sliftutils 1.7.89 → 1.7.91

package/storage/remoteStorage/intermediateManagement.ts

@@ -1,13 +1,14 @@
 import { lazy } from "socket-function/src/caching";
 import { runInfinitePoll } from "socket-function/src/batching";
 import { RemoteConfig, SourceConfig, HostedConfig } from "../IArchives";
-import { ROUTING_FILE, getConfigVersion, serializeRemoteConfig, parseHostedUrl, replaceHostedUrlPort } from "./remoteConfig";
+import { ROUTING_FILE, getConfigVersion, serializeRemoteConfig, parseRoutingData, parseHostedUrl, replaceHostedUrlPort } from "./remoteConfig";
 import { injectIntermediateSource, expireIntermediateSources, getIntermediateSources, nextIntermediateVersion, INTERMEDIATE_EXPIRE_GRACE } from "./intermediateSources";
 import { getTakeoverIntermediate } from "./deployTakeover";
 import { getStorageServerConfig } from "./serverConfig";
 import { createApiArchives, listServerActiveBucketKeys } from "./createArchives";
 import { findSelfIndexes, previousWindowOwners } from "./storePlan";
-import { BucketState, getBucketStates, getLoadedBucket, writeRoutingConfig } from "./storageServerState";
+import { getActiveBucketKeys, getStore, activateBucket, writeRoutingConfig } from "./storageServerState";
+import { readRoutingFromDisk, readNewestRoutingFile } from "./bucketDisk";
 import { DEFAULT_FAST_WRITE_DELAY } from "./ArchivesDelayed";
 import { WINDOW_END_FLUSH_MARGIN } from "./blobStore";
 
@@ -26,19 +27,20 @@ const INTERMEDIATE_MAINTAIN_INTERVAL = 60 * 1000;
 const scheduledBoundaryScans = new Set<string>();
 const boundaryScansRunning = new Set<string>();
 
-/** Called whenever a bucket's state is (re)built: arms the scans its upcoming window boundaries need. Each scan is scheduled once - the key includes the boundary it is for - so re-arming on every config change is harmless. */
-export function scheduleBoundaryWork(loaded: BucketState): void {
-    let key = `${loaded.account}/${loaded.bucketName}`;
+/** Called every time a store applies a routing config to itself (see BlobStore's onRoutingApplied): arms the scans the config's upcoming window boundaries need. Each scan is scheduled once - the key includes the boundary it is for - so re-arming on every config application is harmless. */
+export function scheduleBoundaryWork(account: string, bucketName: string, routing: RemoteConfig): void {
+    let key = `${account}/${bucketName}`;
+    let selfEntries = findSelfIndexes(routing, account, bucketName).map(i => routing.sources[i] as HostedConfig);
     let now = Date.now();
     let starts = new Set<number>();
-    for (let self of loaded.selfEntries) {
+    for (let self of selfEntries) {
         let start = self.validWindow[0];
         if (start > now && start < Number.MAX_SAFE_INTEGER) {
             starts.add(start);
         }
     }
     // A window we have only just taken over, on a server that has only just started: the boundary happened while we were not running, so its scan still has to happen
-    for (let self of loaded.selfEntries) {
+    for (let self of selfEntries) {
         let [start, end] = self.validWindow;
         if (!(start <= now && now < end) || start <= 0) continue;
         if (now - start > BOUNDARY_SCAN_LOOKBACK) continue;
@@ -46,7 +48,7 @@ export function scheduleBoundaryWork(loaded: BucketState): void {
         if (scheduledBoundaryScans.has(scheduleKey)) continue;
         scheduledBoundaryScans.add(scheduleKey);
         let timer = setTimeout(() => {
-            void runBoundaryScan(loaded, start, STARTUP_BOUNDARY_SCAN_DELAY, "startup+30s").catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
+            void runBoundaryScan(account, bucketName, start, STARTUP_BOUNDARY_SCAN_DELAY, "startup+30s").catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
         }, STARTUP_BOUNDARY_SCAN_DELAY);
         (timer as { unref?: () => void }).unref?.();
     }
@@ -64,7 +66,7 @@ export function scheduleBoundaryWork(loaded: BucketState): void {
                         arm();
                         return;
                     }
-                    void runBoundaryScan(loaded, start, offset).catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
+                    void runBoundaryScan(account, bucketName, start, offset).catch((e: Error) => console.error(`Boundary scan for bucket ${key} failed: ${e.stack ?? e}`));
                 }, Math.min(at - Date.now(), MAX_TIMER_DELAY));
                 (timer as { unref?: () => void }).unref?.();
             };
@@ -73,9 +75,9 @@ export function scheduleBoundaryWork(loaded: BucketState): void {
     }
 }
 
-/** Collects the writes that landed on the previous window's owners just before a boundary, into the store that has just taken over. Who owned what is worked out purely from the config (see previousWindowOwners); this only does the pulling. */
-async function runBoundaryScan(loaded: BucketState, windowStart: number, offset: number, offsetLabel?: string): Promise<void> {
-    let key = `${loaded.account}/${loaded.bucketName}`;
+/** Collects the writes that landed on the previous window's owners just before a boundary, into the store that has just taken over. Who owned what is worked out purely from the config (see previousWindowOwners); this only does the pulling. The config is read off the disk at FIRE time, not captured when the scan was armed - it may have changed in between, and the newest copy is the one the handover actually happened under. */
+async function runBoundaryScan(account: string, bucketName: string, windowStart: number, offset: number, offsetLabel?: string): Promise<void> {
+    let key = `${account}/${bucketName}`;
     let label = `bucket ${key}, window starting ${new Date(windowStart).toISOString()}, offset ${offsetLabel || `${offset / 1000}s`}`;
     if (boundaryScansRunning.has(key)) {
         console.log(`Skipping boundary scan (${label}): the previous boundary scan is still running`);
@@ -83,23 +85,22 @@ async function runBoundaryScan(loaded: BucketState, windowStart: number, offset:
     }
     boundaryScansRunning.add(key);
     try {
-        let effective = loaded.routing;
+        let effective = await readRoutingFromDisk(account, bucketName);
         if (!effective) return;
-        let handovers = previousWindowOwners(effective, windowStart, findSelfIndexes(effective, loaded.account, loaded.bucketName));
+        let handovers = previousWindowOwners(effective, windowStart, findSelfIndexes(effective, account, bucketName));
         if (!handovers.length) return;
         console.log(`Boundary scan (${label}): ${handovers.length} route(s) taking over: ${handovers.map(x => `${JSON.stringify(x.route)} from ${x.scanOwnDisk && "our own disk" || ""}${x.scanOwnDisk && x.remotes.size && " + " || ""}${[...x.remotes.keys()].map(i => `source ${i}`).join(", ")}`).join("; ")}`);
         let since = windowStart - BOUNDARY_SCAN_LOOKBACK;
         for (let handover of handovers) {
-            let selfStore = loaded.stores.find(x => x.name === handover.name);
-            if (!selfStore) continue;
+            let selfStore = getStore(account, bucketName, handover.name);
             if (handover.scanOwnDisk) {
-                await selfStore.store.rescanBase();
+                await selfStore.rescanBase();
             }
             for (let [sourceIndex, route] of handover.remotes) {
                 let ownerSource = effective.sources[sourceIndex];
                 if (typeof ownerSource === "string") continue;
                 try {
-                    await selfStore.store.boundaryScanRemote(createApiArchives(ownerSource), { since, route });
+                    await selfStore.boundaryScanRemote(createApiArchives(ownerSource), { since, route });
                 } catch (e) {
                     console.error(`Boundary scan (${label}) of previous-window owner (source index ${sourceIndex}) failed: ${(e as Error).stack ?? e}`);
                 }
@@ -133,66 +134,69 @@ export function reinjectIntermediates(current: RemoteConfig | undefined, incomin
 // Per bucket, not global: a switchover has to write every bucket's windows at once, and a shared throttle would let only one bucket through per interval
 const lastOwnConfigWrite = new Map<string, number>();
 
-async function writeOwnRoutingConfig(loaded: BucketState, updated: RemoteConfig, reason: string): Promise<void> {
-    let key = `${loaded.account}/${loaded.bucketName}`;
+async function writeOwnRoutingConfig(config: { account: string; bucketName: string; storeName: string; current: RemoteConfig; updated: RemoteConfig; reason: string }): Promise<void> {
+    let { account, bucketName, current, updated, reason } = config;
+    let key = `${account}/${bucketName}`;
     let sinceLast = Date.now() - (lastOwnConfigWrite.get(key) || 0);
     if (sinceLast < OWN_CONFIG_WRITE_THROTTLE) {
         console.log(`Not writing our own routing config update for bucket ${key} (${reason}): the last one was ${sinceLast}ms ago, under the ${OWN_CONFIG_WRITE_THROTTLE}ms throttle. Retrying on the next maintenance pass.`);
         return;
     }
     lastOwnConfigWrite.set(key, Date.now());
-    // A switchover writes on top of whatever the bucket is running; with no config at all there is nothing to switch over
-    if (!loaded.routing) return;
-    let currentVersion = getConfigVersion(loaded.routing);
+    let currentVersion = getConfigVersion(current);
     let version = nextIntermediateVersion(currentVersion);
     let next: RemoteConfig = { ...updated, version };
     console.log(`Writing ${ROUTING_FILE} for bucket ${key} (${reason}), version ${currentVersion} -> ${version}: ${JSON.stringify(next)}`);
     let data = Buffer.from(serializeRemoteConfig(next));
-    // Into one of our own stores - it applies it and its peers pull it - and directly to the other servers, which is what makes a switchover take effect in seconds rather than at the next poll
-    let ourStore = loaded.stores[0];
-    if (ourStore) {
-        await writeRoutingConfig(loaded.account, loaded.bucketName, ourStore.name, data);
-    }
-    await propagateRoutingConfig(loaded, next, data);
+    // Into the store holding the newest copy - it applies it and its peers pull it - and directly to the other servers, which is what makes a switchover take effect in seconds rather than at the next poll
+    await writeRoutingConfig(account, bucketName, config.storeName, data);
+    await propagateRoutingConfig({ account, bucketName, current, next, data });
 }
 
-async function propagateRoutingConfig(loaded: BucketState, next: RemoteConfig, data: Buffer): Promise<void> {
+async function propagateRoutingConfig(config: { account: string; bucketName: string; current: RemoteConfig; next: RemoteConfig; data: Buffer }): Promise<void> {
     let targets = new Map<string, SourceConfig>();
-    for (let source of [...loaded.routing?.sources || [], ...next.sources]) {
+    for (let source of [...config.current.sources, ...config.next.sources]) {
         if (typeof source === "string" || source.intermediate) continue;
         if (source.type === "remote") {
             let parsed = parseHostedUrl(source.url);
-            if (parsed.account !== loaded.account || parsed.bucketName !== loaded.bucketName) continue;
+            if (parsed.account !== config.account || parsed.bucketName !== config.bucketName) continue;
         }
         if (targets.has(source.url)) continue;
         targets.set(source.url, source);
     }
     for (let [url, source] of targets) {
         try {
-            await createApiArchives(source).set(ROUTING_FILE, data);
-            console.log(`Wrote ${ROUTING_FILE} for bucket ${loaded.account}/${loaded.bucketName} to ${url}`);
+            await createApiArchives(source).set(ROUTING_FILE, config.data);
+            console.log(`Wrote ${ROUTING_FILE} for bucket ${config.account}/${config.bucketName} to ${url}`);
         } catch (e) {
             console.error(`Propagating our routing config update to ${url} failed: ${(e as Error).stack ?? e}`);
         }
     }
 }
 
-/** Keeps every loaded bucket's switchover windows current: gives our alternate port its window while a takeover is in flight, and takes expired ones back out. */
+/** Keeps every active bucket's switchover windows current: gives our alternate port its window while a takeover is in flight, and takes expired ones back out. */
 async function maintainIntermediates(): Promise<void> {
     let { domain, port } = getStorageServerConfig();
     let takeover = getTakeoverIntermediate();
     let written: string[] = [];
     let alreadyCorrect: string[] = [];
     let notOurs: string[] = [];
-    // ONLY buckets already in memory. A switchover must never load a bucket: loading starts its synchronization, and buckets nothing has touched (legacy ones especially) have no writes to hand off in the first place. One that does get used mid-switchover loads on that access, and the next pass gives it its window.
-    let states = getBucketStates();
-    for (let loaded of states) {
-        let key = `${loaded.account}/${loaded.bucketName}`;
-        let routing = loaded.routing;
-        if (!routing) continue;
+    // ONLY buckets already active. A switchover must never activate a bucket: that starts its synchronization, and buckets nothing has touched (legacy ones especially) have no writes to hand off in the first place. One that does get used mid-switchover activates on that access, and the next pass gives it its window.
+    let activeKeys = getActiveBucketKeys();
+    for (let { account, bucketName } of activeKeys) {
+        let key = `${account}/${bucketName}`;
+        let newest = await readNewestRoutingFile(account, bucketName);
+        if (!newest) continue;
+        let routing: RemoteConfig;
+        try {
+            routing = parseRoutingData(newest.data);
+        } catch (e) {
+            console.error(`Skipping switchover maintenance for bucket ${key}: its routing config could not be parsed (${(e as Error).message})`);
+            continue;
+        }
         let expired = expireIntermediateSources(routing, Date.now());
         if (JSON.stringify(expired) !== JSON.stringify(routing)) {
-            await writeOwnRoutingConfig(loaded, expired, `switchover windows expired more than ${INTERMEDIATE_EXPIRE_GRACE / 1000}s ago`);
+            await writeOwnRoutingConfig({ account, bucketName, storeName: newest.name, current: routing, updated: expired, reason: `switchover windows expired more than ${INTERMEDIATE_EXPIRE_GRACE / 1000}s ago` });
             written.push(key);
             continue;
         }
@@ -216,16 +220,16 @@ async function maintainIntermediates(): Promise<void> {
             alreadyCorrect.push(key);
             continue;
         }
-        await writeOwnRoutingConfig(loaded, injected, `we are a deploy successor: writes route to our alternate port ${takeover.altPort} from ${new Date(takeover.start).toISOString()} until our predecessor is killed at ${new Date(takeover.end).toISOString()}`);
+        await writeOwnRoutingConfig({ account, bucketName, storeName: newest.name, current: routing, updated: injected, reason: `we are a deploy successor: writes route to our alternate port ${takeover.altPort} from ${new Date(takeover.start).toISOString()} until our predecessor is killed at ${new Date(takeover.end).toISOString()}` });
         written.push(key);
     }
     if (!takeover) return;
-    if (!states.length) {
+    if (!activeKeys.length) {
         console.log(`No active buckets, so no config files to write the intermediate into (a bucket is only active once something uses it)`);
         return;
     }
     if (!written.length) {
-        console.log(`Wrote no config files: of ${states.length} active buckets, ${alreadyCorrect.length} already contain the intermediate and ${notOurs.length} are not hosted by us`);
+        console.log(`Wrote no config files: of ${activeKeys.length} active buckets, ${alreadyCorrect.length} already contain the intermediate and ${notOurs.length} are not hosted by us`);
     }
 }
 
@@ -247,7 +251,10 @@ async function activatePredecessorBuckets(): Promise<void> {
     console.log(`Our predecessor on ${url} has ${keys.length} active buckets, activating them here so their config files get the intermediate: ${keys.map(x => `${x.account}/${x.bucketName}`).join(", ")}`);
     for (let { account, bucketName } of keys) {
         try {
-            await getLoadedBucket(account, bucketName);
+            let result = await activateBucket(account, bucketName);
+            if (typeof result === "string") {
+                console.error(`Activating bucket ${account}/${bucketName} (active on our predecessor) failed: ${result}`);
+            }
         } catch (e) {
             console.error(`Activating bucket ${account}/${bucketName} (active on our predecessor) failed: ${(e as Error).stack ?? e}`);
         }

package/storage/remoteStorage/storageController.ts

@@ -9,11 +9,12 @@ import { getCommonName, getPublicIdentifier, getOwnMachineId, verify, verifyMach
 import { ArchiveFileInfo, ArchivesConfig, ArchivesSyncStatus, FindConfig, SourceConfig, IMMUTABLE_CACHE_TIME } from "../IArchives";
 import { ROUTING_FILE, getRoute, routeContains } from "./remoteConfig";
 import {
-    getLoadedBucket, requireBucket, findBucketStore, readBucketInternal, writeRoutingConfig,
-    getBucketConfig, bucketSyncStatus, bucketIndexTotals, LoadedStore, ActiveBucketInfo,
-    listAccountBuckets, ServerBucketInfo, clearAccountWriteStats,
-    getActiveBucket, activateBucket, getActiveBucketKeys,
+    findBucketStore, getStore, getBucketStores, readBucketInternal, writeRoutingConfig,
+    getBucketArchivesConfig, bucketSyncStatus, debugBucketIndexTotals, ActiveBucketInfo,
+    debugListAccountBuckets, ServerBucketInfo,
+    debugGetActiveBucket, activateBucket, getActiveBucketKeys,
 } from "./storageServerState";
+import { debugClearAccountWriteStats } from "./accessStats";
 import { getStorageServerConfig, getTrust, getRequests, assertWritesAllowed } from "./serverConfig";
 import { BlobStore } from "./blobStore";
 import { getRoutingFileResult } from "./bucketDisk";
@@ -332,13 +333,13 @@ class RemoteStorageControllerBase {
     }
     @assertValidArgs
     async getArchivesConfig(config: { account: string; bucketName: string }): Promise<ArchivesConfig> {
-        return getBucketConfig(await requireBucket(config.account, config.bucketName));
+        return await getBucketArchivesConfig(config.account, config.bucketName);
     }
     @assertValidArgs
     async listBuckets(config: { account: string }): Promise<ServerBucketInfo[]> {
         let start = Date.now();
         try {
-            return await listAccountBuckets(config.account);
+            return await debugListAccountBuckets(config.account);
         } finally {
             // The access hook (and the storage it initializes) runs before this, so a large gap between this and the caller's timing is the hook
             console.log(`listBuckets(${config.account}) call body took ${Date.now() - start}ms`);
@@ -347,7 +348,7 @@ class RemoteStorageControllerBase {
     /** The live, in-memory state of one bucket, or a string saying why it is unavailable. Answered without touching the disk, so it is cheap - but only works while the bucket is loaded here. */
     @assertValidArgs
     async getActiveBucket(config: { account: string; bucketName: string }): Promise<ActiveBucketInfo | string> {
-        return await getActiveBucket(config.account, config.bucketName);
+        return await debugGetActiveBucket(config.account, config.bucketName);
     }
     /** Loads a bucket that exists on this server into memory (starting its synchronization) and returns its live state, or a string saying why it could not be loaded. */
     @assertValidArgs
@@ -358,7 +359,7 @@ class RemoteStorageControllerBase {
     @assertValidArgs
     async clearWriteStats(config: { account: string }): Promise<{ clearedBuckets: number }> {
         clearAccountAccessStats(config.account);
-        return { clearedBuckets: clearAccountWriteStats(config.account) };
+        return { clearedBuckets: debugClearAccountWriteStats(config.account) };
     }
     /** In-memory totals per operation type since startup (or the last clearWriteStats). */
     @assertValidArgs
@@ -372,22 +373,22 @@ class RemoteStorageControllerBase {
     }
     @assertValidArgs
     async getIndexInfo(config: { account: string; bucketName: string }): Promise<{ fileCount: number; byteCount: number; sources: { debugName: string; fileCount: number; byteCount: number }[] } | undefined> {
-        return await bucketIndexTotals(await requireBucket(config.account, config.bucketName));
+        return await debugBucketIndexTotals(config.account, config.bucketName);
     }
     @assertValidArgs
     async getSyncStatus(config: { account: string; bucketName: string }): Promise<ArchivesSyncStatus> {
-        return await bucketSyncStatus(await requireBucket(config.account, config.bucketName));
+        return await bucketSyncStatus(config.account, config.bucketName);
     }
 
     @assertValidArgs
     async startLargeFile(config: { account: string; bucketName: string; path: string; sourceConfig: SourceConfig; lastModified?: number; forceSetImmutable?: boolean; noChecks?: boolean; internal?: boolean }): Promise<string> {
         assertWritesAllowed();
-        let target = await findBucketStore(config.account, config.bucketName, config.sourceConfig);
+        let store = findBucketStore(config.account, config.bucketName, config.sourceConfig);
         // The store validates the write here, before any bytes move (see BlobStore.startLargeUpload) - a large file is a set, and its SetConfig decides whether it is even allowed
         let write = { path: config.path, lastModified: config.lastModified, forceSetImmutable: config.forceSetImmutable, noChecks: config.noChecks, internal: config.internal };
-        let id = await target.store.startLargeUpload(write);
+        let id = await store.startLargeUpload(write);
         // The store name pins the upload's parts and finish to the same store the start picked (in-flight uploads survive a bucket rebuild: the part data lives in that store's folder, which a rebuilt store still opens)
-        largeUploadInfo.set(id, { ...write, account: config.account, bucketName: config.bucketName, storeName: target.name });
+        largeUploadInfo.set(id, { ...write, account: config.account, bucketName: config.bucketName, storeName: config.sourceConfig.name });
         return id;
     }
     async uploadPart(config: { uploadId: string; data: Buffer }): Promise<void> {
@@ -395,28 +396,21 @@ class RemoteStorageControllerBase {
         let info = largeUploadInfo.get(config.uploadId);
         if (!info) throw new Error(`Unknown large upload ${config.uploadId}`);
         trackAccess({ account: info.account, operation: "uploadPart", path: `${info.bucketName}/${info.path}`, size: config.data.length });
-        let target = await findUploadStore(info);
-        await target.store.appendLargeUpload({ id: config.uploadId, data: Buffer.from(config.data) });
+        await getStore(info.account, info.bucketName, info.storeName).appendLargeUpload({ id: config.uploadId, data: Buffer.from(config.data) });
     }
     async finishLargeFile(config: { uploadId: string }): Promise<void> {
         assertWritesAllowed();
         let info = largeUploadInfo.get(config.uploadId);
         if (!info) throw new Error(`Unknown large upload ${config.uploadId}`);
         largeUploadInfo.delete(config.uploadId);
-        let target = await findUploadStore(info);
-        await target.store.finishLargeUpload({ id: config.uploadId, path: info.path, lastModified: info.lastModified, forceSetImmutable: info.forceSetImmutable, noChecks: info.noChecks, internal: info.internal });
+        await getStore(info.account, info.bucketName, info.storeName).finishLargeUpload({ id: config.uploadId, path: info.path, lastModified: info.lastModified, forceSetImmutable: info.forceSetImmutable, noChecks: info.noChecks, internal: info.internal });
     }
-    /** Best-effort cleanup: an upload whose bucket or store has since vanished has nothing left to cancel. */
+    /** Best-effort cleanup: an unknown upload has nothing left to cancel. */
     async cancelLargeFile(config: { uploadId: string }): Promise<void> {
         let info = largeUploadInfo.get(config.uploadId);
         if (!info) return;
         largeUploadInfo.delete(config.uploadId);
-        let bucket = await getLoadedBucket(info.account, info.bucketName);
-        if (!bucket) return;
-        const storeName = info.storeName;
-        let target = bucket.stores.find(x => x.name === storeName);
-        if (!target) return;
-        await target.store.cancelLargeUpload({ id: config.uploadId });
+        await getStore(info.account, info.bucketName, info.storeName).cancelLargeUpload({ id: config.uploadId });
     }
 
     // IMPORTANT: We can never expose enumeration (listing, prefix search, changes feeds) over this public HTTP endpoint - only exact-key reads. Enumeration would be a massive security risk (public buckets rely on unguessable keys staying unguessable), and could also crash the client by sending them too much data. Listings exist only on the authenticated API (findInfo etc, behind accountAccess).
@@ -442,20 +436,26 @@ class RemoteStorageControllerBase {
         assertValidName(account, "account");
         assertValidName(bucketName, "bucket name");
         assertValidPath(filePath);
-        let bucket = await getLoadedBucket(account, bucketName);
-        if (!bucket) {
+        let bucketStores = await getBucketStores(account, bucketName);
+        if (!bucketStores.length) {
             return setHTTPResultHeaders(Buffer.from(""), { status: "404" });
         }
-        if (!bucket.self?.public) {
+        // Each store's policy comes from its own config, which it has only read once init ran
+        await Promise.all(bucketStores.map(x => x.store.init()));
+        let policies = bucketStores.map(x => ({ store: x.store, policy: x.store.storeConfig.current() }));
+        if (!policies.some(x => x.policy.public)) {
             throw new Error(`Bucket ${account}/${bucketName} is not public, so its files cannot be read over plain URLs`);
         }
         // Anonymous URL reads carry no source selection - the file's route picks the store, and a route no store here covers is simply not found (the routing file itself lives outside every store)
-        let httpStore: LoadedStore | undefined;
+        let httpStore: BlobStore | undefined;
+        let immutable = false;
         let info: { writeTime: number; size: number } | undefined;
         if (filePath !== ROUTING_FILE) {
             let route = getRoute(filePath);
-            httpStore = bucket.stores.find(s => s.entries.some(e => routeContains(e.route, route)));
-            info = httpStore && await httpStore.store.getInfo({ path: filePath }) || undefined;
+            let serving = policies.find(x => x.policy.public && routeContains(x.policy.route, route));
+            httpStore = serving?.store;
+            immutable = !!serving?.policy.immutable;
+            info = httpStore && await httpStore.getInfo({ path: filePath }) || undefined;
         } else {
             info = await getRoutingFileResult(account, bucketName);
         }
@@ -469,7 +469,8 @@ class RemoteStorageControllerBase {
             "Last-Modified": new Date(info.writeTime).toUTCString(),
             "Accept-Ranges": "bytes",
         };
-        if (bucket.self?.immutable) {
+        // The serving store's own policy - and never for the routing file, which changing is the whole point of
+        if (immutable) {
             headers["Cache-Control"] = `max-age=${IMMUTABLE_CACHE_TIME / 1000}`;
         }
         let ifModifiedSince = request?.headers["if-modified-since"];
@@ -502,7 +503,7 @@ class RemoteStorageControllerBase {
         }
         let result: { data: Buffer; writeTime: number; size: number } | undefined;
         if (httpStore) {
-            result = await httpStore.store.get2({ path: filePath, range });
+            result = await httpStore.get2({ path: filePath, range });
         } else {
             result = await getRoutingFileResult(account, bucketName);
             if (result && range) {
@@ -520,23 +521,13 @@ class RemoteStorageControllerBase {
     }
 }
 
-/** The one resolution every data call does: the client's selected sourceConfig maps to exactly one store (loading the bucket - and so instantiating its stores - if needed), and fn runs on it. findBucketStore throws for missing buckets and unmatched configs. */
+/** The one resolution every data call does: the client's selected sourceConfig NAMES exactly one store (created on first use), and fn runs on it. */
 async function withStore<T>(config: { account: string; bucketName: string; sourceConfig: SourceConfig }, fn: (store: BlobStore) => Promise<T>): Promise<T> {
-    let target = await findBucketStore(config.account, config.bucketName, config.sourceConfig);
-    return await fn(target.store);
+    return await fn(findBucketStore(config.account, config.bucketName, config.sourceConfig));
 }
 
 const largeUploadInfo = new Map<string, { account: string; bucketName: string; path: string; lastModified?: number; forceSetImmutable?: boolean; noChecks?: boolean; internal?: boolean; storeName: string }>();
 
-async function findUploadStore(info: { account: string; bucketName: string; storeName: string }): Promise<LoadedStore> {
-    let bucket = await requireBucket(info.account, info.bucketName);
-    let target = bucket.stores.find(x => x.name === info.storeName);
-    if (!target) {
-        throw new Error(`The store ${JSON.stringify(info.storeName)} this upload targets no longer exists on bucket ${info.account}/${info.bucketName} (available: ${JSON.stringify(bucket.stores.map(x => x.name))})`);
-    }
-    return target;
-}
-
 const accountAccess: SocketFunctionHook = async (context) => {
     let start = Date.now();
     let config = context.call.args[0] as { account?: string } | undefined;

package/storage/remoteStorage/storageServerState.d.ts

@@ -1,38 +1,17 @@
 /// <reference types="node" />
 /// <reference types="node" />
 import { BlobStore } from "./blobStore";
-import { RemoteConfig, HostedConfig, SourceConfig, IArchives, ArchivesConfig, ArchivesSyncStatus } from "../IArchives";
+import { RemoteConfig, SourceConfig, IArchives, ArchivesConfig, ArchivesSyncStatus } from "../IArchives";
 import { BucketDiskInfo } from "./bucketDisk";
-import { SelfSummary } from "./storePlan";
-/**
- * What this server HAS, as opposed to what any of it does. Four things, and nothing else:
- *
- * - the stores, by folder (getStore) - made once, and self-configuring from there
- * - which of them a request means (findBucketStore), which is only ever a name
- * - what exists on disk, for listings and for the pages that report it
- *
- * It decides nothing about routes, windows or peers - a store reads its own config and works that
- * out itself (BlobStore.applyRoutingConfig) - and it schedules nothing: switchovers and the handovers
- * they cause live in intermediateManagement.
- */
-export type LoadedStore = {
+import { BucketWriteStats } from "./accessStats";
+export declare function getStore(account: string, bucketName: string, name: string): BlobStore;
+/** The store serving a request: the one the client's selected entry NAMES. Account, name, and bucket ARE the folder, so this is a direct lookup, never a search of what exists - and a name this server has never seen is CREATED, never rejected, because asking for a name is the instruction to have that store (one name, one folder, one index; it configures itself once the routing config lands in it). Nothing else about the request is compared - not the window, not the route, not the flags - which is the whole point of naming it: a client a config version behind on some flag still reaches the right store. */
+export declare function findBucketStore(account: string, bucketName: string, sourceConfig: SourceConfig | undefined): BlobStore;
+/** The stores of a bucket as the DISK records them (a bucket is nothing more than the store folders sharing its name), opened - so the ones that weren't running yet start synchronizing. Empty when the bucket does not exist here. */
+export declare function getBucketStores(account: string, bucketName: string): Promise<{
     name: string;
-    entries: HostedConfig[];
-    folder: string;
     store: BlobStore;
-};
-export type BucketState = {
-    account: string;
-    bucketName: string;
-    routing?: RemoteConfig;
-    selfEntries: HostedConfig[];
-    self: SelfSummary | undefined;
-    stores: LoadedStore[];
-};
-/** The loaded bucket, loading it (which instantiates its stores and starts their synchronization) if needed. A bucket that does not exist on this server throws - callers never see undefined buckets. */
-export declare function requireBucket(account: string, bucketName: string): Promise<BucketState>;
-/** The store serving a request: the one the client's selected entry NAMES. Nothing else is compared - not the window, not the route, not the flags - because the name is what says which storage this is, and everything else is policy the store itself applies to the request. A client a config version behind on some flag therefore still reaches the right store, which is the whole point of naming it. */
-export declare function findBucketStore(account: string, bucketName: string, sourceConfig: SourceConfig | undefined): Promise<LoadedStore>;
+}[]>;
 /** Internal (store-to-store) reads skip store selection entirely: the caller is another store whose index says this MACHINE holds the bytes - the persisted holder identity is just a URL, which cannot name a store. Whichever store's folder has the newest copy answers. */
 export declare function readBucketInternal(account: string, bucketName: string, config: {
     path: string;
@@ -46,9 +25,9 @@ export declare function readBucketInternal(account: string, bucketName: string,
     writeTime: number;
     size: number;
 } | undefined>;
-export declare function getBucketConfig(bucket: BucketState): ArchivesConfig;
-export declare function bucketSyncStatus(bucket: BucketState): Promise<ArchivesSyncStatus>;
-export declare function bucketIndexTotals(bucket: BucketState): Promise<{
+export declare function getBucketArchivesConfig(account: string, bucketName: string): Promise<ArchivesConfig>;
+export declare function bucketSyncStatus(account: string, bucketName: string): Promise<ArchivesSyncStatus>;
+export declare function debugBucketIndexTotals(account: string, bucketName: string): Promise<{
     fileCount: number;
     byteCount: number;
     sources: {
@@ -57,14 +36,8 @@ export declare function bucketIndexTotals(bucket: BucketState): Promise<{
         byteCount: number;
     }[];
 }>;
-/** The bucket states currently in memory - what the switchover machinery walks. Only what is loaded: loading a bucket starts its synchronization, and a bucket nothing has touched has no in-flight writes to hand over anyway. */
-export declare function getBucketStates(): BucketState[];
 /** A cached IArchives for a persisted source identity: a routing URL (hosted/backblaze) or a disk folder path - the form BlobStore's sources list stores. Configuration (valid windows, routes) decides WHEN a source should be used; for reading bytes the index says a source holds, the URL alone is enough - even for sources no longer in any config. */
 export declare function resolveSourceArchives(url: string): IArchives;
-export declare function getStore(account: string, bucketName: string, name: string): BlobStore;
-export declare function getLoadedBucket(account: string, bucketName: string): Promise<BucketState | undefined>;
-/** Re-reads the bucket off the disk, replacing the cached snapshot: what a routing-config write calls, because that write can CREATE a store (a new name gets a new folder) and the snapshot would keep answering with the stores it saw at load time. Existing stores are reused (getStore caches by folder), so this only picks up folder changes - it never restarts a store. */
-export declare function reloadBucket(account: string, bucketName: string): Promise<BucketState | undefined>;
 /**
  * Writing the routing config is a write like any other: it goes into a store, and the store applies
  * it to itself and lets its peers pull it. The only thing that happens here is picking WHICH store,
@@ -77,7 +50,7 @@ export declare function reloadBucket(account: string, bucketName: string): Promi
 export declare function writeRoutingConfig(account: string, bucketName: string, name: string, data: Buffer, config?: {
     lastModified?: number;
 }): Promise<void>;
-/** Which buckets this process currently has loaded - what a deploy successor asks its predecessor for, so it activates exactly the buckets that are actually in use. */
+/** Which buckets this process currently has active (some store of theirs was opened) - what a deploy successor asks its predecessor for, so it activates exactly the buckets that are actually in use. */
 export declare function getActiveBucketKeys(): {
     account: string;
     bucketName: string;
@@ -96,25 +69,12 @@ export type ServerBucketInfo = {
 };
 export type ActiveBucketInfo = {
     folder: string;
-    /** The routing config the bucket is RUNNING on, straight from memory - including switchover windows written since it loaded. Absent when none of its stores has one yet. */
+    /** The bucket's routing config, the newest copy among its stores. Absent when none of them has one yet. */
     routing?: RemoteConfig;
-    /** Our own entries in that config, and their summarized current role (routes union + flags) */
-    selfEntries: HostedConfig[];
-    self?: SelfSummary;
     config: ArchivesConfig;
 };
-/** The live in-memory state of ONE bucket, answered without touching the disk (no routing file read, no statfs, no stored write stats). Returns an error string when the bucket is not loaded here, which is the normal state for a bucket nothing has accessed since startup. */
-export declare function getActiveBucket(account: string, bucketName: string): Promise<ActiveBucketInfo | string>;
-/** Loads a bucket that exists on this server's disk into memory, which starts its synchronization and window timers, and returns its live state. Nothing is written and no other server is contacted - unlike building an ArchivesChain for it, which would probe every source and could write the routing config. Already-loaded buckets just return their state. */
+/** The state of ONE active bucket. Returns an error string when the bucket is not active here, which is the normal state for a bucket nothing has accessed since startup. */
+export declare function debugGetActiveBucket(account: string, bucketName: string): Promise<ActiveBucketInfo | string>;
+/** Loads every store of a bucket that exists on this server's disk into memory, which starts their synchronization and window timers, and returns the bucket's state. Nothing is written and no other server is contacted - unlike building an ArchivesChain for it, which would probe every source and could write the routing config. Already-active buckets just return their state. */
 export declare function activateBucket(account: string, bucketName: string): Promise<ActiveBucketInfo | string>;
-export declare function listAccountBuckets(account: string): Promise<ServerBucketInfo[]>;
-export type BucketWriteStats = {
-    /** Every set call the bucket accepted */
-    originalWrites: number;
-    originalBytes: number;
-    /** What actually reached the sources. Fast writes coalesce repeated writes to the same key, so this is lower than the original counts (and is what the disk actually did). */
-    flushedWrites: number;
-    flushedBytes: number;
-};
-/** Zeroes the write statistics of every bucket in the account. */
-export declare function clearAccountWriteStats(account: string): number;
+export declare function debugListAccountBuckets(account: string): Promise<ServerBucketInfo[]>;