An append-only log every change is written and fsynced to before the data files are updated, so a crash can be replayed safely.