Linked zones: PTR records follow each view, deleting an override stays deleted

Auto-PTR (and --ptr) changed PTR records in every linked view, whatever
view the address record was in. ptrSync now compares each touched A/AAAA
set before and after, per view, and changes only that view's reverse
zone. PTR records in linked reverse zones are local (fill too); a shared
PTR set is made local in each view before one view changes it.

Deleting a linked zone's local records no longer brings the shared ones
back into the view: the name and type are gone from that view and the
other views keep theirs, local to each. Share still restores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/linked.go

@@ -106,8 +106,8 @@ func affectedKeys(pre, post *model.State, ops []model.Op) []rrKey {
 //
 //   - z overrides it (local records): z's shared copies go; the others
 //     keep theirs.
-//   - z's override was just removed: z gets the shared records back from
-//     a zone that has them.
+//   - z's override was just removed: z goes without the name and type,
+//     and the other zones' shared copies become local to each.
 //   - otherwise z's shared records are the truth: every zone that doesn't
 //     override the name and type gets the same (created, updated or
 //     deleted to match).
@@ -123,24 +123,40 @@ func (x *expander) syncKey(st *model.State, z *model.Zone, name, typ string) ([]
 	}
 	truth := st.SharedRecords(z.ID, name, typ)
 	members := st.LinkedWith(z)
+	if len(truth) == 0 && x.st.HasLocal(z.ID, name, typ) && x.sharing[rrKey{z.ID, name, typ}] {
+		// Another view's version was shared (dropOverrides): z gets it.
+		for _, o := range members {
+			if src := st.SharedRecords(o.ID, name, typ); len(src) > 0 && !st.HasLocal(o.ID, name, typ) {
+				for _, r := range src {
+					op, err := x.copyRecord(st, z, r, "linked: "+name+" "+typ+" is shared again in "+where(z)+": add "+r.Data)
+					if err != nil {
+						return nil, err
+					}
+					ops = append(ops, op)
+				}
+				break
+			}
+		}
+		return ops, nil
+	}
 	if len(truth) == 0 && x.st.HasLocal(z.ID, name, typ) {
-		// The override was removed: back to the shared records.
+		// z's local records are gone, and with them the name and type from
+		// z: the other views keep theirs, each its own now (a shared set
+		// would be in z too). Share sets one version for all again.
 		for _, o := range members {
 			if st.HasLocal(o.ID, name, typ) {
 				continue
 			}
-			src := st.SharedRecords(o.ID, name, typ)
-			if len(src) == 0 {
-				continue
+			var more []model.Op
+			for _, r := range st.SharedRecords(o.ID, name, typ) {
+				more = append(more, newOp(OpRecordUpdate, r.ID, r.Version, RecordInput{SharedID: model.Ptr(int64(0))},
+					fmt.Sprintf("linked: %s %s %s stays in %s, local to it now (%s has none)", name, typ, r.Data, where(o), where(z))))
 			}
-			for _, r := range src {
-				op, err := x.copyRecord(st, z, r, "linked: "+name+" "+typ+" is shared again in "+where(z)+": add "+r.Data)
-				if err != nil {
-					return nil, err
-				}
-				ops = append(ops, op)
+			if len(more) > 0 && !x.p.Can(recordAction(st, o, name, typ, true)) {
+				return nil, errf(KindForbidden, "deleting %s %s from %s makes it local in %s, which you may not change; ask someone who may to delete it, or share %s's version (jarl record update ID --shared)",
+					dnsname.Display(name), typ, where(z), where(o), where(o))
 			}
-			break
+			ops = append(ops, more...)
 		}
 		return ops, nil
 	}
@@ -468,6 +484,10 @@ func (x *expander) dropOverrides(z *model.Zone, name, typ string) []model.Op {
 	for _, o := range x.st.LinkedWith(z) {
 		for _, r := range x.st.RRset(o.ID, name, typ) {
 			if r.SharedID == 0 {
+				if x.sharing == nil {
+					x.sharing = map[rrKey]bool{}
+				}
+				x.sharing[rrKey{o.ID, name, typ}] = true
 				ops = append(ops, newOp(OpRecordDelete, r.ID, r.Version, nil, fmt.Sprintf("linked: %s %s %s in %s is replaced by the shared version", r.Name, r.Type, r.Data, zoneDesc(x.st, o))))
 			}
 		}