Built-in exclusion profiles cover the common cases. What isn't covered is listed below.
Reflection by literal name, ServiceLoader provider lookups, JPMS module
descriptors, Spring's own bean lifecycle (your classes stay eligible; Spring's internals
don't), and the packaged internals of CGLIB, ByteBuddy, Javassist, and Hibernate's bytecode
provider. Each is documented in full under Exclusions.
A Kotlin/Java-interop application ran through the full pipeline during development, but Kotlin is not a separately tested target, and no Kotlin-specific handling exists.
Layering RJNI's output with another obfuscator, running RJNI before or after ProGuard, Zelix KlassMaster, Allatori, or DashO, is out of scope for the current build. Compatibility and ordering with any of these is unknown.