- LoadWithSources: reflection snapshots at layer boundaries (default -> env-file per file -> process-env incl. DSN/CORS/KB normalization); diff yields exact per-field source - no manual key registry, no drift - Load unchanged signature/behavior (wrapper); ApplyCLIOverlay records the cli layer on a cloned config - 'config explain' upgraded to field table (59 fields; source + set flag only, values never printed per KTD17) - replaces the reporting-only key registry from PR #12 - tests: layer attribution (file/process override), cli overlay, Load regression
- config.Explain(envFiles, cliOverrides): per-key source layer following the application precedence cli > process-env > env-file > default; registry is reporting-only (values still applied solely by Load); secrets never shown - ParseEnvFileKeys shares applyEnvFile's parsing rules - cmd/server 'config explain' resolves the same env-file stack as Load and renders the attribution table; smoke: HTTP_PORT/AGENT_BACKEND -> cli - tests: registry liveness sample + layer attribution (file/process/cli/ default) + secret masking - full per-field snapshot with applied/desired revisions remains U10b core