docs(audit): tick CC8 (logging) + add "finish the audit" session note

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CODE-AUDIT.md

@@ -63,6 +63,16 @@ no longer starts a stray timer). All verified: typecheck (node+web) + 253 tests
 green; the touched files are prettier-clean (the 8 remaining prettier warnings are all pre-existing,
 untouched files — DownloadOptionsForm/SettingsView/settings/*Card).
 
+**Session 2026-07-01 pass 2 (the "finish the audit" batch — phase-by-phase PRs):** landed **Phase 1**
+(doc/stale-checkbox reconciliation — L82, L89, plus ticks for wire-or-remove M5/M6/UX1, MAX_ENQUEUE_BATCH,
+and the UX/ref duplicates whose roots already shipped), **Phase 2** (build hygiene — L83 `.blockmap` off via
+`nsis.differentialPackage:false`, L84 `dist/` clean step), and **Phase 3 start: CC8** (in-house file-backed
+leveled logger [logger.ts](src/main/logger.ts) + renderer `log:write` sink). Each phase is its own
+branch/PR stacked on `refactor/h1-decompose-god-files`. All green: typecheck + 258 tests + eslint + prettier.
+Remaining Phase 3 (execFileAsync/streamToFile/reliability/M4-persist) and Phases 4–8 (renderer
+tokens+primitives, logic/perf, UX/Windows, copy/a11y) continue; per the run's policy, subjective-visual and
+live-verify-only items are implemented but left **unchecked** with a flagged list for a watched pass.
+
 **Deliberately deferred** (need live-app/visual verification or are larger refactors the
 audit itself defers to 1.x): the wire-or-cut features (M5/M6/UX1), the god-file/store
 refactors (C1, C2, H1), the SIMP* helpers + shared-UI-token work, the CC* consolidations,
@@ -1293,9 +1303,16 @@ split — but that style is unenforced and several "do the same thing two ways"
   progress is callback-injected; the `WebContents` sender is a param in some handlers and a closure in
   others. **Standard:** keep pure-core param injection; in the shell, pass `wc`/`onProgress` consistently
   as the leading argument and keep singleton access for config/binaries.
-- [ ] **CC8 — No logging strategy.** Effectively no diagnostics — a single stray `console.error` in
+- [x] **CC8 — No logging strategy.** Effectively no diagnostics — a single stray `console.error` in
   preload, and ~29 swallowed catches (M29); `errorlog.ts` is domain data, not logging. **Standard:** one
   small leveled logger (e.g. `electron-log`) written to userData, called at every catch; keep `errorlog.ts` for user-facing download failures only.
+  *Fixed: a small in-house leveled logger [logger.ts](src/main/logger.ts) (no new dependency — the
+  `electron-log` suggestion was an example) appends to `<userData>/logs/aerofetch.log` with size-capped
+  rotation; all `app`/fs access is lazy+guarded so it's a safe no-op under unit tests. The main-process
+  catch sites route through it, and a fire-and-forget `log:write` IPC + preload `logError()` forward the
+  renderer's `logError` (M29) failures to the same file sink — closing the "sink" half M29/R6 deferred here.
+  `errorlog.ts` stays as user-facing download-failure data. The user-facing **toast** half ties to the
+  global status surface (UI25/UX9) and lands there.*
 - [ ] **CC9 — Four validation styles.** Type-guard predicates (`isValid*` in validation.ts),
   coerce-with-fallback (`sanitizeOptions`, `templates.sanitize`), an imperative per-key `switch`
   (`setSettings`, M24), and `throw` (`assertHttpUrl`). **Standard:** one schema layer (e.g. `zod`) that