diff --git a/pkg/component/component.go b/pkg/component/component.go
index 853c43b..e540c3c 100644
--- a/pkg/component/component.go
+++ b/pkg/component/component.go
@@ -183,6 +183,7 @@ func (s *RetrySpec) GetRetryInterval() time.Duration {
 
 // Check if state is Ready.
 func (s *Status) IsReady() bool {
+	// caveat: this operates only on the status, so it does not check that observedGeneration == generation
 	return s.State == StateReady
 }
 
diff --git a/pkg/component/reconciler.go b/pkg/component/reconciler.go
index 5bb2ef6..0f32ea3 100644
--- a/pkg/component/reconciler.go
+++ b/pkg/component/reconciler.go
@@ -59,6 +59,10 @@ import (
 // (e.g. through a TimeoutConfiguration interface that components could optionally implement)
 // TODO: run admission webhooks (if present) in reconcile (e.g. as post-read hook)
 // TODO: improve overall log output
+// TODO: finalizer and fieldowner should be made more configurable (instead of just using the reconciler name)
+// TODO: finalizer should have the standard format prefix/finalizer
+// TODO: currently, the reconciler always claims/owns dependent objects entirely; but due to server-side-apply it can happen that
+// only parts of an object are managed: other parts/fiels might be managed by other actors (or even other components); how to handle such cases?
 
 const (
 	readyConditionReasonNew                = "FirstSeen"
@@ -604,11 +608,11 @@ func (r *Reconciler[T]) getClientForComponent(component T) (cluster.Client, erro
 	clientConfiguration, haveClientConfiguration := assertClientConfiguration(component)
 	impersonationConfiguration, haveImpersonationConfiguration := assertImpersonationConfiguration(component)
 
-	var kubeconfig []byte
+	var kubeConfig []byte
 	var impersonationUser string
 	var impersonationGroups []string
 	if haveClientConfiguration {
-		kubeconfig = clientConfiguration.GetKubeConfig()
+		kubeConfig = clientConfiguration.GetKubeConfig()
 	}
 	if haveImpersonationConfiguration {
 		impersonationUser = impersonationConfiguration.GetImpersonationUser()
@@ -626,7 +630,7 @@ func (r *Reconciler[T]) getClientForComponent(component T) (cluster.Client, erro
 			}
 		}
 	}
-	clnt, err := r.clients.Get(kubeconfig, impersonationUser, impersonationGroups)
+	clnt, err := r.clients.Get(kubeConfig, impersonationUser, impersonationGroups)
 	if err != nil {
 		return nil, errors.Wrap(err, "error getting remote or impersonated client")
 	}
diff --git a/pkg/reconciler/reconciler.go b/pkg/reconciler/reconciler.go
index 586cbca..d4ee07b 100644
--- a/pkg/reconciler/reconciler.go
+++ b/pkg/reconciler/reconciler.go
@@ -134,6 +134,8 @@ type Reconciler struct {
 }
 
 // Create new reconciler.
+// The passed name should be fully qualified; it will be used as field owner and finalizer.
+// The passed client's scheme must recognize at least the core group (v1) and apiextensions.k8s.io/v1 and apiregistration.k8s.io/v1.
 func NewReconciler(name string, clnt cluster.Client, options ReconcilerOptions) *Reconciler {
 	// TOOD: validate options
 	if options.CreateMissingNamespaces == nil {