okay, so this was self-testable. i have been copying my config and all custom modules to /etc/guix-config every time i reconfigure, partly because i thought it's a nice place to put it, and partly because i thought it might be required.
but if i intentionally try to break a module, or even if i move /etc/guix-config to /etc/guix-config-nonexistent, a system generation that started before continues to start just fine. even my sops secrets files don't need to be present where i expect them to be.
there is probably some magic going on here that i don't yet understand