File renaming should be the last operation of an atomic write

That way there is just no possible race conditions.

cc @wisq