Defensive copying

Protect an owned mutable representation by copying mutable data received from clients and by returning independent copies instead of internal mutable objects. Copying only on entry leaves an accessor leak; copying only on exit leaves the constructor argument aliased. For an object containing only primitive fields, a field-by-field copy suffices. Nested mutable references can require a deep copy, immutable components or a stronger ownership contract.

The correctness argument follows aliases: after copying, no client-held reference reaches the owned mutable fields, and every public mutation goes through operations preserving the owner's representation invariant. Copying is one technique for encapsulation, not a substitute for deciding which state is meant to remain mutable.