fix/refactor: deep copy status in translator for all resources

[rudrakhp]

• Refactors fix in fix: deep copy status in translator layer to avoid race #8778 to centralize it for all resources
• Addresses panic: reflect: slice index out of range in watchable coalesce goroutine (Go 1.25) #9445 - missed some resources like Gateway/GatewayClass/ListenerSet/BackendTLSPolicy that lead to this error.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	9083b96
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a58341fb791410008e5dd9c
😎 Deploy Preview	https://deploy-preview-9458--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 92.10526% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.38%. Comparing base (2df4a96) to head (3247d7d).

Files with missing lines	Patch %	Lines
internal/gatewayapi/resource/resource.go	91.30%	2 Missing and 2 partials ⚠️
internal/gatewayapi/securitypolicy.go	66.66%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9458      +/-   ##
==========================================
- Coverage   75.41%   75.38%   -0.04%     
==========================================
  Files         252      252              
  Lines       41660    41608      -52     
==========================================
- Hits        31417    31365      -52     
+ Misses       8113     8111       -2     
- Partials     2130     2132       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[arkodg]

LGTM thanks !

[arkodg]

hey @rudrakhp gen-check is failng

[anrs]

StatusDeepCopy() isolates status mutations correctly, but resolveLocalObjectRefsInPolicy mutates Spec.ResponseOverride[*].Response.Body (Type/Inline/ValueRef) in place on the same *CustomResponseBody that the original holds. Since StatusDeepCopy only deep-copies Status and shallow-copies Spec, the Spec pointer graph is still shared with watchable's coalesce goroutine. This leaves the same class of race open for any BTP with a ResponseOverride.Response.Body.ValueRef — it just needs a different trigger than the original Gateway/GatewayClass panic probably.

[rudrakhp]

Good catch, and you're right — resolveLocalObjectRefsInPolicy mutates Spec.ResponseOverride[*].Response.Body in place on the same *CustomResponseBody the shared tree holds, and since StatusDeepCopy() only deep-copies Status, that Spec pointer graph is still shared with the coalesce goroutine's reflect.DeepEqual walk. So this is a genuine instance of the same class of race.

Two clarifications on the scope:

• It's gated on the merge path (mergeBackendTrafficPolicy returns early when routePolicy.Spec.MergeType == nil), so the trigger is a BTP that has both spec.mergeType set and a responseOverride[...].response.body.valueRef — narrower than any BTP with a ValueRef, but still real and reachable.
• As you note, it won't reproduce the exact slice index out of range (that needs a slice resize mid-walk); reassigning the three body fields would more likely surface as a torn read / different panic under the race detector. Same class, different symptom.

On the fix: I'd like to keep this PR's invariant that only Status is ever deep-copied — broadening the pre-translation copy to cover Spec sub-trees would reintroduce the memory cost we're explicitly avoiding. The right fix here is to stop mutating Spec at all, and instead adopt the field-owner pattern introduced for SecurityPolicy merge in #8538.

I will open a follow up for that fix.

cc @arkodg @kkk777-7

[kkk777-7]

Hi @rudrakhp thanks for working this, and @anrs thanks for raising this issue! :)

To fix same issue in resolveLocalObjectRefsInPolicy, I prefer adopting field-owner pattern.

keep this PR's invariant that only Status

so it sounds good to me.

[kkk777-7]

LGTM, thanks!