feat: improve resource reconciliation and observability

tests/lib/database.test.ts

@@ -151,4 +151,59 @@ describe("managed PostgreSQL claims", () => {
       "Database",
     ]);
   });
+
+  test("reconciles a CNPG cluster returned with managed fields without sending them back", async () => {
+    const claim = {
+      service: "app",
+      username: "app",
+      database: "app",
+      secretName: "postgres-app",
+    };
+    spyOn(objectApi, "read").mockImplementation(async (resource) => {
+      if (resource.kind === "Secret") {
+        return {
+          ...resource,
+          data: {
+            username: Buffer.from("app").toString("base64"),
+            password: Buffer.from("secret").toString("base64"),
+          },
+        } as never;
+      }
+      return {
+        ...resource,
+        metadata: {
+          ...resource.metadata,
+          managedFields: [{ manager: "cloudnative-pg" }],
+          resourceVersion: "42",
+          uid: "cluster-uid",
+          creationTimestamp: "2026-09-08T00:00:00Z",
+          generation: 3,
+        },
+        spec: { managed: { roles: [{ name: "existing" }] } },
+        status: { phase: "Ready" },
+      } as never;
+    });
+    const patch = spyOn(objectApi, "patch").mockImplementation(
+      async (resource) => {
+        if (resource.metadata?.managedFields)
+          throw new Error("metadata.managedFields must be nil");
+        return resource as never;
+      },
+    );
+
+    await reconcilePostgresClaim("project", claim);
+
+    const cluster = patch.mock.calls.find(
+      ([resource]) => resource.kind === "Cluster",
+    )?.[0];
+    expect(cluster).toMatchObject({
+      metadata: { name: "postgres", namespace: "database" },
+      spec: {
+        managed: { roles: [{ name: "existing" }, { name: "app" }] },
+      },
+    });
+    expect(cluster?.metadata).not.toHaveProperty("managedFields");
+    expect(cluster?.metadata).not.toHaveProperty("resourceVersion");
+    expect(cluster).not.toHaveProperty("status");
+  });
 });