refactor(Logging): migrate app events to classified logging

[kyleve]

Posted by an AI agent on kve's behalf.

Summary

• migrate app-level event families and call sites to classified struct events
• cover Where, WhereCore, WhereUI, RegionKit, intents, widgets, the share extension, and Ledger
• update baseline and debug-full reporting for classified fields
• remove the transitional remote-field APIs from feat(Periscope): add classified event authoring #273
• enforce macro authoring with Bumper Bowling rules and mutation tests

Problem

PR #273 adds the classified event foundation but leaves app events on the transitional model. This PR completes the repository-wide migration as one atomic slice.

Architecture

Each old enum case becomes one nested event struct. Stable scope IDs preserve former family names. Stable event IDs preserve approved remote kinds or use deterministic kebab-case names.

Each field has an exposure and semantic kind. Existing approved fields remain shareable. Identifiers, locations, errors, dates, URLs, user content, and internal state remain restricted.

Baseline Bitdrift export uses the stable event name. It emits only shareable classified fields. It excludes rendered messages, restricted values, payloads, dynamic scopes, tags, ambient state, external IDs, and attachments.

Debug-full export keeps complete payloads and contextual metadata. It never exports attachment bytes.

Design decisions

• The migration does not approve any new production fields for baseline export.
• Stable event identity replaces former remote kind fields.
• JSON stays in one canonical, sorted provider field and is not flattened.
• An encoding error skips the complete remote record.
• The reporting actor counts encoding errors and reports them through OSLog.
• The error path does not log through Periscope, so it cannot recurse.

Privacy boundary

Shareable classification is explicit author approval at declaration and emission. It does not prove that a string or JSON value contains no personal data.

Baseline export receives only the generated shareable projection. Debug-full export remains an explicit opt-in mode with its existing warning.

Breaking changes

• App event names combine stable scope and event IDs.
• App payload JSON uses stable field keys instead of enum-associated-value shapes.
• remoteMessage, remoteFields, and all RemoteLogField* types are removed.
• Repository event and scope declarations must use the macros.

Compatibility

There is no in-app migration or decode fallback. Old rows remain available as raw historical records.

Old unmatched span-began rows cannot pair with the new span event name. The development Periscope store must be removed before validation.

Review focus

• the event audit and exact preservation of local messages, severity, external IDs, and attachments
• field keys, exposure, semantic kinds, and the unchanged baseline approval boundary
• baseline and debug-full reporting behavior
• non-recursive handling of JSON and payload encoding errors
• architecture rules that prohibit the legacy and manual authoring models

Testing

• ./swiftformat
• ./test --all — 21 architecture tests, 10 macro tests, and 1,959 iOS tests passed
• ./test --all — no architecture violations and all host regressions passed
• ./test --everything — the unit suite passed and found the intentional Periscope viewer label difference
• ./test --snapshots --review — the reviewed message to message.message reference change passed
• mise exec -- tuist test Ledger-macOS-Tests --no-selective-testing -- -destination 'platform=macOS' — passed

Stack

This PR is 2 of 2 and depends on #273. It contains the app migration, reporting changes, legacy removal, and final enforcement.