File Storage System

Ownership and transitions

Quota is derived accounting owned by the catalog, never a caller-editable counter. Copy charges size again and preserves absolute expiry; resetting TTL would extend lifetime incorrectly. Only explicit advanceTo expires entries, at expiresAt <= now, and each removal releases bytes once. Hash lookups are expected O(1); expiry scans O(files), search sorting O(matches log matches).

Java boundaries

Use the supplied nested records as immutable value carriers. A record is only shallowly immutable: copy every retained mutable input and every outward list/map, including lists inside records. Absence is null; validation failures use IllegalArgumentException, missing-key purchase errors use NoSuchElementException, and invalid transaction boundaries use IllegalStateException. Java primitive types already exclude booleans from numeric inputs. Numeric values use long where signatures say long and all computations must fit signed 64-bit values. Calls in these service exercises are serialized.

A copy inherits absolute expiration, not a fresh relative lifetime. Otherwise copying just before expiry would extend retention unexpectedly:

import java.util.*;

class Example {
    public static void main(String[] args) {
        long createdAt = 0, ttl = 5, copyTime = 2;
        long sourceExpiry = createdAt + ttl;
        long preservedExpiry = sourceExpiry;
        long wronglyResetExpiry = copyTime + ttl;
        assert preservedExpiry == 5;
        assert wronglyResetExpiry == 7;
    }
}

Both source and copy expire at 5, and both charge their own size until removed. Deleting one must not release the other bytes; repeated deletion must release nothing further.

Design boundary

Only advanceTo moves logical time, so passive get/search calls cannot unexpectedly change quota availability. The model stores metadata, not file bytes, and assumes serialized operations. Durable object storage, checksums, multipart uploads, and concurrent quota enforcement are separate concerns.