The audit record that was edited after the fact

import java.util.*;

/**
 * Solution: the audit record that was edited after the fact.
 *
 * final guaranteed that the three fields would never be REASSIGNED. It said
 * nothing whatsoever about the objects they point at, and both of those
 * objects were mutable and reachable from outside.
 *
 * Two leaks, in opposite directions, and both were needed:
 *
 *   The constructor stored the caller's list and the caller's Date, so the
 *   code that built the entry kept live handles to its insides.
 *
 *   The getters handed those same objects to every reader. That is how the
 *   reporting code — which assigns to nothing and is honestly documented as
 *   read-only — deleted rows from the audit trail and moved a timestamp.
 *
 * THE FIX: copy on the way in, copy on the way out.
 *
 *   In:  List.copyOf(changes) and new Date(at.getTime()) in the constructor,
 *        so the builder's references no longer reach the entry.
 *
 *   Out: a fresh ArrayList and a fresh Date from the getters, so a reader
 *        can do whatever it likes to what it was given.
 *
 * WHY THE GETTER RETURNS A MUTABLE COPY
 *   Returning List.copyOf would also protect the entry — and customerVisible
 *   calls removeIf on it, so the report would start throwing
 *   UnsupportedOperationException. That is a legitimate choice and arguably
 *   the better one, because it makes the mistake loud instead of harmless.
 *   It is not this fix, because the brief was to protect the entry without
 *   changing the reporting code. The stretch task is to make the other
 *   choice and deal with the fallout.
 */
public class Solution {

    /** Genuinely immutable: copies on the way in and on the way out. */
    static final class AuditEntry {
        private final String actor;
        private final List<String> changes;
        private final Date at;

        AuditEntry(String actor, List<String> changes, Date at) {
            this.actor = actor;
            this.changes = List.copyOf(changes);          // copy IN
            this.at = new Date(at.getTime());             // Date cannot be frozen
        }

        String actor() {
            return actor;                                 // String is immutable
        }

        List<String> changes() {
            return new ArrayList<>(changes);              // copy OUT, and mutable
        }

        Date at() {
            return new Date(at.getTime());                // copy OUT
        }

        /** The canonical form the auditor compares. */
        String export() {
            return actor + "|" + at.getTime() + "|" + String.join(",", changes);
        }
    }

    /* ── the reporting code, documented read-only ── */

    /** Hides internal-only changes from the customer-facing report. */
    static List<String> customerVisible(AuditEntry entry) {
        List<String> visible = entry.changes();
        visible.removeIf(change -> change.startsWith("internal:"));
        return visible;
    }

    /** Renders the timestamp in the viewer's timezone. */
    static String inViewerTimezone(AuditEntry entry, long offsetMillis) {
        Date shown = entry.at();
        shown.setTime(shown.getTime() + offsetMillis);
        return "at " + shown.getTime();
    }

    public static void main(String[] args) {
        List<String> changes = new ArrayList<>(
                List.of("price: 100 -> 120", "internal:reindexed", "status: draft -> live"));
        Date at = new Date(1_700_000_000_000L);

        AuditEntry entry = new AuditEntry("anita", changes, at);
        String writtenAtTheTime = entry.export();

        System.out.println("── written ──");
        System.out.println("  " + writtenAtTheTime);

        System.out.println();
        System.out.println("── the read-only report runs ──");
        System.out.println("  customer sees : " + customerVisible(entry));
        System.out.println("  rendered      : " + inViewerTimezone(entry, 5 * 3_600_000L));

        String exportedLater = entry.export();

        System.out.println();
        System.out.println("── re-exported ──");
        System.out.println("  " + exportedLater);

        System.out.println();
        boolean trailIntact = writtenAtTheTime.equals(exportedLater);
        System.out.println("audit entry unchanged after reporting : " + trailIntact);
        System.out.println(trailIntact ? "PASS" : "FAIL");
    }
}