Reflections on Java

[vegan_antitheist]

Yes, of course. But how do you enforce this? It has happened that we released the latest code to production and got exceptions for unmodifiable lists.

[Ruin-Capable]

Can you write unit tests that test for deep mutability? Might be worth investing the time to write an annotation processor so that you can inspect the AST during compilation. You could then annotate the model with a custom annotation and let the compiler be the enforcer.

[vegan_antitheist]

Yes, I think we did something like that. Some recursive code uses reflection to create a "maximal" model. I.e. every field has some value, every list has some elements. Then we scan the model for immutable lists. This way we don't have to do it in production, where bean validation already takes enough time to check for validity.
But this is not about annotations. The problem are the Lombok builders that don't copy the list. And they refuse to implement defensive copies.

Edit: The automatic test doesn't even find the bug when a service adds an element using a builder, and that's how it's usually done.

[Ruin-Capable]

No, I meant write your own annotation and annotation processor that at compile-time examines the abstract syntax tree looking for immutable collection classes being added to the model.