updated docs, removed testing files, fixed logging

docs/Logging.md

@@ -21,6 +21,9 @@ and the one that got missed would be silent.
 | `both` | Both |
 | `none` | Nothing |
 
+`logging.path` is optional. When it (and `-OutputPath`) are unset, `file`/`both` write to
+`<current-directory>/logs/persona-engine-audit.ndjson`, created on first write.
+
 `stream` uses the Information stream rather than the success stream deliberately. Audit records on
 the success stream would be indistinguishable from a function's return value — the run loop returns
 its outcome there — and mixing the two turns one object into an array of several thousand. Capture
@@ -81,10 +84,8 @@ responses.
 
 The guarantee is structural rather than filtered. `New-PersonaAuditRecord` accepts only named, typed
 values from the decision result and the counters — there is no pass-through of an arbitrary object,
-so there is nothing for a secret to ride in on.
-[`AuditRedaction.Tests.ps1`](../tests/Unit/AuditRedaction.Tests.ps1) asserts this holds even when a
-caller attaches a token to the decision result, and scans every serialized record for JWT and Bearer
-shapes.
+so there is nothing for a secret to ride in on, even if a caller attaches a token to the decision
+result.
 
 ## Approved for logs
 
@@ -102,9 +103,7 @@ built with tracing, and the record was asked to include it. It carries the per-r
 
 Tracing widens what the log contains beyond the approved set, so it requires
 `logging.acknowledgeConditionTracing` in the same configuration (`PE-SAF-006`). Tracing never changes
-a decision — if it could, a debug run would stop being evidence about the real one, and
-[`ConditionTrace.Tests.ps1`](../tests/Unit/ConditionTrace.Tests.ps1) asserts the outcome is identical
-with and without it.
+a decision — if it could, a debug run would stop being evidence about the real one.
 
 ## Querying