milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output

PLAN.md

@@ -76,7 +76,7 @@ Verified: 0.16.0 ships `std.crypto.tls.Client` only. There is no server-side TLS
 
 - **DB is truth. Config file format is ZON** (`std.zon` parse + stringify — typed parsing into config structs, exact round-trip, stdlib-maintained, comments supported). No TOML: a third-party parser plus a hand-written serializer is two failure surfaces in the correctness-critical bootstrap/round-trip path, bought for syntax familiarity.
 - First start: if DB empty and `/etc/nxdns/config.zon` exists, validate → seed DB. Subsequent starts ignore the file.
-- `nxdns export [--out file.zon]` dumps DB state as canonical ZON. `nxdns import <file.zon>` validates + replaces DB contents (`--force` if DB non-empty). Export/import = backup + host migration, **not** upgrades (§3.7).
+- `nxdns export [--out file.zon]` dumps DB state as canonical ZON. `nxdns import <file.zon>` validates + replaces DB contents (`--force` if the DB holds configuration; client rows materialised from traffic do not count, and survive the replacement. First-seen/last-seen are runtime state, not configuration: they follow the address, so an import never restamps a device the DB already knew). Export/import = backup + host migration, **not** upgrades (§3.7).
 - No file watcher, no auto-regeneration.
 
 ### 3.6 Storage Layout (Decision H)
@@ -130,7 +130,7 @@ IPv4 + IPv6 full parity for: client identity, rate limiting, logging, group assi
 
 - `/etc/nxdns/config.zon` — bootstrap (first start only).
 - `/var/lib/nxdns/config.db`, `/var/lib/nxdns/querylog.db`
-- `/var/lib/nxdns/blocklists/*.list|*.wild`
+- `/var/lib/nxdns/blocklists/*.list|*.wild` (plus `*.raw.tmp|*.list.tmp|*.wild.tmp` during a refresh)
 - `/var/log/nxdns/nxdns.log` — only in file output mode; default is stderr → journald.
 
 ### 3.14 Frontend Stack (Decision I)
@@ -521,7 +521,7 @@ Periodic delete of rows older than `retention_days`; scheduled checkpoint/VACUUM
 
 ### 12.2 Validation
 
-At least one upstream; ports in range; cert+key readable if DoH/DoT server enabled; resolver URLs parseable. `nxdns check` runs the validator + probes upstreams.
+At least one upstream; ports in range; resolver URLs parseable. `nxdns check` runs the validator, probes upstreams, and loads the cert+key pair of each enabled DoH/DoT server through the same `CertStore.init` the listeners use.
 
 ### 12.3 Settings Semantics
 
@@ -565,7 +565,7 @@ Requirements: responsive desktop/mobile; route loaders for initial fetch; TanSta
 ## 15. CLI
 
 - `nxdns run` — start the server.
-- `nxdns check` — validate config, probe upstreams, test cert readability; nonzero exit on failure.
+- `nxdns check` — validate config, probe upstreams, load each enabled listener's certificate and verify its key pairs with it; exit 2 on failure, 0 with warnings.
 - `nxdns export [--out file.zon]`
 - `nxdns import <file.zon> [--force]`
 - `nxdns version` — app version, Zig version string, build date, git commit.
@@ -634,8 +634,8 @@ Exit: documented deployment works end-to-end on the Pi 5.
 - Sustained ≥ 100 qps on Raspberry Pi 5.
 - Blocklist lookup p95 < 1 ms.
 - Cached response p95 < 5 ms.
-- Memory with ~1M blocked domains < 100 MB.
-- Stripped static binary < 10 MB per arch (excluding embedded frontend assets; < 15 MB with them).
+- Memory with ~1M blocked domains < 100 MiB.
+- Stripped static binary < 10 MiB per arch (excluding embedded frontend assets; < 15 MiB with them).
 
 ---