Logs — what's recorded and where it's saved

SubnetSlinger keeps three separate records, all on THIS machine (nothing is sent anywhere):

1. Activity log (the audit trail) — every action: time · user · context · tool · action · result. The Activity tool shows the newest 500 in-app; the FULL history is appended forever to a tab-separated file. Set a Project (or a Context) and it stamps every line, so the log maps to a ticket. Export to CSV from the Activity tool.

File: %APPDATA%\SubnetSlinger\activity.log

2. Incidents (the work log) — the narrative you build by hand or that Runbooks / Drift / the Posse write for you: timestamped notes, severity, resolve state, Markdown export. This is the story for a handoff or ticket.

File: %APPDATA%\SubnetSlinger\incidents.json

3. MCP server audit — when an external tool (Claude Desktop, Cursor) drives SubnetSlinger's MCP server, every tool call is logged GAIT-style so stdout stays clean for the protocol.

File: %APPDATA%\SubnetSlinger\mcp.log

Find them fast: the Files tool browses and previews everything under %APPDATA%\SubnetSlinger and Documents\SubnetSlinger. Retention: the in-app Activity view caps at 500 rows, but activity.log on disk is uncapped (append-only) — archive or clear it yourself if it grows large. The Deputy and Posse also log each tool call to the Activity trail.