sliftutils 1.7.115 → 1.7.117

package/index.d.ts

@@ -2166,7 +2166,7 @@ declare module "sliftutils/storage/IArchives" {
         };
         /** Read ONLY from the primary source - the one writes would target - instead of falling back across the redundant sources. Use this when you want your reads and writes to be somewhat atomic: there will still be issues with the round trip, but without it you could talk to a completely different node and get a much older value. Most reads aren't followed by a write though, so for most cases it's better to get a value than to have to wait (or even throw) when the primary node is not available. */
         noFallbacks?: boolean;
-        /** Store-to-store call: the serving node answers purely from its own disk, completely short-circuiting its index holders - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). No window or route checks on reads: if the bytes are on its disk, the caller may have them. */
+        /** Store-to-store call: the serving node never consults its OTHER sources - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). That is the flag's ENTIRE meaning: no fallbacks, nothing else. The read is otherwise fully correct - the node's index still gates it (a key its index says is deleted answers as deleted, never as the history bytes still sitting on its disk). No window or route checks on reads. */
         internal?: boolean;
         /** Also return size-0 results (tombstones - an empty file IS a missing file) instead of treating them as absent. Off by default, matching getInfo's flag of the same name. Synchronization passes this so a DELETED file (with its write time) is distinguishable from a file that never existed. */
         includeTombstones?: boolean;
@@ -2184,6 +2184,8 @@ declare module "sliftutils/storage/IArchives" {
         includeMarked?: boolean;
         /** Listings normally come ONLY from the authoritative sources (the same nodes writes go to - read-your-writes). With fallbacks, a failing shard's routes are covered by the next source holding them (e.g. a wide read replica) instead of the call failing - high availability at the cost of possibly missing just-written data. Single-source archives ignore the flag. */
         fallbacks?: boolean;
+        /** Store-to-store listing: only entries whose bytes the node ITSELF holds - never entries its index redirects to its own other sources. A peer reads with GetConfig.internal (which never chases those redirects), so listing a redirect would just make the peer flag the file missing, purge it, re-list it, and loop forever; the peer hears about such files from the source actually holding them instead. */
+        internal?: boolean;
     };
     export type DelConfig = {
         /** Stamps the deletion (its tombstone) with this write time instead of now. Synchronization passes the ORIGINAL deletion time, so deletion ordering survives propagation exactly like any other write's ordering. */
@@ -2211,9 +2213,11 @@ declare module "sliftutils/storage/IArchives" {
         time: number;
         /** Only keys routing into one of these [start, end) ranges. Only scanning passes this - it lets a store syncing a partial shard ask for just its slice. */
         routes?: [number, number][];
+        /** See FindConfig.internal - the change feed is a listing too, and redirect entries fail a peer's internal reads the same way. Deletions are always reported (they are index-only, there are no bytes to hold). */
+        internal?: boolean;
     };
     export type SetConfig = {
-        /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+        /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
         lastModified?: number;
         /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
         forceSetImmutable?: boolean;
@@ -2773,7 +2777,7 @@ declare module "sliftutils/storage/TransactionFile" {
         entries(): IterableIterator<[string, LogEntry<T>]>;
         /** The tombstones, which is a much smaller walk than the values - so expiring them, or listing what was deleted since some time, costs what it should. */
         deletedEntries(): IterableIterator<[string, LogTombstone<T>]>;
-        /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+        /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
         set(key: string, value: T, time: number): boolean;
         /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
         delete(key: string, time: number): boolean;
@@ -2856,13 +2860,15 @@ declare module "sliftutils/storage/TransactionStorage" {
 
 declare module "sliftutils/storage/archiveHelpers" {
     import type { IArchives } from "./IArchives";
-    /** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+    /** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
     export declare function copyArchiveFile(config: {
         from: IArchives;
         to: IArchives;
         path: string;
         /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
         toPath?: string;
+        /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+        preserveWriteTime?: boolean;
         forceSetImmutable?: boolean;
         noChecks?: boolean;
         internal?: boolean;
@@ -3713,7 +3719,7 @@ declare module "sliftutils/storage/remoteStorage/blobStore" {
         private assertFreshWriteTarget;
         private assertMutable;
         private assertInternalWriteAccepted;
-        /** Internal (store-to-store) read: purely the local disk, completely short-circuiting the index and holder resolution - the caller is another store, and chasing OUR remote holders while answering it is how infinite get loops between stores form. No window or route checks: if the bytes are on our disk, the caller may have them. Note this reads the disk past any write delay, so a fast write still buffered in memory is invisible here; the caller re-finds it once it flushes. */
+        /** Internal (store-to-store) read: never goes to OTHER sources - the caller is another store, and chasing OUR remote holders while answering it is how infinite get loops between stores form - but the INDEX still gates, because it is the source of truth: a marked deletion keeps its bytes on disk as history (see writeToSources), so the disk alone would happily serve a DELETED file as live. Index says live -> the disk provides the bytes (past any write delay, so a fast write still buffered in memory is invisible here; the caller re-finds it once it flushes). Index says deleted -> the tombstone is the answer, never the disk. No window or route checks. */
         private getInternal2;
         /** Internal (store-to-store) write: the local disk plus our index, with NO downstream fan-out - the pushing store owns propagation, and fanning its pushes back out is how write loops between stores form. Only-take-latest still applies here. */
         private setInternal;
@@ -4482,6 +4488,7 @@ declare module "sliftutils/storage/remoteStorage/storageController" {
             sourceConfig: SourceConfig;
             time: number;
             routes?: [number, number][];
+            internal?: boolean;
         }) => Promise<ArchiveFileInfo[]>;
         getArchivesConfig: (config: {
             account: string;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.115",
+    "version": "1.7.117",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -57,7 +57,7 @@
         "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
         "preact-old-types": "^10.28.1",
         "shell-quote": "^1.8.3",
-        "socket-function": "^1.2.32",
+        "socket-function": "^1.2.33",
         "typenode": "^6.6.1",
         "typesafecss": "*",
         "ws": "^8.18.3",

package/spec.txt

@@ -1,11 +1,10 @@
-Refactor
 
-    createArchives => storageController => storageServerState => BlobStore
-
-    So create Archives has to decide who we're going to talk to, and then Storage Controller, it just acts like adds security and stuff. and then it gets into load it bucket, and then load it bucket. It then decides what back-end store we're talking to, and the back-end store, it might talk to multiple sources. 
-        So there's which server we're going to talk to, which bucket on the server it maps to once we get there, and then there's which back-end stores that we talk to. So I guess it's fine. 
 
+test
+    --internal
+    --selcert
 
+    with a test.ts script
 
 
 TODO: Use wildcard certificates, and then expose urls which match up to the shard fraction, to 2 decimal places:

package/storage/ArchivesDisk.ts

@@ -164,8 +164,8 @@ export class ArchivesDisk implements IArchives {
         await this.handles.run(filePath, async () => {
             if (lastModified) {
                 let existing = await statOrUndefined(filePath);
-                // An older write never overwrites a newer one (see IArchives.set). Both sides floored: sub-millisecond mtime digits are storage artifacts, not ordering (see get2)
-                if (existing && Math.floor(lastModified) < Math.floor(existing.mtimeMs)) return;
+                // An older write never overwrites a newer one (see IArchives.set). Both sides rounded: sub-millisecond mtime digits are storage artifacts, not ordering (see get2)
+                if (existing && Math.round(lastModified) < Math.round(existing.mtimeMs)) return;
             }
             await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
             let handle = await this.handles.getHandle(filePath, fs.constants.O_RDWR | fs.constants.O_CREAT);
@@ -238,14 +238,14 @@ export class ArchivesDisk implements IArchives {
             if (!size && !config?.includeTombstones) return undefined;
             let start = range && Math.min(range.start, size) || 0;
             let end = range && Math.min(range.end, size) || size;
-            // mtimeMs is floored everywhere this disk reports a time: it carries fractional milliseconds (kernel-stamped files have nanosecond mtimes), but utimes round-trips only whole ones - so a fractional time handed to the rest of the system could never be reproduced by propagation, and every copy of the file would compare "older" than the original forever
-            if (end <= start) return { data: Buffer.alloc(0), writeTime: Math.floor(stats.mtimeMs), size };
+            // mtimeMs is ROUNDED everywhere this disk reports a time: it carries fractional milliseconds (kernel-stamped files have nanosecond mtimes), but utimes round-trips only whole ones - so a fractional time handed to the rest of the system could never be reproduced by propagation, and every copy of the file would compare "older" than the original forever. Round rather than floor, because utimes goes through a seconds DOUBLE and can land a hair BELOW the stamped millisecond - flooring turned that representation error into a full lost millisecond, un-reproducing our own stamps.
+            if (end <= start) return { data: Buffer.alloc(0), writeTime: Math.round(stats.mtimeMs), size };
             let buffer = Buffer.alloc(end - start);
             let { bytesRead } = await handle.read(buffer, 0, buffer.length, start);
             if (bytesRead !== buffer.length) {
                 throw new Error(`Expected ${buffer.length} bytes at ${filePath}:${start}, read ${bytesRead}`);
             }
-            return { data: buffer, writeTime: Math.floor(stats.mtimeMs), size };
+            return { data: buffer, writeTime: Math.round(stats.mtimeMs), size };
         });
     }
 
@@ -256,7 +256,7 @@ export class ArchivesDisk implements IArchives {
             let stats = await statOrUndefined(filePath);
             if (!stats || !stats.isFile()) return undefined;
             if (!stats.size && !config?.includeTombstones) return undefined;
-            return { writeTime: Math.floor(stats.mtimeMs), size: stats.size };
+            return { writeTime: Math.round(stats.mtimeMs), size: stats.size };
         });
     }
 
@@ -297,7 +297,7 @@ export class ArchivesDisk implements IArchives {
             let stats = await statOrUndefined(path.join(this.filesDir, relPath));
             // Deleted while we were walking
             if (!stats) continue;
-            infos.set(relPath, { path: relPath, createTime: Math.floor(stats.mtimeMs), size: stats.size });
+            infos.set(relPath, { path: relPath, createTime: Math.round(stats.mtimeMs), size: stats.size });
         }
     }
 
@@ -355,7 +355,7 @@ export class ArchivesDisk implements IArchives {
             if (lastModified) {
                 // An older write never overwrites a newer one (see IArchives.set) - re-checked HERE, not just when the upload started, because a large upload streams for minutes and that window is exactly when a newer write lands
                 let existing = await statOrUndefined(filePath);
-                if (existing && Math.floor(lastModified) < Math.floor(existing.mtimeMs)) {
+                if (existing && Math.round(lastModified) < Math.round(existing.mtimeMs)) {
                     await fs.promises.rm(tmpPath, { force: true });
                     return;
                 }

package/storage/IArchives.d.ts

@@ -71,7 +71,7 @@ export type GetConfig = {
     };
     /** Read ONLY from the primary source - the one writes would target - instead of falling back across the redundant sources. Use this when you want your reads and writes to be somewhat atomic: there will still be issues with the round trip, but without it you could talk to a completely different node and get a much older value. Most reads aren't followed by a write though, so for most cases it's better to get a value than to have to wait (or even throw) when the primary node is not available. */
     noFallbacks?: boolean;
-    /** Store-to-store call: the serving node answers purely from its own disk, completely short-circuiting its index holders - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). No window or route checks on reads: if the bytes are on its disk, the caller may have them. */
+    /** Store-to-store call: the serving node never consults its OTHER sources - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). That is the flag's ENTIRE meaning: no fallbacks, nothing else. The read is otherwise fully correct - the node's index still gates it (a key its index says is deleted answers as deleted, never as the history bytes still sitting on its disk). No window or route checks on reads. */
     internal?: boolean;
     /** Also return size-0 results (tombstones - an empty file IS a missing file) instead of treating them as absent. Off by default, matching getInfo's flag of the same name. Synchronization passes this so a DELETED file (with its write time) is distinguishable from a file that never existed. */
     includeTombstones?: boolean;
@@ -89,6 +89,8 @@ export type FindConfig = {
     includeMarked?: boolean;
     /** Listings normally come ONLY from the authoritative sources (the same nodes writes go to - read-your-writes). With fallbacks, a failing shard's routes are covered by the next source holding them (e.g. a wide read replica) instead of the call failing - high availability at the cost of possibly missing just-written data. Single-source archives ignore the flag. */
     fallbacks?: boolean;
+    /** Store-to-store listing: only entries whose bytes the node ITSELF holds - never entries its index redirects to its own other sources. A peer reads with GetConfig.internal (which never chases those redirects), so listing a redirect would just make the peer flag the file missing, purge it, re-list it, and loop forever; the peer hears about such files from the source actually holding them instead. */
+    internal?: boolean;
 };
 export type DelConfig = {
     /** Stamps the deletion (its tombstone) with this write time instead of now. Synchronization passes the ORIGINAL deletion time, so deletion ordering survives propagation exactly like any other write's ordering. */
@@ -116,9 +118,11 @@ export type ChangesAfterConfig = {
     time: number;
     /** Only keys routing into one of these [start, end) ranges. Only scanning passes this - it lets a store syncing a partial shard ask for just its slice. */
     routes?: [number, number][];
+    /** See FindConfig.internal - the change feed is a listing too, and redirect entries fail a peer's internal reads the same way. Deletions are always reported (they are index-only, there are no bytes to hold). */
+    internal?: boolean;
 };
 export type SetConfig = {
-    /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+    /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
     lastModified?: number;
     /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
     forceSetImmutable?: boolean;

package/storage/IArchives.ts

@@ -106,7 +106,7 @@ export type GetConfig = {
     range?: { start: number; end: number };
     /** Read ONLY from the primary source - the one writes would target - instead of falling back across the redundant sources. Use this when you want your reads and writes to be somewhat atomic: there will still be issues with the round trip, but without it you could talk to a completely different node and get a much older value. Most reads aren't followed by a write though, so for most cases it's better to get a value than to have to wait (or even throw) when the primary node is not available. */
     noFallbacks?: boolean;
-    /** Store-to-store call: the serving node answers purely from its own disk, completely short-circuiting its index holders - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). No window or route checks on reads: if the bytes are on its disk, the caller may have them. */
+    /** Store-to-store call: the serving node never consults its OTHER sources - chasing its own remote holders while answering another store is how infinite get loops between stores form (A asks B, B's index points back at A, ...). That is the flag's ENTIRE meaning: no fallbacks, nothing else. The read is otherwise fully correct - the node's index still gates it (a key its index says is deleted answers as deleted, never as the history bytes still sitting on its disk). No window or route checks on reads. */
     internal?: boolean;
     /** Also return size-0 results (tombstones - an empty file IS a missing file) instead of treating them as absent. Off by default, matching getInfo's flag of the same name. Synchronization passes this so a DELETED file (with its write time) is distinguishable from a file that never existed. */
     includeTombstones?: boolean;
@@ -125,6 +125,8 @@ export type FindConfig = {
     includeMarked?: boolean;
     /** Listings normally come ONLY from the authoritative sources (the same nodes writes go to - read-your-writes). With fallbacks, a failing shard's routes are covered by the next source holding them (e.g. a wide read replica) instead of the call failing - high availability at the cost of possibly missing just-written data. Single-source archives ignore the flag. */
     fallbacks?: boolean;
+    /** Store-to-store listing: only entries whose bytes the node ITSELF holds - never entries its index redirects to its own other sources. A peer reads with GetConfig.internal (which never chases those redirects), so listing a redirect would just make the peer flag the file missing, purge it, re-list it, and loop forever; the peer hears about such files from the source actually holding them instead. */
+    internal?: boolean;
 };
 
 export type DelConfig = {
@@ -155,10 +157,12 @@ export type ChangesAfterConfig = {
     time: number;
     /** Only keys routing into one of these [start, end) ranges. Only scanning passes this - it lets a store syncing a partial shard ask for just its slice. */
     routes?: [number, number][];
+    /** See FindConfig.internal - the change feed is a listing too, and redirect entries fail a peer's internal reads the same way. Deletions are always reported (they are index-only, there are no bytes to hold). */
+    internal?: boolean;
 };
 
 export type SetConfig = {
-    /** The write time to stamp (see IArchives.set). FLOORED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. */
+    /** The write time to stamp (see IArchives.set). ROUNDED to whole milliseconds by every implementation - the disk can't store fractional milliseconds anyway (utimes round-trips whole ms), so a fractional stamp could never be reproduced by propagation and would compare "newer" than its own copies forever. Rounded rather than floored because utimes goes through a seconds double and can read back a hair below the stamped millisecond (see ArchivesDisk.get2). */
     lastModified?: number;
     /** Makes the write acceptable on immutable targets: an existing path is simply kept (immutability wins - nothing is overwritten) instead of the write throwing. Requires lastModified. Synchronization MUST pass this on every push - a plain set throws on immutable targets, which would abort reconciliation whenever one source in a chain is immutable. */
     forceSetImmutable?: boolean;
@@ -182,7 +186,7 @@ export type SetLargeFileConfig = SetConfig & {
     restartStream?(): Promise<void> | void;
 };
 
-// createTime is a misnomer kept for compatibility — it is really the LAST-WRITE time, same as getInfo's writeTime. Neither Backblaze nor our remote storage tracks a distinct creation date: each write stamps a fresh timestamp on the current version, so both fields are just "when the bytes served by get() were most recently written". Always WHOLE milliseconds: write times are floored at every producer (see SetConfig.lastModified).
+// createTime is a misnomer kept for compatibility — it is really the LAST-WRITE time, same as getInfo's writeTime. Neither Backblaze nor our remote storage tracks a distinct creation date: each write stamps a fresh timestamp on the current version, so both fields are just "when the bytes served by get() were most recently written". Always WHOLE milliseconds: write times are rounded at every producer (see SetConfig.lastModified).
 export type ArchiveFileInfo = { path: string; createTime: number; size: number };
 
 // An in-progress background synchronization task (see ArchivesConfig.syncing)

package/storage/TransactionFile.d.ts

@@ -39,7 +39,7 @@ export declare class TransactionFile<T> {
     entries(): IterableIterator<[string, LogEntry<T>]>;
     /** The tombstones, which is a much smaller walk than the values - so expiring them, or listing what was deleted since some time, costs what it should. */
     deletedEntries(): IterableIterator<[string, LogTombstone<T>]>;
-    /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+    /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
     set(key: string, value: T, time: number): boolean;
     /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
     delete(key: string, time: number): boolean;

package/storage/TransactionFile.ts

@@ -119,9 +119,9 @@ export class TransactionFile<T> {
         return this.deleted.entries();
     }
 
-    /** Stores a value as of `time` (floored to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
+    /** Stores a value as of `time` (rounded to whole milliseconds - see applySet). Returns false when something at least as new is already here, in which case nothing changed - an out-of-order write is not an error, it is just late. */
     public set(key: string, value: T, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         if (!this.applySet(key, value, time, Date.now())) return false;
         this.append({ k: key, t: time, v: value });
         return true;
@@ -129,7 +129,7 @@ export class TransactionFile<T> {
 
     /** Deletes as of `time`, keeping the tombstone. A key that had a live value keeps it in the tombstone as MARKED for deletion (readable and restorable until dropValue). Returns false when something at least as new is already here. */
     public delete(key: string, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         let live = this.values.get(key);
         if (!this.applyDelete(key, time, Date.now(), live?.value, live?.time)) return false;
         if (live) {
@@ -142,7 +142,7 @@ export class TransactionFile<T> {
 
     /** Undoes a marked deletion: the kept value becomes live again, as of `time` (a fresh time, so the restore outranks the deletion everywhere it propagated). Returns false when there is no marked value to restore, or something at least as new is already here. */
     public unmark(key: string, time: number): boolean {
-        time = Math.floor(time);
+        time = Math.round(time);
         let tombstone = this.deleted.get(key);
         if (!tombstone || tombstone.value === undefined) return false;
         if (!this.applySet(key, tombstone.value, time, Date.now())) return false;
@@ -163,13 +163,13 @@ export class TransactionFile<T> {
         let had = this.values.delete(key);
         had = this.deleted.delete(key) || had;
         if (!had) return;
-        this.append({ k: key, t: Math.floor(Date.now()), p: 1 });
+        this.append({ k: key, t: Math.round(Date.now()), p: 1 });
     }
 
-    // Times are floored to whole milliseconds on every path into the maps (load replays through here too, so fractional times persisted by older code heal on startup). Disk mtimes carry fractional milliseconds but utimes round-trips only whole ones, so a fractional time can never be reproduced by propagation - every copy of the value would compare "older" than the original forever, and the same write would be re-pushed and re-copied every round.
+    // Times are ROUNDED to whole milliseconds on every path into the maps (load replays through here too, so fractional times persisted by older code heal on startup). Disk mtimes carry fractional milliseconds but utimes round-trips only whole ones, so a fractional time can never be reproduced by propagation - every copy of the value would compare "older" than the original forever, and the same write would be re-pushed and re-copied every round. Round rather than floor, to match ArchivesDisk (see its get2): utimes goes through a seconds double and can land a hair below the stamped millisecond.
     private applySet(key: string, value: T, time: number, changedAt: number): boolean {
-        time = Math.floor(time);
-        changedAt = Math.floor(changedAt);
+        time = Math.round(time);
+        changedAt = Math.round(changedAt);
         if (time < this.timeOf(key)) return false;
         this.deleted.delete(key);
         this.values.set(key, { value, time, changedAt });
@@ -177,10 +177,10 @@ export class TransactionFile<T> {
     }
 
     private applyDelete(key: string, time: number, changedAt: number, value?: T, valueTime?: number): boolean {
-        time = Math.floor(time);
-        changedAt = Math.floor(changedAt);
+        time = Math.round(time);
+        changedAt = Math.round(changedAt);
         if (valueTime !== undefined) {
-            valueTime = Math.floor(valueTime);
+            valueTime = Math.round(valueTime);
         }
         if (time < this.timeOf(key)) return false;
         this.values.delete(key);

package/storage/archiveHelpers.d.ts

@@ -1,11 +1,13 @@
 import type { IArchives } from "./IArchives";
-/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
 export declare function copyArchiveFile(config: {
     from: IArchives;
     to: IArchives;
     path: string;
     /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
     toPath?: string;
+    /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+    preserveWriteTime?: boolean;
     forceSetImmutable?: boolean;
     noChecks?: boolean;
     internal?: boolean;

package/storage/archiveHelpers.ts

@@ -8,13 +8,15 @@ import { logStorageError } from "./remoteStorage/storageLogs";
 const LARGE_COPY_THRESHOLD = 64 * 1024 * 1024;
 const LARGE_COPY_CHUNK = 32 * 1024 * 1024;
 
-/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, the destination already had a NEWER file (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
+/** Copies one file between two archives. The source's CURRENT size and write time always come from getInfo right here - callers never supply them, because a stale size turns into ranged reads of a file that has changed (failing forever), and a stale write time re-orders history. Small files go as a single get2+set; past LARGE_COPY_THRESHOLD the copy streams through setLargeFile in LARGE_COPY_CHUNK ranged reads, so the whole file is never in memory. Returns the copied file's info, and undefined for every way the copy did NOT land: the source doesn't have the file, and with preserveWriteTime the two guarded cases - the destination already held something NEWER (refused up front rather than roll it back), or the destination silently dropped the write (its own only-take-latest won a race we lost - caught by confirming with getInfo afterward). The refused/dropped cases are logged as errors; a caller that treats undefined as "missing at the source" must getInfo the destination to learn the actual latest value. */
 export async function copyArchiveFile(config: {
     from: IArchives;
     to: IArchives;
     path: string;
     /** The path at the destination - defaults to path (the common case: the same key moving between two archives). */
     toPath?: string;
+    /** Stamps the destination with the SOURCE's write time instead of now, and turns on the ordering guards around it (the newer-destination refusal up front, and the getInfo confirm after). ONLY for synchronization between replicas of the same key, where the higher write time must win and ordering must survive propagation - never for a user-triggered copy: a plain copy is a NEW write, and the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently (move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely). */
+    preserveWriteTime?: boolean;
     forceSetImmutable?: boolean;
     noChecks?: boolean;
     internal?: boolean;
@@ -25,14 +27,15 @@ export async function copyArchiveFile(config: {
     let info = await from.getInfo(path, { noFallbacks: config.noFallbacks });
     if (!info) return undefined;
     let size = info.size;
-    // internal (synchronization between replicas of the same key) preserves the source's write time, so ordering survives propagation. A plain copy is a NEW write and is stamped now: the source's old stamp would make it LOSE to any newer write or tombstone at the destination, silently - move a file back to a folder it was deleted from and the copy is dropped, then the caller deletes the source, and the file is gone entirely.
-    let writeTime = Math.floor(config.internal && info.writeTime || Date.now());
-    // A destination that already holds a NEWER file must not be overwritten with our older one - and the destination's own only-take-latest would drop the write SILENTLY, leaving the caller believing the copy happened. Refusing here, loudly, is what turns "the remote has something we missed" from a masked bug into a log line the caller can act on.
-    let destInfo = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
-    // Compared at whole-millisecond precision, here and at the confirm below: disk mtimes carry fractional milliseconds, but utimes round-trips only whole ones, so sub-millisecond differences are storage artifacts of the SAME time, not ordering
-    if (destInfo && Math.floor(destInfo.writeTime) > Math.floor(writeTime)) {
-        logStorageError(`Copy refused - a newer file exists at the destination. Refusing to copy ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: ours ${size} bytes at ${formatDateTimeDetailed(writeTime)}, theirs ${destInfo.size} bytes at ${formatDateTimeDetailed(destInfo.writeTime)} - copying would roll it back`);
-        return undefined;
+    let writeTime = Math.round(config.preserveWriteTime && info.writeTime || Date.now());
+    if (config.preserveWriteTime) {
+        // A destination that already holds a NEWER file must not be overwritten with our older one - and the destination's own only-take-latest would drop the write SILENTLY, leaving the caller believing the copy happened. Refusing here, loudly, is what turns "the remote has something we missed" from a masked bug into a log line the caller can act on. (A fresh-stamped copy needs no such guard - nothing at the destination can be newer than now - so plain copies skip the round trip.)
+        let destInfo = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
+        // Compared at whole-millisecond precision (ROUNDED, matching ArchivesDisk - see its get2), here and at the confirm below: disk mtimes carry fractional milliseconds, but utimes round-trips only whole ones, so sub-millisecond differences are storage artifacts of the SAME time, not ordering
+        if (destInfo && Math.round(destInfo.writeTime) > Math.round(writeTime)) {
+            logStorageError(`Copy refused - a newer file exists at the destination. Refusing to copy ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: ours ${size} bytes at ${formatDateTimeDetailed(writeTime)}, theirs ${destInfo.size} bytes at ${formatDateTimeDetailed(destInfo.writeTime)} - copying would roll it back`);
+            return undefined;
+        }
     }
     let copiedSize: number;
     if (size <= LARGE_COPY_THRESHOLD) {
@@ -67,11 +70,13 @@ export async function copyArchiveFile(config: {
         });
         copiedSize = totalSize;
     }
-    // Every backend drops a superseded write SILENTLY (its only-take-latest is the last line of defense against races the up-front check can't see), so a returned set is not proof the copy landed - only the destination reporting the file at OUR time or newer is. Newer also counts as landed: the destination is at least as new as what we pushed (and b2 always stamps its own, later, upload time).
-    let confirmed = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
-    if (!confirmed || Math.floor(confirmed.writeTime) < Math.floor(writeTime)) {
-        logStorageError(`Copy was silently dropped by the destination. Copy of ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: our copy was ${copiedSize} bytes at ${formatDateTimeDetailed(writeTime)}, but the destination reports ${confirmed && `${confirmed.size} bytes at ${formatDateTimeDetailed(confirmed.writeTime)}` || "nothing"} (a newer write or deletion won the race)`);
-        return undefined;
+    if (config.preserveWriteTime) {
+        // Every backend drops a superseded write SILENTLY (its only-take-latest is the last line of defense against races the up-front check can't see), so a returned set is not proof the copy landed - only the destination reporting the file at OUR time or newer is. Newer also counts as landed: the destination is at least as new as what we pushed (and b2 always stamps its own, later, upload time). Only for preserved stamps: a fresh stamp cannot lose the race, and moveArchiveFile does its own confirm before deleting anything.
+        let confirmed = await to.getInfo(toPath, { noFallbacks: config.noFallbacks });
+        if (!confirmed || Math.round(confirmed.writeTime) < Math.round(writeTime)) {
+            logStorageError(`Copy was silently dropped by the destination. Copy of ${JSON.stringify(path)} from ${from.getDebugName()} to ${to.getDebugName()}${toPath !== path && ` (as ${JSON.stringify(toPath)})` || ""}: our copy was ${copiedSize} bytes at ${formatDateTimeDetailed(writeTime)}, but the destination reports ${confirmed && `${confirmed.size} bytes at ${formatDateTimeDetailed(confirmed.writeTime)}` || "nothing"} (a newer write or deletion won the race)`);
+            return undefined;
+        }
     }
     return { writeTime, size: copiedSize };
 }