keyvalue: prefix deletion watermark

[cheggaaa]

Adds physical deletion to the keyvalue store. Needed by SYN-104 (prune read/ frontiers of removed spaces): today rows are (key, peerId) LWW synced by ldiff, so nothing can ever be removed — a local delete resurrects on the next diff round, and dead-space rows accumulate on every device and node forever.

Design

A deletion is a normal synced row whose signed StoreKeyInner carries a typed StoreDeletePrefix operation (inner.delete) — the watermark. It must be an ordinary row: the stream frame type is frozen (changing it breaks normal sync with old peers), the marker has to participate in ldiff anti-entropy to reach every replica including restored devices, and the operation discriminator must live under the signatures so it cannot be forged. Applying it:

• physically drops every stored row whose key starts with the prefix and is strictly older than the watermark — document and ldiff element;
• keeps the watermark row as the only permanent state (one row per deleted prefix), which also guards against resurrection: rows pushed later (e.g. by a device restoring an old snapshot) are rejected while older than the watermark, and the restorer drops its own copies once the watermark syncs to it;
• wins/loses per ordinary LWW, so a genuinely newer row from a live writer still applies.

Surface: Storage.DeletePrefix(ctx, prefix). Owner-only on both the local API and the receive path (a watermark removes other peers' rows). GetAll/Iterate hide watermark rows. Inner Set returns a SetResult (applied values + dropped ids): SetRaw broadcasts and indexes only applied rows, and the optional DeletionAwareIndexer.RemoveIndex mirrors drops into the app index. Local writes under a newer covering watermark fail with ErrCoveredByWatermark instead of silently succeeding while every replica discards the row.

Validation change bundled: KeyPeerId is now derived from the signed payload (key + "-" + inner.peer). Previously it was unchecked (the TODO in element.go), letting any writer occupy or overwrite another peer's row with a forged id.

Rollout

Old peers store a watermark as an inert empty-valued row and keep their data. Plan: ship the support to the whole fleet first; enable actual DeletePrefix calls only after adoption, so no watermark exists while old versions run.

Tests

• innerstorage: drop semantics (older dropped; newer, out-of-prefix, and key-boundary rows survive), late-arrival rejection, watermark index rebuild on reopen, batch order independence, failed-tx diff restore including same-batch write+drop, SetResult contract
• service: two-peer sync propagation + physical drop on both replicas, replay of captured pre-delete rows is a no-op, non-owner watermark rejected, covered-write errors, indexer flow (index applied, un-index dropped, never index rejected)

SYN-145

🤖 Generated with Claude Code

[github-actions]

New Coverage	60.1% of statements
Patch Coverage	45.7% of changed statements (84/184)

---

^{Coverage provided by https://github.com/seriousben/go-patch-cover-action}