> The only part that really needs to be atomic is the metadata update. That's not usually a problem so long as your on-disk inodes, or at least those fields relating to top-level data block allocation, fit within one physical sector:
They don't and that's not how atomicity is guaranteed. Atomicity is guaranteed via the journal.
> This does assume _complete_ replacement, i.e. O_ATOMIC implies O_TRUNC.
Not really, actually. You merely have to ensure that the old state / blocks remain valid, so you have to do all writes to new blocks.