Props

One setting, resolved across three sources and then parsed: -D beats the environment beats ConfigFile — explicit for this launch, then ambient, then persisted. At every source a value that trims to empty counts as unset and falls through, so a blank env var (what an unrendered compose template leaves behind) cannot shadow the file.

Range checks stay at the call site, the only place that knows what a number means — same split as netty's SystemPropertyUtil, which this is shaped after.

Root package, so the masking loader delegates it to the game loader and both sides read one copy.