Event ledger and telemetry

HardKAS separates two operational streams with different retention semantics:

Event ledger (events.jsonl)

Append-only operational evidence. Never rotated. Each event carries eventId, causationId, domain, and kind. Protected by AppendCoordinator with exclusive locks and fsync.

Telemetry (telemetry.jsonl)

Rotatable observability stream. 8 anomaly types: LOCK_CONTENTION, STALE_LOCK_RECOVERY, FS_RETRY, NORMALIZATION_COLLISION, EXTERNAL_MUTATION, PATH_TRAVERSAL_ATTEMPT, ORPHAN_PROJECTION_RECOVERY. Scoped via AsyncLocalStorage.

note

AppendCoordinator. JSONL persistence uses exclusive file locks (openSync("wx")), spin-wait acquisition, automatic tail repair for corrupted JSON, and fsync after every write.