Fix upstream deletes across independent peer revision spaces

[github-actions]

Summary

Addresses #167. Requested by #167 (comment).

The existing tombstone guard compares a local node revision with the sender's independent revision counter. Four new integration regressions fail against the original implementation: entry and pack pulls after a high-revision host push, and entry and pack pushes into a higher-revision receiver.

• On pulls, compare the live node's local revision with this backend's local push watermark. Unpushed edits and recreations remain protected, including after watermark reset.
• On push receivers, use the committed incoming cursor (in the sender's revision space) to distinguish replays from new authoritative deletes. Thread it through both entry and pack receivers; a failed post-commit settle followed by replay preserves a local recreation.
• Cover asynchronous/synchronous applies, independent backends, watermark resets, and both transports. Existing pull-only deletion fixtures now complete the echo push before expecting remote deletions to win.

Validation

• Original implementation: all four new cross-space integration regressions fail.
• Fixed implementation: 220 dofs sync tests and 99 RPC driver/engine tests pass.
• RPC typecheck (including dofs build), targeted Biome checks, and git diff --check pass.

No real container was required or exercised. Pulls conservatively retain local versions not yet pushed to the selected backend.

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7fcd593

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@185

commit: 7fcd593

[scuffi]

Devin Review found 3 potential issues.

[github-actions]

I reproduced all three findings (each is reported twice, by Devin and again by hand) with failing tests on f78ff4b. The proposed commit fixes them in tombstoneIsStale (packages/dofs/src/sync/apply.ts).

Remote deletes resurrect pulled files: fixed. Pull applies now record the local revs they mint, per backend, in a new _vfs_upstream_revs table. It is created by the baseline DDL, so no migration is needed, and rows are pruned in writePushCursor. A node still at a pulled rev gives way to a later delete from the same backend. A local edit after the pull still protects it.

• Tests: replay.test.ts "lets a remote delete win over an unechoed pulled file" and "protects a local edit made after a pull". sync-engine-pack.test.ts "a container delete wins over a pulled file awaiting its echo push" covers entries and pack mode, and it fails without the fix.
• This replaces the PR body's note that pulls keep local versions until they are pushed.

Directory deletes discard unpushed child edits: fixed. The guard now walks the whole subtree being deleted with a recursive CTE. It protects the delete if any node is past the push cursor and was not minted by a pull.

• Tests: "protects unpushed descendants from a directory delete" and "still deletes a clean directory tree".

Partial pushes lose unshipped same-rev changes: fixed. The guard compares {rev, path} against readPushCursor, capped at the pushRev watermark so a reset stays conservative.

• Test: "protects same-rev paths beyond a partial push cursor", which uses a renamed directory.

Every replay.test.ts case runs against both applyChanges and applyChangesSync.

Checks run, all passing:

• dofs vitest: 680 tests (after building dofs for the schema test)
• rpc vitest: 126 tests
• rpc tsc --noEmit and dofs build
• Biome on the changed files
• git diff --check

[github-actions]

Unpushed hardlinks lost after remote writes: fixing in the proposed commit. I reproduced it on 4f13766. A pull that rewrites /x restamps the inode it shares with an unpushed link /y, and records that rev as upstream. A later delete of /y then removed the link. The fix adds rewritesUnpushedHardlink in packages/dofs/src/sync/apply.ts. When a pulled file write lands on an inode that has more than one name and still holds an unpushed local version, the new rev is not recorded as upstream. A partially shipped rev counts as unpushed, because the names have different paths. The trade-off is conservative: the shared inode stays protected from later deletes until it is pushed, which is how it behaved before the pull.

• replay.test.ts "keeps an unpushed hardlink when a pull rewrites its inode" fails without the fix, in both the async and sync variants.
• "still deletes a pushed hardlink after a pull rewrites its inode" checks that a clean link still gives way to the delete.

The three duplicate threads by scuffi (remote deletes resurrect pulled files, directory deletes discard child edits, partial pushes lose same-rev changes) repeat Devin's round-1 findings. They were fixed in 4f13766, and Devin has resolved its copies. The round-1 tests still pass, so I made no further change for them.

Checks I ran, all passing:

• dofs vitest: 684 tests, after building dofs
• rpc vitest: 126 tests
• rpc typecheck (tsconfig.build.json)
• Biome on the changed files
• git diff --check

A bare tsc --noEmit in rpc reports 5 errors in test files. They are the same with and without this change.

[scuffi]

Please address the open hardlink thread in packages/dofs/src/sync/apply.ts.

[github-actions]

Remote deletion of updated hardlink stays blocked: fixed in the proposed commit. When a pull rewrites a name next to an unpushed hardlink, it now records the new rev for that name only, in _vfs_upstream_paths. A later delete of that name wins, and the unpushed link stays protected. New replay.test.ts cases cover both apply variants, and the first one fails without the fix.

Review body: the open hardlink thread in packages/dofs/src/sync/apply.ts is the one addressed above.

Checks run, all passing:

• dofs vitest: 688 tests, after building dofs
• rpc vitest: 126 tests
• rpc typecheck
• Biome on the changed files
• git diff --check