Function invalid_settings 

pub fn invalid_settings(settings: &Settings) -> Vec<(&'static str, String)>

Every stored setting that its own setter would refuse, with the reason.

devp config set guards the ranges, but nothing guards a hand-edited registry.json — and the values that get in that way are the quiet ones: scan_depth: 0 finds no projects, command_timeout_secs: 0 kills every lockfile command the instant it starts. Both leave a tool that runs, reports success and prunes nothing.

Round-tripping each value through the setter that owns it is deliberate. A separate list of ranges would be a second copy of the rules, free to drift from the ones actually enforced.