containers/stalwart/tools/stalwart_set_mode.sh

@@ -70,14 +70,6 @@ appStalwartSetMode() {
             # server that was private has never had one — so create it here
             # rather than failing with "ACME provider not found".
             #
-            # NOT FULLY VERIFIED. The private direction below is exercised end to
-            # end, but this one has only ever been run against a throwaway .test
-            # domain, where Let's Encrypt refuses the contact address before the
-            # provider is created — so the AcmeProvider -> Domain link past that
-            # point is reasoned, not observed. The plan shape is confirmed up to
-            # the LE call (contact is a set, matchOn is the directory URL, an
-            # acmeProviderId is required). Worth one run on a real domain.
-            #
             # Two things about this are worth knowing. Creating the provider
             # REGISTERS AN ACCOUNT with Let's Encrypt there and then, so it is a
             # real outbound action, not a local setting. And the challenge type

scripts/source/files/arrays/function_manifest.sh

@@ -676,19 +676,10 @@ declare -gA LP_FN_MAP=(
     [lpReleaseLatestFootprint]="source/fetch.sh"
     [lpReleaseLatestVersion]="source/fetch.sh"
     [_lpSha256]="source/fetch.sh"
-    [_lpvAppFiles]="validation/validate_config.sh"
-    [_lpvCheckAuthAdapter]="validation/validate_config.sh"
-    [_lpvCheckCompose]="validation/validate_config.sh"
-    [_lpvCheckConfigFile]="validation/validate_config.sh"
-    [_lpvCheckDeployedSecrets]="validation/validate_config.sh"
-    [_lpvCheckPlaceholders]="validation/validate_config.sh"
     [lpVerifyInstall]="source/verify.sh"
     [lpVerifyMinisig]="source/fetch.sh"
     [lpVerifyPubKeyPath]="source/verify.sh"
     [lpVersionGt]="source/fetch.sh"
-    [_lpvFail]="validation/validate_config.sh"
-    [_lpvLoadSources]="validation/validate_config.sh"
-    [_lpvWarn]="validation/validate_config.sh"
     [mainLoop]="task/crontab_task_processor.sh"
     [mainMenu]="menu/menu_main.sh"
     [manifestCollect]="backup/manifest/manifest_collect.sh"
@@ -990,7 +981,6 @@ declare -gA LP_FN_MAP=(
     [tagsProcessorSpeedtestPass]="config/tags/processors/tags_processor_speedtest_pass.sh"
     [tagsProcessorTraefikControl]="config/tags/processors/tags_processor_traefik_control.sh"
     [tagsProcessorTrustedDomains]="config/tags/processors/tags_processor_trusted_domains.sh"
-    [tagsValidateShowValidationStatus]="validation/validate_config.sh"
     [tailscaleInstallToContainer]="headscale/scripts/tailscale_install.sh"
     [_taskDir]="cli/task/cli_task_run.sh"
     [toolArgsGet]="docker/app/functions/function_app_tool.sh"
@@ -1066,8 +1056,6 @@ declare -gA LP_FN_MAP=(
     [updateTaskFields]="task/crontab_task_processor.sh"
     [_upReportComposeFailure]="docker/app/compose/up_app.sh"
     [userExists]="function/checks/user_exists.sh"
-    [validateAllConfigurations]="validation/validate_config.sh"
-    [validateAppConfiguration]="validation/validate_config.sh"
     [validateContainerHealth]="task/crontab_check_processor.sh"
     [validateDirectoryStructure]="task/crontab_check_processor.sh"
     [validateDiskSpace]="task/crontab_check_processor.sh"
@@ -1076,7 +1064,6 @@ declare -gA LP_FN_MAP=(
     [validateLibrePortalInstallation]="task/crontab_check_processor.sh"
     [validateLogHealth]="task/crontab_check_processor.sh"
     [validatePermissions]="task/crontab_check_processor.sh"
-    [validateSystemConfiguration]="validation/validate_config.sh"
     [validateSystemHealth]="task/crontab_check_processor.sh"
     [validateSystemService]="task/crontab_check_processor.sh"
     [validateTaskSystem]="task/crontab_check_processor.sh"
@@ -1820,19 +1807,10 @@ declare -gA LP_FN_ROOT=(
     [lpReleaseLatestFootprint]="scripts"
     [lpReleaseLatestVersion]="scripts"
     [_lpSha256]="scripts"
-    [_lpvAppFiles]="scripts"
-    [_lpvCheckAuthAdapter]="scripts"
-    [_lpvCheckCompose]="scripts"
-    [_lpvCheckConfigFile]="scripts"
-    [_lpvCheckDeployedSecrets]="scripts"
-    [_lpvCheckPlaceholders]="scripts"
     [lpVerifyInstall]="scripts"
     [lpVerifyMinisig]="scripts"
     [lpVerifyPubKeyPath]="scripts"
     [lpVersionGt]="scripts"
-    [_lpvFail]="scripts"
-    [_lpvLoadSources]="scripts"
-    [_lpvWarn]="scripts"
     [mainLoop]="scripts"
     [mainMenu]="scripts"
     [manifestCollect]="scripts"
@@ -2134,7 +2112,6 @@ declare -gA LP_FN_ROOT=(
     [tagsProcessorSpeedtestPass]="scripts"
     [tagsProcessorTraefikControl]="scripts"
     [tagsProcessorTrustedDomains]="scripts"
-    [tagsValidateShowValidationStatus]="scripts"
     [tailscaleInstallToContainer]="containers"
     [_taskDir]="scripts"
     [toolArgsGet]="scripts"
@@ -2210,8 +2187,6 @@ declare -gA LP_FN_ROOT=(
     [updateTaskFields]="scripts"
     [_upReportComposeFailure]="scripts"
     [userExists]="scripts"
-    [validateAllConfigurations]="scripts"
-    [validateAppConfiguration]="scripts"
     [validateContainerHealth]="scripts"
     [validateDirectoryStructure]="scripts"
     [validateDiskSpace]="scripts"
@@ -2220,7 +2195,6 @@ declare -gA LP_FN_ROOT=(
     [validateLibrePortalInstallation]="scripts"
     [validateLogHealth]="scripts"
     [validatePermissions]="scripts"
-    [validateSystemConfiguration]="scripts"
     [validateSystemHealth]="scripts"
     [validateSystemService]="scripts"
     [validateTaskSystem]="scripts"
@@ -2314,7 +2288,6 @@ LP_EAGER_FILES=(
     "scripts:source/artifacts.sh"
     "scripts:task/crontab_check_processor.sh"
     "scripts:task/crontab_task_processor.sh"
-    "scripts:validation/validate_config.sh"
     "scripts:webui/data/generators/apps/webui_config.sh"
     "scripts:webui/data/generators/apps/webui_services.sh"
     "scripts:webui/data/generators/categories/webui_create_app_field_mappings.sh"
@@ -3000,19 +2973,10 @@ lpReleaseChannel() { unset -f lpReleaseChannel; __lpAutoload "${install_scripts_
 lpReleaseLatestFootprint() { unset -f lpReleaseLatestFootprint; __lpAutoload "${install_scripts_dir}source/fetch.sh"; lpReleaseLatestFootprint "$@"; }
 lpReleaseLatestVersion() { unset -f lpReleaseLatestVersion; __lpAutoload "${install_scripts_dir}source/fetch.sh"; lpReleaseLatestVersion "$@"; }
 _lpSha256() { unset -f _lpSha256; __lpAutoload "${install_scripts_dir}source/fetch.sh"; _lpSha256 "$@"; }
-_lpvAppFiles() { unset -f _lpvAppFiles; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvAppFiles "$@"; }
-_lpvCheckAuthAdapter() { unset -f _lpvCheckAuthAdapter; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvCheckAuthAdapter "$@"; }
-_lpvCheckCompose() { unset -f _lpvCheckCompose; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvCheckCompose "$@"; }
-_lpvCheckConfigFile() { unset -f _lpvCheckConfigFile; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvCheckConfigFile "$@"; }
-_lpvCheckDeployedSecrets() { unset -f _lpvCheckDeployedSecrets; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvCheckDeployedSecrets "$@"; }
-_lpvCheckPlaceholders() { unset -f _lpvCheckPlaceholders; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvCheckPlaceholders "$@"; }
 lpVerifyInstall() { unset -f lpVerifyInstall; __lpAutoload "${install_scripts_dir}source/verify.sh"; lpVerifyInstall "$@"; }
 lpVerifyMinisig() { unset -f lpVerifyMinisig; __lpAutoload "${install_scripts_dir}source/fetch.sh"; lpVerifyMinisig "$@"; }
 lpVerifyPubKeyPath() { unset -f lpVerifyPubKeyPath; __lpAutoload "${install_scripts_dir}source/verify.sh"; lpVerifyPubKeyPath "$@"; }
 lpVersionGt() { unset -f lpVersionGt; __lpAutoload "${install_scripts_dir}source/fetch.sh"; lpVersionGt "$@"; }
-_lpvFail() { unset -f _lpvFail; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvFail "$@"; }
-_lpvLoadSources() { unset -f _lpvLoadSources; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvLoadSources "$@"; }
-_lpvWarn() { unset -f _lpvWarn; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; _lpvWarn "$@"; }
 mainLoop() { unset -f mainLoop; __lpAutoload "${install_scripts_dir}task/crontab_task_processor.sh"; mainLoop "$@"; }
 mainMenu() { unset -f mainMenu; __lpAutoload "${install_scripts_dir}menu/menu_main.sh"; mainMenu "$@"; }
 manifestCollect() { unset -f manifestCollect; __lpAutoload "${install_scripts_dir}backup/manifest/manifest_collect.sh"; manifestCollect "$@"; }
@@ -3314,7 +3278,6 @@ tagsProcessorSocketConfiguration() { unset -f tagsProcessorSocketConfiguration;
 tagsProcessorSpeedtestPass() { unset -f tagsProcessorSpeedtestPass; __lpAutoload "${install_scripts_dir}config/tags/processors/tags_processor_speedtest_pass.sh"; tagsProcessorSpeedtestPass "$@"; }
 tagsProcessorTraefikControl() { unset -f tagsProcessorTraefikControl; __lpAutoload "${install_scripts_dir}config/tags/processors/tags_processor_traefik_control.sh"; tagsProcessorTraefikControl "$@"; }
 tagsProcessorTrustedDomains() { unset -f tagsProcessorTrustedDomains; __lpAutoload "${install_scripts_dir}config/tags/processors/tags_processor_trusted_domains.sh"; tagsProcessorTrustedDomains "$@"; }
-tagsValidateShowValidationStatus() { unset -f tagsValidateShowValidationStatus; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; tagsValidateShowValidationStatus "$@"; }
 tailscaleInstallToContainer() { unset -f tailscaleInstallToContainer; __lpAutoload "${install_containers_dir}headscale/scripts/tailscale_install.sh"; tailscaleInstallToContainer "$@"; }
 _taskDir() { unset -f _taskDir; __lpAutoload "${install_scripts_dir}cli/task/cli_task_run.sh"; _taskDir "$@"; }
 toolArgsGet() { unset -f toolArgsGet; __lpAutoload "${install_scripts_dir}docker/app/functions/function_app_tool.sh"; toolArgsGet "$@"; }
@@ -3390,8 +3353,6 @@ updaterVersionLadder() { unset -f updaterVersionLadder; __lpAutoload "${install_
 updateTaskFields() { unset -f updateTaskFields; __lpAutoload "${install_scripts_dir}task/crontab_task_processor.sh"; updateTaskFields "$@"; }
 _upReportComposeFailure() { unset -f _upReportComposeFailure; __lpAutoload "${install_scripts_dir}docker/app/compose/up_app.sh"; _upReportComposeFailure "$@"; }
 userExists() { unset -f userExists; __lpAutoload "${install_scripts_dir}function/checks/user_exists.sh"; userExists "$@"; }
-validateAllConfigurations() { unset -f validateAllConfigurations; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; validateAllConfigurations "$@"; }
-validateAppConfiguration() { unset -f validateAppConfiguration; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; validateAppConfiguration "$@"; }
 validateContainerHealth() { unset -f validateContainerHealth; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateContainerHealth "$@"; }
 validateDirectoryStructure() { unset -f validateDirectoryStructure; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateDirectoryStructure "$@"; }
 validateDiskSpace() { unset -f validateDiskSpace; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateDiskSpace "$@"; }
@@ -3400,7 +3361,6 @@ validateFileSystem() { unset -f validateFileSystem; __lpAutoload "${install_scri
 validateLibrePortalInstallation() { unset -f validateLibrePortalInstallation; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateLibrePortalInstallation "$@"; }
 validateLogHealth() { unset -f validateLogHealth; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateLogHealth "$@"; }
 validatePermissions() { unset -f validatePermissions; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validatePermissions "$@"; }
-validateSystemConfiguration() { unset -f validateSystemConfiguration; __lpAutoload "${install_scripts_dir}validation/validate_config.sh"; validateSystemConfiguration "$@"; }
 validateSystemHealth() { unset -f validateSystemHealth; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateSystemHealth "$@"; }
 validateSystemService() { unset -f validateSystemService; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateSystemService "$@"; }
 validateTaskSystem() { unset -f validateTaskSystem; __lpAutoload "${install_scripts_dir}task/crontab_check_processor.sh"; validateTaskSystem "$@"; }

scripts/validation/validate_config.sh

@@ -1,283 +0,0 @@
-#!/bin/bash
-
-# Configuration validation.
-# ---------------------------------------------------------------------------
-# Every check here exists because the bug it catches shipped at least once, and
-# none of them announced themselves at runtime — a wrong config key does not
-# crash anything, it just quietly stops working:
-#
-#   * two keys sharing one RANDOMIZED<n> placeholder produced the SAME secret
-#     for Gitea's metrics token and its admin password
-#   * an auth adapter writing CFG_<APP>_ADMIN_PASSWORD while the config declared
-#     ADMIN_PASSWORD_1 made every password reset a silent no-op
-#   * a compose annotation whose value did not match the line body meant the tag
-#     never substituted, and Mastodon shipped its placeholder as a live password
-#
-# So the rule is: fail loudly here, in a command someone can run, rather than
-# discover it months later.
-#
-# Checks run against the deployed install where it exists and fall back to the
-# install templates, because both can be wrong in different ways: a template
-# carries placeholders, a deployed file carries the substituted values.
-
-# Collected during a run.
-_lpv_issues=0
-_lpv_checked=0
-
-_lpvFail()  { isError "  $*";  ((_lpv_issues++)); }
-_lpvWarn()  { isNotice "  $*"; }
-
-# Resolve an app's config / compose, preferring the deployed copy.
-_lpvAppFiles()
-{
-    local app="$1"
-    _lpv_cfg_live="${containers_dir}${app}/${app}.config"
-    _lpv_cfg_tmpl="${install_containers_dir}${app}/${app}.config"
-    _lpv_comp_live="${containers_dir}${app}/docker-compose.yml"
-    _lpv_comp_tmpl="${install_containers_dir}${app}/docker-compose.yml"
-    [[ -f "$_lpv_cfg_live"  ]] || _lpv_cfg_live=""
-    [[ -f "$_lpv_cfg_tmpl"  ]] || _lpv_cfg_tmpl=""
-    [[ -f "$_lpv_comp_live" ]] || _lpv_comp_live=""
-    [[ -f "$_lpv_comp_tmpl" ]] || _lpv_comp_tmpl=""
-}
-
-# --- config file: syntax, duplicates, prefix -------------------------------
-_lpvCheckConfigFile()
-{
-    local app="$1" file="$2" label="$3"
-    [[ -n "$file" ]] || return 0
-    local up="${app^^}"; up="${up//-/_}"
-
-    bash -n "$file" 2>/dev/null || _lpvFail "$app: $label does not parse as shell."
-
-    local dup
-    dup=$(grep -oE '^CFG_[A-Z0-9_]+=' "$file" | sort | uniq -d | tr -d '=')
-    [[ -n "$dup" ]] && while IFS= read -r k; do
-        _lpvFail "$app: $k is defined more than once in $label."
-    done <<< "$dup"
-
-    local wrong
-    wrong=$(grep -oE '^CFG_[A-Z0-9_]+=' "$file" | tr -d '=' | grep -v "^CFG_${up}_" || true)
-    [[ -n "$wrong" ]] && while IFS= read -r k; do
-        [[ -n "$k" ]] && _lpvFail "$app: $k in $label does not use this app's CFG_${up}_ prefix."
-    done <<< "$wrong"
-}
-
-# --- template config: placeholder hygiene ----------------------------------
-# A generated value must carry a slot number, and no two keys may share one
-# placeholder — the replacer mints one value per DISTINCT placeholder and
-# substitutes every occurrence, so sharing means sharing the secret.
-_lpvCheckPlaceholders()
-{
-    local app="$1" file="$2"
-    [[ -n "$file" ]] || return 0
-
-    local k
-    while IFS= read -r k; do
-        [[ -n "$k" ]] || continue
-        [[ "$k" =~ _[0-9]+$ ]] || \
-            _lpvFail "$app: $k holds a generated value but has no slot number (expected ${k}_1)."
-    done < <(grep -oE '^CFG_[A-Z0-9_]+=RANDOMIZED' "$file" | sed 's/=RANDOMIZED//')
-
-    local ph
-    while IFS= read -r ph; do
-        [[ -n "$ph" ]] || continue
-        local keys
-        keys=$(grep -E "^CFG_[A-Z0-9_]+=${ph}$" "$file" | cut -d= -f1 | tr '\n' ' ')
-        _lpvFail "$app: $ph is shared by ${keys}— they would all receive the same secret."
-    done < <(grep -oE '=RANDOMIZED[A-Z]*[0-9]+$' "$file" | tr -d '=' | sort | uniq -d)
-}
-
-# --- deployed config: nothing left unfilled, no accidental twins ------------
-_lpvCheckDeployedSecrets()
-{
-    local app="$1" file="$2"
-    [[ -n "$file" ]] || return 0
-
-    local k
-    while IFS= read -r k; do
-        [[ -n "$k" ]] && _lpvFail "$app: $k still holds its RANDOMIZED placeholder — generation never ran."
-    done < <(grep -oE '^CFG_[A-Z0-9_]+="?RANDOMIZED' "$file" | sed 's/="\?RANDOMIZED//')
-
-    # Two different keys holding one value is what a shared placeholder looks
-    # like after substitution. Short values are skipped: "true", "admin" and
-    # friends repeat legitimately.
-    local v
-    while IFS= read -r v; do
-        [[ ${#v} -ge 12 ]] || continue
-        local keys
-        keys=$(grep -F "=$v" "$file" | cut -d= -f1 | tr '\n' ' ')
-        _lpvFail "$app: these keys share one value: ${keys}— a secret should never be reused."
-    done < <(grep -oE '^CFG_[A-Z0-9_]+="[^"]{12,}"$' "$file" \
-             | sed 's/^[^=]*=//' | tr -d '"' | sort | uniq -d)
-}
-
-# --- compose: annotations substitutable, tags backed -----------------------
-_lpvCheckCompose()
-{
-    local app="$1" file="$2" label="$3" cfg="$4"
-    [[ -n "$file" ]] || return 0
-    local up="${app^^}"; up="${up//-/_}"
-
-    # The annotation value is the literal the tag manager searches for on that
-    # line. If it does not appear in the line body, nothing can ever substitute.
-    # index() rather than split(): awk reads split's separator as a regex, and
-    # "#LIBREPORTAL|" ends in an alternation operator with nothing after it.
-    local bad
-    bad=$(awk '
-        {
-            marker = "#LIBREPORTAL|"
-            first = index($0, marker)
-            if (first == 0) next
-            body = substr($0, 1, first - 1)
-            rest = $0
-            while ((p = index(rest, marker)) > 0) {
-                rest = substr(rest, p + length(marker))
-                q = index(rest, "|")
-                if (q == 0) break
-                tag = substr(rest, 1, q - 1)
-                val = substr(rest, q + 1)
-                sub(/[ \t\r].*$/, "", val)
-                h = index(val, "#")
-                if (h > 0) val = substr(val, 1, h - 1)
-                if (val != "" && index(body, val) == 0)
-                    printf "line %d: %s (value %s)\n", NR, tag, val
-            }
-        }' "$file")
-    [[ -n "$bad" ]] && while IFS= read -r l; do
-        _lpvFail "$app: $label $l never substitutes — the value is not in the line body."
-    done <<< "$bad"
-
-    # Every app-prefixed tag needs a filler: a CFG key of the same name, or a
-    # script that writes the tag directly (version bumps, per-app hooks).
-    # *_VERSION_TAG is exempt: the updater builds both the CFG name and the tag
-    # name from the app slug at runtime (CFG_${up}_VERSION), so neither the key
-    # nor the literal tag appears anywhere to be found.
-    local tag key
-    while IFS= read -r tag; do
-        [[ -n "$tag" ]] || continue
-        [[ "$tag" == *_VERSION_TAG ]] && continue
-        key="CFG_${tag%_TAG}"
-        [[ -n "$cfg" ]] && grep -q "^${key}=" "$cfg" 2>/dev/null && continue
-        grep -q "$tag" <<< "$_lpv_src" && continue
-        _lpvFail "$app: $label tag $tag has no ${key} and no script that fills it."
-    done < <(grep -oE "#LIBREPORTAL\|${up}_[A-Z0-9_]+_TAG\|" "$file" | tr -d '#|' | sed 's/LIBREPORTAL//' | sort -u)
-}
-
-# --- auth adapters: the key they write must exist --------------------------
-# authPersistCfg resolves a bare name to its numbered slot, but if neither form
-# is declared the write is a silent no-op and the WebUI keeps showing a password
-# that no longer works.
-_lpvCheckAuthAdapter()
-{
-    local app="$1" cfg="$2"
-    local adapter="${install_containers_dir}${app}/scripts/${app}_auth.sh"
-    [[ -f "$adapter" && -n "$cfg" ]] || return 0
-    local up="${up_override:-${app^^}}"; up="${up//-/_}"
-
-    local key
-    while IFS= read -r key; do
-        [[ -n "$key" ]] || continue
-        grep -qE "^CFG_${up}_${key}=" "$cfg" && continue
-        grep -qE "^CFG_${up}_${key}_[0-9]+=" "$cfg" && continue
-        _lpvFail "$app: its auth adapter persists ${key}, but neither CFG_${up}_${key} nor a numbered slot is declared."
-    done < <(grep -oE "authPersistCfg ${app} [A-Z_]+" "$adapter" | awk '{print $3}' | sort -u)
-}
-
-# validateAppConfiguration <app> — every check for one app.
-validateAppConfiguration()
-{
-    local app="$1"
-    [[ -n "$app" ]] || { isError "No app name given."; return 1; }
-    _lpvAppFiles "$app"
-    if [[ -z "$_lpv_cfg_live" && -z "$_lpv_cfg_tmpl" ]]; then
-        isError "No config found for '$app'."
-        return 1
-    fi
-    ((_lpv_checked++))
-
-    _lpvCheckConfigFile     "$app" "${_lpv_cfg_live:-$_lpv_cfg_tmpl}" "$( [[ -n "$_lpv_cfg_live" ]] && echo "deployed config" || echo "config template" )"
-    _lpvCheckPlaceholders   "$app" "$_lpv_cfg_tmpl"
-    _lpvCheckDeployedSecrets "$app" "$_lpv_cfg_live"
-    _lpvCheckCompose        "$app" "${_lpv_comp_live:-$_lpv_comp_tmpl}" \
-                            "$( [[ -n "$_lpv_comp_live" ]] && echo "deployed compose" || echo "compose template" )" \
-                            "${_lpv_cfg_live:-$_lpv_cfg_tmpl}"
-    _lpvCheckAuthAdapter    "$app" "${_lpv_cfg_live:-$_lpv_cfg_tmpl}"
-    return 0
-}
-
-# Load every .sh once so the "is this tag filled by a script?" test is a string
-# search rather than a find+grep per tag.
-_lpvLoadSources()
-{
-    [[ -n "$_lpv_src" ]] && return 0
-    _lpv_src=$(cat \
-        $(find "${install_scripts_dir%/}" "${install_containers_dir%/}" \
-             -name '*.sh' ! -name 'function_manifest.sh' -type f 2>/dev/null) 2>/dev/null)
-}
-
-# validateSystemConfiguration — the shared config tree, not any one app.
-validateSystemConfiguration()
-{
-    isHeader "Validating system configuration"
-    local before=$_lpv_issues
-    local f
-    while IFS= read -r f; do
-        [[ -f "$f" ]] || continue
-        bash -n "$f" 2>/dev/null || _lpvFail "$(basename "$f") does not parse as shell."
-        local dup
-        dup=$(grep -oE '^CFG_[A-Z0-9_]+=' "$f" | sort | uniq -d | tr -d '=')
-        [[ -n "$dup" ]] && while IFS= read -r k; do
-            [[ -n "$k" ]] && _lpvFail "$k is defined more than once in $(basename "$f")."
-        done <<< "$dup"
-    done < <(find "${configs_dir%/}" -maxdepth 2 -type f ! -name '*.category' ! -name '.*' ! -name '*.bak' 2>/dev/null)
-
-    if [[ $_lpv_issues -eq $before ]]; then
-        isSuccessful "System configuration is consistent."
-    fi
-    return 0
-}
-
-# validateAllConfigurations — every app plus the system tree.
-validateAllConfigurations()
-{
-    _lpv_issues=0; _lpv_checked=0
-    _lpvLoadSources
-
-    isHeader "Validating application configuration"
-    local d app
-    for d in "${install_containers_dir%/}"/*/; do
-        app="$(basename "$d")"
-        [[ -f "$d$app.config" ]] || continue
-        validateAppConfiguration "$app"
-    done
-
-    validateSystemConfiguration
-
-    echo ""
-    if [[ $_lpv_issues -eq 0 ]]; then
-        isSuccessful "$_lpv_checked apps validated — no configuration problems found."
-        return 0
-    fi
-    isError "$_lpv_issues configuration problem(s) across $_lpv_checked apps."
-    isNotice "These do not surface at runtime: a mis-declared key silently stops working."
-    return 1
-}
-
-# tagsValidateShowValidationStatus — the summary `libreportal validation status`
-# prints. Same checks, counts only.
-tagsValidateShowValidationStatus()
-{
-    validateAllConfigurations >/dev/null 2>&1
-    local rc=$?
-    isHeader "Configuration validation status"
-    echo "  Apps checked : $_lpv_checked"
-    echo "  Problems     : $_lpv_issues"
-    echo ""
-    if [[ $_lpv_issues -eq 0 ]]; then
-        isSuccessful "No configuration problems found."
-    else
-        isNotice "Run 'libreportal validation all' for the detail."
-    fi
-    return $rc
-}