fix(job): preserve SAO field values on CI/Merge jobs to match plan

CI on PR #670 caught a plan/apply consistency failure in
TestAccDbtCloudJobCIWithCostOptimizationFeatures:

  .cost_optimization_features: planned set element
  cty.StringVal("state_aware_orchestration") does not correlate
  with any element in actual.

The previous commit correctly skipped the SAO fields at the API
boundary for CI/Merge job types (to avoid the 405), but then still
overwrote plan.CostOptimizationFeatures from the API response. The
API doesn't store the field for those job types, so it derives back
to empty — but the user's plan still says ["state_aware_orchestration"],
which the framework flags as inconsistent.

Fix: for CI/Merge jobs, preserve whatever the user planned for
force_node_selection and cost_optimization_features rather than
deriving from the API response. The user's value is benign (we
never POST it for those job types) and keeps plan==apply consistent.
For all other job types the API response is still authoritative.

Apply the same logic in Read so that subsequent plans don't show
perpetual drift, with a fallback to empty/null on fresh imports so
ImportStateVerify still round-trips cleanly.

Verified locally with TF_ACC=1 against the dbt Cloud test account:
- TestAccDbtCloudJobCIWithCostOptimizationFeatures: PASS
- TestAccDbtCloudJobCIWithDeferringEnvironment: PASS
- TestAccDbtCloudJobMergeWithDeferringEnvironment: PASS
- TestAccDbtCloudJobCostOptimizationFeatures: SKIP (as designed)
- TestAccDbtCloudJobResource, JobCISettings, JobResourceIntervalCron,
  JobResourceJobTypeAndCompareChanges, JobResourceExecuteStepsValid: PASS

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: will-sargent-dbtlabs

pkg/framework/objects/job/resource.go

@@ -408,18 +408,31 @@ func (j *jobResource) Create(ctx context.Context, req resource.CreateRequest, re
 		plan.JobType = types.StringNull()
 	}
 
-	// Populate force_node_selection from API response
-	if createdJob.ForceNodeSelection != nil {
-		plan.ForceNodeSelection = types.BoolValue(*createdJob.ForceNodeSelection)
+	// SAO fields: for CI/Merge jobs we never POST force_node_selection or
+	// cost_optimization_features (the API rejects them with 405). To keep plan
+	// and apply consistent, preserve whatever the user planned rather than
+	// deriving from the API response. The user's value is benign because we
+	// never actually sent it to the API. For other job types the API response
+	// is authoritative.
+	createdJobIsCIOrMerge := createdJob.JobType == JobTypeCI || createdJob.JobType == JobTypeMerge
+	if !createdJobIsCIOrMerge {
+		if createdJob.ForceNodeSelection != nil {
+			plan.ForceNodeSelection = types.BoolValue(*createdJob.ForceNodeSelection)
+		} else if plan.ForceNodeSelection.IsNull() || plan.ForceNodeSelection.IsUnknown() {
+			plan.ForceNodeSelection = types.BoolNull()
+		}
+		plan.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(createdJob.ForceNodeSelection)
 	} else {
-		// If not set in config and API doesn't return it, keep it null
-		if plan.ForceNodeSelection.IsNull() {
+		// CI/Merge: collapse any unknown plan values to known empty/null so the
+		// framework's plan-apply consistency check has concrete values to compare.
+		if plan.ForceNodeSelection.IsUnknown() {
 			plan.ForceNodeSelection = types.BoolNull()
 		}
+		if plan.CostOptimizationFeatures.IsUnknown() {
+			plan.CostOptimizationFeatures = types.SetValueMust(types.StringType, []attr.Value{})
+		}
 	}
 
-	plan.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(createdJob.ForceNodeSelection)
-
 	jobIDStr := strconv.FormatInt(int64(*createdJob.ID), 10)
 
 	// Check if DeferringJobId is set and matches this job's ID for self-deferring
@@ -633,14 +646,29 @@ func (j *jobResource) Read(ctx context.Context, req resource.ReadRequest, resp *
 	state.RunLint = types.BoolValue(retrievedJob.RunLint)
 	state.ErrorsOnLintFailure = types.BoolValue(retrievedJob.ErrorsOnLintFailure)
 
-	if retrievedJob.ForceNodeSelection != nil {
-		state.ForceNodeSelection = types.BoolValue(*retrievedJob.ForceNodeSelection)
+	// SAO fields: for CI/Merge jobs the API does not honor force_node_selection /
+	// cost_optimization_features (we never POST them for those job types), so the
+	// API value is not authoritative — preserve the existing state. On fresh
+	// imports (no prior state) collapse to known empty/null values that match
+	// what Create writes, so that ImportStateVerify round-trips cleanly. For
+	// other job types the API response is authoritative.
+	retrievedJobIsCIOrMerge := retrievedJob.JobType == JobTypeCI || retrievedJob.JobType == JobTypeMerge
+	if !retrievedJobIsCIOrMerge {
+		if retrievedJob.ForceNodeSelection != nil {
+			state.ForceNodeSelection = types.BoolValue(*retrievedJob.ForceNodeSelection)
+		} else {
+			state.ForceNodeSelection = types.BoolNull()
+		}
+		state.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(retrievedJob.ForceNodeSelection)
 	} else {
-		state.ForceNodeSelection = types.BoolNull()
+		if state.ForceNodeSelection.IsUnknown() {
+			state.ForceNodeSelection = types.BoolNull()
+		}
+		if state.CostOptimizationFeatures.IsNull() || state.CostOptimizationFeatures.IsUnknown() {
+			state.CostOptimizationFeatures = types.SetValueMust(types.StringType, []attr.Value{})
+		}
 	}
 
-	state.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(retrievedJob.ForceNodeSelection)
-
 	if retrievedJob.JobType != "" {
 		state.JobType = types.StringValue(retrievedJob.JobType)
 	} else {
@@ -925,15 +953,26 @@ func (j *jobResource) Update(ctx context.Context, req resource.UpdateRequest, re
 		plan.TimeoutSeconds = types.Int64Value(int64(updatedJob.Execution.TimeoutSeconds))
 	}
 
-	// Populate force_node_selection from API response
-	if updatedJob.ForceNodeSelection != nil {
-		plan.ForceNodeSelection = types.BoolValue(*updatedJob.ForceNodeSelection)
+	// SAO fields: for CI/Merge jobs we never POST force_node_selection or
+	// cost_optimization_features, so preserve whatever the user planned (see the
+	// matching block in Create for the rationale).
+	updatedJobIsCIOrMerge := updatedJob.JobType == JobTypeCI || updatedJob.JobType == JobTypeMerge
+	if !updatedJobIsCIOrMerge {
+		if updatedJob.ForceNodeSelection != nil {
+			plan.ForceNodeSelection = types.BoolValue(*updatedJob.ForceNodeSelection)
+		} else {
+			plan.ForceNodeSelection = types.BoolNull()
+		}
+		plan.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(updatedJob.ForceNodeSelection)
 	} else {
-		plan.ForceNodeSelection = types.BoolNull()
+		if plan.ForceNodeSelection.IsUnknown() {
+			plan.ForceNodeSelection = types.BoolNull()
+		}
+		if plan.CostOptimizationFeatures.IsUnknown() {
+			plan.CostOptimizationFeatures = types.SetValueMust(types.StringType, []attr.Value{})
+		}
 	}
 
-	plan.CostOptimizationFeatures = costOptimizationFeaturesFromForceNodeSelection(updatedJob.ForceNodeSelection)
-
 	// For CI/Merge jobs, preserve deferring_environment_id from the API response
 	// so it is not lost in state when the plan did not explicitly configure it.
 	if updatedJob.DeferringEnvironmentId != nil {