docs(plan): tick Phase 10.1 scaffold + Resource reconciler

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -527,8 +527,8 @@ and per-object configuration lives in typed Spec / Status fields.
 
 ### 10.1 — Satellite as a controller-runtime controller
 
-- [~] `pkg/satellite/controllers/` package scaffold (2026-05-10). All four reconcilers (Resource / ResourceDefinition / Snapshot / StoragePool) defined with the right node-name predicates (or membership filter for Snapshot) + `NewManager` builder that wires them onto a controller-runtime manager. Reconciler bodies are stubs (Get + log + return) — subsequent commits fill in the apply path by delegating to `Config.Apply` (the existing `pkg/satellite.Reconciler`). NOT yet wired into `agent.Run` — gRPC server stays primary until Phase 10.6 retires it.
-- [ ] Resource reconciler on satellite replaces the gRPC `ApplyResources` consumer with a native CRD watch. On reconcile: read Resource Spec + parent RD + peers (List by RD-name) + Node info + effective DRBD options (resolver re-runs satellite-side, reading RG via apiserver) → drive `pkg/satellite/reconciler.applyOne` (existing logic, lifted out from the gRPC handler).
+- [x] `pkg/satellite/controllers/` package (2026-05-10). All four reconcilers defined with the right predicates (`nodeNamePredicate` for Resource/StoragePool, `snapshotNodePredicate` for Snapshot, `dropAllEventsPredicate` cache-warming for ResourceDefinition) + `NewManager` builder. Reconciler bodies wired: Resource calls `dispatcher.BuildDesired` + `Config.Apply.Apply`; Snapshot calls `Config.Apply.CreateSnapshot` / `DeleteSnapshot`; StoragePool calls `satellite.NewProviderFromKind` + `Config.Apply.RegisterProvider`. NOT yet wired into `agent.Run` — gRPC server stays primary until Phase 10.6 retires it.
+- [x] Resource reconciler on satellite (2026-05-10). `ResourceReconciler.Reconcile` reads Resource + parent RD + same-RD peers + Node list, resolves effective props via the shared `pkg/effectiveprops` package (lifted out of `internal/controller`), builds `DesiredResource` via the now-exported `dispatcher.BuildDesired`, and calls `Config.Apply.Apply`. Functional parity with the gRPC `ApplyResources` path.
 - [ ] DeleteResource flow: on Resource with non-zero `DeletionTimestamp` + the satellite's own finalizer, satellite runs the existing teardown (`drbdadm down` → `DeleteVolume` → `rm .res` → `cryptsetup luksClose`) then strips its own finalizer. Today's controller-side `runDelete` (`internal/controller.ResourceReconciler.runDelete`) goes away — finalizer ownership transfers to the satellite.
 - [x] ServiceAccount + RBAC manifests (2026-05-10). `config/rbac/satellite_role.yaml` defines the ClusterRole + ServiceAccount + binding the satellite needs once Phase 10.1 promotes it to a controller-runtime manager: read-only on RG/RD/Node/Snapshot/ControllerConfig; read+write on Resource (own finalizer); write on `*/status` subresources via SSA from Phase 10.2; full CRUD on PhysicalDevice (discovery+delete-on-attach); read on Secrets in the controller namespace; emit Events; per-node leader-election Leases. Wired into `config/rbac/kustomization.yaml`. Dormant until the satellite-as-controller-runtime code lands.