Function write_catalog 

pub fn write_catalog(
    path: &Path,
    catalog: &Catalog,
) -> Result<(), Box<dyn Error>>

Writes the catalog atomically (.tmp → fsync → rename, via write_atomic), inheriting the permissions of the file it replaces so .tmp is never briefly world-readable (see docs/format.md, “Zapis, kolejność kluczy, uprawnienia”). Refuses first, via assert_catalog_readable, leaving the file on disk untouched.