defensive copy / unmodifiableList for storage