Java + Angular Full Stack — Explained Simply

How it works in code

• Encapsulation — make fields private, expose behaviour through methods. This protects your rules. A BankAccount keeps balance private so nobody outside can make it negative.
• Abstraction — an interface names what can be done, hiding how. PaymentGateway.charge(order) — the caller doesn't know it's Stripe or an internal ledger.
• Inheritance — a subclass reuses the parent. Useful, but overused; prefer composition.
• Polymorphism — one variable type, many actual behaviours at runtime.

// Polymorphism doing real work: adding a new rule means adding a bean,
// NOT editing an if/else chain somewhere.
public interface Validator { void validate(Request r); }

@Service
public class RequestService {
    private final List<Validator> validators;   // Spring injects ALL implementations

    public void handle(Request r) {
        for (Validator v : validators) v.validate(r);   // each one behaves differently
    }
}

The differences that actually matter

How I decide

• Am I describing a capability that unrelated classes may have? → interface (Auditable, PaymentGateway). Interfaces are also what makes code easy to mock in tests.
• Do subclasses genuinely share state and half the logic? → abstract class (e.g. AbstractJobRunner holding a retry counter and a template method).

The classic trick question

class A { void f(Object o){ System.out.println("A/Object"); } }
class B extends A { void f(String s){ System.out.println("B/String"); } }

A a = new B();
a.f("hi");     // prints "A/Object"  -- surprising!

Why? f(String) in B does not override f(Object) — it overloads it. Overload resolution happens at compile time, and at compile time the variable is declared as type A, which only has f(Object). So f(Object) is chosen and there's nothing to override at runtime.

Overriding rules

• Same signature; return type must be the same or a subtype (covariant).
• Access can widen (protected → public), never narrow.
• Cannot throw broader checked exceptions.
• private, static and final methods cannot be overridden (a static method is hidden, not overridden).

The contract

1. If a.equals(b) is true, then a.hashCode() == b.hashCode() must be true.
2. The reverse is not required — two different objects may share a hash code (a collision), and that's fine.

Break rule 1 and map.get(key) returns null for a key that is "present", and a Set quietly holds duplicates.

public final class Sku {
    private final String code;
    private final int rev;

    @Override public boolean equals(Object o){
        if (this == o) return true;                    // same object - fast path
        if (!(o instanceof Sku other)) return false;   // pattern matching (Java 16+)
        return rev == other.rev && code.equals(other.code);
    }

    @Override public int hashCode(){
        return Objects.hash(code, rev);                // SAME fields as equals()
    }
}
// Or just: public record Sku(String code, int rev) {}  -- both generated for you.

Why the designers made it immutable

• Security — a file path or JDBC URL cannot be changed after your security check has passed.
• Caching the hash — because the content never changes, the hash code is computed once and reused. That's why String is the ideal HashMap key.
• Thread safety for free — nothing can change, so nothing can race.
• Sharing (the pool) — sharing one instance across the whole JVM is only safe if it can't be mutated.

String a = "java";              // goes into the pool
String b = "java";              // SAME object from the pool
String c = new String("java");  // forced new object on the heap

a == b;            // true   (same reference)
a == c;            // false  (different objects)
a.equals(c);       // true   (same content)  <-- always compare with equals
a == c.intern();   // true   (intern() returns the pooled instance)

StringBuilder vs StringBuffer vs +

Using + inside a loop creates a new String on every iteration — O(n²) work and lots of garbage. Use StringBuilder (not synchronised, fast). StringBuffer is the old synchronised version and is almost never the right choice today.

// BAD in a loop
String s = ""; for (String x : list) s += x;          // creates n Strings

// GOOD
StringBuilder sb = new StringBuilder();
for (String x : list) sb.append(x);
String s = sb.toString();

public record OrderDto(String id, BigDecimal total, Instant placedAt) {

    // "compact constructor" - the place to put validation
    public OrderDto {
        if (total.signum() < 0) throw new IllegalArgumentException("total cannot be negative");
    }
}

OrderDto o = new OrderDto("O-1", new BigDecimal("99.00"), Instant.now());
o.total();                 // note: total(), not getTotal()
o.equals(otherDto);        // compares all fields - generated for you

Rules to remember

• All fields are final — the object is immutable.
• The class is implicitly final — you cannot extend a record.
• Accessors are named after the field (total()), not JavaBean style.

Use / don't use

Use for: DTOs, API request and response payloads, value objects like Money, map keys, returning multiple values from a method.

Don't use for: a JPA @Entity — Hibernate needs a no-arg constructor and mutable fields for dirty-checking and proxies.

Exact order when you call new Child() for the first time

1. Parent's static fields and static blocks — once ever.
2. Child's static fields and static blocks — once ever.
3. Parent's instance fields and instance blocks, then the parent constructor.
4. Child's instance fields and instance blocks, then the child constructor.

Steps 3–4 repeat for every object you create; steps 1–2 never repeat.

class Parent { Parent(){ init(); }  void init(){} }
class Child extends Parent {
    private String name = "abc";
    @Override void init(){ System.out.println(name.length()); }  // NullPointerException!
}

final int MAX = 10;              // value can't be reassigned
final void audit(){}             // method can't be overridden
final class Money {}             // class can't be extended

try { risky(); }
catch (Exception e) { log.error("failed", e); }
finally { cleanup(); }           // runs whether or not an exception was thrown

Why finalize() is dead — and what replaced it

You never knew when it would run (maybe never), it delayed garbage collection, and it could even resurrect a dying object. The modern replacements are try-with-resources for anything AutoCloseable, and java.lang.ref.Cleaner for native resources.

// resources are closed automatically, in REVERSE order, even if the body throws
try (var conn = ds.getConnection();
     var ps   = conn.prepareStatement(SQL)) {
    ps.executeQuery();
}   // no finally block needed

void mutate(List<String> list){
    list.add("x");              // caller SEES this - same object was modified
}

void reassign(List<String> list){
    list = new ArrayList<>();   // caller sees NOTHING - only the local copy changed
    list.add("y");
}

void changeNumber(int n){ n = 99; }   // caller sees nothing - primitives copy the value

The five rules

1. Make the class final (or use a record) so nobody can subclass and add mutability.
2. All fields private final.
3. No setters and no method that changes state.
4. Defensive copy mutable objects on the way in and on the way out.
5. Don't let this escape during construction (e.g. registering a listener in the constructor).

public final class Shipment {
    private final String id;
    private final List<String> items;
    private final Date dispatchedAt;

    public Shipment(String id, List<String> items, Date dispatchedAt){
        this.id = id;
        this.items = List.copyOf(items);              // COPY IN: caller can't modify our list
        this.dispatchedAt = new Date(dispatchedAt.getTime());   // Date is mutable - copy it
    }

    public List<String> items(){ return items; }      // already unmodifiable
    public Date dispatchedAt(){ return new Date(dispatchedAt.getTime()); }  // COPY OUT
}

Integer a = 127, b = 127;
System.out.println(a == b);     // true   - both come from the cache

Integer c = 128, d = 128;
System.out.println(c == d);     // false  - two separate objects!

System.out.println(c.equals(d)); // true  - ALWAYS use equals for wrappers

Two more autoboxing dangers

• NullPointerException on unboxing. Integer x = map.get("missing"); int y = x; → NPE, because null can't become an int. Very common with Map.get().
• Garbage in hot loops. Boxing a million values creates a million objects. Use IntStream/primitive arrays on hot paths.

class Screen {                       // imagine this holds 50MB of data
    class Listener { }               // INNER: secretly holds "Screen.this"
    static class Helper { }          // STATIC NESTED: holds nothing
}

// Memory leak: the registry keeps the Listener forever,
// so the 50MB Screen can never be collected.
registry.add(screen.new Listener());

The four kinds

• Static nested — default choice, no hidden reference.
• Inner (non-static) — only when it genuinely needs the outer instance.
• Anonymous — one-off implementation; mostly replaced by lambdas.
• Local — declared inside a method; captured variables must be effectively final.

A lambda is better than an anonymous class here: it does not create a class file per instance (it uses invokedynamic) and it only captures this if the body actually uses it.

// ARRAYS are covariant -> unsafe
Object[] arr = new String[2];
arr[0] = 42;              // compiles fine... throws ArrayStoreException at RUNTIME

// GENERICS are invariant -> safe
List<Object> list = new ArrayList<String>();   // COMPILE ERROR - caught immediately

Because generics are invariant, you need wildcards (? extends / ? super) to get flexibility back safely — that's the PECS question in the Collections section.

interface A { default String hi(){ return "A"; } }
interface B { default String hi(){ return "B"; } }

class C implements A, B {
    // Without this override, C does NOT compile.
    @Override public String hi(){ return A.super.hi(); }   // explicit choice
}

Resolution rules, in order

1. A method inherited from a class beats one from an interface.
2. The most specific sub-interface wins (if B extends A, B's version wins).
3. Otherwise → compile error, you must override and pick.

The BigDecimal trap you must know for any finance interview

new BigDecimal("1.0").equals(new BigDecimal("1.00"));       // FALSE! scale differs
new BigDecimal("1.0").compareTo(new BigDecimal("1.00")) == 0;  // true - use this

BigDecimal.equals() compares the value and the scale. For "is this the same amount of money", always use compareTo(...) == 0. This also means Set<BigDecimal> can hold both 1.0 and 1.00 as separate entries.

Decision table

Step by step: what put(key, value) does

1. Call key.hashCode().
2. Spread the bits: hash = h ^ (h >>> 16). This mixes the high bits down so that even a poor hashCode spreads across buckets.
3. Find the bucket: index = (table.length - 1) & hash. This works as a fast modulo because the table length is always a power of two.
4. Empty bucket → store it. Occupied → walk the chain, compare with equals(); replace if found, append if not.
5. If a single bucket's chain reaches 8 entries and the table is at least 64 long, that chain converts into a red-black tree (Java 8+). Worst case lookup goes from O(n) to O(log n). It converts back below 6.
6. When size > capacity × 0.75 (the load factor), the table doubles and entries are redistributed.

// simplified view of the index calculation
int h    = key.hashCode();
int hash = h ^ (h >>> 16);              // spread
int idx  = (table.length - 1) & hash;   // bucket index

How it actually works (Java 8+)

• Reads are lock-free. Nodes are volatile, so a reader always sees a consistent, published value.
• Writing into an empty bucket uses CAS (compare-and-set) — an atomic CPU instruction, no lock at all.
• Writing into an occupied bucket synchronises on that bucket's first node only.
• Resizing is cooperative — several threads help move buckets instead of one thread blocking everyone.
• size() uses a striped counter (like LongAdder) so counting doesn't become the bottleneck.

// atomic "read-modify-write" without any external lock
map.compute(key, (k, v) -> v == null ? 1 : v + 1);      // safe counter

// load-once cache idiom - only ONE thread runs the expensive load per key
map.computeIfAbsent(key, k -> expensiveLoad(k));

// LRU cache: capacity 100, evicts the least-recently-USED entry
Map<String, Data> lru = new LinkedHashMap<>(16, 0.75f, true) {   // true = access order
    @Override protected boolean removeEldestEntry(Map.Entry<String, Data> eldest){
        return size() > 100;
    }
};

How the detection works

The collection keeps a counter called modCount, incremented on every structural change. The iterator records that number when it starts and checks it on every next(). If it changed, it throws.

// WRONG - throws ConcurrentModificationException
for (String s : list) {
    if (s.isBlank()) list.remove(s);
}

// RIGHT - option 1: removeIf (clearest)
list.removeIf(String::isBlank);

// RIGHT - option 2: the iterator's own remove()
Iterator<String> it = list.iterator();
while (it.hasNext()) {
    if (it.next().isBlank()) it.remove();      // updates modCount correctly
}

// RIGHT - option 3: collect into a new list
List<String> kept = list.stream().filter(s -> !s.isBlank()).toList();

Fail-safe collections

CopyOnWriteArrayList and ConcurrentHashMap never throw this — they iterate over a snapshot or tolerate concurrent updates. The trade-off is that you may not see the very latest data.

// Comparable: built into the class
public class Employee implements Comparable<Employee> {
    public int compareTo(Employee o){ return this.id.compareTo(o.id); }  // natural order
}

// Comparator: chained, readable, null-safe
employees.sort(
    Comparator.comparing(Employee::getDepartment)                    // 1st key
              .thenComparing(Employee::getSalary, Comparator.reverseOrder())  // 2nd, desc
              .thenComparing(Employee::getName, String.CASE_INSENSITIVE_ORDER));

// handle possible nulls
Comparator<Employee> byManager =
    Comparator.comparing(Employee::getManager, Comparator.nullsLast(Comparator.naturalOrder()));

Why ArrayList usually wins even for inserts

Shifting elements in an ArrayList uses System.arraycopy, a highly optimised block memory move — extremely fast. LinkedList's nodes are scattered across the heap, so every step is a potential CPU cache miss, and every element costs two extra pointers of memory.

What erasure costs you

• No new T() and no new T[10] — the type isn't known at runtime.
• No x instanceof List<String> — only instanceof List.
• You cannot overload f(List<String>) and f(List<Integer>) — after erasure both are f(List), a duplicate method.
• No primitives as type arguments — hence IntStream, Integer boxing, etc.

// Getting the type back at runtime: pass a token
<T> T read(String json, Class<T> type){ return mapper.readValue(json, type); }

// Or capture the full generic type via an anonymous subclass (what Jackson/Spring do)
new TypeReference<List<OrderDto>>() {};
new ParameterizedTypeReference<List<OrderDto>>() {};

// copies FROM a producer INTO a consumer
static <T> void copy(List<? extends T> source, List<? super T> dest){
    for (T item : source) dest.add(item);
}

List<Integer> ints  = List.of(1, 2, 3);
List<Number>  nums  = new ArrayList<>();
copy(ints, nums);        // works ONLY because of the wildcards

// Why you can't add to "? extends"
List<? extends Number> l = new ArrayList<Integer>();
l.add(3.14);             // COMPILE ERROR - it might be a List<Integer>

You'll recognise this in the JDK: Collections.copy(List<? super T> dest, List<? extends T> src) and Stream.map(Function<? super T, ? extends R>).

// TRAP 1: fixed size
List<String> l = Arrays.asList("a","b");
l.add("c");                       // UnsupportedOperationException

// TRAP 2: primitive array becomes a list of ONE element
int[] nums = {1,2,3};
List<int[]> wrong = Arrays.asList(nums);           // size 1 !!
List<Integer> right = Arrays.stream(nums).boxed().toList();   // size 3

// Need a modifiable list from a fixed one:
List<String> modifiable = new ArrayList<>(List.of("a","b"));

// 1. BEST - concurrent collections
Map<K,V> m = new ConcurrentHashMap<>();
List<Listener> ls = new CopyOnWriteArrayList<>();   // many reads, rare writes
BlockingQueue<Task> q = new ArrayBlockingQueue<>(1000);

// 2. Immutable - publish a new instance instead of mutating
List<String> safe = List.copyOf(source);

// 3. Synchronized wrapper - coarse, and iteration still needs manual locking!
List<String> sync = Collections.synchronizedList(new ArrayList<>());
synchronized (sync) { for (String s : sync) { ... } }   // REQUIRED, easy to forget

// STILL A RACE even on ConcurrentHashMap:
if (!map.containsKey(k)) map.put(k, v);      // two threads can both pass the check

// Correct - one atomic operation:
map.putIfAbsent(k, v);
map.computeIfAbsent(k, key -> build(key));

// Spliterator's key method
Spliterator<String> s1 = list.spliterator();
Spliterator<String> s2 = s1.trySplit();     // s1 keeps half, s2 gets the other half

Spliterator also reports characteristics (SIZED, ORDERED, DISTINCT, IMMUTABLE) that let the stream engine skip work — for example, if the source is already DISTINCT, .distinct() becomes free.

// Before Java 8
list.sort(new Comparator<String>() {
    @Override public int compare(String a, String b){ return a.length() - b.length(); }
});

// With a lambda - identical meaning
list.sort((a, b) -> Integer.compare(a.length(), b.length()));

// With a method reference - shorter still
list.sort(Comparator.comparingInt(String::length));

The built-in ones you use daily

They compose: p1.and(p2), p.negate(), f.andThen(g).

String::toUpperCase      // 1. instance method of whatever object arrives
System.out::println      // 2. instance method of ONE specific object
Integer::parseInt        // 3. static method
ArrayList::new           // 4. constructor
String[]::new            // bonus: array constructor, used in toArray()

List.of("a", "bb", "ccc").stream()
    .peek(s -> System.out.println("looking at " + s))
    .filter(s -> s.length() > 1)
    .findFirst();

// OUTPUT:
// looking at a
// looking at bb        <-- stops here! "ccc" is never touched

Notice each element flows through all the steps before the next element starts — the stream does not do "all the filtering, then all the mapping".

List<Order> orders = ...;          // each Order has List<OrderLine> lines

// map -> a stream of LISTS (usually not what you want)
List<List<OrderLine>> nested = orders.stream().map(Order::getLines).toList();

// flatMap -> a single flat stream of all lines
List<String> allSkus = orders.stream()
        .flatMap(o -> o.getLines().stream())   // 1 order -> many lines, flattened
        .map(OrderLine::getSku)               // 1 line -> 1 sku
        .distinct()
        .sorted()
        .toList();

// Optional has it too - avoids Optional<Optional<String>>
Optional<String> city = findUser(id).flatMap(User::getAddress).map(Address::getCity);

// 1. Group employees by department -> Map<String, List<Employee>>
Map<String, List<Employee>> byDept =
    emps.stream().collect(groupingBy(Employee::getDept));

// 2. Group and COUNT -> Map<String, Long>
Map<String, Long> countByDept =
    emps.stream().collect(groupingBy(Employee::getDept, counting()));

// 3. Group and keep only names -> Map<String, List<String>>
Map<String, List<String>> namesByDept =
    emps.stream().collect(groupingBy(Employee::getDept,
                          mapping(Employee::getName, toList())));

// 4. Group into a SORTED map and sum salaries
Map<String, BigDecimal> salaryByDept =
    emps.stream().collect(groupingBy(Employee::getDept, TreeMap::new,
        reducing(BigDecimal.ZERO, Employee::getSalary, BigDecimal::add)));

// 5. Split into exactly two groups by a yes/no test
Map<Boolean, List<Employee>> split =
    emps.stream().collect(partitioningBy(e -> e.getSalary().doubleValue() > 50000));

// 6. Build a Map keyed by something unique
Map<String, Employee> byEmail = emps.stream()
    .collect(toMap(Employee::getEmail,
                   e -> e,
                   (existing, duplicate) -> existing,   // what to do on a duplicate key
                   LinkedHashMap::new));                 // which Map implementation

// 7. Statistics and joining
IntSummaryStatistics stats = emps.stream().mapToInt(Employee::getAge).summaryStatistics();
// stats.getMin() / getMax() / getAverage() / getSum() / getCount()
String csv = emps.stream().map(Employee::getName).collect(joining(", ", "[", "]"));

// reduce - immutable, produces a new BigDecimal at each step
BigDecimal total = lines.stream()
        .map(Line::getAmount)
        .reduce(BigDecimal.ZERO, BigDecimal::add);

// collect - mutable container, no intermediate objects
String names = emps.stream().map(Employee::getName).collect(joining(", "));

Use it when — all of these are true

• The data set is large (roughly 10,000+ elements).
• The work per element is CPU-heavy (calculation, parsing), not waiting on I/O.
• The source splits evenly — array, ArrayList, IntStream.range.
• Your lambda has no shared mutable state and no side effects.
• Combining results is cheap.

Don't use it when

• The work is a database call or an HTTP call (blocking). You'd starve the shared pool.
• N is small — the coordination overhead costs more than it saves.
• The source is a LinkedList, Files.lines, or Stream.iterate — these split badly.
• You're already inside a web request being served by 200 concurrent threads — you already have parallelism.

// If you must parallelise blocking work, use your OWN pool - never the common one
ForkJoinPool pool = new ForkJoinPool(8);
List<Result> out = pool.submit(() ->
        ids.parallelStream().map(client::fetch).toList()).get();
pool.shutdown();

// Better in Java 21: virtual threads
try (var exec = Executors.newVirtualThreadPerTaskExecutor()) { ... }

// Chain safely - no null checks anywhere
String city = repo.findById(id)
        .map(User::getAddress)
        .map(Address::getCity)
        .filter(c -> !c.isBlank())
        .orElse("Unknown");

// Throw a meaningful exception when absent
Order o = repo.findById(id).orElseThrow(() -> new OrderNotFoundException(id));

// Two branches
repo.findById(id).ifPresentOrElse(this::process, this::handleMissing);

opt.orElse(expensiveDefault());     // expensiveDefault() runs ALWAYS, even if present
opt.orElseGet(() -> expensiveDefault());  // runs only when empty

Where NOT to use it

• As a field — it isn't Serializable and adds an object per field.
• As a method parameter — use an overload instead.
• In entities or JSON DTOs.
• Calling .get() without checking — that's just a NullPointerException with extra steps.

// Old world: bounded pool, blocking = wasted thread
ExecutorService old = Executors.newFixedThreadPool(200);

// New world: one virtual thread per task, blocking is cheap
try (var exec = Executors.newVirtualThreadPerTaskExecutor()) {
    List<Future<Report>> futures = ids.stream()
        .map(id -> exec.submit(() -> reportClient.fetch(id)))   // blocking call - fine!
        .toList();
}   // close() waits for all tasks to finish

// Spring Boot 3.2+ - one property makes Tomcat use virtual threads
// spring.threads.virtual.enabled=true

Why this changes architecture

The reason teams adopted reactive frameworks like WebFlux was to avoid blocking threads. Virtual threads give you that scalability with ordinary, readable, debuggable imperative code — normal stack traces, normal debugger, normal try/catch.

public sealed interface PaymentEvent
        permits Authorised, Captured, Refunded, Failed { }

public record Authorised(String txnId, BigDecimal amount) implements PaymentEvent {}
public record Failed(String txnId, String reason)         implements PaymentEvent {}

String describe(PaymentEvent e) {
    return switch (e) {                                    // no 'default' needed
        case Authorised a when a.amount().signum() == 0 -> "zero-value auth";
        case Authorised a  -> "authorised " + a.amount();
        case Captured  c   -> "captured";
        case Refunded  r   -> "refunded";
        case Failed(String id, String reason) -> "failed: " + reason;  // record pattern
    };
}

Notice three modern features together: pattern matching (case Authorised a — no cast needed), guards (when), and record deconstruction (Failed(String id, String reason) pulls the fields out directly).

// switch EXPRESSION - returns a value, no break, no fall-through bugs
int days = switch (month) {
    case FEB -> isLeapYear ? 29 : 28;
    case APR, JUN, SEP, NOV -> 30;
    default -> 31;
};

// text block - what you write is what you get
String sql = """
        SELECT o.id, o.total
          FROM orders o
         WHERE o.status = :status
         ORDER BY o.created_at DESC
        """;

Other additions worth naming

// Collections (immutable)   Java 9
List.of(), Set.of(), Map.of(), List.copyOf(c)

// String                    Java 11
" x ".strip();  "".isBlank();  "ab".repeat(3);  text.lines().toList();

// Stream                    Java 9-16
stream.takeWhile(p);  stream.dropWhile(p);  stream.toList();  Stream.ofNullable(x);

// Optional
opt.or(() -> other);  opt.ifPresentOrElse(a, b);  opt.stream();

// Files / HttpClient        Java 11
Files.readString(path);   HttpClient.newHttpClient().send(req, ofString());

// Sequenced collections     Java 21
list.getFirst();  list.getLast();  list.reversed();  map.firstEntry();

// var                       Java 10 - local variables only, still statically typed
var repo = new CustomerRepository();

try (var scope = new StructuredTaskScope.ShutdownOnFailure()) {
    Subtask<User>  user  = scope.fork(() -> userService.find(id));
    Subtask<Perms> perms = scope.fork(() -> permService.find(id));

    scope.join();              // wait for both
    scope.throwIfFailed();     // if either failed, the OTHER is cancelled automatically

    return new Profile(user.get(), perms.get());
}

Compare with the old pattern: submit two futures, remember to cancel the second in a finally, and handle two separate exception paths. Most codebases got that wrong.

Detail worth knowing

• The heap is split into Young (Eden + two Survivor spaces) and Old. New objects start in Eden.
• Each thread's stack is about 1MB by default. Deep recursion → StackOverflowError.
• Metaspace replaced PermGen in Java 8. It grows until -XX:MaxMetaspaceSize, so a classloader leak now exhausts native memory instead of PermGen.

Why generations exist

The weak generational hypothesis: most objects die very young (a DTO created and discarded inside one request). So the JVM optimises for that:

1. New objects go into Eden — allocation is just moving a pointer, extremely fast.
2. Eden fills up → Minor GC. Surviving objects are copied to a Survivor space and their age increases. Everything else is discarded wholesale — cheap, because most objects died.
3. An object that survives enough rounds is promoted to the Old generation.
4. Old fills up → Major/Full GC: mark, sweep, compact. Much more expensive, longer pause.

Step 1 — read the message

Step 2 — always have evidence configured in advance

-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/dumps
-Xlog:gc*:file=/var/log/gc.log:time,uptime:filecount=5,filesize=20M
-XX:+ExitOnOutOfMemoryError        # let the orchestrator restart a poisoned JVM

Step 3 — leak or just undersized?

Plot old-generation occupancy immediately after each Full GC. A sawtooth that returns to the same baseline = healthy, just under pressure. A staircase that keeps climbing = a leak.

Step 4 — find the culprit

Open the heap dump in Eclipse MAT → Leak Suspects report → dominator tree → pick the biggest retained set → right-click "Path to GC Roots" — that tells you exactly which object is refusing to let go.

Practical consequences

• Class identity = fully-qualified name + classloader. The same class loaded by two loaders is two different types → a baffling ClassCastException saying Foo cannot be cast to Foo.
• ClassNotFoundException = the class was never found (usually a missing jar).
  NoClassDefFoundError = it was found once but is unusable now — most often its static initializer threw earlier, which is a very common cause of confusing startup failures.
• Frameworks deliberately break delegation: Tomcat uses child-first per webapp for isolation, and Spring Boot's LaunchedURLClassLoader reads nested jars inside the fat jar.

What it does

• Tiered compilation: C1 compiles quickly with light optimisation, then C2 recompiles the hottest methods aggressively.
• Inlining (removing call overhead), loop unrolling, escape analysis (an object that never leaves a method may be allocated on the stack or eliminated entirely), lock elision.
• Deoptimization: C2 speculates ("this call site is always an ArrayList"). If a different type appears, it throws away the compiled code and falls back to the interpreter.

class Worker {
    private volatile boolean running = true;   // without volatile this loop may NEVER exit

    public void stop(){ running = false; }
    public void loop(){ while (running) { doWork(); } }
}

happens-before — the rules that create guarantees

• Statements within a single thread, in program order.
• Releasing a lock happens-before any later acquisition of the same lock.
• A volatile write happens-before every later read of that variable.
• Thread.start() happens-before everything the new thread does.
• Everything a thread does happens-before another thread's successful join().
• final fields are safely published at the end of the constructor.

My order

1. Dashboards first (Micrometer → Prometheus → Grafana): is it CPU, GC, thread-pool saturation, DB pool, or a downstream? Alert on p99, never on the average.
2. Thread dump — jcmd <pid> Thread.print, three dumps 10 seconds apart. Many threads stuck in the same frame = your bottleneck.
3. GC log — pause frequency and duration, old-gen trend.
4. JFR + JDK Mission Control — near-zero-overhead profiling you can safely enable in production: jcmd <pid> JFR.start settings=profile duration=120s filename=x.jfr.
5. async-profiler — CPU and allocation flame graphs without safepoint bias.
6. Eclipse MAT — for heap dumps.
7. Distributed tracing (OpenTelemetry) when more than one service is involved.

Reading a thread dump

• BLOCKED + "waiting to lock <0x...>" → find who owns that monitor.
• "Found one Java-level deadlock" → the JVM has told you outright.
• WAITING on getTask() = an idle pool thread, harmless.
• Thread count growing between dumps = a thread leak.

Symptom: a 400ms stall, but the GC log shows nothing unusual. Enable -Xlog:safepoint and look at "time to safepoint".

How to create work, worst to best

1. extends Thread — wastes your one inheritance slot. Avoid.
2. implements Runnable — better, but you're still managing threads by hand.
3. Callable + ExecutorService — pooled, returns a value, handles exceptions.
4. CompletableFuture — composable async pipelines.
5. Virtual threads / structured concurrency (Java 21) — cheap thread-per-task.

// ReentrantLock - ALWAYS this exact shape
lock.lock();
try {
    // critical section
} finally {
    lock.unlock();      // if this isn't in finally, an exception deadlocks your app
}

// tryLock to avoid waiting forever
if (lock.tryLock(2, TimeUnit.SECONDS)) {
    try { ... } finally { lock.unlock(); }
} else {
    metrics.increment("lock.timeout");   // degrade gracefully instead of hanging
}

// volatile: a stop flag - visibility only
private volatile boolean running = true;

// atomic: a counter - atomic read-modify-write, no lock
private final AtomicInteger hits = new AtomicInteger();
hits.incrementAndGet();
hits.updateAndGet(v -> Math.min(v + 1, MAX));

// LongAdder: better than AtomicLong under HIGH contention (striped internally)
private final LongAdder requests = new LongAdder();
requests.increment();

// lock: an invariant across TWO fields
synchronized void transfer(int amt){ this.from -= amt; this.to += amt; }

How CAS works — the mental model

int prev, next;
do {
    prev = value.get();
    next = compute(prev);
} while (!value.compareAndSet(prev, next));   // retry if someone else changed it first

Mentioning the ABA problem earns credit: a value changes A→B→A, so CAS thinks nothing happened. AtomicStampedReference adds a version stamp to detect it.

ThreadPoolExecutor pool = new ThreadPoolExecutor(
    8, 16,                                  // core, max threads
    60L, TimeUnit.SECONDS,                  // idle timeout for threads above core
    new ArrayBlockingQueue<>(1000),         // BOUNDED - this is the important part
    new CustomizableThreadFactory("report-"),   // NAMED threads - readable dumps
    new ThreadPoolExecutor.CallerRunsPolicy()); // when full, the submitter runs it
                                                // -> automatic back-pressure

Sizing

• CPU-bound work: roughly cores + 1.
• I/O-bound: cores × (1 + waitTime / serviceTime).
• In practice: size it to the downstream limit. If the DB pool allows 20 connections, 200 threads just means 180 threads queueing.

Shutdown

pool.shutdown();                                     // stop accepting new tasks
if (!pool.awaitTermination(30, TimeUnit.SECONDS))    // let running tasks finish
    pool.shutdownNow();                              // then interrupt them

CompletableFuture<Profile> profile =
    CompletableFuture.supplyAsync(() -> userClient.get(id), ioPool)      // task 1
        .thenCombine(                                                    // run in parallel
            CompletableFuture.supplyAsync(() -> prefClient.get(id), ioPool),
            Profile::new)                                                // merge results
        .orTimeout(2, TimeUnit.SECONDS)                                  // give up after 2s
        .exceptionally(ex -> Profile.fallback(id));                      // graceful degrade

// wait for several
CompletableFuture.allOf(f1, f2, f3).join();

The methods worth memorising

Prevention — break the circular wait

The most reliable fix is a global lock ordering: always acquire locks in the same order, everywhere.

// DEADLOCK-PRONE: transfer(a,b) and transfer(b,a) at the same time
synchronized (from) { synchronized (to) { ... } }

// SAFE: always lock the lower account id first
void transfer(Account a, Account b, BigDecimal amt){
    Account first  = a.getId() < b.getId() ? a : b;
    Account second = a.getId() < b.getId() ? b : a;
    synchronized (first) {
        synchronized (second) { a.debit(amt); b.credit(amt); }
    }
}

Other prevention: use tryLock with a timeout and back off; hold locks for as short a time as possible; never call unknown/foreign code while holding a lock (it might take another lock).

Detection

jcmd <pid> Thread.print        # prints "Found one Java-level deadlock" with both stacks

Related terms: livelock (threads keep reacting to each other but make no progress) and starvation (one thread never gets its turn).

// THE PRACTICAL ANSWER
BlockingQueue<Task> queue = new ArrayBlockingQueue<>(100);

// producer
queue.put(task);      // blocks if full  -> natural back-pressure

// consumer
Task t = queue.take(); // blocks if empty -> no busy-waiting

// THE "SHOW ME WAIT/NOTIFY" ANSWER
synchronized (lock) {
    while (buffer.isEmpty()) {     // WHILE, not if
        lock.wait();               // releases the lock and sleeps
    }
    Task t = buffer.poll();
    lock.notifyAll();              // wake producers waiting for space
}

Also: wait() releases the monitor; Thread.sleep() does not — sleeping while holding a lock blocks everyone.

// Latch: main thread waits for 5 init tasks
CountDownLatch ready = new CountDownLatch(5);
// worker: ready.countDown();
ready.await();

// Semaphore: never more than 10 concurrent calls to a fragile downstream
Semaphore permits = new Semaphore(10);
permits.acquire();
try { legacyClient.call(); } finally { permits.release(); }   // release in finally!

// 1. BEST - enum. Thread-safe, and immune to reflection and serialization attacks.
public enum Config { INSTANCE; public String url(){ return "..."; } }

// 2. Holder idiom - lazy, no synchronization after initialization.
public class Config {
    private Config(){}
    private static class Holder { static final Config INSTANCE = new Config(); }
    public static Config get(){ return Holder.INSTANCE; }   // JVM guarantees class init is thread-safe
}

// 3. Double-checked locking - 'volatile' is MANDATORY
public class Config {
    private static volatile Config instance;
    public static Config get(){
        Config local = instance;              // read the volatile once (small optimisation)
        if (local == null) {
            synchronized (Config.class) {
                local = instance;
                if (local == null) instance = local = new Config();
            }
        }
        return local;
    }
}

// Typical use: a non-thread-safe formatter, one per thread
private static final ThreadLocal<SimpleDateFormat> FMT =
        ThreadLocal.withInitial(() -> new SimpleDateFormat("yyyy-MM-dd"));

try {
    return FMT.get().format(date);
} finally {
    FMT.remove();     // essential in a pooled thread
}

You already use it indirectly: Spring's SecurityContextHolder, SLF4J's MDC for correlation ids, and the JPA EntityManager binding.

The three dangers

• Memory leak in pooled threads if you never remove() (see the references question).
• It does not propagate to threads you spawn — an @Async method loses the security context and the trace id unless you use a TaskDecorator or Spring's delegating executors.
• With millions of virtual threads, per-thread copies become expensive — Java 21's ScopedValue is the successor.

try {
    queue.take();
} catch (InterruptedException e) {
    Thread.currentThread().interrupt();   // RESTORE the flag you just consumed
    return;                               // then stop, or rethrow
}

// In a long loop, check periodically
while (!Thread.currentThread().isInterrupted()) { processChunk(); }

My position for a Spring service

Use unchecked for almost everything. That's the direction the ecosystem went too: Spring deliberately wraps SQLException (checked) into the unchecked DataAccessException hierarchy, and @Transactional rolls back on unchecked exceptions by default. Use checked only when the caller has a genuinely different recovery path.

Rules I enforce in review

• Never catch (Exception e) {} — an empty catch block is a blocker.
• Never throws Exception on a public API.
• Always preserve the cause: throw new OrderFailedException("id=" + id, e).
• Log or rethrow, not both — double logging makes production noise.
• Throw domain exceptions from the service layer (InsufficientFundsException), not technical ones.
• Don't use exceptions for control flow — building a stack trace is expensive.

// This method NEVER throws, and always returns 2. The exception disappears.
int broken(){
    try { throw new RuntimeException("boom"); }
    finally { return 2; }
}

This is exactly why try-with-resources exists: if both the body and close() throw, it keeps the original exception and attaches the other as a suppressed exception (e.getSuppressed()) instead of losing it.

Concrete examples

• SRP violation: a ReportService that queried the DB, formatted HTML and sent email. A template change risked breaking the SQL. Split into three classes.
• OCP violation: a growing switch (paymentType). Replaced with a Map<PaymentType, PaymentHandler> assembled from injected beans — adding a payment type became adding a class.
• LSP violation: a ReadOnlyList subclass that threw on add(). Anything expecting a List broke.
• DIP: this is literally what Spring DI gives you — and it's why unit tests don't need a database.

// Open/Closed via Spring DI - the OCP fix in real code
public interface PaymentHandler { PaymentType type(); void handle(Payment p); }

@Service
public class PaymentRouter {
    private final Map<PaymentType, PaymentHandler> handlers;

    public PaymentRouter(List<PaymentHandler> all){          // Spring injects every impl
        this.handlers = all.stream().collect(toMap(PaymentHandler::type, h -> h));
    }
    public void route(Payment p){
        handlers.getOrDefault(p.getType(), unsupported).handle(p);
    }
}

Java's own Stack extends Vector is the standard cautionary tale: because it inherited everything, stack.insertElementAt(0, x) is legal and breaks LIFO semantics entirely.

// Client sends a unique key; the server stores it and returns the SAME result on a repeat
@PostMapping("/payments")
ResponseEntity<PaymentDto> pay(@RequestHeader("Idempotency-Key") String key,
                              @RequestBody PayRequest req){

    Optional<IdempotentResult> existing = store.find(key);
    if (existing.isPresent()) return ok(existing.get().response());   // replay, don't re-charge

    PaymentDto result = service.charge(req);
    store.save(key, result);       // unique constraint on 'key' makes this race-safe
    return ok(result);
}

For Kafka consumers: make the handler naturally idempotent (upsert by business key) or record processed event ids in the same transaction as the state change.

My concrete checklist

• Names state intent; no data, tmp, process().
• A method does one thing at one level of abstraction.
• Guard clauses instead of nested if pyramids.
• No magic numbers or strings.
• Return empty collections, not null.
• No business logic in controllers.
• Tests assert behaviour, not implementation.
• Logs carry a correlation id and no PII or secrets.
• The pull request is small enough to review properly (<400 lines).

@Service
public class OrderService {
    private final OrderRepository repo;      // final = guaranteed set, never reassigned
    private final PricingClient pricing;

    // Constructor injection - no @Autowired needed for a single constructor
    public OrderService(OrderRepository repo, PricingClient pricing) {
        this.repo = repo;
        this.pricing = pricing;
    }
}

// In a unit test - no Spring, no database, instant
var service = new OrderService(mockRepo, mockPricing);

Why constructor injection, always

• Dependencies can be final → immutable, thread-safe.
• The object is never in a half-built state.
• Missing beans fail at startup, not on the first request at 3am.
• A constructor with 8 parameters is visibly ugly — it tells you the class does too much. Field injection hides that.
• You can construct it in a plain unit test without a Spring context.

The pipeline

1. Bean definitions loaded (component scan, @Bean methods). BeanFactoryPostProcessors can still edit the definitions — this is where ${property} placeholders get resolved.
2. Instantiate the object.
3. Inject dependencies.
4. *Aware callbacks (ApplicationContextAware, etc.).
5. BeanPostProcessor.postProcessBeforeInitialization
6. @PostConstruct → afterPropertiesSet() → custom initMethod
7. BeanPostProcessor.postProcessAfterInitialization ← AOP proxies are created HERE, wrapping your bean
8. Bean is in use.
9. Shutdown: @PreDestroy → destroy() → custom destroyMethod (singletons only — Spring does not destroy prototypes).

@Configuration
public class ClientConfig {
    @Bean                                              // third-party class - can't annotate it
    RestClient pricingClient(RestClient.Builder b, @Value("${pricing.url}") String url){
        return b.baseUrl(url).build();
    }
}

The differences that are real

• @Repository adds exception translation — vendor-specific persistence exceptions become Spring's DataAccessException hierarchy, so your service layer isn't coupled to Hibernate or JDBC error codes.
• @RestController = @Controller + @ResponseBody, and it's what the MVC handler mapping looks for.
• The layer annotations also let you write AOP pointcuts per layer.

Step by step

1. @SpringBootApplication = @SpringBootConfiguration + @ComponentScan + @EnableAutoConfiguration.
2. @EnableAutoConfiguration imports a selector that reads a list of candidate config classes from every jar's META-INF/spring/…AutoConfiguration.imports file.
3. Each candidate is filtered by conditions: @ConditionalOnClass (is this library present?), @ConditionalOnMissingBean (did the user already define one?), @ConditionalOnProperty, @ConditionalOnWebApplication.
4. Auto-configurations are processed after your beans, so your bean always wins.

# See exactly what matched and, more usefully, what did NOT match and why
java -jar app.jar --debug          # prints the CONDITIONS EVALUATION REPORT
# or, at runtime:  GET /actuator/conditions

# turn one off
@SpringBootApplication(exclude = DataSourceAutoConfiguration.class)

// Type-safe config - validated at STARTUP, not on first use
@ConfigurationProperties(prefix = "pricing")
@Validated
public record PricingProps(
    @NotBlank String url,
    @Positive int timeoutMs,
    boolean cacheEnabled) {}

// application.yml
pricing:
  url: https://pricing.internal
  timeout-ms: 2000        # relaxed binding: timeout-ms -> timeoutMs

I prefer this over scattered @Value("${...}") because it's type-safe, validated, grouped, documented and easy to inject into a test.

Property precedence (highest wins)

1. Command-line arguments
2. SPRING_APPLICATION_JSON
3. OS environment variables (how Kubernetes injects config)
4. External application-{profile}.yml next to the jar
5. Packaged application-{profile}.yml
6. Packaged application.yml

@Aspect @Component
public class AuditAspect {

    @Around("@annotation(audited)")          // applies to any method annotated @Audited
    public Object audit(ProceedingJoinPoint pjp, Audited audited) throws Throwable {
        long start = System.nanoTime();
        try {
            Object result = pjp.proceed();   // call the real method
            log.info("op={} status=OK ms={}", audited.value(), ms(start));
            return result;
        } catch (Exception e) {
            log.warn("op={} status=FAIL err={}", audited.value(), e.toString());
            throw e;
        }
    }
}

Vocabulary: aspect (the class), join point (a method execution), pointcut (the expression selecting which ones), advice (@Before, @After, @Around, @AfterThrowing).

@Service
public class OrderService {
    public void placeAll(List<Order> orders){
        orders.forEach(this::place);      // 'this' bypasses the proxy!
    }                                     // -> @Transactional on place() does NOTHING

    @Transactional
    public void place(Order o){ ... }
}
// Fixes: move place() to another bean, inject self with @Lazy,
// use AopContext.currentProxy(), or use AspectJ weaving.

Spring Boot defaults to CGLIB (proxyTargetClass=true) so proxying works whether or not you wrote an interface. Consequences: you can inject by concrete type, but final classes/methods can't be advised, and you shouldn't rely on field state read through the proxy.

Fix in this order

1. Redesign — extract the shared logic into a third bean, or publish an application event so A doesn't need to call B directly. This is nearly always the right answer; a cycle is a layering smell.
2. @Lazy on one side — Spring injects a proxy and resolves the real bean on first use.
3. Setter injection.
4. spring.main.allow-circular-references=true — an escape hatch to unblock a release, not a fix.

public interface NotificationSender { String channel(); void send(Msg m); }

@Component class EmailSender implements NotificationSender { ... }
@Component @Primary class SmsSender implements NotificationSender { ... }

@Service
class AlertService {
    // explicit choice wins over @Primary
    AlertService(@Qualifier("emailSender") NotificationSender sender) { }
}

// Inject ALL implementations - this is the Strategy pattern, for free
@Service
class Fanout {
    private final Map<String, NotificationSender> byChannel;
    Fanout(List<NotificationSender> all){
        this.byChannel = all.stream().collect(toMap(NotificationSender::channel, s -> s));
    }
}

Resolution order: @Qualifier → @Primary → a bean whose name matches the parameter name → otherwise NoUniqueBeanDefinitionException.

management.endpoints.web.exposure.include=health,info,prometheus,loggers
management.endpoint.health.probes.enabled=true       # liveness + readiness groups
management.server.port=9090                          # separate port, not publicly routed

@Component
class PricingHealthIndicator implements HealthIndicator {
    public Health health(){
        try { client.ping(); return Health.up().withDetail("latencyMs", ms).build(); }
        catch (Exception e){ return Health.down(e).build(); }
    }
}

@Service
class OrderService {
    private final Counter placed;
    private final Timer   latency;

    OrderService(MeterRegistry registry){
        placed  = Counter.builder("orders.placed").tag("channel", "web").register(registry);
        latency = Timer.builder("orders.latency").publishPercentileHistogram().register(registry);
    }
    public void place(Order o){ latency.record(() -> { doPlace(o); placed.increment(); }); }
}

@EnableScheduling @EnableAsync
@Configuration
class AsyncConfig {
    @Bean("reportExecutor")
    Executor reportExecutor(){
        var e = new ThreadPoolTaskExecutor();
        e.setCorePoolSize(4); e.setMaxPoolSize(8); e.setQueueCapacity(500);
        e.setThreadNamePrefix("report-");
        e.setWaitForTasksToCompleteOnShutdown(true);
        e.setAwaitTerminationSeconds(30);
        e.initialize();
        return e;
    }
}

@Scheduled(cron = "0 0 2 * * *", zone = "Asia/Kolkata")   // 2am daily
void nightlyReconcile(){ ... }

@Async("reportExecutor")
CompletableFuture<Report> build(long id){ ... }

The four states

@Transactional
public void markShipped(long id){
    Order order = repo.findById(id).orElseThrow();   // now MANAGED
    order.setStatus(SHIPPED);                        // just change the field
}   // at commit, Hibernate compares with the snapshot and issues UPDATE. No save() needed.

Order managed = em.merge(detached);    // use 'managed', not 'detached', afterwards

Four fixes — know all of them

// 1. JOIN FETCH - one query, best for a single collection
@Query("select distinct o from Order o join fetch o.lines where o.status = :s")
List<Order> findWithLines(@Param("s") Status s);

// 2. Entity graph - declarative, works with Spring Data derived queries
@EntityGraph(attributePaths = {"lines", "customer"})
List<Order> findByStatus(Status s);

// 3. Batch fetching - turns 100 queries into 2 (IN clauses of 50)
@BatchSize(size = 50)
private List<OrderLine> lines;
// or globally:
// spring.jpa.properties.hibernate.default_batch_fetch_size=50

// 4. DTO projection - fetch ONLY the columns the screen needs (usually fastest)
@Query("""
       select new com.acme.OrderSummary(o.id, o.total, c.name)
       from Order o join o.customer c where o.status = :s
       """)
List<OrderSummary> summaries(@Param("s") Status s);

How to detect it

show-sql isn't enough — you can't count 400 lines by eye. I use Hibernate statistics or a query-counting proxy (datasource-proxy / p6spy), and I put a query-count assertion in the integration test:

assertThat(queryCounter.getSelectCount()).isEqualTo(2);   // fails the build if N+1 returns

Why EAGER is harmful

• It loads on every query of that entity, even when you only wanted the id.
• It compounds: an eager chain Order → Customer → Address → Country can pull half the database for one lookup.
• It makes performance unpredictable, because the cost is hidden in the mapping rather than the query.

The LazyInitializationException, and the wrong fix

If you access a lazy field after the transaction has closed, you get LazyInitializationException. The tempting fix is spring.jpa.open-in-view=true (on by default in Boot!), which keeps the session open for the entire HTTP request.

That's the wrong fix because it (a) hides N+1 queries — they now happen during JSON serialization, (b) holds a database connection for the whole request including view rendering, and (c) makes failures happen in the serializer where the stack trace is useless.

Propagation

Isolation

// OPTIMISTIC - just add @Version. Hibernate does the rest.
@Entity
public class Account {
    @Id private Long id;
    @Version private long version;      // UPDATE ... SET version=6 WHERE id=? AND version=5
    private BigDecimal balance;
}
// If 0 rows are updated, someone else got there first:
// -> ObjectOptimisticLockingFailureException. Handle it: retry, or tell the user.

// PESSIMISTIC - real database lock
@Lock(LockModeType.PESSIMISTIC_WRITE)      // issues SELECT ... FOR UPDATE
@Query("select a from Account a where a.id = :id")
Account lockById(@Param("id") Long id);

Which to choose

• Optimistic — the default. Great for user-edited screens where conflicts are rare. Scales because nothing is locked. Cost: the caller must handle the conflict.
• Pessimistic — for genuinely hot rows (inventory count, ledger balance) where a retry loop would thrash. Cost: lock waits, deadlock risk, and you must set a lock timeout.

When each is a good idea

L2 is great for reference data that rarely changes: countries, currencies, product catalogue, config. It's dangerous for hot mutable data, and outright wrong if another application writes the same tables — Hibernate won't know to invalidate.

The query cache is invalidated by any write to any table it touches, so on a busy table it can make things slower while adding memory pressure.

// 1. DERIVED - Spring builds the query from the method NAME. Good for 1-2 criteria.
List<Order> findByCustomerIdAndStatusOrderByCreatedAtDesc(Long id, Status s);
Optional<Order> findFirstByCustomerIdOrderByCreatedAtDesc(Long id);
boolean existsByReference(String ref);
// Beyond ~3 conditions the name becomes unreadable -> switch to @Query.

// 2. @QUERY with a projection interface - fetch only 2 columns
public interface OrderView { Long getId(); BigDecimal getTotal(); }

@Query("select o.id as id, o.total as total from Order o where o.status = ?1")
List<OrderView> views(Status s);

// 3. NATIVE - for database-specific features
@Query(value = "select * from orders where payload @> :filter", nativeQuery = true)
List<Order> searchJson(@Param("filter") String filter);

// 4. MODIFYING - bulk update, bypasses the persistence context
@Modifying(clearAutomatically = true, flushAutomatically = true)
@Query("update Order o set o.status = :s where o.id in :ids")
int bulkUpdate(@Param("s") Status s, @Param("ids") List<Long> ids);

// 5. SPECIFICATION - for a dynamic search screen with optional filters
Specification<Order> spec = (root, query, cb) -> {
    List<Predicate> ps = new ArrayList<>();
    if (status != null) ps.add(cb.equal(root.get("status"), status));
    if (min != null)    ps.add(cb.greaterThanOrEqualTo(root.get("total"), min));
    return cb.and(ps.toArray(new Predicate[0]));
};
repo.findAll(spec, PageRequest.of(0, 20, Sort.by("createdAt").descending()));

@Entity
public class Order {
    @OneToMany(mappedBy = "order",              // "the Order field on OrderLine owns the FK"
               cascade = CascadeType.ALL,
               orphanRemoval = true)
    private List<OrderLine> lines = new ArrayList<>();

    // ALWAYS provide helper methods that keep BOTH sides in sync
    public void addLine(OrderLine l){ lines.add(l); l.setOrder(this); }
    public void removeLine(OrderLine l){ lines.remove(l); l.setOrder(null); }
}

@Entity
public class OrderLine {
    @ManyToOne(fetch = FetchType.LAZY)          // override the EAGER default
    @JoinColumn(name = "order_id")              // the OWNING side - holds the FK column
    private Order order;
}

Cascade and orphanRemoval

• cascade = ALL + orphanRemoval = true is right for a true parent–child where the child cannot exist alone (Order → OrderLine).
• It's wrong for shared references — cascading a delete from Order to Customer would delete the customer.
• Prefer replacing @ManyToMany with an explicit join entity as soon as the relationship needs its own attributes (e.g. quantity, added date).

@Override public boolean equals(Object o){
    if (this == o) return true;
    if (!(o instanceof Order other)) return false;   // instanceof, NOT getClass() - proxies!
    return id != null && id.equals(other.getId());   // null id -> never equal to anything else
}

@Override public int hashCode(){
    return getClass().hashCode();     // CONSTANT - never changes as state changes
}

Why these two choices

• instanceof instead of getClass() ==: Hibernate gives you a proxy subclass for lazy references, and getClass() would say they're different types.
• A constant hashCode looks wrong but is correct and stable: it never changes when the id is assigned. All entities of that type land in one bucket, which is fine because you rarely put thousands in one Set.
• Best of all: if the domain has a natural key (an order reference, a client-generated UUID), use that in both methods and the problem disappears.

# enable JDBC batching
spring.jpa.properties.hibernate.jdbc.batch_size=50
spring.jpa.properties.hibernate.order_inserts=true
spring.jpa.properties.hibernate.order_updates=true
# MySQL also needs this in the JDBC URL:  rewriteBatchedStatements=true

for (int i = 0; i < entities.size(); i++) {
    em.persist(entities.get(i));
    if (i % 50 == 0) {
        em.flush();     // send the batch to the database
        em.clear();     // detach them, so the persistence context doesn't grow to millions
    }
}

For truly large loads (millions of rows), drop to JdbcTemplate.batchUpdate or the database's native bulk loader (Postgres COPY) — JPA is the wrong tool at that scale.

# Flyway: versioned, immutable, reviewed
src/main/resources/db/migration/
    V1__create_orders.sql
    V2__add_status_index.sql
    V3__add_customer_email.sql

spring.jpa.hibernate.ddl-auto=validate      # validate in EVERY environment. Never 'update'.

ddl-auto=update is banned in production because it can't drop or rename anything, produces subtly different schemas per environment, and leaves no review trail.

Zero-downtime changes: expand → migrate → contract

1. Expand: add the new nullable column. Old code ignores it, new code can use it.
2. Migrate: backfill in batches; deploy code that writes both old and new.
3. Switch reads to the new column.
4. Contract: in a later release, drop the old column.

Also: create indexes CONCURRENTLY on Postgres, and know the lock behaviour of your DDL before running it on a 40-million-row table during business hours.

spring.datasource.hikari.maximum-pool-size=20
spring.datasource.hikari.minimum-idle=20            # = max, for stable latency
spring.datasource.hikari.connection-timeout=3000    # fail fast rather than hang
spring.datasource.hikari.max-lifetime=1740000       # just under the DB/proxy idle timeout
spring.datasource.hikari.leak-detection-threshold=20000

• Reporting and analytics — complex joins, window functions, aggregates. You want SQL, not entities.
• Bulk data movement — millions of rows; use JdbcTemplate batch or a native loader.
• Very simple services — Spring Data JDBC or JdbcClient is lighter, with no lazy loading or dirty checking to reason about.
• When you need exact control of the SQL — jOOQ gives type-safe SQL without the ORM layer.

GET    /api/v1/customers/42/orders?status=OPEN&page=0&size=20&sort=createdAt,desc
GET    /api/v1/orders/{id}
POST   /api/v1/orders                 -> 201 Created + Location header
PUT    /api/v1/orders/{id}            -> full replace  (idempotent)
PATCH  /api/v1/orders/{id}            -> partial update
DELETE /api/v1/orders/{id}            -> 204 No Content  (idempotent)

Status codes that mean something

The rest of a good design

• Versioning: /v1 in the path is pragmatic and easy to debug and cache.
• Pagination: page/size for small sets, cursor (?after=id) for large or live-updating ones.
• Errors: one consistent shape — RFC 7807 ProblemDetail, plus a trace id.
• Statelessness: no server-side session state, so any instance can serve any request.

1. Servlet container → Filters (encoding, CORS, Spring Security, your trace-id filter).
2. DispatcherServlet — the front controller.
3. HandlerMapping finds the right controller method.
4. HandlerInterceptor.preHandle.
5. HandlerAdapter invokes the method: argument resolvers bind @PathVariable/@RequestParam, an HttpMessageConverter (Jackson) turns the JSON body into your DTO, and @Valid runs.
6. The returned object is serialised back to JSON by a message converter.
7. Any exception goes to HandlerExceptionResolver → your @RestControllerAdvice.
8. postHandle / afterCompletion, response flushed.

Filter vs Interceptor (a common follow-up): a filter is Servlet-level — it sees every request, can wrap the request/response, but knows nothing about Spring MVC. An interceptor is Spring-level and knows which controller method will handle the request.

// 1. Declare the rules on the DTO
public record CreateOrder(
    @NotBlank String customerId,
    @NotEmpty @Valid List<LineDto> lines,      // @Valid cascades into the nested objects
    @Positive BigDecimal total) {}

// 2. Trigger them with @Valid
@PostMapping
ResponseEntity<OrderDto> create(@Valid @RequestBody CreateOrder req){ ... }

// 3. Convert failures into ONE consistent error shape - in one place
@RestControllerAdvice
class ApiExceptionHandler {

    @ExceptionHandler(MethodArgumentNotValidException.class)
    ProblemDetail onValidation(MethodArgumentNotValidException e){
        var pd = ProblemDetail.forStatus(HttpStatus.BAD_REQUEST);
        pd.setTitle("Validation failed");
        pd.setProperty("errors", e.getBindingResult().getFieldErrors().stream()
            .collect(toMap(FieldError::getField, FieldError::getDefaultMessage, (a,b) -> a)));
        pd.setProperty("traceId", MDC.get("traceId"));   // so support can find the log line
        return pd;
    }

    @ExceptionHandler(OrderNotFoundException.class)
    ProblemDetail onNotFound(OrderNotFoundException e){
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, e.getMessage());
    }

    @ExceptionHandler(Exception.class)
    ProblemDetail onUnexpected(Exception e){
        log.error("unhandled", e);                        // log the stack trace SERVER-side
        return ProblemDetail.forStatusAndDetail(
            HttpStatus.INTERNAL_SERVER_ERROR, "Unexpected error");  // never leak it to the client
    }
}

Also useful: @Validated on the class for validating @RequestParams, validation groups for different create vs update rules, and a custom ConstraintValidator for domain rules.

// Declarative typed client - cleanest option
@HttpExchange("/pricing")
public interface PricingClient {
    @GetExchange("/{sku}")
    Price get(@PathVariable String sku);
}

// Always configure timeouts
@Bean
RestClient pricingRestClient(RestClient.Builder builder){
    var factory = new SimpleClientHttpRequestFactory();
    factory.setConnectTimeout(1000);      // time to establish the TCP connection
    factory.setReadTimeout(2000);         // time to wait for the response
    return builder.baseUrl(url).requestFactory(factory).build();
}

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
  return http
    .csrf(csrf -> csrf.disable())                       // stateless bearer-token API
    .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
    .cors(Customizer.withDefaults())
    .authorizeHttpRequests(a -> a
        .requestMatchers("/actuator/health", "/api/v1/public/**").permitAll()
        .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated())                  // deny by default
    .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
    .build();
}

// Method-level rules, including data ownership
@PreAuthorize("hasRole('MANAGER') or #order.ownerId == authentication.name")
public void approve(Order order){ ... }

Order matters: rules are evaluated top to bottom, first match wins, and anyRequest().authenticated() last means "deny by default" — the correct posture.

My standard setup

1. OAuth2/OIDC with an identity provider (Keycloak, Azure AD, Okta) — don't build auth yourself.
2. Angular uses the Authorization Code flow with PKCE — the correct flow for a browser app, because it never holds a client secret.
3. Short-lived access token (5–15 min) + a refresh token. Short life limits the damage if a token leaks.
4. Store the access token in memory in Angular, not localStorage (any XSS can read localStorage). If it must persist, use an HttpOnly; Secure; SameSite=Strict cookie plus CSRF protection.
5. An Angular HttpInterceptor attaches the token and handles 401 → refresh → retry once.
6. Spring validates the signature, iss, aud and exp against the provider's JWKS endpoint.

@Bean
CorsConfigurationSource corsConfigurationSource(){
    var config = new CorsConfiguration();
    config.setAllowedOrigins(List.of("https://app.example.com"));  // NEVER "*" with credentials
    config.setAllowedMethods(List.of("GET","POST","PUT","PATCH","DELETE"));
    config.setAllowedHeaders(List.of("Authorization","Content-Type","X-Trace-Id"));
    config.setAllowCredentials(true);
    config.setMaxAge(3600L);                     // cache the preflight for an hour
    var source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", config);
    return source;
}

// Filter: put the id into MDC so EVERY log line in this request carries it automatically
String traceId = Optional.ofNullable(request.getHeader("X-Trace-Id"))
                         .orElse(UUID.randomUUID().toString());
MDC.put("traceId", traceId);
try {
    chain.doFilter(request, response);
} finally {
    MDC.clear();          // MUST clear - pooled threads would leak it to the next request
}

Log discipline

• Log in JSON (logstash-logback-encoder) so fields are searchable in ELK/Splunk.
• ERROR = a human must act. WARN = degraded but handled. INFO = business events. DEBUG = off in production, switchable at runtime via /actuator/loggers.
• Never log passwords, tokens, card numbers or full request bodies.
• Use Micrometer Tracing / OpenTelemetry so the trace id propagates automatically and you get a span waterfall showing which hop was slow.

When NOT to split

• The domain boundaries aren't stable yet — you'll draw them wrong and every change will span services.
• One team owns everything. Microservices mostly solve a coordination problem you don't have.
• You don't yet have the platform: CI/CD, centralised logging, tracing, on-call.
• The services would need to be transactionally consistent with each other — that's a sign they're one service.

The three states

1. CLOSED — normal. Calls pass through; failures are counted.
2. OPEN — the failure rate crossed the threshold. All calls fail immediately (no waiting), and the fallback runs.
3. HALF_OPEN — after a wait period, a few probe calls are allowed. Success → back to CLOSED. Failure → back to OPEN.

@CircuitBreaker(name = "pricing", fallbackMethod = "cachedPrice")
@Retry(name = "pricing")        // retry sits INSIDE - and only for idempotent calls
@Bulkhead(name = "pricing")     // cap concurrent calls
@TimeLimiter(name = "pricing")
public Price get(String sku){ return client.get(sku); }

// The fallback must be MEANINGFUL - stale cache, a default, a queued request
private Price cachedPrice(String sku, Throwable t){
    return cache.getOrDefault(sku, Price.UNAVAILABLE);
}

resilience4j.circuitbreaker.instances.pricing:
  slidingWindowSize: 50
  failureRateThreshold: 50          # trip at 50% failures
  waitDurationInOpenState: 30s
  permittedNumberOfCallsInHalfOpenState: 5

Two saga styles

• Choreography — each service listens for events and reacts. Simple, no central component; but with more than about 4 steps nobody can tell you what the overall flow is.
• Orchestration — one orchestrator explicitly drives each step and handles compensation. Slightly more code, but the flow is visible, testable and observable. My default for anything involving money.

The outbox pattern — why you need it

@Transactional
public void placeOrder(Order o){
    orderRepo.save(o);
    outboxRepo.save(new OutboxEvent("OrderPlaced", toJson(o)));   // SAME transaction
}
// A separate poller (or Debezium CDC reading the WAL) reads the outbox table,
// publishes to Kafka, and marks the row as sent.
// Delivery is at-least-once -> every consumer MUST be idempotent.

What real systems do: strong consistency inside each service's own database (a normal ACID transaction), and eventual consistency between services via events. So the order service is always internally consistent, but the reporting service might be two seconds behind.

Worth adding PACELC: even when there's no partition (E), you're still trading latency (L) against consistency (C) — which is exactly the read-replica lag conversation.

# PRODUCER - durability
acks=all                       # wait for all in-sync replicas, not just the leader
enable.idempotence=true        # a retry won't create a duplicate
retries=2147483647
min.insync.replicas=2          # (broker/topic side) refuse writes if replicas are down

# CONSUMER - don't lose messages
enable.auto.commit=false       # commit the offset AFTER successful processing
isolation.level=read_committed

Delivery semantics — say this clearly

• At-most-once: commit the offset before processing. You can lose messages. Rarely acceptable.
• At-least-once: commit after processing. The normal choice — but a crash between processing and committing means redelivery, so consumers must be idempotent.
• Exactly-once: possible with Kafka transactions, but only for Kafka→Kafka flows. If you write to a database, you're back to at-least-once plus idempotency.

Also mention: a dead-letter topic with a retry topic and backoff for poison messages, and monitoring consumer lag as your primary health signal.

The maths that makes the point

Every synchronous hop multiplies failure probability and adds latency. A chain of 5 sync calls, each 99.9% available, gives you 99.5% — that's 3.6 hours of downtime per month you didn't choose. Converting the tail of that chain into events removes it.

Async also gives you: buffering against traffic spikes, one producer to many consumers, and the ability for a consumer to be down and catch up later.

My sequence

1. Get the trace id from the failing response or the user's screenshot.
2. Open the trace — the span waterfall usually shows the guilty service immediately.
3. In that service, check error logs and dependency metrics: DB pool usage, cache hit rate, circuit-breaker state, consumer lag.
4. If needed, bump that package to DEBUG at runtime via /actuator/loggers, or take a thread dump.
5. Fix, add a regression test, and add the alert that would have caught it sooner.

Non-negotiables for zero downtime

• Backward-compatible database migrations — during a rolling deploy, old and new code run simultaneously against the same schema.
• Backward-compatible API and event schemas.
• A readiness probe that fails before the pod is ready, so traffic doesn't arrive early.
• Graceful shutdown: server.shutdown=graceful plus a preStop sleep so the load balancer deregisters the pod before the JVM stops.
• An automatic rollback trigger on error rate.

@Cacheable(cacheNames = "price", key = "#sku", unless = "#result == null")
public Price get(String sku){ ... }

@CacheEvict(cacheNames = "price", key = "#p.sku")
public void update(Price p){ ... }

What interviewers listen for

• Always a TTL and a max size. An unbounded cache is a memory leak with good PR.
• Invalidation strategy: TTL for tolerable staleness, event-driven eviction when you can't tolerate it.
• Cache stampede: a popular key expires and 500 threads all rebuild it at once. Fix with a per-key lock, refreshAfterWrite, or jittered TTLs.
• Negative caching: cache "not found" too, or a missing-key attack hammers your database.
• Never cache user-specific data under a shared key — that's a data-leak incident, not a bug.

# Multi-stage: build with the JDK, run on the smaller JRE
FROM eclipse-temurin:21-jdk AS build
WORKDIR /app
COPY . .
RUN ./mvnw -q -DskipTests package \
 && java -Djarmode=layertools -jar target/app.jar extract   # split into layers

FROM eclipse-temurin:21-jre
WORKDIR /app
COPY --from=build /app/dependencies/ ./          # rarely changes -> cached layer
COPY --from=build /app/spring-boot-loader/ ./
COPY --from=build /app/application/ ./           # changes every build -> last layer
USER 1000                                        # never run as root
ENTRYPOINT ["java","-XX:MaxRAMPercentage=75",
            "org.springframework.boot.loader.launch.JarLauncher"]

Kubernetes essentials to name

• Requests and limits — but be careful with hard CPU limits: CFS throttling can cause latency spikes in a JVM that's just doing GC.
• Three probes: startup (slow boot), liveness (restart me if I'm wedged), readiness (don't send traffic yet) — mapped to Actuator health groups.
• terminationGracePeriodSeconds matched to your graceful shutdown timeout.
• HPA on a meaningful metric, ConfigMap/Secret for config, PodDisruptionBudget so a node drain doesn't take all replicas.

What I actually put in place

• Unit tests for business rules and edge cases — the bulk of the suite.
• Slice tests (@WebMvcTest, @DataJpaTest) for the boundaries.
• Integration tests with Testcontainers for repositories, Flyway migrations and Kafka.
• Contract tests (Spring Cloud Contract / Pact) between services, so a breaking change fails my build rather than the consumer's production.
• A handful of Cypress/Playwright journeys — login, place order, pay.
• Coverage gates on new/changed code, not a global percentage — and occasional mutation testing (PIT) when coverage numbers look gamed.

@BeforeAll static void once(){}          // JUnit 4: @BeforeClass
@BeforeEach void setUp(){}               // JUnit 4: @Before
@Test @DisplayName("rejects a negative withdrawal")
void rejectsNegative(){ }

@ParameterizedTest                       // one test, many inputs
@ValueSource(strings = {"", " ", "\t"})
void blankIsInvalid(String input){ ... }

@ParameterizedTest
@CsvSource({"1,2,3", "5,5,10", "-1,1,0"})
void adds(int a, int b, int expected){ assertEquals(expected, calc.add(a,b)); }

@Nested class WhenAccountIsFrozen { ... }   // grouped, readable contexts
@Tag("slow") @Timeout(2) @RepeatedTest(5) @Disabled("flaky - JIRA-123")

// assertions
assertThrows(IllegalArgumentException.class, () -> svc.withdraw(-1));
assertAll(() -> assertEquals(2, r.size()),
          () -> assertTrue(r.contains("x")));     // reports BOTH failures, not just the first

// AssertJ reads far better and gives better failure messages
assertThat(orders).hasSize(2)
                  .extracting(Order::getStatus)
                  .containsExactly(OPEN, OPEN);

vs JUnit 4: modular (Platform/Jupiter/Vintage), @ExtendWith replaces runners and rules (and you can compose many extensions, where you could only have one runner), and it supports parameter injection.

@ExtendWith(MockitoExtension.class)
class OrderServiceTest {

    @Mock OrderRepository repo;
    @Mock PricingClient pricing;
    @InjectMocks OrderService service;          // constructed with the two mocks
    @Captor ArgumentCaptor<Order> orderCaptor;

    @Test
    void appliesDiscountForLoyalCustomers(){
        // GIVEN
        given(pricing.quote("SKU1")).willReturn(new BigDecimal("100"));
        given(repo.save(any())).willAnswer(inv -> inv.getArgument(0));

        // WHEN
        Order result = service.place(new PlaceOrder("cust-1", "SKU1", true));

        // THEN - assert the OUTCOME
        assertThat(result.getTotal()).isEqualByComparingTo("90.00");

        // and capture what was actually saved
        then(repo).should().save(orderCaptor.capture());
        assertThat(orderCaptor.getValue().getStatus()).isEqualTo(PLACED);
    }
}

@WebMvcTest(OrderController.class)
class OrderControllerTest {
    @Autowired MockMvc mvc;
    @MockBean OrderService service;         // the real service is NOT loaded

    @Test
    void returns400WhenCustomerIdMissing() throws Exception {
        mvc.perform(post("/api/v1/orders")
               .contentType(APPLICATION_JSON)
               .content("{}"))
           .andExpect(status().isBadRequest())
           .andExpect(jsonPath("$.errors.customerId").exists());
    }
}

@SpringBootTest
@Testcontainers
class OrderRepositoryIT {

    @Container
    static PostgreSQLContainer<?> db = new PostgreSQLContainer<>("postgres:16-alpine");

    @DynamicPropertySource
    static void props(DynamicPropertyRegistry registry){
        registry.add("spring.datasource.url", db::getJdbcUrl);
        registry.add("spring.datasource.username", db::getUsername);
        registry.add("spring.datasource.password", db::getPassword);
    }
}

Why H2 "in Postgres mode" isn't good enough

• Different SQL dialect edge cases — queries that pass on H2 and fail in production.
• No JSONB, no window function parity, different locking and sequence behaviour.
• Flyway migrations that succeed on H2 and fail on the real database — the worst kind, because you find out during deployment.

Cost: Docker in CI and slower startup. Mitigate with a shared static container per suite and reusable containers locally.

// TIME: inject a Clock instead of calling Instant.now()
public OrderService(Clock clock){ this.clock = clock; }
Instant now = Instant.now(clock);
// in the test:
var service = new OrderService(Clock.fixed(Instant.parse("2026-01-01T00:00:00Z"), UTC));

// ASYNC: Awaitility - poll for a condition with a timeout
await().atMost(5, SECONDS)
       .untilAsserted(() -> assertThat(repo.count()).isEqualTo(1));

// CONCURRENCY: release N threads simultaneously, then assert the invariant
var latch = new CountDownLatch(1);
IntStream.range(0, 50).forEach(i -> pool.submit(() -> { latch.await(); counter.increment(); }));
latch.countDown();

// DOWNSTREAM FAILURES: WireMock to simulate slow/500 responses,
// which is also how you actually test your circuit breaker

• Only verifying mocks ("the method was called") without asserting the actual outcome.
• Coupled to implementation — any refactor turns it red even though behaviour is unchanged.
• Shared mutable state or dependence on test execution order.
• Thread.sleep, or dependence on the current date.
• No negative cases — no null, empty, boundary, duplicate or concurrent scenarios.
• Hitting a real external system.
• Names like test1. I want rejectsWithdrawalWhenBalanceIsInsufficient.

-- Customers who have NEVER ordered: LEFT JOIN + IS NULL is the standard idiom
SELECT c.id, c.name
FROM customers c
LEFT JOIN orders o ON o.customer_id = c.id
WHERE o.id IS NULL;

-- Employees earning more than their manager (self join)
SELECT e.name, e.salary, m.name AS manager
FROM employees e
JOIN employees m ON e.manager_id = m.id
WHERE e.salary > m.salary;

-- BROKEN: acts as an INNER JOIN
LEFT JOIN orders o ON o.customer_id = c.id WHERE o.status = 'OPEN'
-- CORRECT
LEFT JOIN orders o ON o.customer_id = c.id AND o.status = 'OPEN'

Logical order — memorise this

FROM → JOIN → WHERE → GROUP BY → HAVING → SELECT → DISTINCT → ORDER BY → LIMIT

This explains two things that confuse people: you can't use a SELECT alias in WHERE (SELECT hasn't run yet), but you can in ORDER BY (it has).

SELECT dept_id, COUNT(*) AS headcount
FROM employees
WHERE active = true             -- filters ROWS first (cheap)
GROUP BY dept_id
HAVING COUNT(*) > 5             -- filters GROUPS after
ORDER BY headcount DESC;        -- alias works here

When your index is silently ignored

Covering index

If the index contains every column the query needs, the database never touches the table at all — an index-only scan. That's often the single biggest win available on a hot read query.

My sequence

1. Confirm which query. pg_stat_statements or the slow-query log, ranked by total time, not per-call time — a 20ms query run 10,000 times/minute matters more than a 2-second report run hourly.
2. Get the real plan: EXPLAIN (ANALYZE, BUFFERS). Compare estimated vs actual rows — a big gap means bad statistics and the optimiser is choosing badly.
3. Read for these signals: Seq Scan on a large table; a Nested Loop with a huge inner side; an external Sort (spilling to disk); very high buffer reads.
4. Fix in this order:
   • The query — drop SELECT *, remove an unnecessary DISTINCT, turn a correlated subquery into a join, remove functions from indexed columns.
   • The index — composite in the right order, covering, or partial (WHERE status='OPEN').
   • Statistics — ANALYZE.
   • The access pattern — keyset pagination instead of OFFSET 100000; a materialised view for reporting.
   • Only then — partitioning, read replicas, caching.
5. Verify with the same EXPLAIN ANALYZE, then add an alert on p99 so a regression is noticed.

My practical position

Normalize the write model to 3NF, so there's a single source of truth and no update anomalies. Denormalize deliberately and separately for read paths that are measurably too slow — a reporting table, a materialised view, a search index or a CQRS read model — always with a defined refresh mechanism.

-- OFFSET: simple, degrades badly
SELECT * FROM orders ORDER BY created_at DESC LIMIT 20 OFFSET 100000;

-- KEYSET: constant time. The tuple comparison handles ties correctly.
SELECT * FROM orders
WHERE (created_at, id) < (:lastCreatedAt, :lastId)
ORDER BY created_at DESC, id DESC
LIMIT 20;
-- index on (created_at DESC, id DESC)

Also: avoid running COUNT(*) on every page. Spring Data's Slice (instead of Page) skips the count query entirely — you just tell the UI whether there's a next page.

Prevention

• Consistent access order — always update rows in the same order (e.g. by ascending id) across all code paths. This is the fix that actually scales.
• Keep transactions short — never do an HTTP call or wait for user input inside one.
• Use SELECT ... FOR UPDATE SKIP LOCKED for queue-like tables so workers grab different rows.
• Retry — a deadlock victim usually succeeds on retry, so a bounded retry on that specific error code is legitimate.

• Views — fine. Good for encapsulating a join or restricting columns.
• Materialized views — excellent for expensive reporting aggregates, with a scheduled refresh.
• Stored procedures — fast (no round trips), but business logic in the database is hard to version, test, review and debug. I keep logic in Java unless there's a genuine bulk-data reason.
• Triggers — I avoid them for business logic. They cause invisible side effects: someone reads the Java code, sees no reason for a change, and loses hours. Auditing is the one defensible use, and even then CDC/outbox is usually better.

• Read with a cursor/keyset — Stream or ScrollableResults, never findAll().
• Process in batches of 500–1000; flush() and clear() the persistence context each chunk.
• Commit per chunk, so a failure at 90% doesn't roll back hours of work.
• Record a restart point and make each chunk idempotent, so a rerun is safe.
• Throttle — a batch job that saturates the database takes the online system down with it. Run off-peak and rate-limit.
• Emit progress metrics so someone can see it's alive.

Spring Batch gives you chunk processing, skip/retry policies and a job repository for restartability out of the box — worth naming.

The building blocks

• Component — a piece of UI: a TypeScript class + an HTML template + styles.
• Template — HTML with bindings, loops and conditions.
• Directive — adds behaviour to an element (*ngIf, or your own).
• Pipe — formats a value for display (| date, | currency).
• Service — logic and state, shared via dependency injection.
• Router — maps URLs to components, with lazy loading and guards.

@Component({
  selector: 'app-order-list',
  standalone: true,
  imports: [CommonModule, RouterLink, OrderCardComponent],   // exactly what THIS component uses
  templateUrl: './order-list.component.html'
})
export class OrderListComponent {}

// Bootstrapping - no AppModule
bootstrapApplication(AppComponent, {
  providers: [
    provideRouter(routes, withPreloading(PreloadAllModules)),
    provideHttpClient(withInterceptors([authInterceptor, errorInterceptor])),
    provideAnimations()
  ]
});

Folder structure I use

src/app/
  core/            singletons: auth, interceptors, error handler  (provided ONCE)
  shared/          dumb reusable components, pipes, directives    (no feature imports)
  features/
    orders/        routes + smart containers + presentational components + services
    customers/
  models/          interfaces and types

<!-- 1. Interpolation: class -> view -->
<h2>{{ order.reference }}</h2>

<!-- 2. Property binding: class -> view (real DOM property, not a string) -->
<button [disabled]="form.invalid">Save</button>
<img [src]="user.avatarUrl">

<!-- 3. Event binding: view -> class -->
<button (click)="save($event)">Save</button>

<!-- 4. Two-way -->
<input [(ngModel)]="query">
<!-- which is exactly shorthand for: -->
<input [ngModel]="query" (ngModelChange)="query = $event">

The "banana in a box" works on any component that exposes @Input() x plus @Output() xChange — it's a naming convention, not magic. Saying that shows you understand the mechanism.

// Parent -> child
@Input() order!: Order;
@Input({ required: true }) id!: string;      // Angular 16+: enforced at build
readonly order = input.required<Order>();    // signal-based input (Angular 17+)

// Child -> parent
@Output() saved = new EventEmitter<Order>();
this.saved.emit(order);
readonly saved = output<Order>();            // signal-based output

// Parent reaching into a child
@ViewChild(ChildComponent) child!: ChildComponent;

// Unrelated components -> shared service
@Injectable({ providedIn: 'root' })
export class CartStore {
  private readonly _items = signal<Item[]>([]);
  readonly items = this._items.asReadonly();          // expose read-only
  add(i: Item){ this._items.update(list => [...list, i]); }
}

@Injectable({ providedIn: 'root' })      // ONE instance app-wide, and tree-shakable
export class OrderService {
  private http = inject(HttpClient);      // inject() function - no constructor needed
}

// Provided at COMPONENT level = a NEW instance per component instance,
// destroyed with the component. Perfect for per-wizard or per-dialog state.
@Component({ providers: [DraftStore] })

// Non-class dependencies need a token
export const API_URL = new InjectionToken<string>('API_URL');

providers: [
  { provide: API_URL,   useValue: environment.apiUrl },
  { provide: Logger,    useClass: ProdLogger },        // swap implementation
  { provide: Cache,     useFactory: () => new Cache(50) }
]

Angular uses a hierarchical injector: it looks in the component's own injector, then its ancestors, then the root. Modifiers: @Optional(), @Self(), @SkipSelf().

@if (order(); as o) {
  <app-summary [order]="o" />
} @else {
  <app-empty-state />
}

@for (line of lines(); track line.id) {      <!-- track is REQUIRED -->
  <app-line [line]="line" />
} @empty {
  <p>No lines yet</p>
}

@switch (status()) {
  @case ('OPEN')   { <app-open /> }
  @case ('CLOSED') { <app-closed /> }
  @default         { <app-unknown /> }
}

@defer (on viewport) {          <!-- lazy-load a heavy component when scrolled into view -->
  <app-chart />
} @placeholder {
  <app-skeleton />
}

// A custom structural directive: show content only if the user has a role
@Directive({ selector: '[appHasRole]', standalone: true })
export class HasRoleDirective {
  private tpl  = inject(TemplateRef<unknown>);
  private vcr  = inject(ViewContainerRef);
  private auth = inject(AuthService);

  @Input() set appHasRole(role: string) {
    this.vcr.clear();
    if (this.auth.hasRole(role)) this.vcr.createEmbeddedView(this.tpl);
  }
}
// usage:  <button *appHasRole="'ADMIN'">Delete</button>

<!-- BAD: runs on EVERY change detection cycle, for every row -->
<td>{{ calculateTotal(order) }}</td>

<!-- GOOD: pure pipe, cached per input -->
<td>{{ order | orderTotal }}</td>

<!-- ALSO GOOD: computed signal, recalculated only when a dependency changes -->
<td>{{ total() }}</td>

@Pipe({ name: 'maskAccount', standalone: true })     // pure by default
export class MaskAccountPipe implements PipeTransform {
  transform(value: string, visible = 4): string {
    if (!value) return '';
    return '•'.repeat(Math.max(0, value.length - visible)) + value.slice(-visible);
  }
}

AsyncPipe is impure by necessity — it must react whenever the observable emits. It also unsubscribes automatically, which is why it's the preferred way to consume observables in templates.

@Injectable({ providedIn: 'root' })
export class OrderApi {
  private http = inject(HttpClient);
  private base = inject(API_URL);

  list(page: number, size: number): Observable<Page<Order>> {
    const params = new HttpParams().set('page', page).set('size', size);
    return this.http.get<Page<Order>>(`${this.base}/orders`, { params })
      .pipe(
        retry({ count: 2, delay: (_, i) => timer(300 * 2 ** i) }),   // GETs only
        catchError(this.toDomainError)
      );
  }
}

// Functional interceptor (Angular 15+)
export const authInterceptor: HttpInterceptorFn = (req, next) => {
  const token = inject(AuthStore).token();
  const authed = token
      ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } })
      : req;
  return next(authed).pipe(
    catchError(err => err.status === 401 ? refreshAndRetry(authed, next)
                                        : throwError(() => err))
  );
};

export const routes: Routes = [
  { path: '', component: HomeComponent },
  {
    path: 'orders',
    canMatch: [authGuard],                        // don't even DOWNLOAD the chunk if not allowed
    loadChildren: () => import('./features/orders/orders.routes')
                          .then(m => m.ORDER_ROUTES)
  },
  {
    path: 'orders/:id',
    loadComponent: () => import('./order-detail.component')
                           .then(m => m.OrderDetailComponent),
    resolve: { order: orderResolver },
    canDeactivate: [unsavedChangesGuard]          // "you have unsaved changes"
  },
  { path: '**', component: NotFoundComponent }    // wildcard MUST be last
];

export const authGuard: CanMatchFn = () => {
  const auth = inject(AuthService);
  const router = inject(Router);
  return auth.isLoggedIn() ? true : router.createUrlTree(['/login']);
};

Which guard?

• canActivate — may the user enter this route?
• canDeactivate — may the user leave? (unsaved changes prompt)
• canMatch — preferred over the old canLoad; prevents even downloading the lazy chunk.

form = this.fb.nonNullable.group({
    customerId: ['', Validators.required],
    email:      ['', [Validators.required, Validators.email], [this.emailTaken()]], // async
    lines:      this.fb.array([this.newLine()])
  },
  { validators: totalMatchesLines }         // cross-field validator on the GROUP
);

get lines(){ return this.form.get('lines') as FormArray; }
addLine(){ this.lines.push(this.newLine()); }
removeLine(i: number){ this.lines.removeAt(i); }

// custom validator - a function returning null (valid) or an error object
export function futureDate(c: AbstractControl): ValidationErrors | null {
  return new Date(c.value) > new Date() ? null : { futureDate: true };
}

// async validator - debounce so you don't hit the API on every keystroke
emailTaken(): AsyncValidatorFn {
  return c => timer(400).pipe(
    switchMap(() => this.api.emailExists(c.value)),
    map(exists => exists ? { emailTaken: true } : null)
  );
}

onSubmit(){
  if (this.form.invalid) { this.form.markAllAsTouched(); return; }  // show all errors
  this.api.save(this.form.getRawValue()).subscribe(...);
}

Angular 14+ typed forms mean form.value.email is a string, not any — worth mentioning that you migrated to them.

export class CartComponent {
  // writable state
  readonly items  = signal<CartItem[]>([]);
  readonly coupon = signal<string | null>(null);

  // DERIVED state - recomputed only when items() changes, and cached
  readonly total = computed(() =>
      this.items().reduce((sum, i) => sum + i.price * i.qty, 0));

  readonly hasItems = computed(() => this.items().length > 0);

  constructor(){
    // effect = side effects only (logging, localStorage). NOT for deriving state.
    effect(() => console.log('total is now', this.total()));
  }

  add(item: CartItem){ this.items.update(list => [...list, item]); }
  clear(){ this.items.set([]); }
}

<!-- in the template, call it like a function -->
<p>Total: {{ total() | currency }}</p>

Signals vs RxJS — the split I recommend

• Signals for synchronous component state: form filters, selected row, derived totals, UI flags.
• RxJS for asynchronous streams over time: HTTP, websockets, debounced search, complex event orchestration.
• Bridge them: toSignal(observable$) and toObservable(signal).

ng build --configuration production
# - AOT compilation
# - tree-shaking (unused code removed)
# - minification + hashed filenames for cache busting
# - budgets enforced

// angular.json - fail the build if the bundle grows
"budgets": [
  { "type": "initial", "maximumWarning": "500kb", "maximumError": "1mb" }
]

To find what's bloating the bundle: ng build --stats-json then source-map-explorer.

type ViewState<T> =
  | { status: 'loading' }
  | { status: 'loaded'; data: T }
  | { status: 'empty' }
  | { status: 'error'; message: string };

readonly vm$ = this.api.list().pipe(
  map(data => data.length
        ? { status: 'loaded', data } as const
        : { status: 'empty' } as const),
  startWith({ status: 'loading' } as const),
  catchError(e => of({ status: 'error', message: friendly(e) } as const))
);

@switch (vm().status) {
  @case ('loading') { <app-spinner /> }
  @case ('empty')   { <app-empty-state /> }
  @case ('error')   { <app-error [message]="..." (retry)="reload()" /> }
  @case ('loaded')  { <app-table [rows]="..." /> }
}

Plus a global ErrorHandler for uncaught runtime errors, reporting to Sentry with the trace id.

// The canonical type-ahead search
this.results$ = this.searchControl.valueChanges.pipe(
  debounceTime(300),                     // wait for a pause in typing
  distinctUntilChanged(),                // ignore if the text didn't actually change
  filter((q): q is string => !!q && q.length >= 2),
  switchMap(q => this.api.search(q).pipe(
      catchError(() => of([]))           // catch INSIDE so the outer stream survives
  )),
  shareReplay({ bufferSize: 1, refCount: true })
);

// Prevent double-submit without disabling the button
this.saveClicks$.pipe(
  exhaustMap(() => this.api.save(this.form.value))
).subscribe();

// 1. BEST - let the template manage it. AsyncPipe unsubscribes automatically.
<div *ngIf="orders$ | async as orders">...</div>

// 2. takeUntilDestroyed (Angular 16+) - no boilerplate at all
constructor(){
  this.svc.updates$.pipe(takeUntilDestroyed()).subscribe(...);
}
// outside an injection context (e.g. in ngOnInit):
private destroyRef = inject(DestroyRef);
ngOnInit(){
  this.svc.updates$.pipe(takeUntilDestroyed(this.destroyRef)).subscribe(...);
}

// 3. The classic pattern (still common in older codebases)
private destroy$ = new Subject<void>();
ngOnDestroy(){ this.destroy$.next(); this.destroy$.complete(); }
this.x$.pipe(takeUntil(this.destroy$)).subscribe(...);   // takeUntil must be LAST in the pipe

Which ones actually leak?

Only streams that never complete: valueChanges, router.events, interval, websockets, and any Subject in a service. A single HttpClient call completes by itself, so it isn't a leak — though it can still call back into a destroyed component.

@Injectable({ providedIn: 'root' })
export class UserStore {
  private readonly _user = new BehaviorSubject<User | null>(null);
  readonly user$ = this._user.asObservable();     // expose READ-ONLY

  setUser(u: User | null){ this._user.next(u); }
  get current(){ return this._user.value; }        // synchronous read
}

Always expose asObservable() so consumers can't call .next() — the same encapsulation argument as making a field private with a getter.

// Without shareReplay: this HTTP call fires once PER subscriber
readonly config$ = this.http.get<Config>('/api/config');

// With: one call, result shared and replayed to anyone who subscribes later
readonly config$ = this.http.get<Config>('/api/config')
    .pipe(shareReplay({ bufferSize: 1, refCount: true }));

// forkJoin: load everything a page needs, in parallel
forkJoin({
  order:     this.api.getOrder(id),
  customer:  this.api.getCustomer(custId),
  countries: this.api.getCountries()
}).subscribe(({ order, customer, countries }) => { ... });

// combineLatest: any filter change reloads the table
readonly rows$ = combineLatest({
  filters: this.filters$,
  page:    this.page$
}).pipe(
  debounceTime(50),                                     // batch rapid changes
  switchMap(({ filters, page }) => this.api.search(filters, page))
);

// WRONG - one failure kills the search box permanently
this.query$.pipe(
  switchMap(q => this.api.search(q)),
  catchError(() => of([]))         // outer catch - stream now COMPLETE
);

// RIGHT - catch inside
this.query$.pipe(
  switchMap(q => this.api.search(q).pipe(
      catchError(err => { this.toast.error(err); return of([]); })
  ))
);

// Retry only server errors, with exponential backoff + jitter
this.api.get().pipe(
  retry({
    count: 3,
    delay: (err, i) => err.status >= 500
        ? timer(500 * 2 ** i + Math.random() * 200)
        : throwError(() => err)        // don't retry 4xx - it'll fail identically
  })
);

Also worth knowing: EMPTY (complete quietly), throwError(() => e), and finalize() for cleanup like hiding a spinner whatever the outcome.

The dev-mode double check

In development Angular runs the check twice and throws ExpressionChangedAfterItHasBeenCheckedError if a bound value differs between the two passes. That means you changed state during the checking phase — usually in ngAfterViewInit. Fixes: move the change to ngOnInit, defer it with queueMicrotask/setTimeout, or call cdr.detectChanges() deliberately.

An OnPush component re-renders only when:

1. An @Input() receives a new reference.
2. An event fires from inside its own template (a click, an input).
3. An | async pipe in its template emits.
4. You explicitly call cdr.markForCheck().
5. A signal read in its template changes.

@Component({ changeDetection: ChangeDetectionStrategy.OnPush, ... })

// This does NOT update an OnPush child - same object reference
this.user.name = 'New Name';

// This DOES - new object, new reference
this.user = { ...this.user, name: 'New Name' };

// Same for arrays
this.items.push(x);                  // ❌ no update
this.items = [...this.items, x];     // ✅ updates

Which is why OnPush goes hand-in-hand with immutable updates.

markForCheck() marks this component and its ancestors dirty for the next cycle. detectChanges() runs the check on this component now. detach()/reattach() gives full manual control for extreme cases like a high-frequency price ticker.

Measure

Angular DevTools profiler (shows exactly which components re-render and how long they take), Chrome Performance panel, Lighthouse, and source-map-explorer for bundle size.

Fix — change detection

• ChangeDetectionStrategy.OnPush everywhere.
• No method calls or getters in templates — use a pure pipe or a computed().
• track on every list.
• Run high-frequency work outside Angular: ngZone.runOutsideAngular(() => ...) for scroll, mousemove, animation loops and third-party charts.

Fix — DOM volume

• Virtual scrolling (cdk-virtual-scroll-viewport) — render 20 rows instead of 5,000.
• Pagination; @defer for below-the-fold widgets.

Fix — network and bundle

• Route-level lazy loading; standalone components; bundle budgets in CI.
• Import individual functions, not whole libraries (import debounce from 'lodash-es/debounce').
• debounceTime on inputs; shareReplay to avoid duplicate calls; ask the API for fewer fields.
• SSR/hydration for first-paint-sensitive pages; brotli; long-cache hashed assets.

The ladder

1. Component state — a signal or a plain field. Most state belongs here.
2. A service with signals or a BehaviorSubject — shared between a few components. This covers the majority of enterprise apps.
3. A lightweight store — NgRx SignalStore, Elf.
4. Full NgRx — actions, reducers, effects, selectors.

When full NgRx earns its cost

Many components share and mutate the same state; you need time-travel debugging or an audit trail of every state change; complex async orchestration; or a large team that benefits from enforced conventions. Not for a CRUD app with six screens — the boilerplate will exceed the benefit.

// The NgRx flow, in one comment block:
// Component --dispatch(Action)--> Reducer (pure function) --> new State
//                            \--> Effect (side effect: HTTP) --> new Action
// Component <--Selector (memoised)-- Store

export const loadOrders = createAction('[Orders] Load');
export const loadOrdersSuccess =
    createAction('[Orders] Load Success', props<{ orders: Order[] }>());

loadOrders$ = createEffect(() => this.actions$.pipe(
  ofType(loadOrders),
  switchMap(() => this.api.list().pipe(
    map(orders => loadOrdersSuccess({ orders })),
    catchError(err => of(loadOrdersFailure({ err })))
  ))
));

// SERVICE test - fake the HTTP layer, assert the request AND the response handling
TestBed.configureTestingModule({
  providers: [provideHttpClient(), provideHttpClientTesting()]
});
const httpMock = TestBed.inject(HttpTestingController);

service.list().subscribe(res => expect(res.length).toBe(2));

const req = httpMock.expectOne('/api/orders');
expect(req.request.method).toBe('GET');
req.flush([{ id: 1 }, { id: 2 }]);          // supply the fake response
httpMock.verify();                           // fail if any unexpected call was made

// COMPONENT test
await TestBed.configureTestingModule({
  imports: [OrderListComponent],                        // standalone: import it
  providers: [{ provide: OrderApi, useValue: apiSpy }]
}).compileComponents();

const fixture = TestBed.createComponent(OrderListComponent);
fixture.detectChanges();                                // runs ngOnInit and renders

expect(fixture.nativeElement.querySelectorAll('tr').length).toBe(3);

// ASYNC - control time instead of waiting
it('debounces the search', fakeAsync(() => {
  typeInto('ja');
  tick(300);                                            // advance the virtual clock
  expect(apiSpy.search).toHaveBeenCalledTimes(1);
}));

• XSS — Angular sanitises by default and escapes interpolation. The danger points are [innerHTML] with user content and bypassSecurityTrustHtml. Add a strict Content-Security-Policy header.
• Token storage — in memory, or an HttpOnly cookie. localStorage is readable by any injected script.
• CSRF — Angular's HttpClient automatically reads the XSRF-TOKEN cookie and sends X-XSRF-TOKEN; pair that with Spring Security's CSRF config when you use cookie auth.
• Guards are UX, not security — every rule is enforced again server-side.
• No secrets in environment.ts — it ships to the browser. Anything in the bundle is public.
• Dependencies — npm audit, Renovate/Dependabot, and avoid unmaintained UI libraries.

// DISCRIMINATED UNION + exhaustive check - the most valuable pattern
type Result<T> =
  | { kind: 'ok';  value: T }
  | { kind: 'err'; error: string };

function render<T>(r: Result<T>): string {
  switch (r.kind) {
    case 'ok':  return String(r.value);     // TS knows 'value' exists here
    case 'err': return r.error;             // and 'error' exists here
    default:
      const _exhaustive: never = r;         // adding a new kind = COMPILE ERROR here
      return _exhaustive;
  }
}

// UTILITY TYPES - derive types instead of duplicating them
Partial<T>  Required<T>  Readonly<T>  Pick<T,K>  Omit<T,K>
Record<K,V>  ReturnType<F>  Awaited<P>  NonNullable<T>

type OrderForm = Omit<Order, 'id' | 'createdAt'>;    // stays in sync with Order

// GENERIC with a constraint
function byId<T extends { id: string }>(list: T[], id: string): T | undefined {
  return list.find(x => x.id === id);
}

// TYPE GUARD - narrows 'unknown' safely
function isOrder(x: unknown): x is Order {
  return !!x && typeof (x as Order).id === 'string';
}

// 'as const' union instead of enum - simpler output, better tree-shaking
const STATUSES = ['OPEN', 'CLOSED', 'CANCELLED'] as const;
type Status = typeof STATUSES[number];      // 'OPEN' | 'CLOSED' | 'CANCELLED'

Compiler settings I insist on

strict: true, which turns on strictNullChecks and noImplicitAny, plus noUncheckedIndexedAccess. Prefer unknown over any — it forces you to narrow before use.

My rule: interface for object shapes you might extend, type for everything else, especially unions. Both are erased at runtime — neither validates incoming JSON, so if you need runtime validation use zod, or generate the client from OpenAPI.

• package builds the jar into target/; install also puts it in your local repository so other local projects can use it.
• Dependency conflicts: Maven picks the version nearest in the dependency tree, which is why an old jar can appear unexpectedly. mvn dependency:tree shows you; a <dependencyManagement> section or a BOM pins it.
• Scopes: compile, provided (present at runtime from the container), runtime, test.
• I use surefire for unit tests and failsafe for *IT integration tests so slow tests don't run on every compile, plus jacoco with a coverage gate and OWASP dependency-check.

On a pull request

Compile → unit tests → static analysis (SonarQube quality gate on new code) → dependency and secret scanning → integration tests with Testcontainers → build the image → deploy to an ephemeral environment → smoke and contract tests.

On merge to main

Version, publish the image, deploy to staging, run E2E, then a gated canary release to production with automatic rollback on error rate.

Principles

• The pipeline is the only path to production — no manual deploys.
• Build the artifact once and promote the same one through environments; inject configuration per environment.
• Fail fast, and keep it under ~10 minutes — beyond that, people start working around it.

Either way, get these right

• Caching: hashed filenames with a long cache header; index.html with no-cache so a new deploy is picked up immediately.
• SPA fallback: try_files $uri /index.html, otherwise a deep link like /orders/42 returns 404 on refresh.
• Runtime config: fetch /assets/config.json at bootstrap instead of baking the API URL into the bundle — so the same artifact runs in dev, staging and production.

1. Clarify (2–3 minutes). Who uses it? What's the core use case? How many users/requests? Read-heavy or write-heavy? Latency budget? Consistency needs? Compliance?
2. Define the contract. The 4–6 APIs or events involved.
3. Estimate. 1M requests/day ≈ 12 per second average — plan for 5–10× peak. Storage per record × records per day × retention.
4. High-level design. Client → gateway → services → data stores → async pipeline.
5. Data model. Tables, keys, indexes, partitioning.
6. Deep dive on the one or two hard parts they seem interested in.
7. Scale and failure. Caching, replication, queues, idempotency, retries, circuit breakers. What happens when each component dies?
8. Trade-offs and next steps. State clearly what you deliberately did not build and why.

1. Contract

POST  /api/v1/orders            (Idempotency-Key header)  -> 202 Accepted
GET   /api/v1/orders?status&page&size
GET   /api/v1/orders/{id}
PATCH /api/v1/orders/{id}/cancel

Events: OrderPlaced, PaymentAuthorised, StockReserved, OrderConfirmed, OrderFailed

2. Services

Angular SPA → API Gateway (auth, rate limiting) → Order service (system of record) → events → Payment, Inventory, Notification.

3. The flow

1. Order service writes the order as PENDING and an outbox row, in one local transaction.
2. The outbox publisher emits OrderPlaced.
3. Payment and Inventory react; a saga orchestrator advances the order to CONFIRMED, or issues compensations (release stock, refund) and sets FAILED.
4. The client gets 202 immediately and either polls GET /orders/{id} or receives an SSE/websocket update — so a slow payment provider never blocks the UI.

4. Data

Postgres: orders + order_lines. Indexes on (customer_id, created_at DESC) and (status, created_at). @Version on the order for cancel/update races. An idempotency_keys table with a unique constraint.

5. Scale & resilience

Read replica for list/reporting queries; Redis for product and pricing reference data; Kafka partitioned by customerId to preserve per-customer ordering; DLQ plus retry topic; circuit breaker on Payment; rate limiting at the gateway.

6. Frontend

Lazy-loaded orders feature; OnPush and virtual scroll on the grid; keyset pagination; filters stored in the URL so refresh and back work; optimistic UI on cancel with rollback if the server rejects it.

1. Angular asks the backend for a pre-signed upload URL.
2. Angular uploads directly to S3/blob storage, showing progress.
3. Angular tells the backend "done" → the backend creates a job row (QUEUED) and publishes a message.
4. A separate worker deployment (scaled independently) streams the file, validates it, and processes it in chunks with Spring Batch — restartable, with skip and retry policies.
5. Angular polls GET /jobs/{id} or subscribes to SSE for progress.
6. Failures produce a downloadable error report keyed by row number — which is what business users actually need.

Guardrails: size and MIME allow-list, virus scan, tenant-scoped storage paths, TTL on temporary objects, and a cap on concurrent jobs per tenant so one customer can't starve the queue.

1. Find the seams by bounded context and by pain — what changes most often, what needs to scale differently.
2. Extract the lowest-coupling, highest-value capability first, to prove the pipeline, observability and deployment story before attempting anything hard.
3. Decouple the data. The new service owns its own schema. Use CDC or an outbox to keep the monolith's view in sync during the transition — this is the hardest part, not the code.
4. Run both in parallel with traffic shadowing and compare outputs before cutting over.
5. Delete the old code. An extraction isn't finished until the monolith path is removed — otherwise you're maintaining both.

My template

1. Context and problem — what's broken or needed, in business terms.
2. Goals / non-goals — non-goals prevent scope arguments later.
3. Requirements — functional, plus NFRs: performance, availability, security, compliance, with numbers.
4. Proposed design — component and sequence diagrams, API/event contracts, data model.
5. Alternatives considered and why rejected. This is the section reviewers actually read.
6. Risks and mitigations.
7. Rollout plan — feature flags, backfill, rollback.
8. Testing strategy and observability — which dashboards and alerts we add.
9. Open questions with named owners.

Process

Circulate at 60% complete for comments — a polished document invites cosmetic feedback rather than real challenge. Walk the BA and QA through the flows; they catch requirement gaps developers miss. Record decisions as short ADRs so the "why" survives after people leave.

Then verify the claims with load tests (Gatling, k6, JMeter) against a production-like environment as part of the release process. A design claim you haven't load tested is a guess.

Layering

core/          auth, interceptors, error handling, config   (provided once)
shared/        presentational components, pipes, directives (imports NO feature)
features/
  orders/
    data-access/   typed API client + store
    ui/            dumb components
    orders.routes.ts
models/

Rules that keep it maintainable with 30 developers

• Generated API clients from OpenAPI, so frontend types can't drift from the backend.
• A design system library (Angular Material or internal) so UI is consistent and accessible by default.
• Boundary rules — ESLint import restrictions, or Nx tags — so one feature can't import another feature's internals.
• OnPush by default; strict TypeScript; bundle budgets in CI.
• Shared components documented in Storybook, so people find them instead of rebuilding them.

For very large organisations: an Nx monorepo with affected-only builds. Micro-frontends via module federation only when separate teams genuinely need separate release cadences — the runtime and version-alignment costs are real.

What I look for, in priority order

1. Does it solve the actual requirement? (Read the ticket first.)
2. Correctness and edge cases — null, empty, boundary, concurrency.
3. Tests that would catch a regression.
4. Security — authorisation including object ownership, injection, secrets, PII in logs.
5. Performance — N+1, unbounded queries or collections, missing index, blocking call in a hot path.
6. Readability and naming; consistency with existing patterns.
7. Observability — will we be able to debug this in production?

How I give the feedback

• I label every comment [blocking], [suggestion] or [nit], so the author knows what actually stops the merge. This one habit removes most review friction.
• Ask, don't decree: "what happens if the list is empty here?" rather than "this is wrong".
• Praise good solutions publicly — reviews shouldn't be purely negative.
• If a thread goes beyond two rounds, move it to a 10-minute call. Long text arguments burn goodwill and rarely converge.
• Adjust to the person: for a junior I explain the why and link a reference; for a peer I flag the risk and let them decide.

What I ask of authors

Small PRs (under ~400 lines), a description with context and testing notes, self-review before requesting review, and no mixing a refactor with a behaviour change in one diff.

1. Communicate immediately — impact, and when the next update will come. Silence during an incident is what damages trust.
2. Stabilise — roll back, disable the feature flag, scale out, or fail over.
3. Preserve evidence before restarting — heap dump, thread dump, logs, trace ids. A restart destroys the only copy of the cause, and then it happens again next week.
4. Root cause with the data you captured.
5. Fix properly, with a test that reproduces the bug.
6. Blameless post-mortem with concrete actions and named owners. The action is almost always a missing alert, a missing timeout, or a missing test.

With the BA

I get involved before the story is finalised and ask about the edge cases people forget: partial data, duplicates, timezones, permissions, what happens on failure. I turn acceptance criteria into Given/When/Then so QA and I are testing the same thing. And I show a UI prototype or the Swagger contract early — people react far better to something concrete than to a document.

With QA

I share the technical design and specifically point out the risky areas so they can target exploratory testing there. I make sure they have test data and access to feature flags. When they raise a defect I reproduce it with a failing automated test first. On non-trivial stories I run a "three amigos" kickoff — BA, developer, QA — which is the cheapest defect prevention available.

With support

I make the system diagnosable: correlation ids in error messages that the user can quote, runbooks for known failure modes, and log levels adjustable at runtime. I also join the support rotation periodically — nothing improves your design instincts faster than answering for your own code on a Monday morning.

• Refinement — I push for clarity before estimation. I'll say "I can't size this until we know whether the export is synchronous". I flag technical dependencies and propose splitting fat stories into thin vertical slices that each deliver something usable.
• Planning — realistic capacity, an explicit definition of done (code + tests + docs + observability + reviewed), and I make sure some NFR/tech-debt work is in every sprint rather than deferred to a mythical cleanup sprint.
• Daily stand-up — focused on flow and blockers, not status theatre. If something's stuck more than a day, I raise it rather than repeating "still working on it".
• Review/demo — I demo from the user's perspective, not the code's.
• Retro — I bring data: cycle time, escaped defects, flaky test count. And I commit to one improvement that I personally own. Retros fail when actions have no owner.

• Pairing on their first tickets in an unfamiliar area — an hour of pairing beats a day of review comments.
• Reviews that teach: explain the why and link a reference, rather than just marking it wrong.
• A rotating 30-minute tech share each sprint. Mine have been virtual threads, JPA fetch strategies and Angular signals.
• ADRs and a living onboarding document, which each new joiner updates as their first pull request — it's a useful task and it tests the doc.
• Deliberately handing over a design I could do faster myself, then supporting it. The goal is a second person who can own it, not a hero.

• Keep a visible debt register with an estimated cost: hours lost per sprint, incident risk, onboarding friction.
• Propose a standing allocation — typically 15–20% of each sprint — rather than negotiating from scratch every time.
• Give debt work a measurable outcome: "cut build time from 14 minutes to 5", "remove the flaky tests causing 3 pipeline reruns a week".
• Accept that not all debt needs repaying. Debt in a stable module nobody touches is fine. Prioritise debt in the code you're changing most.

Questions to ask them — this is scored, so have 4–5 ready

• "What does the delivery pipeline look like — how long from merge to production, and who can deploy?"
• "How is technical design decided: architects, RFCs, or the team?"
• "What's the current state of automated testing, and what's the biggest source of production incidents?"
• "Which Java and Angular versions are you on, and is there an upgrade plan?"
• "How do developers, BAs and QA collaborate on a typical story?"
• "What would success look like for this person in the first six months?"

1. Your 90-second intro, with one measurable achievement.
2. HashMap internals, and ConcurrentHashMap's per-bucket locking.
3. A groupingBy stream problem, coded live without hesitating.
4. Thread pool sizing, and why you avoid Executors.newFixedThreadPool.
5. volatile vs atomic vs synchronized, with happens-before.
6. How you debugged an OOM or a memory leak, naming the tools.
7. Spring bean lifecycle, and where AOP proxies are applied.
8. The three ways @Transactional silently does nothing.
9. N+1: how you detect it and four ways to fix it.
10. Optimistic vs pessimistic locking, with the @Version code.
11. Your global exception handling and error contract.
12. The OAuth2/JWT flow for an Angular SPA, and where the token lives.
13. Circuit breaker states and a meaningful fallback.
14. Saga plus transactional outbox, and why the outbox is needed.
15. Your test pyramid, and why Testcontainers over H2.
16. An EXPLAIN ANALYZE story about a slow query.
17. switchMap vs mergeMap vs concatMap vs exhaustMap.
18. OnPush rules, and how you sped up a slow page.
19. Signals vs RxJS and when you'd use each.
20. A code review disagreement you handled well.

The shape that works: state the boundary → reason from what you do know → say how you'd find out

That answer often scores better than a memorised correct one, because it demonstrates exactly what a 10-year hire is for: calibrated judgement and a method for handling the unknown.

• Answering "what is X?" with a definition and then stopping. Always add the trade-off and a use case.
• Blaming previous teams or managers.
• Claiming everything — "I've used all of those extensively". Depth beats breadth claims, and they will probe.
• No numbers in any achievement.
• Not asking any questions at the end.
• Talking for four minutes without checking you're answering what was asked. Pause: "does that cover it, or would you like me to go deeper on the failure handling?"
• Whiteboarding in silence. Narrate continuously — they're scoring your reasoning, and they can't score what they can't hear.
• Arguing with the interviewer. Disagree once, with evidence, then offer to move on.

Thinking

Put one finger at the start and one at the end. Swap those two characters, then move both fingers inward. Stop when they meet.

public static String reverse(String input) {
    char[] c = input.toCharArray();
    int left = 0, right = c.length - 1;

    while (left < right) {
        char tmp = c[left];
        c[left]  = c[right];
        c[right] = tmp;
        left++;
        right--;
    }
    return new String(c);
}

// Reverse the WORDS instead of the characters - a common variation
public static String reverseWords(String s) {
    String[] words = s.trim().split("\\s+");
    Collections.reverse(Arrays.asList(words));
    return String.join(" ", words);
}

Time O(n) · Space O(n) for the char array (O(1) extra if you're given a char[])

Thinking

Two pointers again — but this time, skip any character that isn't a letter or digit, and compare in lower case. Don't build a cleaned copy of the string unless asked; skipping in place is O(1) space.

public static boolean isPalindrome(String s) {
    int left = 0, right = s.length() - 1;

    while (left < right) {
        // skip non-alphanumeric from the left
        while (left < right && !Character.isLetterOrDigit(s.charAt(left)))  left++;
        // skip non-alphanumeric from the right
        while (left < right && !Character.isLetterOrDigit(s.charAt(right))) right--;

        if (Character.toLowerCase(s.charAt(left)) != Character.toLowerCase(s.charAt(right)))
            return false;
        left++;
        right--;
    }
    return true;
}

Time O(n) · Space O(1)

Thinking

Count every character in one pass. Then walk the string again in order and return the first with a count of 1. A plain HashMap loses the order, so either re-scan the original string (simplest) or use a LinkedHashMap.

public static Character firstNonRepeating(String s) {
    Map<Character, Integer> counts = new HashMap<>();
    for (char c : s.toCharArray())
        counts.merge(c, 1, Integer::sum);        // put 1, or add 1 if present

    for (char c : s.toCharArray())               // second pass keeps original order
        if (counts.get(c) == 1) return c;

    return null;
}

// Stream version, using LinkedHashMap to preserve order
public static Character firstNonRepeatingStream(String s) {
    return s.chars().mapToObj(i -> (char) i)
            .collect(Collectors.groupingBy(c -> c, LinkedHashMap::new, Collectors.counting()))
            .entrySet().stream()
            .filter(e -> e.getValue() == 1)
            .map(Map.Entry::getKey)
            .findFirst().orElse(null);
}

Time O(n) · Space O(k) where k = distinct characters

// Characters
public static Map<Character, Long> charFrequency(String s) {
    return s.chars().mapToObj(i -> (char) i)
            .collect(Collectors.groupingBy(c -> c, Collectors.counting()));
}

// Words, case-insensitive, sorted by count descending
public static LinkedHashMap<String, Long> topWords(String text) {
    return Arrays.stream(text.toLowerCase().split("\\W+"))
        .filter(w -> !w.isBlank())
        .collect(Collectors.groupingBy(w -> w, Collectors.counting()))
        .entrySet().stream()
        .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue,
                                  (a, b) -> a, LinkedHashMap::new));
}

// The classic non-stream way - merge() is the cleanest
Map<String, Integer> counts = new HashMap<>();
for (String w : words) counts.merge(w, 1, Integer::sum);

Time O(n) (O(n log n) if you sort) · Space O(k)

Thinking

Approach A (sort): sort both strings and compare — 3 lines, O(n log n). Approach B (count): count characters of the first, subtract the second; all counts must end at zero — O(n). Mention A, implement B.

public static boolean isAnagram(String a, String b) {
    if (a.length() != b.length()) return false;        // fast reject

    int[] counts = new int[256];                       // assume ASCII; use a Map for Unicode
    for (int i = 0; i < a.length(); i++) {
        counts[a.charAt(i)]++;                         // add for the first string
        counts[b.charAt(i)]--;                         // subtract for the second
    }
    for (int c : counts) if (c != 0) return false;
    return true;
}

// One-liner using sorting - fine to mention, slower
boolean quick = Arrays.equals(
        a.chars().sorted().toArray(), b.chars().sorted().toArray());

Time O(n) · Space O(1) — the array is a fixed 256 regardless of input size

Thinking — the sliding window

Imagine a window over the string with a left and right edge. Move the right edge forward one character at a time. If the new character is already inside the window, jump the left edge past its previous position. The window always contains only unique characters, so its size is a candidate answer.

public static int longestUnique(String s) {
    Map<Character, Integer> lastSeen = new HashMap<>();   // char -> last index
    int best = 0, left = 0;

    for (int right = 0; right < s.length(); right++) {
        char c = s.charAt(right);

        // if we've seen c inside the current window, shrink from the left
        if (lastSeen.containsKey(c) && lastSeen.get(c) >= left) {
            left = lastSeen.get(c) + 1;
        }
        lastSeen.put(c, right);
        best = Math.max(best, right - left + 1);
    }
    return best;
}

Dry run on "abcabcbb"

right=0 'a'  window "a"    best=1
right=1 'b'  window "ab"   best=2
right=2 'c'  window "abc"  best=3
right=3 'a'  'a' seen at 0 -> left=1, window "bca"  best=3
right=4 'b'  'b' seen at 1 -> left=2, window "cab"  best=3
...

Time O(n) — each pointer moves forward only · Space O(k)

Thinking

Brute force is two nested loops — O(n²). The trick: as you walk the array, for each number you know exactly what its partner must be (target - current). So keep a map of everything you've already seen and check whether the partner is in it. One pass, O(n).

public static int[] twoSum(int[] nums, int target) {
    Map<Integer, Integer> seen = new HashMap<>();   // value -> index

    for (int i = 0; i < nums.length; i++) {
        int needed = target - nums[i];
        if (seen.containsKey(needed))
            return new int[]{ seen.get(needed), i };
        seen.put(nums[i], i);                       // put AFTER checking
    }
    return new int[0];                              // no pair found
}

Dry run: nums=[2,7,11,15], target=9

i=0  num=2  needed=7  seen={}          -> not found, seen={2:0}
i=1  num=7  needed=2  seen={2:0}       -> FOUND! return [0,1]

Time O(n) · Space O(n) — the classic trade of memory for speed

// Find all duplicates - the elegant Set trick:
// set.add() returns FALSE if the value was already present
public static Set<Integer> findDuplicates(int[] nums) {
    Set<Integer> seen = new HashSet<>();
    Set<Integer> dups = new LinkedHashSet<>();
    for (int n : nums)
        if (!seen.add(n)) dups.add(n);
    return dups;
}

// Same idea with streams
Set<Integer> seen = new HashSet<>();
Set<Integer> dups = Arrays.stream(nums).boxed()
        .filter(n -> !seen.add(n))
        .collect(Collectors.toSet());

// Remove duplicates from a SORTED array in place, return the new length
public static int removeDuplicatesSorted(int[] nums) {
    if (nums.length == 0) return 0;
    int write = 1;                                   // position to write the next unique value
    for (int read = 1; read < nums.length; read++) {
        if (nums[read] != nums[write - 1]) {
            nums[write++] = nums[read];
        }
    }
    return write;
}

// Remove duplicates preserving order (unsorted)
List<Integer> unique = new ArrayList<>(new LinkedHashSet<>(list));

Time O(n) · Space O(n) — or O(1) for the in-place sorted version

// O(n) single pass, distinct values
public static int secondLargest(int[] nums) {
    long first = Long.MIN_VALUE, second = Long.MIN_VALUE;

    for (int n : nums) {
        if (n > first) {
            second = first;      // the old winner becomes runner-up
            first  = n;
        } else if (n > second && n != first) {
            second = n;
        }
    }
    if (second == Long.MIN_VALUE) throw new IllegalArgumentException("no second largest");
    return (int) second;
}

// Nth highest with a stream (readable; fine to offer as the "quick" version)
Optional<Integer> nth = Arrays.stream(nums).boxed()
        .distinct()
        .sorted(Comparator.reverseOrder())
        .skip(n - 1)
        .findFirst();

// Top K efficiently with a min-heap of size K - O(n log k)
PriorityQueue<Integer> heap = new PriorityQueue<>();   // min-heap
for (int num : nums) {
    heap.offer(num);
    if (heap.size() > k) heap.poll();                  // drop the smallest
}
// heap now holds the K largest; heap.peek() is the Kth largest

Time O(n) single pass, or O(n log k) for top-K · Space O(1) / O(k)

Thinking

Use a write pointer. Walk through with a read pointer; every time you find a non-zero, write it at the write pointer and advance it. At the end, fill the rest with zeros. This "compaction" pattern appears constantly.

public static void moveZeros(int[] nums) {
    int write = 0;

    for (int read = 0; read < nums.length; read++) {
        if (nums[read] != 0) nums[write++] = nums[read];
    }
    while (write < nums.length) nums[write++] = 0;      // pad the tail
}

Dry run on [0,1,0,3,12]

read=0 (0)  skip
read=1 (1)  nums[0]=1  write=1
read=2 (0)  skip
read=3 (3)  nums[1]=3  write=2
read=4 (12) nums[2]=12 write=3
pad: nums[3]=0, nums[4]=0   -> [1,3,12,0,0]

Time O(n) · Space O(1)

Thinking — the key insight

At each position ask one question: "is the running total I'm carrying actually helping me?" If the total so far is negative, it's dragging you down — drop it and start fresh from the current number. That's the whole algorithm.

public static int maxSubArraySum(int[] nums) {
    int currentBest = nums[0];     // best sum ENDING at the current index
    int overallBest = nums[0];

    for (int i = 1; i < nums.length; i++) {
        // either extend the previous run, or start a new one here
        currentBest = Math.max(nums[i], currentBest + nums[i]);
        overallBest = Math.max(overallBest, currentBest);
    }
    return overallBest;
}

Dry run on [-2,1,-3,4,-1,2,1,-5,4]

i=1  1:  max(1, -2+1=-1)  = 1     overall=1
i=2 -3:  max(-3, 1-3=-2)  = -2    overall=1
i=3  4:  max(4, -2+4=2)   = 4     overall=4   <- fresh start
i=4 -1:  max(-1, 4-1=3)   = 3     overall=4
i=5  2:  max(2, 3+2=5)    = 5     overall=5
i=6  1:  max(1, 5+1=6)    = 6     overall=6   <- answer

Time O(n) · Space O(1)

Thinking

Reverse the whole array, then reverse the first k elements, then reverse the rest. It looks like magic but you can verify it in one dry run — and it's the answer they're looking for.

public static void rotate(int[] nums, int k) {
    int n = nums.length;
    k = k % n;                       // handle k > n
    if (k < 0) k += n;               // handle negative k

    reverse(nums, 0, n - 1);         // whole array
    reverse(nums, 0, k - 1);         // first k
    reverse(nums, k, n - 1);         // the rest
}

private static void reverse(int[] a, int i, int j) {
    while (i < j) { int t = a[i]; a[i++] = a[j]; a[j--] = t; }
}

Dry run: [1,2,3,4,5], k=2

reverse all       -> [5,4,3,2,1]
reverse first 2   -> [4,5,3,2,1]
reverse rest      -> [4,5,1,2,3]   ✓

Time O(n) · Space O(1)

// MERGE two sorted arrays - the merge step of merge sort
public static int[] merge(int[] a, int[] b) {
    int[] out = new int[a.length + b.length];
    int i = 0, j = 0, k = 0;

    while (i < a.length && j < b.length)
        out[k++] = (a[i] <= b[j]) ? a[i++] : b[j++];

    while (i < a.length) out[k++] = a[i++];    // drain whichever is left
    while (j < b.length) out[k++] = b[j++];
    return out;
}

// MISSING NUMBER in 1..n - the maths trick, O(1) space
public static int missingNumber(int[] nums, int n) {
    long expected = (long) n * (n + 1) / 2;    // sum of 1..n
    long actual   = Arrays.stream(nums).asLongStream().sum();
    return (int) (expected - actual);
}

// XOR version - immune to integer overflow
public static int missingXor(int[] nums, int n) {
    int x = 0;
    for (int i = 1; i <= n; i++) x ^= i;       // XOR all expected values
    for (int v : nums)           x ^= v;       // XOR all actual values
    return x;                                  // pairs cancel out; the missing one remains
}

Time O(n+m) / O(n) · Space O(n+m) / O(1)

Thinking

Walk the list with three pointers: prev, current, and next. At each node: remember the next node (or you lose the rest of the list), point the current node backwards at prev, then shuffle all three forward. When current is null, prev is the new head.

class Node { int val; Node next; Node(int v){ val = v; } }

public static Node reverse(Node head) {
    Node prev = null;
    Node current = head;

    while (current != null) {
        Node next = current.next;   // 1. save the rest of the list
        current.next = prev;        // 2. flip the arrow backwards
        prev = current;             // 3. move prev forward
        current = next;             // 4. move current forward
    }
    return prev;                    // prev is now the new head
}

Dry run on 1→2→3

start:  prev=null  cur=1
step1:  next=2, 1.next=null, prev=1, cur=2      list so far: 1→null
step2:  next=3, 2.next=1,    prev=2, cur=3      list so far: 2→1→null
step3:  next=null, 3.next=2, prev=3, cur=null   list: 3→2→1→null ✓

Time O(n) · Space O(1)

// CYCLE DETECTION (Floyd's tortoise and hare)
public static boolean hasCycle(Node head) {
    Node slow = head, fast = head;

    while (fast != null && fast.next != null) {
        slow = slow.next;            // 1 step
        fast = fast.next.next;       // 2 steps
        if (slow == fast) return true;   // they met -> there's a loop
    }
    return false;                    // fast reached the end -> no loop
}

// FIND THE MIDDLE
public static Node middle(Node head) {
    Node slow = head, fast = head;
    while (fast != null && fast.next != null) {
        slow = slow.next;
        fast = fast.next.next;
    }
    return slow;                     // for even length, this is the second middle
}

// FIND WHERE THE CYCLE STARTS (the follow-up)
public static Node cycleStart(Node head) {
    Node slow = head, fast = head;
    while (fast != null && fast.next != null) {
        slow = slow.next; fast = fast.next.next;
        if (slow == fast) {                        // meeting point found
            Node p = head;
            while (p != slow) { p = p.next; slow = slow.next; }
            return p;                              // this is the loop entry
        }
    }
    return null;
}

Time O(n) · Space O(1) — beating the obvious HashSet solution's O(n) space

Thinking

Brackets must close in reverse order of opening — that's literally what a stack does. Push every opening bracket. On a closing bracket, pop and check it matches. At the end the stack must be empty (otherwise something never closed).

public static boolean isBalanced(String s) {
    Deque<Character> stack = new ArrayDeque<>();   // ArrayDeque, not the legacy Stack class
    Map<Character, Character> pairs = Map.of(')', '(', ']', '[', '}', '{');

    for (char c : s.toCharArray()) {
        if (c == '(' || c == '[' || c == '{') {
            stack.push(c);
        } else if (pairs.containsKey(c)) {
            // must have something to close, and it must be the matching opener
            if (stack.isEmpty() || stack.pop() != pairs.get(c)) return false;
        }
    }
    return stack.isEmpty();       // anything left = unclosed bracket
}

Time O(n) · Space O(n)

Thinking — queue from two stacks

Stack A takes new items. When someone wants to dequeue, pour A into B — the pouring reverses the order, so B's top is the oldest item. Only pour when B is empty, which makes the average cost O(1) per operation.

class QueueFromStacks<T> {
    private final Deque<T> inbox  = new ArrayDeque<>();
    private final Deque<T> outbox = new ArrayDeque<>();

    public void enqueue(T item) {
        inbox.push(item);                     // always cheap
    }

    public T dequeue() {
        if (outbox.isEmpty()) {
            if (inbox.isEmpty()) throw new NoSuchElementException();
            while (!inbox.isEmpty()) outbox.push(inbox.pop());   // pour = reverse
        }
        return outbox.pop();
    }
}

Time O(1) amortised — each element is moved at most once · Space O(n)

class TreeNode { int val; TreeNode left, right; TreeNode(int v){ val = v; } }

// DFS - recursion. Note only the ORDER of the three lines changes.
void inorder(TreeNode n, List<Integer> out) {
    if (n == null) return;
    inorder(n.left, out);
    out.add(n.val);
    inorder(n.right, out);
}

void preorder(TreeNode n, List<Integer> out) {
    if (n == null) return;
    out.add(n.val);
    preorder(n.left, out);
    preorder(n.right, out);
}

// BFS - level order, uses a Queue
List<List<Integer>> levelOrder(TreeNode root) {
    List<List<Integer>> levels = new ArrayList<>();
    if (root == null) return levels;

    Queue<TreeNode> queue = new LinkedList<>();
    queue.add(root);

    while (!queue.isEmpty()) {
        int levelSize = queue.size();          // how many nodes on THIS level
        List<Integer> level = new ArrayList<>();

        for (int i = 0; i < levelSize; i++) {
            TreeNode n = queue.poll();
            level.add(n.val);
            if (n.left  != null) queue.add(n.left);
            if (n.right != null) queue.add(n.right);
        }
        levels.add(level);
    }
    return levels;
}

Time O(n) · Space O(h) for DFS recursion (h = height), O(w) for BFS (w = widest level)

// HEIGHT - the base case does all the work
public static int height(TreeNode n) {
    if (n == null) return 0;
    return 1 + Math.max(height(n.left), height(n.right));
}

// IS IT BALANCED? (no subtree pair differs in height by more than 1)
// Naive version calls height() at every node -> O(n²).
// This version computes height and balance in ONE pass, using -1 as "unbalanced".
public static boolean isBalanced(TreeNode root) {
    return check(root) != -1;
}

private static int check(TreeNode n) {
    if (n == null) return 0;

    int left = check(n.left);
    if (left == -1) return -1;              // early exit - already unbalanced

    int right = check(n.right);
    if (right == -1) return -1;

    if (Math.abs(left - right) > 1) return -1;
    return 1 + Math.max(left, right);
}

Time O(n) for the single-pass version (vs O(n²) naive) · Space O(h)

public static boolean isValidBST(TreeNode root) {
    return valid(root, Long.MIN_VALUE, Long.MAX_VALUE);
}

private static boolean valid(TreeNode n, long min, long max) {
    if (n == null) return true;
    if (n.val <= min || n.val >= max) return false;

    // going left: everything must be BELOW n.val
    // going right: everything must be ABOVE n.val
    return valid(n.left, min, n.val) && valid(n.right, n.val, max);
}

// LOWEST COMMON ANCESTOR in a BST - exploit the ordering, no searching needed
public static TreeNode lca(TreeNode root, int a, int b) {
    TreeNode node = root;
    while (node != null) {
        if (a < node.val && b < node.val)      node = node.left;   // both smaller -> go left
        else if (a > node.val && b > node.val) node = node.right;  // both bigger  -> go right
        else return node;   // they diverge here (or one IS this node) -> this is the LCA
    }
    return null;
}

Time O(n) validate, O(h) for the BST LCA · Space O(h)

public static int binarySearch(int[] sorted, int target) {
    int low = 0, high = sorted.length - 1;

    while (low <= high) {                       // <= not < : the last window is a single element
        int mid = low + (high - low) / 2;       // NOT (low+high)/2 -- see below

        if (sorted[mid] == target) return mid;
        if (sorted[mid] < target) low  = mid + 1;   // discard the left half
        else                      high = mid - 1;   // discard the right half
    }
    return -1;
}

Dry run: find 7 in [1,3,5,7,9,11]

low=0 high=5  mid=2 (5)   5<7  -> low=3
low=3 high=5  mid=4 (9)   9>7  -> high=3
low=3 high=3  mid=3 (7)   found -> return 3

Time O(log n) · Space O(1)

What Java actually does

• Arrays.sort(int[]) — dual-pivot quicksort. Primitives have no identity, so stability is meaningless and quicksort's speed and O(1) space win.
• Arrays.sort(Object[]) and Collections.sort — TimSort, a hybrid of merge sort and insertion sort. Objects need stability (equal elements keep their relative order, which matters when you sort by one field then another), and TimSort is very fast on partially sorted real-world data.

// Insertion sort - the one worth being able to write, and what TimSort uses for small runs
public static void insertionSort(int[] a) {
    for (int i = 1; i < a.length; i++) {
        int key = a[i], j = i - 1;
        while (j >= 0 && a[j] > key) {    // shift bigger elements right
            a[j + 1] = a[j];
            j--;
        }
        a[j + 1] = key;                   // drop the key into the gap
    }
}

// Factorial - clean recursion
public static long factorial(int n) {
    if (n < 0) throw new IllegalArgumentException();
    if (n <= 1) return 1;                   // BASE CASE
    return n * factorial(n - 1);            // progress toward the base case
}

// Fibonacci - NAIVE. fib(50) takes minutes: it recomputes fib(30) over a million times.
public static long fibSlow(int n) {
    return n <= 1 ? n : fibSlow(n - 1) + fibSlow(n - 2);       // O(2^n) !!
}

// MEMOISED - remember what you've already computed. O(n).
public static long fib(int n, Map<Integer, Long> memo) {
    if (n <= 1) return n;
    return memo.computeIfAbsent(n, k -> fib(k - 1, memo) + fib(k - 2, memo));
}

// ITERATIVE - O(n) time, O(1) space. Usually the best answer.
public static long fibIterative(int n) {
    long prev = 0, curr = 1;
    for (int i = 2; i <= n; i++) {
        long next = prev + curr;
        prev = curr;
        curr = next;
    }
    return n == 0 ? 0 : curr;
}

Time O(2ⁿ) naive → O(n) memoised or iterative · Space O(n) recursion stack → O(1) iterative

public static Collection<List<String>> groupAnagrams(String[] words) {
    Map<String, List<String>> groups = new LinkedHashMap<>();

    for (String w : words) {
        char[] letters = w.toCharArray();
        Arrays.sort(letters);
        String key = new String(letters);              // "eat" and "tea" both -> "aet"
        groups.computeIfAbsent(key, k -> new ArrayList<>()).add(w);
    }
    return groups.values();
}

// Stream version - the same idea, one expression
Map<String, List<String>> grouped = Arrays.stream(words)
    .collect(Collectors.groupingBy(w -> {
        char[] c = w.toCharArray(); Arrays.sort(c); return new String(c);
    }));

Time O(n · k log k) where k = word length · Space O(n·k)

// THE JAVA ANSWER - LinkedHashMap already IS a HashMap + doubly-linked list
public class LruCache<K, V> extends LinkedHashMap<K, V> {
    private final int capacity;

    public LruCache(int capacity) {
        super(16, 0.75f, true);        // true = ACCESS order, not insertion order
        this.capacity = capacity;
    }

    @Override
    protected boolean removeEldestEntry(Map.Entry<K, V> eldest) {
        return size() > capacity;      // called after each put; true = evict the eldest
    }
}

Time O(1) for get and put · Space O(capacity)

// THE ANSWER TO GIVE FIRST - BlockingQueue does everything
public class OrderPipeline {
    private final BlockingQueue<Order> queue = new ArrayBlockingQueue<>(100);

    public void produce(Order o) throws InterruptedException {
        queue.put(o);           // blocks when full -> automatic back-pressure
    }

    public void startConsumers(int n) {
        ExecutorService pool = Executors.newFixedThreadPool(n);
        for (int i = 0; i < n; i++) {
            pool.submit(() -> {
                try {
                    while (!Thread.currentThread().isInterrupted()) {
                        Order o = queue.take();     // blocks when empty
                        process(o);
                    }
                } catch (InterruptedException e) {
                    Thread.currentThread().interrupt();   // restore the flag and exit
                }
            });
        }
    }
}

// IF THEY ASK FOR wait/notify - the manual version
class BoundedBuffer<T> {
    private final Queue<T> buffer = new LinkedList<>();
    private final int capacity;
    private final Object lock = new Object();

    public void put(T item) throws InterruptedException {
        synchronized (lock) {
            while (buffer.size() == capacity) lock.wait();   // WHILE, not if
            buffer.add(item);
            lock.notifyAll();          // wake any waiting consumers
        }
    }

    public T take() throws InterruptedException {
        synchronized (lock) {
            while (buffer.isEmpty()) lock.wait();
            T item = buffer.poll();
            lock.notifyAll();          // wake any waiting producers
            return item;
        }
    }
}

// ROTATE a square matrix 90° clockwise, IN PLACE
// Trick: transpose (flip along the diagonal), then reverse each row.
public static void rotate90(int[][] m) {
    int n = m.length;

    for (int i = 0; i < n; i++)                  // transpose
        for (int j = i + 1; j < n; j++) {
            int t = m[i][j]; m[i][j] = m[j][i]; m[j][i] = t;
        }

    for (int[] row : m) {                        // reverse each row
        for (int l = 0, r = n - 1; l < r; l++, r--) {
            int t = row[l]; row[l] = row[r]; row[r] = t;
        }
    }
}

// SPIRAL print - shrink four boundaries inward
public static List<Integer> spiral(int[][] m) {
    List<Integer> out = new ArrayList<>();
    if (m.length == 0) return out;

    int top = 0, bottom = m.length - 1, left = 0, right = m[0].length - 1;

    while (top <= bottom && left <= right) {
        for (int j = left; j <= right; j++)  out.add(m[top][j]);     top++;
        for (int i = top;  i <= bottom; i++) out.add(m[i][right]);   right--;

        if (top <= bottom)                                            // guard for thin matrices
            { for (int j = right; j >= left; j--) out.add(m[bottom][j]); bottom--; }
        if (left <= right)
            { for (int i = bottom; i >= top; i--) out.add(m[i][left]); left++; }
    }
    return out;
}

Time O(n²) · Space O(1) for rotate, O(n²) output for spiral

record Employee(String name, String dept, BigDecimal salary, int age, String managerId) {}

// 1. Highest-paid employee per department
Map<String, Optional<Employee>> topPerDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept,
             Collectors.maxBy(Comparator.comparing(Employee::salary))));

// 2. Average salary per department, sorted by department name
Map<String, Double> avgByDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept, TreeMap::new,
             Collectors.averagingDouble(e -> e.salary().doubleValue())));

// 3. Total salary bill
BigDecimal total = employees.stream()
    .map(Employee::salary)
    .reduce(BigDecimal.ZERO, BigDecimal::add);

// 4. Names of employees earning above the overall average
double avg = employees.stream().mapToDouble(e -> e.salary().doubleValue()).average().orElse(0);
List<String> aboveAvg = employees.stream()
    .filter(e -> e.salary().doubleValue() > avg)
    .map(Employee::name)
    .sorted()
    .toList();

// 5. Count employees per department, descending by count
LinkedHashMap<String, Long> countDesc = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept, Collectors.counting()))
    .entrySet().stream()
    .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
    .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue,
                              (a, b) -> a, LinkedHashMap::new));

// 6. Build an org chart: manager -> direct reports
Map<String, List<Employee>> reports = employees.stream()
    .filter(e -> e.managerId() != null)
    .collect(Collectors.groupingBy(Employee::managerId));

// 7. Partition into eligible / not eligible, then sort each group
Map<Boolean, List<Employee>> eligibility = employees.stream()
    .collect(Collectors.partitioningBy(e -> e.age() >= 40));

record Employee(int id, String name, String dept, double salary, int age, String city) {}

List<Employee> employees = List.of(
    new Employee(1, "Arun",   "IT",      95000, 34, "Chennai"),
    new Employee(2, "Bhavna", "IT",      82000, 29, "Pune"),
    new Employee(3, "Chetan", "HR",      54000, 41, "Chennai"),
    new Employee(4, "Divya",  "Finance", 76000, 37, "Mumbai"),
    new Employee(5, "Esha",   "IT",     120000, 45, "Pune"),
    new Employee(6, "Farid",  "HR",      58000, 26, "Mumbai"),
    new Employee(7, "Gita",   "Finance", 91000, 31, "Chennai")
);

List<String> words   = List.of("banana","apple","cherry","apple","date","banana","apple");
List<Integer> numbers = List.of(5, 3, 9, 1, 7, 3, 8, 2, 9);

// 1. Names of all IT employees, sorted alphabetically
List<String> itNames = employees.stream()
    .filter(e -> e.dept().equals("IT"))
    .map(Employee::name)
    .sorted()
    .toList();

// 2. Employees earning more than 80,000, highest first
List<Employee> wellPaid = employees.stream()
    .filter(e -> e.salary() > 80_000)
    .sorted(Comparator.comparingDouble(Employee::salary).reversed())
    .toList();

// 3. All distinct departments
List<String> depts = employees.stream()
    .map(Employee::dept)
    .distinct()
    .sorted()
    .toList();

// 4. Uppercase names, comma separated
String csv = employees.stream()
    .map(e -> e.name().toUpperCase())
    .collect(Collectors.joining(", ", "[", "]"));

// 5. Sort by department, then salary DESCENDING within each department
List<Employee> sorted = employees.stream()
    .sorted(Comparator.comparing(Employee::dept)
                      .thenComparing(Employee::salary, Comparator.reverseOrder()))
    .toList();

// 6. Group employees by department
Map<String, List<Employee>> byDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept));

// 7. Count employees per department
Map<String, Long> countByDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept, Collectors.counting()));

// 8. Only the NAMES grouped by department (downstream 'mapping')
Map<String, List<String>> namesByDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept,
             Collectors.mapping(Employee::name, Collectors.toList())));

// 9. Two-level grouping: department, then city
Map<String, Map<String, List<String>>> byDeptThenCity = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept,
             Collectors.groupingBy(Employee::city,
             Collectors.mapping(Employee::name, Collectors.toList()))));

// 10. Word frequency, sorted by count descending
LinkedHashMap<String, Long> freq = words.stream()
    .collect(Collectors.groupingBy(w -> w, Collectors.counting()))
    .entrySet().stream()
    .sorted(Map.Entry.<String, Long>comparingByValue().reversed())
    .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue,
                              (a, b) -> a, LinkedHashMap::new));

// 11. Total salary bill
double total = employees.stream().mapToDouble(Employee::salary).sum();

// 12. Average salary per department
Map<String, Double> avgByDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept,
             Collectors.averagingDouble(Employee::salary)));

// 13. Highest-paid employee overall
Optional<Employee> topEarner = employees.stream()
    .max(Comparator.comparingDouble(Employee::salary));

// 14. Highest-paid employee PER department
Map<String, Optional<Employee>> topPerDept = employees.stream()
    .collect(Collectors.groupingBy(Employee::dept,
             Collectors.maxBy(Comparator.comparingDouble(Employee::salary))));

// 15. All the statistics in ONE pass
DoubleSummaryStatistics stats = employees.stream()
    .mapToDouble(Employee::salary)
    .summaryStatistics();

// 16. Map of id -> name
Map<Integer, String> idToName = employees.stream()
    .collect(Collectors.toMap(Employee::id, Employee::name));

// 17. Map of name -> salary, handling duplicate keys safely
Map<String, Double> nameToSalary = employees.stream()
    .collect(Collectors.toMap(Employee::name, Employee::salary,
                              (existing, duplicate) -> existing));   // keep the first

// 18. Partition into "above 35" and "35 or under"
Map<Boolean, List<String>> byAge = employees.stream()
    .collect(Collectors.partitioningBy(e -> e.age() > 35,
             Collectors.mapping(Employee::name, Collectors.toList())));

// 19. flatMap: all distinct characters used in all names
List<String> letters = employees.stream()
    .map(Employee::name)
    .flatMap(n -> n.toLowerCase().chars().mapToObj(c -> String.valueOf((char) c)))
    .distinct().sorted().toList();

// 20. flatMap over nested lists
List<List<Integer>> nested = List.of(List.of(1,2), List.of(3,4), List.of(5));
List<Integer> flat = nested.stream().flatMap(List::stream).toList();

// 21. Second highest number (distinct)
Optional<Integer> second = numbers.stream()
    .distinct()
    .sorted(Comparator.reverseOrder())
    .skip(1)
    .findFirst();

// 22. Sum of squares of even numbers
int sumSquares = numbers.stream()
    .filter(n -> n % 2 == 0)
    .mapToInt(n -> n * n)
    .sum();

// 23. Find duplicates in a list
Set<Integer> seen = new HashSet<>();
Set<Integer> duplicates = numbers.stream()
    .filter(n -> !seen.add(n))          // add() returns false if already present
    .collect(Collectors.toSet());

// 24. First non-repeating character of a string
Character firstUnique = "swiss".chars().mapToObj(c -> (char) c)
    .collect(Collectors.groupingBy(c -> c, LinkedHashMap::new, Collectors.counting()))
    .entrySet().stream()
    .filter(e -> e.getValue() == 1)
    .map(Map.Entry::getKey)
    .findFirst().orElse(null);

// 25. Reverse each word in a sentence, keeping word order
String reversedWords = Arrays.stream("the sky is blue".split(" "))
    .map(w -> new StringBuilder(w).reverse().toString())
    .collect(Collectors.joining(" "));

// 26. Sum with BigDecimal - the correct way to total money
BigDecimal totalMoney = orders.stream()
    .map(Order::amount)
    .reduce(BigDecimal.ZERO, BigDecimal::add);

// 27. teeing (Java 12): two collectors, one pass, combined result
record MinMax(double min, double max) {}
MinMax range = employees.stream().collect(Collectors.teeing(
    Collectors.summarizingDouble(Employee::salary),
    Collectors.counting(),
    (stats, count) -> new MinMax(stats.getMin(), stats.getMax())
));

// 28. Infinite stream, bounded by limit - generate the first 10 even numbers
List<Integer> evens = Stream.iterate(0, n -> n + 2).limit(10).toList();

// 3-argument iterate (Java 9) has the condition built in
List<Integer> powers = Stream.iterate(1, n -> n < 100, n -> n * 2).toList();

// 29. takeWhile vs filter - the difference matters
List<Integer> nums = List.of(1, 2, 3, 10, 4, 5);
nums.stream().takeWhile(n -> n < 5).toList();   // STOPS at the first failure
nums.stream().filter(n   -> n < 5).toList();    // checks EVERY element

// 30. A custom collector - collect into an unmodifiable sorted set
TreeSet<String> names = employees.stream()
    .map(Employee::name)
    .collect(Collectors.toCollection(TreeSet::new));

// ❌ Reusing a stream
Stream<String> s = list.stream();
s.filter(...).count();
s.map(...).toList();          // IllegalStateException: stream has already been operated upon

// ❌ Side effects inside a stream (breaks with parallel, and hides intent)
List<String> out = new ArrayList<>();
list.stream().forEach(out::add);            // use .toList() instead

// ❌ Modifying the source while streaming it
list.stream().forEach(x -> list.remove(x)); // ConcurrentModificationException

// ❌ peek() for real logic - the JVM may skip it entirely
list.stream().peek(x -> save(x)).count();

// ❌ Boxing in a hot loop
list.stream().map(Integer::valueOf).reduce(0, Integer::sum);   // use mapToInt(...).sum()

// ❌ Assuming a stream is faster than a loop
// For a small list, a plain for-loop is often faster. Streams win on readability
// and on parallelism, not automatically on speed.

// ❌ parallelStream() around blocking I/O
ids.parallelStream().map(client::fetch).toList();   // starves the common ForkJoinPool

1. Entity

@Entity
@Table(name = "orders", indexes = @Index(name="ix_orders_status", columnList = "status,created_at"))
public class Order {

    @Id @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "order_seq")
    @SequenceGenerator(name = "order_seq", sequenceName = "order_seq", allocationSize = 50)
    private Long id;

    @Column(nullable = false, unique = true, length = 40)
    private String reference;

    @Enumerated(EnumType.STRING)                    // STRING, never ORDINAL - see note below
    @Column(nullable = false, length = 20)
    private OrderStatus status = OrderStatus.NEW;

    @Column(nullable = false, precision = 19, scale = 2)
    private BigDecimal total;

    @Version private long version;                  // optimistic locking
    @CreatedDate private Instant createdAt;         // needs @EnableJpaAuditing

    @OneToMany(mappedBy = "order", cascade = CascadeType.ALL, orphanRemoval = true)
    private List<OrderLine> lines = new ArrayList<>();

    public void addLine(OrderLine l){ lines.add(l); l.setOrder(this); }
    // getters/setters omitted
}

2. DTOs — never expose the entity

public record CreateOrderRequest(
    @NotBlank @Size(max = 40) String reference,
    @NotEmpty @Valid List<LineRequest> lines) {}

public record OrderResponse(Long id, String reference, String status,
                            BigDecimal total, Instant createdAt) {

    public static OrderResponse from(Order o){
        return new OrderResponse(o.getId(), o.getReference(),
                                 o.getStatus().name(), o.getTotal(), o.getCreatedAt());
    }
}

3. Repository

public interface OrderRepository extends JpaRepository<Order, Long> {

    Optional<Order> findByReference(String reference);
    boolean existsByReference(String reference);

    @EntityGraph(attributePaths = "lines")               // avoids N+1
    Page<Order> findByStatus(OrderStatus status, Pageable pageable);
}

4. Service — where the transaction and the business rules live

@Service
@Transactional(readOnly = true)                          // read-only by default
public class OrderService {

    private final OrderRepository repo;

    public OrderService(OrderRepository repo){ this.repo = repo; }

    public Page<OrderResponse> list(OrderStatus status, Pageable pageable){
        return repo.findByStatus(status, pageable).map(OrderResponse::from);
    }

    public OrderResponse get(Long id){
        return repo.findById(id).map(OrderResponse::from)
                   .orElseThrow(() -> new OrderNotFoundException(id));
    }

    @Transactional                                        // write -> override readOnly
    public OrderResponse create(CreateOrderRequest req){
        if (repo.existsByReference(req.reference()))
            throw new DuplicateOrderException(req.reference());

        Order order = new Order();
        order.setReference(req.reference());
        req.lines().forEach(l -> order.addLine(toLine(l)));
        order.setTotal(order.getLines().stream()
                .map(OrderLine::lineTotal)
                .reduce(BigDecimal.ZERO, BigDecimal::add));

        return OrderResponse.from(repo.save(order));
    }

    @Transactional
    public void cancel(Long id){
        Order o = repo.findById(id).orElseThrow(() -> new OrderNotFoundException(id));
        if (o.getStatus() == OrderStatus.SHIPPED)
            throw new IllegalStateTransitionException("Cannot cancel a shipped order");
        o.setStatus(OrderStatus.CANCELLED);               // dirty checking - no save() needed
    }
}

5. Controller — thin, no business logic

@RestController
@RequestMapping("/api/v1/orders")
@Validated
public class OrderController {

    private final OrderService service;
    public OrderController(OrderService service){ this.service = service; }

    @GetMapping
    Page<OrderResponse> list(@RequestParam(defaultValue = "NEW") OrderStatus status,
                             @PageableDefault(size = 20, sort = "createdAt",
                                              direction = Sort.Direction.DESC) Pageable pageable){
        return service.list(status, pageable);
    }

    @GetMapping("/{id}")
    OrderResponse get(@PathVariable Long id){ return service.get(id); }

    @PostMapping
    ResponseEntity<OrderResponse> create(@Valid @RequestBody CreateOrderRequest req){
        OrderResponse created = service.create(req);
        URI location = ServletUriComponentsBuilder.fromCurrentRequest()
                          .path("/{id}").buildAndExpand(created.id()).toUri();
        return ResponseEntity.created(location).body(created);   // 201 + Location header
    }

    @PatchMapping("/{id}/cancel")
    @ResponseStatus(HttpStatus.NO_CONTENT)                       // 204
    void cancel(@PathVariable Long id){ service.cancel(id); }
}

6. Global error handling

@RestControllerAdvice
class ApiExceptionHandler {

    @ExceptionHandler(OrderNotFoundException.class)
    ProblemDetail notFound(OrderNotFoundException e){
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, e.getMessage());
    }

    @ExceptionHandler(DuplicateOrderException.class)
    ProblemDetail duplicate(DuplicateOrderException e){
        return ProblemDetail.forStatusAndDetail(HttpStatus.CONFLICT, e.getMessage());   // 409
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    ProblemDetail invalid(MethodArgumentNotValidException e){
        var pd = ProblemDetail.forStatus(HttpStatus.BAD_REQUEST);
        pd.setProperty("errors", e.getBindingResult().getFieldErrors().stream()
            .collect(toMap(FieldError::getField, FieldError::getDefaultMessage, (a,b)->a)));
        return pd;
    }
}

// ---------- UNIT TEST: business logic, no Spring, milliseconds ----------
@ExtendWith(MockitoExtension.class)
class OrderServiceTest {

    @Mock OrderRepository repo;
    @InjectMocks OrderService service;

    @Test
    void createsOrderAndCalculatesTotal(){
        given(repo.existsByReference("R-1")).willReturn(false);
        given(repo.save(any())).willAnswer(inv -> inv.getArgument(0));

        var req = new CreateOrderRequest("R-1",
                      List.of(new LineRequest("SKU1", 2, new BigDecimal("50.00"))));

        OrderResponse out = service.create(req);

        assertThat(out.total()).isEqualByComparingTo("100.00");
        assertThat(out.status()).isEqualTo("NEW");
    }

    @Test
    void rejectsDuplicateReference(){
        given(repo.existsByReference("R-1")).willReturn(true);

        assertThatThrownBy(() -> service.create(new CreateOrderRequest("R-1", List.of(line()))))
            .isInstanceOf(DuplicateOrderException.class);

        then(repo).should(never()).save(any());      // and nothing was written
    }

    @Test
    void cannotCancelAShippedOrder(){
        Order shipped = orderWithStatus(OrderStatus.SHIPPED);
        given(repo.findById(1L)).willReturn(Optional.of(shipped));

        assertThatThrownBy(() -> service.cancel(1L))
            .isInstanceOf(IllegalStateTransitionException.class);
    }
}

// ---------- WEB SLICE: routing, validation, JSON, status codes ----------
@WebMvcTest(OrderController.class)
class OrderControllerTest {

    @Autowired MockMvc mvc;
    @MockBean OrderService service;

    @Test
    void returns201WithLocationHeader() throws Exception {
        given(service.create(any())).willReturn(
            new OrderResponse(7L, "R-1", "NEW", new BigDecimal("100.00"), Instant.now()));

        mvc.perform(post("/api/v1/orders")
               .contentType(MediaType.APPLICATION_JSON)
               .content("""
                        { "reference": "R-1",
                          "lines": [{ "sku": "SKU1", "qty": 2, "price": 50.00 }] }
                        """))
           .andExpect(status().isCreated())
           .andExpect(header().string("Location", containsString("/api/v1/orders/7")))
           .andExpect(jsonPath("$.reference").value("R-1"));
    }

    @Test
    void returns400WhenReferenceMissing() throws Exception {
        mvc.perform(post("/api/v1/orders")
               .contentType(MediaType.APPLICATION_JSON).content("{\"lines\":[]}"))
           .andExpect(status().isBadRequest())
           .andExpect(jsonPath("$.errors.reference").exists());
    }
}

// ---------- INTEGRATION: real Postgres, real SQL, real migrations ----------
@SpringBootTest
@Testcontainers
class OrderRepositoryIT {

    @Container
    static PostgreSQLContainer<?> db = new PostgreSQLContainer<>("postgres:16-alpine");

    @DynamicPropertySource
    static void props(DynamicPropertyRegistry r){
        r.add("spring.datasource.url", db::getJdbcUrl);
        r.add("spring.datasource.username", db::getUsername);
        r.add("spring.datasource.password", db::getPassword);
    }

    @Autowired OrderRepository repo;

    @Test
    void enforcesUniqueReference(){
        repo.saveAndFlush(order("R-1"));
        assertThatThrownBy(() -> repo.saveAndFlush(order("R-1")))
            .isInstanceOf(DataIntegrityViolationException.class);
    }
}

// 1. Accept Pageable directly - Spring binds ?page=0&size=20&sort=createdAt,desc
@GetMapping
Page<OrderResponse> search(
        @RequestParam(required = false) OrderStatus status,
        @RequestParam(required = false) String customerId,
        @RequestParam(required = false) @DateTimeFormat(iso = DATE) LocalDate from,
        @PageableDefault(size = 20, sort = "createdAt", direction = DESC) Pageable pageable) {

    return service.search(new OrderFilter(status, customerId, from), pageable);
}

// 2. Dynamic filtering with a Specification - only apply the filters that were supplied
public Page<OrderResponse> search(OrderFilter f, Pageable pageable) {

    Specification<Order> spec = (root, query, cb) -> {
        List<Predicate> predicates = new ArrayList<>();

        if (f.status() != null)
            predicates.add(cb.equal(root.get("status"), f.status()));
        if (f.customerId() != null)
            predicates.add(cb.equal(root.get("customerId"), f.customerId()));
        if (f.from() != null)
            predicates.add(cb.greaterThanOrEqualTo(root.get("createdAt"),
                           f.from().atStartOfDay(ZoneOffset.UTC).toInstant()));

        return cb.and(predicates.toArray(new Predicate[0]));
    };

    return repo.findAll(spec, pageable).map(OrderResponse::from);
}

// 1. The typed client interface
@HttpExchange("/api/pricing")
public interface PricingClient {
    @GetExchange("/{sku}")
    PriceDto price(@PathVariable String sku);
}

// 2. Configuration - timeouts are NOT optional
@Configuration
class PricingClientConfig {

    @Bean
    PricingClient pricingClient(@Value("${pricing.base-url}") String baseUrl) {
        var factory = new SimpleClientHttpRequestFactory();
        factory.setConnectTimeout(1_000);          // TCP connect
        factory.setReadTimeout(2_000);             // waiting for the response

        RestClient client = RestClient.builder()
                .baseUrl(baseUrl)
                .requestFactory(factory)
                .defaultHeader("X-Trace-Id", MDC.get("traceId"))
                .build();

        return HttpServiceProxyFactory
                .builderFor(RestClientAdapter.create(client))
                .build()
                .createClient(PricingClient.class);
    }
}

// 3. Wrap it with resilience
@Service
public class PricingService {

    private final PricingClient client;
    private final Cache<String, PriceDto> cache =
            Caffeine.newBuilder().maximumSize(10_000)
                    .expireAfterWrite(Duration.ofMinutes(10)).build();

    @CircuitBreaker(name = "pricing", fallbackMethod = "fallbackPrice")
    @Retry(name = "pricing")
    public PriceDto price(String sku) {
        PriceDto p = client.price(sku);
        cache.put(sku, p);
        return p;
    }

    // Signature = original params + Throwable
    private PriceDto fallbackPrice(String sku, Throwable t) {
        log.warn("pricing unavailable for sku={}, serving cached", sku, t);
        PriceDto stale = cache.getIfPresent(sku);
        if (stale != null) return stale.markStale();
        throw new PricingUnavailableException(sku, t);      // no cache -> fail honestly
    }
}

# application.yml
resilience4j:
  retry:
    instances.pricing:
      maxAttempts: 3
      waitDuration: 200ms
      enableExponentialBackoff: true
      retryExceptions: [java.io.IOException, org.springframework.web.client.HttpServerErrorException]
  circuitbreaker:
    instances.pricing:
      slidingWindowSize: 50
      failureRateThreshold: 50
      waitDurationInOpenState: 30s

// GIVEN THIS - how many problems can you find?
@RestController
public class OrderController {

    @Autowired
    private OrderRepository repo;

    @GetMapping("/orders")
    public List<Order> getOrders(@RequestParam String status) {
        List<Order> all = repo.findAll();
        List<Order> result = new ArrayList<>();
        for (Order o : all) {
            if (o.getStatus().equals(status)) {
                result.add(o);
            }
        }
        return result;
    }

    @PostMapping("/orders")
    public Order create(@RequestBody Order order) {
        try {
            return repo.save(order);
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }
}

The findings, in review order

• [blocking] Loads the entire table into memory then filters in Java. Should be repo.findByStatus(status, pageable) — a query plus pagination.
• [blocking] No pagination. This endpoint gets slower every day and will eventually OOM.
• [blocking] Returns the entity directly — leaks the schema into the API, risks LazyInitializationException during serialization, and may expose internal fields.
• [blocking] Accepts the entity as the request body — mass-assignment risk: a caller can set id, status or version. Use a request DTO.
• [blocking] Swallows the exception, prints a stack trace to stdout, and returns null with a 200 OK. The client is told everything succeeded. Should propagate to a @RestControllerAdvice.
• [blocking] No validation — no @Valid, no constraints.
• [blocking] NPE risk — o.getStatus() assumes non-null; safer as status.equals(o.getStatus()) or Objects.equals.
• [suggestion] Field injection — use constructor injection so the field can be final and the class is testable without Spring.
• [suggestion] No API versioning — /api/v1/orders.
• [suggestion] POST should return 201 with a Location header, not 200.
• [suggestion] status should be typed as the enum, so an invalid value is rejected at binding.
• [nit] The filtering loop is a stream one-liner — but it shouldn't exist at all (see the first point).

@Component({
  selector: 'app-order-list',
  standalone: true,
  imports: [CommonModule, ReactiveFormsModule, RouterLink],
  changeDetection: ChangeDetectionStrategy.OnPush,          // 1. OnPush
  template: `
    <input [formControl]="search" placeholder="Search orders…" />

    @if (vm(); as state) {
      @switch (state.status) {
        @case ('loading') { <app-spinner /> }
        @case ('error')   { <app-error [msg]="state.message" (retry)="reload()" /> }
        @case ('empty')   { <p>No orders match “{{ search.value }}”</p> }
        @case ('loaded')  {
          <table>
            @for (o of state.data.content; track o.id) {       <!-- 2. track -->
              <tr>
                <td><a [routerLink]="['/orders', o.id]">{{ o.reference }}</a></td>
                <td>{{ o.total | currency:'INR' }}</td>
                <td>{{ o.createdAt | date:'medium' }}</td>
              </tr>
            }
          </table>
          <app-paginator [page]="page()" [total]="state.data.totalPages"
                         (pageChange)="page.set($event)" />
        }
      }
    }
  `
})
export class OrderListComponent {
  private api = inject(OrderApi);

  readonly search = new FormControl('', { nonNullable: true });
  readonly page   = signal(0);

  private readonly search$ = this.search.valueChanges.pipe(
    debounceTime(300),                    // 3. don't fire on every keystroke
    distinctUntilChanged(),
    tap(() => this.page.set(0)),          // new search resets to page 1
    startWith('')
  );

  readonly vm = toSignal(
    combineLatest([this.search$, toObservable(this.page)]).pipe(
      switchMap(([q, page]) =>            // 4. switchMap cancels the stale request
        this.api.search(q, page).pipe(
          map(data => data.content.length
                ? { status: 'loaded', data } as const
                : { status: 'empty' } as const),
          startWith({ status: 'loading' } as const),
          catchError(e => of({ status: 'error', message: friendly(e) } as const))
        ))
    )
  );                                      // 5. toSignal cleans up automatically

  reload(){ this.search.setValue(this.search.value); }
}

@Component({
  selector: 'app-order-form',
  standalone: true,
  imports: [ReactiveFormsModule, CommonModule],
  changeDetection: ChangeDetectionStrategy.OnPush,
  template: `
    <form [formGroup]="form" (ngSubmit)="submit()">

      <input formControlName="reference" placeholder="Reference" />
      @if (ref.touched && ref.errors) {
        @if (ref.errors['required'])  { <small>Reference is required</small> }
        @if (ref.errors['taken'])     { <small>That reference already exists</small> }
      }

      <div formArrayName="lines">
        @for (line of lines.controls; track $index) {
          <div [formGroupName]="$index">
            <input formControlName="sku" />
            <input formControlName="qty" type="number" />
            <button type="button" (click)="removeLine($index)">Remove</button>
          </div>
        }
      </div>

      <button type="button" (click)="addLine()">Add line</button>
      <button type="submit" [disabled]="form.invalid || form.pending || saving()">
        Save
      </button>
    </form>
  `
})
export class OrderFormComponent {
  private fb  = inject(FormBuilder);
  private api = inject(OrderApi);
  readonly saving = signal(false);

  readonly form = this.fb.nonNullable.group({
    reference: ['', [Validators.required, Validators.maxLength(40)],
                    [this.referenceTaken()]],                     // async validator
    lines: this.fb.array([this.newLine()], [Validators.required])
  }, { validators: [atLeastOneLine] });                           // group-level validator

  get ref()   { return this.form.controls.reference; }
  get lines() { return this.form.controls.lines; }

  private newLine(){
    return this.fb.nonNullable.group({
      sku: ['', Validators.required],
      qty: [1, [Validators.required, Validators.min(1)]]
    });
  }
  addLine(){ this.lines.push(this.newLine()); }
  removeLine(i: number){ this.lines.removeAt(i); }

  // ASYNC VALIDATOR - debounced so it doesn't call the API on every keystroke
  private referenceTaken(): AsyncValidatorFn {
    return (control: AbstractControl) => timer(400).pipe(
      switchMap(() => this.api.referenceExists(control.value)),
      map(exists => exists ? { taken: true } : null),
      catchError(() => of(null))          // a failed check should not block the user
    );
  }

  submit(){
    if (this.form.invalid) { this.form.markAllAsTouched(); return; }   // reveal all errors
    this.saving.set(true);
    this.api.create(this.form.getRawValue())
        .pipe(finalize(() => this.saving.set(false)))
        .subscribe({ next: () => this.router.navigate(['/orders']),
                     error: e  => this.toast.error(e) });
  }
}

// CUSTOM SYNC VALIDATOR at group level
export const atLeastOneLine: ValidatorFn = (group: AbstractControl) => {
  const lines = group.get('lines') as FormArray;
  return lines.length > 0 ? null : { noLines: true };
};

let refreshing = false;
const refreshed$ = new BehaviorSubject<string | null>(null);

export const authInterceptor: HttpInterceptorFn = (req, next) => {
  const auth = inject(AuthService);

  // never attach the token to the refresh call itself, or to third-party URLs
  if (req.url.includes('/auth/refresh')) return next(req);

  const token = auth.accessToken();
  const authed = token ? withToken(req, token) : req;

  return next(authed).pipe(
    catchError((err: HttpErrorResponse) => {
      if (err.status !== 401) return throwError(() => err);

      if (!refreshing) {
        refreshing = true;
        refreshed$.next(null);                     // make everyone else wait

        return auth.refresh().pipe(
          switchMap(newToken => {
            refreshing = false;
            refreshed$.next(newToken);             // release the queued requests
            return next(withToken(req, newToken)); // retry THIS request
          }),
          catchError(refreshError => {
            refreshing = false;
            auth.logout();                         // refresh failed -> session is over
            return throwError(() => refreshError);
          })
        );
      }

      // another request is already refreshing - queue up behind it
      return refreshed$.pipe(
        filter((t): t is string => t !== null),
        take(1),
        switchMap(newToken => next(withToken(req, newToken)))
      );
    })
  );
};

const withToken = (req: HttpRequest<unknown>, token: string) =>
    req.clone({ setHeaders: { Authorization: `Bearer ${token}` } });

@Component({
  selector: 'app-card',
  standalone: true,
  changeDetection: ChangeDetectionStrategy.OnPush,
  template: `
    <section class="card" [class.card--danger]="variant() === 'danger'">
      <header>
        <ng-content select="[card-title]" />      <!-- named slot -->
      </header>

      <div class="card__body">
        <ng-content />                            <!-- default slot -->
      </div>

      @if (hasFooter()) {
        <footer><ng-content select="[card-actions]" /></footer>
      }
    </section>
  `
})
export class CardComponent {
  readonly variant   = input<'default' | 'danger'>('default');
  readonly hasFooter = input(true);
}

<!-- Using it -->
<app-card variant="danger">
  <h3 card-title>Cancel this order?</h3>
  <p>This cannot be undone.</p>
  <div card-actions>
    <button (click)="confirm()">Confirm</button>
  </div>
</app-card>

// ---------- SERVICE ----------
describe('OrderApi', () => {
  let api: OrderApi;
  let http: HttpTestingController;

  beforeEach(() => {
    TestBed.configureTestingModule({
      providers: [OrderApi, provideHttpClient(), provideHttpClientTesting()]
    });
    api  = TestBed.inject(OrderApi);
    http = TestBed.inject(HttpTestingController);
  });

  afterEach(() => http.verify());          // fails if any unexpected request was made

  it('sends the search query and page as params', () => {
    api.search('abc', 2).subscribe(res => expect(res.content.length).toBe(1));

    const req = http.expectOne(r => r.url === '/api/v1/orders');
    expect(req.request.method).toBe('GET');
    expect(req.request.params.get('q')).toBe('abc');
    expect(req.request.params.get('page')).toBe('2');

    req.flush({ content: [{ id: 1 }], totalPages: 1 });
  });

  it('maps a 500 to a friendly error', () => {
    api.search('abc', 0).subscribe({
      error: e => expect(e.message).toContain('temporarily unavailable')
    });
    http.expectOne(() => true).flush('boom', { status: 500, statusText: 'Server Error' });
  });
});

// ---------- COMPONENT ----------
describe('OrderListComponent', () => {
  let fixture: ComponentFixture<OrderListComponent>;
  const apiSpy = jasmine.createSpyObj('OrderApi', ['search']);

  beforeEach(async () => {
    apiSpy.search.and.returnValue(of({ content: [{ id: 1, reference: 'R-1' }],
                                       totalPages: 1 }));
    await TestBed.configureTestingModule({
      imports: [OrderListComponent],                       // standalone -> import
      providers: [{ provide: OrderApi, useValue: apiSpy }]
    }).compileComponents();

    fixture = TestBed.createComponent(OrderListComponent);
    fixture.detectChanges();
  });

  it('renders one row per order', () => {
    const rows = fixture.nativeElement.querySelectorAll('tbody tr');
    expect(rows.length).toBe(1);
    expect(rows[0].textContent).toContain('R-1');
  });

  it('debounces the search input', fakeAsync(() => {
    const input = fixture.nativeElement.querySelector('input');
    input.value = 'ja';
    input.dispatchEvent(new Event('input'));

    tick(100);
    expect(apiSpy.search).toHaveBeenCalledTimes(1);     // still only the initial load

    tick(300);                                          // now past debounceTime(300)
    expect(apiSpy.search).toHaveBeenCalledTimes(2);
  }));
});

// GIVEN THIS - what's wrong?
@Component({
  selector: 'app-orders',
  template: `
    <input (keyup)="search($event)" />
    <div *ngFor="let o of orders">
      {{ formatTotal(o) }}
    </div>
  `
})
export class OrdersComponent implements OnInit {
  orders: Order[] = [];

  constructor(private http: HttpClient) {}

  ngOnInit() {
    this.http.get<Order[]>('http://api.example.com/orders')
        .subscribe(data => this.orders = data);
  }

  search(event: any) {
    this.http.get<Order[]>('http://api.example.com/orders?q=' + event.target.value)
        .subscribe(data => this.orders = data);
  }

  formatTotal(o: Order) {
    return new Intl.NumberFormat('en-IN', { style: 'currency', currency: 'INR' })
             .format(o.total);
  }
}

The findings

• [blocking] No debounce on the search — one HTTP request per keystroke. Typing "chennai" fires seven requests.
• [blocking] Race condition — responses can arrive out of order, so a slow early response overwrites a newer one. Needs switchMap.
• [blocking] Method call in the template — formatTotal() runs on every change-detection cycle for every row, and it constructs a new Intl.NumberFormat each time. Use the currency pipe.
• [blocking] Hard-coded absolute URL — should come from injected configuration, so the same build works in every environment.
• [blocking] No error handling — a failed request leaves the user staring at an empty screen with no message.
• [suggestion] No trackBy/track — the whole list is destroyed and rebuilt on every update.
• [suggestion] No OnPush.
• [suggestion] HttpClient used directly in the component — belongs in a typed service.
• [suggestion] event: any — loses type safety; and reading event.target.value is fragile. Use a FormControl.
• [suggestion] No loading state.
• [nit] (keyup) misses paste-by-mouse; valueChanges on a FormControl catches everything.