Keep track of successfully applied ops to enable resume after an error.
When resuming, the journal must match the previous run’s non-delete op sequence (including op hashes).