Replace all non-logger console.error/warn calls with process.stderr.write using tagged prefixes ([AuditLogger], [CSRF], [DNS Registry], etc.) for grep-ability. All in fallback/catch paths where structured logger may be unavailable. Test updated to use jest.spyOn with try/finally for clean mock restoration. Codex grade: pass (22,402 tokens). All 1539 tests pass.