Status: OUT
The SSTable write path has two independent fragility points: sorted key order is the caller's responsibility with no enforcement (violation silently corrupts binary search), and the file header is written as a placeholder then patched via seek-back after all entries are written (a crash between data write and header patch leaves a structurally invalid file).
Both the invariant contract and the write protocol have independent unguarded failure modes
Depends on (SL): sstable-sorted-order-caller-responsibility, sstable-writer-append-then-patch