Instrument receipt, parse, write and display with monotonic timings, then compare the same captured input offline with logging enabled and disabled. Don't use the changing folder size as your only timing evidence.
Then separate the writer from display work, with bounded buffering and a defined overflow policy. An unlimited queue could hide the pause while quietly consuming the machine's memory.
Beth, who gets told if the writer falls behind? I don't want the person collecting fault evidence to discover at handover that the nice responsive screen was watching updates it never managed to keep.
Anika's point belongs in the acceptance checks. Show logging health separately from incoming-data age; a current display and a damaged diagnostic record are possible at the same time.
Bounded writer queue added. Replay stays responsive with stalled storage; overflow shows a loss count. Shutdown and export completeness still untested.
Keep those two tests open before rollout. Also verify that the exported record identifies the lost interval, not just a total somewhere on the screen; the next person reading it may never see that display.
Liam, has anyone been assigned to act on that logging warning? The technical fix is useful, but the person at the bench needs to know whether the record is usable for their investigation and who sorts out the storage fault.