docs(plan): close 8.1 node-id stability

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -396,7 +396,7 @@ The phases above closed the MVP slice and the csi-sanity REST contract. A deep a
 
 ### 8.1 Correctness — DRBD invariants (highest priority)
 
-- [ ] **node-id stability across reconciles**. `pkg/dispatcher/dispatcher.go` re-derives node-id from the current sorted peer set. Removing a replica re-numbers the survivors → DRBD bitmap mapping breaks → silent data corruption. Persist the assigned id in `Resource.Status.DRBD.NodeID` (or a controller-side allocator), free the id only when a Resource is deleted, never reuse for a different node-name on the same RD. Pinned via property test: any sequence of add/remove must keep stable name→id for surviving replicas.
+- [x] **node-id stability across reconciles** (2026-05-09): `Resource.Status.DRBDNodeID` persisted; `pkg/drbd.LowestFreeNodeID` allocator picks lowest free 0..15 not held by any sibling; `internal/controller/resource_controller.go` ensures allocation + Status update + requeue before Apply. `pkg/dispatcher/dispatcher.go` reads the persisted id, never re-derives. Property test (`internal/controller/drbd_ids_test.go`) drives a 4-phase add/remove/re-add churn against a fake client and asserts surviving replicas keep their ids. Port/minor share the same persistence on Status (one value per RD, replicated onto every sibling).
 - [ ] **TCP port pool with collision detection**. Replace `derivePort` (hash mod 1000 + 7000) with a controller-side `TcpPortPool` that allocates monotonically from a configurable range, persists the assignment on the RD, and refuses to hand out an in-use port. Cover: pool exhaustion → 409, hash collision (currently silent) → distinct ports, range reconfiguration drains old assignments. Match upstream `LinstorRemoteAccess`/`TcpPortPool` semantics.
 - [ ] **Drop pool of taken ports also covers DRBD minor numbers** — same risk class as ports. Persist `DRBDMinor` on the RD and allocate from a guarded range.
 - [ ] **`replicas_on_same` / `replicas_on_different`** — fields are accepted on the wire but ignored in `candidatePools`. Apply as anti/affinity over the Aux-prop bag golinstor sends (`Aux/topology/zone` etc.). Wrong scope today: replicas can land on the same failure domain.