Append-only durable run records.

A journal is never reopened with truncate semantics. Every acknowledged append is flushed before returning. Earlier corruption and sequence gaps are errors; a single torn final line is quarantined before the next append.