How do you keep a Java record truly immutable when one of its components is a mutable type like a List or a Date?

## Why records aren't automatically deeply immutable A **record** stores each component in a `private final` field. The keyword **`final`** on a field means the *reference* cannot be reassigned after construction — it does **not** mean the *object the reference points to* is frozen. This distinction is the heart of the problem. Consider: ```java record Team(String name, List<String> members) {} List<String> m = new ArrayList<>(List.of("Ann")); Team t = new Team("A", m); m.add("Bob"); // mutates the SAME list the record holds! System.out.println(t.members()); // [Ann, Bob] -- the record changed ``` Two leak channels exist: 1. **Inbound leak:** the constructor stored the caller's list directly, so the caller still holds a reference and can mutate it. 2. **Outbound leak:** the accessor `members()` returns the internal list directly, so anyone can call `t.members().add(...)`. Because a record's auto-generated `equals` and `hashCode` are **derived from the component values**, a mutated component silently changes the record's identity in a `HashSet`/`HashMap` key — the same key-mutation hazard as any hash collection. ## Fix 1 — defensive copy inbound (in the canonical constructor) Use the compact canonical constructor to copy the argument so the stored field is independent of the caller's reference: ```java record Team(String name, List<String> members) { Team { members = List.copyOf(members); // immutable, independent copy (also null-checks) } } ``` `List.copyOf` returns an **unmodifiable** list, which also conveniently solves the outbound leak for `List` (the returned reference can't be mutated). For arrays or `Date`, use `members.clone()` / `new Date(d.getTime())`. ## Fix 2 — defensive copy outbound (override the accessor) If the stored field is still mutable (e.g. you kept a mutable `ArrayList` or a `Date`), override the **accessor** to hand back a copy or an unmodifiable view: ```java record Event(Date when) { Event { when = new Date(when.getTime()); } // inbound copy public Date when() { return new Date(when.getTime()); } // outbound copy } ``` Note the accessor must be named exactly after the component (`when()`), and you typically copy in **both** directions for a non-immutable type like `Date`. ## Fix 3 (preferred) — use immutable component types The least error-prone option is to choose component types that are already immutable: `List.copyOf(...)`/`Map.copyOf(...)`, `Instant`/`LocalDate` instead of `Date`, a wrapped value instead of a raw array. Then both leaks vanish and you don't have to remember to override accessors. ## Summary of the boundary discipline - **Inbound** copy in the canonical constructor → external mutation can't reach the field. - **Outbound** copy in the accessor → callers can't mutate the field through the returned reference. - For `List`/`Map`/`Set`, `List.copyOf` etc. handle both at once by being unmodifiable. - Keeping components immutable keeps the derived `equals`/`hashCode` stable, which is required for safe use as map keys.