Feature/8 dependency refresh 0.5.1

.github/workflows/host-tests.yml

@@ -2,7 +2,7 @@ name: Host Tests
 
 on:
   push:
-    branches: [main, feature/observable-callback-coverage]
+    branches: [main, bugfix/7-event-monitor-structured-payload-safety, feature/8-dependency-refresh-0.5.1]
   pull_request:
 
 jobs:
@@ -23,11 +23,18 @@ jobs:
           repository: Flowduino/ESPressio-Observable
           ref: 3.0.1
           path: deps/ESPressio-Observable
+      - name: Checkout ESPressio Serializable 0.10.2
+        uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Serializable
+          ref: 0.10.2
+          path: deps/ESPressio-Serializable
       - name: Configure
         run: >-
           cmake -S tests -B build
           -DESPRESSIO_COMMAND_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Command/src"
           -DESPRESSIO_OBSERVABLE_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Observable/src"
+          -DESPRESSIO_SERIALIZABLE_INCLUDE_DIR="$GITHUB_WORKSPACE/deps/ESPressio-Serializable/src"
       - name: Build
         run: cmake --build build --parallel
       - name: Test
@@ -46,18 +53,36 @@ jobs:
           repository: Flowduino/ESPressio-Observable
           ref: 3.0.1
           path: project/dependencies/ESPressio-Observable
-      - name: Checkout ESPressio Units 0.2.1
+      - name: Checkout ESPressio Units 0.2.3
         uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Units
-          ref: 0.2.1
+          ref: 0.2.3
           path: project/dependencies/ESPressio-Units
-      - name: Checkout ESPressio Timing 2.2.2
+      - name: Checkout ESPressio Timing 2.2.4
         uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-Timing
-          ref: 2.2.2
+          ref: 2.2.4
           path: project/dependencies/ESPressio-Timing
+      - name: Checkout ESPressio Threads 3.1.4
+        uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Threads
+          ref: 3.1.4
+          path: project/dependencies/ESPressio-Threads
+      - name: Checkout ESPressio Serializable 0.10.2
+        uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Serializable
+          ref: 0.10.2
+          path: project/dependencies/ESPressio-Serializable
+      - name: Checkout ESPressio Event 5.8.2
+        uses: actions/checkout@v4
+        with:
+          repository: Flowduino/ESPressio-Event
+          ref: 5.8.2
+          path: project/dependencies/ESPressio-Event
       - name: Checkout ESPressio Command 0.3.0
         uses: actions/checkout@v4
         with:
@@ -76,11 +101,11 @@ jobs:
           repository: Flowduino/ESPressio-Sockets
           ref: 0.5.0
           path: project/dependencies/ESPressio-Sockets
-      - name: Checkout ESPressio ESP-Now 0.5.0
+      - name: Checkout ESPressio ESP-Now 0.5.2
         uses: actions/checkout@v4
         with:
           repository: Flowduino/ESPressio-ESP-Now
-          ref: 0.5.0
+          ref: 0.5.2
           path: project/dependencies/ESPressio-ESP-Now
       - uses: actions/setup-python@v5
         with:
@@ -111,6 +136,9 @@ jobs:
               ../dependencies/ESPressio-Observable
               ../dependencies/ESPressio-Units
               ../dependencies/ESPressio-Timing
+              ../dependencies/ESPressio-Threads
+              ../dependencies/ESPressio-Serializable
+              ../dependencies/ESPressio-Event
               ../ESPressio-Serial
           EOF
           cat > project/compile/src/main.cpp <<'EOF'
@@ -121,9 +149,11 @@ jobs:
           #include <ESPressio_SocketWorkerMonitor.hpp>
           #include <ESPressio_SocketSecuritySessionMonitor.hpp>
           #include <ESPressio_ESPNowTransportMonitor.hpp>
+          #include <ESPressio_EventMonitor.hpp>
+          #include <event/ESPressio_EventMonitorPayloadSafety.hpp>
 
           void setup() {}
           void loop() {}
           EOF
-      - name: Compile ESP32 Observable monitors
+      - name: Compile ESP32 Observable and Event monitors
         run: pio run -d project/compile

CHANGELOG.md

@@ -1,3 +1,31 @@
+## 0.5.1
+
+### Fixed
+
+- Replaced EventMonitor's tree-building `BinaryArchive::Load()` diagnostic path with bounded, allocation-free ESPB traversal from ESPressio Serializable 0.10.2, preventing valid payload diagnostics from requiring a second heap-backed `SerializationNode` tree.
+- Hardened structured `EventMonitor` payload diagnostics so malformed, truncated, excessively nested, or otherwise unreasonable Event Transport payloads are rejected under monitor-specific decode limits.
+- Added fail-safe fallback from `Structured` to bounded `Hex` output whenever a payload fails structured validation or exceeds the configured monitor limits.
+- Updated Event Monitor's optional Serializable baseline to ESPressio Serializable >= 0.10.2 < 1.0.0, consuming the bounded/allocation-free BinaryArchive facilities introduced for Flowduino/ESPressio-Serializable#2.
+
+### Added
+
+- Added `MaximumStructuredNodes` to `EventMonitorConfig` alongside the existing collection, string, and nesting limits.
+- Added deterministic malformed/deep/random payload regression and stress coverage for the EventMonitor structured-payload validation path.
+- Added ESP32 compile validation for `EventMonitor` against the coordinated dependency-refresh candidates: Units 0.2.3, Timing 2.2.4, Threads 3.1.4, ESP-Now 0.5.2, Event 5.8.2, and released Serializable 0.10.2.
+
+### Changed
+
+- Raised the current optional Event integration baseline to ESPressio Event >= 5.8.2 < 6.0.0.
+- Raised the current optional ESP-Now monitor baseline to ESPressio ESP-Now >= 0.5.2 < 1.0.0.
+- Updated current documentation and CI to consume the completed Serializable 0.10.2 dependency cascade rather than intermediate bug-fix commits.
+- Serializable 0.10.2 also resolves the strict-build `-Wmisleading-indentation` warning exposed by Serial's warnings-as-errors host validation.
+
+### Compatibility
+
+- Core Serial remains dependency-free.
+- EventMonitor remains opt-in.
+- Existing structured output remains JSON-like and source-compatible for payloads that validate successfully.
+
 ## 0.5.0
 
 - Added opt-in `CommandMonitor` for ESPressio Command 0.3.x registry lifecycle observation.
@@ -144,4 +172,4 @@ The structure follows the principles of [Keep a Changelog](https://keepachangelo
 ### Dependency model
 
 - Core ESPressio Serial has no mandatory ESPressio library dependencies.
-- Event Monitor is opt-in and requires ESPressio Event 5.5.0 or newer plus ESPressio Serializable 0.9.0 or newer.
+- Event Monitor is opt-in and requires ESPressio Event 5.5.0 or newer plus ESPressio Serializable 0.9.0 or newer.

ESPRESSIO_DEPENDENCY_CHART.md

@@ -1,125 +1,129 @@
-# ESPressio Dependency Chart
+# ESPressio Dependency Chart — Serial 0.5.1
 
 ![ESPressio Library Dependency Chart](ESPRESSIO_DEPENDENCY_CHART.png)
 
-## Purpose
+## ESPressio Serial 0.5.1
 
-This document describes the current dependency relationships between ESPressio libraries relevant to ESPressio Serial 0.5.0.
+The Serial core and generic `Console` have no mandatory ESPressio dependencies.
+All ESPressio integrations remain opt-in.
 
-The chart is hierarchical: libraries with no **required** ESPressio dependencies appear at the top, while libraries that build on progressively more of the ecosystem appear lower.
-
-- **Solid arrow** — required ESPressio dependency.
-- **Dashed arrow** — opt-in dependency activated only by the associated feature/header.
-- Arrows point from the dependent library to the library it consumes.
-
-## ESPressio Serial 0.5.0
-
-The ESPressio Serial core and generic `Console` have no required ESPressio dependency.
-
-All integrations remain opt-in.
-
-### CommandConsole and CommandMonitor
-
-`CommandConsole` and `CommandMonitor` consume:
+### Current integration baselines
 
 ```text
-ESPressio Command >= 0.3.0 < 1.0.0
-```
+CommandConsole / CommandMonitor
+    - - -> ESPressio Command >= 0.3.0 < 1.0.0
 
-Command supplies the transport-neutral typed Command registry, parsing, validation, invocation, help/completion metadata, scoped command registration, and Observable registry lifecycle used by Serial's Command integrations.
+SecurityMonitor
+    - - -> ESPressio Security >= 0.2.0 < 1.0.0
 
-### SecurityMonitor
+SocketWorkerMonitor
+    - - -> ESPressio Sockets >= 0.5.0 < 1.0.0
 
-`SecurityMonitor` consumes:
+SocketSecuritySessionMonitor
+    - - -> ESPressio Sockets >= 0.5.0 < 1.0.0
+    - - -> ESPressio Security >= 0.2.0 < 1.0.0
 
-```text
-ESPressio Security >= 0.2.0 < 1.0.0
-```
+ESPNowTransportMonitor
+    - - -> ESPressio ESP-Now >= 0.5.2 < 1.0.0
 
-Security supplies the Observable configuration, secure-session, replay-protection, and failure lifecycle observed directly by the monitor.
+SystemClockMonitor
+    - - -> ESPressio Timing >= 2.2.4 < 3.0.0
 
-### Socket monitors
+ThreadMonitor
+    - - -> ESPressio Threads >= 3.1.4 < 4.0.0
 
-`SocketWorkerMonitor` consumes:
-
-```text
-ESPressio Sockets >= 0.5.0 < 1.0.0
+EventMonitor / EventConsole
+    - - -> ESPressio Event >= 5.8.2 < 6.0.0
+    - - -> ESPressio Serializable >= 0.10.2 < 1.0.0
 ```
 
-`SocketSecuritySessionMonitor` consumes:
-
-```text
-ESPressio Sockets >= 0.5.0 < 1.0.0
-ESPressio Security >= 0.2.0 < 1.0.0
-```
+EventMonitor 0.5.1 uses Serializable 0.10.2's bounded, allocation-free ESPB
+traversal API for structured diagnostics. Serializable 0.10.2 also contains the
+strict-build warning correction required by Serial's `-Werror` host validation.
 
-Sockets supplies the Observable socket worker and secure-session lifecycle contracts. Security is only relevant to the secure-session integration.
-
-### ESPNowTransportMonitor
-
-`ESPNowTransportMonitor` consumes:
+## Current coordinated ecosystem
 
 ```text
-ESPressio ESP-Now >= 0.5.0 < 1.0.0
+FOUNDATIONAL
+├── Observable 3.0.1
+├── Serializable 0.10.2
+├── Units 0.2.3
+├── Security 0.2.0
+└── Command 0.3.0
+
+RUNTIME
+└── Timing 2.2.4
+    ├── Units >= 0.2.3 < 1.0.0
+    └── Observable >= 3.0.1 < 4.0.0
+
+EXECUTION
+└── Threads 3.1.4
+    ├── Timing >= 2.2.4 < 3.0.0
+    └── Observable >= 3.0.1 < 4.0.0
+
+TRANSPORT / INTEGRATION
+├── Sockets 0.5.0
+└── ESP-Now 0.5.2
+
+EVENT
+└── Event 5.8.2
+    ├── Threads >= 3.1.4 < 4.0.0
+    ├── Timing >= 2.2.4 < 3.0.0
+    ├── Observable >= 3.0.1 < 4.0.0
+    └── Serializable >= 0.10.2 < 1.0.0 [optional]
+
+DIAGNOSTICS / OPERATOR
+└── Serial 0.5.1
 ```
 
-ESP-Now supplies the Observable transport, peer, and send lifecycle contract.
+## Dependency-direction rule
 
-### EventMonitor and EventConsole
+Serial is deliberately a terminal/downstream integration layer. It may observe
+or operate against Command, Security, Sockets, ESP-Now, Timing, Threads, Event,
+and Serializable, but none of those libraries should acquire a Serial
+dependency.
 
-`EventMonitor` consumes:
+The wider ecosystem should follow the same rule: dependency edges cascade
+downstream and integration code belongs with the component that introduces the
+additional dependency.
 
-```text
-ESPressio Event >= 5.8.0 < 6.0.0
-ESPressio Serializable >= 0.10.0 < 1.0.0
-```
+### Known circular optional relationships
 
-Event supplies the Event Transport Transaction Observation stream. Serializable supplies structured payload decoding used for human-readable diagnostic output.
-
-The legacy EventConsole initialization path remains supported for compatibility. The recommended Command-backed EventConsole integration consumes:
+Two existing Event bridge placements violate that preferred direction:
 
 ```text
-ESPressio Command >= 0.3.0 < 1.0.0
-ESPressio Event >= 5.8.0 < 6.0.0
-ESPressio Serializable >= 0.10.0 < 1.0.0
-```
-
-Command supplies the shared `event`/`events` command tree and scoped registration lifetime. Event supplies runtime Serializable Event discovery, descriptors, construction and dispatch. Serializable supplies `JsonArchive` and validation diagnostics.
+Sockets - - -> Event
+    concrete socket Event transports
 
-The external ArduinoJson dependency is required only by the optional Serializable `JsonArchive`; it is outside this ESPressio-to-ESPressio dependency chart.
-
-### Timing and Threads monitors
-
-`SystemClockMonitor` optionally consumes:
-
-```text
-ESPressio Timing >= 2.2.2 < 3.0.0
+Event - - -> Sockets
+    SocketWorkerEventBridge
+    SocketSecuritySessionEventBridge
 ```
 
-`ThreadMonitor` optionally consumes:
+and:
 
 ```text
-ESPressio Threads >= 3.1.2 < 4.0.0
-```
+ESP-Now - - -> Event
+    ESPNowEventTransport
 
-### Event bridges versus Serial monitors
+Event - - -> ESP-Now
+    ESPNowTransportEventBridge
+```
 
-The 0.5.0 Observable monitors subscribe directly to the originating subsystem. They do not require ESPressio Event.
+The optimal resolution is to keep Event transport-neutral and relocate the
+transport-specific Observer-to-Event bridges downstream into the corresponding
+Sockets/ESP-Now Event integration, or into dedicated integration packages.
 
-ESPressio Event 5.8.0 separately supplies optional Event bridges for Command, Security, Sockets, and ESP-Now when asynchronous Event conversion is desired. Serial diagnostics therefore remain usable without introducing Event as an intermediary.
+Generic Event bridges for upstream libraries that do not themselves consume
+Event—such as Timing, Threads, Command, and Security—do not create this cycle.
 
-## Current ecosystem relationships
+## Why ESP-Now is not pinned to Event 5.8.2
 
-- Observable 3.0.1 has no mandatory ESPressio dependencies.
-- Serializable 0.10.0 has no mandatory ESPressio dependencies.
-- Units 0.2.1 optionally consumes Serializable for Serializable Unit counterparts.
-- Timing 2.2.2 requires Units and Observable.
-- Threads 3.1.2 requires Timing and Observable.
-- Security 0.2.0 requires Observable; Event conversion is opt-in downstream through Event 5.8.0.
-- Command 0.3.0 requires Observable; Event conversion is opt-in downstream through Event 5.8.0.
-- Sockets 0.5.0 consumes Observable for lifecycle observation and optionally integrates Command and Security.
-- ESP-Now 0.5.0 requires Timing and Observable and optionally integrates Command, Security, and Event transport functionality.
-- Event 5.8.0 requires Threads, Timing, and Observable and optionally bridges Security, Command, Sockets, and ESP-Now observer contracts.
-- Serial 0.5.0 has no mandatory ESPressio dependencies; Command, Security, Sockets, ESP-Now, Event, Serializable, Timing, and Threads integrations are all opt-in.
+ESP-Now 0.5.2's **required** dependency refresh is Timing 2.2.4. Its Event
+transport is optional and can consume a compatible Event 5.x release. Requiring
+ESP-Now 0.5.2 to consume Event 5.8.2 while Event also contains an ESP-Now bridge
+would strengthen the reciprocal edge and produce unnecessary release churn.
 
-Applications using only the core ESPressio Serial layer acquire none of these optional ESPressio dependencies.
+Serial is different: Serial sits downstream of both and therefore validates its
+Event integration against Event 5.8.2 and its ESP-Now monitor against ESP-Now
+0.5.2.