A record's canonical DAG-CBOR is appended to `records/pds.heap` as a framed body and the journal carries `RecordStored` — the three names, the content identifier and the slot — instead of the value. Bytes reach the medium before the fact that names them, so a crash between the two costs bodies nothing names, which the next boot reclaims; a slot past the end of the heap is a torn tail and the record is dropped, and a slot back inside it after one past the end is refused. Change-Id: I6ec51e0e8672aecb933dbfa80e52be585044fc14 (cherry picked from commit ca0f8521f7efdc497e3b83847d0961628c12ff6c)