fix: anchored times shift only while still running at save start (#2730)

Follow-up to #2729.

## Problem

At load, `ReadAnchoredTime` shifted **every** anchored value forward by the downtime, including values that were already in the past when the save started. That caused two problems.

**An expired deadline came back.** A deadline that passed 5 minutes before a 30-minute outage loaded 25 minutes in the future. For example:
- `Sheep.NextWoolTime`: a sheep that was ready to shear stopped being ready.
- `PlayerVendor.NextPayTime`: an overdue payment was pushed back.
- `BaseCreature.SummonEnd`, the spell fields' `End`, `TransientItem.Expiration`, and the ChampionSpawn times could move the same way.

**Records were rewritten for nothing.** The first save after every restart rewrote:
- stamps of things that had already happened: VirtueContext's `LastHonorUse`, `LastSacrificeGain`, the four `Last*Loss` stamps, and `Corpse.TimeOfDeath`
- every deadline that had expired long ago.

## Change

- **`IGenericReader.AnchoredTimeOrigin`** is the loaded save's start time.
  - `GenericEntityPersistence` and `GenericPersistence` set it from `World.LoadedSaveStartTime`.
  - `BufferReader`, `UnmanagedDataReader` and `BinaryFileReader` expose it.
- **`ReadAnchoredTime` returns any value at or before the origin exactly as saved.**
  - A deadline still running at save start is shifted as before and keeps its remaining time.
  - Readers without an origin keep the old behaviour.
- **This covers every anchored field, including generated ones.** Generated `[AnchoredDateTime]` fields call `reader.ReadAnchoredTime()`, so the one change covers all 26 generated fields as well as the manual reads. `[DeserializeTimer]` only restores timers that were running at save time, so it is unaffected.
- **The `[AnchoredDateTime]` section of `dev-docs/serialization.md` and the `WriteAnchoredTime` doc comment describe the new rule.**

## Behaviour change

Downtime now counts toward windows measured from a past stamp:

| Window | Length |
|---|---|
| Honor use | 5 minutes |
| Sacrifice gain | 1 day |
| Virtue atrophy | 7 days |
| Instanced corpse looting | 3 minutes |

A 30-minute outage makes a 7-day atrophy fire about 0.3% sooner. No format change.

## Tests

New tests in `AnchoredTimeTests`:
- A deadline running at save start keeps its remaining time.
- A deadline that passed before save start stays passed.
- A past stamp is not shifted.
- A value exactly at save start is not shifted.

`Server.Tests`: 845 passed. `UOContent.Tests`: 1140 passed.

Projects/Server.Tests/Tests/Serialization/AnchoredTimeTests.cs

@@ -67,6 +67,63 @@ public class AnchoredTimeTests
 
         Assert.Equal(local.ToUniversalTime(), read(TimeSpan.Zero).ReadAnchoredTime());
     }
+
+    private static readonly DateTime SaveStart = new(2026, 8, 22, 12, 0, 0, DateTimeKind.Utc);
+
+    private static IGenericReader ReadSaved(BufferWriter writer, TimeSpan downtime) =>
+        new BufferReader(writer.Buffer) { AnchoredTimeShift = downtime, AnchoredTimeOrigin = SaveStart };
+
+    [Fact]
+    public void AnchoredTime_DeadlineRunningAtSaveStart_KeepsItsRemainingTime()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var deadline = SaveStart + TimeSpan.FromMinutes(20);
+        var downtime = TimeSpan.FromHours(3);
+
+        writer.WriteAnchoredTime(deadline);
+
+        Assert.Equal(deadline + downtime, ReadSaved(writer, downtime).ReadAnchoredTime());
+    }
+
+    /// <summary>
+    /// A deadline that had passed before the save must stay passed. Shifting it brought an expiry
+    /// back into the future whenever the downtime was longer than the time since it expired.
+    /// </summary>
+    [Fact]
+    public void AnchoredTime_DeadlinePassedBeforeSaveStart_StaysPassed()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var expired = SaveStart - TimeSpan.FromMinutes(5);
+
+        writer.WriteAnchoredTime(expired);
+
+        Assert.Equal(expired, ReadSaved(writer, TimeSpan.FromMinutes(30)).ReadAnchoredTime());
+    }
+
+    /// <summary>
+    /// A stamp of something that already happened (a last-use time) is never shifted, so its
+    /// bytes survive a restart and downtime counts toward its window.
+    /// </summary>
+    [Fact]
+    public void AnchoredTime_PastStamp_IsNotShifted()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var lastUse = SaveStart - TimeSpan.FromDays(2);
+
+        writer.WriteAnchoredTime(lastUse);
+
+        Assert.Equal(lastUse, ReadSaved(writer, TimeSpan.FromHours(1)).ReadAnchoredTime());
+    }
+
+    [Fact]
+    public void AnchoredTime_ValueAtSaveStart_IsNotShifted()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+
+        writer.WriteAnchoredTime(SaveStart);
+
+        Assert.Equal(SaveStart, ReadSaved(writer, TimeSpan.FromHours(1)).ReadAnchoredTime());
+    }
 }
 
 internal class AnchoredEntity : ISerializable

Projects/Server/Serialization/BinaryFileReader.cs

@@ -80,6 +80,12 @@ public sealed unsafe class BinaryFileReader : IDisposable, IGenericReader
         set => _reader.AnchoredTimeShift = value;
     }
 
+    public DateTime AnchoredTimeOrigin
+    {
+        get => _reader.AnchoredTimeOrigin;
+        set => _reader.AnchoredTimeOrigin = value;
+    }
+
     public void Dispose()
     {
         _accessor?.SafeMemoryMappedViewHandle.ReleasePointer();

Projects/Server/Serialization/BufferReader.cs

@@ -39,6 +39,8 @@ public class BufferReader : IGenericReader
 
     public TimeSpan AnchoredTimeShift { get; set; }
 
+    public DateTime AnchoredTimeOrigin { get; set; }
+
     public BufferReader(byte[] buffer, Dictionary<ulong, string> typesDb = null, Encoding encoding = null)
     {
         _buffer = buffer;

Projects/Server/Serialization/BufferWriter.cs

@@ -409,9 +409,9 @@ public class BufferWriter : IGenericWriter
     }
 
     /// <summary>
-    /// Writes the absolute value; <see cref="IGenericReader.ReadAnchoredTime" /> re-bases it
-    /// by the elapsed time since the save started, so downtime does not age it and an
-    /// unchanged value serializes to identical bytes.
+    /// Writes the absolute value; <see cref="IGenericReader.ReadAnchoredTime" /> re-bases it by
+    /// the downtime when it was still in the future at save start, so downtime does not consume a
+    /// running deadline and an unchanged value serializes to identical bytes.
     /// </summary>
     public void WriteAnchoredTime(DateTime value)
     {

Projects/Server/Serialization/GenericEntityPersistence.cs

@@ -710,7 +710,8 @@ public class GenericEntityPersistence<T> : GenericPersistence, IGenericEntityPer
         accessor.SafeMemoryMappedViewHandle.AcquirePointer(ref ptr);
         var dataReader = new UnmanagedDataReader(ptr, accessor.Length, typesDb)
         {
-            AnchoredTimeShift = _anchoredTimeShift
+            AnchoredTimeShift = _anchoredTimeShift,
+            AnchoredTimeOrigin = World.LoadedSaveStartTime
         };
 
         Deserialize(dataReader);

Projects/Server/Serialization/GenericPersistence.cs

@@ -103,7 +103,8 @@ public abstract class GenericPersistence : Persistence, IGenericSerializable
                 // These payloads carry no anchor of their own; they inherit the save-wide
                 // shift stamped while the entity indexes were read (indexes always load
                 // before persistence payloads — see Persistence.Load).
-                AnchoredTimeShift = World.LoadTimeShift
+                AnchoredTimeShift = World.LoadTimeShift,
+                AnchoredTimeOrigin = World.LoadedSaveStartTime
             };
             Deserialize(dataReader);
 

Projects/Server/Serialization/IGenericReader.cs

@@ -65,6 +65,19 @@ public interface IGenericReader
     /// </summary>
     TimeSpan AnchoredTimeShift => TimeSpan.Zero;
 
+    /// <summary>
+    /// UTC start of the loaded save. <see cref="ReadAnchoredTime" /> leaves a value at or before
+    /// it unshifted. Default when unknown, which shifts every value.
+    /// </summary>
+    DateTime AnchoredTimeOrigin => default;
+
+    /// <summary>
+    /// Reads an anchored timestamp. A deadline still in the future when the save started is
+    /// shifted by <see cref="AnchoredTimeShift" />, so it keeps the time it had left. A value at or
+    /// before the save start is returned as saved: an expired deadline stays expired instead of
+    /// coming back, and a record of something that already happened (a last-use or last-loss stamp)
+    /// keeps its bytes across restarts, with downtime counting toward its window.
+    /// </summary>
     DateTime ReadAnchoredTime()
     {
         var value = ReadDateTime();
@@ -75,7 +88,7 @@ public interface IGenericReader
         }
 
         var shift = AnchoredTimeShift;
-        if (shift == TimeSpan.Zero)
+        if (shift == TimeSpan.Zero || value <= AnchoredTimeOrigin)
         {
             return value;
         }

Projects/Server/Serialization/UnmanagedDataReader.cs

@@ -45,6 +45,8 @@ public unsafe class UnmanagedDataReader : IGenericReader
 
     public TimeSpan AnchoredTimeShift { get; set; }
 
+    public DateTime AnchoredTimeOrigin { get; set; }
+
     /// <summary>
     /// Read bits of data raw from a serialized file using Little-endian.
     /// </summary>

dev-docs/serialization.md

@@ -261,14 +261,17 @@ Best for fields that are usually small values (counts, IDs, indexes).
 ### [AnchoredDateTime]
 
 **Target**: `DateTime` field
-**Effect**: Stores the absolute UTC instant; at load it is shifted forward by the downtime
-between the save and the load (using the save-start anchor in the save's index file), so
-server downtime does not consume the remaining time. `DateTime.MinValue`/`MaxValue`
+**Effect**: Stores the absolute UTC instant. At load, a value still in the future when the save
+started is shifted forward by the downtime between the save and the load (using the save-start
+anchor in the save's index file), so server downtime does not consume the remaining time. A
+value at or before the save start is loaded as saved: an expired deadline stays expired, and a
+"last happened at" stamp lets downtime count toward its window. `DateTime.MinValue`/`MaxValue`
 sentinels pass through unshifted.
 
-Prefer this for deadlines and "elapsed while running" values. Unlike `[DeltaDateTime]`, the
-stored bytes do not change on every save when the value is unchanged, keeping idle saves
-byte-stable.
+Use this for deadlines. A field that only records when something happened (a last-use stamp)
+never shifts, so it may equally be a plain `DateTime`. Unlike `[DeltaDateTime]`, the stored
+bytes do not change on every save when the value is unchanged, and only deadlines still running
+at save time change across a restart.
 
 ```csharp
 [AnchoredDateTime]