UBIFS robustness questions

[Charles Manning]

This is probably documented somewhere but I could not find it...

What operations in UBIFS are robust to power failure and which are not?

I know for example that writing a file into flash does not mean it has been 
completely written to flash until after a sync, but what about other 
operations such as mv?

The reasonn I'm asking this is that I want to be able to "hot-swap" a 
directory of files without losing any file state.

What I'm considerings doing is something like:

Start with ~/runtime having a sane set of files

untar etc into ~/updated
sync
mv ~/updated ~/run-time
sync

What is unacceptable is that, at any time, a power failure/reboot results in 
~/runtime having a non-sane set of files.

* Does the above sequence look safe?
* Is the second sync required?


TIA

-- Charles