[kriszyp]

⊙ Problem

Hosts managed through HARPER_DEFAULT_CONFIG get waf.enabled, waf.region and waf.nodeTags from the env config layer. On every boot ensureBuiltInComponentConfigKeys() then writes waf: {} if the key is missing. No test checked that the backfill leaves those values alone, so a change to either step could drop them without a failing test.

🤔 Does call order matter?

The task assumed backfilling first would drop the values. I tried it: they survive, because the env layer fills values under an empty waf: {}. These tests check "the backfill never overwrites" and "the env layer fills under an empty block", not call order. A real-boot WAF activation check would go in qa577-upgrade-builtins.test.ts.

💡 Solution

Adds one test file, configUtils-builtInBackfillEnvLeaves.test.js. On an upgraded config with no waf key, it runs the env layer and then the backfill, and checks that the three values stay intact in the config file, in getConfigObj() (what the component loader reads) and in the flat config.

The five cases

• No waf key: the env layer supplies the values before the backfill runs, and the backfill adds nothing.
• Restart: a second boot keeps the values.
• An existing empty waf: {}: the env layer fills the values in.
• The file loses waf while memory holds the values: the backfill leaves the in-memory values alone.
• No env layer: the backfill still adds waf: {}, so the cases above cannot pass with the backfill disabled.

⚖️ Alternatives

• Test bin/run.ts call order directly — order has no visible effect on the values, so the test would lock in an order nothing depends on.
• Add cases to the existing ensureBuiltInComponentConfigKeys tests — those write YAML by hand and never run the env layer.
• Run the test through env.initSync(true) — it exits the process on a config error instead of failing the test.
• Make the backfill value-aware, or move it into initConfig() — a production change with no defect to fix, and it would blur the rule that an explicit waf: false stays disabled.

✅ Verification

• npx mocha on configUtils-builtInBackfillEnvLeaves.test.js: 5 passing.
• Mutation checks on dist, restored afterwards: removing the backfill's presence check fails 3 cases. Making the env layer skip values under an existing scope fails 3. Making the in-memory mirror unconditional fails the in-memory case. Calling the backfill from inside initConfig() before the env merge fails none of the value cases.
• npm run test:unit:main: 7163 passing, 1 failing. The failure, deployCandidateBuild.test.js "closes the git credential socket…", also fails when run alone on this checkout and loads none of this PR's code.
• Not run: test:unit:resources and test:integration:all. This PR adds one file under unitTests/config, which neither suite loads.
• Integration Tests 1/6 failed on this PR's old base in qa822-purge-log-invariants.test.ts, the same as on main at that commit. Main fixed it in Adopt rocksdb-js 2.12's transaction-log retention (#3265). After merging main, that test passes locally (9 of 9).
• Not covered: boot persistence on a full disk, real WAF enforcement, concurrent writers.
• PR QA: skipped @ 9f14701 — test-only change.

_{🤖 Generated by Anthropic Claude (Sonnet 5.5); posted via @kriszyp.}

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dx2k2ATBYemxrCvitR8saa

Release target: main — test-only addition, no release-line code changes
Related PRs: none found (partial scan: 2 PRs with more than 100 files or 10 linked issues could not be fully matched)
Complexity: easy

Deferred findings

• 36774f7d87c181dc nit test-coverage — unitTests/config/configUtils-builtInBackfillEnvLeaves.test.js — boot() calls initConfig(true) directly, skipping env.initSync override replay and the non-forced first read that bin/run.ts uses — NOT FILED

Origin — the dispatch brief this PR was written from

Add a regression test pinning that HARPER_DEFAULT_CONFIG-supplied component leaf values (for example waf.enabled/region/nodeTags) are not replaced by ensureBuiltInComponentConfigKeys()'s empty-object backfill on boot.

Acceptance

A unit test that fails if the backfill runs before, or clobbers, env-var-sourced leaf values (demonstrate by temporarily reordering). No production code change needed unless the test finds one.

_{Dispatch: task harper-default-config-backfill-order-test · queued by finding-triage/wave-20 · ran by claude/sonnet/xhigh · worker kzyp-xps-1}

_{Review-Coverage: authored=claude; ran=gemini,cursor-composer,codex; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse,muse; rounds=3; full=1 @ 9f14701}

_{Review-Attention: read ~3m (decisions: unit-pin-vs-integration, direct-initconfig-vs-initsync; raised: degraded review) @ 9f14701}

[gemini-code-assist]

Code Review

This pull request adds a new test file unitTests/config/configUtils-builtInBackfillEnvLeaves.test.js to verify the behavior of built-in component backfills when environment-supplied configuration leaves (specifically HARPER_DEFAULT_CONFIG with waf configurations) are present. The tests cover scenarios such as upgrading configurations without a waf key, maintaining configurations across restarts, filling leaves under empty blocks, preserving memoized leaves, and default backfilling. I have no feedback to provide as there are no review comments and the implementation aligns with the repository's style guidelines.