diff --git a/.clang-format b/.clang-format
index c7e9c50..6a6c06f 100644
--- a/.clang-format
+++ b/.clang-format
@@ -10,11 +10,9 @@ AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: false
 AllowShortLambdasOnASingleLine: false
 AllowShortLoopsOnASingleLine: false
-AllowAllConstructorInitializersOnNextLine: false
 BreakBeforeBraces: Custom
 DerivePointerAlignment: false
 FixNamespaceComments: true
-IndentCaseLabels: false
 IndentPPDirectives: None
 IndentWidth: 2
 PointerAlignment: Left
diff --git a/conanfile.py b/conanfile.py
index 919851c..0b6c173 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -69,7 +69,7 @@ def configure(self):
 
 
     def requirements(self):
-        self.requires("batteries/0.52.1", **VISIBLE)
+        self.requires("batteries/0.52.4", **VISIBLE)
         self.requires("boost/1.83.0", **VISIBLE)
         self.requires("cli11/2.3.2", **VISIBLE)
         self.requires("glog/0.6.0", **VISIBLE)
diff --git a/src/llfs/basic_log_storage_driver.hpp b/src/llfs/basic_log_storage_driver.hpp
index 024a74b..b2980be 100644
--- a/src/llfs/basic_log_storage_driver.hpp
+++ b/src/llfs/basic_log_storage_driver.hpp
@@ -43,17 +43,17 @@ class BasicLogStorageDriver
   //
   Status set_trim_pos(slot_offset_type trim_pos)
   {
-    return impl_.set_trim_pos(trim_pos);
+    return this->impl_.set_trim_pos(trim_pos);
   }
 
   slot_offset_type get_trim_pos() const
   {
-    return impl_.get_trim_pos();
+    return this->impl_.get_trim_pos();
   }
 
   StatusOr<slot_offset_type> await_trim_pos(slot_offset_type trim_pos)
   {
-    return impl_.await_trim_pos(trim_pos);
+    return this->impl_.await_trim_pos(trim_pos);
   }
 
   //----
@@ -63,41 +63,51 @@ class BasicLogStorageDriver
 
   slot_offset_type get_flush_pos() const
   {
-    return impl_.get_flush_pos();
+    return this->impl_.get_flush_pos();
   }
 
   StatusOr<slot_offset_type> await_flush_pos(slot_offset_type flush_pos)
   {
-    return impl_.await_flush_pos(flush_pos);
+    return this->impl_.await_flush_pos(flush_pos);
   }
 
   //----
 
   Status set_commit_pos(slot_offset_type commit_pos)
   {
-    return impl_.set_commit_pos(commit_pos);
+    return this->impl_.set_commit_pos(commit_pos);
   }
 
   slot_offset_type get_commit_pos() const
   {
-    return impl_.get_commit_pos();
+    return this->impl_.get_commit_pos();
   }
 
   StatusOr<slot_offset_type> await_commit_pos(slot_offset_type commit_pos)
   {
-    return impl_.await_commit_pos(commit_pos);
+    return this->impl_.await_commit_pos(commit_pos);
   }
 
   //----
 
   Status open()
   {
-    return impl_.open();
+    return this->impl_.open();
   }
 
   Status close()
   {
-    return impl_.close();
+    return this->impl_.close();
+  }
+
+  void halt()
+  {
+    this->impl_.halt();
+  }
+
+  void join()
+  {
+    this->impl_.join();
   }
   //
   //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/basic_ring_buffer_log_device.hpp b/src/llfs/basic_ring_buffer_log_device.hpp
index f2420d4..308deed 100644
--- a/src/llfs/basic_ring_buffer_log_device.hpp
+++ b/src/llfs/basic_ring_buffer_log_device.hpp
@@ -13,6 +13,7 @@
 #include <llfs/basic_log_storage_driver.hpp>
 #include <llfs/basic_log_storage_reader.hpp>
 #include <llfs/log_device.hpp>
+#include <llfs/log_storage_driver_context.hpp>
 #include <llfs/ring_buffer.hpp>
 
 namespace llfs {
@@ -62,6 +63,16 @@ class BasicRingBufferLogDevice
 
   Status close() override;
 
+  void halt() override
+  {
+    this->driver_.halt();
+  }
+
+  void join() override
+  {
+    this->driver_.join();
+  }
+
   Status sync(LogReadMode mode, SlotUpperBoundAt event) override;
 
   driver_type& driver()
@@ -222,8 +233,6 @@ class BasicRingBufferLogDevice<Impl>::WriterImpl : public LogDevice::Writer
 
   StatusOr<MutableBuffer> prepare(usize byte_count, usize head_room) override
   {
-    BATT_CHECK(!this->prepared_offset_);
-
     if (this->device_->closed_.load()) {
       return ::llfs::make_status(StatusCode::kPrepareFailedLogClosed);
     }
diff --git a/src/llfs/data_reader.hpp b/src/llfs/data_reader.hpp
index 18049ae..e9ae482 100644
--- a/src/llfs/data_reader.hpp
+++ b/src/llfs/data_reader.hpp
@@ -26,6 +26,7 @@
 #include <llfs/logging.hpp>
 
 #include <batteries/assert.hpp>
+#include <batteries/slice.hpp>
 #include <batteries/type_traits.hpp>
 
 #include <boost/range/iterator_range.hpp>
@@ -98,6 +99,22 @@ class DataReader
     at_end_ = false;
   }
 
+  /** \brief Tries to consume a prefix of the remaining input that exactly matches `token`.
+   *
+   * \return true iff the unread data begins with token and this prefix is successfully consumed.
+   */
+  bool read_token(const batt::Slice<const u8>& token) noexcept
+  {
+    if (this->bytes_available() < token.size()) {
+      return false;
+    }
+    if (std::memcmp(this->unread_.begin(), token.begin(), token.size()) != 0) {
+      return false;
+    }
+    this->unread_.advance_begin(token.size());
+    return true;
+  }
+
   template <typename T>
   [[nodiscard]] const T* read_record(batt::StaticType<T> = {})
   {
@@ -240,6 +257,13 @@ class DataReader
     return ConstBuffer{this->unread_.begin(), this->unread_.size()};
   }
 
+  /** \brief Returns a pointer to the start of unread data.
+   */
+  const u8* unread_begin() const
+  {
+    return this->unread_.begin();
+  }
+
  private:
   bool at_end_ = false;
   ConstBuffer buffer_;
diff --git a/src/llfs/file_log_driver.cpp b/src/llfs/file_log_driver.cpp
index 337e90e..16b9589 100644
--- a/src/llfs/file_log_driver.cpp
+++ b/src/llfs/file_log_driver.cpp
@@ -341,9 +341,24 @@ StatusOr<slot_offset_type> FileLogDriver::await_commit_pos(slot_offset_type min_
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
 Status FileLogDriver::close()
+{
+  this->halt();
+  this->join();
+
+  return OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void FileLogDriver::halt()
 {
   this->shared_state_.halt();
+}
 
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void FileLogDriver::join()
+{
   if (this->trim_task_) {
     this->trim_task_->join();
     this->trim_task_ = None;
@@ -352,8 +367,6 @@ Status FileLogDriver::close()
     this->flush_task_->join();
     this->flush_task_ = None;
   }
-
-  return OkStatus();
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/file_log_driver.hpp b/src/llfs/file_log_driver.hpp
index f266896..a5ce821 100644
--- a/src/llfs/file_log_driver.hpp
+++ b/src/llfs/file_log_driver.hpp
@@ -189,6 +189,10 @@ class FileLogDriver
 
   Status close();
 
+  void halt();
+
+  void join();
+
  private:
   // See <llfs/file_log_driver/concurrent_shared_state.cpp>
   //
diff --git a/src/llfs/ioring_file.cpp b/src/llfs/ioring_file.cpp
index 04562d5..16a1c50 100644
--- a/src/llfs/ioring_file.cpp
+++ b/src/llfs/ioring_file.cpp
@@ -19,13 +19,15 @@ namespace llfs {
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-IoRing::File::File(const IoRing& io_ring, int fd) noexcept : io_ring_{&io_ring}, fd_{fd}
+IoRing::File::File(const IoRing& io_ring, int fd) noexcept
+    : io_ring_impl_{io_ring.impl_.get()}
+    , fd_{fd}
 {
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-IoRing::File::File(File&& that) noexcept : io_ring_{that.io_ring_}, fd_{that.fd_}
+IoRing::File::File(File&& that) noexcept : io_ring_impl_{that.io_ring_impl_}, fd_{that.fd_}
 {
   that.fd_ = -1;
   that.registered_fd_ = -1;
@@ -37,7 +39,7 @@ auto IoRing::File::operator=(File&& that) noexcept -> File&
 {
   File copy{std::move(that)};
 
-  std::swap(this->io_ring_, copy.io_ring_);
+  std::swap(this->io_ring_impl_, copy.io_ring_impl_);
   std::swap(this->fd_, copy.fd_);
   std::swap(this->registered_fd_, copy.registered_fd_);
 
@@ -155,7 +157,7 @@ Status IoRing::File::register_fd()
     return OkStatus();
   }
 
-  StatusOr<i32> rfd = this->io_ring_->register_fd(this->fd_);
+  StatusOr<i32> rfd = this->io_ring_impl_->register_fd(this->fd_);
   if (!rfd.ok()) {
     LLFS_LOG_ERROR() << "register_fd failed! " << BATT_INSPECT(rfd.status());
   }
@@ -174,7 +176,7 @@ Status IoRing::File::unregister_fd()
     return OkStatus();
   }
 
-  Status status = this->io_ring_->unregister_fd(this->registered_fd_);
+  Status status = this->io_ring_impl_->unregister_fd(this->registered_fd_);
   BATT_REQUIRE_OK(status);
 
   this->registered_fd_ = -1;
diff --git a/src/llfs/ioring_file.hpp b/src/llfs/ioring_file.hpp
index f15a9e5..8fe9605 100644
--- a/src/llfs/ioring_file.hpp
+++ b/src/llfs/ioring_file.hpp
@@ -47,9 +47,9 @@ class IoRing::File
 
   ~File() noexcept;
 
-  const IoRing& get_io_ring() const
+  IoRing::Impl* get_io_ring_impl() const
   {
-    return *this->io_ring_;
+    return this->io_ring_impl_;
   }
 
   // Returns the OS-native file descriptor currently owned by this object.  Returns -1 if no file is
@@ -158,7 +158,7 @@ class IoRing::File
   }
 
  private:
-  const IoRing* io_ring_;
+  IoRing::Impl* io_ring_impl_ = nullptr;
   int fd_ = -1;
   int registered_fd_ = -1;
   bool raw_io_ = true;
@@ -173,16 +173,16 @@ inline void IoRing::File::async_read_some(i64 offset, MutableBufferSequence&& bu
                                           Handler&& handler)
 {
   LLFS_DVLOG(1) << "async_read_some(mulitple buffers)";
-  this->io_ring_->submit(BATT_FORWARD(buffers), BATT_FORWARD(handler),
-                         [offset, this](struct io_uring_sqe* sqe, auto& op) {
-                           if (this->registered_fd_ == -1) {
-                             io_uring_prep_readv(sqe, this->fd_, op.iov_, op.iov_count_, offset);
-                           } else {
-                             io_uring_prep_readv(sqe, this->registered_fd_, op.iov_, op.iov_count_,
-                                                 offset);
-                             sqe->flags |= IOSQE_FIXED_FILE;
-                           }
-                         });
+  this->io_ring_impl_->submit(
+      BATT_FORWARD(buffers), BATT_FORWARD(handler),
+      [offset, this](struct io_uring_sqe* sqe, auto& op) {
+        if (this->registered_fd_ == -1) {
+          io_uring_prep_readv(sqe, this->fd_, op.iov_, op.iov_count_, offset);
+        } else {
+          io_uring_prep_readv(sqe, this->registered_fd_, op.iov_, op.iov_count_, offset);
+          sqe->flags |= IOSQE_FIXED_FILE;
+        }
+      });
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
@@ -194,7 +194,7 @@ inline void IoRing::File::async_read_some(i64 offset, const MutableBuffer& buffe
   static const std::vector<MutableBuffer> empty;
 
   LLFS_DVLOG(1) << "async_read_some(single buffer)";
-  this->io_ring_->submit(
+  this->io_ring_impl_->submit(
       empty, BATT_FORWARD(handler),
       [&buffer, offset, this](struct io_uring_sqe* sqe, auto& /*op*/) {
         if (this->registered_fd_ == -1) {
@@ -217,7 +217,7 @@ inline void IoRing::File::async_read_some_fixed(i64 offset, const MutableBuffer&
   static const std::vector<MutableBuffer> empty;
 
   LLFS_DVLOG(1) << "async_read_some(single buffer)";
-  this->io_ring_->submit(
+  this->io_ring_impl_->submit(
       empty, BATT_FORWARD(handler),
       [&buffer, offset, buf_index, this](struct io_uring_sqe* sqe, auto& /*op*/) {
         if (this->registered_fd_ == -1) {
@@ -238,16 +238,16 @@ template <typename ConstBufferSequence, typename Handler, typename>
 inline void IoRing::File::async_write_some(i64 offset, ConstBufferSequence&& buffers,
                                            Handler&& handler)
 {
-  this->io_ring_->submit(BATT_FORWARD(buffers), BATT_FORWARD(handler),
-                         [offset, this](struct io_uring_sqe* sqe, auto& op) {
-                           if (this->registered_fd_ == -1) {
-                             io_uring_prep_writev(sqe, this->fd_, op.iov_, op.iov_count_, offset);
-                           } else {
-                             io_uring_prep_writev(sqe, this->registered_fd_, op.iov_, op.iov_count_,
-                                                  offset);
-                             sqe->flags |= IOSQE_FIXED_FILE;
-                           }
-                         });
+  this->io_ring_impl_->submit(
+      BATT_FORWARD(buffers), BATT_FORWARD(handler),
+      [offset, this](struct io_uring_sqe* sqe, auto& op) {
+        if (this->registered_fd_ == -1) {
+          io_uring_prep_writev(sqe, this->fd_, op.iov_, op.iov_count_, offset);
+        } else {
+          io_uring_prep_writev(sqe, this->registered_fd_, op.iov_, op.iov_count_, offset);
+          sqe->flags |= IOSQE_FIXED_FILE;
+        }
+      });
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
@@ -257,7 +257,7 @@ inline void IoRing::File::async_write_some(i64 offset, const ConstBuffer& buffer
 {
   static const std::vector<ConstBuffer> empty;
 
-  this->io_ring_->submit(
+  this->io_ring_impl_->submit(
       empty, BATT_FORWARD(handler),
       [&buffer, offset, this](struct io_uring_sqe* sqe, auto& /*op*/) {
         if (this->registered_fd_ == -1) {
@@ -277,7 +277,7 @@ inline void IoRing::File::async_write_some_fixed(i64 offset, const ConstBuffer&
 {
   static const std::vector<ConstBuffer> empty;
 
-  this->io_ring_->submit(
+  this->io_ring_impl_->submit(
       empty, BATT_FORWARD(handler),
       [&buffer, buf_index, offset, this](struct io_uring_sqe* sqe, auto& /*op*/) {
         if (this->registered_fd_ == -1) {
diff --git a/src/llfs/ioring_log_config.cpp b/src/llfs/ioring_log_config.cpp
index 4378f49..a7d8328 100644
--- a/src/llfs/ioring_log_config.cpp
+++ b/src/llfs/ioring_log_config.cpp
@@ -11,6 +11,7 @@
 
 #ifndef LLFS_DISABLE_IO_URING
 
+#include <llfs/log_block_calculator.hpp>
 #include <llfs/log_device_config.hpp>
 
 namespace llfs {
@@ -28,6 +29,26 @@ namespace llfs {
   };
 }
 
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*static*/ IoRingLogConfig IoRingLogConfig::from_logical_size(u64 logical_size,
+                                                              Optional<usize> opt_block_size,
+                                                              Optional<i64> opt_physical_offset)
+{
+  const usize block_size = opt_block_size.value_or(IoRingLogConfig::kDefaultBlockSize);
+  const i32 block_size_log2 = batt::log2_ceil(block_size);
+
+  BATT_CHECK_GE(block_size_log2, kLogPageSizeLog2);
+
+  return IoRingLogConfig{
+      .logical_size = logical_size,
+      .physical_offset = opt_physical_offset.value_or(0),
+      .physical_size =
+          LogBlockCalculator::disk_size_required_for_log_size(logical_size, block_size),
+      .pages_per_block_log2 = block_size_log2 - kLogPageSizeLog2,
+  };
+}
+
 }  // namespace llfs
 
 #endif  // LLFS_DISABLE_IO_URING
diff --git a/src/llfs/ioring_log_config.hpp b/src/llfs/ioring_log_config.hpp
index 69ce6f8..fe3c49f 100644
--- a/src/llfs/ioring_log_config.hpp
+++ b/src/llfs/ioring_log_config.hpp
@@ -14,6 +14,7 @@
 #include <llfs/constants.hpp>
 #include <llfs/file_offset_ptr.hpp>
 #include <llfs/int_types.hpp>
+#include <llfs/optional.hpp>
 #include <llfs/packed_log_page_header.hpp>
 
 namespace llfs {
@@ -44,7 +45,8 @@ struct IoRingLogConfig {
   u64 physical_size;
 
   // Specifies the size of a "flush block," the size of a single write operation while flushing,
-  // in number of 4kb pages, log2.  For example:
+  // in number of kLogAtomicWriteSize (default=512; see llfs/config.hpp) byte pages, log2.  For
+  // example:
   //
   //  | flush_block_pages_log2   | flush write buffer size   |
   //  |--------------------------|---------------------------|
@@ -64,6 +66,17 @@ struct IoRingLogConfig {
   static IoRingLogConfig from_packed(
       const FileOffsetPtr<const PackedLogDeviceConfig&>& packed_config);
 
+  /** \brief Constructs and returns a config based on a given logical size.
+   *
+   * The block size defaults to IoRingLogConfig::kDefaultBlockSize.
+   * The physical offset defaults to 0.
+   * In all cases physical size is derived from logical size and block size.
+   *
+   * \return the new IoRingLogConfig
+   */
+  static IoRingLogConfig from_logical_size(u64 logical_size, Optional<usize> opt_block_size = None,
+                                           Optional<i64> opt_physical_offset = None);
+
   //+++++++++++-+-+--+----- --- -- -  -  -   -
 
   usize pages_per_block() const
diff --git a/src/llfs/ioring_log_device.hpp b/src/llfs/ioring_log_device.hpp
index 51032fd..ccf79b2 100644
--- a/src/llfs/ioring_log_device.hpp
+++ b/src/llfs/ioring_log_device.hpp
@@ -20,6 +20,7 @@
 #include <llfs/file_offset_ptr.hpp>
 #include <llfs/ioring.hpp>
 #include <llfs/ioring_log_config.hpp>
+#include <llfs/ioring_log_device_storage.hpp>
 #include <llfs/ioring_log_driver.hpp>
 #include <llfs/ioring_log_driver_options.hpp>
 #include <llfs/ioring_log_flush_op.hpp>
@@ -64,12 +65,25 @@ class IoRingLogDeviceFactory : public LogDeviceFactory
 
   StatusOr<std::unique_ptr<IoRingLogDevice>> open_ioring_log_device()
   {
-    auto instance = std::make_unique<IoRingLogDevice>(
-        RingBuffer::TempFile{.byte_size = this->config_.logical_size}, this->task_scheduler_,
-        this->fd_, this->config_, this->options_);
+    LogBlockCalculator calculate{this->config_, this->options_};
+
+    BATT_ASSIGN_OK_RESULT(DefaultIoRingLogDeviceStorage storage,
+                          DefaultIoRingLogDeviceStorage::make_new(
+                              MaxQueueDepth{
+                                  calculate.queue_depth() * 2
+                                  //
+                                  // Double the number of flush ops, to give us some margin so the
+                                  // rings don't ever run out of space (TODO [tastolfi 2024-05-14]
+                                  // this seems excessive; investigate lowering this)
+                              },
+                              this->fd_));
 
     this->fd_ = -1;
 
+    auto instance = std::make_unique<IoRingLogDevice>(
+        RingBuffer::TempFile{.byte_size = this->config_.logical_size}, this->task_scheduler_,
+        std::move(storage), this->config_, this->options_);
+
     Status open_status = instance->open();
     BATT_REQUIRE_OK(open_status);
 
diff --git a/src/llfs/ioring_log_device_storage.cpp b/src/llfs/ioring_log_device_storage.cpp
new file mode 100644
index 0000000..ab36b2c
--- /dev/null
+++ b/src/llfs/ioring_log_device_storage.cpp
@@ -0,0 +1,71 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#include <llfs/ioring_log_device_storage.hpp>
+//
+
+namespace llfs {
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*static*/ StatusOr<DefaultIoRingLogDeviceStorage> DefaultIoRingLogDeviceStorage::make_new(
+    MaxQueueDepth entries, int fd)
+{
+  BATT_ASSIGN_OK_RESULT(IoRing io_ring, IoRing::make_new(entries));
+  BATT_ASSIGN_OK_RESULT(IoRing::File file, IoRing::File::open(io_ring, fd));
+
+  return DefaultIoRingLogDeviceStorage{std::move(io_ring), std::move(file)};
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ DefaultIoRingLogDeviceStorage::DefaultIoRingLogDeviceStorage(
+    IoRing&& io_ring, IoRing::File&& file) noexcept
+    : io_ring_{std::move(io_ring)}
+    , file_{std::move(file)}
+{
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ DefaultIoRingLogDeviceStorage::EventLoopTask::EventLoopTask(
+    DefaultIoRingLogDeviceStorage& storage, std::string_view caller) noexcept
+    : storage_{storage}
+    , caller_{caller}
+    , thread_{[this] {
+      LLFS_VLOG(1) << "(" << this->caller_ << ") invoking IoRing::run()";
+
+      Status io_status = this->storage_.io_ring_.run();
+      if (!io_status.ok()) {
+        LLFS_LOG_WARNING() << "(" << this->caller_ << ") IoRing::run() returned: " << io_status;
+      }
+      this->done_.set_value(true);
+
+      LLFS_VLOG(1) << "(" << this->caller_ << ") IoRing::run() returned; exiting event loop thread";
+    }}
+{
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+DefaultIoRingLogDeviceStorage::EventLoopTask::~EventLoopTask() noexcept
+{
+  BATT_CHECK(this->join_called_);
+  BATT_CHECK(this->done_.get_value());
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void DefaultIoRingLogDeviceStorage::EventLoopTask::join()
+{
+  this->join_called_ = true;
+  BATT_CHECK_OK(this->done_.await_equal(true));
+  this->thread_.join();
+}
+
+}  //namespace llfs
diff --git a/src/llfs/ioring_log_device_storage.hpp b/src/llfs/ioring_log_device_storage.hpp
new file mode 100644
index 0000000..6572031
--- /dev/null
+++ b/src/llfs/ioring_log_device_storage.hpp
@@ -0,0 +1,150 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#pragma once
+#ifndef LLFS_IORING_LOG_DEVICE_STORAGE_HPP
+#define LLFS_IORING_LOG_DEVICE_STORAGE_HPP
+
+#include <llfs/config.hpp>
+//
+#include <llfs/ioring.hpp>
+#include <llfs/ioring_file.hpp>
+#include <llfs/optional.hpp>
+#include <llfs/status.hpp>
+
+#include <batteries/async/watch.hpp>
+
+#include <thread>
+
+namespace llfs {
+
+class DefaultIoRingLogDeviceStorage
+{
+ public:
+  /** \brief Creates a new IoRing with the specified queue depth, wraps it in a
+   * DefaultIoRingLogDeviceStorage, and returns the result.
+   *
+   * The returned object should be used by an IoRingLogDriver/IoRingLogDevice for the low-level file
+   * I/O.
+   */
+  static StatusOr<DefaultIoRingLogDeviceStorage> make_new(MaxQueueDepth entries, int fd);
+
+  /** \brief A background thread or task that runs the IoRing event loop for a given
+   * DefaultIoRingLogDeviceStorage object.
+   */
+  class EventLoopTask;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  DefaultIoRingLogDeviceStorage(const DefaultIoRingLogDeviceStorage&) = delete;
+  DefaultIoRingLogDeviceStorage& operator=(const DefaultIoRingLogDeviceStorage&) = delete;
+
+  DefaultIoRingLogDeviceStorage(DefaultIoRingLogDeviceStorage&&) = default;
+  DefaultIoRingLogDeviceStorage& operator=(DefaultIoRingLogDeviceStorage&&) = default;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  Status register_fd()
+  {
+    return this->file_.register_fd();
+  }
+
+  StatusOr<usize> register_buffers(batt::BoxedSeq<MutableBuffer>&& buffers,
+                                   bool update = false) const noexcept
+  {
+    return this->io_ring_.register_buffers(std::move(buffers), update);
+  }
+
+  Status close()
+  {
+    return this->file_.close();
+  }
+
+  void on_work_started() const noexcept
+  {
+    this->io_ring_.on_work_started();
+  }
+
+  void on_work_finished() const noexcept
+  {
+    this->io_ring_.on_work_finished();
+  }
+
+  void reset_event_loop() const noexcept
+  {
+    this->io_ring_.reset();
+  }
+
+  template <typename Handler = void(StatusOr<i32>)>
+  void post_to_event_loop(Handler&& handler) const noexcept
+  {
+    this->io_ring_.post(BATT_FORWARD(handler));
+  }
+
+  void stop_event_loop() const noexcept
+  {
+    this->io_ring_.stop();
+  }
+
+  Status read_all(i64 offset, MutableBuffer buffer)
+  {
+    return this->file_.read_all(offset, buffer);
+  }
+
+  template <typename Handler>
+  void async_write_some_fixed(i64 file_offset, const ConstBuffer& data, i32 buf_index,
+                              Handler&& handler);
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+ private:
+  explicit DefaultIoRingLogDeviceStorage(IoRing&& io_ring, IoRing::File&& file) noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   --
+
+  IoRing io_ring_;
+  IoRing::File file_;
+};
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+
+template <typename Handler>
+inline void DefaultIoRingLogDeviceStorage::async_write_some_fixed(i64 file_offset,
+                                                                  const ConstBuffer& data,
+                                                                  i32 buf_index, Handler&& handler)
+{
+  this->file_.async_write_some_fixed(file_offset, data, buf_index, BATT_FORWARD(handler));
+}
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+
+class DefaultIoRingLogDeviceStorage::EventLoopTask
+{
+ public:
+  explicit EventLoopTask(DefaultIoRingLogDeviceStorage& storage, std::string_view caller) noexcept;
+
+  EventLoopTask(const EventLoopTask&) = delete;
+  EventLoopTask& operator=(const EventLoopTask&) = delete;
+
+  ~EventLoopTask() noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  void join();
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+ private:
+  DefaultIoRingLogDeviceStorage& storage_;
+  std::string_view caller_;
+  std::thread thread_;
+  batt::Watch<bool> done_{false};
+  bool join_called_ = false;
+};
+
+}  //namespace llfs
+
+#endif  // LLFS_IORING_LOG_DEVICE_FILE_HPP
diff --git a/src/llfs/ioring_log_driver.cpp b/src/llfs/ioring_log_driver.cpp
index 98434ca..2544b2e 100644
--- a/src/llfs/ioring_log_driver.cpp
+++ b/src/llfs/ioring_log_driver.cpp
@@ -15,7 +15,7 @@
 
 namespace llfs {
 
-template class BasicIoRingLogDriver<BasicIoRingLogFlushOp>;
+template class BasicIoRingLogDriver<BasicIoRingLogFlushOp, DefaultIoRingLogDeviceStorage>;
 
 }  // namespace llfs
 
diff --git a/src/llfs/ioring_log_driver.hpp b/src/llfs/ioring_log_driver.hpp
index f851d8e..25a32fb 100644
--- a/src/llfs/ioring_log_driver.hpp
+++ b/src/llfs/ioring_log_driver.hpp
@@ -18,6 +18,8 @@
 #include <llfs/basic_log_storage_driver.hpp>
 #include <llfs/int_types.hpp>
 #include <llfs/ioring_log_config.hpp>
+#include <llfs/ioring_log_device_storage.hpp>
+#include <llfs/ioring_log_driver_fwd.hpp>
 #include <llfs/ioring_log_driver_options.hpp>
 #include <llfs/ioring_log_flush_op.hpp>
 #include <llfs/log_block_calculator.hpp>
@@ -40,14 +42,11 @@ BATT_UNSUPPRESS()
 
 namespace llfs {
 
-template <template <typename> class FlushOpImpl>
-class BasicIoRingLogDriver;
-
-using IoRingLogDriver = BasicIoRingLogDriver<BasicIoRingLogFlushOp>;
+using IoRingLogDriver = BasicIoRingLogDriver<BasicIoRingLogFlushOp, DefaultIoRingLogDeviceStorage>;
 
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
 //
-template <template <typename> class FlushOpImpl>
+template <template <typename> class FlushOpImpl, typename StorageT>
 class BasicIoRingLogDriver
 {
  public:
@@ -71,9 +70,10 @@ class BasicIoRingLogDriver
 
   //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 
-  explicit BasicIoRingLogDriver(LogStorageDriverContext& context,
-                                batt::TaskScheduler& task_scheduler, int fd,
-                                const IoRingLogConfig& config,
+  explicit BasicIoRingLogDriver(LogStorageDriverContext& context,     //
+                                batt::TaskScheduler& task_scheduler,  //
+                                StorageT&& storage,                   //
+                                const IoRingLogConfig& config,        //
                                 const IoRingLogDriverOptions& options) noexcept;
 
   ~BasicIoRingLogDriver() noexcept;
@@ -108,10 +108,7 @@ class BasicIoRingLogDriver
     return this->flush_pos_.get_value();
   }
 
-  StatusOr<slot_offset_type> await_flush_pos(slot_offset_type flush_pos)
-  {
-    return await_slot_offset(flush_pos, this->flush_pos_);
-  }
+  StatusOr<slot_offset_type> await_flush_pos(slot_offset_type flush_pos);
 
   //----
 
@@ -135,7 +132,7 @@ class BasicIoRingLogDriver
   {
     this->halt();
     this->join();
-    return this->file_.close();
+    return this->storage_close_status_;
   }
 
   void halt();
@@ -169,6 +166,10 @@ class BasicIoRingLogDriver
 
   void poll_flush_state();
 
+  /** \brief Called by flush ops to report I/O failures.
+   */
+  void report_flush_error(Status error_status);
+
   //+++++++++++-+-+--+----- --- -- -  -  -   -
 
   ConstBuffer get_data(slot_offset_type slot_offset) const
@@ -177,9 +178,9 @@ class BasicIoRingLogDriver
   }
 
   template <typename Handler>
-  void async_write_some(i64 log_offset, const ConstBuffer& data, i32 buf_index, Handler&& handler)
+  void async_write_some(i64 file_offset, const ConstBuffer& data, i32 buf_index, Handler&& handler)
   {
-    this->file_.async_write_some_fixed(log_offset, data, buf_index, BATT_FORWARD(handler));
+    this->storage_.async_write_some_fixed(file_offset, data, buf_index, BATT_FORWARD(handler));
   }
 
   //+++++++++++-+-+--+----- --- -- -  -  -   -
@@ -257,6 +258,21 @@ class BasicIoRingLogDriver
 
   void handle_commit_pos_update(const StatusOr<slot_offset_type>& updated_commit_pos);
 
+  /** \brief Signals the entering of the storage I/O event loop; the first time this is called
+   * (before a corresponding call to this->storage_work_finished()), calls
+   * this->storage_.on_work_started() to increment the work count.
+   */
+  void storage_work_started();
+
+  /** \brief Signals that storage I/O work is now in the process of shutting down.  The first time
+   * this is called (after this->storage_work_started()), calls this->storage_.on_work_finished() to
+   * decrement the work count, allowing the storage I/O event loop to exit once all activity has
+   * completed.
+   *
+   * This may be called in response to a fatal error or an external call to this->halt().
+   */
+  void storage_work_finished();
+
   //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 
   // Used to access the RingBuffer.
@@ -278,16 +294,26 @@ class BasicIoRingLogDriver
   //
   const LogBlockCalculator calculate_;
 
-  // The IoRing and file used to do log flushing.
+  // Interface to the low-level storage media used to save log data.
   //
-  IoRing ioring_;
-  IoRing::File file_;
+  StorageT storage_;
+
+  // The return value of this->storage_.close().
+  //
+  Status storage_close_status_ = batt::StatusCode::kUnknown;
 
   // Set to true once when halt is first called; used to detect unexpected/premature exit of
   // background tasks.
   //
   std::atomic<bool> halt_requested_{false};
 
+  // While in normal operation, we maintain a positive work count on the storage object; eventually
+  // we will release this count as part of shutting down; this field acts as a gate to make sure we
+  // only call this->storage_.on_work_started()/on_work_finished() once at the boundary of this time
+  // interval.
+  //
+  std::atomic<bool> storage_working_{false};
+
   // The standard log state variables.
   //
   batt::Watch<slot_offset_type> trim_pos_{0};
diff --git a/src/llfs/ioring_log_driver.ipp b/src/llfs/ioring_log_driver.ipp
index f4e7bd9..906150b 100644
--- a/src/llfs/ioring_log_driver.ipp
+++ b/src/llfs/ioring_log_driver.ipp
@@ -31,23 +31,26 @@ namespace llfs {
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline BasicIoRingLogDriver<FlushOpImpl>::BasicIoRingLogDriver(
-    LogStorageDriverContext& context, batt::TaskScheduler& task_scheduler, int fd,
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline BasicIoRingLogDriver<FlushOpImpl, StorageT>::BasicIoRingLogDriver(
+    LogStorageDriverContext& context, batt::TaskScheduler& task_scheduler, StorageT&& storage,
     const IoRingLogConfig& config, const IoRingLogDriverOptions& options) noexcept
     : context_{context}
     , task_scheduler_{task_scheduler}
     , config_{config}
     , options_{options}
     , calculate_{config, options}
-    , ioring_{*IoRing::make_new(MaxQueueDepth{this->calculate().queue_depth() * 2})}
-    , file_{this->ioring_, fd}
+    , storage_{std::move(storage)}
     , flush_ops_(std::max(usize{2}, this->calculate().queue_depth()))
 //                        ^ we require at least two flush ops for lazy init:
 //                           one to flush a full block at the end of the log and one to
 //                           initialize the next (empty) block header.
 
 {
+  BATT_CHECK_GE(this->calculate().block_count(), this->calculate().queue_depth())
+      << "Queue Depth (== number of concurrent flush ops) may not exceed the number of blocks in "
+         "the log; please use different options!";
+
   const auto metric_name = [this](const std::string_view& property) {
     return batt::to_string("IoRingLogDevice_", this->name_, "_", property);
   };
@@ -60,8 +63,8 @@ inline BasicIoRingLogDriver<FlushOpImpl>::BasicIoRingLogDriver(
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline BasicIoRingLogDriver<FlushOpImpl>::~BasicIoRingLogDriver() noexcept
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline BasicIoRingLogDriver<FlushOpImpl, StorageT>::~BasicIoRingLogDriver() noexcept
 {
   global_metric_registry()  //
       .remove(this->trim_pos_)
@@ -71,15 +74,15 @@ inline BasicIoRingLogDriver<FlushOpImpl>::~BasicIoRingLogDriver() noexcept
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline Status BasicIoRingLogDriver<FlushOpImpl>::open()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline Status BasicIoRingLogDriver<FlushOpImpl, StorageT>::open()
 {
   // Read all blocks into the ring buffer.
   //
   Status data_read = this->read_log_data();
   BATT_REQUIRE_OK(data_read) << BATT_INSPECT(this->name_);
 
-  Status fd_registered = this->file_.register_fd();
+  Status fd_registered = this->storage_.register_fd();
   BATT_REQUIRE_OK(fd_registered);
 
   // First initialize all ops in the queue pipeline to point back at this driver.  IMPORTANT: this
@@ -89,8 +92,8 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::open()
     op.initialize(this);
   }
 
-  StatusOr<usize> buffers_registered = this->ioring_.register_buffers(
-      as_seq(this->flush_ops_) | seq::map([](const IoRingLogFlushOp& op) {
+  StatusOr<usize> buffers_registered = this->storage_.register_buffers(
+      as_seq(this->flush_ops_) | seq::map([](const Self::FlushOp& op) {
         return op.get_buffer();
       }) |
       seq::boxed());
@@ -104,8 +107,8 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::open()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline Status BasicIoRingLogDriver<FlushOpImpl>::read_log_data()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline Status BasicIoRingLogDriver<FlushOpImpl, StorageT>::read_log_data()
 {
   BATT_CHECK(!this->flush_task_);
 
@@ -113,29 +116,25 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::read_log_data()
   // the read operations in the loop below.  After we are done, we must stop this background thread
   // and return the IoRing to its original state so that device driver can start up.
   //
-  this->ioring_.on_work_started();
+  this->storage_.on_work_started();
 
   // The background thread to process IO completions.
   //
-  std::thread ioring_thread{[this] {
-    LLFS_VLOG(1) << "ioring_thread started";
-    this->ioring_.run().IgnoreError();
-    LLFS_VLOG(1) << "ioring_thread returning";
-  }};
+  typename StorageT::EventLoopTask event_loop{this->storage_, this->name_};
 
   // Shut down the ioring and reset when we leave this scope.
   //
   const auto stop_ioring_thread = batt::finally([&] {
     LLFS_VLOG(1) << "Stopping ioring (IoRingLogDriver::read_log_data)";
-    this->ioring_.on_work_finished();
-    ioring_thread.join();
-    this->ioring_.reset();
+    this->storage_.on_work_finished();
+    event_loop.join();
+    this->storage_.reset_event_loop();
   });
 
   IoRingLogRecovery recovery{
       this->config_, this->context_.buffer_,
       /*read_data_fn=*/[this](i64 file_offset, MutableBuffer buffer) -> Status {
-        return this->file_.read_all(file_offset + this->config_.physical_offset, buffer);
+        return this->storage_.read_all(file_offset + this->config_.physical_offset, buffer);
       }};
 
   LLFS_VLOG(1) << "Starting log recovery..." << BATT_INSPECT(this->name_);
@@ -183,10 +182,10 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::read_log_data()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline Status BasicIoRingLogDriver<FlushOpImpl>::set_trim_pos(slot_offset_type trim_pos)
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline Status BasicIoRingLogDriver<FlushOpImpl, StorageT>::set_trim_pos(slot_offset_type trim_pos)
 {
-  LLFS_VLOG(1) << "BasicIoRingLogDriver<FlushOpImpl>::set_trim_pos(" << trim_pos << ")"
+  LLFS_VLOG(1) << "BasicIoRingLogDriver::set_trim_pos(" << trim_pos << ")"
                << BATT_INSPECT(this->trim_pos_.get_value());
 
   clamp_min_slot(this->trim_pos_, trim_pos);
@@ -196,8 +195,27 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::set_trim_pos(slot_offset_type t
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline Status BasicIoRingLogDriver<FlushOpImpl>::set_commit_pos(slot_offset_type commit_pos)
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline StatusOr<slot_offset_type> BasicIoRingLogDriver<FlushOpImpl, StorageT>::await_flush_pos(
+    slot_offset_type flush_pos)
+{
+  StatusOr<slot_offset_type> status_or = await_slot_offset(flush_pos, this->flush_pos_);
+
+  // If the flush_pos Watch has been closed, it may indicate there was an I/O error; check the
+  // LogStorageDriverContext and report any error status we find.
+  //
+  if (status_or.status() == batt::StatusCode::kClosed) {
+    BATT_REQUIRE_OK(this->context_.get_error_status());
+  }
+
+  return status_or;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline Status BasicIoRingLogDriver<FlushOpImpl, StorageT>::set_commit_pos(
+    slot_offset_type commit_pos)
 {
   clamp_min_slot(this->commit_pos_, commit_pos);
 
@@ -206,27 +224,35 @@ inline Status BasicIoRingLogDriver<FlushOpImpl>::set_commit_pos(slot_offset_type
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::halt()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::halt()
 {
   const bool previously_halted = this->halt_requested_.exchange(true);
   if (!previously_halted) {
-    LLFS_VLOG(1) << "BasicIoRingLogDriver<FlushOpImpl>::halt() - (trim="
-                 << this->trim_pos_.get_value() << " flush=" << this->flush_pos_.get_value()
+    LLFS_VLOG(1) << "BasicIoRingLogDriver::halt() - (driver=" << this->name_
+                 << " trim=" << this->trim_pos_.get_value()
+                 << " flush=" << this->flush_pos_.get_value()
                  << " commit=" << this->commit_pos_.get_value() << ")";
 
     this->trim_pos_.close();
     this->flush_pos_.close();
     this->commit_pos_.close();
+
+    this->storage_work_finished();
   }
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::join()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::join()
 {
   if (this->flush_task_) {
+    BATT_DEBUG_INFO(
+        BATT_INSPECT(this->halt_requested_)
+        << BATT_INSPECT(this->trim_pos_.is_closed()) << BATT_INSPECT(this->flush_pos_.is_closed())
+        << BATT_INSPECT(this->commit_pos_.is_closed()) << BATT_INSPECT(this->storage_working_));
+
     this->flush_task_->join();
     this->flush_task_ = None;
 
@@ -237,8 +263,8 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::join()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::start_flush_task()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::start_flush_task()
 {
   this->flush_task_.emplace(
       this->task_scheduler_.schedule_task(),
@@ -250,8 +276,8 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::start_flush_task()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::flush_task_main()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::flush_task_main()
 {
   Status status = [&]() -> Status {
     const u64 total_size = this->calculate().physical_size();
@@ -281,33 +307,38 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::flush_task_main()
           << BATT_INSPECT(commit_pos_);
     });
 
-    this->ioring_.on_work_started();
+    this->storage_work_started();
     this->poll_flush_state();
     this->poll_commit_state();
 
-    // Run the IoRing on a background thread so as not to tie up the executor on which this task
-    // is running.
+    // Process I/O events concurrently in the background so as not to tie up the executor on which
+    // this task is running.
     //
-    batt::Watch<bool> done{false};
-    std::thread io_thread{[this, &done] {
-      LLFS_VLOG(1) << "(driver=" << this->name_ << ") invoking IoRing::run()";
-
-      Status io_status = this->ioring_.run();
-      if (!io_status.ok()) {
-        LLFS_LOG_WARNING() << "(driver=" << this->name_
-                           << ") IoRing::run() returned: " << io_status;
-      }
-      done.set_value(true);
-    }};
+    typename StorageT::EventLoopTask event_loop{this->storage_, this->name_};
 
-    auto done_status = done.await_equal(true);
-    BATT_CHECK_OK(done_status);
-    io_thread.join();
+    // Wait for the event loop to exit.
+    //
+    event_loop.join();
+
+    // Now it is safe to close the storage layer (i.e. direct I/O block file).
+    //
+    this->storage_close_status_ = this->storage_.close();
+
+    if (!this->storage_close_status_.ok()) {
+      if (default_ioring_quiet_failure_logging()) {
+        LLFS_VLOG(1) << "Failed to close storage for IoRingLogDevice;"
+                     << BATT_INSPECT_STR(this->name_) << BATT_INSPECT(this->storage_close_status_);
+      } else {
+        LLFS_LOG_WARNING() << "Failed to close storage for IoRingLogDevice;"
+                           << BATT_INSPECT_STR(this->name_)
+                           << BATT_INSPECT(this->storage_close_status_);
+      }
+    }
 
     return OkStatus();
   }();
 
-  if (!this->halt_requested_.load()) {
+  if (!this->halt_requested_.load() && this->storage_working_.load()) {
     LLFS_LOG_WARNING() << "[IoRingLogDriver::flush_task] exited unexpectedly with status="
                        << status;
   } else {
@@ -317,20 +348,33 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::flush_task_main()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::poll_flush_state()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::poll_flush_state()
 {
   this->flush_state_->poll(this);
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::poll_commit_state()
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::report_flush_error(Status error_status)
+{
+  this->context_.update_error_status(error_status);
+  this->flush_pos_.close();
+  this->storage_work_finished();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::poll_commit_state()
 {
+  LLFS_VLOG(2) << "(driver=" << this->name_ << ") poll_commit_state() entered";
+
   // Don't recursively re-enter `poll_commit_state`.
   //
   if (this->inside_poll_commit_state_) {
+    LLFS_VLOG(2) << "(driver=" << this->name_ << ") poll_commit_state() recursive call - returning";
     return;
   }
   this->inside_poll_commit_state_ = true;
@@ -341,6 +385,8 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::poll_commit_state()
   // Return immediately if there are no flush ops waiting for `commit_pos_` to advance.
   //
   if (this->waiting_for_commit_.empty()) {
+    LLFS_VLOG(2) << "(driver=" << this->name_
+                 << ") poll_commit_state() waiting_for_commit_ is empty - returning";
     return;
   }
 
@@ -363,8 +409,9 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::poll_commit_state()
       if (!this->commit_pos_listener_active_) {
         this->commit_pos_listener_active_ = true;
 
-        LLFS_VLOG(2) << "(driver=" << this->name_ << ")" << BATT_INSPECT(known_commit_pos)
-                     << BATT_INSPECT(next_wait_pos);
+        LLFS_VLOG(2) << "(driver=" << this->name_ << ") waiting on commit_pos;"
+                     << BATT_INSPECT(known_commit_pos) << BATT_INSPECT(next_wait_pos)
+                     << BATT_INSPECT(this->commit_pos_.is_closed());
 
         // If we break out of this loop before we completely drain `waiting_for_commit_`, we must
         // start another wait operation.
@@ -374,6 +421,8 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::poll_commit_state()
             make_custom_alloc_handler(         //
                 this->commit_handler_memory_,  //
                 [this](const StatusOr<slot_offset_type>& updated_commit_pos) {
+                  LLFS_VLOG(2) << "(driver=" << this->name_
+                               << ") commit_pos_ updated: " << updated_commit_pos;
                   this->handle_commit_pos_update(updated_commit_pos);
                 }));
       }
@@ -395,8 +444,9 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::poll_commit_state()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::wait_for_commit(slot_offset_type least_upper_bound)
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::wait_for_commit(
+    slot_offset_type least_upper_bound)
 {
   this->waiting_for_commit_.push(least_upper_bound);
   this->poll_commit_state();
@@ -404,36 +454,60 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::wait_for_commit(slot_offset_type
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::handle_commit_pos_update(
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::handle_commit_pos_update(
     const StatusOr<slot_offset_type>& updated_commit_pos)
 {
   // VERY IMPORTANT: we must execute the actual handler logic on the ioring thread to avoid data
   // races!
   //
-  this->ioring_.post(make_custom_alloc_handler(  //
-      this->commit_handler_memory_,              //
+  this->storage_.post_to_event_loop(make_custom_alloc_handler(  //
+      this->commit_handler_memory_,                             //
       [this, updated_commit_pos](const StatusOr<i32>& post_result) {
+        LLFS_VLOG(2) << "(driver=" << this->name_ << ") handle_commit_pos_update("
+                     << updated_commit_pos << ")" << BATT_INSPECT(post_result);
+
         this->commit_pos_listener_active_ = false;
 
         if (!updated_commit_pos.ok() || !post_result.ok()) {
-          this->ioring_.on_work_finished();
-          this->ioring_.stop();
+          this->storage_work_finished();
           return;
         }
 
-        LLFS_VLOG(2) << "(driver=" << this->name_
-                     << ") commit_pos listener invoked: " << updated_commit_pos;
-
         this->poll_commit_state();
       }));
 }
 
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::storage_work_started()
+{
+  const bool was_working = this->storage_working_.exchange(true);
+  BATT_CHECK(!was_working);
+
+  this->storage_.on_work_started();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::storage_work_finished()
+{
+  const bool was_working = this->storage_working_.exchange(false);
+  if (was_working) {
+    this->storage_.on_work_finished();
+  }
+  // else:
+  //   Don't assert/check here, since there are multiple legitimate places where we could call
+  //   `on_work_finished`.
+}
+
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
 // class FlushState
 //
-template <template <typename> class FlushOpImpl>
-inline BasicIoRingLogDriver<FlushOpImpl>::FlushState::FlushState(
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline BasicIoRingLogDriver<FlushOpImpl, StorageT>::FlushState::FlushState(
     BasicIoRingLogDriver* driver) noexcept
     : flushed_upper_bound_{driver->get_flush_pos()}
 
@@ -451,8 +525,9 @@ inline BasicIoRingLogDriver<FlushOpImpl>::FlushState::FlushState(
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline void BasicIoRingLogDriver<FlushOpImpl>::FlushState::poll(BasicIoRingLogDriver* driver)
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline void BasicIoRingLogDriver<FlushOpImpl, StorageT>::FlushState::poll(
+    BasicIoRingLogDriver* driver)
 {
   bool update = false;
 
@@ -486,9 +561,9 @@ inline void BasicIoRingLogDriver<FlushOpImpl>::FlushState::poll(BasicIoRingLogDr
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-template <template <typename> class FlushOpImpl>
-inline slot_offset_type BasicIoRingLogDriver<FlushOpImpl>::FlushState::get_flushed_upper_bound()
-    const
+template <template <typename> class FlushOpImpl, typename StorageT>
+inline slot_offset_type
+BasicIoRingLogDriver<FlushOpImpl, StorageT>::FlushState::get_flushed_upper_bound() const
 {
   return this->flushed_upper_bound_;
 }
diff --git a/src/llfs/ioring_log_driver_fwd.hpp b/src/llfs/ioring_log_driver_fwd.hpp
new file mode 100644
index 0000000..6d2d45d
--- /dev/null
+++ b/src/llfs/ioring_log_driver_fwd.hpp
@@ -0,0 +1,26 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#pragma once
+#ifndef LLFS_IORING_LOG_DRIVER_FWD_HPP
+#define LLFS_IORING_LOG_DRIVER_FWD_HPP
+
+#include <llfs/config.hpp>
+
+namespace llfs {
+
+#ifndef LLFS_DISABLE_IO_URING
+
+template <template <typename> class FlushOpImpl, typename StorageT>
+class BasicIoRingLogDriver;
+
+#endif  // LLFS_DISABLE_IO_URING
+
+}  //namespace llfs
+
+#endif  // LLFS_IORING_LOG_DRIVER_FWD_HPP
diff --git a/src/llfs/ioring_log_driver_options.hpp b/src/llfs/ioring_log_driver_options.hpp
index b47c08e..4bf22f4 100644
--- a/src/llfs/ioring_log_driver_options.hpp
+++ b/src/llfs/ioring_log_driver_options.hpp
@@ -68,6 +68,20 @@ class IoRingLogDriverOptions
     return *this;
   }
 
+  /** \brief Sets queue depth to the smallest power of 2 that is not greater than `max_n` *and* not
+   * greater than the current value of queue depth.
+   *
+   * `max_n` must be at least 2.
+   */
+  Self& limit_queue_depth(usize max_n)
+  {
+    BATT_CHECK_GT(max_n, 1);
+    while (this->queue_depth() > max_n) {
+      --this->queue_depth_log2;
+    }
+    return *this;
+  }
+
   usize queue_depth_mask() const
   {
     return this->queue_depth() - 1;
diff --git a/src/llfs/ioring_log_flush_op.hpp b/src/llfs/ioring_log_flush_op.hpp
index 6f2cc90..3e42e2d 100644
--- a/src/llfs/ioring_log_flush_op.hpp
+++ b/src/llfs/ioring_log_flush_op.hpp
@@ -17,6 +17,8 @@
 #include <llfs/data_layout.hpp>
 #include <llfs/int_types.hpp>
 #include <llfs/ioring.hpp>
+#include <llfs/ioring_log_device_storage.hpp>
+#include <llfs/ioring_log_driver_fwd.hpp>
 #include <llfs/log_block_calculator.hpp>
 #include <llfs/metrics.hpp>
 #include <llfs/packed_log_page_buffer.hpp>
@@ -35,11 +37,25 @@ namespace llfs {
 template <typename DriverImpl>
 class BasicIoRingLogFlushOp;
 
-template <template <typename> class FlushOpImpl>
-class BasicIoRingLogDriver;
-
-using IoRingLogFlushOp = BasicIoRingLogFlushOp<BasicIoRingLogDriver<BasicIoRingLogFlushOp>>;
+using IoRingLogFlushOp = BasicIoRingLogFlushOp<
+    BasicIoRingLogDriver<BasicIoRingLogFlushOp, DefaultIoRingLogDeviceStorage>>;
 
+/** \brief The global default setting for whether IoRingLogDevices should log failures at INFO or
+ * higher level by default.
+ *
+ * This exists mostly as a convenience for testing, so that the test output doesn't contain a large
+ * number of injected/simulated failure log messages.
+ */
+inline std::atomic<bool>& default_ioring_quiet_failure_logging()
+{
+  static std::atomic<bool> be_quiet_{false};
+  return be_quiet_;
+}
+
+/** \brief Flushes data from the in-memory ring buffer to log storage asynchronously.
+ *
+ * Concurrent flush operations are implemented by instantiating a number of objects of this type.
+ */
 template <typename DriverImpl>
 class BasicIoRingLogFlushOp
 {
@@ -151,7 +167,7 @@ class BasicIoRingLogFlushOp
     return this->debug_info_message_;
   }
 
-  std::atomic<bool> quiet_failure_logging{false};
+  std::atomic<bool> quiet_failure_logging{default_ioring_quiet_failure_logging().load()};
 
  private:
   // Return the committed data portion of the block buffer, aligned to 512-byte boundaries.
diff --git a/src/llfs/ioring_log_flush_op.ipp b/src/llfs/ioring_log_flush_op.ipp
index b46adbf..7391400 100644
--- a/src/llfs/ioring_log_flush_op.ipp
+++ b/src/llfs/ioring_log_flush_op.ipp
@@ -164,12 +164,11 @@ inline void BasicIoRingLogFlushOp<DriverImpl>::handle_commit(slot_offset_type kn
   PackedLogPageHeader* const header = this->get_header();
 
   const slot_offset_type known_flush_pos = header->slot_offset + header->commit_size;
+  const bool have_data_to_flush = slot_less_than(known_flush_pos, known_commit_pos);
 
   THIS_VLOG(1) << "handle_commit(known_commit_pos=" << known_commit_pos << ")"
                << BATT_INSPECT(header->slot_offset) << BATT_INSPECT(header->commit_size)
-               << BATT_INSPECT(known_flush_pos);
-
-  const bool have_data_to_flush = slot_less_than(known_flush_pos, known_commit_pos);
+               << BATT_INSPECT(known_flush_pos) << BATT_INSPECT(have_data_to_flush);
 
   // We should only suspend this op waiting for data if the current log block is known to be
   // initialized; otherwise we continue and flush whatever data we have (even if it is zero bytes)
@@ -563,12 +562,19 @@ inline bool BasicIoRingLogFlushOp<DriverImpl>::handle_errors(const StatusOr<i32>
       }
       return true;
     }
-    if (!this->quiet_failure_logging &&
-        result.status() != ::llfs::make_status(StatusCode::kIoRingShutDown)) {
+
+    const bool normal_shutdown_error =
+        (result.status() == ::llfs::make_status(StatusCode::kIoRingShutDown));
+
+    if (!this->quiet_failure_logging && !normal_shutdown_error) {
       LLFS_LOG_INFO() << "flush failed: " << result.status();
     } else {
       LLFS_VLOG(1) << "flush failed: " << result.status();
     }
+
+    if (!normal_shutdown_error) {
+      this->driver_->report_flush_error(result.status());
+    }
     return true;
   }
 
diff --git a/src/llfs/ioring_log_flush_op.test.cpp b/src/llfs/ioring_log_flush_op.test.cpp
index 52d4751..d2c7f15 100644
--- a/src/llfs/ioring_log_flush_op.test.cpp
+++ b/src/llfs/ioring_log_flush_op.test.cpp
@@ -393,6 +393,9 @@ class IoRingLogFlushOpModel
                                             ::testing::_ /*handler*/))
         .WillRepeatedly(::testing::InvokeArgument<1>(this->calculate_->block_count()));
 
+    EXPECT_CALL(*this->driver_, report_flush_error(::testing::_ /*error status*/))
+        .WillRepeatedly(::testing::Return());
+
     //----- --- -- -  -  -   -
 
     // Create the expected flush op state.
diff --git a/src/llfs/ioring_log_flush_op.test.hpp b/src/llfs/ioring_log_flush_op.test.hpp
index dfae0b0..0f6c339 100644
--- a/src/llfs/ioring_log_flush_op.test.hpp
+++ b/src/llfs/ioring_log_flush_op.test.hpp
@@ -75,6 +75,8 @@ class MockIoRingLogDriver
 
   MOCK_METHOD(void, poll_flush_state, (), ());
 
+  MOCK_METHOD(void, report_flush_error, (Status), ());
+
   MOCK_METHOD(void, update_init_upper_bound, (LogBlockCalculator::PhysicalBlockIndex), ());
 
   MOCK_METHOD(usize, get_init_upper_bound, (), (const));
diff --git a/src/llfs/ioring_log_initializer.cpp b/src/llfs/ioring_log_initializer.cpp
index f3d8312..cd02a0d 100644
--- a/src/llfs/ioring_log_initializer.cpp
+++ b/src/llfs/ioring_log_initializer.cpp
@@ -50,7 +50,7 @@ Status initialize_ioring_log_device(RawBlockFile& file, const IoRingLogConfig& c
       BATT_REQUIRE_OK(init_status);
 
     } else {
-      LLFS_LOG_INFO() << "Using slow path for log device initialization";
+      LLFS_LOG_INFO_FIRST_N(10) << "Using slow path for log device initialization";
 
       PackedLogPageBuffer buffer;
       buffer.clear();
diff --git a/src/llfs/ioring_log_initializer.ipp b/src/llfs/ioring_log_initializer.ipp
index 2da5596..bbb3ce4 100644
--- a/src/llfs/ioring_log_initializer.ipp
+++ b/src/llfs/ioring_log_initializer.ipp
@@ -57,14 +57,14 @@ inline batt::Status BasicIoRingLogInitializer<IoRingImpl>::run()
 
     // Map our memory buffer to the kernel for faster I/O.
     //
-    StatusOr<usize> buffers_status = this->file_.get_io_ring().register_buffers(
-        seq::single_item(std::move(memory)) | seq::boxed());
+    StatusOr<usize> buffers_status = this->file_.get_io_ring_impl()->register_buffers(
+        seq::single_item(std::move(memory)) | seq::boxed(), /*update=*/false);
 
     LLFS_VLOG(2) << "register_buffers status=" << buffers_status;
     BATT_REQUIRE_OK(buffers_status);
   }
   auto on_scope_exit = batt::finally([&] {
-    this->file_.get_io_ring().unregister_buffers().IgnoreError();
+    this->file_.get_io_ring_impl()->unregister_buffers().IgnoreError();
     LLFS_VLOG(1) << "IoRingLogInitializer::run() Finished";
   });
 
diff --git a/src/llfs/ioring_log_recovery.cpp b/src/llfs/ioring_log_recovery.cpp
index 2e8ecdf..7adedd1 100644
--- a/src/llfs/ioring_log_recovery.cpp
+++ b/src/llfs/ioring_log_recovery.cpp
@@ -10,6 +10,7 @@
 //
 #include <llfs/data_reader.hpp>
 #include <llfs/logging.hpp>
+#include <llfs/slot_writer.hpp>
 
 #include <batteries/stream_util.hpp>
 
@@ -44,7 +45,7 @@ Status IoRingLogRecovery::run()
        ++block_i, file_offset += this->config_.block_size()) {
     //----- --- -- -  -  -   -
     LLFS_VLOG(2) << "Reading " << BATT_INSPECT(block_i) << "/" << block_count << " from "
-                 << BATT_INSPECT(file_offset);
+                 << BATT_INSPECT(file_offset) << BATT_INSPECT(this->block_buffer().size());
 
     BATT_CHECK_LE(known_valid_blocks, block_count);
 
@@ -250,6 +251,10 @@ void IoRingLogRecovery::recover_flush_pos()
 
   ConstBuffer committed_bytes = resize_buffer(this->ring_buffer_.get(slot_offset),
                                               committed_ranges.front().offset_range.size());
+
+  slot_offset_type confirmed_flush_pos = slot_offset;
+  bool inside_atomic_range = false;
+
   for (;;) {
     LLFS_VLOG_EVERY_N(2, kUpdateCadence)
         << " -- attempting to recover log entry at " << BATT_INSPECT(slot_offset);
@@ -286,13 +291,31 @@ void IoRingLogRecovery::recover_flush_pos()
                    << BATT_INSPECT(slot_size);
       break;
     }
+
+    // Check for control token; this indicates the beginning or end of an atomic slot range.
+    //
+    if (*slot_body_size == 0) {
+      if (slot_header_size == SlotWriter::WriterLock::kBeginAtomicRangeTokenSize) {
+        inside_atomic_range = true;
+      } else if (slot_header_size == SlotWriter::WriterLock::kEndAtomicRangeTokenSize) {
+        inside_atomic_range = false;
+      }
+    }
+
     committed_bytes += slot_size;
     slot_offset += slot_size;
+
+    // If inside an atomic slot range, we hold off on updating the confirmed_flush_pos, just in case
+    // the flushed data is cut off before the end of the atomic range.
+    //
+    if (!inside_atomic_range) {
+      confirmed_flush_pos = slot_offset;
+    }
   }
 
   LLFS_VLOG(1) << " -- Slot scan complete;" << BATT_INSPECT(slot_offset);
 
-  this->flush_pos_ = slot_offset;
+  this->flush_pos_ = confirmed_flush_pos;
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/latching_bit_set.test.cpp b/src/llfs/latching_bit_set.test.cpp
index c87eb3d..27b5837 100644
--- a/src/llfs/latching_bit_set.test.cpp
+++ b/src/llfs/latching_bit_set.test.cpp
@@ -32,7 +32,7 @@ TEST(LatchingBitSetTest, Size0)
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-TEST(LatchingBitSetTest, Size1)
+TEST(LatchingBitSetTest, Size1Death)
 {
   llfs::LatchingBitSet s{1};
 
diff --git a/src/llfs/log_device.hpp b/src/llfs/log_device.hpp
index 94f8090..348e4aa 100644
--- a/src/llfs/log_device.hpp
+++ b/src/llfs/log_device.hpp
@@ -82,46 +82,87 @@ class LogDevice
 
   virtual ~LogDevice() = default;
 
-  // The maximum capacity in bytes of this log device.
-  //
+  /** \brief The maximum capacity in bytes of this log device.
+   */
   virtual u64 capacity() const = 0;
 
-  // The current size of all committed data in the log.
-  //
+  /** \brief The current size of all committed data in the log (commit_pos - trim_pos).
+   */
   virtual u64 size() const = 0;
 
-  // Convenience; the current available space.
-  //
+  /** \brief Convenience; the current available space (this->capacity() - this->size()).
+   */
   virtual u64 space() const
   {
     return this->capacity() - this->size();
   }
 
-  // Trim the log at `slot_lower_bound`.  May not take effect immediately if there are active
-  // Readers whose slot_offset is below `slot_lower_bound`.
-  //
+  /** \brief Trims the log at `slot_lower_bound`.
+   *
+   * May not take effect immediately if there are active Readers whose slot_offset is below
+   * `slot_lower_bound`, and/or if the implementation uses asynchronous data flushing.
+   */
   virtual Status trim(slot_offset_type slot_lower_bound) = 0;
 
-  // Create a new reader.
-  //
+  /** \brief Creates a new reader.
+   *
+   * If `slot_lower_bound` is None, then the current trim position is assumed.
+   *
+   * The `mode` arg determines what part of the log's contents can be seen by the returned reader.
+   * If mode is LogReadMode::kDurable, then the reader will only see up to the flush position.  If
+   * it is LogReadMode::kSpeculative, then the reader will see up to the commit position.  If
+   * LogReadMode::kInconsistent is used, then there is no guarantee provided to the caller as far as
+   * what data will be readable; the implementation should make a best effort attempt to include as
+   * much as it can (up to the commit position), while offering as little overhead as possible. What
+   * `kInconsistent` means will vary by implementation.
+   *
+   * The returned Reader will see a "live" view of the LogDevice as it is appended and trimmed.
+   */
   virtual std::unique_ptr<LogDevice::Reader> new_reader(Optional<slot_offset_type> slot_lower_bound,
                                                         LogReadMode mode) = 0;
 
-  // Returns the current active slot range for the log.  `mode` determines whether the upper bound
-  // will be the flushed or committed upper bound.
-  //
+  /** \brief Returns the current active slot range for the log.  `mode` determines whether the upper
+   * bound will be the flushed or committed upper bound.
+   */
   virtual SlotRange slot_range(LogReadMode mode) = 0;
 
-  // There can be only one Writer at a time.
-  //
+  /** \brief Returns the Writer associated with this LogDevice.
+   *
+   * There can only be one thread at a time using the Writer instance returned by this function.
+   */
   virtual LogDevice::Writer& writer() = 0;
 
+  /** \brief Performs a synchronous shutdown of the LogDevice, including all resources it is using
+   * and all background tasks it might be employing.
+   */
   virtual Status close() = 0;
 
+  /** \brief Initiates shutdown of the LogDevice, all resources it uses, and all background tasks it
+   * is running.
+   *
+   * This function may return before shutdown of the LogDevice has finished.  To block awaiting the
+   * completion of shutdown, use LogDevice::join().
+   */
+  virtual void halt()
+  {
+  }
+
+  /** \brief Blocks the caller until the LogDevice has been completely shut down.
+   *
+   * This function does not initiate the shutdown; see LogDevice::halt().
+   */
+  virtual void join()
+  {
+  }
+
+  /** \brief Blocks the caller until the specified event has happened; the upper bound implied in
+   * `event` is either the flush position (if mode is kDurable) or commit position (if mode is
+   * kSpeculative).
+   */
   virtual Status sync(LogReadMode mode, SlotUpperBoundAt event) = 0;
 
-  // Convenience: wait for kSpeculative to catch up to kDurable.
-  //
+  /** \brief Convenience: wait for kSpeculative to catch up to kDurable.
+   */
   Status flush()
   {
     return this->sync(LogReadMode::kDurable,
@@ -235,28 +276,28 @@ class LogDevice::Reader
 
   virtual ~Reader() = default;
 
-  // Check whether the log device is closed.
-  //
+  /** \brief Check whether the log device is closed.
+   */
   virtual bool is_closed() = 0;
 
-  // The current log contents.  The memory returned by this method is a valid reflection of this
-  // part of the log.  Even if `consume` invalidates some prefix of `data()`, the remaining portion
-  // will still be valid. Likewise, once await returns Ok to indicate there is more data ready to
-  // read, calling `data()` again will return the same memory with some extra at the end.
-  //
+  /** \brief The current log contents.  The memory returned by this method is a valid reflection of
+   * this part of the log.  Even if `consume` invalidates some prefix of `data()`, the remaining
+   * portion will still be valid. Likewise, once await returns Ok to indicate there is more data
+   * ready to read, calling `data()` again will return the same memory with some extra at the end.
+   */
   virtual ConstBuffer data() = 0;
 
-  // The current offset in bytes of this reader, relative to the start of the log.
-  //
+  /** \brief The current offset in bytes of this reader, relative to the start of the log.
+   */
   virtual slot_offset_type slot_offset() = 0;
 
-  // Releases ownership of some prefix of `data()` (possibly all of it).  See description of
-  // `data()` for more details.
-  //
+  /** \brief Releases ownership of some prefix of `data()` (possibly all of it).  See description of
+   * `data()` for more details.
+   */
   virtual void consume(usize byte_count) = 0;
 
-  // Wait for the log to reach the specified state.
-  //
+  /** \brief Wait for the log to reach the specified state.
+   */
   virtual Status await(LogDevice::ReaderEvent event) = 0;
 };
 
@@ -284,36 +325,39 @@ class LogDevice::Writer
 
   virtual ~Writer() = default;
 
-  // The current available space.
-  //
+  /** \brief The current available space (in bytes).
+   */
   virtual u64 space() const = 0;
 
-  // The next slot offset to be written.  Updated by `commit`.
-  //
+  /** \brief The next slot offset to be written.  Updated by `commit`.
+   */
   virtual slot_offset_type slot_offset() = 0;
 
-  // Allocate memory to write a new log slot of size `byte_count`.  Return error if not enough
-  // space.
-  //
-  // `head_room` (unit=bytes) specifies an additional amount of space to ensure is available in the
-  // log before returning success.  The head room is not included in the returned buffer.  Rather,
-  // its purpose is to allow differentiated levels of priority amongst slots written to the log.
-  // Without this, deadlock might be possible.  For example, a common scheme for log-event-driven
-  // state machines is to store periodic checkpoints with deltas in between.  If deltas are allowed
-  // to fill the entire capacity of the log, then there will be no room left to write a checkpoint,
-  // and trimming the log will be impossible, thus deadlocking the system.
-  //
+  /** Allocate memory to write a new log slot of size `byte_count`.  Return error if not enough
+   * space.
+   *
+   * This function may be called multiple times to attempt to allocate progressively larger buffers
+   * before a single call to commit.
+   *
+   * `head_room` (unit=bytes) specifies an additional amount of space to ensure is available in the
+   * log before returning success.  The head room is not included in the returned buffer.  Rather,
+   * its purpose is to allow differentiated levels of priority amongst slots written to the log.
+   * Without this, deadlock might be possible.  For example, a common scheme for log-event-driven
+   * state machines is to store periodic checkpoints with deltas in between.  If deltas are allowed
+   * to fill the entire capacity of the log, then there will be no room left to write a checkpoint,
+   * and trimming the log will be impossible, thus deadlocking the system.
+   */
   virtual StatusOr<MutableBuffer> prepare(usize byte_count, usize head_room = 0) = 0;
 
-  // Commits `byte_count` bytes; does not guarantee that these bytes are durable yet; a Reader may
-  // be created to await the flush of a certin slot offset.
-  //
-  // Returns the new end (slot upper bound) of the log.
-  //
+  /** \brief Commits `byte_count` bytes; does not guarantee that these bytes are durable yet; a
+   * Reader may be created to await the flush of a certin slot offset.
+   *
+   * Returns the new end (slot upper bound) of the log.
+   */
   virtual StatusOr<slot_offset_type> commit(usize byte_count) = 0;
 
-  // Wait for the log to reach the specified state.
-  //
+  /** \brief Wait for the log to reach the specified state.
+   */
   virtual Status await(LogDevice::WriterEvent event) = 0;
 };
 
diff --git a/src/llfs/log_device_config.cpp b/src/llfs/log_device_config.cpp
index 15377fb..2334894 100644
--- a/src/llfs/log_device_config.cpp
+++ b/src/llfs/log_device_config.cpp
@@ -78,9 +78,11 @@ Status configure_storage_object(StorageFileBuilder::Transaction& txn,
 //
 StatusOr<std::unique_ptr<IoRingLogDeviceFactory>> recover_storage_object(
     const batt::SharedPtr<StorageContext>& storage_context, const std::string& file_name,
-    const FileOffsetPtr<const PackedLogDeviceConfig&>& p_config,
-    const IoRingLogDriverOptions& options)
+    const FileOffsetPtr<const PackedLogDeviceConfig&>& p_config, IoRingLogDriverOptions options)
 {
+  BATT_ASSIGN_OK_RESULT(usize block_count, p_config->block_count());
+  options.limit_queue_depth(block_count);
+
   const int flags = O_DIRECT | O_SYNC | O_RDWR;
 
   int fd = batt::syscall_retry([&] {
diff --git a/src/llfs/log_device_config.hpp b/src/llfs/log_device_config.hpp
index 4a4c7b5..c90305d 100644
--- a/src/llfs/log_device_config.hpp
+++ b/src/llfs/log_device_config.hpp
@@ -45,8 +45,7 @@ Status configure_storage_object(StorageFileBuilder::Transaction&,
 
 StatusOr<std::unique_ptr<IoRingLogDeviceFactory>> recover_storage_object(
     const batt::SharedPtr<StorageContext>& storage_context, const std::string& file_name,
-    const FileOffsetPtr<const PackedLogDeviceConfig&>& p_config,
-    const IoRingLogDriverOptions& options);
+    const FileOffsetPtr<const PackedLogDeviceConfig&>& p_config, IoRingLogDriverOptions options);
 
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
 //
@@ -207,6 +206,17 @@ struct PackedLogDeviceConfig : PackedConfigSlotHeader {
   {
     return kLogPageSize * this->pages_per_block();
   }
+
+  StatusOr<usize> block_count() const
+  {
+    // If there isn't a whole number of blocks, then this config is corrupted/invalid.
+    //
+    if (this->physical_size % this->block_size()) {
+      return {batt::StatusCode::kDataLoss};
+    }
+
+    return this->physical_size / this->block_size();
+  }
 };
 
 BATT_STATIC_ASSERT_EQ(sizeof(PackedLogDeviceConfig), PackedLogDeviceConfig::kSize);
diff --git a/src/llfs/log_storage_driver_context.hpp b/src/llfs/log_storage_driver_context.hpp
index 0ba0d7c..b5faf6c 100644
--- a/src/llfs/log_storage_driver_context.hpp
+++ b/src/llfs/log_storage_driver_context.hpp
@@ -10,7 +10,12 @@
 #ifndef LLFS_LOG_STORAGE_DRIVER_CONTEXT_HPP
 #define LLFS_LOG_STORAGE_DRIVER_CONTEXT_HPP
 
+#include <llfs/config.hpp>
+//
 #include <llfs/ring_buffer.hpp>
+#include <llfs/status.hpp>
+
+#include <batteries/async/mutex.hpp>
 
 #include <atomic>
 
@@ -21,7 +26,35 @@ struct LogStorageDriverContext {
   {
   }
 
+  /** \brief Updates the stored error status with the passed value.
+   */
+  void update_error_status(Status status) noexcept
+  {
+    batt::ScopedLock<Status> locked{this->error_status_};
+
+    locked->Update(status);
+  }
+
+  /** \brief Sets the stored error status to the passed value.
+   */
+  void set_error_status(Status status) noexcept
+  {
+    batt::ScopedLock<Status> locked{this->error_status_};
+
+    *locked = status;
+  }
+
+  /** \brief Returns the stored error status.
+   */
+  Status get_error_status() noexcept
+  {
+    batt::ScopedLock<Status> locked{this->error_status_};
+
+    return *locked;
+  }
+
   std::atomic<bool> closed_{false};
+  batt::Mutex<Status> error_status_{OkStatus()};
   RingBuffer buffer_;
 };
 
diff --git a/src/llfs/memory_log_device.hpp b/src/llfs/memory_log_device.hpp
index 798bc53..663afa0 100644
--- a/src/llfs/memory_log_device.hpp
+++ b/src/llfs/memory_log_device.hpp
@@ -84,12 +84,23 @@ class MemoryLogStorageDriver /*Impl*/
   //----
 
   Status close()
+  {
+    this->halt();
+    this->join();
+
+    return OkStatus();
+  }
+
+  void halt()
   {
     this->trim_pos_.close();
     this->manual_flush_pos_.close();
     this->commit_pos_.close();
+  }
 
-    return OkStatus();
+  void join()
+  {
+    // Nothing to do.
   }
 
   //+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/packed_log_page_buffer.hpp b/src/llfs/packed_log_page_buffer.hpp
index 7f428fc..96ab352 100644
--- a/src/llfs/packed_log_page_buffer.hpp
+++ b/src/llfs/packed_log_page_buffer.hpp
@@ -10,13 +10,16 @@
 #ifndef LLFS_PACKED_LOG_PAGE_BUFFER_HPP
 #define LLFS_PACKED_LOG_PAGE_BUFFER_HPP
 
-#include <llfs/buffer.hpp>
 #include <llfs/config.hpp>
+//
+#include <llfs/buffer.hpp>
 #include <llfs/int_types.hpp>
 #include <llfs/packed_log_page_header.hpp>
 
 #include <batteries/static_assert.hpp>
 
+#include <type_traits>
+
 namespace llfs {
 
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
diff --git a/src/llfs/packed_status_or.test.cpp b/src/llfs/packed_status_or.test.cpp
index 81b344c..9c81708 100644
--- a/src/llfs/packed_status_or.test.cpp
+++ b/src/llfs/packed_status_or.test.cpp
@@ -19,7 +19,7 @@ namespace {
 
 using namespace llfs::int_types;
 
-TEST(PackedStatusOrTest, PackUnPack)
+TEST(PackedStatusOrTest, PackUnPackDeath)
 {
   batt::Status not_found_status{batt::StatusCode::kNotFound};
 
diff --git a/src/llfs/page_allocator.cpp b/src/llfs/page_allocator.cpp
index 2a9804b..e58b028 100644
--- a/src/llfs/page_allocator.cpp
+++ b/src/llfs/page_allocator.cpp
@@ -169,7 +169,7 @@ void PageAllocator::halt() noexcept
   this->stop_requested_.set_value(true);
 
   this->slot_writer_.halt();
-  this->log_device_->close().IgnoreError();
+  this->log_device_->halt();
   this->state_->halt();
   this->checkpoint_grant_.revoke();
 }
@@ -177,6 +177,7 @@ void PageAllocator::halt() noexcept
 void PageAllocator::join() noexcept
 {
   this->checkpoint_task_.join();
+  this->log_device_->join();
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/page_allocator.test.cpp b/src/llfs/page_allocator.test.cpp
index 04f7f4f..a88c575 100644
--- a/src/llfs/page_allocator.test.cpp
+++ b/src/llfs/page_allocator.test.cpp
@@ -13,9 +13,11 @@
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
+#include <llfs/testing/fake_log_device.hpp>
+#include <llfs/testing/test_config.hpp>
+
 #include <llfs/log_device_snapshot.hpp>
 #include <llfs/memory_log_device.hpp>
-#include <llfs/testing/fake_log_device.hpp>
 #include <llfs/uuid.hpp>
 
 #include <batteries/async/fake_execution_context.hpp>
@@ -137,6 +139,8 @@ TEST(PageAllocatorTest, UpdateRefCounts)
 
 TEST(PageAllocatorTest, LogCrashRecovery)
 {
+  llfs::testing::TestConfig test_config;
+
   llfs::suppress_log_output_for_test() = true;
   auto undo_suppress = batt::finally([] {
     llfs::suppress_log_output_for_test() = false;
@@ -152,7 +156,7 @@ TEST(PageAllocatorTest, LogCrashRecovery)
   std::uniform_int_distribution<i32> pick_ref_count_delta(-5, +5);
   std::uniform_int_distribution<u64> pick_failure_time(1u, 4096u);
 
-  const bool extra_testing = batt::getenv_as<int>("LLFS_EXTRA_TESTING").value_or(0);
+  const bool extra_testing = test_config.extra_testing();
 
   constexpr u64 kStartSeed = 0;
   const u64 kEndSeed = (extra_testing ? (10000 * kNumSeeds) : kNumSeeds) + kStartSeed;
@@ -181,8 +185,6 @@ TEST(PageAllocatorTest, LogCrashRecovery)
         /*size=*/PageAllocator::calculate_log_size(/*physical_page_count=*/kNumPages,
                                                    /*max_attachments=*/kMaxAttachments)};
 
-    LLFS_LOG_INFO_FIRST_N(1) << BATT_INSPECT(mem_log.space());
-
     auto fake_log_state = std::make_shared<FakeLogDevice::State>();
 
     FakeLogDeviceFactory<MemoryLogStorageDriver> fake_log_factory{mem_log, mem_log.driver().impl(),
diff --git a/src/llfs/page_arena.hpp b/src/llfs/page_arena.hpp
index df55b0f..b4d5a03 100644
--- a/src/llfs/page_arena.hpp
+++ b/src/llfs/page_arena.hpp
@@ -49,7 +49,7 @@ class PageArena
     return *this->allocator_;
   }
 
-  void close()
+  void halt()
   {
     // this->device_->close();  TODO [tastolfi 2021-04-07]
     this->allocator_->halt();
diff --git a/src/llfs/page_cache.cpp b/src/llfs/page_cache.cpp
index 75ed8db..39c6011 100644
--- a/src/llfs/page_cache.cpp
+++ b/src/llfs/page_cache.cpp
@@ -255,7 +255,7 @@ void PageCache::close()
 {
   for (const std::unique_ptr<PageDeviceEntry>& entry : this->page_devices_) {
     if (entry) {
-      entry->arena.close();
+      entry->arena.halt();
     }
   }
 }
diff --git a/src/llfs/page_cache.hpp b/src/llfs/page_cache.hpp
index 05e6d9f..da1f12e 100644
--- a/src/llfs/page_cache.hpp
+++ b/src/llfs/page_cache.hpp
@@ -166,6 +166,8 @@ class PageCache : public PageLoader
 
   void close();
 
+  void halt();
+
   void join();
 
   std::unique_ptr<PageCacheJob> new_job();
diff --git a/src/llfs/page_cache_slot.test.cpp b/src/llfs/page_cache_slot.test.cpp
index 0660603..b4ce21a 100644
--- a/src/llfs/page_cache_slot.test.cpp
+++ b/src/llfs/page_cache_slot.test.cpp
@@ -64,7 +64,7 @@ class PageCacheSlotTest : public ::testing::Test
 //  1. Create slots with different index values in a Pool; verify index()
 //     - also verify initial is_valid state
 //
-TEST_F(PageCacheSlotTest, CreateSlots)
+TEST_F(PageCacheSlotTest, CreateSlotsDeath)
 {
   for (usize i = 0; i < kNumTestSlots; ++i) {
     llfs::PageCacheSlot* slot = this->pool_->allocate();
@@ -89,7 +89,7 @@ TEST_F(PageCacheSlotTest, CreateSlots)
 //  2. ref_count test - add_ref/remove_ref should affect the ref_count, and also the use count of
 //     the pool but only in the case of add: 0 -> 1 and remove: 1 -> 0.
 //
-TEST_F(PageCacheSlotTest, AddRemoveRef)
+TEST_F(PageCacheSlotTest, AddRemoveRefDeath)
 {
   EXPECT_EQ(this->pool_->use_count(), 1u);
 
@@ -373,7 +373,7 @@ TEST_F(PageCacheSlotTest, EvictIfKeyEqualsFailureWrongKey)
 //     a. Valid + Filled
 //     c. Valid + Filled + Pinned
 //
-TEST_F(PageCacheSlotTest, FillFailureAlreadyFilled)
+TEST_F(PageCacheSlotTest, FillFailureAlreadyFilledDeath)
 {
   llfs::PageCacheSlot* slot = this->pool_->allocate();
   {
@@ -391,7 +391,7 @@ TEST_F(PageCacheSlotTest, FillFailureAlreadyFilled)
 //  7. fill fails when state is not Invalid:
 //     b. Valid + Cleared
 //
-TEST_F(PageCacheSlotTest, FillFailureCleared)
+TEST_F(PageCacheSlotTest, FillFailureClearedDeath)
 {
   llfs::PageCacheSlot* slot = this->pool_->allocate();
 
diff --git a/src/llfs/simulated_log_device_storage.cpp b/src/llfs/simulated_log_device_storage.cpp
new file mode 100644
index 0000000..67a76b9
--- /dev/null
+++ b/src/llfs/simulated_log_device_storage.cpp
@@ -0,0 +1,544 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#include <llfs/simulated_log_device_storage.hpp>
+//
+#include <llfs/ioring_log_driver.hpp>
+#include <llfs/ioring_log_driver.ipp>
+#include <llfs/ioring_log_flush_op.hpp>
+#include <llfs/ioring_log_flush_op.ipp>
+#include <llfs/storage_simulation.hpp>
+
+namespace llfs {
+
+// Explicitly instantiate BasicIoRingLogDriver for the simulated LogDevice storage.
+//
+template class BasicIoRingLogDriver<BasicIoRingLogFlushOp, SimulatedLogDeviceStorage>;
+
+// BasicIoRingLogFlushOp is required by BasicIoRingLogDriver, so explicitly instantiate that too.
+//
+template class BasicIoRingLogFlushOp<
+    BasicIoRingLogDriver<BasicIoRingLogFlushOp, SimulatedLogDeviceStorage>>;
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+// class SimulatedLogDeviceStorage::DurableState
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::DurableState::crash_and_recover(u64 simulation_step) /*override*/
+{
+  batt::ScopedLock<Impl> locked{this->impl_};
+
+  locked->last_recovery_step_ = simulation_step;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::DurableState::validate_args(i64 offset, usize size,
+                                                              const char* op_type) noexcept
+{
+  if (offset % sizeof(AlignedBlock) != 0 || size != sizeof(AlignedBlock)) {
+    return batt::StatusCode::kInvalidArgument;
+  }
+  if (offset < this->config_.physical_offset) {
+    return batt::StatusCode::kOutOfRange;
+  }
+  if (offset + size > this->config_.physical_offset + this->config_.physical_size) {
+    return batt::StatusCode::kOutOfRange;
+  }
+  if (this->simulation_.inject_failure()) {
+    LLFS_VLOG(1) << "(id=" << this->id_ << ") injecting failure;" << BATT_INSPECT(offset)
+                 << BATT_INSPECT(size) << BATT_INSPECT(op_type);
+    return batt::StatusCode::kInternal;
+  }
+
+  return OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <typename BufferT, typename OpFn>
+Status SimulatedLogDeviceStorage::DurableState::block_op_impl(u64 creation_step, i64 offset,
+                                                              const BufferT& buffer, OpFn&& op_fn)
+{
+  const char* op_type = std::is_same_v<std::decay_t<BufferT>, ConstBuffer> ? "write" : "read";
+
+  BATT_REQUIRE_OK(this->validate_args(offset, buffer.size(), op_type));
+
+  batt::ScopedLock<Impl> locked{this->impl_};
+
+  if (creation_step < locked->last_recovery_step_) {
+    return batt::StatusCode::kClosed;
+  }
+
+  auto& p_block = locked->blocks_[offset];
+  BATT_FORWARD(op_fn)(p_block);
+
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") DurableState::" << op_type << "_block(" << offset
+               << ") Success";
+
+  return batt::OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::DurableState::write_block(u64 creation_step, i64 offset,
+                                                            const ConstBuffer& buffer)
+{
+  return this->block_op_impl(creation_step, offset, buffer,
+                             [&buffer](std::unique_ptr<AlignedBlock>& p_block) {
+                               if (!p_block) {
+                                 p_block = std::make_unique<AlignedBlock>();
+                               }
+                               std::memcpy(p_block.get(), buffer.data(), buffer.size());
+                             });
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::DurableState::read_block(u64 creation_step, i64 offset,
+                                                           const MutableBuffer& buffer)
+{
+  return this->block_op_impl(creation_step, offset, buffer,
+                             [&buffer](std::unique_ptr<AlignedBlock>& p_block) {
+                               if (!p_block) {
+                                 std::memset(buffer.data(), 0, buffer.size());
+                               } else {
+                                 std::memcpy(buffer.data(), p_block.get(), buffer.size());
+                               }
+                             });
+}
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+// class SimulatedLogDeviceStorage::EphemeralState
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ SimulatedLogDeviceStorage::EphemeralState::EphemeralState(
+    std::shared_ptr<DurableState>&& durable_state) noexcept
+    : durable_state_{std::move(durable_state)}
+    , simulation_{this->durable_state_->simulation()}
+    , creation_step_{this->simulation_.current_step()}
+{
+  this->work_count_per_caller_.fill(0);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+batt::TaskScheduler& SimulatedLogDeviceStorage::EphemeralState::get_task_scheduler() noexcept
+{
+  return this->simulation_.is_running() ? this->simulation_.task_scheduler()
+                                        : batt::Runtime::instance().default_scheduler();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::EphemeralState::close()
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::close()";
+
+  if (this->closed_.exchange(true)) {
+    return batt::StatusCode::kClosed;
+  }
+
+  return batt::OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::on_work_started(usize caller)
+{
+  ++this->work_count_per_caller_[caller];
+
+  const i32 old_value = this->work_count_.fetch_add(1);
+
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::on_work_started() " << old_value
+               << " -> " << (old_value + 1);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::on_work_finished(usize caller)
+{
+  --this->work_count_per_caller_[caller];
+
+  const i32 old_value = this->work_count_.fetch_sub(1);
+
+  for (i32 n : this->work_count_per_caller_) {
+    BATT_CHECK_GE(n, 0) << BATT_INSPECT(this->id_)
+                        << BATT_INSPECT_RANGE(this->work_count_per_caller_) << BATT_INSPECT(caller);
+  }
+
+  BATT_CHECK_GT(old_value, 0) << BATT_INSPECT(this->id_)
+                              << BATT_INSPECT_RANGE(this->work_count_per_caller_)
+                              << BATT_INSPECT(caller);
+
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::on_work_finished() " << old_value
+               << " -> " << (old_value - 1);
+
+  if (old_value == 1) {
+    this->queue_.poke();
+  }
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::EphemeralState::run_event_loop()
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::run_event_loop() entered" << std::endl
+               << boost::stacktrace::stacktrace{};
+  for (;;) {
+    LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::run_event_loop() top of loop:"
+                 << BATT_INSPECT(this->stopped_) << BATT_INSPECT(this->work_count_);
+
+    // If there is no more work to do (work_count_ == 0), or stop has been explicitly requested,
+    // then exit the loop now before awaiting the next completion handler.
+    //
+    if (this->stopped_.load() || this->work_count_.load() == 0) {
+      break;
+    }
+
+    BATT_DEBUG_INFO(BATT_INSPECT(this->stopped_)
+                    << BATT_INSPECT(this->work_count_) << BATT_INSPECT(this->closed_));
+
+    LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::run_event_loop() waiting for queue";
+    StatusOr<std::function<void()>> handler = this->queue_.await_next();
+    if (!handler.ok()) {
+      if (handler.status() == batt::StatusCode::kPoke) {
+        continue;
+      }
+
+      if (handler.status() == batt::StatusCode::kClosed) {
+        break;
+      }
+
+      return handler.status();
+    }
+
+    try {
+      (*handler)();
+    } catch (...) {
+      LLFS_LOG_WARNING() << "Simulation handler threw exception!";
+    }
+  }
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::run_event_loop() exiting";
+
+  return batt::OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::reset_event_loop()
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::reset_event_loop()"
+               << BATT_INSPECT(this->stopped_);
+  this->stopped_.store(false);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::stop_event_loop()
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::reset_event_loop()"
+               << BATT_INSPECT(this->stopped_);
+  this->stopped_.store(true);
+  this->queue_.poke();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::post_to_event_loop(
+    std::function<void(StatusOr<i32>)>&& handler)
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::post_to_event_loop(handler) entered"
+               << BATT_INSPECT(this->simulation_.is_running());
+
+  this->on_work_started(POST_TO_EVENT_LOOP);
+
+  auto runnable = [shared_this = batt::shared_ptr_from(this),
+                   handler = BATT_FORWARD(handler)]() mutable {
+    auto* const this_ = shared_this.get();
+
+    LLFS_VLOG(1) << "(id=" << this_->id_
+                 << ") EphemeralState::post_to_event_loop(handler) invoked runnable";
+
+    // We don't need to capture `shared_this` in the completion handler we push to the queue, since
+    // either the work count will keep the event loop task running (and if the log driver doesn't
+    // join the even loop task, this is a serious error we don't want to mask) *or* the completion
+    // handler will never run, in which case a dangling pointer doesn't matter (if a tree falls in a
+    // forest...)
+    //
+    this_->queue_
+        .push([this_, handler]() mutable {
+          auto on_scope_exit = batt::finally([&] {
+            this_->on_work_finished(POST_TO_EVENT_LOOP);
+          });
+          BATT_FORWARD(handler)(StatusOr<i32>{0});
+        })
+        .IgnoreError();
+  };
+
+  if (this->simulation_.is_running()) {
+    this->simulation_.post(std::move(runnable));
+  } else {
+    runnable();
+  }
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SimulatedLogDeviceStorage::EphemeralState::read_all(i64 offset, const MutableBuffer& buffer)
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::read_all(offset=" << offset
+               << ", size=" << buffer.size() << ")";
+
+  return this->multi_block_iop<MutableBuffer, &DurableState::read_block>(offset, buffer);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::async_write_some(
+    i64 file_offset, const ConstBuffer& data, std::function<void(StatusOr<i32>)>&& handler)
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphemeralState::async_write_some(offset=" << file_offset
+               << ", size=" << data.size() << ")";
+
+  if (this->closed_.load()) {
+    BATT_FORWARD(handler)(Status{batt::StatusCode::kClosed});
+    return;
+  }
+
+  this->on_work_started(ASYNC_WRITE_SOME);
+
+  auto write_task = std::make_shared<batt::Task>(
+      this->get_task_scheduler().schedule_task(),
+      [shared_this = batt::shared_ptr_from(this), file_offset, data,
+       handler = BATT_FORWARD(handler)]() mutable {
+        auto* const this_ = shared_this.get();
+
+        // Write all blocks synchronously.
+        //
+        Status status =
+            this_->multi_block_iop<ConstBuffer, &DurableState::write_block>(file_offset, data);
+
+        auto result = [&] {
+          if (status.ok()) {
+            return StatusOr<i32>{static_cast<i32>(data.size())};
+          }
+          return StatusOr<i32>{status};
+        }();
+
+        this_->queue_
+            .push([handler, result, this_] {
+              auto on_scope_exit = batt::finally([this_] {
+                this_->on_work_finished(ASYNC_WRITE_SOME);
+              });
+              handler(result);
+            })
+            .IgnoreError();
+      },
+      batt::Task::DeferStart{true});
+
+  write_task->call_when_done([write_task]() mutable {
+    // Release the task.
+    //
+    write_task = nullptr;
+  });
+
+  write_task->start();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+template <typename BufferT,
+          Status (SimulatedLogDeviceStorage::DurableState::*Op)(u64, i64, const BufferT&)>
+Status SimulatedLogDeviceStorage::EphemeralState::multi_block_iop(i64 offset, BufferT buffer)
+{
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphmeralState::multi_block_iop(" << BATT_INSPECT(offset)
+               << "," << BATT_INSPECT(buffer.size())
+               << ") type=" << (std::is_same_v<BufferT, ConstBuffer> ? "write" : "read");
+
+  if (this->closed_.load()) {
+    return batt::StatusCode::kClosed;
+  }
+
+  std::vector<Status> block_status(buffer.size() / sizeof(AlignedBlock));
+  batt::Watch<usize> blocks_remaining(block_status.size());
+  std::atomic<usize> pin_count{block_status.size()};
+
+  if (buffer.size() != block_status.size() * sizeof(AlignedBlock)) {
+    return batt::StatusCode::kInvalidArgument;
+  }
+
+  usize i = 0;
+  while (buffer.size() > 0) {
+    LLFS_VLOG(1) << "(id=" << this->id_ << ") EphmeralState::multi_block_iop()"
+                 << BATT_INSPECT(offset) << BATT_INSPECT(i) << "/" << block_status.size();
+
+    this->simulation_post([this, i, offset, &block_status, &blocks_remaining, &pin_count,
+                           block_buffer = BufferT{buffer.data(), sizeof(AlignedBlock)}] {
+      LLFS_VLOG(1) << "(id=" << this->id_ << ") EphmeralState::multi_block_iop() - activated"
+                   << BATT_INSPECT(offset) << BATT_INSPECT(i) << "/" << block_status.size();
+
+      auto on_scope_exit = batt::finally([&] {
+        blocks_remaining.fetch_sub(1);
+        pin_count.fetch_sub(1);
+      });
+
+      block_status[i] = this->closed_.load() ? Status{batt::StatusCode::kClosed}
+                                             : (this->durable_state_.get()->*Op)(
+                                                   this->creation_step_, offset, block_buffer);
+    });
+
+    offset += sizeof(AlignedBlock);
+    buffer += sizeof(AlignedBlock);
+    ++i;
+  }
+
+  LLFS_VLOG(1) << "(id=" << this->id_
+               << ") EphmeralState::multi_block_iop() waiting for all ops to complete";
+
+  blocks_remaining.await_equal(0).IgnoreError();
+  BATT_CHECK_EQ(blocks_remaining.get_value(), 0u);
+  while (pin_count.load() != 0) {
+    batt::Task::yield();
+  }
+
+  LLFS_VLOG(1) << "(id=" << this->id_
+               << ") EphmeralState::multi_block_iop() checking per-block statuses";
+
+  for (const Status& status : block_status) {
+    BATT_REQUIRE_OK(status);
+  }
+
+  LLFS_VLOG(1) << "(id=" << this->id_ << ") EphmeralState::multi_block_iop() success!";
+
+  return batt::OkStatus();
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EphemeralState::simulation_post(std::function<void()>&& fn)
+{
+  if (this->simulation_.is_running()) {
+    this->simulation_.post(std::move(fn));
+  } else {
+    try {
+      std::move(fn)();
+    } catch (...) {
+      LLFS_LOG_WARNING() << "Simulation post fn threw exception!";
+    }
+  }
+}
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+// class SimulatedLogDeviceStorage::RawBlockFileImpl
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ SimulatedLogDeviceStorage::RawBlockFileImpl::RawBlockFileImpl(
+    std::shared_ptr<DurableState>&& durable_state) noexcept
+    : durable_state_{std::move(durable_state)}
+    , creation_step_{this->durable_state_->simulation().current_step()}
+{
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+StatusOr<i64> SimulatedLogDeviceStorage::RawBlockFileImpl::write_some(
+    i64 offset, const ConstBuffer& buffer_arg) /*override*/
+{
+  ConstBuffer buffer = buffer_arg;
+  i64 n_written = 0;
+
+  while (buffer.size() > 0) {
+    BATT_REQUIRE_OK(this->durable_state_->write_block(
+        this->creation_step_, offset,
+        ConstBuffer{buffer.data(), std::min(buffer.size(), sizeof(AlignedBlock))}));
+    offset += sizeof(AlignedBlock);
+    buffer += sizeof(AlignedBlock);
+    n_written += sizeof(AlignedBlock);
+  }
+
+  return n_written;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+StatusOr<i64> SimulatedLogDeviceStorage::RawBlockFileImpl::read_some(
+    i64 offset, const MutableBuffer& buffer_arg) /*override*/
+{
+  MutableBuffer buffer = buffer_arg;
+  i64 n_read = 0;
+
+  while (buffer.size() > 0) {
+    BATT_REQUIRE_OK(this->durable_state_->read_block(
+        this->creation_step_, offset,
+        MutableBuffer{buffer.data(), std::min(buffer.size(), sizeof(AlignedBlock))}));
+    offset += sizeof(AlignedBlock);
+    buffer += sizeof(AlignedBlock);
+    n_read += sizeof(AlignedBlock);
+  }
+
+  return n_read;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+StatusOr<i64> SimulatedLogDeviceStorage::RawBlockFileImpl::get_size() /*override*/
+{
+  return Status{batt::StatusCode::kUnimplemented};
+}
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+// class SimulatedLogDeviceStorage::EventLoopTask
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ SimulatedLogDeviceStorage::EventLoopTask::EventLoopTask(
+    SimulatedLogDeviceStorage& storage, std::string_view caller) noexcept
+    : storage_{storage}
+    , caller_{caller}
+    , task_{this->storage_.impl_->get_task_scheduler().schedule_task(),
+            [this] {
+              LLFS_VLOG(1) << "Entered simulated log storage event loop;"
+                           << BATT_INSPECT(this->caller_)
+                           << BATT_INSPECT(this->storage_.impl_->id());
+
+              this->storage_.impl_->run_event_loop().IgnoreError();
+
+              LLFS_VLOG(1) << "Leaving simulated log storage event loop;"
+                           << BATT_INSPECT(this->caller_)
+                           << BATT_INSPECT(this->storage_.impl_->id());
+            },
+            batt::to_string("SimulatedLogDeviceStorage::EventLoopTask(", caller, ")")}
+{
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+SimulatedLogDeviceStorage::EventLoopTask::~EventLoopTask() noexcept
+{
+  BATT_CHECK(this->join_called_);
+  BATT_CHECK(this->task_.is_done());
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SimulatedLogDeviceStorage::EventLoopTask::join()
+{
+  this->join_called_ = true;
+  this->task_.join();
+
+  LLFS_VLOG(1) << "EventLoopTask::join() exiting;"
+               << BATT_INSPECT(this->storage_.impl_->work_count())
+               << BATT_INSPECT(this->storage_.impl_->is_stopped())
+               << BATT_INSPECT(this->storage_.impl_->id());
+}
+
+}  //namespace llfs
diff --git a/src/llfs/simulated_log_device_storage.hpp b/src/llfs/simulated_log_device_storage.hpp
new file mode 100644
index 0000000..f790105
--- /dev/null
+++ b/src/llfs/simulated_log_device_storage.hpp
@@ -0,0 +1,338 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#pragma once
+#ifndef LLFS_SIMULATED_LOG_DEVICE_STORAGE_HPP
+#define LLFS_SIMULATED_LOG_DEVICE_STORAGE_HPP
+
+#include <llfs/config.hpp>
+//
+#include <llfs/ioring_log_config.hpp>
+#include <llfs/packed_log_page_buffer.hpp>
+#include <llfs/simulated_storage_object.hpp>
+#include <llfs/status.hpp>
+
+#include <batteries/async/mutex.hpp>
+#include <batteries/async/queue.hpp>
+#include <batteries/async/task.hpp>
+#include <batteries/async/task_scheduler.hpp>
+#include <batteries/async/watch.hpp>
+#include <batteries/shared_ptr.hpp>
+
+#include <atomic>
+#include <functional>
+#include <memory>
+#include <unordered_map>
+
+namespace llfs {
+
+class StorageSimulation;
+
+class SimulatedLogDeviceStorage
+{
+ public:
+  static i64 new_id()
+  {
+    static std::atomic<i64> next_{0};
+    return next_.fetch_add(1);
+  }
+
+  using AlignedBlock = PackedLogPageBuffer::AlignedUnit;
+
+  class DurableState : public SimulatedStorageObject
+  {
+   public:
+    struct Impl {
+      u64 last_recovery_step_{0};
+      std::unordered_map<i64, std::unique_ptr<AlignedBlock>> blocks_;
+    };
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    explicit DurableState(StorageSimulation& simulation, const IoRingLogConfig& config) noexcept
+        : simulation_{simulation}
+        , config_{config}
+    {
+    }
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    i64 id() const noexcept
+    {
+      return this->id_;
+    }
+
+    StorageSimulation& simulation() noexcept
+    {
+      return this->simulation_;
+    }
+
+    const IoRingLogConfig& config() const noexcept
+    {
+      return this->config_;
+    }
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    /** \brief Simulates a process termination/restart by removing all non-flushed state.
+     */
+    void crash_and_recover(u64 simulation_step) override;
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    /** \brief Simulates writing a single block.
+     *
+     * If simulation is injecting errors, then this call may inject a batt::StatusCode::kInternal
+     * error spuriously.
+     */
+    Status write_block(u64 creation_step, i64 offset, const ConstBuffer& buffer);
+
+    /** \brief Simulates writing a single block.
+     *
+     * If simulation is injecting errors, then this call may inject a batt::StatusCode::kInternal
+     * error spuriously.
+     */
+    Status read_block(u64 creation_step, i64 offset, const MutableBuffer& buffer);
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+   private:
+    /** \brief Checks the offset and buffer size args to a block operation to make sure they are
+     * valid.
+     *
+     * \return OkStatus() if the args are valid, or an error status indicating the problem
+     * otherwise.
+     */
+    Status validate_args(i64 offset, usize size, const char* op_type) noexcept;
+
+    /** \brief Abstracts the common parts of the implementation of write_block and read_block.
+     *
+     * The passed `op_fn` will be called on the AlignedBlock pointer corresponding to `offset`, if
+     * the arguments are valid and the creation step is after the most recent crash/recover step.
+     */
+    template <typename BufferT, typename OpFn = void(std::unique_ptr<AlignedBlock>&)>
+    Status block_op_impl(u64 creation_step, i64 offset, const BufferT& buffer, OpFn&& op_fn);
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    const i64 id_{SimulatedLogDeviceStorage::new_id()};
+    StorageSimulation& simulation_;
+    const IoRingLogConfig config_;
+    batt::Mutex<Impl> impl_;
+  };
+
+  class EphemeralState : public batt::RefCounted<EphemeralState>
+  {
+   public:
+    enum : usize {
+      PUBLIC_API = 0,
+      POST_TO_EVENT_LOOP,
+      ASYNC_WRITE_SOME,
+      NUM_CALLERS,
+    };
+
+    explicit EphemeralState(std::shared_ptr<DurableState>&& durable_state) noexcept;
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    batt::TaskScheduler& get_task_scheduler() noexcept;
+
+    //----- --- -- -  -  -   -
+
+    i64 id() const noexcept
+    {
+      return this->id_;
+    }
+
+    const IoRingLogConfig& config() const noexcept
+    {
+      return this->durable_state_->config();
+    }
+
+    Status close();
+
+    void on_work_started(usize caller = PUBLIC_API);
+
+    void on_work_finished(usize caller = PUBLIC_API);
+
+    Status run_event_loop();
+
+    void reset_event_loop();
+
+    void post_to_event_loop(std::function<void(StatusOr<i32>)>&& handler);
+
+    void stop_event_loop();
+
+    Status read_all(i64 offset, const MutableBuffer& buffer);
+
+    void async_write_some(i64 file_offset, const ConstBuffer& data,
+                          std::function<void(StatusOr<i32>)>&& handler);
+
+    i32 work_count() const noexcept
+    {
+      return this->work_count_.load();
+    }
+
+    bool is_stopped() const noexcept
+    {
+      return this->stopped_.load();
+    }
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+   private:
+    void simulation_post(std::function<void()>&& fn);
+
+    template <typename BufferT, Status (DurableState::*Op)(u64, i64, const BufferT&)>
+    Status multi_block_iop(i64 offset, BufferT buffer);
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    const std::shared_ptr<DurableState> durable_state_;
+
+    StorageSimulation& simulation_;
+
+    const u64 creation_step_;
+
+    const i64 id_ = durable_state_->id();
+
+    std::atomic<i32> work_count_{0};
+
+    std::array<i32, NUM_CALLERS> work_count_per_caller_;
+
+    batt::Queue<std::function<void()>> queue_;
+
+    std::atomic<bool> closed_{false};
+
+    std::atomic<bool> stopped_{false};
+  };
+
+  class RawBlockFileImpl : public RawBlockFile
+  {
+   public:
+    explicit RawBlockFileImpl(std::shared_ptr<DurableState>&& durable_state) noexcept;
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+    StatusOr<i64> write_some(i64 offset, const ConstBuffer& buffer_arg) override;
+
+    StatusOr<i64> read_some(i64 offset, const MutableBuffer& buffer_arg) override;
+
+    StatusOr<i64> get_size() override;
+
+    //+++++++++++-+-+--+----- --- -- -  -  -   -
+   private:
+    const std::shared_ptr<DurableState> durable_state_;
+    const u64 creation_step_;
+  };
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  class EventLoopTask
+  {
+   public:
+    explicit EventLoopTask(SimulatedLogDeviceStorage& storage, std::string_view caller) noexcept;
+
+    EventLoopTask(const EventLoopTask&) = delete;
+    EventLoopTask& operator=(const EventLoopTask&) = delete;
+
+    ~EventLoopTask() noexcept;
+
+    void join();
+
+   private:
+    SimulatedLogDeviceStorage& storage_;
+    std::string_view caller_;
+    batt::Task task_;
+    bool join_called_ = false;
+  };
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  explicit SimulatedLogDeviceStorage(std::shared_ptr<DurableState>&& durable_state) noexcept
+      : impl_{batt::make_shared<EphemeralState>(std::move(durable_state))}
+  {
+    BATT_STATIC_ASSERT_TYPE_EQ(batt::SharedPtr<EphemeralState>,
+                               boost::intrusive_ptr<EphemeralState>);
+  }
+
+  SimulatedLogDeviceStorage(const SimulatedLogDeviceStorage&) = delete;
+  SimulatedLogDeviceStorage& operator=(const SimulatedLogDeviceStorage&) = delete;
+
+  SimulatedLogDeviceStorage(SimulatedLogDeviceStorage&&) = default;
+  SimulatedLogDeviceStorage& operator=(SimulatedLogDeviceStorage&&) = default;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  const IoRingLogConfig& config() const noexcept
+  {
+    return this->impl_->config();
+  }
+
+  Status register_fd()
+  {
+    return batt::OkStatus();
+  }
+
+  StatusOr<usize> register_buffers(batt::BoxedSeq<MutableBuffer>&&, bool = false) const noexcept
+  {
+    return {0};
+  }
+
+  Status close()
+  {
+    return this->impl_->close();
+  }
+
+  void on_work_started() const noexcept
+  {
+    this->impl_->on_work_started();
+  }
+
+  void on_work_finished() const noexcept
+  {
+    this->impl_->on_work_finished();
+  }
+
+  void reset_event_loop() const noexcept
+  {
+    this->impl_->reset_event_loop();
+  }
+
+  template <typename Handler = void(StatusOr<i32>)>
+  void post_to_event_loop(Handler&& handler) const noexcept
+  {
+    this->impl_->post_to_event_loop(BATT_FORWARD(handler));
+  }
+
+  void stop_event_loop() const noexcept
+  {
+    this->impl_->stop_event_loop();
+  }
+
+  Status read_all(i64 offset, MutableBuffer buffer)
+  {
+    return this->impl_->read_all(offset, buffer);
+  }
+
+  // The buf_index arg here isn't used by the simulated impl, but it is needed by the other type
+  // used to instantiate IoRingLogDriver, DefaultIoRingLogDeviceStorage.
+  //
+  template <typename Handler = void(StatusOr<i32>)>
+  void async_write_some_fixed(i64 file_offset, const ConstBuffer& data, i32 /*buf_index*/,
+                              Handler&& handler)
+  {
+    this->impl_->async_write_some(file_offset, data, BATT_FORWARD(handler));
+  }
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+ private:
+  batt::SharedPtr<EphemeralState> impl_;
+};
+
+}  //namespace llfs
+
+#endif  // LLFS_SIMULATED_LOG_DEVICE_STORAGE_HPP
diff --git a/src/llfs/slot_reader.cpp b/src/llfs/slot_reader.cpp
index 2b4b6d9..5fc6142 100644
--- a/src/llfs/slot_reader.cpp
+++ b/src/llfs/slot_reader.cpp
@@ -104,6 +104,13 @@ StatusOr<SlotParse> SlotReader::parse_next(batt::WaitForResource wait_for_data)
     //
     const usize bytes_available_before = data_reader.bytes_available();
 
+    if (bytes_available_before != 0) {
+      BATT_CHECK_NE((int)(*data_reader.unread_begin()), 0)
+          << BATT_INSPECT(bytes_available_before) << BATT_INSPECT(current_slot)
+          << BATT_INSPECT(data.size()) << BATT_INSPECT(current_slot + data.size())
+          << BATT_INSPECT(this->slots_parsed_count_);
+    }
+
     Optional<u64> slot_body_size = data_reader.read_varint();
     if (!slot_body_size) {
       min_bytes_needed = data.size() + 1;
@@ -111,11 +118,6 @@ StatusOr<SlotParse> SlotReader::parse_next(batt::WaitForResource wait_for_data)
     }
     const usize bytes_available_after = data_reader.bytes_available();
 
-    BATT_CHECK_NE(*slot_body_size, 0u)
-        << BATT_INSPECT(bytes_available_before) << BATT_INSPECT(bytes_available_after)
-        << BATT_INSPECT(current_slot) << BATT_INSPECT(data.size())
-        << BATT_INSPECT(current_slot + data.size()) << BATT_INSPECT(this->slots_parsed_count_);
-
     // Calculate the header (varint) size from bytes available before and after.
     //
     BATT_CHECK_GT(bytes_available_before, bytes_available_after);
@@ -136,7 +138,7 @@ StatusOr<SlotParse> SlotReader::parse_next(batt::WaitForResource wait_for_data)
     // Initialize the slot_range according to the log reader's offset attribute; we will update
     // `upper_bound` inside the variant visitor passed to `DataReader::read_variant`.
     //
-    return SlotParse{
+    auto slot_parse = SlotParse{
         .offset =
             SlotRange{
                 .lower_bound = current_slot,
@@ -145,6 +147,13 @@ StatusOr<SlotParse> SlotReader::parse_next(batt::WaitForResource wait_for_data)
         .body = slot_body,
         .total_grant_spent = slot_size,
     };
+
+    if (slot_parse.body.size() == 0) {
+      this->consume_slot(slot_parse);
+      continue;
+    }
+
+    return slot_parse;
   }
 }
 
diff --git a/src/llfs/slot_writer.cpp b/src/llfs/slot_writer.cpp
index 782649f..d69366c 100644
--- a/src/llfs/slot_writer.cpp
+++ b/src/llfs/slot_writer.cpp
@@ -59,104 +59,170 @@ void SlotWriter::halt()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-auto SlotWriter::prepare(batt::Grant& caller_grant, usize slot_body_size) -> StatusOr<Append>
+/*static*/ Slice<const u8> SlotWriter::WriterLock::begin_atomic_range_token() noexcept
 {
-  BATT_CHECK_NE(slot_body_size, 0);
+  const static std::array<u8, Self::kBeginAtomicRangeTokenSize> token_ = {0b10000000, 0b10000000,
+                                                                          0b00000000};
+  return as_const_slice(token_);
+}
 
-  const usize slot_header_size = packed_sizeof_varint(slot_body_size);
-  const usize slot_size = slot_header_size + slot_body_size;
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*static*/ Slice<const u8> SlotWriter::WriterLock::end_atomic_range_token() noexcept
+{
+  const static std::array<u8, Self::kEndAtomicRangeTokenSize> token_ = {0b10000000, 0b00000000};
+  return as_const_slice(token_);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+/*explicit*/ SlotWriter::WriterLock::WriterLock(SlotWriter& slot_writer) noexcept
+    : slot_writer_{slot_writer}
+    , writer_lock_{this->slot_writer_.log_writer_}  // Lock the LogDevice::Writer mutex
+{
+  BATT_CHECK_NOT_NULLPTR(*this->writer_lock_);
+}
 
-  StatusOr<batt::Grant> slot_grant = caller_grant.spend(slot_size);
-  if (slot_grant.status() == batt::StatusCode::kGrantUnavailable) {
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+Status SlotWriter::WriterLock::append_token_impl(const Slice<const u8>& token,
+                                                 const batt::Grant& caller_grant) noexcept
+{
+  BATT_CHECK_EQ(this->prepare_size_, 0u);
+
+  const usize prepare_size = this->deferred_commit_size_ + token.size();
+
+  if (caller_grant.size() < prepare_size) {
     return ::llfs::make_status(StatusCode::kSlotGrantTooSmall);
   }
-  BATT_REQUIRE_OK(slot_grant);
 
-  batt::Mutex<LogDevice::Writer*>::Lock writer_lock = this->log_writer_.lock();
-  StatusOr<MutableBuffer> slot_buffer = (*writer_lock)->prepare(slot_size, /*head_room=*/0);
-  BATT_REQUIRE_OK(slot_buffer);
+  BATT_ASSIGN_OK_RESULT(MutableBuffer buffer,
+                        (*this->writer_lock_)->prepare(prepare_size, /*head_room=*/0));
+
+  buffer += this->deferred_commit_size_;
+
+  std::memcpy(buffer.data(), token.begin(), token.size());
 
-  return {Append{
-      this,
-      std::move(writer_lock),
-      std::move(*slot_grant),
-      *slot_buffer,
-      slot_body_size,
-  }};
+  this->deferred_commit_size_ += token.size();
+
+  return batt::OkStatus();
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-SlotWriter::Append::Append(SlotWriter* that, batt::Mutex<LogDevice::Writer*>::Lock writer_lock,
-                           batt::Grant&& slot_grant, const MutableBuffer& slot_buffer,
-                           usize slot_body_size) noexcept
-    : that_{that}
-    , writer_lock_{std::move(writer_lock)}
-    , slot_grant_{std::move(slot_grant)}
-    , cancelled_{false}
-    , committed_{false}
-    , slot_lower_bound_{(*this->writer_lock_)->slot_offset()}
-    , packer_{slot_buffer}
+Status SlotWriter::WriterLock::begin_atomic_range(const batt::Grant& caller_grant) noexcept
 {
-  BATT_CHECK_NOT_NULLPTR(*this->writer_lock_);
-  BATT_CHECK_EQ(this->slot_grant_.get_issuer(), &this->that_->pool_);
-  BATT_CHECK_EQ(this->packer_.buffer_size(), this->slot_grant_.size());
-  BATT_CHECK_NOT_NULLPTR(this->packer_.pack_varint(slot_body_size));
+  return this->append_token_impl(Self::begin_atomic_range_token(), caller_grant);
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-SlotWriter::Append::~Append() noexcept
+Status SlotWriter::WriterLock::end_atomic_range(const batt::Grant& caller_grant) noexcept
 {
-  this->cancel();
+  return this->append_token_impl(Self::end_atomic_range_token(), caller_grant);
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-StatusOr<SlotRange> SlotWriter::Append::commit()
+StatusOr<MutableBuffer> SlotWriter::WriterLock::prepare(usize slot_payload_size,
+                                                        const batt::Grant& caller_grant) noexcept
 {
-  if (this->cancelled_) {
-    return {batt::StatusCode::kCancelled};
+  BATT_CHECK_NE(slot_payload_size, 0);
+
+  const usize slot_header_size = packed_sizeof_varint(slot_payload_size);
+  const usize slot_size = slot_header_size + slot_payload_size;
+  const usize prepare_size = this->deferred_commit_size_ + slot_size;
+
+  if (caller_grant.size() < prepare_size) {
+    return ::llfs::make_status(StatusCode::kSlotGrantTooSmall);
   }
 
-  BATT_CHECK(!this->committed_);
-  this->committed_ = true;
-  LLFS_VLOG(1) << "LogDevice::Writer::commit(" << this->packer_.buffer_size() << ")";
+  BATT_ASSIGN_OK_RESULT(MutableBuffer buffer,
+                        (*this->writer_lock_)->prepare(prepare_size, /*head_room=*/0));
+
+  this->prepare_size_ = slot_size;
 
-  StatusOr<slot_offset_type> commit_slot_upper_bound =
-      (*this->writer_lock_)->commit(this->packer_.buffer_size());
+  buffer += this->deferred_commit_size_;
 
-  BATT_REQUIRE_OK(commit_slot_upper_bound);
+  Optional<MutableBuffer> payload_buffer = pack_varint_to(buffer, slot_payload_size);
+  BATT_CHECK(payload_buffer);
 
-  LLFS_VLOG(1) << (void*)this << " commit succeeded; new upper_bound= " << *commit_slot_upper_bound
+  return {*payload_buffer};
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+SlotRange SlotWriter::WriterLock::defer_commit() noexcept
+{
+  const slot_offset_type slot_lower_bound =
+      (*this->writer_lock_)->slot_offset() + this->deferred_commit_size_;
+  const slot_offset_type slot_upper_bound = slot_lower_bound + this->prepare_size_;
+
+  this->deferred_commit_size_ += this->prepare_size_;
+  this->prepare_size_ = 0;
+
+  return SlotRange{
+      .lower_bound = slot_lower_bound,
+      .upper_bound = slot_upper_bound,
+  };
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+StatusOr<SlotRange> SlotWriter::WriterLock::commit(batt::Grant& caller_grant) noexcept
+{
+  this->deferred_commit_size_ += this->prepare_size_;
+  this->prepare_size_ = 0;
+
+  const slot_offset_type slot_lower_bound = (*this->writer_lock_)->slot_offset();
+
+  if (this->deferred_commit_size_ == 0) {
+    return SlotRange{
+        .lower_bound = slot_lower_bound,
+        .upper_bound = slot_lower_bound,
+    };
+  }
+
+  StatusOr<batt::Grant> commit_grant = caller_grant.spend(this->deferred_commit_size_);
+  if (commit_grant.status() == batt::StatusCode::kGrantUnavailable) {
+    return ::llfs::make_status(StatusCode::kSlotGrantTooSmall);
+  }
+  BATT_REQUIRE_OK(commit_grant);
+
+  StatusOr<slot_offset_type> slot_upper_bound =
+      (*this->writer_lock_)->commit(this->deferred_commit_size_);
+
+  BATT_REQUIRE_OK(slot_upper_bound);
+
+  LLFS_VLOG(1) << (void*)this << " commit succeeded; new upper_bound= " << *slot_upper_bound
                << " == " << (*this->writer_lock_)->slot_offset();
 
   // Grow the in-use grant by the amount written.
   //
-  BATT_CHECK_EQ(this->that_->in_use_.get_issuer(), this->slot_grant_.get_issuer());
-  this->that_->in_use_.subsume(std::move(this->slot_grant_));
+  BATT_CHECK_EQ(this->slot_writer_.in_use_.get_issuer(), commit_grant->get_issuer());
+  this->slot_writer_.in_use_.subsume(std::move(*commit_grant));
+
+  this->deferred_commit_size_ = 0;
 
   return SlotRange{
-      .lower_bound = this->slot_lower_bound_,
-      .upper_bound = *commit_slot_upper_bound,
+      .lower_bound = slot_lower_bound,
+      .upper_bound = *slot_upper_bound,
   };
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-void SlotWriter::Append::cancel()
+void SlotWriter::WriterLock::cancel_prepare() noexcept
 {
-  const auto set_cancelled = batt::finally([&] {
-    this->cancelled_ = true;
-  });
+  this->prepare_size_ = 0;
+}
 
-  if (this->writer_lock_) {
-    if (!this->cancelled_ && !this->committed_) {
-      (*this->writer_lock_)->commit(0).IgnoreError();
-    }
-    this->slot_grant_.spend_all();
-    this->writer_lock_.release();
-  }
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+void SlotWriter::WriterLock::cancel_all() noexcept
+{
+  this->cancel_prepare();
+  this->deferred_commit_size_ = 0;
 }
 
 }  // namespace llfs
diff --git a/src/llfs/slot_writer.hpp b/src/llfs/slot_writer.hpp
index 476d0a5..8b50eba 100644
--- a/src/llfs/slot_writer.hpp
+++ b/src/llfs/slot_writer.hpp
@@ -14,6 +14,7 @@
 
 #include <llfs/data_layout.hpp>
 #include <llfs/data_packer.hpp>
+#include <llfs/optional.hpp>
 #include <llfs/slot_parse.hpp>
 
 #include <batteries/async/grant.hpp>
@@ -28,10 +29,16 @@ struct PackedRawData;
 class SlotWriter
 {
  public:
-  class Append;
+  using Self = SlotWriter;
+
+  class WriterLock;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
 
   explicit SlotWriter(LogDevice& log_device) noexcept;
 
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
   usize log_size() const
   {
     return this->log_device_.size();
@@ -101,10 +108,6 @@ class SlotWriter
     return this->log_device_.sync(mode, event);
   }
 
-  // Prepare space in the log to append a slot.
-  //
-  StatusOr<Append> prepare(batt::Grant& grant, usize slot_body_size);
-
  private:
   LogDevice& log_device_;
 
@@ -128,67 +131,111 @@ class SlotWriter
 
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
 
-class SlotWriter::Append
+class SlotWriter::WriterLock
 {
  public:
-  explicit Append(SlotWriter* that, batt::Mutex<LogDevice::Writer*>::Lock writer_lock,
-                  batt::Grant&& slot_grant, const MutableBuffer& slot_buffer,
-                  usize slot_body_size) noexcept;
+  using Self = WriterLock;
 
-  Append(const Append&) = delete;
-  Append& operator=(const Append&) = delete;
+  static constexpr usize kBeginAtomicRangeTokenSize = 3;
+  static constexpr usize kEndAtomicRangeTokenSize = 2;
 
-  BATT_SUPPRESS_IF_CLANG("-Wdefaulted-function-deleted")
-  //
-  Append(Append&&) = default;
-  Append& operator=(Append&&) = default;
-  //
-  BATT_UNSUPPRESS_IF_CLANG()
+  static Slice<const u8> begin_atomic_range_token() noexcept;
+  static Slice<const u8> end_atomic_range_token() noexcept;
 
-  ~Append() noexcept;
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
 
-  slot_offset_type slot_lower_bound() const
-  {
-    return this->slot_lower_bound_;
-  }
+  /** \brief Acquires an exclusive lock on writing to the log managed by `slot_writer`, preparing
+   * to write new slot data.  This lock is released when the WriterLock object goes out of scope.
+   */
+  explicit WriterLock(SlotWriter& slot_writer) noexcept;
 
-  DataPacker& packer()
-  {
-    return this->packer_;
-  }
+  /** \brief WriterLock is not copyable.
+   */
+  WriterLock(const WriterLock&) = delete;
 
-  StatusOr<SlotRange> commit();
+  /** \brief WriterLock is not copyable.
+   */
+  WriterLock& operator=(const WriterLock&) = delete;
 
-  void cancel();
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
 
- private:
-  SlotWriter* that_;
+  /** \brief Appends special token to the log to indicate the start of a sequence of slots that
+   * must commit/recover atomically.
+   *
+   * The token commit is deferred, requiring later calls to end_atomic_range and commit.
+   */
+  Status begin_atomic_range(const batt::Grant& caller_grant) noexcept;
 
-  // To pack the data into the log, we need exclusive access.
-  //
-  batt::Mutex<LogDevice::Writer*>::Lock writer_lock_;
+  /** \brief Appends special sequence to the log indicating the end of the current atomic range.
+   *
+   * The token commit is deferred, requiring a later call to commit.
+   */
+  Status end_atomic_range(const batt::Grant& caller_grant) noexcept;
 
-  // The slot_grant will be destroyed when we return, releasing its count back to the pool.
-  //
-  batt::Grant slot_grant_;
+  /** \brief Verifies that the passed grant can accomodate a new slot with the passed payload size
+   * (in addition to any currently deferred slots), then allocates space in the log and writes a
+   * header for the new slot, returning a mutable buffer for _just_ the payload portion.
+   */
+  StatusOr<MutableBuffer> prepare(usize slot_payload_size,
+                                  const batt::Grant& caller_grant) noexcept;
 
-  // Was this append cancelled?
-  //
-  bool cancelled_;
+  /** \brief Defers the currently prepared slot for later commit.
+   *
+   * Future calls to prepare will return a memory segment after the deferred commit slots.
+   */
+  SlotRange defer_commit() noexcept;
 
-  // Was this append committed?
-  //
-  bool committed_;
+  /** \brief Commits the current prepared slot and any deferred commit slots to the log.
+   *
+   * Transfers the size of the committed data from `caller_grant` to the SlotWriter's in_use_
+   * grant.
+   *
+   * \return the log slot range of the committed data.
+   */
+  StatusOr<SlotRange> commit(batt::Grant& caller_grant) noexcept;
 
-  // The beginning offset at which this append will occur if committed.
-  //
-  slot_offset_type slot_lower_bound_;
+  /** \brief Reverts the effect of the most recent call to prepare after the most recent call to
+   * defer_commit or commit.
+   */
+  void cancel_prepare() noexcept;
 
-  // Exposed to the caller to serialize the contents of the slot.
-  //
-  DataPacker packer_;
+  /** \brief Equivalent to this->cancel_prepare() plus clearing out all deferred commits.  Rolls
+   * back everything since the most recent call to this->commit().
+   */
+  void cancel_all() noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+ private:
+  /** \brief Appends the specified byte range to the prepared data.  `token` is just a raw byte
+   * sequence, not a full slot.  This function is used to implement the `begin_atomic_range` and
+   * `end_atomic_range` tokens.
+   */
+  Status append_token_impl(const Slice<const u8>& token, const batt::Grant& caller_grant) noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  /** \brief The SlotWriter object passed in at construction time.
+   */
+  SlotWriter& slot_writer_;
+
+  /** \brief Lock on the SlotWriter's LogDevice::Writer.
+   */
+  batt::ScopedLock<LogDevice::Writer*> writer_lock_;
+
+  /** \brief The size (bytes) of the most recently prepared slot buffer (allocated via
+   * this->prepare).  This size includes the varint slot header (the payload size), so it is
+   * always larger than the `slot_payload_size` arg passed to `this->prepare()`.
+   */
+  usize prepare_size_ = 0;
+
+  /** \brief The size (bytes) of all slots that have been fully packed and are ready for commit
+   * the next time `this->commit()` is called.
+   */
+  usize deferred_commit_size_ = 0;
 };
 
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+
 inline constexpr usize packed_sizeof_slot_with_payload_size(usize payload_size)
 {
   const usize slot_body_size = sizeof(PackedVariant<>) + payload_size;
@@ -213,7 +260,6 @@ template <typename... Ts>
 class TypedSlotWriter<PackedVariant<Ts...>> : public SlotWriter
 {
  public:
-  using Append = typename SlotWriter::Append;
   using SlotWriter::SlotWriter;
 
   struct NullPostCommitFn {
@@ -225,6 +271,110 @@ class TypedSlotWriter<PackedVariant<Ts...>> : public SlotWriter
     }
   };
 
+  /** \brief An append operation of one or more slots.
+   */
+  class MultiAppend
+  {
+   public:
+    /** \brief Initialize a MultiAppend operation using the passed TypedSlotWriter.
+     *
+     * This will obtain a lock on the slot writer's LogDevice::Writer mutex.
+     */
+    explicit MultiAppend(TypedSlotWriter& slot_writer) noexcept : writer_lock_{slot_writer}
+    {
+    }
+
+    MultiAppend(const MultiAppend&) = delete;
+    MultiAppend& operator=(const MultiAppend&) = delete;
+
+    //----- --- -- -  -  -   -
+
+    Status begin_atomic_range(const batt::Grant& caller_grant) noexcept
+    {
+      return this->writer_lock_.begin_atomic_range(caller_grant);
+    }
+
+    Status end_atomic_range(const batt::Grant& caller_grant) noexcept
+    {
+      return this->writer_lock_.end_atomic_range(caller_grant);
+    }
+
+    /** \brief Packs a single slot into the log device buffer.  Does not commit the slot; all slots
+     * are committed atomically when this->finalize() is called.
+     */
+    template <typename T, typename PackedT = PackedTypeFor<T>>
+    StatusOr<SlotParseWithPayload<const PackedT*>> typed_append(const batt::Grant& caller_grant,
+                                                                T&& payload)
+    {
+      // Calculate packed size of payload.
+      //
+      const usize slot_payload_size = sizeof(PackedVariant<Ts...>) + packed_sizeof(payload);
+
+      // Allocate log buffer space and write the slot header (varint).
+      //
+      BATT_ASSIGN_OK_RESULT(MutableBuffer payload_buffer,
+                            this->writer_lock_.prepare(slot_payload_size, caller_grant));
+
+      // Pack the payload.
+      //
+      DataPacker packer{payload_buffer};
+
+      PackedVariant<Ts...>* const variant_head =
+          packer.pack_record(batt::StaticType<PackedVariant<Ts...>>{});
+
+      if (!variant_head) {
+        return ::llfs::make_status(StatusCode::kFailedToPackSlotVarHead);
+      }
+
+      variant_head->init(batt::StaticType<PackedT>{});
+
+      if (!pack_object(BATT_FORWARD(payload), &packer)) {
+        return ::llfs::make_status(StatusCode::kFailedToPackSlotVarTail);
+      }
+
+      // Add the packed slot to the deferred commit segment.
+      //
+      SlotRange slot_range = this->writer_lock_.defer_commit();
+      auto* slot_payload_start = reinterpret_cast<const char*>(variant_head);
+
+      return SlotParseWithPayload<const PackedT*>{
+          .slot =
+              SlotParse{
+                  .offset = slot_range,
+                  .body = std::string_view{slot_payload_start, slot_payload_size},
+                  .total_grant_spent = slot_payload_size,
+              },
+          .payload = variant_head->as(batt::StaticType<PackedT>{}),
+      };
+    }
+
+    /** \brief Like typed_append, but erases type information from the returned value.
+     */
+    template <typename T, typename PackedT = PackedTypeFor<T>>
+    StatusOr<SlotRange> append(const batt::Grant& caller_grant, T&& payload)
+    {
+      StatusOr<SlotParseWithPayload<const PackedTypeFor<T>*>> packed =
+          this->typed_append(caller_grant, BATT_FORWARD(payload));
+
+      BATT_REQUIRE_OK(packed);
+
+      return {packed->slot.offset};
+    }
+
+    /** \brief Atomically commits all slots appended previously by `this` via typed_append.
+     */
+    template <typename PostCommitFn = NullPostCommitFn>
+    StatusOr<SlotRange> finalize(batt::Grant& caller_grant,
+                                 PostCommitFn&& post_commit_fn = {}) noexcept
+    {
+      return post_commit_fn(this->writer_lock_.commit(caller_grant));
+    }
+
+    //----- --- -- -  -  -   -
+   private:
+    SlotWriter::WriterLock writer_lock_;
+  };
+
   /** \brief Appends `payload` to the log using the passed `caller_grant`.
    *
    * \param caller_grant Must be at least as large as packed_sizeof(payload)
@@ -242,44 +392,17 @@ class TypedSlotWriter<PackedVariant<Ts...>> : public SlotWriter
                                                               T&& payload,
                                                               PostCommitFn&& post_commit_fn = {})
   {
-    const usize slot_body_size = sizeof(PackedVariant<Ts...>) + packed_sizeof(payload);
-    BATT_CHECK_NE(slot_body_size, 0u);
-
-    // Lock the writer in SlotWriter::prepare.
-    //
-    StatusOr<Append> op = this->SlotWriter::prepare(caller_grant, slot_body_size);
-    BATT_REQUIRE_OK(op);
-
-    // Do allocation for the buffer to write the variant-ID.
+    // Appending a single slot is treated as a degenerate case of a MultiAppend.
     //
-    PackedVariant<Ts...>* variant_head =
-        op->packer().pack_record(batt::StaticType<PackedVariant<Ts...>>{});
-    if (!variant_head) {
-      return ::llfs::make_status(StatusCode::kFailedToPackSlotVarHead);
-    }
-
-    // Get variant-ID ('which') for this entry.
-    //
-    variant_head->init(batt::StaticType<PackedT>{});
-
-    if (!pack_object(BATT_FORWARD(payload), &(op->packer()))) {
-      return ::llfs::make_status(StatusCode::kFailedToPackSlotVarTail);
-    }
+    MultiAppend op{*this};
 
-    StatusOr<SlotRange> slot_range = post_commit_fn(op->commit());
-    BATT_REQUIRE_OK(slot_range);
+    StatusOr<SlotParseWithPayload<const PackedT*>> result =
+        op.typed_append(caller_grant, BATT_FORWARD(payload));
 
-    auto* slot_body_start = reinterpret_cast<const char*>(variant_head);
+    BATT_REQUIRE_OK(result);
+    BATT_REQUIRE_OK(op.finalize(caller_grant, post_commit_fn));
 
-    return SlotParseWithPayload<const PackedT*>{
-        .slot =
-            SlotParse{
-                .offset = *slot_range,
-                .body = std::string_view{slot_body_start, slot_body_size},
-                .total_grant_spent = slot_body_size,
-            },
-        .payload = variant_head->as(batt::StaticType<PackedT>{}),
-    };
+    return result;
   }
 
   template <typename T, typename PostCommitFn = NullPostCommitFn>
diff --git a/src/llfs/slot_writer.test.cpp b/src/llfs/slot_writer.test.cpp
new file mode 100644
index 0000000..2cdb396
--- /dev/null
+++ b/src/llfs/slot_writer.test.cpp
@@ -0,0 +1,45 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#include <llfs/slot_writer.hpp>
+//
+#include <llfs/slot_writer.hpp>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <llfs/varint.hpp>
+
+namespace {
+
+using namespace llfs::int_types;
+
+TEST(SlotWriterTest, BeginEndAtomicRangeTokens)
+{
+  llfs::Slice<const u8> begin_token = llfs::SlotWriter::WriterLock::begin_atomic_range_token();
+  llfs::Slice<const u8> end_token = llfs::SlotWriter::WriterLock::end_atomic_range_token();
+
+  EXPECT_EQ(begin_token.size(), llfs::SlotWriter::WriterLock::kBeginAtomicRangeTokenSize);
+  EXPECT_EQ(end_token.size(), llfs::SlotWriter::WriterLock::kEndAtomicRangeTokenSize);
+  EXPECT_NE(begin_token.size(), end_token.size());
+  EXPECT_GT(begin_token.size(), 1u);
+  EXPECT_GT(end_token.size(), 1u);
+
+  const auto verify_parses_as_zero = [](const llfs::Slice<const u8>& token) {
+    auto [parsed_n, end_of_parse] = llfs::unpack_varint_from(token.begin(), token.end());
+
+    ASSERT_TRUE(parsed_n);
+    EXPECT_EQ(*parsed_n, 0u);
+    EXPECT_EQ(end_of_parse, token.end());
+  };
+
+  verify_parses_as_zero(begin_token);
+  verify_parses_as_zero(end_token);
+}
+
+}  // namespace
diff --git a/src/llfs/storage_simulation.cpp b/src/llfs/storage_simulation.cpp
index 13b7cc3..f7fa847 100644
--- a/src/llfs/storage_simulation.cpp
+++ b/src/llfs/storage_simulation.cpp
@@ -9,6 +9,12 @@
 #include <llfs/storage_simulation.hpp>
 //
 
+#include <llfs/basic_ring_buffer_log_device.hpp>
+#include <llfs/confirm.hpp>
+#include <llfs/ioring_log_driver.hpp>
+#include <llfs/ioring_log_driver_options.hpp>
+#include <llfs/ioring_log_flush_op.hpp>
+#include <llfs/ioring_log_initializer.hpp>
 #include <llfs/simulated_log_device.hpp>
 #include <llfs/simulated_log_device_impl.hpp>
 #include <llfs/simulated_page_device.hpp>
@@ -71,7 +77,15 @@ batt::TaskScheduler& StorageSimulation::task_scheduler() noexcept
 void StorageSimulation::run_main_task(std::function<void()> main_fn)
 {
   LLFS_LOG_SIM_EVENT() << "entered run_main_task();" << BATT_INSPECT(batt::this_thread_id());
+
+  const bool was_running = this->is_running_.exchange(true);
+
+  const bool saved_quiet_logging =
+      default_ioring_quiet_failure_logging().exchange(this->low_level_log_devices_);
+
   auto on_scope_exit = batt::finally([&] {
+    this->is_running_.store(was_running);
+    default_ioring_quiet_failure_logging().store(saved_quiet_logging);
     LLFS_LOG_SIM_EVENT() << "leaving run_main_task()";
   });
 
@@ -81,7 +95,7 @@ void StorageSimulation::run_main_task(std::function<void()> main_fn)
   // Run the main task until there are no more events to process (either we have terminated or
   // deadlocked).
   //
-  this->handle_events();
+  this->handle_events(/*main_fn_done=*/false);
   //
   LLFS_LOG_SIM_EVENT() << "done handling events." << BATT_INSPECT(main_task.is_done());
 
@@ -89,12 +103,16 @@ void StorageSimulation::run_main_task(std::function<void()> main_fn)
   // Shut down the cache and call `handle_events` again to allow it to terminate all tasks
   // gracefully.
   //
-  this->close_cache();
+  this->close_cache(/*main_fn_done=*/true);
 
   //----- --- -- -  -  -   -
   // The main task should be terminated at this point.
   //
-  BATT_CHECK_EQ(main_task.try_join(), batt::Task::IsDone{true})
+  auto is_done = main_task.try_join();
+  if (is_done != batt::Task::IsDone{true}) {
+    batt::Task::backtrace_all(/*force=*/true);
+  }
+  BATT_CHECK_EQ(is_done, batt::Task::IsDone{true})
       << "main task failed to terminate (possible deadlock?)" << [&main_task](std::ostream& out) {
            batt::print_debug_info(main_task.debug_info, out);
          };
@@ -114,6 +132,9 @@ void StorageSimulation::crash_and_recover()
   for (const auto& [name, p_log_device_impl] : this->log_devices_) {
     p_log_device_impl->crash_and_recover(recover_step);
   }
+  for (const auto& [name, p_log_storage_impl] : this->log_storage_) {
+    p_log_storage_impl->crash_and_recover(recover_step);
+  }
   for (const auto& [name, p_page_device_impl] : this->page_devices_) {
     p_page_device_impl->crash_and_recover(recover_step);
   }
@@ -123,13 +144,13 @@ void StorageSimulation::crash_and_recover()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-void StorageSimulation::close_cache() noexcept
+void StorageSimulation::close_cache(bool main_fn_done) noexcept
 {
   if (this->cache_) {
     LLFS_LOG_SIM_EVENT() << "shutting down the PageCache...";
     this->cache_->close();
     //
-    this->handle_events();
+    this->handle_events(main_fn_done);
     //
     this->cache_->join();
     this->cache_ = nullptr;
@@ -139,7 +160,7 @@ void StorageSimulation::close_cache() noexcept
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-void StorageSimulation::handle_events()
+void StorageSimulation::handle_events(bool main_fn_done)
 {
   for (;;) {
     const u64 step = this->step_.fetch_add(1) + 1;
@@ -153,6 +174,18 @@ void StorageSimulation::handle_events()
         });
 
     if (!next_event_handler) {
+      if (main_fn_done) {
+        const i64 observed_work_count = this->fake_io_context_.work_count().get_value();
+        if (observed_work_count != 0) {
+          LLFS_LOG_ERROR()
+              << "No work to do, but work count is non-zero (" << observed_work_count
+              << "); possible deadlock?  (or threads/tasks have escaped the simulation?)";
+
+          batt::Task::backtrace_all(/*force=*/true);
+          BATT_PANIC();
+          BATT_UNREACHABLE();
+        }
+      }
       LLFS_LOG_SIM_EVENT() << "no more events to handle";
       return;
     }
@@ -167,30 +200,84 @@ void StorageSimulation::handle_events()
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
-std::unique_ptr<LogDevice> StorageSimulation::get_log_device(const std::string& name,
-                                                             Optional<u64> capacity)
+SimulatedLogDeviceStorage StorageSimulation::get_log_device_storage(const std::string& name,
+                                                                    Optional<u64> capacity)
 {
-  auto iter = this->log_devices_.find(name);
+  auto iter = this->log_storage_.find(name);
 
-  // If we didn't find the named device, then create it.
+  // If we didn't find the named storage object, then create it.
   //
-  if (iter == this->log_devices_.end()) {
-    BATT_CHECK(capacity)
-        << "Must specify capacity if creating a simulated log device for the first time!";
+  if (iter == this->log_storage_.end()) {
+    BATT_CHECK(capacity.has_value());
 
-    iter = this->log_devices_
-               .emplace(name, std::make_shared<SimulatedLogDevice::Impl>(*this, name, *capacity))
-               .first;
+    auto config = IoRingLogConfig::from_logical_size(*capacity);
+    auto durable_state = std::make_shared<SimulatedLogDeviceStorage::DurableState>(*this, config);
+
+    Status init_status =
+        initialize_ioring_log_device(*std::make_unique<SimulatedLogDeviceStorage::RawBlockFileImpl>(
+                                         batt::make_copy(durable_state)),
+                                     config, ConfirmThisWillEraseAllMyData::kYes);
+
+    BATT_CHECK_OK(init_status);
+
+    iter = this->log_storage_.emplace(name, std::move(durable_state)).first;
   }
 
-  // At this point we should have a valid entry.
-  //
-  BATT_CHECK_NE(iter, this->log_devices_.end());
+  BATT_CHECK_NE(iter, this->log_storage_.end());
   BATT_CHECK_NOT_NULLPTR(iter->second);
 
-  LLFS_LOG_SIM_EVENT() << "creating SimulatedLogDevice " << batt::c_str_literal(name);
+  return SimulatedLogDeviceStorage{batt::make_copy(iter->second)};
+}
 
-  return std::make_unique<SimulatedLogDevice>(batt::make_copy(iter->second));
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+std::unique_ptr<LogDevice> StorageSimulation::get_log_device(const std::string& name,
+                                                             Optional<u64> capacity)
+{
+  if (this->low_level_log_devices_) {
+    SimulatedLogDeviceStorage storage = this->get_log_device_storage(name, capacity);
+    IoRingLogConfig config = storage.config();
+    auto options = IoRingLogDriverOptions::with_default_values();
+    options.name = name;
+    options.limit_queue_depth(config.block_count());
+
+    using DriverT = BasicIoRingLogDriver<BasicIoRingLogFlushOp, SimulatedLogDeviceStorage>;
+    using LogDeviceT = BasicRingBufferLogDevice<DriverT>;
+
+    batt::TaskScheduler& scheduler =
+        this->is_running() ? this->task_scheduler() : batt::Runtime::instance().default_scheduler();
+
+    auto log_device =
+        std::make_unique<LogDeviceT>(RingBuffer::TempFile{.byte_size = config.logical_size},
+                                     scheduler, std::move(storage), config, options);
+
+    BATT_CHECK_OK(log_device->open());
+
+    return log_device;
+
+  } else {
+    auto iter = this->log_devices_.find(name);
+
+    // If we didn't find the named device, then create it.
+    //
+    if (iter == this->log_devices_.end()) {
+      BATT_CHECK(capacity)
+          << "Must specify capacity if creating a simulated log device for the first time!";
+
+      iter = this->log_devices_
+                 .emplace(name, std::make_shared<SimulatedLogDevice::Impl>(*this, name, *capacity))
+                 .first;
+    }
+
+    // At this point we should have a valid entry.
+    //
+    BATT_CHECK_NE(iter, this->log_devices_.end());
+    BATT_CHECK_NOT_NULLPTR(iter->second);
+
+    LLFS_LOG_SIM_EVENT() << "creating SimulatedLogDevice " << batt::c_str_literal(name);
+
+    return std::make_unique<SimulatedLogDevice>(batt::make_copy(iter->second));
+  }
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
diff --git a/src/llfs/storage_simulation.hpp b/src/llfs/storage_simulation.hpp
index d26fe90..4638080 100644
--- a/src/llfs/storage_simulation.hpp
+++ b/src/llfs/storage_simulation.hpp
@@ -12,12 +12,15 @@
 
 #include <llfs/config.hpp>
 //
+#include <llfs/testing/test_config.hpp>
+
 #include <llfs/int_types.hpp>
 #include <llfs/log_device.hpp>
 #include <llfs/optional.hpp>
 #include <llfs/page_cache.hpp>
 #include <llfs/page_size.hpp>
 #include <llfs/simulated_log_device.hpp>
+#include <llfs/simulated_log_device_storage.hpp>
 #include <llfs/simulated_page_device.hpp>
 #include <llfs/slot.hpp>
 #include <llfs/volume.hpp>
@@ -70,6 +73,11 @@ class StorageSimulation
 
   //+++++++++++-+-+--+----- --- -- -  -  -   -
 
+  void set_low_level_log_devices(bool on) noexcept
+  {
+    this->low_level_log_devices_ = on;
+  }
+
   /** \brief Schedules the passed function (signature: void()) to run at some future point in the
    * simulation.
    *
@@ -101,7 +109,7 @@ class StorageSimulation
   /** \brief Forces the PageCache to be shut down; this will stop all background tasks associated
    * with the PageAllocators.
    */
-  void close_cache() noexcept;
+  void close_cache(bool main_fn_done = false) noexcept;
 
   /** \brief Returns a reference to a TaskScheduler that should be used for all Tasks involved in
    * the simulation.
@@ -160,6 +168,13 @@ class StorageSimulation
     LLFS_LOG_SIM_EVENT() << batt::to_string(BATT_FORWARD(args)...);
   }
 
+  /** \brief Returns true iff the simulation is running.
+   */
+  bool is_running() const noexcept
+  {
+    return this->is_running_.load();
+  }
+
   /** \brief Launches the "driver" (main) simulation task.  This is the entry point to the
    * simulation run.
    */
@@ -171,6 +186,13 @@ class StorageSimulation
    */
   void crash_and_recover();
 
+  /** \brief Creates/accesses a simulated LogDeviceStorage object.
+   *
+   * \param name A unique name used to identify the LogDevice storage in the context of this
+   * simulation
+   */
+  SimulatedLogDeviceStorage get_log_device_storage(const std::string& name, Optional<u64> capacity);
+
   /** \brief Creates/accesses a simulated LogDevice.
    *
    * \param name A unique name used to identify the LogDevice in the context of this simulation
@@ -246,10 +268,14 @@ class StorageSimulation
   /** \brief Step the simulation forward repeatedly until there are no pending handlers that can
    * run.
    */
-  void handle_events();
+  void handle_events(bool main_fn_done);
 
   //+++++++++++-+-+--+----- --- -- -  -  -   -
 
+  // Reads test configuration from the environment.
+  //
+  testing::TestConfig test_config_;
+
   // Used to select event orderings, operations into which to inject failures, etc.
   //
   batt::StateMachineEntropySource entropy_source_;
@@ -289,6 +315,12 @@ class StorageSimulation
   //
   std::unordered_map<std::string, std::shared_ptr<SimulatedLogDevice::Impl>> log_devices_;
 
+  // The set of all simulated log device storage (low-level), indexed by name string (passed in by
+  // the test code).
+  //
+  std::unordered_map<std::string, std::shared_ptr<SimulatedLogDeviceStorage::DurableState>>
+      log_storage_;
+
   // The set of all simulated page devices, indexed by name string (passed in by the test code).
   //
   std::unordered_map<std::string, std::shared_ptr<SimulatedPageDevice::Impl>> page_devices_;
@@ -305,6 +337,14 @@ class StorageSimulation
   // Page readers that should be registered with PageCache instances on each recovery.
   //
   std::unordered_map<PageLayoutId, PageCache::PageReaderFromFile, PageLayoutId::Hash> page_readers_;
+
+  // Are we in low-level LogDevice simulation mode?
+  //
+  bool low_level_log_devices_ = this->test_config_.low_level_log_device_sim();
+
+  // Set to true when we are inside the main simulation loop.
+  //
+  std::atomic<bool> is_running_{false};
 };
 
 }  //namespace llfs
diff --git a/src/llfs/testing/test_config.cpp b/src/llfs/testing/test_config.cpp
new file mode 100644
index 0000000..3f12c2f
--- /dev/null
+++ b/src/llfs/testing/test_config.cpp
@@ -0,0 +1,86 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#include <llfs/testing/test_config.hpp>
+//
+
+#include <batteries/env.hpp>
+
+namespace llfs {
+namespace testing {
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+TestConfig::TestConfig() noexcept
+{
+  this->extra_testing_ =                          //
+      batt::getenv_as<int>("LLFS_EXTRA_TESTING")  //
+          .value_or(0);
+
+  this->low_level_log_device_sim_ =                          //
+      batt::getenv_as<int>("LLFS_LOW_LEVEL_LOG_DEVICE_SIM")  //
+          .value_or(1);
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+bool TestConfig::extra_testing() const noexcept
+{
+  return this->extra_testing_;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+bool TestConfig::low_level_log_device_sim() const noexcept
+{
+  return this->low_level_log_device_sim_;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+const std::filesystem::path& TestConfig::project_dir() noexcept
+{
+  if (this->project_dir_.empty()) {
+    this->project_dir_ = []() {
+      // Preferred method: read the PROJECT_DIR environment variable and use that.
+      //
+      const char* project_dir_env = std::getenv("PROJECT_DIR");
+      if (project_dir_env) {
+        return std::filesystem::path{project_dir_env};
+      }
+
+      // Fallback method: starting with the path to this source file (__FILE__), recursively look at
+      // parent directory names until we find `src`, then go up one level and stop.
+      //
+      std::filesystem::path file_path{__FILE__};
+      while (file_path.has_parent_path() && file_path.filename() != "src") {
+        file_path = file_path.parent_path();
+      }
+      if (file_path.filename() == "src") {
+        file_path = file_path.parent_path();
+        return file_path;
+      }
+
+      // All methods failed.
+      //
+      BATT_PANIC() << "Could not find project root; make sure PROJECT_DIR is set!";
+      BATT_UNREACHABLE();
+    }();
+  }
+  return this->project_dir_;
+}
+
+//==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
+//
+std::filesystem::path TestConfig::data_file_path(std::string_view file_rel_path) noexcept
+{
+  return this->project_dir() / "testdata" / file_rel_path;
+}
+
+}  //namespace testing
+}  //namespace llfs
diff --git a/src/llfs/testing/test_config.hpp b/src/llfs/testing/test_config.hpp
new file mode 100644
index 0000000..24a9bcc
--- /dev/null
+++ b/src/llfs/testing/test_config.hpp
@@ -0,0 +1,71 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#pragma once
+#ifndef LLFS_TESTING_TEST_CONFIG_HPP
+#define LLFS_TESTING_TEST_CONFIG_HPP
+
+#include <llfs/config.hpp>
+//
+
+#include <filesystem>
+
+namespace llfs {
+namespace testing {
+
+/** \brief Captures testing-related settings from the environment and presents them to test code
+ * with a simple API.
+ */
+class TestConfig
+{
+ public:
+  /** \brief Construct a TestConfig from the current environment.
+   */
+  TestConfig() noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  /** \brief Returns whether tests should take extra time to run very thorough tests on more cases.
+   *
+   * Controlled by env var `LLFS_EXTRA_TESTING`.
+   */
+  bool extra_testing() const noexcept;
+
+  /** \brief Returns whether StorageSimulations should use low-level LogDevice simulation
+   * (default=true).
+   *
+   * Controlled by env var `LLFS_LOW_LEVEL_LOG_DEVICE_SIM`.
+   */
+  bool low_level_log_device_sim() const noexcept;
+
+  /** \brief Determines the current repository root directory.
+   *
+   * By default, this is derived from `__FILE__` and built-in assumptions about the directory layout
+   * of the project.  It can be overridden via the environment variable `PROJECT_DIR`.
+   */
+  const std::filesystem::path& project_dir() noexcept;
+
+  /** \brief Returns the path to the named data file.
+   *
+   * Test data files are located in <PROJECT_DIR>/testdata/.
+   */
+  std::filesystem::path data_file_path(std::string_view file_rel_path) noexcept;
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+ private:
+  bool extra_testing_;
+
+  bool low_level_log_device_sim_;
+
+  std::filesystem::path project_dir_;
+};
+
+}  //namespace testing
+}  //namespace llfs
+
+#endif  // LLFS_TESTING_TEST_CONFIG_HPP
diff --git a/src/llfs/testing/util.cpp b/src/llfs/testing/util.cpp
index 988dad0..3651339 100644
--- a/src/llfs/testing/util.cpp
+++ b/src/llfs/testing/util.cpp
@@ -9,6 +9,8 @@
 #include <llfs/testing/util.hpp>
 //
 
+#include <llfs/testing/test_config.hpp>
+
 namespace llfs {
 namespace testing {
 
@@ -16,41 +18,18 @@ namespace testing {
 //
 const std::filesystem::path& get_project_dir()
 {
-  static const std::filesystem::path cached = []() {
-    const char* project_dir_env = std::getenv("PROJECT_DIR");
-    if (project_dir_env) {
-      return std::filesystem::path{project_dir_env};
-    }
-
-    std::filesystem::path file_path{__FILE__};
-    if (std::filesystem::exists(file_path)) {
-      std::filesystem::path testing_dir_path = file_path.parent_path();
-      if (std::filesystem::exists(testing_dir_path)) {
-        std::filesystem::path src_llfs_dir_path = testing_dir_path.parent_path();
-        if (std::filesystem::exists(src_llfs_dir_path)) {
-          std::filesystem::path src_dir_path = src_llfs_dir_path.parent_path();
-          if (std::filesystem::exists(src_dir_path)) {
-            std::filesystem::path project_dir_path = src_dir_path.parent_path();
-            if (std::filesystem::exists(project_dir_path)) {
-              return project_dir_path;
-            }
-          }
-        }
-      }
-    }
-
-    BATT_PANIC() << "Could not find project root; make sure PROJECT_DIR is set!";
-    BATT_UNREACHABLE();
-  }();
-
-  return cached;
+  TestConfig test_config;
+
+  return test_config.project_dir();
 }
 
 //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 //
 std::filesystem::path get_test_data_file_path(std::string_view file_rel_path)
 {
-  return get_project_dir() / "testdata" / file_rel_path;
+  TestConfig test_config;
+
+  return test_config.data_file_path(file_rel_path);
 }
 
 }  //namespace testing
diff --git a/src/llfs/trie.test.cpp b/src/llfs/trie.test.cpp
index 77bc084..3578f10 100644
--- a/src/llfs/trie.test.cpp
+++ b/src/llfs/trie.test.cpp
@@ -13,6 +13,7 @@
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
+#include <llfs/testing/test_config.hpp>
 #include <llfs/testing/util.hpp>
 
 #include <llfs/data_packer.hpp>
@@ -115,7 +116,9 @@ struct PackedSSTableWrapper {
 
 TEST(Trie, Test)
 {
-  const bool extra_testing = batt::getenv_as<int>("LLFS_EXTRA_TESTING").value_or(0);
+  llfs::testing::TestConfig test_config;
+
+  const bool extra_testing = test_config.extra_testing();
 
   auto words = load_words();
 
@@ -369,7 +372,9 @@ inline bool operator<(const Rec& l, const Rec& r)
 
 TEST(Trie, VEBLayoutTest)
 {
-  const bool extra_testing = batt::getenv_as<int>("LLFS_EXTRA_TESTING").value_or(0);
+  llfs::testing::TestConfig test_config;
+
+  const bool extra_testing = test_config.extra_testing();
 
   std::cerr << "depth, avg(BFS), avg(vEB), avg(RND),";
   for (usize i = 0; i < 32; ++i) {
diff --git a/src/llfs/varint.hpp b/src/llfs/varint.hpp
index 41697f0..1b7d09a 100644
--- a/src/llfs/varint.hpp
+++ b/src/llfs/varint.hpp
@@ -12,6 +12,7 @@
 #ifndef LLFS_VARINT_HPP
 #define LLFS_VARINT_HPP
 
+#include <llfs/buffer.hpp>
 #include <llfs/int_types.hpp>
 #include <llfs/optional.hpp>
 
@@ -66,6 +67,20 @@ BATT_STATIC_ASSERT_EQ(kMaxVarInt64Size, max_packed_sizeof_varint(64));
 //
 u8* pack_varint_to(u8* first, u8* last, u64 n);
 
+/** \brief (Convenience) Packs the passed integer `n` to the buffer `dst`, returning the remaining
+ * portion of `dst` if successful or None if there is not enough space.
+ */
+inline Optional<MutableBuffer> pack_varint_to(const MutableBuffer& dst, u64 n)
+{
+  u8* const first = static_cast<u8*>(dst.data());
+  u8* const last = first + dst.size();
+  u8* const rest = pack_varint_to(first, last, n);
+  if (rest) {
+    return MutableBuffer{rest, static_cast<usize>(last - rest)};
+  }
+  return None;
+}
+
 // Attempts to decode a varint value from the given byte range.  If successful, this function will
 // return the decoded integer as the first tuple element; else this element will be None.  The
 // second element of the returned tuple will be a pointer to the byte after the last byte parsed as
@@ -73,6 +88,28 @@ u8* pack_varint_to(u8* first, u8* last, u64 n);
 //
 std::tuple<Optional<u64>, const u8*> unpack_varint_from(const u8* first, const u8* last);
 
+/** \brief (Convenience) Unpacks a varint from the passed buffer; updates the buffer in-place.
+ */
+inline Optional<u64> unpack_varint_from(ConstBuffer* src)
+{
+  const u8* const first = static_cast<const u8*>(src->data());
+  const u8* const last = first + src->size();
+  auto [n, rest] = unpack_varint_from(first, last);
+  if (n) {
+    *src += rest - first;
+  }
+  return n;
+}
+
+/** \brief (Convenience) Unpacks a varint from the passed buffer, returning the parsed integer and
+ * the rest of the data.
+ */
+inline std::tuple<Optional<u64>, ConstBuffer> unpack_varint_from(ConstBuffer src)
+{
+  Optional<u64> n = unpack_varint_from(&src);
+  return {n, src};
+}
+
 }  // namespace llfs
 
 #endif  // LLFS_VARINT_HPP
diff --git a/src/llfs/varint.test.cpp b/src/llfs/varint.test.cpp
index bb9784b..ce9b833 100644
--- a/src/llfs/varint.test.cpp
+++ b/src/llfs/varint.test.cpp
@@ -26,8 +26,11 @@ using namespace llfs::int_types;
 
 using llfs::ConstBuffer;
 using llfs::MutableBuffer;
+using llfs::None;
 using llfs::Optional;
+using llfs::pack_varint_to;
 using llfs::packed_sizeof_varint;
+using llfs::unpack_varint_from;
 
 // Verify the edge-case boundaries of packed varint size (i.e., the precise integer values where the
 // packed size of a varint changes).
@@ -85,4 +88,97 @@ TEST(VarIntTest, RandomValues)
   }
 }
 
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+//
+TEST(VarIntTest, BufferApi)
+{
+  const u64 small_num = 7;
+  const u64 large_num = 0xfedcba9876543210ull;
+
+  constexpr usize small_num_size = 1;
+  constexpr usize large_num_size = 10;
+
+  ASSERT_EQ(packed_sizeof_varint(small_num), small_num_size);
+  ASSERT_EQ(packed_sizeof_varint(large_num), large_num_size);
+
+  std::array<char, small_num_size> small_buf;
+  std::array<char, large_num_size> large_buf;
+
+  EXPECT_FALSE(pack_varint_to(MutableBuffer{small_buf.data(), small_buf.size()}, large_num));
+  EXPECT_FALSE(pack_varint_to(MutableBuffer{large_buf.data(), large_buf.size() - 1}, large_num));
+
+  Optional<MutableBuffer> packed;
+
+  packed = None;
+  packed = pack_varint_to(MutableBuffer{small_buf.data(), small_buf.size()}, small_num);
+
+  ASSERT_TRUE(packed);
+  EXPECT_EQ((void*)packed->data(), (void*)(small_buf.data() + small_buf.size()));
+  EXPECT_EQ(packed->size(), 0u);
+
+  packed = None;
+  packed = pack_varint_to(MutableBuffer{large_buf.data(), large_buf.size()}, large_num);
+
+  ASSERT_TRUE(packed);
+  EXPECT_EQ((void*)packed->data(), (void*)(large_buf.data() + large_buf.size()));
+  EXPECT_EQ(packed->size(), 0u);
+
+  {
+    auto src = ConstBuffer{small_buf.data(), small_buf.size()};
+    Optional<u64> unpacked_small_num = unpack_varint_from(&src);
+
+    ASSERT_TRUE(unpacked_small_num);
+    EXPECT_EQ(*unpacked_small_num, small_num);
+
+    EXPECT_EQ((void*)src.data(), (void*)(small_buf.data() + small_buf.size()));
+    EXPECT_EQ(src.size(), 0u);
+
+    auto [n, rest] = unpack_varint_from(ConstBuffer{small_buf.data(), small_buf.size()});
+
+    ASSERT_TRUE(n);
+    EXPECT_EQ(*n, small_num);
+    EXPECT_EQ(rest.size(), 0u);
+    EXPECT_EQ((void*)rest.data(), (void*)(small_buf.data() + small_buf.size()));
+  }
+  {
+    auto src = ConstBuffer{large_buf.data(), large_buf.size()};
+    Optional<u64> unpacked_large_num = unpack_varint_from(&src);
+
+    ASSERT_TRUE(unpacked_large_num);
+    EXPECT_EQ(*unpacked_large_num, large_num);
+
+    EXPECT_EQ((void*)src.data(), (void*)(large_buf.data() + large_buf.size()));
+    EXPECT_EQ(src.size(), 0u);
+
+    auto [n, rest] = unpack_varint_from(ConstBuffer{large_buf.data(), large_buf.size()});
+
+    ASSERT_TRUE(n);
+    EXPECT_EQ(*n, large_num);
+    EXPECT_EQ(rest.size(), 0u);
+    EXPECT_EQ((void*)rest.data(), (void*)(large_buf.data() + large_buf.size()));
+  }
+}
+
+//=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
+// Test that we accept longer-than-necessary encodings of integers.
+//
+TEST(VarIntTest, ExtraBytes)
+{
+  std::array<u8, 1> packed1 = {0b00000000};
+  std::array<u8, 2> packed2 = {0b10000000, 0b00000000};
+  std::array<u8, 3> packed3 = {0b10000000, 0b10000000, 0b00000000};
+
+  auto verify = [](const auto& packed) {
+    auto [n, parse_end] = unpack_varint_from(packed.data(), packed.data() + packed.size());
+
+    ASSERT_TRUE(n);
+    EXPECT_EQ(*n, 0u);
+    EXPECT_EQ((void*)parse_end, (void*)(&packed[packed.size()]));
+  };
+
+  ASSERT_NO_FATAL_FAILURE(verify(packed1));
+  ASSERT_NO_FATAL_FAILURE(verify(packed2));
+  ASSERT_NO_FATAL_FAILURE(verify(packed3));
+}
+
 }  // namespace
diff --git a/src/llfs/volume.cpp b/src/llfs/volume.cpp
index 6ce61c7..2419c4c 100644
--- a/src/llfs/volume.cpp
+++ b/src/llfs/volume.cpp
@@ -194,7 +194,6 @@ u64 Volume::calculate_grant_size(const AppendableJob& appendable) const
           StatusOr<slot_offset_type> sync_slot =
               arena.allocator().attach_user(uuid, /*user_slot=*/next_available_slot_offset);
 
-          BATT_UNTESTED_COND(!sync_slot.ok());
           BATT_REQUIRE_OK(sync_slot);
 
           Status sync_status = arena.allocator().sync(*sync_slot);
@@ -395,7 +394,7 @@ void Volume::halt()
   this->slot_writer_->halt();
   this->trim_control_->halt();
   this->trimmer_->halt();
-  this->root_log_->close().IgnoreError();
+  this->root_log_->halt();
   if (this->recycler_) {
     this->recycler_->halt();
   }
@@ -409,6 +408,7 @@ void Volume::join()
     this->trimmer_task_->join();
     this->trimmer_task_ = None;
   }
+  this->root_log_->join();
   if (this->recycler_) {
     this->recycler_->join();
   }
@@ -572,7 +572,10 @@ StatusOr<SlotRange> Volume::append(AppendableJob&& appendable, batt::Grant& gran
 
     const auto grant_size_after_prepare = grant.size();
 
-    BATT_CHECK_EQ(prepared_job_size, grant_size_before_prepare - grant_size_after_prepare);
+    if (prepare_slot.ok()) {
+      BATT_CHECK_EQ(prepared_job_size, grant_size_before_prepare - grant_size_after_prepare)
+          << BATT_INSPECT(prepare_slot.status()) << BATT_INSPECT(grant_size_before_prepare);
+    }
 
     if (sequencer) {
       if (!prepare_slot.ok()) {
diff --git a/src/llfs/volume.hpp b/src/llfs/volume.hpp
index 07513fb..a5e4d24 100644
--- a/src/llfs/volume.hpp
+++ b/src/llfs/volume.hpp
@@ -45,14 +45,18 @@ struct VolumeRecoverParams {
 };
 
 class VolumeJobRecoveryVisitor;
+class VolumeMultiAppend;
 
 //=#=#==#==#===============+=+=+=+=++=++++++++++++++-++-+--+-+----+---------------
 //
 class Volume
 {
  public:
+  friend class VolumeMultiAppend;
   friend class VolumeReader;
 
+  using MultiAppend = VolumeMultiAppend;
+
   //==#==========+==+=+=++=+++++++++++-+-+--+----- --- -- -  -  -   -
 
   // Read the Volume state from the passed log devices and resolve any pending jobs by committing or
@@ -349,3 +353,4 @@ class Volume
 #endif  // LLFS_VOLUME_HPP
 
 #include <llfs/volume.ipp>
+#include <llfs/volume_multi_append.hpp>
diff --git a/src/llfs/volume.test.cpp b/src/llfs/volume.test.cpp
index 1ce17d9..628190a 100644
--- a/src/llfs/volume.test.cpp
+++ b/src/llfs/volume.test.cpp
@@ -14,6 +14,7 @@
 #include <gtest/gtest.h>
 
 #include <llfs/testing/fake_log_device.hpp>
+#include <llfs/testing/test_config.hpp>
 
 #include <llfs/memory_log_device.hpp>
 #include <llfs/memory_page_cache.hpp>
@@ -1427,11 +1428,14 @@ class VolumeSimTest : public ::testing::Test
 //
 TEST_F(VolumeSimTest, RecoverySimulation)
 {
+  static const llfs::testing::TestConfig test_config;
+
   static const u32 kInitialSeed =  //
       batt::getenv_as<u32>("LLFS_VOLUME_SIM_SEED").value_or(987654321);
 
   static const u32 kNumSeeds =  //
-      batt::getenv_as<u32>("LLFS_VOLUME_SIM_COUNT").value_or(2500);
+      batt::getenv_as<u32>("LLFS_VOLUME_SIM_COUNT")
+          .value_or(test_config.extra_testing() ? 65536 : 4096);
 
   static const u32 kCpuPin =  //
       batt::getenv_as<u32>("LLFS_VOLUME_SIM_CPU").value_or(0);
@@ -1506,6 +1510,8 @@ TEST_F(VolumeSimTest, ConcurrentAppendJobs)
                              llfs::PageGraphNodeView::page_reader());
 
     const auto main_task_fn = [&] {
+      LLFS_VLOG(1) << "entered main;" << BATT_INSPECT(seed);
+
       // Create the simulated Volume.
       //
       {
@@ -1520,6 +1526,8 @@ TEST_F(VolumeSimTest, ConcurrentAppendJobs)
 
         llfs::Volume& volume = **recovered_volume;
 
+        LLFS_VLOG(1) << "recovered volume";
+
         // Test plan:
         //  1. Concurrently, on `this->pages_per_device` different tasks:
         //     - build a page and commit it to the volume
@@ -1571,10 +1579,14 @@ TEST_F(VolumeSimTest, ConcurrentAppendJobs)
               /*name=*/batt::to_string("TestCommitTask", task_i)));
         }
 
+        LLFS_VLOG(1) << "starting tasks...";
+
         for (auto& p_task : tasks) {
           p_task->start();
         }
 
+        LLFS_VLOG(1) << "joining tasks...";
+
         for (auto& p_task : tasks) {
           p_task->join();
         }
@@ -1585,6 +1597,8 @@ TEST_F(VolumeSimTest, ConcurrentAppendJobs)
         //
         constexpr i32 kExpectedRefCount = 2;
 
+        LLFS_VLOG(1) << "checking ref counts...";
+
         for (llfs::PageCache::PageDeviceEntry* entry :
              sim.cache()->devices_with_page_size(1 * kKiB)) {
           BATT_CHECK_NOT_NULLPTR(entry);
@@ -1594,8 +1608,11 @@ TEST_F(VolumeSimTest, ConcurrentAppendJobs)
           break;
         }
 
+        LLFS_VLOG(1) << "volume.halt()";
         volume.halt();
+        LLFS_VLOG(1) << "volume.join()";
         volume.join();
+        LLFS_VLOG(1) << "done!";
       }
     };
 
@@ -1655,9 +1672,14 @@ void VolumeSimTest::run_recovery_sim(u32 seed)
                            llfs::PageGraphNodeView::page_reader());
 
   const auto main_task_fn = [&] {
+    sim.set_inject_failures_mode(false);
+
+    LLFS_VLOG(1) << "Entered main task;" << BATT_INSPECT(seed) << BATT_INSPECT(sim.is_running());
+
     // Create the simulated Volume.
     //
     {
+      LLFS_VLOG(1) << "Creating simulated volume";
       batt::StatusOr<std::unique_ptr<llfs::Volume>> recovered_volume = sim.get_volume(
           "TestVolume", /*slot_visitor_fn=*/
           [](auto&&...) {
@@ -1665,6 +1687,8 @@ void VolumeSimTest::run_recovery_sim(u32 seed)
           },
           /*root_log_capacity=*/64 * kKiB);
 
+      LLFS_VLOG(1) << "volume recovery status=" << recovered_volume.status();
+
       ASSERT_TRUE(recovered_volume.ok()) << recovered_volume.status();
 
       llfs::Volume& volume = **recovered_volume;
@@ -1683,13 +1707,18 @@ void VolumeSimTest::run_recovery_sim(u32 seed)
 
       // Simulate a full crash and recovery.
       //
+      LLFS_VLOG(1) << "Before crash_and_recover()";
       sim.crash_and_recover();
+      LLFS_VLOG(1) << "After crash_and_recover(); Before volume.halt()";
 
       // Terminate the volume.
       //
       volume.halt();
+      LLFS_VLOG(1) << "After volume.halt(); Before volume.join()";
       volume.join();
+      LLFS_VLOG(1) << "After volume.join()";
     }
+    LLFS_VLOG(1) << "First crash_and_recover()" << BATT_INSPECT(seed);
     EXPECT_TRUE(state.first_page_id.is_valid()) << BATT_INSPECT(state.seed);
 
     // Recover system state, post-crash.
@@ -1706,6 +1735,8 @@ void VolumeSimTest::run_recovery_sim(u32 seed)
       ASSERT_NO_FATAL_FAILURE(
           this->verify_post_recovery_expectations(state, sim, **recovered_volume));
     }
+
+    LLFS_VLOG(1) << "Sim run finished;" << BATT_INSPECT(seed);
   };
 
   sim.run_main_task(main_task_fn);
diff --git a/src/llfs/volume_multi_append.hpp b/src/llfs/volume_multi_append.hpp
new file mode 100644
index 0000000..06581cf
--- /dev/null
+++ b/src/llfs/volume_multi_append.hpp
@@ -0,0 +1,157 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#pragma once
+#ifndef LLFS_VOLUME_MULTI_APPEND_HPP
+#define LLFS_VOLUME_MULTI_APPEND_HPP
+
+#ifndef LLFS_VOLUME_HPP
+#error This file must be included from <llfs/volume.hpp>!
+#endif
+
+#include <llfs/slot_writer.hpp>
+
+namespace llfs {
+
+/** \brief An atomic, multiple slot append operation for a Volume.
+ *
+ * Unlike regular sequential appends, VolumeMultiAppend offers the following guarantees:
+ *
+ *  - All slots in the multi-append will appear sequentially with no interposed slots (from other
+ *    writers/threads)
+ *  - Only a single call will be made to the underlying LogDevice::Writer to commit the data
+ *  - On crash/recovery, either all of the slots in the multi-append will be visible, or none
+ */
+class VolumeMultiAppend
+{
+ public:
+  /** \brief Returns the size grant required for a multi-append, given the total size of the grants
+   * needed for each slot.
+   */
+  static constexpr u64 calculate_grant_size(u64 slots_total_size) noexcept
+  {
+    return slots_total_size + SlotWriter::WriterLock::kBeginAtomicRangeTokenSize +
+           SlotWriter::WriterLock::kEndAtomicRangeTokenSize;
+  }
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  /** \brief Locks the volume's slot writer and initiates an atomic multi-slot append operation.
+   */
+  explicit VolumeMultiAppend(Volume& volume) noexcept : op_{*volume.slot_writer_}
+  {
+  }
+
+  /** \brief VolumeMultiAppend is not copy-constructible.
+   */
+  VolumeMultiAppend(const VolumeMultiAppend&) = delete;
+
+  /** \brief VolumeMultiAppend is not copy-assignable.
+   */
+  VolumeMultiAppend& operator=(const VolumeMultiAppend&) = delete;
+
+  /** \brief Destroys the object; panics if neither of this->commit() nor this->cancel() have been
+   * invoked.
+   */
+  ~VolumeMultiAppend() noexcept
+  {
+    BATT_CHECK(this->closed_);
+  }
+
+  //+++++++++++-+-+--+----- --- -- -  -  -   -
+
+  /** \brief Returns true iff the multi-append operation is still accepting new slots.  Calling
+   * this->commit or this->cancel the first time will cause the status of the operation to go from
+   * "open" to "closed" (not open).
+   */
+  bool is_open() const noexcept
+  {
+    return !this->closed_;
+  }
+
+  /** \brief Adds a single slot (the packed representation of T) to the end of the multi-append. The
+   * passed grant must be large enough to cover the *entire* multi-append, including the current
+   * payload and all payloads previously passed to append.
+   *
+   * \return the slot offset interval of the appended data
+   */
+  template <typename T>
+  StatusOr<SlotRange> append(const T& payload, const batt::Grant& grant) noexcept
+  {
+    BATT_CHECK(!this->closed_);
+
+    if (this->first_) {
+      this->first_ = false;
+      BATT_REQUIRE_OK(this->op_.begin_atomic_range(grant));
+    }
+
+    llfs::PackObjectAsRawData<const T&> packed_obj_as_raw{payload};
+
+    return this->op_.append(grant, packed_obj_as_raw);
+  }
+
+  /** \brief Adds a single slot (raw bytes) to the multi-append.
+   */
+  StatusOr<SlotRange> append(const std::string_view& payload, const batt::Grant& grant)
+  {
+    return this->append(pack_as_raw(payload), grant);
+  }
+
+  /** \brief Attempts to commit all slots that have been added to the multi-append, consuming part
+   * or all of the passed grant.
+   *
+   * This operation may fail due to insufficient grant or I/O errors in the underlying LogDevice
+   * (even though the data is flushed from memory to storage asychronously; this means an I/O error
+   * reported here was likely encountered while flushing previous data).
+   *
+   * \return the entire committed slot interval for the slots in the multi-append
+   */
+  StatusOr<SlotRange> commit(batt::Grant& grant) noexcept
+  {
+    BATT_CHECK(!this->closed_);
+
+    if (!this->first_) {
+      BATT_REQUIRE_OK(this->op_.end_atomic_range(grant));
+    }
+
+    StatusOr<SlotRange> result = this->op_.finalize(grant);
+    BATT_REQUIRE_OK(result);
+
+    this->closed_ = true;
+    return result;
+  }
+
+  /** \brief Abandons the multi-append without modifying the Volume root log.
+   *
+   * Note: does not release the writer lock for the volume; this object must be destroyed to release
+   * the lock.
+   */
+  void cancel() noexcept
+  {
+    BATT_CHECK(!this->closed_);
+    this->closed_ = true;
+  }
+
+ private:
+  // Implements the actual log appending.
+  //
+  TypedSlotWriter<VolumeEventVariant>::MultiAppend op_;
+
+  // true iff no call append has yet been made; used to determine when we should write a begin
+  // atomic range token to the log.
+  //
+  bool first_ = true;
+
+  // true iff commit or cancel has been called.
+  //
+  bool closed_ = false;
+};
+
+}  //namespace llfs
+
+#endif  // LLFS_VOLUME_MULTI_APPEND_HPP
diff --git a/src/llfs/volume_multi_append.test.cpp b/src/llfs/volume_multi_append.test.cpp
new file mode 100644
index 0000000..a4b4ae4
--- /dev/null
+++ b/src/llfs/volume_multi_append.test.cpp
@@ -0,0 +1,197 @@
+//#=##=##=#==#=#==#===#+==#+==========+==+=+=+=+=+=++=+++=+++++=-++++=-+++++++++++
+//
+// Part of the LLFS Project, under Apache License v2.0.
+// See https://www.apache.org/licenses/LICENSE-2.0 for license information.
+// SPDX short identifier: Apache-2.0
+//
+//+++++++++++-+-+--+----- --- -- -  -  -   -
+
+#include <llfs/volume.hpp>
+//
+#include <llfs/volume.hpp>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <llfs/testing/test_config.hpp>
+
+#include <llfs/storage_simulation.hpp>
+
+#include <random>
+
+namespace {
+
+using namespace llfs::int_types;
+using namespace llfs::constants;
+
+using llfs::StatusOr;
+
+TEST(VolumeMultiAppendTest, SimTest)
+{
+  const std::string nonterminal(197, 'a');
+  const std::string terminal(193, 'b');
+
+  llfs::testing::TestConfig test_config;
+
+  const u32 kNumSeeds = test_config.extra_testing() ? 100 * 1000 : 400;
+
+  for (u32 seed = 0; seed < kNumSeeds; ++seed) {
+    for (usize n_before_crash : {1, 2, 3, 5, 10, 100, 500, 1000, 2000}) {
+      LLFS_VLOG(1) << BATT_INSPECT(seed) << BATT_INSPECT(n_before_crash);
+      std::mt19937 rng{seed};
+
+      llfs::StorageSimulation sim{batt::StateMachineEntropySource{
+          /*entropy_fn=*/[&rng](usize min_value, usize max_value) -> usize {
+            std::uniform_int_distribution<usize> pick_value{min_value, max_value};
+            return pick_value(rng);
+          }}};
+
+      sim.run_main_task([&] {
+        //+++++++++++-+-+--+----- --- -- -  -  -   -
+        {
+          //----- --- -- -  -  -   -
+          // Recover the simulated Volume.
+          //
+          LLFS_VLOG(1) << "sim.get_volume()";
+
+          StatusOr<std::unique_ptr<llfs::Volume>> recovered_volume = sim.get_volume(
+              "TestVolume", /*slot_visitor_fn=*/
+              [](auto&&...) {
+                return batt::OkStatus();
+              },
+              /*root_log_capacity=*/64 * kKiB);
+
+          ASSERT_TRUE(recovered_volume.ok()) << recovered_volume.status();
+
+          llfs::Volume& volume = **recovered_volume;
+
+          //----- --- -- -  -  -   -
+          // Obtain a grant to append the entire contents of the root log.
+          //
+          batt::Grant grant = BATT_OK_RESULT_OR_PANIC(
+              volume.reserve(volume.available_to_reserve(), batt::WaitForResource::kFalse));
+
+          // We will commit half the slots without failure injection, then turn on failure
+          // injection and allow errors to be handled.
+          //
+          sim.set_inject_failures_mode(false);
+
+          batt::Optional<llfs::VolumeMultiAppend> op;
+          usize pos_in_batch = 0;
+          usize batch_size = 1;
+          bool first_half = true;
+
+          for (usize i = 0; i < n_before_crash; ++i) {
+            // Check to see if it is time to turn on failure injection yet.
+            //
+            if (first_half && i >= n_before_crash / 2) {
+              first_half = false;
+              sim.set_inject_failures_mode(true);
+            }
+
+            // Open a multi-append if there isn't an active one.
+            //
+            if (!op) {
+              op.emplace(volume);
+            }
+
+            // Allow the simulator to run some background tasks randomly.
+            //
+            batt::Task::yield();
+
+            // We write multi-appends in batches of increasing size: 1, 2, 3, 4...
+            // All multi-appends contain `nonterminal` slots followed by a single `terminal`
+            // slot.
+            //
+            std::string_view s = (pos_in_batch + 1 < batch_size) ? nonterminal : terminal;
+
+            if (!op->append(s, grant).ok()) {
+              // This is a valid path, as we aren't checking the grant to see if we have enough
+              // space in the log to add `s`.
+              //
+              LLFS_VLOG(1) << "Append error" << BATT_INSPECT(grant.size())
+                           << BATT_INSPECT(op->is_open());
+              break;
+            }
+
+            // Increment our position in the current batch and see if the current batch is
+            // completed, in which case we commit the multi-append, reset state, and increment the
+            // batch_size.
+            //
+            ++pos_in_batch;
+            if (pos_in_batch == batch_size) {
+              ++batch_size;
+              pos_in_batch = 0;
+              if (!op->commit(grant).ok()) {
+                LLFS_VLOG(1) << "Commit error";
+                break;
+              }
+              op = batt::None;
+            }
+          }
+
+          // It's possible that we exited the loop while in the middle of an open multi-append; if
+          // so, cancel it now.
+          //
+          if (op && op->is_open()) {
+            op->cancel();
+            op = batt::None;
+          }
+        }
+
+        LLFS_VLOG(1) << "sim.inject_failures = false; crash_and_recover";
+
+        // Simulate a crash and recover.
+        //
+        sim.set_inject_failures_mode(false);
+        sim.crash_and_recover();
+
+        //+++++++++++-+-+--+----- --- -- -  -  -   -
+        {
+          std::string_view last_slot;
+          usize slots_found = 0;
+          i32 last_run = -1;
+          i32 run_length = 0;
+
+          StatusOr<std::unique_ptr<llfs::Volume>> recovered_volume = sim.get_volume(
+              "TestVolume", /*slot_visitor_fn=*/
+              [&](const llfs::SlotParse& slot, std::string_view user_data) {
+                ++slots_found;
+                last_slot = user_data;
+
+                LLFS_VLOG(1) << BATT_INSPECT(slot.offset) << BATT_INSPECT_STR(user_data)
+                             << BATT_INSPECT(slots_found);
+
+                if (last_slot == nonterminal) {
+                  ++run_length;
+
+                } else {
+                  // If the slot data isn't `nonterminal`, and it isn't `terminal`, um... what is
+                  // it, and how did it get here??
+                  //
+                  BATT_CHECK_EQ(last_slot, terminal);
+
+                  EXPECT_EQ(run_length, last_run + 1);
+
+                  last_run = run_length;
+                  run_length = 0;
+                }
+                return batt::OkStatus();
+              });
+
+          ASSERT_TRUE(recovered_volume.ok()) << recovered_volume.status();
+
+          // This is the crucial test -- the last slot observed should always be on a multi-append
+          // boundary.
+          //
+          if (slots_found != 0) {
+            EXPECT_THAT(last_slot, ::testing::StrEq(terminal))
+                << BATT_INSPECT(seed) << BATT_INSPECT(n_before_crash);
+          }
+        }
+      });
+    }
+  }
+}
+
+}  // namespace
diff --git a/src/llfs/volume_trimmer.test.cpp b/src/llfs/volume_trimmer.test.cpp
index 00bc0d5..8af237a 100644
--- a/src/llfs/volume_trimmer.test.cpp
+++ b/src/llfs/volume_trimmer.test.cpp
@@ -14,6 +14,7 @@
 #include <gtest/gtest.h>
 
 #include <llfs/testing/fake_log_device.hpp>
+#include <llfs/testing/test_config.hpp>
 
 #include <llfs/log_device_snapshot.hpp>
 #include <llfs/pack_as_raw.hpp>
@@ -1031,9 +1032,9 @@ void VolumeTrimmerTest::TrimmerSession::terminate()
 //
 TEST_F(VolumeTrimmerTest, RandomizedTest)
 {
-  static const bool kExtraTesting =               //
-      batt::getenv_as<int>("LLFS_EXTRA_TESTING")  //
-          .value_or(0);
+  static llfs::testing::TestConfig test_config;
+
+  static const bool kExtraTesting = test_config.extra_testing();
 
   static const usize kNumSeeds =                   //
       batt::getenv_as<int>("LLFS_TEST_NUM_SEEDS")  //