moveDirIfExists refused to proceed whenever the destination files existed,
even if there was nothing in ColdDataDir to move. After the first run the
node creates stateproof.sqlite and crash.sqlite in HotDataDir, so every
subsequent startup with separate hot and cold dirs failed with
"destination file ... already exists, not overwriting".

Return early when none of the files exist in the source directory, and add
a regression test for the restart case.

Size against offset only catches a truncation that is still visible when
the poll arrives. A file emptied and written back past the old offset
inside one interval never looks short, and the next drain reads new bytes
at a stale position: the prefix is lost and a pending fragment of the old
file is spliced onto what followed.

Polling has no way to close that. Nothing separates a truncate-and-regrow
from an append once the inode is unchanged and the length has recovered,
so the alternative is a different mechanism rather than a better check.
The window is one interval wide, algod rotates by renaming, and tail -F
has the same hole; it is left open on purpose, and now says so.

The truncation test slept to stay out of that window without explaining
which window, which read as timing noise rather than as the point.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqPSx1wqM8rMdo4EHPa4jy

streamOne returns a failure to read the file and a failure inside the
caller's callback down one path, and behind the live log streamSources
treated both as an unreadable archive. A callback that failed while an
archive was open had its error recorded as the archive's, and the scan
carried on into the newer files and returned nil.

That lost a cancellation or a closed pipe outright, and reported a hole
in a history that had been read perfectly well. The n > 0 path has always
returned the callback's error directly; the two halves of Scan disagreed
about their own contract. Callback errors are tagged so they can be told
apart and returned.

The existing test passed a single live source, so the branch that
swallowed them had never been read by it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqPSx1wqM8rMdo4EHPa4jy

Render's one-line guarantee was only half enforced. Values were escaped
and keys were concatenated raw, but a field name is decoded from the same
JSON object the value is, and an object key may hold anything a JSON
string can. A key carrying a newline split one entry across two physical
lines, which is the defect the value quoting was there to prevent.

The predicate moves into quoteIfNeeded and both halves of the pair go
through it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqPSx1wqM8rMdo4EHPa4jy