fix: wait for leadership status to be known before starting reconciliation

Replicas now wait until they're certain they won't become leader (20s timeout)
before starting the reconciliation loop. This prevents the race condition where
a pod would start reconciling with IsLeader=false and then become leader.

- Leader: starts reconciliation immediately after OnStartedLeading
- Replica: starts reconciliation after 20s timeout confirms non-leader status

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: maksymlumen

cli/run.go

@@ -205,11 +205,16 @@ var runCmd = &cobra.Command{
 		}
 
 		leaderElected := make(chan struct{})
+		leadershipKnown := make(chan struct{})
 
 		leaderCallbacks := leaderelection.LeaderCallbacks{
 			OnStartedLeading: func(ctx context.Context) {
 				l.Info("became leader for status updates")
 				isLeader.Store(true)
+				// Leadership status is now known - we are the leader
+				if !isClosed(leadershipKnown) {
+					close(leadershipKnown)
+				}
 			},
 			OnStoppedLeading: func() {
 				l.Info("stopped leading for status updates")
@@ -221,6 +226,20 @@ var runCmd = &cobra.Command{
 					return
 				}
 				close(leaderElected)
+				// Start a goroutine to close leadershipKnown after timeout if we don't become leader
+				go func() {
+					select {
+					case <-leadershipKnown:
+						// Already closed by OnStartedLeading
+						return
+					case <-time.After(20 * time.Second):
+						// We're not going to become leader - we're a replica
+						l.Info("leadership election timeout, proceeding as replica")
+						if !isClosed(leadershipKnown) {
+							close(leadershipKnown)
+						}
+					}
+				}()
 			},
 		}
 
@@ -498,10 +517,10 @@ var runCmd = &cobra.Command{
 		})
 
 		wg.Go(func() error {
-			<-leaderElected
+			<-leadershipKnown
 
-			// start manager
-			l.Info("starting kubebuilder operator")
+			// start manager (leadership status is now known - either leader or replica)
+			l.Info("starting kubebuilder operator", "isLeader", isLeader.Load())
 			defer func() {
 				l.Info("kubebuilder operator stopped")
 			}()

internal/controller/tinysignal_controller.go

@@ -17,25 +17,26 @@ limitations under the License.
 package controller
 
 import (
-	"context"
-	"github.com/tiny-systems/module/internal/scheduler"
-	"github.com/tiny-systems/module/internal/scheduler/runner"
-	"github.com/tiny-systems/module/module"
-	"github.com/tiny-systems/module/pkg/utils"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	operatorv1alpha1 "github.com/tiny-systems/module/api/v1alpha1"
+  "context"
+  "sync"
+  "sync/atomic"
+  "time"
+
+  "github.com/tiny-systems/module/internal/scheduler"
+  "github.com/tiny-systems/module/internal/scheduler/runner"
+  "github.com/tiny-systems/module/module"
+  "github.com/tiny-systems/module/pkg/utils"
+  "k8s.io/apimachinery/pkg/api/errors"
+  "k8s.io/apimachinery/pkg/types"
+  "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+  "sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+  "k8s.io/apimachinery/pkg/runtime"
+  ctrl "sigs.k8s.io/controller-runtime"
+  "sigs.k8s.io/controller-runtime/pkg/client"
+  "sigs.k8s.io/controller-runtime/pkg/log"
+
+  operatorv1alpha1 "github.com/tiny-systems/module/api/v1alpha1"
 )
 
 // TinySignalReconciler reconciles a TinySignal object
@@ -139,6 +140,7 @@ func (r *TinySignalReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 
 	_, isRunning := r.runningProcesses[req.NamespacedName]
 	lastProcessedNonce := signal.Status.ProcessedNonce
+
 	currentNonce := signal.Spec.Nonce
 
 	specHasChanged := currentNonce != lastProcessedNonce
@@ -328,7 +330,7 @@ func (r *TinySignalReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 
 				return
 			}
-		}(processCtx, req.NamespacedName, signal.Spec, signal.Spec.Nonce)
+		}(processCtx, req.NamespacedName, signal.Spec, currentNonce)
 	}
 
 	return ctrl.Result{}, nil