Validate configuration source keys and overrides

docs/config.md

@@ -53,7 +53,11 @@ All omitted fields use their built-in defaults.
 | `format` | `json` | Required and must be `json`. |
 
 Timezone values may be IANA names, configured aliases such as `Chicago` and
-`Stl`, US timezone abbreviations, or UTC offsets such as `-5` and `+09:30`.
+`Stl`, US timezone abbreviations, or signed UTC offsets such as `-5`, `+0930`,
+and `+09:30`. Numeric offsets require a sign, one or two hour digits, and an
+optional two-digit minute component with or without a colon. Hours must be
+from `00` through `23`, minutes from `00` through `59`, so the largest accepted
+offset magnitude is `23:59`.
 
 ### `location`
 
@@ -161,9 +165,10 @@ output selection, and failure handling.
 
 `missing_source.default` defaults to `warn` and accepts `error`, `warn`, or
 `none`. `missing_source.sources` optionally overrides that policy by source.
-Hourly forecast data is required for generated reports. Supported optional
-source keys are `observations`, `current`, `narrative`, `alerts`, `discussion`,
-`weather_story`, and `spc_convective_outlooks`.
+Hourly forecast data is required for generated reports and cannot have a
+source-specific policy. Supported optional source keys are `observations`,
+`current`, `narrative`, `alerts`, `discussion`, `weather_story`, and
+`spc_convective_outlooks`; any other key is rejected.
 
 ### `promptkit`
 
@@ -218,8 +223,9 @@ derivation. Every item needs `name`, `start`, and `end`; start and end use
 `reports` optionally overrides a report's ordered deterministic modules and
 Distributor path templates. Omit a report entry to retain its defaults.
 
-Supported report keys are `daily`, `today`, `tomorrow`, and `hourly`; hyphens
-and underscores are equivalent.
+Supported report keys are `daily`, `today`, `tomorrow`, and `hourly`. Keys are
+trimmed, case-folded to lowercase, and normalize hyphens to underscores before
+lookup.
 
 Each report entry can contain: