i suspect /run/fsck is maintained by systemd-fsck
audit needs to be able to rename log files
fsck maintains systemd-fsck run files
journalctl creates unix stream sockets
journalctl flushing logs (requires journald.unit_object service stop;)
systemd lists and reads fsck run
journalctl stream connects to systemd