[ConfigManager] Declare the Config Values a Node Actually Reads

[bdchatham]

Stacked on #4094. Review that one first; this adds two commits on top.

What was wrong

A node's own configuration files state 276 keys. This binary declared 281, and
22 of the file's keys were not among them.

An undeclared key goes on resolving from the file that states it, and that is the
one thing sei.toml cannot reach. The resolution has nothing to say about the
key, so writing that file changes nothing for it, and neither does writing it
again on every start. A node enrolled in automatic configuration management was
held to its kind's defaults for every key except those 22.

Four of them are used

The gRPC-web settings are read by the upstream server: server/start.go starts
the listener and server/grpc/grpc_web.go reads the address, the CORS switch and
the connection ceiling. And params.SetAppConfigByMode assigns grpc-web.enable
per kind of node, so a mode rule already targeted a key the declaration could not
express.

Declared now, which adds two rows to the agreement record: the interface is open
on a generated file and declared closed for a validator and a seed, exactly as
the REST interface and gRPC already are.

Twelve are not used, and now say why

The query settings are the find. The reader that builds the server configuration
from the source fills that whole section from its own defaults:

Query: DefaultQueryConfig(),

It never asks the source for any of the five keys. Measured:

written query.max-limit=500       -> 1000     (the compiled default)
written query.disable-limits=true -> false
written query.trusted-cidrs=[..]  -> []
written query.max-iterations=22   -> 11000
written grpc-web.address=...      -> arrives  (the control)

The file's own comment tells an operator to "set disable-limits on nodes not
exposed to untrusted callers", and there is validation warning that an overly
broad trusted-cidrs entry lets public callers bypass pagination limits. Neither
value ever arrives. The compiled defaults are the restrictive ones, so limits stay
on and nobody is trusted: the failure is that an operator cannot grant trusted
access or move a limit, while believing they have. Filed separately; not declared
here, because declaring a key nothing reads offers a setting that changes nothing.

Rosetta's six are an unsupported feature. Recorded as pending removal rather than
declared, so the record closes without waiting on a product removal.
wasm.lru_size has no reader. eth_replay.eth_replay_contract_state_checks is a
template line whose name the reader does not look up.

The remaining six were already decided in config/tendermintbase, which keeps a
named constant and a reason for every key it leaves out. Those rows name the
constant rather than restating it, so the two cannot drift.

What keeps it closed

config/tendermintbase had this discipline and config/cosmosbase had none: it
registered five sections and every key outside them was undeclared with nothing
recorded. That asymmetry is why rosetta.*, query.* and grpc-web.* all sat
outside the declaration for no stated reason.

The new measurement holds both directions. A key written into a template with no
section to declare it fails, rather than answering from app.toml quietly. A key
recorded as undeclared that the binary starts declaring also fails, as a record of
a hole that is closed.

Verification

Every check broken on purpose and confirmed to fail for its stated reason, with
the mutation confirmed to apply: a dropped row, a row naming a key the binary
declares, and the gRPC-web registration removed — which reports all four of its
keys and is the gap this started from.

The first attempt at that last mutation silently failed to apply and reported a
pass; the retry is why the claim stands.

go test -race green on the touched packages, make fmtcheck clean,
golangci-lint 0 issues.

Not in this

• Deleting rosetta. Its keys are recorded as unsupported, which closes the record
  without the removal.
• Wiring the query keys to their reader. That changes behaviour on the query path
  and wants its own review.
• PLT-955.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 3, 2026, 9:42 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.27%. Comparing base (c67c288) to head (aaaae2a).

Additional details and impacted files

@@                 Coverage Diff                  @@
##           plt-775-generate    #4096      +/-   ##
====================================================
- Coverage             60.29%   60.27%   -0.03%     
====================================================
  Files                  2078     2076       -2     
  Lines                179119   178923     -196     
====================================================
- Hits                 108003   107848     -155     
+ Misses                61066    61041      -25     
+ Partials              10050    10034      -16     

Flag	Coverage Δ
sei-chain-pr	53.16% <100.00%> (-12.51%)	⬇️
sei-db	69.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
config/cosmosbase/cosmosbase.go	100.00% <100.00%> (ø)

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.