File Storage System

Ownership and transitions

Quota and expiry belong to the catalog as one state owner. Copy creates a second charged entry but preserves the source absolute expiry; resetting a relative TTL would extend its lifetime. Only explicit advanceTo expires files, and removal releases bytes once. Hash lookups are expected O(1); expiry scans O(files), search sorts matches. A snapshot cannot provide a writable path around accounting.

JavaScript boundaries

Use native classes with per-instance state and plain object/array snapshots. Object assignment shares a reference; copy retained inputs and every outward mutable container, including nested arrays. null means absence. Map handles arbitrary string keys safely, including "__proto__"; do not confuse a missing key with zero or an empty string. Domain validation uses RangeError. Numeric inputs must satisfy Number.isSafeInteger, so booleans, fractions, infinities, and NaN are invalid where an integer is required. All documented aggregate results and timestamp-plus-duration sums fit the safe-integer range. Strings use exact case-sensitive equality; lexical order compares JavaScript UTF-16 code units. Calls are serialized and synchronous.

const internal = ["initial"];
const snapshot = [...internal];
snapshot.length = 0;
console.assert(internal.length === 1);

A detached snapshot protects ownership; the service still has to validate and commit a coherent transition.