CLI.Validate interleaved flag-combination checks with in-memory default preparation, so the checks could not run on their own and each reported only its first error. Split into CheckConfig (pure, error-collecting, the single home for 'this flag combination will take the node down' checks) and PrepareConfig (defaults and process-local setup). Validate runs both, unchanged from a starting node's perspective. New: signing-key path is now checked at startup (unreadable or non-PEM --signing-key previously only exploded mid-boot in the app-updates path). New: 'streamplace validate-config' runs exactly what a starting node runs (cli.Validate) and exits without opening listeners, databases, or media pipelines, for deploy tooling to call before a restart. The gstreamer self-test is skipped for it so it works even when the media stack is broken — that is when you are diagnosing a crashloop.