diff --git a/OneSignal-KMP-SDK b/OneSignal-KMP-SDK
index 6c6bb902f..0513bf563 160000
--- a/OneSignal-KMP-SDK
+++ b/OneSignal-KMP-SDK
@@ -1 +1 @@
-Subproject commit 6c6bb902f1011307f56e4a18ea297539de68d88d
+Subproject commit 0513bf56367c76439cb33f40a9d28723a2874f0c
diff --git a/iOS_SDK/OneSignalSDK/OneSignal.xcodeproj/project.pbxproj b/iOS_SDK/OneSignalSDK/OneSignal.xcodeproj/project.pbxproj
index a76259a58..6077cdd24 100644
--- a/iOS_SDK/OneSignalSDK/OneSignal.xcodeproj/project.pbxproj
+++ b/iOS_SDK/OneSignalSDK/OneSignal.xcodeproj/project.pbxproj
@@ -83,6 +83,7 @@
 		A5048F01A1B2C3D4E5F6000A /* OSFeatureFlagsTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = A5048F01A1B2C3D4E5F60009 /* OSFeatureFlagsTests.swift */; };
 		A5048F01A1B2C3D4E5F6100B /* OSFeatureFlagsRefreshServiceTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = A5048F01A1B2C3D4E5F6100A /* OSFeatureFlagsRefreshServiceTests.swift */; };
 		C781A33FED62B4B54221A09A /* OSLogCrashHandlerTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 3B6A59620B83538CEFF77269 /* OSLogCrashHandlerTests.swift */; };
+		32D3A6EA8AD44274B5CE378A /* FileLogStoreRetentionTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9CC252C94ECB485E8D0380E9 /* FileLogStoreRetentionTests.swift */; };
 		B96A3B6BA8CC49EE4796D9BF /* OSRemoteLoggingController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8A72F938F8A3808AC1FF7F3C /* OSRemoteLoggingController.swift */; };
 		25898119922BDCDA7AF0B9CC /* OSRemoteLoggingController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8A72F938F8A3808AC1FF7F3C /* OSRemoteLoggingController.swift */; };
 		9EAF92032D0429FA35E04417 /* OSRemoteLoggingController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8A72F938F8A3808AC1FF7F3C /* OSRemoteLoggingController.swift */; };
@@ -1816,6 +1817,7 @@
 		A5048F01A1B2C3D4E5F60009 /* OSFeatureFlagsTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OSFeatureFlagsTests.swift; sourceTree = "<group>"; };
 		A5048F01A1B2C3D4E5F6100A /* OSFeatureFlagsRefreshServiceTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OSFeatureFlagsRefreshServiceTests.swift; sourceTree = "<group>"; };
 		3B6A59620B83538CEFF77269 /* OSLogCrashHandlerTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OSLogCrashHandlerTests.swift; sourceTree = "<group>"; };
+		9CC252C94ECB485E8D0380E9 /* FileLogStoreRetentionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FileLogStoreRetentionTests.swift; sourceTree = "<group>"; };
 		8A72F938F8A3808AC1FF7F3C /* OSRemoteLoggingController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OSRemoteLoggingController.swift; sourceTree = "<group>"; };
 		7C91A2B0D84F1E9A3C5B6D8E /* OSRemoteLoggingConfiguration.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OSRemoteLoggingConfiguration.swift; sourceTree = "<group>"; };
 		C0462F96E1AADF655F3B3765 /* OSRemoteLoggingController.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = OSRemoteLoggingController.h; sourceTree = "<group>"; };
@@ -2608,6 +2610,7 @@
 				A5048F01A1B2C3D4E5F60009 /* OSFeatureFlagsTests.swift */,
 				A5048F01A1B2C3D4E5F6100A /* OSFeatureFlagsRefreshServiceTests.swift */,
 				3B6A59620B83538CEFF77269 /* OSLogCrashHandlerTests.swift */,
+				9CC252C94ECB485E8D0380E9 /* FileLogStoreRetentionTests.swift */,
 				3C23A21A2FCE0A52001D32E3 /* OneSignalIdentifiersFallbackTests.swift */,
 				3C23A21E2FCE0AA1001D32E3 /* OSResilientStorageTests.swift */,
 				3C23A21C2FCE0A83001D32E3 /* OSModelStoreRefreshTests.swift */,
@@ -4655,6 +4658,7 @@
 				A5048F01A1B2C3D4E5F6000A /* OSFeatureFlagsTests.swift in Sources */,
 				A5048F01A1B2C3D4E5F6100B /* OSFeatureFlagsRefreshServiceTests.swift in Sources */,
 				C781A33FED62B4B54221A09A /* OSLogCrashHandlerTests.swift in Sources */,
+				32D3A6EA8AD44274B5CE378A /* FileLogStoreRetentionTests.swift in Sources */,
 				3C23A21B2FCE0A52001D32E3 /* OneSignalIdentifiersFallbackTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
diff --git a/iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/Logging/FileLogStore.swift b/iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/Logging/FileLogStore.swift
index e70dbc73c..f4f6b6da9 100644
--- a/iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/Logging/FileLogStore.swift
+++ b/iOS_SDK/OneSignalSDK/OneSignalOSCore/Source/Logging/FileLogStore.swift
@@ -32,35 +32,79 @@ import OneSignalCore
 
 /// Persists encoded crash logs so they can be uploaded after the app restarts.
 ///
-/// Writes are synchronous and durable because fatal handlers may terminate the
-/// process immediately after `save` returns. Directory scans and cleanup run on
-/// a utility queue to keep disk I/O off the caller.
+/// A bounded cache, not a queue: retention decisions come from `CrashRetention` in the shared
+/// module, so iOS and Android reclaim identically and this type contributes only the file I/O.
 final class FileLogStore: ILogFileStore {
-    /// Complete records use `.otlp`; interrupted durable writes leave
-    /// `.otlp.tmp` files that are safe to reap after the minimum-age gate.
-    private static let ownedFileSuffix = ".otlp"
-    private static let temporaryFileSuffix = ".otlp.tmp"
+    /// Taken from the policy rather than restated, so what this store writes cannot drift out of
+    /// what `isOwned` accepts; a mismatch would hide brand-new records from every reader.
+    private static let ownedFileSuffix = CrashRetention.shared.defaultPolicy.ownedSuffix
+    private static let temporaryFileSuffix = ownedFileSuffix + ".tmp"
     private static let queueLabel = "com.onesignal.logger.file-store"
 
+    /// Kotlin default arguments do not cross the Objective-C boundary, so every selector call
+    /// must pass this explicitly.
+    private static let retentionPolicy = CrashRetention.shared.defaultPolicy
+
+    /// Reads the attributes a `CrashDirEntry` is built from. Injectable because unreadable
+    /// attributes cannot be staged on a real filesystem: revoking access fails the listing.
+    typealias AttributeLookup = (URL) -> URLResourceValues?
+
+    static let defaultAttributeLookup: AttributeLookup = { url in
+        try? url.resourceValues(forKeys: [
+            .contentModificationDateKey,
+            .fileSizeKey,
+            .isRegularFileKey
+        ])
+    }
+
     private let rootURL: URL
     private let fileManager: FileManager
+    private let attributeLookup: AttributeLookup
+    /// Crash-path diagnostics; `OneSignalLog` would fan out to app listeners and the remote sink.
+    private let crashWarn: (String) -> Void
     private let ioQueue = DispatchQueue(label: queueLabel, qos: .utility)
+    private let inFlightLock = NSLock()
+    private var inFlightNames = Set<String>()
 
-    init(rootPath: String, fileManager: FileManager = .default) {
+    init(
+        rootPath: String,
+        fileManager: FileManager = .default,
+        crashWarn: ((String) -> Void)? = nil,
+        attributeLookup: @escaping AttributeLookup = FileLogStore.defaultAttributeLookup
+    ) {
         self.rootURL = URL(fileURLWithPath: rootPath, isDirectory: true)
         self.fileManager = fileManager
+        let crashLogger = OSCrashLogger()
+        self.crashWarn = crashWarn ?? { crashLogger.warn(message: $0) }
+        self.attributeLookup = attributeLookup
         try? createRootDirectory()
     }
 
+    /// Runs synchronously on the crashing thread and must not throw: a fatal handler may
+    /// terminate the process the moment this returns.
     func save(bytes: KotlinByteArray) -> Bool {
         guard bytes.size > 0 else {
             return false
         }
+        // Refuse rather than store-then-reclaim: an over-limit record would claim the whole
+        // shared budget or be evicted before it could upload.
+        guard Int64(bytes.size) <= Self.retentionPolicy.maxRecordBytes else {
+            crashWarn(
+                "FileLogStore refusing record of \(bytes.size) bytes, over the "
+                    + "\(Self.retentionPolicy.maxRecordBytes)-byte limit"
+            )
+            return false
+        }
         do {
             try createRootDirectory()
             let timestamp = Int64(Date().timeIntervalSince1970 * 1_000)
             let id = "\(timestamp)-\(UUID().uuidString)\(Self.ownedFileSuffix)"
-            try writeDurably(bytes.data, to: rootURL.appendingPathComponent(id))
+            let targetURL = rootURL.appendingPathComponent(id)
+            let tmpName = targetURL.appendingPathExtension("tmp").lastPathComponent
+            try withInFlightNames([id, tmpName]) {
+                try writeDurably(bytes.data, to: targetURL)
+                enforceAccumulationCaps(keepName: id)
+            }
             return true
         } catch {
             return false
@@ -114,13 +158,23 @@ final class FileLogStore: ILogFileStore {
         ioQueue.async {
             var deleted = 0
             do {
-                for url in try self.fileURLs()
-                    where url.lastPathComponent.hasSuffix(Self.temporaryFileSuffix) {
-                    guard try self.isOldEnough(url, minAgeMillis: minAgeMillis) else {
-                        continue
+                // The only scan that runs when remote logging is disabled, so it is the sole
+                // chance to bound a directory `listReadable` never touches.
+                _ = self.reclaim(entries: try self.directoryEntries())
+
+                // Deliberately narrower than the shared `selectUnrecognized`: iOS never ran the
+                // OpenTelemetry pipeline, so the only reapable foreign files are this store's own
+                // interrupted writes, and never one it currently has in flight.
+                let now = Self.nowMillis()
+                let inFlight = self.snapshotInFlightNames()
+                for entry in try self.directoryEntries()
+                    where entry.name.hasSuffix(Self.temporaryFileSuffix)
+                    && !inFlight.contains(entry.name)
+                    && Self.hasReachedMinAge(entry, now: now, minAgeMillis: minAgeMillis) {
+                    // Per-entry, so one undeletable leftover cannot strand the rest of the sweep.
+                    if self.remove(name: entry.name) {
+                        deleted += 1
                     }
-                    try self.fileManager.removeItem(at: url)
-                    deleted += 1
                 }
             } catch {
                 OneSignalLog.onesignalLog(
@@ -133,36 +187,181 @@ final class FileLogStore: ILogFileStore {
     }
 
     private func readableEntries(minAgeMillis: Int64) throws -> [StoredLogFile] {
-        try fileURLs()
-            .filter { $0.lastPathComponent.hasSuffix(Self.ownedFileSuffix) }
-            .filter { try isOldEnough($0, minAgeMillis: minAgeMillis) }
-            .compactMap { url in
+        let entries = try directoryEntries()
+        // Reclaim first so payloads are only materialized for records that survive both bounds.
+        let reclaimed = reclaim(entries: entries)
+        let now = Self.nowMillis()
+
+        return entries
+            .filter { CrashRetention.shared.isOwned(name: $0.name, policy: Self.retentionPolicy) }
+            .filter { !reclaimed.contains($0.name) }
+            .filter { Self.hasReachedMinAge($0, now: now, minAgeMillis: minAgeMillis) }
+            .compactMap { entry in
+                let url = rootURL.appendingPathComponent(entry.name)
                 guard let data = try? Data(contentsOf: url) else {
                     return nil
                 }
-                return StoredLogFile(id: url.lastPathComponent, bytes: data.kotlinByteArray)
+                return StoredLogFile(id: entry.name, bytes: data.kotlinByteArray)
             }
     }
 
-    private func fileURLs() throws -> [URL] {
+    /// Whether [entry] is known to have existed for at least [minAgeMillis].
+    ///
+    /// An entry nothing can date returns false: an unreadable timestamp is not evidence of age,
+    /// so the record is withheld rather than uploaded or reaped, and the caps still bound it.
+    private static func hasReachedMinAge(
+        _ entry: CrashDirEntry,
+        now: Int64,
+        minAgeMillis: Int64
+    ) -> Bool {
+        guard let writtenMs = CrashRetention.shared.effectiveWriteTimeMs(entry: entry)?.int64Value else {
+            return false
+        }
+        return now - writtenMs >= max(0, minAgeMillis)
+    }
+
+    /// Applies the shared retention policy and deletes what it selects.
+    ///
+    /// - Returns: names to withhold from readers, including any whose unlink failed: a record
+    ///   past the ceiling must not be uploaded even if it could not be removed.
+    private func reclaim(entries: [CrashDirEntry]) -> Set<String> {
+        let now = Self.nowMillis()
+        var withheld = Set<String>()
+
+        let inFlight = snapshotInFlightNames()
+        let expired = CrashRetention.shared.selectExpiredOwned(
+            entries: entries,
+            nowMs: now,
+            policy: Self.retentionPolicy
+        )
+        for entry in expired where !inFlight.contains(entry.name) {
+            withheld.insert(entry.name)
+            remove(name: entry.name)
+        }
+
+        // Survivors only, per the ILogFileStore contract: an expired record still in the listing
+        // would consume a count slot and byte budget it is about to give back.
+        let survivors = entries.filter { !withheld.contains($0.name) }
+        let overflow = CrashRetention.shared.selectOverflowOwned(
+            entries: survivors,
+            nowMs: now,
+            // Every in-flight name: evicting one corrupts a crash being captured right now.
+            keepNames: inFlight,
+            policy: Self.retentionPolicy
+        )
+        for entry in overflow where !inFlight.contains(entry.name) {
+            withheld.insert(entry.name)
+            remove(name: entry.name)
+        }
+
+        if !withheld.isEmpty {
+            OneSignalLog.onesignalLog(
+                .LL_DEBUG,
+                message: "FileLogStore reclaimed \(expired.count) expired and "
+                    + "\(overflow.count) over-cap record(s)"
+            )
+        }
+        return withheld
+    }
+
+    /// Reserves every in-flight name, not just [keepName]: this path unlinks whatever the selector
+    /// returns without re-checking, so an unnamed sibling's record really is deleted. Runs inline
+    /// on the crashing thread, so the `isWithinCaps` guard is what keeps the sort out of the
+    /// steady state. Overflow only; expiry is left to the uploader passes.
+    private func enforceAccumulationCaps(keepName: String) {
+        guard let entries = try? directoryEntries() else {
+            return
+        }
+        guard !CrashRetention.shared.isWithinCaps(
+            entries: entries,
+            policy: Self.retentionPolicy
+        ) else {
+            return
+        }
+        let overflow = CrashRetention.shared.selectOverflowOwned(
+            entries: entries,
+            nowMs: Self.nowMillis(),
+            keepNames: snapshotInFlightNames().union([keepName]),
+            policy: Self.retentionPolicy
+        )
+        for entry in overflow {
+            remove(name: entry.name, crashSafe: true)
+        }
+    }
+
+    /// - Returns: whether the file is gone. An already-removed file counts as success, since
+    ///   crash-path eviction and the async reclaim can target the same name.
+    @discardableResult
+    private func remove(name: String, crashSafe: Bool = false) -> Bool {
+        do {
+            try fileManager.removeItem(at: rootURL.appendingPathComponent(name))
+            return true
+        } catch {
+            if fileLogStoreIsAlreadyRemoved(error) {
+                return true
+            }
+            let message = "FileLogStore failed to reclaim \(name): \(error.localizedDescription)"
+            if crashSafe {
+                crashWarn(message)
+            } else {
+                OneSignalLog.onesignalLog(.LL_WARN, message: message)
+            }
+            return false
+        }
+    }
+
+    /// Attributes are routinely unreadable before first unlock, so the entry is kept: omitting it
+    /// would put the file outside every bound at once. A missing mtime must stay `nil`, never a
+    /// stand-in the policy reads back as an age. Entries are dropped only when `isRegularFile`
+    /// is known false.
+    private func directoryEntries() throws -> [CrashDirEntry] {
         guard fileManager.fileExists(atPath: rootURL.path) else {
             return []
         }
         return try fileManager.contentsOfDirectory(
             at: rootURL,
-            includingPropertiesForKeys: [.contentModificationDateKey, .isRegularFileKey],
+            includingPropertiesForKeys: [
+                .contentModificationDateKey,
+                .fileSizeKey,
+                .isRegularFileKey
+            ],
             options: [.skipsHiddenFiles]
-        ).filter {
-            (try? $0.resourceValues(forKeys: [.isRegularFileKey]).isRegularFile) == true
+        ).compactMap { url in
+            let values = attributeLookup(url)
+            if values?.isRegularFile == false {
+                return nil
+            }
+            let name = url.lastPathComponent
+            return CrashDirEntry(
+                name: name,
+                lastModifiedMs: values?.contentModificationDate.map {
+                    KotlinLong(longLong: Int64($0.timeIntervalSince1970 * 1_000))
+                },
+                lengthBytes: Int64(values?.fileSize ?? 0)
+            )
         }
     }
 
-    private func isOldEnough(_ url: URL, minAgeMillis: Int64) throws -> Bool {
-        let values = try url.resourceValues(forKeys: [.contentModificationDateKey])
-        guard let modifiedAt = values.contentModificationDate else {
-            return false
+    private static func nowMillis() -> Int64 {
+        Int64(Date().timeIntervalSince1970 * 1_000)
+    }
+
+    private func withInFlightNames(_ names: [String], _ body: () throws -> Void) rethrows {
+        inFlightLock.lock()
+        inFlightNames.formUnion(names)
+        inFlightLock.unlock()
+        defer {
+            inFlightLock.lock()
+            inFlightNames.subtract(names)
+            inFlightLock.unlock()
         }
-        return Date().timeIntervalSince(modifiedAt) * 1_000 >= Double(max(0, minAgeMillis))
+        try body()
+    }
+
+    private func snapshotInFlightNames() -> Set<String> {
+        inFlightLock.lock()
+        defer { inFlightLock.unlock() }
+        return inFlightNames
     }
 
     private func isSafeEntryId(_ id: String) -> Bool {
@@ -233,3 +432,12 @@ final class FileLogStore: ILogFileStore {
         }
     }
 }
+
+private func fileLogStoreIsAlreadyRemoved(_ error: Error) -> Bool {
+    let nsError = error as NSError
+    if nsError.domain == NSCocoaErrorDomain {
+        return nsError.code == CocoaError.fileNoSuchFile.rawValue
+            || nsError.code == CocoaError.fileReadNoSuchFile.rawValue
+    }
+    return nsError.domain == NSPOSIXErrorDomain && nsError.code == Int(ENOENT)
+}
diff --git a/iOS_SDK/OneSignalSDK/OneSignalOSCoreTests/FileLogStoreRetentionTests.swift b/iOS_SDK/OneSignalSDK/OneSignalOSCoreTests/FileLogStoreRetentionTests.swift
new file mode 100644
index 000000000..0bff3f8c3
--- /dev/null
+++ b/iOS_SDK/OneSignalSDK/OneSignalOSCoreTests/FileLogStoreRetentionTests.swift
@@ -0,0 +1,673 @@
+/*
+ Modified MIT License
+
+ Copyright 2026 OneSignal
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ 1. The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ 2. All copies of substantial portions of the Software may only be used in connection
+ with services provided by OneSignal.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+ */
+
+import Foundation
+import OneSignalCore
+import OneSignalKMP
+@testable import OneSignalOSCore
+import XCTest
+
+/// A scratch crash directory and the staging every file-store suite needs.
+class FileLogStoreTestCase: XCTestCase {
+    fileprivate var temporaryDirectory: URL!
+
+    override func setUpWithError() throws {
+        temporaryDirectory = FileManager.default.temporaryDirectory
+            .appendingPathComponent(UUID().uuidString, isDirectory: true)
+        try FileManager.default.createDirectory(at: temporaryDirectory, withIntermediateDirectories: true)
+    }
+
+    override func tearDownWithError() throws {
+        // A test may have made the directory read-only; restore it or the fixture outlives the run.
+        try? FileManager.default.setAttributes(
+            [.posixPermissions: 0o700],
+            ofItemAtPath: temporaryDirectory.path
+        )
+        try? FileManager.default.removeItem(at: temporaryDirectory)
+    }
+}
+
+/// The bounds that keep the crash directory a bounded cache rather than a queue. The policy
+/// decisions themselves are unit-tested in the shared module.
+final class FileLogStoreRetentionTests: FileLogStoreTestCase {
+    // MARK: - write-time size limit
+
+    func testRefusesPayloadOverThePerRecordLimit() {
+        let store = makeStore()
+        let oversized = Data(count: Int(CrashRetention.shared.defaultPolicy.maxRecordBytes) + 1)
+
+        XCTAssertFalse(store.save(bytes: oversized.kotlinByteArray))
+        XCTAssertEqual(ownedFileNames().count, 0)
+    }
+
+    func testAcceptsPayloadAtTheLimit() {
+        let store = makeStore()
+        let atLimit = Data(count: Int(CrashRetention.shared.defaultPolicy.maxRecordBytes))
+
+        XCTAssertTrue(store.save(bytes: atLimit.kotlinByteArray))
+        XCTAssertEqual(ownedFileNames().count, 1)
+    }
+
+    // MARK: - age ceiling
+
+    func testListReadableDropsAndDeletesRecordsPastTheAgeCeiling() throws {
+        let ceiling = CrashRetention.shared.defaultPolicy.maxReadAgeMillis
+        try writeRecord(named: "expired.otlp", ageMillis: ceiling + 60_000)
+        try writeRecord(named: "fresh.otlp", ageMillis: 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        XCTAssertEqual(readable.map { $0.id }, ["fresh.otlp"])
+        XCTAssertFalse(fileExists("expired.otlp"))
+        XCTAssertTrue(fileExists("fresh.otlp"))
+    }
+
+    func testRecordInsideTheAgeWindowIsRetained() throws {
+        let ceiling = CrashRetention.shared.defaultPolicy.maxReadAgeMillis
+        try writeRecord(named: "edge.otlp", ageMillis: ceiling - 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        XCTAssertEqual(readable.map { $0.id }, ["edge.otlp"])
+        XCTAssertTrue(fileExists("edge.otlp"))
+    }
+
+    func testExpiredRecordThatCannotBeDeletedIsStillWithheldFromReaders() throws {
+        // Withholding must not be contingent on the delete succeeding.
+        let ceiling = CrashRetention.shared.defaultPolicy.maxReadAgeMillis
+        try writeRecord(named: "expired-stuck.otlp", ageMillis: ceiling + 60_000)
+        try writeRecord(named: "fresh.otlp", ageMillis: 60_000)
+        // Denying directory writes fails the unlink without making the entries unreadable.
+        try FileManager.default.setAttributes(
+            [.posixPermissions: 0o500],
+            ofItemAtPath: temporaryDirectory.path
+        )
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        // Premise, not behavior: if the removal went through, this re-covers ordinary expiry.
+        XCTAssertTrue(fileExists("expired-stuck.otlp"))
+        XCTAssertEqual(readable.map { $0.id }, ["fresh.otlp"])
+    }
+
+    // MARK: - accumulation caps
+
+    func testListReadableReclaimsAnInheritedOverCapBacklog() throws {
+        // The upgrade case: a directory written by a build with no caps, trimmed on the first
+        // uploader pass rather than waiting for the next crash.
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        for index in 0..<(max + 10) {
+            try writeRecord(named: "seed-\(index).otlp", ageMillis: Int64(1_000 * (index + 1)))
+        }
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        XCTAssertEqual(readable.count, max)
+        XCTAssertEqual(ownedFileNames().count, max)
+    }
+
+    func testSaveEvictsOldestFirstPastTheCountCap() throws {
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        for index in 0..<max {
+            try writeRecord(named: "seed-\(index).otlp", ageMillis: Int64(1_000 * (index + 1)))
+        }
+        let oldest = "seed-\(max - 1).otlp"
+
+        XCTAssertTrue(makeStore().save(bytes: Data("new".utf8).kotlinByteArray))
+
+        XCTAssertEqual(ownedFileNames().count, max)
+        XCTAssertFalse(fileExists(oldest))
+        XCTAssertTrue(fileExists("seed-0.otlp"))
+    }
+
+    func testSaveEvictsOldestFirstPastTheTotalByteCap() throws {
+        // Each record sits just under the per-record cap, so only the byte budget can breach.
+        let policy = CrashRetention.shared.defaultPolicy
+        let nearCap = Int(policy.maxRecordBytes) - 12_288
+        for index in 0..<5 {
+            try writeRecord(
+                named: "big-\(index).otlp",
+                ageMillis: Int64(10_000 * (index + 1)),
+                bytes: nearCap
+            )
+        }
+
+        XCTAssertTrue(makeStore().save(bytes: Data("new".utf8).kotlinByteArray))
+
+        XCTAssertEqual(ownedFileNames().count, 5)
+        XCTAssertFalse(fileExists("big-4.otlp"))
+        XCTAssertTrue(fileExists("big-0.otlp"))
+    }
+
+    /// A backlog dated ahead of the clock ties with the new record on both sort keys, so without
+    /// the `keepNames` reservation eviction is a coin flip. The repeat drives a false pass to nil.
+    func testSaveNeverEvictsTheRecordItJustWroteWhateverOrderTheBacklogListsIn() throws {
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+
+        for _ in 0..<25 {
+            for name in try FileManager.default.contentsOfDirectory(atPath: temporaryDirectory.path) {
+                try FileManager.default.removeItem(at: temporaryDirectory.appendingPathComponent(name))
+            }
+            for index in 0..<(max + 3) {
+                let ahead = Int64(Date().timeIntervalSince1970 * 1_000) + 3_600_000 + Int64(index)
+                try writeRecord(named: "\(ahead)-seed\(index).otlp", ageMillis: -60_000, bytes: 1)
+            }
+
+            XCTAssertTrue(makeStore().save(bytes: Data("new".utf8).kotlinByteArray))
+
+            let survivors = ownedFileNames()
+            XCTAssertEqual(survivors.count, max)
+            // The just-written record is the only one whose name has no "seed" marker.
+            XCTAssertEqual(survivors.filter { !$0.contains("seed") }.count, 1)
+        }
+    }
+
+    // MARK: - shared-policy coupling
+
+    func testWrittenRecordsUseTheSharedPolicySuffix() {
+        // Drift from `ownedSuffix` would make every brand-new record invisible to readers.
+        XCTAssertTrue(makeStore().save(bytes: Data("new".utf8).kotlinByteArray))
+
+        let policy = CrashRetention.shared.defaultPolicy
+        let written = (try? FileManager.default.contentsOfDirectory(atPath: temporaryDirectory.path)) ?? []
+        XCTAssertEqual(written.count, 1)
+        let name = written.first ?? ""
+        XCTAssertTrue(name.hasSuffix(policy.ownedSuffix))
+        XCTAssertTrue(CrashRetention.shared.isOwned(name: name, policy: policy))
+    }
+
+    // MARK: - foreign entries
+
+    func testDeleteUnrecognizedReapsOnlyThisStoresInterruptedWrites() throws {
+        // Narrower than the shared selector on purpose: only our own `.otlp.tmp` is reclaimed.
+        try writeRecord(named: "owned.otlp", ageMillis: 60_000)
+        try writeRecord(named: "unowned", ageMillis: 60_000)
+        try writeRecord(named: "interrupted.otlp.tmp", ageMillis: 60_000)
+
+        let deleted = try awaitDeleteUnrecognized(minAgeMillis: 0)
+
+        XCTAssertEqual(deleted, 1)
+        XCTAssertTrue(fileExists("owned.otlp"))
+        XCTAssertTrue(fileExists("unowned"))
+        XCTAssertFalse(fileExists("interrupted.otlp.tmp"))
+    }
+
+    func testDeleteUnrecognizedPreservesTooYoungInterruptedWrites() throws {
+        // The write may still be in flight; the age gate protects it.
+        try writeRecord(named: "just-written.otlp.tmp", ageMillis: 100)
+
+        let deleted = try awaitDeleteUnrecognized(minAgeMillis: 5_000)
+
+        XCTAssertEqual(deleted, 0)
+        XCTAssertTrue(fileExists("just-written.otlp.tmp"))
+    }
+
+    func testDeleteUnrecognizedAlsoBoundsAnOverCapBacklog() throws {
+        // The only scan that runs when remote logging is disabled.
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        for index in 0..<(max + 10) {
+            try writeRecord(named: "seed-\(index).otlp", ageMillis: Int64(1_000 * (index + 1)))
+        }
+
+        _ = try awaitDeleteUnrecognized(minAgeMillis: 0)
+
+        XCTAssertEqual(ownedFileNames().count, max)
+    }
+
+    func testDirectoryNamedLikeARecordIsNotTreatedAsOne() throws {
+        try FileManager.default.createDirectory(
+            at: temporaryDirectory.appendingPathComponent("folder.otlp"),
+            withIntermediateDirectories: true
+        )
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        XCTAssertEqual(readable.map { $0.id }, [])
+        XCTAssertTrue(fileExists("folder.otlp"))
+    }
+
+    // MARK: - crash-path logging
+
+    func testSaveDoesNotFanOutThroughOneSignalLogWhenRefusingAnOversizedRecord() {
+        let listener = FileLogStoreLogListener()
+        OneSignalLog.debug().__add(listener)
+        defer { OneSignalLog.debug().__remove(listener) }
+        var crashWarnings: [String] = []
+        let oversized = Data(count: Int(CrashRetention.shared.defaultPolicy.maxRecordBytes) + 1)
+
+        XCTAssertFalse(
+            makeStore(crashWarn: { crashWarnings.append($0) })
+                .save(bytes: oversized.kotlinByteArray)
+        )
+
+        XCTAssertTrue(listener.entries.isEmpty)
+        XCTAssertEqual(crashWarnings.count, 1)
+        XCTAssertTrue(crashWarnings[0].contains("refusing record"))
+    }
+
+    // MARK: - concurrent reclaim
+
+    func testAlreadyRemovedFileIsASuccessfulCleanup() throws {
+        try writeRecord(named: "interrupted.otlp.tmp", ageMillis: 60_000)
+
+        let deleted = try awaitDeleteUnrecognized(
+            minAgeMillis: 0,
+            fileManager: FileLogStoreMissingItemFileManager()
+        )
+
+        XCTAssertEqual(deleted, 1)
+    }
+
+    func testReclaimReachesTheCapWhileSeveralRecordsAreInFlight() throws {
+        // A scan racing two concurrent writes must name both to the selector, or it spends an
+        // eviction slot on a file the reclaim loop then refuses to unlink and stays over cap.
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        // Dating the backlog ahead clamps every seed to "now", putting the in-flight records last
+        // in the eviction order so the selector really reaches for them.
+        for index in 0..<max {
+            let ahead = Self.nowMillis() + 3_600_000 + Int64(index)
+            try writeRecord(named: "\(ahead)-seed\(index).otlp", ageMillis: -3_600_000, bytes: 1)
+        }
+
+        let fileManager = FileLogStoreMoveBarrierFileManager()
+        let store = FileLogStore(rootPath: temporaryDirectory.path, fileManager: fileManager)
+        let parked = expectation(description: "both writes parked")
+        parked.expectedFulfillmentCount = 2
+        let release = DispatchSemaphore(value: 0)
+        let parkedLock = NSLock()
+        var parkedNames = Set<String>()
+        fileManager.onMoved = { url in
+            parkedLock.lock()
+            parkedNames.insert(url.lastPathComponent)
+            parkedLock.unlock()
+            parked.fulfill()
+            XCTAssertEqual(release.wait(timeout: .now() + 10), .success)
+        }
+
+        let saved = expectation(description: "both writes complete")
+        saved.expectedFulfillmentCount = 2
+        for _ in 0..<2 {
+            DispatchQueue.global().async {
+                XCTAssertTrue(store.save(bytes: Data("new".utf8).kotlinByteArray))
+                saved.fulfill()
+            }
+        }
+        wait(for: [parked], timeout: 10)
+
+        // Same store, so the scan sees the in-flight set the two parked writes are holding.
+        let listed = expectation(description: "listReadable")
+        store.listReadable(minAgeMillis: 0) { _, _ in listed.fulfill() }
+        wait(for: [listed], timeout: 10)
+        let survivors = Set(ownedFileNames())
+
+        release.signal()
+        release.signal()
+        wait(for: [saved], timeout: 10)
+
+        parkedLock.lock()
+        let inFlight = parkedNames
+        parkedLock.unlock()
+        XCTAssertEqual(inFlight.count, 2)
+        // Premise, not behavior: the reclaim loop skips in-flight names regardless.
+        XCTAssertEqual(inFlight.subtracting(survivors), [])
+        XCTAssertEqual(survivors.count, max)
+    }
+
+    func testSaveDoesNotEvictAnotherThreadsInFlightRecord() throws {
+        // The write path unlinks whatever the selector returns with no in-flight check of its
+        // own, so caps enforcement must not destroy the crash another thread is still capturing.
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        for index in 0..<max {
+            let ahead = Self.nowMillis() + 3_600_000 + Int64(index)
+            try writeRecord(named: "\(ahead)-seed\(index).otlp", ageMillis: -3_600_000, bytes: 1)
+        }
+
+        let fileManager = FileLogStoreMoveBarrierFileManager()
+        let store = FileLogStore(rootPath: temporaryDirectory.path, fileManager: fileManager)
+        let parked = expectation(description: "first write parked")
+        let release = DispatchSemaphore(value: 0)
+        let parkedLock = NSLock()
+        var parkedName: String?
+        fileManager.onMoved = { url in
+            parkedLock.lock()
+            let isFirst = parkedName == nil
+            if isFirst {
+                parkedName = url.lastPathComponent
+            }
+            parkedLock.unlock()
+            guard isFirst else {
+                return
+            }
+            parked.fulfill()
+            XCTAssertEqual(release.wait(timeout: .now() + 10), .success)
+        }
+
+        let saved = expectation(description: "parked write completes")
+        DispatchQueue.global().async {
+            XCTAssertTrue(store.save(bytes: Data("first".utf8).kotlinByteArray))
+            saved.fulfill()
+        }
+        wait(for: [parked], timeout: 10)
+
+        // The parked record sorts oldest, so it is the first thing this write's eviction reaches.
+        XCTAssertTrue(store.save(bytes: Data("second".utf8).kotlinByteArray))
+        parkedLock.lock()
+        let firstRecord = parkedName ?? ""
+        parkedLock.unlock()
+        let survivedItsOwnWrite = fileExists(firstRecord)
+
+        release.signal()
+        wait(for: [saved], timeout: 10)
+
+        XCTAssertFalse(firstRecord.isEmpty)
+        XCTAssertTrue(survivedItsOwnWrite)
+        XCTAssertTrue(fileExists(firstRecord))
+    }
+
+    func testSaveSurvivesATempSweepOfItsInFlightWrite() {
+        let fileManager = FileLogStoreReentrantCleanupFileManager()
+        let store = FileLogStore(rootPath: temporaryDirectory.path, fileManager: fileManager)
+        fileManager.onTemporaryWrite = {
+            let done = DispatchSemaphore(value: 0)
+            store.deleteUnrecognizedEntries(minAgeMillis: 0) { _, _ in done.signal() }
+            XCTAssertEqual(done.wait(timeout: .now() + 5), .success)
+        }
+
+        XCTAssertTrue(store.save(bytes: Data("new".utf8).kotlinByteArray))
+        XCTAssertEqual(ownedFileNames().count, 1)
+        XCTAssertEqual(
+            ((try? FileManager.default.contentsOfDirectory(atPath: temporaryDirectory.path)) ?? [])
+                .filter { $0.hasSuffix(".otlp.tmp") }
+                .count,
+            0
+        )
+    }
+
+}
+
+/// Record dating when the filesystem will not supply a write time. Data protection denies
+/// attributes while the directory still lists, on every reboot until first unlock, so this is
+/// the ordinary Apple case rather than a corner of it.
+final class FileLogStoreRecordDatingTests: FileLogStoreTestCase {
+    // MARK: - reading
+
+    func testRecordWithUnreadableAttributesIsDatedByItsNameAndUploaded() throws {
+        // The state of every record on the first launch after a reboot.
+        let opaque = try writeProductionShapedRecord(ageMillis: 60_000)
+        let fresh = try writeProductionShapedRecord(ageMillis: 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0, attributesUnreadableFor: [opaque])
+
+        XCTAssertTrue(fileExists(opaque))
+        XCTAssertEqual(readable.map { $0.id }.sorted(), [opaque, fresh].sorted())
+    }
+
+    func testRecordWithUnreadableAttributesPastTheCeilingStillExpires() throws {
+        // The fallback must not become an amnesty.
+        let ceiling = CrashRetention.shared.defaultPolicy.maxReadAgeMillis
+        let stale = try writeProductionShapedRecord(ageMillis: ceiling + 60_000)
+        let fresh = try writeProductionShapedRecord(ageMillis: 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0, attributesUnreadableFor: [stale, fresh])
+
+        XCTAssertFalse(fileExists(stale))
+        XCTAssertEqual(readable.map { $0.id }, [fresh])
+    }
+
+    func testFilesystemTimeDecidesWhenBothSourcesAreAvailable() throws {
+        // The name is a fallback, not a second opinion: a rewritten record keeps its original
+        // millis, so a readable timestamp has to win.
+        let ceiling = CrashRetention.shared.defaultPolicy.maxReadAgeMillis
+        let staleName = "\(Self.nowMillis() - ceiling - 60_000)-\(UUID().uuidString).otlp"
+        try writeRecord(named: staleName, ageMillis: 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0)
+
+        XCTAssertEqual(readable.map { $0.id }, [staleName])
+        XCTAssertTrue(fileExists(staleName))
+    }
+
+    func testEntryIsKeptWhenRegularFileBitCannotBeRead() throws {
+        // Keep the entry unless the bit is known false; nil must not discard it.
+        try writeRecord(named: "present.otlp", ageMillis: 60_000)
+        let lookup: FileLogStore.AttributeLookup = { url in
+            guard url.lastPathComponent == "present.otlp" else {
+                return FileLogStore.defaultAttributeLookup(url)
+            }
+            var values = URLResourceValues()
+            values.contentModificationDate = Date(timeIntervalSinceNow: -60)
+            return values
+        }
+
+        let readable = try awaitListReadable(minAgeMillis: 0, attributeLookup: lookup)
+
+        XCTAssertEqual(readable.map { $0.id }, ["present.otlp"])
+        XCTAssertTrue(fileExists("present.otlp"))
+    }
+
+    // MARK: - records nothing can date
+
+    func testUndatableRecordIsWithheldFromReadersRatherThanExpiredOrUploaded() throws {
+        // No millis in the name and no readable timestamp. Deleting it would destroy a crash
+        // report on no evidence; uploading it would claim an age nothing measured.
+        try writeRecord(named: "opaque.otlp", ageMillis: 60_000)
+        let fresh = try writeProductionShapedRecord(ageMillis: 60_000)
+
+        let readable = try awaitListReadable(minAgeMillis: 0, attributesUnreadableFor: ["opaque.otlp"])
+
+        XCTAssertTrue(fileExists("opaque.otlp"))
+        XCTAssertEqual(readable.map { $0.id }, [fresh])
+    }
+
+    func testUndatableRecordsAreStillCountedAndEvictedByTheCaps() throws {
+        // Withholding alone would leak: an entry no age gate can select is bounded only by caps.
+        let max = Int(CrashRetention.shared.defaultPolicy.maxRecordCount)
+        let undatable = (0..<(max + 10)).map { "opaque-\($0).otlp" }
+        for name in undatable {
+            try writeRecord(named: name, ageMillis: 60_000)
+        }
+
+        let readable = try awaitListReadable(
+            minAgeMillis: 0,
+            attributesUnreadableFor: Set(undatable)
+        )
+
+        XCTAssertEqual(readable.count, 0)
+        XCTAssertEqual(ownedFileNames().count, max)
+    }
+
+    // MARK: - the temp sweep
+
+    func testYoungInterruptedWriteWithUnreadableAttributesIsDatedByItsName() throws {
+        // A temp carries the same `{millis}-{uuid}` prefix, so this one is protected by its real
+        // age rather than because the sweep gave up on dating it.
+        let inFlight = try writeProductionShapedRecord(ageMillis: 100, suffix: ".otlp.tmp")
+
+        let deleted = try awaitDeleteUnrecognized(
+            minAgeMillis: 5_000,
+            attributesUnreadableFor: [inFlight]
+        )
+
+        XCTAssertEqual(deleted, 0)
+        XCTAssertTrue(fileExists(inFlight))
+    }
+
+    func testOldInterruptedWriteWithUnreadableAttributesIsReaped() throws {
+        // Its name dates it, so it is reclaimed on the same pass a readable one would be.
+        let abandoned = try writeProductionShapedRecord(ageMillis: 60_000, suffix: ".otlp.tmp")
+
+        let deleted = try awaitDeleteUnrecognized(
+            minAgeMillis: 5_000,
+            attributesUnreadableFor: [abandoned]
+        )
+
+        XCTAssertEqual(deleted, 1)
+        XCTAssertFalse(fileExists(abandoned))
+    }
+
+    func testUndatableInterruptedWriteIsLeftAlone() throws {
+        // Undatable, so it may be a write still in flight: not grounds to delete it.
+        try writeRecord(named: "in-flight.otlp.tmp", ageMillis: 60_000)
+
+        let deleted = try awaitDeleteUnrecognized(
+            minAgeMillis: 0,
+            attributesUnreadableFor: ["in-flight.otlp.tmp"]
+        )
+
+        XCTAssertEqual(deleted, 0)
+        XCTAssertTrue(fileExists("in-flight.otlp.tmp"))
+    }
+}
+
+private extension FileLogStoreTestCase {
+    /// - Parameter attributesUnreadableFor: names whose resource values the store should see as
+    ///   unavailable. This cannot be staged on disk: revoking access fails the listing instead.
+    func makeStore(
+        attributesUnreadableFor denied: Set<String> = [],
+        fileManager: FileManager = .default,
+        crashWarn: ((String) -> Void)? = nil,
+        attributeLookup: FileLogStore.AttributeLookup? = nil
+    ) -> FileLogStore {
+        let lookup = attributeLookup ?? { url in
+            denied.contains(url.lastPathComponent)
+                ? nil
+                : FileLogStore.defaultAttributeLookup(url)
+        }
+        return FileLogStore(
+            rootPath: temporaryDirectory.path,
+            fileManager: fileManager,
+            crashWarn: crashWarn,
+            attributeLookup: lookup
+        )
+    }
+
+    func writeRecord(named name: String, ageMillis: Int64, bytes: Int = 16) throws {
+        let url = temporaryDirectory.appendingPathComponent(name)
+        try Data(count: bytes).write(to: url)
+        let modified = Date(timeIntervalSinceNow: -Double(ageMillis) / 1_000)
+        try FileManager.default.setAttributes([.modificationDate: modified], ofItemAtPath: url.path)
+    }
+
+    /// A record named the way the store names its own: `{millis}-{uuid}.otlp`. Anything asserting
+    /// on dating must use this shape — a name without leading millis cannot reach the name
+    /// fallback and silently tests the undatable path instead.
+    /// - Returns: the generated name.
+    @discardableResult
+    func writeProductionShapedRecord(
+        ageMillis: Int64,
+        bytes: Int = 16,
+        suffix: String = ".otlp"
+    ) throws -> String {
+        let name = "\(Self.nowMillis() - ageMillis)-\(UUID().uuidString)\(suffix)"
+        try writeRecord(named: name, ageMillis: ageMillis, bytes: bytes)
+        return name
+    }
+
+    static func nowMillis() -> Int64 {
+        Int64(Date().timeIntervalSince1970 * 1_000)
+    }
+
+    func fileExists(_ name: String) -> Bool {
+        FileManager.default.fileExists(atPath: temporaryDirectory.appendingPathComponent(name).path)
+    }
+
+    func ownedFileNames() -> [String] {
+        let contents = (try? FileManager.default.contentsOfDirectory(atPath: temporaryDirectory.path)) ?? []
+        return contents.filter { $0.hasSuffix(CrashRetention.shared.defaultPolicy.ownedSuffix) }
+    }
+
+    func awaitListReadable(
+        minAgeMillis: Int64,
+        attributesUnreadableFor denied: Set<String> = [],
+        attributeLookup: FileLogStore.AttributeLookup? = nil
+    ) throws -> [StoredLogFile] {
+        let expectation = expectation(description: "listReadable")
+        var result: [StoredLogFile] = []
+        makeStore(attributesUnreadableFor: denied, attributeLookup: attributeLookup)
+            .listReadable(minAgeMillis: minAgeMillis) { entries, _ in
+                result = entries ?? []
+                expectation.fulfill()
+            }
+        wait(for: [expectation], timeout: 5)
+        return result
+    }
+
+    func awaitDeleteUnrecognized(
+        minAgeMillis: Int64,
+        attributesUnreadableFor denied: Set<String> = [],
+        fileManager: FileManager = .default
+    ) throws -> Int {
+        let expectation = expectation(description: "deleteUnrecognizedEntries")
+        var deleted = 0
+        makeStore(attributesUnreadableFor: denied, fileManager: fileManager)
+            .deleteUnrecognizedEntries(minAgeMillis: minAgeMillis) { count, _ in
+                deleted = Int(truncating: count ?? 0)
+                expectation.fulfill()
+            }
+        wait(for: [expectation], timeout: 5)
+        return deleted
+    }
+}
+
+private final class FileLogStoreLogListener: NSObject, OSLogListener {
+    var entries: [String] = []
+
+    func onLogEvent(_ event: OneSignalLogEvent) {
+        entries.append(event.entry)
+    }
+}
+
+/// `removeItem` reports the file already gone, the way a racing crash-path eviction looks.
+private final class FileLogStoreMissingItemFileManager: FileManager {
+    override func removeItem(at url: URL) throws {
+        throw CocoaError(.fileNoSuchFile)
+    }
+}
+
+/// Parks the durable write just after its `.tmp` moves into place, so the record is on disk and
+/// still in flight while another thread scans the directory.
+private final class FileLogStoreMoveBarrierFileManager: FileManager {
+    var onMoved: ((URL) -> Void)?
+
+    override func moveItem(at srcURL: URL, to dstURL: URL) throws {
+        try super.moveItem(at: srcURL, to: dstURL)
+        onMoved?(dstURL)
+    }
+}
+
+/// Invokes a hook once the durable write has created its `.tmp`, so a concurrent temp sweep can
+/// race the in-flight name.
+private final class FileLogStoreReentrantCleanupFileManager: FileManager {
+    var onTemporaryWrite: (() -> Void)?
+
+    override func setAttributes(_ attributes: [FileAttributeKey: Any], ofItemAtPath path: String) throws {
+        try super.setAttributes(attributes, ofItemAtPath: path)
+        if path.hasSuffix(".tmp") {
+            onTemporaryWrite?()
+        }
+    }
+}