[ConfigManager] Register Node Sections 3/4

[bdchatham]

Declares the last five tables: state sync, the transaction index, instrumentation, the
signing key paths, and self remediation. 33 keys. Nothing consumes them.

After this every table in the file is declared; the keys at its top are the remaining step.

One key varies by node kind

tx-index.indexer is [kv] for a node that serves queries and [null] for a validator or
seed, which serve none and keep the write. The other four sections answer the same for every
mode, and each says why in the source.

What is left out

statesync.rpc-servers names the operator's own peers, so there is no value to inherit and
an address written here would name a host this binary cannot know exists.
statesync.trust-height and trust-hash are computed from the chain tip each time a node
starts. The signing key section carries the root directory field the node fills from the
command line, and it is the one where a blank root is worst: a node that cannot find its key
does not sign.

Two tests worth naming

One walks the section names this package owns rather than a list kept beside them, so the
next section is covered by registering it.

The other asserts the registry refused nothing. That is the check no single section can make:
two of the refusals depend on what else has registered, and a section that loses one is
dropped whole with every key it declared.

gofmt, goimports, go vet, golangci-lint clean; config/... and cmd/seid/... pass.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Aug 25, 2026, 9:23 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.59%. Comparing base (a7de35a) to head (579b53d).

Additional details and impacted files

@@                   Coverage Diff                    @@
##           plt-775-node-sections-2    #3994   +/-   ##
========================================================
  Coverage                    57.59%   57.59%           
========================================================
  Files                         2230     2230           
  Lines                       186966   186980   +14     
========================================================
+ Hits                        107683   107696   +13     
- Misses                       69447    69448    +1     
  Partials                      9836     9836           

Flag	Coverage Δ
sei-chain-pr	100.00% <100.00%> (ø)
sei-db	69.80% <ø> (-0.22%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
config/tendermintbase/tendermintbase.go	100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

PR Summary

Low Risk
Declarative registry and test-only changes with no described runtime consumer yet; mis-declared keys would affect generated config later but not current node behavior.

Overview
Completes ConfigManager section registration for the last five Tendermint tables: state sync, tx-index, instrumentation, priv-validator, and self-remediation, each wired to mode defaults via forMode like the existing P2P/RPC/consensus/mempool sections.

statesync.rpc-servers stays undeclared (operator-specific peers); priv-validator.home stays excluded like other command-line-filled roots. tx-index.indexer is the only new mode-varying key: [kv] on full/archive nodes and [null] on validators/seeds.

Tests now derive the section list from declaredSections() instead of hardcoding P2P/RPC prefixes, record tx-index.indexer in the mode-variation table, extend key/struct parity checks to all nine sections, and add coverage for the state-sync exclusion and registry-wide registration defects.

^{Reviewed by Cursor Bugbot for commit 579b53d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

Declares the last five sei-tendermint sections in the config registry with per-mode defaults and adds tests that walk the package's own section set. The registrations are structurally sound (all fields tagged, no defect-producing shapes, tx-index.indexer mode split matches SetTendermintConfigByMode); two exclusion-policy choices are worth a second look before the registry gets wired to a reader.

Findings: 0 blocking | 2 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] The stated reason for excluding rpc-servers — "has no default and cannot have one" — doesn't hold up against the rest of this same section, and it's the first exclusion in this package that covers a key generated files actually carry.

• The default is the empty list, and TestTheStateSyncExclusionIsThePathWithNoDefault asserts exactly that (len(DefaultStateSyncConfig().RPCServers) != 0 is the failure). An empty list resolves fine through sectionValues/detach and is carryable by an env var ([]string passes oneVariableCanCarry), so nothing forces the exclusion.
• The "operator's own peers, nothing to inherit" argument applies identically to statesync.trust-height, trust-hash and temp-dir, which this section declares with their zero values. The asymmetry isn't explained by either category RegisterSectionExcluding's doc names (a reader that refuses the key outright, or a field whose absence is the setting).
• Concretely: sei-tendermint/config/toml.go:527 writes rpc-servers = "..." into every generated config.toml, so once a reader is on Resolve, a key present in every operator's file lands in Resolved.Unknown — the channel whose purpose is "a typo in an operator's file is visible." The other two exclusions in this package (home, p2p.max-outbound-connections) are absent from the template, so they don't have this effect.

Declaring it with its empty-list default looks more consistent than excluding it. (Codex reached the opposite conclusion — exclude trust-height/trust-hash too — on the theory that registry defaults could overwrite runtime-computed values; that mechanism doesn't apply here, since Resolve puts defaults at the bottom of the precedence order and nothing installs a resolution yet. The asymmetry is the real point either way.)

[seidroid]

[suggestion] instrumentation.namespace is a key that changes nothing about how the node runs, and this section offers it.

InstrumentationConfig.Namespace (sei-tendermint/config/config.go:1442) is documented as "Deprecated: Instrumentation namespace is ignored. Tendermint Prometheus metrics always use the fixed "tendermint" namespace," and nothing reads it — the metrics constructors take MetricsNamespace instead. The generated template doesn't write it either.

That is the same class removedSettings exists for a few lines up, with the rationale spelled out there: "declaring any of them would offer a key that changes nothing about how the node runs." Consider RegisterSectionExcluding(InstrumentationSectionName, ..., "namespace"), with a note on the exclusion list. Note that the existing consensus pin (TestTheExcludedConsensusPathsAreTheRemovedOnes) keys off fields named Deprecated*, so it won't reach this one — a small assertion against DefaultInstrumentationConfig().Namespace still being the ignored fixed value would keep the exclusion honest if the node ever starts reading the field.