Function reconcile_zone_records 

pub async fn reconcile_zone_records(
    client: Client,
    dnszone: DNSZone,
    stores: &Stores,
) -> Result<Vec<RecordReferenceWithTimestamp>>

Reconciles DNS records for a zone by discovering records that match the zone’s label selectors.

Event-Driven Architecture: This function implements the core of the zone/record ownership model:

1. Discovers records matching the zone’s recordsFrom label selectors
2. Tags matched records by setting status.zoneRef (triggers record reconciliation via watches)
3. Untags previously matched records by clearing status.zoneRef (stops record reconciliation)
4. Returns references to currently matched records for DNSZone.status.records tracking

Record reconcilers watch status.zoneRef to determine which zone they belong to. When status.zoneRef is set, the record is reconciled to BIND9. When status.zoneRef is cleared, the record reconciler marks it as "NotSelected".

Before a record is untagged, its data is deleted from the zone’s primary BIND9 instances. If that DNS deletion fails, the record is kept selected (and in status.records) so the cleanup is retried on the next reconciliation instead of orphaning the data in BIND9.

Arguments

• client - Kubernetes API client for querying DNS records
• dnszone - The DNSZone resource with label selectors
• stores - Context stores for resolving instances and creating Bind9Managers

Returns

• Ok(Vec<RecordReference>) - List of currently matched DNS records
• Err(_) - If record discovery or tagging fails

Errors

Returns an error if Kubernetes API operations fail.