- server config check: load + validate + masked summary; exit 1 on issues - no side effects: creates no DB, starts nothing, writes no business dirs - Config.Check() (production secrets, port range, data dir) exported for reuse; MaskedSummary never prints credential values - default no-arg invocation unchanged (serve); help added - smoke-verified: pass exit 0, invalid port exit 1 with issue line - layer-source attribution (config explain) deferred to U10b ConfigSnapshot