[gildesmarais]

What changed

• SecurityLogger emits { event_name, details } only; removes security_event dual-write, reset_logger!, and unused log_blocked_request.
• AppLogger drops dead logfmt parsing; gem structured payload uses symbol-keyed event_name only.
• Auth / FeedToken::Signer: inline with_validated_token, fold single-caller hulls, delete unused Signer.validate.
• ErrorClassifier: remove SPECIAL_DECISIONS, defined?/respond_to? gem shims; classify the cause chain directly; specs use real Html2rss error classes.
• Feeds::Service / Responder: call Contracts::RenderResult.new directly; unify failure-details construction.
• Boot::Setup: inline 1-line private pass-throughs; CONTEXT.md + specs updated.

Why

Single event_name contract across the stack; delete dual-write and pre-0.32.2 compatibility hulls that hide contract drift.

Risk

• low — behavior-preserving cleanup; audit log key changes from security_event to event_name (pair with self-hosted collector PR; re-check OpenObserve after deploy).
• ErrorClassifier still maps the same gem errors to the same HTTP/cache decisions; specs now pin the real classes.

Review map

1. spec/html2rss/web/error_classifier_spec.rb — real gem error mapping
2. app/web/errors/error_classifier.rb — chain classification without shims
3. app/web/security/security_logger.rb — event_name-only emit
4. app/web/telemetry/app_logger.rb — logfmt removal

Validation

• make ready in Dev Container (html2rss-web_devcontainer-app-1) — exit 0 (re-run before push)