This issue erodes confidence in the config log audit accuracy. If a config item is forced at some point then this isn't reflected in the config log and likewise if it is unforced later. Ideally there would be some level of audit showing the full history of any item. Some items such as api keys and password fields can be forced and are not visible in the gui so these should not have their value shown. It might be easier to not show the value of any forced config item but still show the fact that it was forced on or off at certain points in time.

For this to work we'd need to store in the DB a summary of the last set of forced config items, compare this at bootstrap, and if they differ then log the changes and store the new version config set. This should be able to be done in a very lightweight and performant way by comparing some sort of summary hash and storing that in config / MUC.