- query().total: full-scan true count (was capped at offset+limit by an early break — dashboard 24h stat read ≤1000 vs real ~46k) - trim trigger/curer mismatch: byte trigger + line curer never converged when avg line > ~524B (live avg 355B); now keeps maxDisk lines OR ≤80% byte budget, whichever retains fewer (TRIM_TARGET_FACTOR); budget env-overridable via SECURITY_EVENT_TRIM_BYTES / opts.trimSizeLimit - trim/append race: trim renamed over the file mid-append losing events to the unlinked inode; now single-flight, queue-empty gated, holds the write lock, error paths always release + lazily re-kick (no hot loop) Judge: glm-4.6@zai-coding-paas adversarial cold-read, grade B clean (0 blocking, 4 polish — 2 folded, 1 already-satisfied, 1 deferred as judge-endorsed safer). 127 suites / 2849 tests green.