defensive copy in constructor for storage, and unmodifiableList in getter