fix: guard observeCurrentImage against stale StatefulSet status

Add ObservedGeneration < Generation check to prevent false-positive
convergence signals when reading StatefulSet status in the same
reconcile cycle that patched the spec. ObservedGeneration and
UpdatedReplicas are written atomically by the StatefulSet controller,
so when both checks pass the pod is guaranteed to be running the new
template.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bdchatham

internal/controller/node/controller.go

@@ -197,6 +197,10 @@ func (r *SeiNodeReconciler) observeCurrentImage(ctx context.Context, node *seiv1
 		return err
 	}
 
+	// Wait for the StatefulSet controller to process the latest spec change.
+	if sts.Status.ObservedGeneration < sts.Generation {
+		return nil
+	}
 	if sts.Spec.Replicas == nil || sts.Status.UpdatedReplicas < *sts.Spec.Replicas {
 		return nil
 	}

internal/controller/node/reconciler_test.go

@@ -250,6 +250,7 @@ func TestObserveCurrentImage_UpdatesWhenConverged(t *testing.T) {
 		Build()
 
 	sts.Status.UpdatedReplicas = 1
+	sts.Status.ObservedGeneration = sts.Generation
 	g.Expect(c.Status().Update(ctx, sts)).To(Succeed())
 
 	r := &SeiNodeReconciler{Client: c, Scheme: s}
@@ -259,6 +260,46 @@ func TestObserveCurrentImage_UpdatesWhenConverged(t *testing.T) {
 	g.Expect(fetched.Status.CurrentImage).To(Equal(testImageV2))
 }
 
+func TestObserveCurrentImage_SkipsWhenStaleGeneration(t *testing.T) {
+	g := NewWithT(t)
+	ctx := context.Background()
+
+	node := newGenesisNode("mynet-0", "default")
+	node.Finalizers = []string{nodeFinalizerName}
+	node.Status.Phase = seiv1alpha1.PhaseRunning
+	node.Spec.Image = testImageV2
+
+	sts := &appsv1.StatefulSet{
+		ObjectMeta: metav1.ObjectMeta{Name: "mynet-0", Namespace: "default", Generation: 2},
+		Spec: appsv1.StatefulSetSpec{
+			Replicas:    ptrInt32(1),
+			ServiceName: "mynet-0",
+			Selector:    &metav1.LabelSelector{MatchLabels: map[string]string{"sei.io/node": "mynet-0"}},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"sei.io/node": "mynet-0"}},
+				Spec:       corev1.PodSpec{Containers: []corev1.Container{{Name: "seid", Image: testImageV2}}},
+			},
+		},
+	}
+
+	s := newNodeTestScheme(t)
+	c := fake.NewClientBuilder().
+		WithScheme(s).
+		WithObjects(node, sts).
+		WithStatusSubresource(&seiv1alpha1.SeiNode{}, &appsv1.StatefulSet{}).
+		Build()
+
+	sts.Status.UpdatedReplicas = 1
+	sts.Status.ObservedGeneration = 1
+	g.Expect(c.Status().Update(ctx, sts)).To(Succeed())
+
+	r := &SeiNodeReconciler{Client: c, Scheme: s}
+	g.Expect(r.observeCurrentImage(ctx, node)).To(Succeed())
+
+	fetched := getSeiNode(t, ctx, c, "mynet-0", "default")
+	g.Expect(fetched.Status.CurrentImage).To(BeEmpty())
+}
+
 func TestObserveCurrentImage_SkipsWhenRolling(t *testing.T) {
 	g := NewWithT(t)
 	ctx := context.Background()