libmisc/utmp.c (for Debian in the source of the
login package) line 301 the comment for
* setutmp - Update an entry in utmp and log an entry in wtmp
* Return 1 on failure and 0 on success.
/var/run/utmp is updated first immediately followed by writing the log by calling
updwtmp() (if PAM if used, PAM writes the log). In both cases
both the information is written explicitly and not synced, so your point 2 is not relevant.
To find this on a Debian system. First guess who could do the writing (kernel,
login command). Search
wtmp strings in kernel doesn't give much info. So use
dpkg -S $(which login) to find the package name where
login comes from and google for
debian login package. That will lead you to
shadow*.tar.gz in those sources you will find the code that writes