Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@deployments/upgrades/6_2_to_6_3_upgrade.md`:
- Around line 54-58: The docs lack explicit instructions for turning per-field
placeholders {secretName: TODO-REPLACE-ME, secretKey: <field>} into real
Kubernetes Secrets; update the guide to tell operators to inspect the stderr
list of TODO placeholders and either (1) create a Kubernetes Secret named as you
choose with keys matching each listed secretKey (so each placeholder maps to a
key in that Secret) or (2) edit the generated YAML under services.configs to
replace the per-field placeholder block with a whole-secret reference
(secretRef) that your configmap_loader.py expects, and ensure the mounted Secret
filenames/keys match what configmap_loader.py checks before it clears the
placeholders; also call out that existing secretRefs listed in stderr must have
matching K8s Secrets in the target namespace.

In `@deployments/upgrades/export_configs_to_helm.py`:
- Around line 251-263: The list branch of drop_empty currently filters on the
original item instead of the recursively cleaned value, so nested empty
containers (e.g., [{'gpu': None}]) become [{}]; update the list handling in
drop_empty to call drop_empty(item) for each element, then include only elements
where the cleaned result is not None and not an empty dict/list (i.e., filter
out cleaned == None, cleaned == {}, and cleaned == []), ensuring recursive
pruning of empty containers inside lists while preserving other values.
- Around line 542-552: After strip_backend_image_pins(configs) may leave empty
dicts (e.g. workflow.backend_images -> {}), run drop_empty(configs) again before
diffing so empty containers are removed and diff_against_defaults(configs,
defaults) produces a minimal override; specifically, after calling
strip_backend_image_pins, call drop_empty on the configs (respecting the
args.no_strip_defaults flow and existing load_chart_defaults/
diff_against_defaults usage) so empty structures are not preserved by
diff_against_defaults.
- Around line 130-145: The exception handler inside the fetch routine (the
except urllib.error.HTTPError block) currently returns None for non-optional
failures which lets main() produce a partial export; modify it so that if the
call is not optional (the optional variable is False) and the HTTPError is not
the specific 400/"does not exist"/"\"DATABASE\"" case, the process exits
non-zero (e.g., sys.exit(1) or re-raise the error) instead of returning None;
keep the existing skip behavior for the optional true + 400/"does not
exist"/"\"DATABASE\"" case and preserve printing of the error body for
diagnostics.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@deployments/upgrades/export_configs_to_helm.py`:
- Around line 360-374: The code assumes the YAML root and nested nodes are
mappings and chains .get(), which can raise AttributeError for non-mapping YAML
(values_path, values); change the logic to validate shapes before chaining:
after loading values (variable values), check isinstance(values, dict) else
return {}; then assign services = values.get('services', {}) only if
isinstance(values.get('services', {}), dict) else return {}; then set configs =
services.get('configs', {}) only if isinstance(services.get('configs', {}),
dict) else return {}; keep the subsequent drop of the 'enabled' key and return
drop_empty(configs) so behavior falls back to an empty mapping for non-mapping
YAML rather than crashing.

---

Duplicate comments:
In `@deployments/upgrades/export_configs_to_helm.py`:
- Around line 565-575: After stripping pinned backend image tags with
strip_backend_image_pins(configs), run the existing drop_empty() cleanup again
to remove now-empty structures (e.g., backend_images: {}) before running
diff_against_defaults; specifically, call configs = drop_empty(configs)
immediately after stripped_image_pins = strip_backend_image_pins(configs) so
diff_against_defaults only sees meaningful keys.
- Around line 134-152: The current exception handlers for urllib.error.HTTPError
and urllib.error.URLError swallow failures and return None even when the fetch
was not optional, which lets main() produce an incomplete migration file; update
the handlers in the fetch routine (the block that references optional, path and
url) so that if optional is False you either re-raise the exception or exit with
a non-zero status (rather than returning None), while preserving the current
“skip” behavior for optional==True and the existing debug prints for optional
errors; apply this change to both the HTTPError and URLError branches so main()
can detect hard failures instead of silently emitting a partial override.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@deployments/upgrades/export_configs_to_helm.py`:
- Around line 141-158: The current code calls json.loads(resp.read()) and will
let JSONDecodeError escape; modify the success path to read the response into a
string (e.g. body = resp.read().decode()), then try to parse with
json.loads(body) and catch json.JSONDecodeError (or ValueError) and raise
ExportError with a message like f'Error fetching {path}: invalid JSON' and
include a snippet of body (first ~200 chars), preserving "raise ExportError(...
) from error" semantics; follow the same message/format used in the
urllib.error.HTTPError branch so callers see a consistent ExportError instead of
a traceback.

---

Duplicate comments:
In `@deployments/upgrades/export_configs_to_helm.py`:
- Around line 381-389: The current loop over for key in ('services', 'configs')
silences the case where services.configs exists but is not a mapping (e.g.,
services: {configs: 123}) because the final isinstance check happens after the
loop; change the logic to validate immediately after fetching each key: after
configs = configs.get(key, {}), if key == 'configs' and not isinstance(configs,
dict) then print the existing warning (using values_path) and return {} so we
emit a warning when services.configs is not a mapping; keep using the same
warning text and sys.stderr output and preserve the surrounding loop and
returns.