Module config_ledger 

ADR-094 process-lifetime config lock ledger.

Several OnceLock-backed config readers across packs (recall profiling, ANN overfetch rounds, context profiling, …) resolve an environment variable exactly once per process and hold it for the process lifetime. That first resolution is itself an auditable lifecycle event (“this process locked config key K to value V”), but the OnceLock::get_or_init closures that produce it run synchronously, off any async/event-store context, and long before a VerbRegistry exists.

This module bridges the two: record_config_locked is a plain sync function any OnceLock closure can call to enqueue a (key, value) pair into a process-wide queue. The registry’s dispatch path drains the queue (take_config_locked) at the same gate where it already appends audit events, so ConfigLocked rows carry the namespace/actor of whichever dispatch happens to observe the queue non-empty first (ADR-094’s accepted provenance quirk) rather than needing every OnceLock site to carry its own EventStore handle.

Functions

record_config_locked

Enqueue a config key/value pair for later ConfigLocked event emission.