fix(cli): fix three log journal defects and test Windows with the race detector

docs/network-recovery-diagnostics.md

@@ -67,8 +67,10 @@ The `Network snapshot` event and the header line of every log file render the sa
 The field `default_route_interface` is gone. Read `default_route_v4` and `default_route_v6` in its place.
 The two routes and the two gateways come from the route table of macOS, one route per address family. A tunnel that owns the default route has no next hop, so its route names the tunnel and its gateway stays empty.
 Windows and Linux read no route table in this release. They fill `default_route_v4` from the network monitor and leave `default_route_v6`, `gateway_v4`, and `gateway_v6` empty.
+On macOS, `default_route_v4` comes from the network monitor only when the route table gives no route for the two address families. When the route table gives an IPv6 route only, `default_route_v4` stays empty.
 
 `link_type` is one of `wifi`, `ethernet`, `usb_tether`, `tunnel`, and `unknown`.
+`link_type` and `tethered` describe the interface of the IPv4 default route. When no IPv4 route is present, they describe the interface of the IPv6 default route. When the route table gives no route, they describe the default interface of the network monitor. Thus the link fields and the route fields of one record describe the same interface.
 macOS reads it from the name of the hardware port. Linux reads `wifi`, `ethernet`, `usb_tether`, and `tunnel` from the kernel.
 Windows reads the description of the adapter in place of a port name. The words Ethernet, LAN, and Thunderbolt win over the tunnel class on every platform, so a VPN adapter with a description such as `SSL VPN Virtual Ethernet Adapter` reads as `ethernet`.
 Windows gives `tunnel` to the other VPN adapters. The other links are `unknown`.

docs/runtime-internal-logging.md

@@ -32,7 +32,7 @@ Rotation is by size. A write that crosses the size limit rotates the file first.
 
 Each stream also keeps a memory buffer: 5 MB for the debug stream and 1 MB for the journal. These buffers serve `ctrld log tail` and the fallback path when a file cannot open. The files hold the history.
 
-A restart deletes the memory buffers and keeps the files. The new process appends a header line, which marks the restart point inside each file.
+A restart deletes the memory buffers and keeps the files. The new process appends a header line, which marks the restart point inside each file. When the header would make a file larger than its size limit, ctrld rotates the file first, and the header starts the new file. If the file cannot move, the header goes to the end of the current file. After an open error, ctrld opens the file again and appends the header with no rotation, so that file can pass its limit by one header.
 
 ## Header and rotation events
 
@@ -83,6 +83,8 @@ Two keys in the `[service]` section size the debug stream:
 
 Both keys also apply to the `log_path` file, which rotates the same way. The journal budget is fixed per platform.
 
+A change to the keys takes effect with no restart. This includes the first start, when the keys come from the Control D API, and a managed configuration refresh. When the backup count decreases, ctrld deletes the extra backups of `ctrld.log`. ctrld does not delete backups of the `log_path` file, because that directory can hold files of other programs.
+
 ## Uploads
 
 `ctrld log send` uploads the log to Control D. The body holds these parts, in this order: