[beinan]

Summary

Recoverable ingestion clients need to persist exact pending requests and ACK checkpoints. Synchronizing a separate file for every writer can put many storage barriers on that path. Add an optional local latest-value journal backed by the existing pinned raft-engine, so independent writers can share a durable batch while retaining their retry identities.

The component binds scope, keys and settings, bounds queued/live-state bytes, reserves rewrite space, and fences every handle after mutation failure. Payload parts stay shared until engine-value assembly. Callers still supply producer ordering, ownership and recovery validation; this does not enable an HTTP SDK or replace the server's durable quorum ACK.

Refs #378.

Testing

• Standalone optional-feature library check and Clippy.
• Seven journal tests passed, including cancellation and sync-failure fencing, relative-directory recovery, concurrent reclamation, and actual subprocess kills before/after rewrite sync. The ignored child fixture is invoked by its parent test.
• Full local CI helper: workspace formatting, Clippy and all-target tests; Python pytest, Ruff and Pyright, with the server and editable Rust bindings built and CI mode enabled (Python: 229 passed, 2 optional skips, 1 existing xfail).

The tests cover retained-file process recovery. They do not establish storage power-loss guarantees, distributed producer ownership or end-to-end ingestion throughput.