sliftutils 1.7.115 → 1.7.116

package/index.d.ts

@@ -2213,7 +2213,7 @@ declare module "sliftutils/storage/IArchives" {
         routes?: [number, number][];
     };
     export type SetConfig = {
-        /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+        /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
         lastModified?: number;
         /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
         forceSetImmutable?: boolean;
@@ -2773,7 +2773,7 @@ declare module "sliftutils/storage/TransactionFile" {
         entries(): IterableIterator<[string, LogEntry<T>]>;
         /** The tombstones, which is a much smaller walk than the values - so expiring them, or listing what was deleted since some time, costs what it should. */
         deletedEntries(): IterableIterator<[string, LogTombstone<T>]>;
-        /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+        /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
         set(key: string, value: T, time: number): boolean;
         /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
         delete(key: string, time: number): boolean;
@@ -2856,13 +2856,15 @@ declare module "sliftutils/storage/TransactionStorage" {
 
 declare module "sliftutils/storage/archiveHelpers" {
     import type { IArchives } from "./IArchives";
-    /** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+    /** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
     export declare function copyArchiveFile(config: {
         from: IArchives;
         to: IArchives;
         path: string;
         /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
         toPath?: string;
+        /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+        preserveWriteTime?: boolean;
         forceSetImmutable?: boolean;
         noChecks?: boolean;
         internal?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.115",
+    "version": "1.7.116",
     "main": "index.js",
     "license": "MIT",
     "files": [

package/storage/ArchivesDisk.ts

@@ -164,8 +164,8 @@ export class ArchivesDisk implements IArchives {
         await this.handles.run(filePath, async () => {
             if (lastModified) {
                 let existing = await statOrUndefined(filePath);
-                // An older write never overwrites a newer one (see IArchives.set). Both sides floored: sub-millisecond mtime digits are storage artifacts, not ordering (see get2)
-                if (existing && Math.floor(lastModified) < Math.floor(existing.mtimeMs)) return;
+                // An older write never overwrites a newer one (see IArchives.set). Both sides rounded: sub-millisecond mtime digits are storage artifacts, not ordering (see get2)
+                if (existing && Math.round(lastModified) < Math.round(existing.mtimeMs)) return;
             }
             await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
             let handle = await this.handles.getHandle(filePath, fs.constants.O_RDWR | fs.constants.O_CREAT);
@@ -238,14 +238,14 @@ export class ArchivesDisk implements IArchives {
             if (!size && !config?.includeTombstones) return undefined;
             let start = range && Math.min(range.start, size) || 0;
             let end = range && Math.min(range.end, size) || size;
-            // mtimeMs is floored everywhere this disk reports a time: it carries fractional milliseconds (kernel-stamped files have nanosecond mtimes), but utimes round-trips only whole ones - so a fractional time handed to the rest of the system could never be reproduced by propagation, and every copy of the file would compare "older" than the original forever
-            if (end <= start) return { data: Buffer.alloc(0), writeTime: Math.floor(stats.mtimeMs), size };
+            // mtimeMs is ROUNDED everywhere this disk reports a time: it carries fractional milliseconds (kernel-stamped files have nanosecond mtimes), but utimes round-trips only whole ones - so a fractional time handed to the rest of the system could never be reproduced by propagation, and every copy of the file would compare "older" than the original forever. Round rather than floor, because utimes goes through a seconds DOUBLE and can land a hair BELOW the stamped millisecond - flooring turned that representation error into a full lost millisecond, un-reproducing our own stamps.
+            if (end <= start) return { data: Buffer.alloc(0), writeTime: Math.round(stats.mtimeMs), size };
             let buffer = Buffer.alloc(end - start);
             let { bytesRead } = await handle.read(buffer, 0, buffer.length, start);
             if (bytesRead !== buffer.length) {
                 throw new Error(`Expected ${buffer.length} bytes at ${filePath}:${start}, read ${bytesRead}`);
             }
-            return { data: buffer, writeTime: Math.floor(stats.mtimeMs), size };
+            return { data: buffer, writeTime: Math.round(stats.mtimeMs), size };
         });
     }
 
@@ -256,7 +256,7 @@ export class ArchivesDisk implements IArchives {
             let stats = await statOrUndefined(filePath);
             if (!stats || !stats.isFile()) return undefined;
             if (!stats.size && !config?.includeTombstones) return undefined;
-            return { writeTime: Math.floor(stats.mtimeMs), size: stats.size };
+            return { writeTime: Math.round(stats.mtimeMs), size: stats.size };
         });
     }
 
@@ -297,7 +297,7 @@ export class ArchivesDisk implements IArchives {
             let stats = await statOrUndefined(path.join(this.filesDir, relPath));
             // Deleted while we were walking
             if (!stats) continue;
-            infos.set(relPath, { path: relPath, createTime: Math.floor(stats.mtimeMs), size: stats.size });
+            infos.set(relPath, { path: relPath, createTime: Math.round(stats.mtimeMs), size: stats.size });
         }
     }
 
@@ -355,7 +355,7 @@ export class ArchivesDisk implements IArchives {
             if (lastModified) {
                 // An older write never overwrites a newer one (see IArchives.set) - re-checked HERE, not just when the upload started, because a large upload streams for minutes and that window is exactly when a newer write lands
                 let existing = await statOrUndefined(filePath);
-                if (existing && Math.floor(lastModified) < Math.floor(existing.mtimeMs)) {
+                if (existing && Math.round(lastModified) < Math.round(existing.mtimeMs)) {
                     await fs.promises.rm(tmpPath, { force: true });
                     return;
                 }

package/storage/IArchives.d.ts

@@ -118,7 +118,7 @@ export type ChangesAfterConfig = {
     routes?: [number, number][];
 };
 export type SetConfig = {
-    /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+    /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
     lastModified?: number;
     /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
     forceSetImmutable?: boolean;

package/storage/IArchives.ts

@@ -158,7 +158,7 @@ export type ChangesAfterConfig = {
 };
 
 export type SetConfig = {
-    /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+    /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
     lastModified?: number;
     /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
     forceSetImmutable?: boolean;
@@ -182,7 +182,7 @@ export type SetLargeFileConfig = SetConfig & {
     restartStream?(): Promise<void> | void;
 };
 
-// createTime is a misnomer kept for compatibility — it is really the LAST-WRITE time, same as getInfo's writeTime. Neither Backblaze nor our remote storage tracks a distinct creation date: each write stamps a fresh timestamp on the current version, so both fields are just "when the bytes served by get() were most recently written". Always WHOLE milliseconds: write times are floored at every producer (see SetConfig.lastModified).
+// createTime is a misnomer kept for compatibility — it is really the LAST-WRITE time, same as getInfo's writeTime. Neither Backblaze nor our remote storage tracks a distinct creation date: each write stamps a fresh timestamp on the current version, so both fields are just "when the bytes served by get() were most recently written". Always WHOLE milliseconds: write times are rounded at every producer (see SetConfig.lastModified).
 export type ArchiveFileInfo = { path: string; createTime: number; size: number };
 
 // An in-progress background synchronization task (see ArchivesConfig.syncing)

package/storage/TransactionFile.d.ts

@@ -39,7 +39,7 @@ export declare class TransactionFile<T> {
     entries(): IterableIterator<[string, LogEntry<T>]>;
     /** The tombstones, which is a much smaller walk than the values - so expiring them, or listing what was deleted since some time, costs what it should. */
     deletedEntries(): IterableIterator<[string, LogTombstone<T>]>;
-    /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+    /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
     set(key: string, value: T, time: number): boolean;
     /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
     delete(key: string, time: number): boolean;

package/storage/TransactionFile.ts

@@ -119,9 +119,9 @@ export class TransactionFile<T> {
         return this.deleted.entries();
     }
 
-    /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+    /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
     public set(key: string, value: T, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         if (!this.applySet(key, value, time, Date.now())) return false;
         this.append({ k: key, t: time, v: value });
         return true;
@@ -129,7 +129,7 @@ export class TransactionFile<T> {
 
     /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
     public delete(key: string, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         let live = this.values.get(key);
         if (!this.applyDelete(key, time, Date.now(), live?.value, live?.time)) return false;
         if (live) {
@@ -142,7 +142,7 @@ export class TransactionFile<T> {
 
     /** Undoes a marked deletion: the kept value becomes live again, as of `time` (a fresh time, so the restore outranks the deletion everywhere it propagated). Returns false when there is no marked value to restore, or something at least as new is already here. */
     public unmark(key: string, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         let tombstone = this.deleted.get(key);
         if (!tombstone || tombstone.value === undefined) return false;
         if (!this.applySet(key, tombstone.value, time, Date.now())) return false;
@@ -163,13 +163,13 @@ export class TransactionFile<T> {
         let had = this.values.delete(key);
         had = this.deleted.delete(key) || had;
         if (!had) return;
-        this.append({ k: key, t: Math.floor(Date.now()), p: 1 });
+        this.append({ k: key, t: Math.round(Date.now()), p: 1 });
     }
 
-    // Times are floored to whole milliseconds on every path into the maps (load replays through here too, so fractional times persisted by older code heal on startup). Disk mtimes carry fractional milliseconds but utimes round-trips only whole ones, so a fractional time can never be reproduced by propagation - every copy of the value would compare "older" than the original forever, and the same write would be re-pushed and re-copied every round.
+    // Times are ROUNDED to whole milliseconds on every path into the maps (load replays through here too, so fractional times persisted by older code heal on startup). Disk mtimes carry fractional milliseconds but utimes round-trips only whole ones, so a fractional time can never be reproduced by propagation - every copy of the value would compare "older" than the original forever, and the same write would be re-pushed and re-copied every round. Round rather than floor, to match ArchivesDisk (see its get2): utimes goes through a seconds double and can land a hair below the stamped millisecond.
     private applySet(key: string, value: T, time: number, changedAt: number): boolean {
-        time = Math.floor(time);
-        changedAt = Math.floor(changedAt);
+        time = Math.round(time);
+        changedAt = Math.round(changedAt);
         if (time < this.timeOf(key)) return false;
         this.deleted.delete(key);
         this.values.set(key, { value, time, changedAt });
@@ -177,10 +177,10 @@ export class TransactionFile<T> {
     }
 
     private applyDelete(key: string, time: number, changedAt: number, value?: T, valueTime?: number): boolean {
-        time = Math.floor(time);
-        changedAt = Math.floor(changedAt);
+        time = Math.round(time);
+        changedAt = Math.round(changedAt);
         if (valueTime !== undefined) {
-            valueTime = Math.floor(valueTime);
+            valueTime = Math.round(valueTime);
         }
         if (time < this.timeOf(key)) return false;
         this.values.delete(key);

package/storage/archiveHelpers.d.ts

@@ -1,11 +1,13 @@
 import type { IArchives } from "./IArchives";
-/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
 export declare function copyArchiveFile(config: {
     from: IArchives;
     to: IArchives;
     path: string;
     /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
     toPath?: string;
+    /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+    preserveWriteTime?: boolean;
     forceSetImmutable?: boolean;
     noChecks?: boolean;
     internal?: boolean;

package/storage/archiveHelpers.ts

@@ -8,13 +8,15 @@ import { logStorageError } from "./remoteStorage/storageLogs";
 const LARGE_COPY_THRESHOLD = 64 * 1024 * 1024;
 const LARGE_COPY_CHUNK = 32 * 1024 * 1024;
 
-/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
 export async function copyArchiveFile(config: {
     from: IArchives;
     to: IArchives;
     path: string;
     /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
     toPath?: string;
+    /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+    preserveWriteTime?: boolean;
     forceSetImmutable?: boolean;
     noChecks?: boolean;
     internal?: boolean;
@@ -25,14 +27,15 @@ export async function copyArchiveFile(config: {
     let info = await from.getInfo(path, { noFallbacks: config.noFallbacks });
     if (!info) return undefined;
     let size = info.size;
-    // internal (synchronization between replicas of the same key) preserves the source's write time, so ordering survives propagation. A plain copy is a NEW write and is stamped now: the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently - move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely.
-    let writeTime = Math.floor(config.internal && info.writeTime || Date.now());
-    // A destination that already holds a NEWER file must not be overwritten with our older one - and the destination's own only-take-latest would drop the write SILENTLY, leaving the caller believing the copy happened. Refusing here, loudly, is what turns "the remote has something we missed" from a masked bug into a log line the caller can act on.
-    let destInfo = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
-    // Compared at whole-millisecond precision, here and at the confirm below: disk mtimes carry fractional milliseconds, but utimes round-trips only whole ones, so sub-millisecond differences are storage artifacts of the SAME time, not ordering
-    if (destInfo && Math.floor(destInfo.writeTime) > Math.floor(writeTime)) {
-        logStorageError(`Copy refused - a newer file exists at the destination. Refusing to copy ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: ours ${size} bytes at ${formatDateTimeDetailed(writeTime)}, theirs ${destInfo.size} bytes at ${formatDateTimeDetailed(destInfo.writeTime)} - copying would roll it back`);
-        return undefined;
+    let writeTime = Math.round(config.preserveWriteTime && info.writeTime || Date.now());
+    if (config.preserveWriteTime) {
+        // A destination that already holds a NEWER file must not be overwritten with our older one - and the destination's own only-take-latest would drop the write SILENTLY, leaving the caller believing the copy happened. Refusing here, loudly, is what turns "the remote has something we missed" from a masked bug into a log line the caller can act on. (A fresh-stamped copy needs no such guard - nothing at the destination can be newer than now - so plain copies skip the round trip.)
+        let destInfo = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
+        // Compared at whole-millisecond precision (ROUNDED, matching ArchivesDisk - see its get2), here and at the confirm below: disk mtimes carry fractional milliseconds, but utimes round-trips only whole ones, so sub-millisecond differences are storage artifacts of the SAME time, not ordering
+        if (destInfo && Math.round(destInfo.writeTime) > Math.round(writeTime)) {
+            logStorageError(`Copy refused - a newer file exists at the destination. Refusing to copy ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: ours ${size} bytes at ${formatDateTimeDetailed(writeTime)}, theirs ${destInfo.size} bytes at ${formatDateTimeDetailed(destInfo.writeTime)} - copying would roll it back`);
+            return undefined;
+        }
     }
     let copiedSize: number;
     if (size <= LARGE_COPY_THRESHOLD) {
@@ -67,11 +70,13 @@ export async function copyArchiveFile(config: {
         });
         copiedSize = totalSize;
     }
-    // Every backend drops a superseded write SILENTLY (its only-take-latest is the last line of defense against races the up-front check can't see), so a returned set is not proof the copy landed - only the destination reporting the file at OUR time or newer is. Newer also counts as landed: the destination is at least as new as what we pushed (and b2 always stamps its own, later, upload time).
-    let confirmed = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
-    if (!confirmed || Math.floor(confirmed.writeTime) < Math.floor(writeTime)) {
-        logStorageError(`Copy was silently dropped by the destination. Copy of ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: our copy was ${copiedSize} bytes at ${formatDateTimeDetailed(writeTime)}, but the destination reports ${confirmed && `${confirmed.size} bytes at ${formatDateTimeDetailed(confirmed.writeTime)}` || "nothing"} (a newer write or deletion won the race)`);
-        return undefined;
+    if (config.preserveWriteTime) {
+        // Every backend drops a superseded write SILENTLY (its only-take-latest is the last line of defense against races the up-front check can't see), so a returned set is not proof the copy landed - only the destination reporting the file at OUR time or newer is. Newer also counts as landed: the destination is at least as new as what we pushed (and b2 always stamps its own, later, upload time). Only for preserved stamps: a fresh stamp cannot lose the race, and moveArchiveFile does its own confirm before deleting anything.
+        let confirmed = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
+        if (!confirmed || Math.round(confirmed.writeTime) < Math.round(writeTime)) {
+            logStorageError(`Copy was silently dropped by the destination. Copy of ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: our copy was ${copiedSize} bytes at ${formatDateTimeDetailed(writeTime)}, but the destination reports ${confirmed && `${confirmed.size} bytes at ${formatDateTimeDetailed(confirmed.writeTime)}` || "nothing"} (a newer write or deletion won the race)`);
+            return undefined;
+        }
     }
     return { writeTime, size: copiedSize };
 }