Jackson 3 series companion code

37 runnable examples covering the eight feature posts on ankurm.com, verified against Jackson 3.2.1 on Temurin 21.0.5. Every output committed under docs/ was produced by run-all.sh. Also documents 11 places where the published snippets do not compile or do not behave as printed against a real Jackson 3 build - most notably that writeValueAsString(List<Base>) silently drops the polymorphic type discriminator, so the post's serialised output cannot be read back.
2026-08-04 23:12:11 +05:30
commit c438afc33b
94 changed files with 3387 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,3 @@
+target/
+*.iml
+.idea/
--- a/README.md
+++ b/README.md
@@ -0,0 +1,123 @@
+# jackson3-by-example
+
+Runnable companion code for the eight-part **Jackson 3** series on [ankurm.com](https://ankurm.com).
+
+Every example is a standalone `main()` you can run on its own. Every line of output
+in [`docs/`](docs) was produced by [`run-all.sh`](run-all.sh) on the versions below —
+nothing is transcribed by hand.
+
+```
+Jackson            3.2.1        (tools.jackson.core:jackson-databind)
+jackson-annotations 2.22        (com.fasterxml.jackson.core — deliberately unchanged)
+JDK                Temurin 21.0.5
+Maven              3.9.9
+```
+
+## Run it
+
+```bash
+git clone https://ankurm.com/git.app/asmhatre/jackson3-by-example.git
+cd jackson3-by-example
+./run-all.sh                       # compiles, runs all 37 examples, refreshes docs/output/
+```
+
+Or run any single example:
+
+```bash
+mvn -q compile
+mvn -q exec:java -Dexec.mainClass=com.ankurm.jackson3.part5polymorphic.F01SerialiseMixedList
+```
+
+## Map: post → code
+
+| Post | Package | Examples | Notes & output |
+|---|---|---|---|
+| [Jackson 101](https://ankurm.com/jackson-java-tutorial/) | [`part0setup`](src/main/java/com/ankurm/jackson3/part0setup) | [A01](src/main/java/com/ankurm/jackson3/part0setup/A01FirstRoundTrip.java) [A02](src/main/java/com/ankurm/jackson3/part0setup/A02SharedMapperConfiguration.java) [A03](src/main/java/com/ankurm/jackson3/part0setup/A03ThreeProcessingModels.java) | [write-up](docs/part0-setup.md) |
+| [ObjectMapper Guide](https://ankurm.com/jackson-objectmapper-guide/) | [`part1objectmapper`](src/main/java/com/ankurm/jackson3/part1objectmapper) | [B01](src/main/java/com/ankurm/jackson3/part1objectmapper/B01WriteJson.java) [B02](src/main/java/com/ankurm/jackson3/part1objectmapper/B02ReadJson.java) [B03](src/main/java/com/ankurm/jackson3/part1objectmapper/B03GenericCollections.java) [B04](src/main/java/com/ankurm/jackson3/part1objectmapper/B04PropertyOrdering.java) | [write-up](docs/part1-objectmapper.md) |
+| [Records, Optionals, Sealed](https://ankurm.com/jackson-java-records-optionals/) | [`part2modernjava`](src/main/java/com/ankurm/jackson3/part2modernjava) | [C01](src/main/java/com/ankurm/jackson3/part2modernjava/C01RecordRoundTrip.java) [C02](src/main/java/com/ankurm/jackson3/part2modernjava/C02OptionalFields.java) [C03](src/main/java/com/ankurm/jackson3/part2modernjava/C03SealedWithSubTypes.java) [C04](src/main/java/com/ankurm/jackson3/part2modernjava/C04SealedAutoDiscovery.java) | [write-up](docs/part2-modern-java.md) |
+| [Annotations Cheat Sheet](https://ankurm.com/jackson-annotations-guide/) | [`part3annotations`](src/main/java/com/ankurm/jackson3/part3annotations) | [D01](src/main/java/com/ankurm/jackson3/part3annotations/D01RenameAndIgnore.java) [D02](src/main/java/com/ankurm/jackson3/part3annotations/D02InclusionAndFormat.java) [D03](src/main/java/com/ankurm/jackson3/part3annotations/D03AliasAndUnknownFields.java) [D04](src/main/java/com/ankurm/jackson3/part3annotations/D04CreatorsAndUnwrapping.java) | [write-up](docs/part3-annotations.md) |
+| [Custom Serialisers & Mix-ins](https://ankurm.com/jackson-custom-serializer-mixin/) | [`part4custom`](src/main/java/com/ankurm/jackson3/part4custom) | [E01](src/main/java/com/ankurm/jackson3/part4custom/E01MoneyValueSerializer.java) [E02](src/main/java/com/ankurm/jackson3/part4custom/E02MoneyValueDeserializer.java) [E03](src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java) [E04](src/main/java/com/ankurm/jackson3/part4custom/E04MixinAnnotations.java) [E05](src/main/java/com/ankurm/jackson3/part4custom/E05ValueSerializerDirect.java) | [write-up](docs/part4-custom.md) |
+| [Polymorphic Deserialisation](https://ankurm.com/jackson-polymorphic-deserialization/) | [`part5polymorphic`](src/main/java/com/ankurm/jackson3/part5polymorphic) | [F01](src/main/java/com/ankurm/jackson3/part5polymorphic/F01SerialiseMixedList.java) [F02](src/main/java/com/ankurm/jackson3/part5polymorphic/F02DeserialiseMixedList.java) [F03](src/main/java/com/ankurm/jackson3/part5polymorphic/F03IncludeStrategies.java) [F04](src/main/java/com/ankurm/jackson3/part5polymorphic/F04UnknownTypeId.java) | [write-up](docs/part5-polymorphic.md) |
+| [Streaming API & JsonNode](https://ankurm.com/jackson-streaming-api-jsonnode/) | [`part6streaming`](src/main/java/com/ankurm/jackson3/part6streaming) | [G01](src/main/java/com/ankurm/jackson3/part6streaming/G01StreamingParserFilter.java) [G02](src/main/java/com/ankurm/jackson3/part6streaming/G02StreamingGenerator.java) [G03](src/main/java/com/ankurm/jackson3/part6streaming/G03TreeModelNavigation.java) [G04](src/main/java/com/ankurm/jackson3/part6streaming/G04ThreeApproachesMeasured.java) | [write-up](docs/part6-streaming.md) |
+| [Security Best Practices](https://ankurm.com/jackson-security-best-practices/) | [`part7security`](src/main/java/com/ankurm/jackson3/part7security) | [H01](src/main/java/com/ankurm/jackson3/part7security/H01SafePolymorphismByAnnotation.java) [H02](src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java) [H03](src/main/java/com/ankurm/jackson3/part7security/H03PolymorphicTypeValidatorAllowlist.java) [H04](src/main/java/com/ankurm/jackson3/part7security/H04StreamReadConstraints.java) [H05](src/main/java/com/ankurm/jackson3/part7security/H05NeverDeserialiseIntoObject.java) | [write-up](docs/part7-security.md) |
+| — (beyond the posts) | [`beyond`](src/main/java/com/ankurm/jackson3/beyond) | [Y01](src/main/java/com/ankurm/jackson3/beyond/Y01UncheckedExceptions.java) [Y02](src/main/java/com/ankurm/jackson3/beyond/Y02TrailingTokens.java) [Y03](src/main/java/com/ankurm/jackson3/beyond/Y03DateTimeDefaults.java) [Y04](src/main/java/com/ankurm/jackson3/beyond/Y04ImmutableMapperAndReaders.java) [Y05](src/main/java/com/ankurm/jackson3/beyond/Y05CreatorDetection.java) [Y06](src/main/java/com/ankurm/jackson3/beyond/Y06RecyclerPoolTuning.java) | [write-up](docs/beyond.md) |
+
+### Documentation
+
+Each page pairs the code with its real captured output and calls out where the post and
+the library disagree.
+
+| Page | Covers |
+|---|---|
+| [docs/part0-setup.md](docs/part0-setup.md) | Setup, the shared-mapper rule, three processing models |
+| [docs/part1-objectmapper.md](docs/part1-objectmapper.md) | Reading, writing, `TypeReference`, property ordering |
+| [docs/part2-modern-java.md](docs/part2-modern-java.md) | Records, `Optional`, sealed types and auto-discovery |
+| [docs/part3-annotations.md](docs/part3-annotations.md) | The annotation set, and which advice is now obsolete |
+| [docs/part4-custom.md](docs/part4-custom.md) | `ValueSerializer`, `ValueDeserializer`, modules, mix-ins |
+| [docs/part5-polymorphic.md](docs/part5-polymorphic.md) | `@JsonTypeInfo`, and the dropped-discriminator defect in full |
+| [docs/part6-streaming.md](docs/part6-streaming.md) | Streaming, the tree model, and the three approaches measured |
+| [docs/part7-security.md](docs/part7-security.md) | Safe polymorphism, allowlists, resource limits |
+| [docs/beyond.md](docs/beyond.md) | Unchecked exceptions, flipped defaults, pool tuning |
+
+Raw stdout for all 37 programs is in [`docs/output/`](docs/output), regenerated by
+[`run-all.sh`](run-all.sh).
+
+## Corrections to the posts
+
+Writing this code against a real Jackson 3.2.1 build surfaced places where the blog
+snippets do not compile or do not behave as printed. Each is demonstrated by a program,
+so you can verify rather than take my word for it.
+
+| # | Claim in the post | What actually happens | Shown by |
+|---|---|---|---|
+| 1 | Maven coordinate `com.fasterxml.jackson.core:jackson-databind:3.1.2` | That artifact does not exist. Jackson 3 is at `tools.jackson.core:jackson-databind`; only `jackson-annotations` keeps the old group ID. | [`pom.xml`](pom.xml) |
+| 2 | `JsonMapper.builder().disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)` | Does not compile. The constant is not on `SerializationFeature` in Jackson 3 — it moved to `tools.jackson.databind.cfg.DateTimeFeature`, and it already defaults to off, so ISO-8601 needs no configuration. | [Y03](src/main/java/com/ankurm/jackson3/beyond/Y03DateTimeDefaults.java) |
+| 3 | `JsonMapper.builder().serializationInclusion(...)` | No such builder method. The real API is `changeDefaultPropertyInclusion(UnaryOperator)`. | [A02](src/main/java/com/ankurm/jackson3/part0setup/A02SharedMapperConfiguration.java), [H02](src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java) |
+| 4 | `writeValueAsString(List<PaymentMethod>)` emits `paymentType` | It does not. A `List` carries no element type, so the polymorphic serialiser never engages and the discriminator is dropped — and the output then fails to deserialise. Use `writerFor(TypeReference)` or a typed array. | [F01](src/main/java/com/ankurm/jackson3/part5polymorphic/F01SerialiseMixedList.java), [F02](src/main/java/com/ankurm/jackson3/part5polymorphic/F02DeserialiseMixedList.java) |
+| 5 | Remediate with `mapper.activateDefaultTyping(validator, ...)` | Jackson 3's mapper has no mutators at all — not `enableDefaultTyping`, not `activateDefaultTyping`, not one `set*` method. `activateDefaultTyping` exists only on `JsonMapper.Builder`. | [H02](src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java), [H03](src/main/java/com/ankurm/jackson3/part7security/H03PolymorphicTypeValidatorAllowlist.java) |
+| 6 | `import tools.jackson.core.JsonFactory` | Wrong package. It is `tools.jackson.core.json.JsonFactory`. | [G01](src/main/java/com/ankurm/jackson3/part6streaming/G01StreamingParserFilter.java) |
+| 7 | Optional needs `jackson-datatype-jdk8`; records need `jackson-module-parameter-names` and `-parameters` | All three are built into `jackson-databind` 3.x. The Jackson 2 module classes do not exist under `tools.jackson`, so leaving the registrations in place is a compile error. | [C01](src/main/java/com/ankurm/jackson3/part2modernjava/C01RecordRoundTrip.java), [C02](src/main/java/com/ankurm/jackson3/part2modernjava/C02OptionalFields.java) |
+| 8 | Set `FAIL_ON_UNKNOWN_PROPERTIES=false`; use `@JsonIgnoreProperties(ignoreUnknown=true)` to opt out per class | Already false by default in Jackson 3. The annotation now matters only when you deliberately turn strictness back on. | [D03](src/main/java/com/ankurm/jackson3/part3annotations/D03AliasAndUnknownFields.java) |
+| 9 | Without `@JsonFormat`, `LocalDate` is written as a numeric array | Jackson 2 behaviour. Jackson 3 writes ISO-8601 by default; the annotation is only needed for a non-standard pattern. | [D02](src/main/java/com/ankurm/jackson3/part3annotations/D02InclusionAndFormat.java) |
+| 10 | Removing `AUTO_DETECT_CREATORS` means single-arg constructors "quietly fail" | The enum constant is gone, but the behaviour is not: a single-argument constructor is still detected as a delegating creator. Annotate anyway, but the upgrade will not break these classes. | [Y05](src/main/java/com/ankurm/jackson3/beyond/Y05CreatorDetection.java) |
+| 11 | The custom deserialiser uses `p.getCodec().readTree(p)` and `node.get(...)` | `getCodec()` is gone — use `ctxt.readTree(parser)`. And `get()` NPEs on a missing field; `path()` with a defaulting accessor does not. A bare `decimalValue()` on a `MissingNode` throws in Jackson 3 where Jackson 2 returned zero. | [E02](src/main/java/com/ankurm/jackson3/part4custom/E02MoneyValueDeserializer.java), [E03](src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java) |
+
+Two smaller ones worth knowing, neither strictly an error in the posts:
+
+- A getter-based POJO serialises its properties **alphabetically**; a record serialises in
+  declaration order. The post's sample output for `ProductSummary` shows declaration order.
+  See [B04](src/main/java/com/ankurm/jackson3/part1objectmapper/B04PropertyOrdering.java).
+- `{"amount":20.00}` deserialises to `BigDecimal` **20.0**, not 20.00 — the scale is lost
+  unless `USE_BIG_DECIMAL_FOR_FLOATS` is enabled. See
+  [E03](src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java).
+
+## Measured, not asserted
+
+Three examples produce numbers rather than prose. Figures below are from one run on a
+2-core container; re-run them on your own hardware.
+
+**Three processing models over a 20 MB / 200k-entry file** ([G04](src/main/java/com/ankurm/jackson3/part6streaming/G04ThreeApproachesMeasured.java)):
+
+```
+data binding (readValue)     errors=4000      524 ms   heap delta    47 MB
+tree model (readTree)        errors=4000      341 ms   heap delta   102 MB
+streaming (JsonParser)       errors=4000       78 ms   heap delta     1 MB
+```
+
+**Streaming a million records** ([G02](src/main/java/com/ankurm/jackson3/part6streaming/G02StreamingGenerator.java)): 30 MB written in 129 ms with a 0 MB heap delta.
+
+**RecyclerPool** ([Y06](src/main/java/com/ankurm/jackson3/beyond/Y06RecyclerPoolTuning.java)) — the comparison post suggests restoring the 2.x
+thread-local pool if you see a regression. On this box the two pools are within noise of
+each other in both shapes, and the gap moves between runs, so the honest conclusion is
+that there is no default winner: measure on your own hardware before changing it. What
+is stable across runs is that turning recycling off entirely is clearly worse — a useful
+negative control confirming the pool is doing something.
+
+```
+1 thread    threadLocalPool 301 ms   concurrentDeque 310 ms   nonRecycling 496 ms
+8 threads   threadLocalPool 451 ms   concurrentDeque 450 ms   nonRecycling 808 ms
+```
+
+## Related
+
+- [jackson2-to-3-migration](https://ankurm.com/git.app/asmhatre/jackson2-to-3-migration) — the before/after companion for the two migration guides.
--- a/docs/README.md
+++ b/docs/README.md
@@ -0,0 +1,18 @@
+# Documentation
+
+One page per post in the series. Each page lists the examples for that post, states
+where the code deviates from the published snippet and why, and embeds the real
+captured output.
+
+- [Part 0 — Jackson 101: setup and the ObjectMapper lifecycle](part0-setup.md)
+- [Part 1 — ObjectMapper: reading and writing](part1-objectmapper.md)
+- [Part 2 — Records, Optionals and sealed types](part2-modern-java.md)
+- [Part 3 — Annotations](part3-annotations.md)
+- [Part 4 — Custom serialisers, deserialisers and mix-ins](part4-custom.md)
+- [Part 5 — Polymorphic deserialisation](part5-polymorphic.md)
+- [Part 6 — Streaming API and the tree model](part6-streaming.md)
+- [Part 7 — Security](part7-security.md)
+- [Beyond the posts](beyond.md)
+
+Raw captured stdout for every program is in [`output/`](output). Those files are
+regenerated by [`../run-all.sh`](../run-all.sh); do not edit them by hand.
--- a/docs/beyond.md
+++ b/docs/beyond.md
@@ -0,0 +1,149 @@
+# Beyond the posts
+
+Behaviour that no post in the series covers, but that shows up on the first real
+upgrade. Every claim here is printed by a program rather than asserted.
+
+## Y01 — unchecked exceptions
+
+[`Y01UncheckedExceptions.java`](../src/main/java/com/ankurm/jackson3/beyond/Y01UncheckedExceptions.java)
+
+`JacksonException extends RuntimeException`. The comparison post is right that this is
+the most dangerous change, but the failure mode is more specific than "your catch blocks
+stop working". There are two cases:
+
+- **The try block contains only Jackson calls.** `catch (IOException)` becomes a
+  *compile error* — "exception java.io.IOException is never thrown in body of
+  corresponding try statement". The compiler saves you.
+- **The try block also does real I/O.** `IOException` is still reachable, so the catch
+  block compiles and simply stops covering the Jackson call.
+
+The second is the common shape in real code — read a request body, parse it — and it is
+what runs below.
+
+```
+JacksonException extends RuntimeException : true
+JacksonException extends IOException      : false
+
+-- catch (IOException) around I/O + Jackson --
+   ESCAPED the IOException handler -> StreamReadException
+-- catch (JacksonException) then catch (IOException) --
+   caught: StreamReadException
+-- unchecked exceptions inside a stream --
+   [{"orderId":1,"customerName":"Alice"}, {"orderId":2,"customerName":"Bob"}]
+```
+
+The upside is real too: Jackson calls now compose inside lambdas and streams without a
+checked-exception wrapper, as the last line shows.
+
+## Y02 — FAIL_ON_TRAILING_TOKENS
+
+[`Y02TrailingTokens.java`](../src/main/java/com/ankurm/jackson3/beyond/Y02TrailingTokens.java)
+
+Off in Jackson 2, on in Jackson 3. Concatenated or double-encoded JSON that used to
+parse — reading the first document and discarding the rest — now throws.
+
+```
+FAIL_ON_TRAILING_TOKENS default : true
+
+Jackson 3 default -> rejected: MismatchedInputException
+2.x behaviour     -> accepted: OrderDto[orderId=1]
+garbage, default  -> rejected: StreamReadException
+garbage, relaxed  -> accepted: OrderDto[orderId=1]
+```
+
+A correctness improvement, but it surfaces as new runtime failures on payloads that
+previously "worked", which is a bad thing to discover in production.
+
+## Y03 — where WRITE_DATES_AS_TIMESTAMPS went
+
+[`Y03DateTimeDefaults.java`](../src/main/java/com/ankurm/jackson3/beyond/Y03DateTimeDefaults.java)
+
+Several blog snippets carry `.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)`
+over from Jackson 2. That constant is not on `SerializationFeature` in Jackson 3, so the
+code does not compile. It moved to `tools.jackson.databind.cfg.DateTimeFeature` and
+defaults to off, so there is nothing to disable.
+
+```
+SerializationFeature has WRITE_DATES_AS_TIMESTAMPS : false
+DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS default  : false
+
+defaults (ISO-8601):
+  {"day":"2026-09-15","startsAt":"2026-09-15T10:30:00","recordedAt":"2026-09-15T10:30:00Z","zoned":"2026-09-15T10:30:00Z","length":"PT45M"}
+with WRITE_DATES_AS_TIMESTAMPS enabled:
+  {"day":[2026,9,15],"startsAt":[2026,9,15,10,30],"recordedAt":1789468200.000000000,"zoned":1789468200.000000000,"length":"PT45M"}
+numeric form reads back: 2026-09-15
+```
+
+Both forms read back, so stored payloads written by an older service still parse.
+
+## Y04 — configuring an immutable mapper
+
+[`Y04ImmutableMapperAndReaders.java`](../src/main/java/com/ankurm/jackson3/beyond/Y04ImmutableMapperAndReaders.java)
+
+The Jackson 2 habit of fetching the shared mapper and calling `configure()` on it has no
+equivalent. Two replacements: `rebuild()` forks a builder from an existing mapper, and
+`reader()`/`writer()` give per-call views.
+
+```
+shared              : {"firstName":"Ada","lastName":"Lovelace","middleName":null}
+rebuilt snake_case  : {"first_name":"Ada","last_name":"Lovelace"}
+shared unchanged    : {"firstName":"Ada","lastName":"Lovelace","middleName":null}
+writer view pretty  : { "firstName" : "Ada", "lastName" : "Lovelace", "middleName" : null }
+reader view strict  : rejected (UnrecognizedPropertyException) without touching the shared mapper
+```
+
+`ObjectReader` has no `readValue(String, Class)` overload — use `.forType(X.class)`
+then `.readValue(json)`.
+
+## Y05 — creator detection
+
+[`Y05CreatorDetection.java`](../src/main/java/com/ankurm/jackson3/beyond/Y05CreatorDetection.java)
+
+The comparison post says removing `MapperFeature.AUTO_DETECT_CREATORS` means "any class
+relying on a single-argument constructor being detected without an annotation will
+quietly fail". Half right: the enum constant is gone, but the behaviour is not.
+
+```
+MapperFeature.AUTO_DETECT_CREATORS exists : false
+Nearest surviving features                : [INFER_CREATOR_FROM_CONSTRUCTOR_PROPERTIES, DETECT_PARAMETER_NAMES, SORT_CREATOR_PROPERTIES_FIRST]
+
+implicit single-arg ctor : ImplicitOrderId[ord-1]
+explicit @JsonCreator    : ExplicitOrderId[ord-2]
+round-trip via @JsonValue: "ord-3"
+```
+
+Annotate with `@JsonCreator` anyway — it is explicit and costs nothing — but do not
+budget upgrade time for classes that will not actually break.
+
+## Y06 — RecyclerPool
+
+[`Y06RecyclerPoolTuning.java`](../src/main/java/com/ankurm/jackson3/beyond/Y06RecyclerPoolTuning.java)
+
+Jackson 3 changed the default buffer pool. The post says to restore the 2.x thread-local
+pool if you see a regression, but does not measure it. Whether it helps depends entirely
+on your concurrency profile, so measure on your own hardware.
+
+```
+default pool : ConcurrentDequePool
+cores        : 2
+
+--- 1 thread(s), 40000 round-trips each ---
+  threadLocalPool   (2.x default)      301 ms
+  concurrentDeque   (3.x default)      310 ms
+  nonRecyclingPool  (no reuse)         496 ms
+
+--- 8 thread(s), 40000 round-trips each ---
+  threadLocalPool   (2.x default)      451 ms
+  concurrentDeque   (3.x default)      450 ms
+  nonRecyclingPool  (no reuse)         808 ms
+```
+
+On this 2-core container the two pools land within noise of each other in both shapes,
+and which one wins moves between runs — so the honest reading is that there is no default
+winner here and the post's advice is worth testing rather than applying blind. Re-run this
+a few times before concluding anything; the figures above are a single shot.
+
+What *is* stable across runs is the third line: disabling recycling entirely is
+consistently the slowest, and by a wide margin under concurrency. That is the useful
+negative control — it confirms the pool is doing real work, so the choice between the two
+pooling strategies is a tuning decision rather than a correctness one.
--- a/docs/output/A01FirstRoundTrip.txt
+++ b/docs/output/A01FirstRoundTrip.txt
@@ -0,0 +1,2 @@
+{"listPrice":79.99,"productId":1,"productName":"Mechanical Keyboard"}
+Mechanical Keyboard
--- a/docs/output/A02SharedMapperConfiguration.txt
+++ b/docs/output/A02SharedMapperConfiguration.txt
@@ -0,0 +1,3 @@
+configured : {"invoiceId":500,"customerName":"Alice","issuedOn":"2026-04-09"}
+defaults   : {"invoiceId":500,"customerName":"Alice","issuedOn":"2026-04-09","note":null}
+ObjectMapper set*() methods in Jackson 3: 0
--- a/docs/output/A03ThreeProcessingModels.txt
+++ b/docs/output/A03ThreeProcessingModels.txt
@@ -0,0 +1,3 @@
+1. data binding : Order[orderId=1001, status=SHIPPED]
+2. tree model   : orderId=1001 status=SHIPPED
+3. streaming    : orderId=1001 status=SHIPPED
--- a/docs/output/B01WriteJson.txt
+++ b/docs/output/B01WriteJson.txt
@@ -0,0 +1,8 @@
+{"articleId":1,"title":"Jackson Deep Dive","tags":["java","json"]}
+file     : {"articleId":1,"title":"Jackson Deep Dive","tags":["java","json"]}
+pretty   :
+{
+  "articleId" : 1,
+  "title" : "Jackson Deep Dive",
+  "tags" : [ "java", "json" ]
+}
--- a/docs/output/B02ReadJson.txt
+++ b/docs/output/B02ReadJson.txt
@@ -0,0 +1,3 @@
+from String : Jackson Deep Dive
+from File   : 1
+from Stream : [java, json]
--- a/docs/output/B03GenericCollections.txt
+++ b/docs/output/B03GenericCollections.txt
@@ -0,0 +1,6 @@
+size          : 2
+element class : Article
+first title   : First
+raw element   : LinkedHashMap  <- not Article
+cast fails   : ClassCastException, as expected
+map value     : Nine
--- a/docs/output/B04PropertyOrdering.txt
+++ b/docs/output/B04PropertyOrdering.txt
@@ -0,0 +1,3 @@
+POJO    : {"listPrice":79.99,"productId":1,"productName":"Mechanical Keyboard"}
+record  : {"productId":1,"productName":"Mechanical Keyboard","listPrice":79.99}
+ordered : {"productId":1,"productName":"Mechanical Keyboard","listPrice":79.99}
--- a/docs/output/C01RecordRoundTrip.txt
+++ b/docs/output/C01RecordRoundTrip.txt
@@ -0,0 +1,3 @@
+{"productId":101,"productName":"Wireless Keyboard","unitPrice":49.99}
+Wireless Keyboard
+round-trip equal: true
--- a/docs/output/C02OptionalFields.txt
+++ b/docs/output/C02OptionalFields.txt
@@ -0,0 +1,5 @@
+present : {"customerName":"Alice","middleName":"Marie"}
+empty   : {"customerName":"Bob","middleName":null}
+absent  : {"customerName":"Bob"}
+isPresent: true
+missing -> Optional.empty (null? false)
--- a/docs/output/C03SealedWithSubTypes.txt
+++ b/docs/output/C03SealedWithSubTypes.txt
@@ -0,0 +1,4 @@
+Circle with radius: 5.0
+Rectangle 10.0 x 4.0
+lossy   : [{"radius":5.0},{"width":10.0,"height":4.0}]
+correct : [{"shapeType":"circle","radius":5.0},{"shapeType":"rectangle","width":10.0,"height":4.0}]
--- a/docs/output/C04SealedAutoDiscovery.txt
+++ b/docs/output/C04SealedAutoDiscovery.txt
@@ -0,0 +1,3 @@
+Circle                   -> {"shapeType":"circle","radius":5.0}                  -> Circle[radius=5.0]
+Rectangle                -> {"shapeType":"rectangle","width":10.0,"height":4.0}  -> Rectangle[width=10.0, height=4.0]
+Triangle                 -> {"shapeType":"triangle","base":3.0,"height":6.0}     -> Triangle[base=3.0, height=6.0]
--- a/docs/output/D01RenameAndIgnore.txt
+++ b/docs/output/D01RenameAndIgnore.txt
@@ -0,0 +1,4 @@
+rename    : {"order_id":1001,"customer_name":"Alice"}
+read back : OrderSummary[orderId=1001, customerName=Alice]
+ignore    : {"username":"alice"}
+read back : passwordHash=null
--- a/docs/output/D02InclusionAndFormat.txt
+++ b/docs/output/D02InclusionAndFormat.txt
@@ -0,0 +1,3 @@
+NON_NULL  : {"productName":"Keyboard"}
+NON_EMPTY : {"productName":"Keyboard"}
+formats   : {"invoiceId":500,"defaultDate":"2026-04-09","ukStyleDate":"09/04/2026","totalAmount":"199.99"}
--- a/docs/output/D03AliasAndUnknownFields.txt
+++ b/docs/output/D03AliasAndUnknownFields.txt
@@ -0,0 +1,6 @@
+alias {"q":"jackson"}          -> jackson
+alias {"query":"jackson"}      -> jackson
+alias {"search_term":"jackson"} -> jackson
+default mapper : LenientResponse[status=OK, message=done]
+strict mapper  : UnrecognizedPropertyException (as expected)
+strict + anno  : OptedOutResponse[status=OK, message=done]
--- a/docs/output/D04CreatorsAndUnwrapping.txt
+++ b/docs/output/D04CreatorsAndUnwrapping.txt
@@ -0,0 +1,5 @@
+creator   : ImmutablePoint(x=3.5, y=7.2)
+round-trip: {"x":3.5,"y":7.2}
+unwrapped : {"street":"123 Main St","city":"Springfield","customerName":"Alice"}
+any-setter: {surprise=1, another=[true, false]}
+any-getter: {"knownField":"a","surprise":1,"another":[true,false]}
--- a/docs/output/E03SimpleModuleRegistration.txt
+++ b/docs/output/E03SimpleModuleRegistration.txt
@@ -0,0 +1,5 @@
+serialised   : {"amount":20.00,"currency":"USD"}
+amount       : 20.0  (scale lost)
+amount exact : 20.00  (scale preserved)
+missing field: Money[amount=0, currencyCode=EUR]
+no module    : {"amount":19.999,"currencyCode":"usd"}
--- a/docs/output/E04MixinAnnotations.txt
+++ b/docs/output/E04MixinAnnotations.txt
@@ -0,0 +1,2 @@
+with mixin   : {"city":"Springfield","street":"123 Main St","zip":"12345"}
+without mixin: {"city":"Springfield","internalTrackingCode":"INTERNAL-X99","postalCode":"12345","street":"123 Main St"}
--- a/docs/output/E05ValueSerializerDirect.txt
+++ b/docs/output/E05ValueSerializerDirect.txt
@@ -0,0 +1,3 @@
+custom  : {"assignee":"u-42","title":"Fix build"}
+default : {"assignee":{"value":"u-42"},"title":"Fix build"}
+base class: tools.jackson.databind.ValueSerializer
--- a/docs/output/F01SerialiseMixedList.txt
+++ b/docs/output/F01SerialiseMixedList.txt
@@ -0,0 +1,20 @@
+--- 1. single element: discriminator present ---
+{"paymentType":"credit_card","amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1}
+--- 2. BROKEN: writeValueAsString(List) drops paymentType ---
+[{"amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1},{"amountDue":250.0,"bankAccountIban":"GB29NWBK60161331926819","bankName":"National Bank","paymentId":2}]
+--- 3. FIX A: writerFor(TypeReference) ---
+[ {
+  "paymentType" : "credit_card",
+  "amountDue" : 99.99,
+  "cardNetwork" : "VISA",
+  "cardNumberLastFour" : "4242",
+  "paymentId" : 1
+}, {
+  "paymentType" : "bank_transfer",
+  "amountDue" : 250.0,
+  "bankAccountIban" : "GB29NWBK60161331926819",
+  "bankName" : "National Bank",
+  "paymentId" : 2
+} ]
+--- 4. FIX B: a typed array carries its component type ---
+[{"paymentType":"credit_card","amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1},{"paymentType":"bank_transfer","amountDue":250.0,"bankAccountIban":"GB29NWBK60161331926819","bankName":"National Bank","paymentId":2}]
--- a/docs/output/F02DeserialiseMixedList.txt
+++ b/docs/output/F02DeserialiseMixedList.txt
@@ -0,0 +1,4 @@
+Card ending: 4242
+Bank: National Bank
+lossy JSON round-trip -> InvalidTypeIdException
+correct JSON round-trip -> 2 payments, CreditCardPayment first
--- a/docs/output/F03IncludeStrategies.txt
+++ b/docs/output/F03IncludeStrategies.txt
@@ -0,0 +1,7 @@
+PROPERTY          : {"kind":"card","amountDue":99.0}
+WRAPPER_OBJECT    : {"card":{"amountDue":99.0}}
+WRAPPER_ARRAY     : ["card",{"amountDue":99.0}]
+EXISTING_PROPERTY : {"kind":"card","amountDue":99.0}
+read PROPERTY       -> PropCard[amountDue=99.0]
+read WRAPPER_OBJECT -> WrapObjCard[amountDue=99.0]
+read WRAPPER_ARRAY  -> WrapArrCard[amountDue=99.0]
--- a/docs/output/F04UnknownTypeId.txt
+++ b/docs/output/F04UnknownTypeId.txt
@@ -0,0 +1,3 @@
+unknown logical name           -> InvalidTypeIdException
+attacker-supplied class name   -> InvalidTypeIdException
+missing discriminator          -> InvalidTypeIdException
--- a/docs/output/G01StreamingParserFilter.txt
+++ b/docs/output/G01StreamingParserFilter.txt
@@ -0,0 +1,2 @@
+ERROR: Database connection failed
+Total errors found: 1
--- a/docs/output/G02StreamingGenerator.txt
+++ b/docs/output/G02StreamingGenerator.txt
@@ -0,0 +1,4 @@
+records written : 1000000
+file size       : 30 MB
+elapsed         : 129 ms
+heap delta      : 0 MB   <- the document is never held in memory
--- a/docs/output/G03TreeModelNavigation.txt
+++ b/docs/output/G03TreeModelNavigation.txt
@@ -0,0 +1,8 @@
+Customer: Alice
+KB-01 x2
+MS-42 x1
+Has discount: false
+path(missing) :   (class MissingNode)
+get(missing)  : null
+deep path     : '<default>'
+treeToValue   : CustomerRecord[name=Alice, tier=gold]
--- a/docs/output/G04ThreeApproachesMeasured.txt
+++ b/docs/output/G04ThreeApproachesMeasured.txt
@@ -0,0 +1,5 @@
+input file : 20 MB, 200000 entries
+
+data binding (readValue)     errors=4000      524 ms   heap delta    47 MB
+tree model (readTree)        errors=4000      341 ms   heap delta   102 MB
+streaming (JsonParser)       errors=4000       78 ms   heap delta     1 MB
--- a/docs/output/H01SafePolymorphismByAnnotation.txt
+++ b/docs/output/H01SafePolymorphismByAnnotation.txt
@@ -0,0 +1,3 @@
+email : EmailNotification[a@example.com]
+sms   : SmsNotification[+441234567890]
+attack: rejected with InvalidTypeIdException
--- a/docs/output/H02DefaultTypingRemoved.txt
+++ b/docs/output/H02DefaultTypingRemoved.txt
@@ -0,0 +1,14 @@
+--- tools.jackson.databind.ObjectMapper ---
+  enableDefaultTyping              ABSENT
+  activateDefaultTyping            ABSENT
+  setSerializationInclusion        ABSENT
+  registerModule                   ABSENT
+  addMixIn                         ABSENT
+total set*() mutators: 0
+
+--- tools.jackson.databind.json.JsonMapper.Builder ---
+  activateDefaultTyping            present
+  deactivateDefaultTyping          present
+  polymorphicTypeValidator         present
+  changeDefaultPropertyInclusion   present
+  serializationInclusion           ABSENT
--- a/docs/output/H03PolymorphicTypeValidatorAllowlist.txt
+++ b/docs/output/H03PolymorphicTypeValidatorAllowlist.txt
@@ -0,0 +1,3 @@
+allowed written : {"@class":"com.ankurm.jackson3.part7security.H03PolymorphicTypeValidatorAllowlist$Envelope","body":{"@class":"com.ankurm.jackson3.part7security.H03PolymorphicTypeValidatorAllowlist$SafePayload","note":"ok"}}
+allowed read    : SafePayload[ok]
+rogue           : rejected with InvalidTypeIdException
--- a/docs/output/H04StreamReadConstraints.txt
+++ b/docs/output/H04StreamReadConstraints.txt
@@ -0,0 +1,11 @@
+--- Jackson 3 defaults ---
+max nesting depth : 500
+max number length : 1000
+max string length : 100000000
+max name length   : 50000
+max doc length    : -1  (-1 = unlimited)
+
+1200-deep nesting, default limits -> rejected (StreamConstraintsException)
+20-deep nesting,  strict limits  -> rejected (StreamConstraintsException)
+5-deep nesting,   strict limits  -> accepted
+3KB string,       strict limits  -> rejected (StreamConstraintsException)
--- a/docs/output/H05NeverDeserialiseIntoObject.txt
+++ b/docs/output/H05NeverDeserialiseIntoObject.txt
@@ -0,0 +1,4 @@
+as Object   : {action=ship, quantity=3, extra={nested=[1, 2]}}
+runtime type: java.util.LinkedHashMap   <- a plain Map, no arbitrary class was instantiated
+as DTO      : MyRequestDto[action=ship, quantity=3]
+bad input   : rejected with InvalidFormatException
--- a/docs/output/Y01UncheckedExceptions.txt
+++ b/docs/output/Y01UncheckedExceptions.txt
@@ -0,0 +1,9 @@
+JacksonException extends RuntimeException : true
+JacksonException extends IOException      : false
+
+-- catch (IOException) around I/O + Jackson --
+   ESCAPED the IOException handler -> StreamReadException
+-- catch (JacksonException) then catch (IOException) --
+   caught: StreamReadException
+-- unchecked exceptions inside a stream --
+   [{"orderId":1,"customerName":"Alice"}, {"orderId":2,"customerName":"Bob"}]
--- a/docs/output/Y02TrailingTokens.txt
+++ b/docs/output/Y02TrailingTokens.txt
@@ -0,0 +1,6 @@
+FAIL_ON_TRAILING_TOKENS default : true
+
+Jackson 3 default -> rejected: MismatchedInputException
+2.x behaviour     -> accepted: OrderDto[orderId=1]
+garbage, default  -> rejected: StreamReadException
+garbage, relaxed  -> accepted: OrderDto[orderId=1]
--- a/docs/output/Y03DateTimeDefaults.txt
+++ b/docs/output/Y03DateTimeDefaults.txt
@@ -0,0 +1,8 @@
+SerializationFeature has WRITE_DATES_AS_TIMESTAMPS : false
+DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS default  : false
+
+defaults (ISO-8601):
+  {"day":"2026-09-15","startsAt":"2026-09-15T10:30:00","recordedAt":"2026-09-15T10:30:00Z","zoned":"2026-09-15T10:30:00Z","length":"PT45M"}
+with WRITE_DATES_AS_TIMESTAMPS enabled:
+  {"day":[2026,9,15],"startsAt":[2026,9,15,10,30],"recordedAt":1789468200.000000000,"zoned":1789468200.000000000,"length":"PT45M"}
+numeric form reads back: 2026-09-15
--- a/docs/output/Y04ImmutableMapperAndReaders.txt
+++ b/docs/output/Y04ImmutableMapperAndReaders.txt
@@ -0,0 +1,5 @@
+shared              : {"firstName":"Ada","lastName":"Lovelace","middleName":null}
+rebuilt snake_case  : {"first_name":"Ada","last_name":"Lovelace"}
+shared unchanged    : {"firstName":"Ada","lastName":"Lovelace","middleName":null}
+writer view pretty  : { "firstName" : "Ada", "lastName" : "Lovelace", "middleName" : null }
+reader view strict  : rejected (UnrecognizedPropertyException) without touching the shared mapper
--- a/docs/output/Y05CreatorDetection.txt
+++ b/docs/output/Y05CreatorDetection.txt
@@ -0,0 +1,6 @@
+MapperFeature.AUTO_DETECT_CREATORS exists : false
+Nearest surviving features                : [INFER_CREATOR_FROM_CONSTRUCTOR_PROPERTIES, DETECT_PARAMETER_NAMES, SORT_CREATOR_PROPERTIES_FIRST]
+
+implicit single-arg ctor : ImplicitOrderId[ord-1]
+explicit @JsonCreator    : ExplicitOrderId[ord-2]
+round-trip via @JsonValue: "ord-3"
--- a/docs/output/Y06RecyclerPoolTuning.txt
+++ b/docs/output/Y06RecyclerPoolTuning.txt
@@ -0,0 +1,13 @@
+default pool : ConcurrentDequePool
+cores        : 2
+
+--- 1 thread(s), 40000 round-trips each ---
+  threadLocalPool   (2.x default)      301 ms
+  concurrentDeque   (3.x default)      310 ms
+  nonRecyclingPool  (no reuse)         496 ms
+
+--- 8 thread(s), 40000 round-trips each ---
+  threadLocalPool   (2.x default)      451 ms
+  concurrentDeque   (3.x default)      450 ms
+  nonRecyclingPool  (no reuse)         808 ms
+
--- a/docs/part0-setup.md
+++ b/docs/part0-setup.md
@@ -0,0 +1,60 @@
+# Part 0 — Jackson 101: setup and the ObjectMapper lifecycle
+
+Post: <https://ankurm.com/jackson-java-tutorial/>
+
+## A01 — first round-trip
+
+[`A01FirstRoundTrip.java`](../src/main/java/com/ankurm/jackson3/part0setup/A01FirstRoundTrip.java)
+
+A plain POJO out to JSON and back, using `JsonMapper.builder().build()` in place of
+`new ObjectMapper()`. Note there is no `throws` clause: Jackson 3 exceptions are unchecked.
+
+```
+{"listPrice":79.99,"productId":1,"productName":"Mechanical Keyboard"}
+Mechanical Keyboard
+```
+
+The property order is **alphabetical**, not declaration order — the post shows
+`productId` first. That is not a Jackson 3 change; it is how getter-based POJOs have
+always been introspected. Records behave differently. See
+[Part 1 / B04](part1-objectmapper.md#b04--property-ordering).
+
+## A02 — the shared mapper
+
+[`A02SharedMapperConfiguration.java`](../src/main/java/com/ankurm/jackson3/part0setup/A02SharedMapperConfiguration.java)
+
+The post's central rule — build once, share everywhere — is enforced by the API in
+Jackson 3 rather than left to discipline. Three of the four lines people copy from
+Jackson 2 configuration are unnecessary or invalid here:
+
+| Jackson 2 line | Status in Jackson 3 |
+|---|---|
+| `.registerModule(new JavaTimeModule())` | Delete. Built in; the class does not exist under `tools.jackson`. |
+| `.registerModule(new Jdk8Module())` | Delete. Same. |
+| `.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)` | **Does not compile.** Moved to `DateTimeFeature`, and already off. |
+| `.configure(FAIL_ON_UNKNOWN_PROPERTIES, false)` | Redundant — already the default. |
+| `.setSerializationInclusion(NON_NULL)` | Replaced by `.changeDefaultPropertyInclusion(...)`. |
+
+```
+configured : {"invoiceId":500,"customerName":"Alice","issuedOn":"2026-04-09"}
+defaults   : {"invoiceId":500,"customerName":"Alice","issuedOn":"2026-04-09","note":null}
+ObjectMapper set*() methods in Jackson 3: 0
+```
+
+The last line is the point: `tools.jackson.databind.ObjectMapper` has **zero** `set*`
+methods. Reconfiguring a shared mapper is not discouraged in Jackson 3, it is impossible.
+
+## A03 — the three processing models
+
+[`A03ThreeProcessingModels.java`](../src/main/java/com/ankurm/jackson3/part0setup/A03ThreeProcessingModels.java)
+
+The same payload read by data binding, the tree model and the streaming parser.
+
+```
+1. data binding : Order[orderId=1001, status=SHIPPED]
+2. tree model   : orderId=1001 status=SHIPPED
+3. streaming    : orderId=1001 status=SHIPPED
+```
+
+For what each approach costs on a real file, see
+[Part 6 / G04](part6-streaming.md#g04--the-decision-table-measured).
--- a/docs/part1-objectmapper.md
+++ b/docs/part1-objectmapper.md
@@ -0,0 +1,69 @@
+# Part 1 — ObjectMapper: reading and writing
+
+Post: <https://ankurm.com/jackson-objectmapper-guide/>
+
+## B01 — writing
+
+[`B01WriteJson.java`](../src/main/java/com/ankurm/jackson3/part1objectmapper/B01WriteJson.java)
+
+String, File and pretty-printed output.
+
+```
+{"articleId":1,"title":"Jackson Deep Dive","tags":["java","json"]}
+file     : {"articleId":1,"title":"Jackson Deep Dive","tags":["java","json"]}
+pretty   :
+{
+  "articleId" : 1,
+  "title" : "Jackson Deep Dive",
+  "tags" : [ "java", "json" ]
+}
+```
+
+## B02 — reading
+
+[`B02ReadJson.java`](../src/main/java/com/ankurm/jackson3/part1objectmapper/B02ReadJson.java)
+
+String, File and InputStream. The post's `readValue(new URL(...), ...)` example is
+deliberately not reproduced — it makes a live network call, so it could not be part of
+a reproducible run. The `InputStream` form is what an HTTP client hands you in practice.
+
+```
+from String : Jackson Deep Dive
+from File   : 1
+from Stream : [java, json]
+```
+
+## B03 — generic collections
+
+[`B03GenericCollections.java`](../src/main/java/com/ankurm/jackson3/part1objectmapper/B03GenericCollections.java)
+
+`TypeReference` lives in `tools.jackson.core.type` in Jackson 3. The example also runs
+the wrong version — `readValue(json, List.class)` — to show what it actually produces.
+
+```
+size          : 2
+element class : Article
+first title   : First
+raw element   : LinkedHashMap  <- not Article
+cast fails   : ClassCastException, as expected
+map value     : Nine
+```
+
+The failure is deferred, not immediate: the call succeeds and returns a
+`List<LinkedHashMap>`. You find out at the first cast, often far from the parse site.
+
+## B04 — property ordering
+
+[`B04PropertyOrdering.java`](../src/main/java/com/ankurm/jackson3/part1objectmapper/B04PropertyOrdering.java)
+
+Beyond the post, but it explains why your first output does not look like the article's.
+
+```
+POJO    : {"listPrice":79.99,"productId":1,"productName":"Mechanical Keyboard"}
+record  : {"productId":1,"productName":"Mechanical Keyboard","listPrice":79.99}
+ordered : {"productId":1,"productName":"Mechanical Keyboard","listPrice":79.99}
+```
+
+Getter-based POJOs serialise alphabetically; records follow declaration order;
+`@JsonPropertyOrder` overrides both. Worth pinning explicitly if the JSON is
+cached, signed, or diffed against a fixture.
--- a/docs/part2-modern-java.md
+++ b/docs/part2-modern-java.md
@@ -0,0 +1,70 @@
+# Part 2 — Records, Optionals and sealed types
+
+Post: <https://ankurm.com/jackson-java-records-optionals/>
+
+The single biggest simplification in Jackson 3 lands here. All three features are in
+core: the project's [`pom.xml`](../pom.xml) has one dependency, no
+`jackson-datatype-jdk8`, no `jackson-module-parameter-names`, and no `-parameters`
+compiler argument.
+
+## C01 — records
+
+[`C01RecordRoundTrip.java`](../src/main/java/com/ankurm/jackson3/part2modernjava/C01RecordRoundTrip.java)
+
+```
+{"productId":101,"productName":"Wireless Keyboard","unitPrice":49.99}
+Wireless Keyboard
+round-trip equal: true
+```
+
+The post's own dependency block here is wrong twice over: it suggests
+`com.fasterxml.jackson.module:jackson-module-parameter-names:3.1.2`, which is both an
+artifact Jackson 3 does not need and a version that does not exist at that coordinate.
+
+## C02 — Optional
+
+[`C02OptionalFields.java`](../src/main/java/com/ankurm/jackson3/part2modernjava/C02OptionalFields.java)
+
+```
+present : {"customerName":"Alice","middleName":"Marie"}
+empty   : {"customerName":"Bob","middleName":null}
+absent  : {"customerName":"Bob"}
+isPresent: true
+missing -> Optional.empty (null? false)
+```
+
+Two behaviours worth committing to memory: an empty `Optional` serialises as `null`
+unless you ask for `NON_ABSENT`, and a *missing* property deserialises to
+`Optional.empty()` rather than to `null`, so the field is never null.
+
+## C03 — sealed types with an explicit registry
+
+[`C03SealedWithSubTypes.java`](../src/main/java/com/ankurm/jackson3/part2modernjava/C03SealedWithSubTypes.java)
+
+```
+Circle with radius: 5.0
+Rectangle 10.0 x 4.0
+lossy   : [{"radius":5.0},{"width":10.0,"height":4.0}]
+correct : [{"shapeType":"circle","radius":5.0},{"shapeType":"rectangle","width":10.0,"height":4.0}]
+```
+
+Note the `lossy` line. Serialising a `List<Shape>` drops the `shapeType` discriminator,
+because a `List` gives Jackson no element type to dispatch on. This is the same defect
+covered at length in [Part 5](part5-polymorphic.md).
+
+## C04 — sealed auto-discovery
+
+[`C04SealedAutoDiscovery.java`](../src/main/java/com/ankurm/jackson3/part2modernjava/C04SealedAutoDiscovery.java)
+
+Beyond the post: Jackson 3 reads the `permits` clause, so `@JsonSubTypes` can be dropped
+entirely when each permitted type carries `@JsonTypeName`. There is no `@JsonSubTypes`
+anywhere in that file, and a third subtype added later just works.
+
+```
+Circle                   -> {"shapeType":"circle","radius":5.0}                  -> Circle[radius=5.0]
+Rectangle                -> {"shapeType":"rectangle","width":10.0,"height":4.0}  -> Rectangle[width=10.0, height=4.0]
+Triangle                 -> {"shapeType":"triangle","base":3.0,"height":6.0}     -> Triangle[base=3.0, height=6.0]
+```
+
+In Jackson 2 the `@JsonSubTypes` registry had to be maintained in parallel with
+`permits`, and drifted whenever someone added a case.
--- a/docs/part3-annotations.md
+++ b/docs/part3-annotations.md
@@ -0,0 +1,74 @@
+# Part 3 — Annotations
+
+Post: <https://ankurm.com/jackson-annotations-guide/>
+
+Every `@Json*` annotation is imported from `com.fasterxml.jackson.annotation`, even in
+Jackson 3. `jackson-annotations` deliberately keeps the old group ID and package so a
+single copy can serve Jackson 2 and Jackson 3 code on one classpath — the
+[migration repo's coexistence module](https://ankurm.com/git.app/asmhatre/jackson2-to-3-migration)
+proves that with both majors loaded at once.
+
+## D01 — @JsonProperty and @JsonIgnore
+
+[`D01RenameAndIgnore.java`](../src/main/java/com/ankurm/jackson3/part3annotations/D01RenameAndIgnore.java)
+
+```
+rename    : {"order_id":1001,"customer_name":"Alice"}
+read back : OrderSummary[orderId=1001, customerName=Alice]
+ignore    : {"username":"alice"}
+read back : passwordHash=null
+```
+
+`@JsonIgnore` is bidirectional — the last line shows an injected `passwordHash` in the
+input being discarded, which is the security-relevant half people forget.
+
+## D02 — @JsonInclude and @JsonFormat
+
+[`D02InclusionAndFormat.java`](../src/main/java/com/ankurm/jackson3/part3annotations/D02InclusionAndFormat.java)
+
+```
+NON_NULL  : {"productName":"Keyboard"}
+NON_EMPTY : {"productName":"Keyboard"}
+formats   : {"invoiceId":500,"defaultDate":"2026-04-09","ukStyleDate":"09/04/2026","totalAmount":"199.99"}
+```
+
+`defaultDate` carries no annotation and still comes out as `2026-04-09`. The post's
+claim that "without `@JsonFormat`, Jackson writes `LocalDate` as a numeric array" was
+true in Jackson 2; in Jackson 3 ISO-8601 is the default and the annotation is only
+needed for a non-standard pattern such as `ukStyleDate`.
+
+## D03 — @JsonAlias and unknown fields
+
+[`D03AliasAndUnknownFields.java`](../src/main/java/com/ankurm/jackson3/part3annotations/D03AliasAndUnknownFields.java)
+
+```
+alias {"q":"jackson"}          -> jackson
+alias {"query":"jackson"}      -> jackson
+alias {"search_term":"jackson"} -> jackson
+default mapper : LenientResponse[status=OK, message=done]
+strict mapper  : UnrecognizedPropertyException (as expected)
+strict + anno  : OptedOutResponse[status=OK, message=done]
+```
+
+The post frames `@JsonIgnoreProperties(ignoreUnknown = true)` as the per-class
+alternative to disabling `FAIL_ON_UNKNOWN_PROPERTIES` globally. In Jackson 3 that
+feature is already off, so the default mapper tolerates the extra field with no
+annotation. The annotation earns its keep only on a mapper where you have deliberately
+re-enabled strictness — which is the `strict` case above.
+
+## D04 — creators, unwrapping and catch-alls
+
+[`D04CreatorsAndUnwrapping.java`](../src/main/java/com/ankurm/jackson3/part3annotations/D04CreatorsAndUnwrapping.java)
+
+`@JsonUnwrapped` appears in the post's summary table but is never demonstrated;
+`@JsonAnyGetter`/`@JsonAnySetter` are not in the post at all, and are the cleanest way
+to keep fields you did not model instead of silently dropping them.
+
+```
+creator   : ImmutablePoint(x=3.5, y=7.2)
+round-trip: {"x":3.5,"y":7.2}
+unwrapped : {"street":"123 Main St","city":"Springfield","customerName":"Alice"}
+any-setter: {surprise=1, another=[true, false]}
+any-getter: {"knownField":"a","surprise":1,"another":[true,false]}
+```
+
--- a/docs/part4-custom.md
+++ b/docs/part4-custom.md
@@ -0,0 +1,72 @@
+# Part 4 — Custom serialisers, deserialisers and mix-ins
+
+Post: <https://ankurm.com/jackson-custom-serializer-mixin/>
+
+This is the part with the most API churn. The post's code is Jackson 2 throughout.
+
+| Jackson 2 | Jackson 3 |
+|---|---|
+| `JsonSerializer<T>` | `ValueSerializer<T>` |
+| `JsonDeserializer<T>` | `ValueDeserializer<T>` |
+| `SerializerProvider` | `SerializationContext` |
+| `com.fasterxml.jackson.databind.ser.std.StdSerializer` | `tools.jackson.databind.ser.std.StdSerializer` |
+| `gen.writeNumberField` / `writeStringField` | `gen.writeNumberProperty` / `writeStringProperty` |
+| `p.getCodec().readTree(p)` | `ctxt.readTree(p)` |
+| `throws IOException` | removed — exceptions are unchecked |
+| `new SimpleModule(name, Version)` | `new SimpleModule(name)` |
+| `mapper.registerModule(m)` | `builder.addModule(m)` |
+| `mapper.addMixIn(a, b)` | `builder.addMixIn(a, b)` |
+
+## E01 / E02 — the handlers
+
+[`E01MoneyValueSerializer.java`](../src/main/java/com/ankurm/jackson3/part4custom/E01MoneyValueSerializer.java) ·
+[`E02MoneyValueDeserializer.java`](../src/main/java/com/ankurm/jackson3/part4custom/E02MoneyValueDeserializer.java) ·
+[`Money.java`](../src/main/java/com/ankurm/jackson3/part4custom/Money.java)
+
+The deserialiser uses `path()` rather than `get()`. The post's version calls
+`rootNode.get("amount").decimalValue()`, which throws `NullPointerException` on
+`{"currency":"USD"}`. There is a second trap: in Jackson 3, a bare `decimalValue()` on
+a `MissingNode` throws, where Jackson 2 returned `BigDecimal.ZERO`. The defaulting
+overload `decimalValue(BigDecimal.ZERO)` is what you want.
+
+## E03 — registration
+
+[`E03SimpleModuleRegistration.java`](../src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java)
+
+```
+serialised   : {"amount":20.00,"currency":"USD"}
+amount       : 20.0  (scale lost)
+amount exact : 20.00  (scale preserved)
+missing field: Money[amount=0, currencyCode=EUR]
+no module    : {"amount":19.999,"currencyCode":"usd"}
+```
+
+The post prints `20.00` for the deserialised amount. You get `20.0` — Jackson parses the
+literal as a double before handing it over, so the scale is gone. If scale matters, and
+for money it does, enable `USE_BIG_DECIMAL_FOR_FLOATS`, as the third line shows.
+
+## E04 — mix-ins
+
+[`E04MixinAnnotations.java`](../src/main/java/com/ankurm/jackson3/part4custom/E04MixinAnnotations.java)
+
+```
+with mixin   : {"city":"Springfield","street":"123 Main St","zip":"12345"}
+without mixin: {"city":"Springfield","internalTrackingCode":"INTERNAL-X99","postalCode":"12345","street":"123 Main St"}
+```
+
+The second line is the proof that nothing was modified at the bytecode level: a mapper
+built without the mix-in still sees `internalTrackingCode` and `postalCode`.
+
+## E05 — ValueSerializer directly
+
+[`E05ValueSerializerDirect.java`](../src/main/java/com/ankurm/jackson3/part4custom/E05ValueSerializerDirect.java)
+
+Beyond the post. `StdSerializer` kept its name, which hides the rename; extending
+`ValueSerializer` directly makes it obvious, and is the leaner form for a simple wrapper.
+
+```
+custom  : {"assignee":"u-42","title":"Fix build"}
+default : {"assignee":{"value":"u-42"},"title":"Fix build"}
+base class: tools.jackson.databind.ValueSerializer
+```
+
--- a/docs/part5-polymorphic.md
+++ b/docs/part5-polymorphic.md
@@ -0,0 +1,111 @@
+# Part 5 — Polymorphic deserialisation
+
+Post: <https://ankurm.com/jackson-polymorphic-deserialization/>
+
+This part contains the most consequential correction in the whole repo, so it gets the
+most space.
+
+## The defect
+
+The post's "Serialising a Mixed List" section shows:
+
+```java
+List<PaymentMethod> payments = List.of(card, bank);
+String jsonOutput = mapper.writerWithDefaultPrettyPrinter().writeValueAsString(payments);
+```
+
+and prints output containing `"paymentType" : "credit_card"`.
+
+It does not produce that. `writeValueAsString(Object)` sees only the runtime class of
+the argument — `ImmutableCollections.ListN` — which carries no element type. Without a
+declared element type Jackson never engages the polymorphic type serialiser, and the
+discriminator is silently omitted from every element. No exception, no warning.
+
+The consequence is not cosmetic. That JSON cannot be read back: the deserialiser has
+no type id to dispatch on and throws `InvalidTypeIdException`. A service that writes
+with the post's code and reads with the post's code does not round-trip.
+
+## F01 — the defect and both fixes
+
+[`F01SerialiseMixedList.java`](../src/main/java/com/ankurm/jackson3/part5polymorphic/F01SerialiseMixedList.java)
+
+```
+--- 1. single element: discriminator present ---
+{"paymentType":"credit_card","amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1}
+--- 2. BROKEN: writeValueAsString(List) drops paymentType ---
+[{"amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1},{"amountDue":250.0,"bankAccountIban":"GB29NWBK60161331926819","bankName":"National Bank","paymentId":2}]
+--- 3. FIX A: writerFor(TypeReference) ---
+[ {
+  "paymentType" : "credit_card",
+  "amountDue" : 99.99,
+  "cardNetwork" : "VISA",
+  "cardNumberLastFour" : "4242",
+  "paymentId" : 1
+}, {
+  "paymentType" : "bank_transfer",
+  "amountDue" : 250.0,
+  "bankAccountIban" : "GB29NWBK60161331926819",
+  "bankName" : "National Bank",
+  "paymentId" : 2
+} ]
+--- 4. FIX B: a typed array carries its component type ---
+[{"paymentType":"credit_card","amountDue":99.99,"cardNetwork":"VISA","cardNumberLastFour":"4242","paymentId":1},{"paymentType":"bank_transfer","amountDue":250.0,"bankAccountIban":"GB29NWBK60161331926819","bankName":"National Bank","paymentId":2}]
+```
+
+Block 1 shows a single element serialising correctly, which is why this is easy to miss
+in a unit test that only checks one object. Block 2 is the collection, discriminator
+absent. Blocks 3 and 4 are the two fixes:
+
+- `mapper.writerFor(new TypeReference<List<PaymentMethod>>() {})` — declares the element
+  type on the writer.
+- `payments.toArray(new PaymentMethod[0])` — an array carries its component type at
+  runtime, so no extra declaration is needed.
+
+## F02 — round-trip proof
+
+[`F02DeserialiseMixedList.java`](../src/main/java/com/ankurm/jackson3/part5polymorphic/F02DeserialiseMixedList.java)
+
+```
+Card ending: 4242
+Bank: National Bank
+lossy JSON round-trip -> InvalidTypeIdException
+correct JSON round-trip -> 2 payments, CreditCardPayment first
+```
+
+Deserialisation itself works exactly as the post describes; it is the serialisation side
+that is wrong. The middle two lines are the demonstration: lossy output fails, correctly
+written output survives.
+
+## F03 — the four include strategies
+
+[`F03IncludeStrategies.java`](../src/main/java/com/ankurm/jackson3/part5polymorphic/F03IncludeStrategies.java)
+
+The post gives these as a table. Here they are executed, with the read-back to confirm
+each wire format is symmetric.
+
+```
+PROPERTY          : {"kind":"card","amountDue":99.0}
+WRAPPER_OBJECT    : {"card":{"amountDue":99.0}}
+WRAPPER_ARRAY     : ["card",{"amountDue":99.0}]
+EXISTING_PROPERTY : {"kind":"card","amountDue":99.0}
+read PROPERTY       -> PropCard[amountDue=99.0]
+read WRAPPER_OBJECT -> WrapObjCard[amountDue=99.0]
+read WRAPPER_ARRAY  -> WrapArrCard[amountDue=99.0]
+```
+
+`EXISTING_PROPERTY` needs `visible = true` and a real field of that name on the type;
+without it the discriminator is written but not populated back onto the object.
+
+## F04 — bad discriminators
+
+[`F04UnknownTypeId.java`](../src/main/java/com/ankurm/jackson3/part5polymorphic/F04UnknownTypeId.java)
+
+```
+unknown logical name           -> InvalidTypeIdException
+attacker-supplied class name   -> InvalidTypeIdException
+missing discriminator          -> InvalidTypeIdException
+```
+
+All three fail the same way, which is the reassuring answer: an unregistered logical
+name, an attacker-supplied fully qualified class name, and a missing discriminator are
+indistinguishable to the type resolver, and none of them instantiate anything.
--- a/docs/part6-streaming.md
+++ b/docs/part6-streaming.md
@@ -0,0 +1,80 @@
+# Part 6 — Streaming API and the tree model
+
+Post: <https://ankurm.com/jackson-streaming-api-jsonnode/>
+
+Renames that break the post's code verbatim:
+
+| Jackson 2 | Jackson 3 |
+|---|---|
+| `com.fasterxml.jackson.core.JsonFactory` | `tools.jackson.core.json.JsonFactory` (note the extra `.json`) |
+| `parser.getCurrentName()` | `parser.currentName()` |
+| `parser.getText()` | `parser.getString()` |
+| `JsonToken.FIELD_NAME` | `JsonToken.PROPERTY_NAME` |
+| `gen.writeNumberField` / `writeStringField` | `gen.writeNumberProperty` / `writeStringProperty` |
+| `node.asText()` | `node.asString()` |
+| `factory.createParser(file)` | `factory.createParser(ObjectReadContext.empty(), file)` |
+
+The comparison post's performance section gives the import as
+`tools.jackson.core.JsonFactory`, which does not resolve — the class is in the
+`.json` subpackage.
+
+## G01 — filtering a large array
+
+[`G01StreamingParserFilter.java`](../src/main/java/com/ankurm/jackson3/part6streaming/G01StreamingParserFilter.java)
+
+```
+ERROR: Database connection failed
+Total errors found: 1
+```
+
+## G02 — writing a million records
+
+[`G02StreamingGenerator.java`](../src/main/java/com/ankurm/jackson3/part6streaming/G02StreamingGenerator.java)
+
+The post's loop, kept at its full 1,000,000 iterations, with the heap delta measured so
+"constant memory usage" is a number.
+
+```
+records written : 1000000
+file size       : 30 MB
+elapsed         : 129 ms
+heap delta      : 0 MB   <- the document is never held in memory
+```
+
+## G03 — the tree model
+
+[`G03TreeModelNavigation.java`](../src/main/java/com/ankurm/jackson3/part6streaming/G03TreeModelNavigation.java)
+
+```
+Customer: Alice
+KB-01 x2
+MS-42 x1
+Has discount: false
+path(missing) :   (class MissingNode)
+get(missing)  : null
+deep path     : '<default>'
+treeToValue   : CustomerRecord[name=Alice, tier=gold]
+```
+
+The `path(missing)` / `get(missing)` pair is the whole argument for `path()`: it returns
+a `MissingNode` that chains safely, where `get()` returns `null` and the next call NPEs.
+
+## G04 — the decision table, measured
+
+[`G04ThreeApproachesMeasured.java`](../src/main/java/com/ankurm/jackson3/part6streaming/G04ThreeApproachesMeasured.java)
+
+The post closes with a table asserting relative memory and verbosity. This runs the same
+filter three ways over a generated 20 MB file.
+
+```
+input file : 20 MB, 200000 entries
+
+data binding (readValue)     errors=4000      524 ms   heap delta    47 MB
+tree model (readTree)        errors=4000      341 ms   heap delta   102 MB
+streaming (JsonParser)       errors=4000       78 ms   heap delta     1 MB
+```
+
+Single-shot measurements on a 2-core container, not JMH — treat the ordering as the
+result, not the absolute figures. Two things do stand out and are stable across runs:
+the tree model costs roughly twice the heap of data binding for the same document, and
+streaming is the only approach whose heap does not scale with input size.
--- a/docs/part7-security.md
+++ b/docs/part7-security.md
@@ -0,0 +1,116 @@
+# Part 7 — Security
+
+Post: <https://ankurm.com/jackson-security-best-practices/>
+
+## H01 — the safe pattern
+
+[`H01SafePolymorphismByAnnotation.java`](../src/main/java/com/ankurm/jackson3/part7security/H01SafePolymorphismByAnnotation.java)
+
+`@JsonTypeInfo(use = Id.NAME)` plus an explicit `@JsonSubTypes` registry. The permitted
+set is fixed at compile time, so no payload can introduce a class of its own.
+
+```
+email : EmailNotification[a@example.com]
+sms   : SmsNotification[+441234567890]
+attack: rejected with InvalidTypeIdException
+```
+
+This is the recommendation, and it is correct. Reach for anything below only if this
+cannot express your model.
+
+## H02 — what survived into Jackson 3
+
+[`H02DefaultTypingRemoved.java`](../src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java)
+
+The post's remediation snippet is Jackson 2:
+
+```java
+ObjectMapper mapper = new ObjectMapper();
+mapper.activateDefaultTyping(safeTypeValidator, ObjectMapper.DefaultTyping.NON_FINAL, ...);
+```
+
+Neither line compiles against Jackson 3. The mapper has no mutators at all, and
+`DefaultTyping` is no longer nested inside `ObjectMapper`.
+
+```
+--- tools.jackson.databind.ObjectMapper ---
+  enableDefaultTyping              ABSENT
+  activateDefaultTyping            ABSENT
+  setSerializationInclusion        ABSENT
+  registerModule                   ABSENT
+  addMixIn                         ABSENT
+total set*() mutators: 0
+
+--- tools.jackson.databind.json.JsonMapper.Builder ---
+  activateDefaultTyping            present
+  deactivateDefaultTyping          present
+  polymorphicTypeValidator         present
+  changeDefaultPropertyInclusion   present
+  serializationInclusion           ABSENT
+```
+
+A second correction, from the migration repo rather than this one: both guides state
+that `enableDefaultTyping()` was "removed in 2.16". It is still present on
+`ObjectMapper` in Jackson 2.22.1, deprecated. That changes the migration story — a
+Jackson 2 codebase can still be compiling against it today, so Jackson 3 is where it
+finally breaks, not 2.16.
+
+## H03 — a provable allowlist
+
+[`H03PolymorphicTypeValidatorAllowlist.java`](../src/main/java/com/ankurm/jackson3/part7security/H03PolymorphicTypeValidatorAllowlist.java)
+
+The post's intent in working Jackson 3 form, with the negative test the post's own AI
+prompt asks for.
+
+```
+allowed written : {"@class":"com.ankurm.jackson3.part7security.H03PolymorphicTypeValidatorAllowlist$Envelope","body":{"@class":"com.ankurm.jackson3.part7security.H03PolymorphicTypeValidatorAllowlist$SafePayload","note":"ok"}}
+allowed read    : SafePayload[ok]
+rogue           : rejected with InvalidTypeIdException
+```
+
+One trap the post does not mention: with `DefaultTyping.NON_FINAL`, Jackson writes a
+type id for the **root** object too, so the root class must be allowlisted as well.
+Allowlisting only the payload base type makes the happy path fail, not just the attack
+path — which reads like a bug in your validator when it is actually correct behaviour.
+
+## H04 — resource limits
+
+[`H04StreamReadConstraints.java`](../src/main/java/com/ankurm/jackson3/part7security/H04StreamReadConstraints.java)
+
+Beyond the post. Gadget attacks are not the only deserialisation risk: a few hundred
+bytes of nested brackets can exhaust the stack. Jackson 3 ships defaults for this and
+they are tunable.
+
+```
+--- Jackson 3 defaults ---
+max nesting depth : 500
+max number length : 1000
+max string length : 100000000
+max name length   : 50000
+max doc length    : -1  (-1 = unlimited)
+
+1200-deep nesting, default limits -> rejected (StreamConstraintsException)
+20-deep nesting,  strict limits  -> rejected (StreamConstraintsException)
+5-deep nesting,   strict limits  -> accepted
+3KB string,       strict limits  -> rejected (StreamConstraintsException)
+```
+
+The 100 MB default string limit and unlimited document length are generous for a
+public endpoint. Tighten both if you accept untrusted JSON.
+
+## H05 — Object.class
+
+[`H05NeverDeserialiseIntoObject.java`](../src/main/java/com/ankurm/jackson3/part7security/H05NeverDeserialiseIntoObject.java)
+
+```
+as Object   : {action=ship, quantity=3, extra={nested=[1, 2]}}
+runtime type: java.util.LinkedHashMap   <- a plain Map, no arbitrary class was instantiated
+as DTO      : MyRequestDto[action=ship, quantity=3]
+bad input   : rejected with InvalidFormatException
+```
+
+Worth being precise here, because the post is slightly alarming about it: on a default
+Jackson 3 mapper, `readValue(json, Object.class)` yields a plain `LinkedHashMap`. No
+arbitrary class is instantiated. The danger returns only once default typing is active
+(H03). The rule still holds — target a specific type and you get input validation as a
+side effect, as the last line shows.
--- a/pom.xml
+++ b/pom.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.ankurm</groupId>
+  <artifactId>jackson3-by-example</artifactId>
+  <version>1.0.0</version>
+  <packaging>jar</packaging>
+
+  <name>jackson3-by-example</name>
+  <description>Runnable companion code for the Jackson 3 series on ankurm.com</description>
+
+  <properties>
+    <!-- Jackson 3 requires Java 17+. Verified on Temurin 21.0.5. -->
+    <maven.compiler.release>21</maven.compiler.release>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <jackson.version>3.2.1</jackson.version>
+  </properties>
+
+  <dependencyManagement>
+    <dependencies>
+      <!-- The BOM aligns jackson-core, jackson-databind AND the jackson-annotations
+           version that Jackson 3 expects. Import it instead of pinning each artifact. -->
+      <dependency>
+        <groupId>tools.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+  <dependencies>
+    <!-- Jackson 3 lives at tools.jackson.core, NOT com.fasterxml.jackson.core.
+         jackson-databind pulls in jackson-core and jackson-annotations transitively.
+         jackson-annotations deliberately stays on the com.fasterxml.jackson.core
+         group ID (2.22 as of Jackson 3.2.1) so it can be shared with Jackson 2. -->
+    <dependency>
+      <groupId>tools.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>exec-maven-plugin</artifactId>
+        <version>3.6.3</version>
+      </plugin>
+    </plugins>
+  </build>
+</project>
--- a/run-all.sh
+++ b/run-all.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Compiles the project and runs every example, writing each program's real output
+# to docs/output/<ClassName>.txt. Everything checked into docs/output was produced
+# by this script — nothing is hand-written.
+set -u
+cd "$(dirname "$0")"
+
+mvn -B -q clean compile || { echo "compile failed"; exit 1; }
+CP="target/classes:$(mvn -B -q dependency:build-classpath -Dmdep.outputFile=/dev/stdout -DincludeScope=runtime 2>/dev/null | tail -1)"
+mkdir -p docs/output
+
+FAILED=0
+for f in $(find src/main/java -name '*.java' | sort); do
+  CLASS=$(echo "$f" | sed 's|src/main/java/||; s|\.java$||; s|/|.|g')
+  grep -q 'public static void main' "$f" || continue
+  SHORT="${CLASS##*.}"
+  printf '%-52s' "$SHORT"
+  if java -cp "$CP" "$CLASS" > "docs/output/$SHORT.txt" 2>&1; then
+    echo "ok"
+  else
+    echo "FAILED"; FAILED=1
+  fi
+done
+
+echo
+if [ "$FAILED" -eq 0 ]; then echo "All examples ran successfully."; else echo "Some examples failed."; fi
+exit $FAILED
--- a/src/main/java/com/ankurm/jackson3/beyond/Y01UncheckedExceptions.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y01UncheckedExceptions.java
@@ -0,0 +1,79 @@
+package com.ankurm.jackson3.beyond;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.util.List;
+import java.util.stream.Stream;
+
+/**
+ * BEYOND THE POSTS — the change most likely to reach production unnoticed.
+ *
+ * In Jackson 2, JsonProcessingException extended IOException, so `catch (IOException)`
+ * caught mapping failures. In Jackson 3, JacksonException extends RuntimeException.
+ *
+ * There are two cases, and only one of them is safe:
+ *
+ *   A. The try block contains ONLY Jackson calls. `catch (IOException)` becomes a
+ *      COMPILE ERROR — "exception java.io.IOException is never thrown in body of
+ *      corresponding try statement". The compiler saves you. Good.
+ *
+ *   B. The try block also contains real I/O — reading a file, a socket, a request
+ *      body. IOException is still thrown by that code, so the catch block compiles
+ *      fine and simply stops catching the Jackson half. This is the dangerous case,
+ *      and it is by far the more common shape in real code.
+ *
+ * Case B is what runs below.
+ */
+public class Y01UncheckedExceptions {
+
+    public record OrderDto(Long orderId, String customerName) { }
+
+    public static void main(String[] args) {
+        System.out.println("JacksonException extends RuntimeException : "
+                + RuntimeException.class.isAssignableFrom(JacksonException.class));
+        System.out.println("JacksonException extends IOException      : "
+                + IOException.class.isAssignableFrom(JacksonException.class));
+        System.out.println();
+
+        JsonMapper mapper = JsonMapper.builder().build();
+        String malformed = "{\"orderId\": not-json}";
+
+        // CASE B: genuine I/O plus a Jackson call in the same try block. Compiles
+        // cleanly, catches the I/O half, and lets the Jackson half straight through.
+        System.out.println("-- catch (IOException) around I/O + Jackson --");
+        try {
+            try (StringReader reader = new StringReader(malformed)) {
+                reader.read();                                  // makes IOException reachable
+                mapper.readValue(malformed, OrderDto.class);    // no longer covered
+                System.out.println("   unreachable");
+            } catch (IOException e) {
+                System.out.println("   caught by IOException handler");
+            }
+        } catch (JacksonException escaped) {
+            System.out.println("   ESCAPED the IOException handler -> "
+                    + escaped.getClass().getSimpleName());
+        }
+
+        // The correct Jackson 3 idiom: catch both, separately.
+        System.out.println("-- catch (JacksonException) then catch (IOException) --");
+        try (StringReader reader = new StringReader(malformed)) {
+            reader.read();
+            mapper.readValue(malformed, OrderDto.class);
+        } catch (JacksonException e) {
+            System.out.println("   caught: " + e.getClass().getSimpleName());
+        } catch (IOException e) {
+            System.out.println("   I/O error: " + e.getClass().getSimpleName());
+        }
+
+        // The upside of unchecked: Jackson calls now compose inside lambdas without a
+        // wrapper, which was genuinely painful in Jackson 2.
+        System.out.println("-- unchecked exceptions inside a stream --");
+        List<String> json = Stream.of(new OrderDto(1L, "Alice"), new OrderDto(2L, "Bob"))
+                .map(mapper::writeValueAsString)     // no try/catch, no helper needed
+                .toList();
+        System.out.println("   " + json);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/beyond/Y02TrailingTokens.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y02TrailingTokens.java
@@ -0,0 +1,46 @@
+package com.ankurm.jackson3.beyond;
+
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POSTS — a default that flipped between Jackson 2 and Jackson 3.
+ *
+ * FAIL_ON_TRAILING_TOKENS was OFF in Jackson 2 and is ON in Jackson 3. Concatenated
+ * or double-encoded JSON that Jackson 2 quietly accepted (reading the first document
+ * and discarding the rest) now throws. This is a correctness improvement, but it will
+ * surface as new runtime failures on payloads that used to "work".
+ */
+public class Y02TrailingTokens {
+
+    public record OrderDto(Long orderId) { }
+
+    public static void main(String[] args) {
+        JsonMapper strict  = JsonMapper.builder().build();                 // Jackson 3 default
+        JsonMapper relaxed = JsonMapper.builder()
+                .disable(DeserializationFeature.FAIL_ON_TRAILING_TOKENS)   // Jackson 2 behaviour
+                .build();
+
+        System.out.println("FAIL_ON_TRAILING_TOKENS default : "
+                + strict.deserializationConfig().isEnabled(
+                        DeserializationFeature.FAIL_ON_TRAILING_TOKENS));
+        System.out.println();
+
+        String concatenated = "{\"orderId\":1} {\"orderId\":2}";
+
+        System.out.println("Jackson 3 default -> " + read(strict,  concatenated));
+        System.out.println("2.x behaviour     -> " + read(relaxed, concatenated));
+
+        String trailingGarbage = "{\"orderId\":1}garbage";
+        System.out.println("garbage, default  -> " + read(strict,  trailingGarbage));
+        System.out.println("garbage, relaxed  -> " + read(relaxed, trailingGarbage));
+    }
+
+    private static String read(JsonMapper mapper, String json) {
+        try {
+            return "accepted: " + mapper.readValue(json, OrderDto.class);
+        } catch (Exception e) {
+            return "rejected: " + e.getClass().getSimpleName();
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/beyond/Y03DateTimeDefaults.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y03DateTimeDefaults.java
@@ -0,0 +1,62 @@
+package com.ankurm.jackson3.beyond;
+
+import tools.jackson.databind.cfg.DateTimeFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.ZonedDateTime;
+
+/**
+ * BEYOND THE POSTS — where WRITE_DATES_AS_TIMESTAMPS actually lives.
+ *
+ * Several of the blog snippets carry `.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)`
+ * over from Jackson 2. That constant does NOT exist on SerializationFeature in Jackson 3;
+ * the code does not compile. The flag moved to tools.jackson.databind.cfg.DateTimeFeature
+ * and, more usefully, it now defaults to OFF — so ISO-8601 output needs no configuration
+ * at all and there is nothing to disable.
+ */
+public class Y03DateTimeDefaults {
+
+    public record Meeting(LocalDate day, LocalDateTime startsAt,
+                          Instant recordedAt, ZonedDateTime zoned, Duration length) { }
+
+    public static void main(String[] args) {
+        System.out.println("SerializationFeature has WRITE_DATES_AS_TIMESTAMPS : "
+                + hasSerializationFeature("WRITE_DATES_AS_TIMESTAMPS"));
+        System.out.println("DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS default  : "
+                + JsonMapper.builder().build().serializationConfig()
+                        .isEnabled(DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS));
+        System.out.println();
+
+        Meeting meeting = new Meeting(
+                LocalDate.of(2026, 9, 15),
+                LocalDateTime.of(2026, 9, 15, 10, 30),
+                Instant.parse("2026-09-15T10:30:00Z"),
+                ZonedDateTime.parse("2026-09-15T10:30:00Z"),
+                Duration.ofMinutes(45));
+
+        JsonMapper defaults = JsonMapper.builder().build();
+        System.out.println("defaults (ISO-8601):");
+        System.out.println("  " + defaults.writeValueAsString(meeting));
+
+        JsonMapper timestamps = JsonMapper.builder()
+                .enable(DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS)
+                .build();
+        System.out.println("with WRITE_DATES_AS_TIMESTAMPS enabled:");
+        System.out.println("  " + timestamps.writeValueAsString(meeting));
+
+        // Both forms read back, so an upgrade does not break existing stored payloads.
+        String numeric = timestamps.writeValueAsString(meeting);
+        System.out.println("numeric form reads back: " + defaults.readValue(numeric, Meeting.class).day());
+    }
+
+    private static boolean hasSerializationFeature(String name) {
+        for (var f : tools.jackson.databind.SerializationFeature.values()) {
+            if (f.name().equals(name)) return true;
+        }
+        return false;
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/beyond/Y04ImmutableMapperAndReaders.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y04ImmutableMapperAndReaders.java
@@ -0,0 +1,56 @@
+package com.ankurm.jackson3.beyond;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.PropertyNamingStrategies;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POSTS — how to vary configuration once the mapper is immutable.
+ *
+ * The Jackson 2 habit of grabbing the shared mapper and calling configure() on it is
+ * impossible in Jackson 3 — there are no mutators. The replacements are rebuild(),
+ * which forks a builder from an existing mapper, and reader()/writer() views for
+ * per-call tweaks. Neither disturbs the shared instance.
+ */
+public class Y04ImmutableMapperAndReaders {
+
+    public record UserProfile(String firstName, String lastName, String middleName) { }
+
+    public static void main(String[] args) {
+        JsonMapper shared = JsonMapper.builder().build();
+        UserProfile user = new UserProfile("Ada", "Lovelace", null);
+
+        System.out.println("shared              : " + shared.writeValueAsString(user));
+
+        // 1. rebuild(): fork the shared mapper's configuration and change one thing.
+        JsonMapper snakeCase = shared.rebuild()
+                .propertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE)
+                .changeDefaultPropertyInclusion(i -> i.withValueInclusion(JsonInclude.Include.NON_NULL))
+                .build();
+        System.out.println("rebuilt snake_case  : " + snakeCase.writeValueAsString(user));
+
+        // 2. The shared mapper is untouched by the fork.
+        System.out.println("shared unchanged    : " + shared.writeValueAsString(user));
+
+        // 3. writer()/reader() views for a single call, no new mapper needed.
+        System.out.println("writer view pretty  : "
+                + shared.writer().withDefaultPrettyPrinter().writeValueAsString(user)
+                        .replace("\n", " ").replaceAll("\\s+", " "));
+
+        System.out.println("reader view strict  : " + readStrict(shared));
+    }
+
+    private static String readStrict(JsonMapper shared) {
+        String json = "{\"firstName\":\"Ada\",\"lastName\":\"Lovelace\",\"unexpected\":1}";
+        try {
+            shared.reader()
+                    .with(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .forType(UserProfile.class)     // ObjectReader has no readValue(String, Class)
+                    .readValue(json);
+            return "accepted";
+        } catch (Exception e) {
+            return "rejected (" + e.getClass().getSimpleName() + ") without touching the shared mapper";
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/beyond/Y05CreatorDetection.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y05CreatorDetection.java
@@ -0,0 +1,55 @@
+package com.ankurm.jackson3.beyond;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
+import tools.jackson.databind.MapperFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.Arrays;
+
+/**
+ * BEYOND THE POSTS — checking a claim rather than repeating it.
+ *
+ * The comparison post states that MapperFeature.AUTO_DETECT_CREATORS was removed and
+ * that, as a result, "any class relying on a single-argument constructor being detected
+ * without an annotation will quietly fail."
+ *
+ * Half right. The enum constant is genuinely gone. But the BEHAVIOUR it controlled is
+ * still there: a single-argument constructor is still detected as a delegating creator.
+ * The wrapper below deserialises with no @JsonCreator at all. Annotate anyway — it is
+ * explicit and free — but do not expect the upgrade to break these classes.
+ */
+public class Y05CreatorDetection {
+
+    /** No @JsonCreator anywhere. */
+    public static class ImplicitOrderId {
+        private final String value;
+        public ImplicitOrderId(String value) { this.value = value; }
+        @JsonValue public String value() { return value; }
+        @Override public String toString() { return "ImplicitOrderId[" + value + "]"; }
+    }
+
+    /** The explicit form, which is what you should write. */
+    public static class ExplicitOrderId {
+        private final String value;
+        @JsonCreator public ExplicitOrderId(String value) { this.value = value; }
+        @JsonValue public String value() { return value; }
+        @Override public String toString() { return "ExplicitOrderId[" + value + "]"; }
+    }
+
+    public static void main(String[] args) {
+        boolean present = Arrays.stream(MapperFeature.values())
+                .anyMatch(f -> f.name().equals("AUTO_DETECT_CREATORS"));
+        System.out.println("MapperFeature.AUTO_DETECT_CREATORS exists : " + present);
+        System.out.println("Nearest surviving features                : "
+                + Arrays.stream(MapperFeature.values())
+                        .filter(f -> f.name().contains("CREATOR") || f.name().contains("PARAMETER_NAMES"))
+                        .map(Enum::name).toList());
+        System.out.println();
+
+        JsonMapper mapper = JsonMapper.builder().build();
+        System.out.println("implicit single-arg ctor : " + mapper.readValue("\"ord-1\"", ImplicitOrderId.class));
+        System.out.println("explicit @JsonCreator    : " + mapper.readValue("\"ord-2\"", ExplicitOrderId.class));
+        System.out.println("round-trip via @JsonValue: " + mapper.writeValueAsString(new ImplicitOrderId("ord-3")));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/beyond/Y06RecyclerPoolTuning.java
+++ b/src/main/java/com/ankurm/jackson3/beyond/Y06RecyclerPoolTuning.java
@@ -0,0 +1,69 @@
+package com.ankurm.jackson3.beyond;
+
+import tools.jackson.core.json.JsonFactory;
+import tools.jackson.core.util.JsonRecyclerPools;
+import tools.jackson.core.util.RecyclerPool;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.List;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+
+/**
+ * BEYOND THE POSTS — the performance knob the comparison post names but never measures.
+ *
+ * Jackson 3 changed the default buffer RecyclerPool. The post says to restore the 2.x
+ * thread-local pool if you see a regression. Whether that helps depends entirely on your
+ * concurrency profile, so this measures it on the machine you are actually running on
+ * instead of asserting a winner.
+ *
+ * Indicative timings, not JMH. Run it a few times; the numbers move.
+ */
+public class Y06RecyclerPoolTuning {
+
+    public record Payload(long id, String name, List<String> tags, double amount) { }
+
+    private static final int ITERATIONS = 40_000;
+
+    public static void main(String[] args) throws Exception {
+        System.out.println("default pool : "
+                + JsonRecyclerPools.defaultPool().getClass().getSimpleName());
+        System.out.println("cores        : " + Runtime.getRuntime().availableProcessors());
+        System.out.println();
+
+        for (int threads : new int[] { 1, 8 }) {
+            System.out.println("--- " + threads + " thread(s), " + ITERATIONS + " round-trips each ---");
+            run(threads, "threadLocalPool   (2.x default)", JsonRecyclerPools.threadLocalPool());
+            run(threads, "concurrentDeque   (3.x default)", JsonRecyclerPools.newConcurrentDequePool());
+            run(threads, "nonRecyclingPool  (no reuse)   ", JsonRecyclerPools.nonRecyclingPool());
+            System.out.println();
+        }
+    }
+
+    private static void run(int threads, String label, RecyclerPool<?> pool) throws Exception {
+        @SuppressWarnings({ "unchecked", "rawtypes" })
+        JsonFactory factory = JsonFactory.builder().recyclerPool((RecyclerPool) pool).build();
+        JsonMapper mapper = JsonMapper.builder(factory).build();
+
+        Payload sample = new Payload(1L, "example", List.of("a", "b", "c"), 12.5);
+        for (int i = 0; i < 2_000; i++) {                      // warm up
+            mapper.readValue(mapper.writeValueAsString(sample), Payload.class);
+        }
+
+        ExecutorService pooled = Executors.newFixedThreadPool(threads);
+        long start = System.nanoTime();
+        var tasks = java.util.stream.IntStream.range(0, threads)
+                .<Callable<Void>>mapToObj(t -> () -> {
+                    for (int i = 0; i < ITERATIONS; i++) {
+                        mapper.readValue(mapper.writeValueAsString(sample), Payload.class);
+                    }
+                    return null;
+                }).toList();
+        for (var future : pooled.invokeAll(tasks)) future.get();
+        long ms = (System.nanoTime() - start) / 1_000_000;
+        pooled.shutdown();
+
+        System.out.printf("  %-34s %5d ms%n", label, ms);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part0setup/A01FirstRoundTrip.java
+++ b/src/main/java/com/ankurm/jackson3/part0setup/A01FirstRoundTrip.java
@@ -0,0 +1,49 @@
+package com.ankurm.jackson3.part0setup;
+
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson 101 — https://ankurm.com/jackson-java-tutorial/
+ * Section: "Your First Serialise/Deserialise Example"
+ *
+ * The simplest possible Jackson 3 round-trip: a POJO out to JSON and back.
+ */
+public class A01FirstRoundTrip {
+
+    /** A plain POJO with getters and setters — the classic Jackson shape. */
+    public static class ProductSummary {
+        private Long   productId;
+        private String productName;
+        private double listPrice;
+
+        public ProductSummary() { }                       // needed for deserialisation
+        public ProductSummary(Long id, String name, double price) {
+            this.productId = id; this.productName = name; this.listPrice = price;
+        }
+        public Long   getProductId()   { return productId; }
+        public String getProductName() { return productName; }
+        public double getListPrice()   { return listPrice; }
+        public void setProductId(Long v)     { this.productId = v; }
+        public void setProductName(String v) { this.productName = v; }
+        public void setListPrice(double v)   { this.listPrice = v; }
+    }
+
+    public static void main(String[] args) {
+        // Jackson 3: JsonMapper.builder().build() replaces `new ObjectMapper()`.
+        // The result is IMMUTABLE — you cannot reconfigure it afterwards.
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        // Serialise: Java object -> JSON string
+        ProductSummary product = new ProductSummary(1L, "Mechanical Keyboard", 79.99);
+        String jsonOutput = mapper.writeValueAsString(product);
+        System.out.println(jsonOutput);
+
+        // Deserialise: JSON string -> Java object
+        ProductSummary restored = mapper.readValue(jsonOutput, ProductSummary.class);
+        System.out.println(restored.getProductName());
+
+        // Note: no `throws` clause anywhere in this method. In Jackson 3 the
+        // exception hierarchy is rooted at JacksonException extends RuntimeException,
+        // so serialisation failures are UNCHECKED. See beyond/Y01UncheckedExceptions.
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part0setup/A02SharedMapperConfiguration.java
+++ b/src/main/java/com/ankurm/jackson3/part0setup/A02SharedMapperConfiguration.java
@@ -0,0 +1,64 @@
+package com.ankurm.jackson3.part0setup;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.time.LocalDate;
+
+/**
+ * Post: Jackson 101 — https://ankurm.com/jackson-java-tutorial/
+ * Section: "The ObjectMapper Lifecycle — The One Rule That Matters Most"
+ *
+ * Build the mapper ONCE at startup and share it. In Jackson 3 this is enforced
+ * by the API rather than by convention: the built mapper has no setters at all.
+ */
+public class A02SharedMapperConfiguration {
+
+    public record Invoice(Long invoiceId, String customerName, LocalDate issuedOn, String note) { }
+
+    /**
+     * The Jackson 3 equivalent of the classic Spring @Bean ObjectMapper.
+     *
+     * Three of the four settings people habitually copy from Jackson 2 tutorials
+     * are unnecessary or wrong in Jackson 3 — the comments say which and why.
+     */
+    static JsonMapper buildSharedMapper() {
+        return JsonMapper.builder()
+                // NOT NEEDED: FAIL_ON_UNKNOWN_PROPERTIES already defaults to false in
+                // Jackson 3. Listed here only because it is the single most-copied line
+                // from Jackson 2 configuration; deleting it changes nothing.
+                .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+
+                // NOT NEEDED: java.time support is built into jackson-databind 3.x and
+                // dates already serialise as ISO-8601 strings. There is no
+                // SerializationFeature.WRITE_DATES_AS_TIMESTAMPS in Jackson 3 — the flag
+                // moved to tools.jackson.databind.cfg.DateTimeFeature and is off by
+                // default. See beyond/Y03DateTimeDefaults for proof.
+
+                // Skip null fields. Jackson 2's setSerializationInclusion(...) and the
+                // builder's serializationInclusion(...) do NOT exist in Jackson 3.
+                // The real API is changeDefaultPropertyInclusion.
+                .changeDefaultPropertyInclusion(
+                        incl -> incl.withValueInclusion(JsonInclude.Include.NON_NULL))
+                .build();
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = buildSharedMapper();
+
+        Invoice invoice = new Invoice(500L, "Alice", LocalDate.of(2026, 4, 9), null);
+        System.out.println("configured : " + mapper.writeValueAsString(invoice));
+
+        JsonMapper plain = JsonMapper.builder().build();
+        System.out.println("defaults   : " + plain.writeValueAsString(invoice));
+
+        // Proof that the mapper is immutable: ObjectMapper in Jackson 3 exposes no
+        // set*() mutators at all, so there is no way to reconfigure a shared instance.
+        long setterCount = java.util.Arrays.stream(
+                        tools.jackson.databind.ObjectMapper.class.getMethods())
+                .filter(m -> m.getName().startsWith("set"))
+                .count();
+        System.out.println("ObjectMapper set*() methods in Jackson 3: " + setterCount);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part0setup/A03ThreeProcessingModels.java
+++ b/src/main/java/com/ankurm/jackson3/part0setup/A03ThreeProcessingModels.java
@@ -0,0 +1,45 @@
+package com.ankurm.jackson3.part0setup;
+
+import tools.jackson.core.JsonParser;
+import tools.jackson.core.JsonToken;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson 101 — https://ankurm.com/jackson-java-tutorial/
+ * Section: "Jackson's Three Processing Models"
+ *
+ * The same payload read three ways, so the trade-off is concrete rather than a table.
+ */
+public class A03ThreeProcessingModels {
+
+    public record Order(Long orderId, String status) { }
+
+    private static final String JSON = "{\"orderId\":1001,\"status\":\"SHIPPED\"}";
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        // 1. DATA BINDING — the right answer roughly 95% of the time.
+        Order bound = mapper.readValue(JSON, Order.class);
+        System.out.println("1. data binding : " + bound);
+
+        // 2. TREE MODEL — schema not known at compile time; navigate a JsonNode.
+        JsonNode tree = mapper.readTree(JSON);
+        System.out.println("2. tree model   : orderId=" + tree.path("orderId").asInt()
+                + " status=" + tree.path("status").asString());
+
+        // 3. STREAMING — token by token, constant memory, no document ever built.
+        StringBuilder streamed = new StringBuilder();
+        try (JsonParser parser = mapper.createParser(JSON)) {
+            while (parser.nextToken() != null) {
+                if (parser.currentToken() == JsonToken.PROPERTY_NAME) {
+                    String field = parser.currentName();
+                    parser.nextToken();                       // advance to the value
+                    streamed.append(field).append('=').append(parser.getString()).append(' ');
+                }
+            }
+        }
+        System.out.println("3. streaming    : " + streamed.toString().trim());
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part1objectmapper/B01WriteJson.java
+++ b/src/main/java/com/ankurm/jackson3/part1objectmapper/B01WriteJson.java
@@ -0,0 +1,39 @@
+package com.ankurm.jackson3.part1objectmapper;
+
+import tools.jackson.databind.json.JsonMapper;
+
+import java.io.File;
+import java.nio.file.Files;
+import java.util.List;
+
+/**
+ * Post: Jackson ObjectMapper Guide — https://ankurm.com/jackson-objectmapper-guide/
+ * Section: "Serialising Java Objects to JSON"
+ *
+ * Every write target: String, File, and pretty-printed String.
+ */
+public class B01WriteJson {
+
+    public record Article(Long articleId, String title, List<String> tags) { }
+
+    public static void main(String[] args) throws Exception {
+        JsonMapper mapper = JsonMapper.builder().build();
+        Article article = new Article(1L, "Jackson Deep Dive", List.of("java", "json"));
+
+        // 1. Write to a String
+        String jsonOutput = mapper.writeValueAsString(article);
+        System.out.println(jsonOutput);
+
+        // 2. Write to a File
+        File target = File.createTempFile("article", ".json");
+        mapper.writeValue(target, article);
+        System.out.println("file     : " + Files.readString(target.toPath()));
+
+        // 3. Pretty-printed output
+        String pretty = mapper.writerWithDefaultPrettyPrinter().writeValueAsString(article);
+        System.out.println("pretty   :");
+        System.out.println(pretty);
+
+        target.deleteOnExit();
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part1objectmapper/B02ReadJson.java
+++ b/src/main/java/com/ankurm/jackson3/part1objectmapper/B02ReadJson.java
@@ -0,0 +1,49 @@
+package com.ankurm.jackson3.part1objectmapper;
+
+import tools.jackson.databind.json.JsonMapper;
+
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.List;
+
+/**
+ * Post: Jackson ObjectMapper Guide — https://ankurm.com/jackson-objectmapper-guide/
+ * Section: "Deserialising JSON to Java Objects"
+ *
+ * Reading from a String, a File and an InputStream.
+ *
+ * The post also shows readValue(new URL(...), ...). That overload is deliberately
+ * NOT reproduced here: it performs a live network call, which would make this
+ * example non-reproducible. The InputStream form below is what a real HTTP client
+ * hands you anyway.
+ */
+public class B02ReadJson {
+
+    public record Article(Long articleId, String title, List<String> tags) { }
+
+    public static void main(String[] args) throws Exception {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        String json = "{\"articleId\":1,\"title\":\"Jackson Deep Dive\",\"tags\":[\"java\",\"json\"]}";
+
+        // 1. Read from a String
+        Article fromString = mapper.readValue(json, Article.class);
+        System.out.println("from String : " + fromString.title());
+
+        // 2. Read from a File
+        File file = File.createTempFile("article", ".json");
+        Files.writeString(file.toPath(), json);
+        Article fromFile = mapper.readValue(file, Article.class);
+        System.out.println("from File   : " + fromFile.articleId());
+
+        // 3. Read from an InputStream
+        try (var in = new ByteArrayInputStream(json.getBytes(StandardCharsets.UTF_8))) {
+            Article fromStream = mapper.readValue(in, Article.class);
+            System.out.println("from Stream : " + fromStream.tags());
+        }
+
+        file.deleteOnExit();
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part1objectmapper/B03GenericCollections.java
+++ b/src/main/java/com/ankurm/jackson3/part1objectmapper/B03GenericCollections.java
@@ -0,0 +1,54 @@
+package com.ankurm.jackson3.part1objectmapper;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Post: Jackson ObjectMapper Guide — https://ankurm.com/jackson-objectmapper-guide/
+ * Section: "Working with Collections and Generic Types"
+ *
+ * Why TypeReference is required, and what actually happens without it.
+ *
+ * Note the import: TypeReference lives in tools.jackson.core.type in Jackson 3.
+ */
+public class B03GenericCollections {
+
+    public record Article(Long articleId, String title) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        String jsonArray = "[{\"articleId\":1,\"title\":\"First\"},"
+                         + "{\"articleId\":2,\"title\":\"Second\"}]";
+
+        // CORRECT: TypeReference captures List<Article> through an anonymous subclass,
+        // so the parameterised type survives erasure and reaches Jackson at runtime.
+        List<Article> articles = mapper.readValue(jsonArray, new TypeReference<List<Article>>() { });
+        System.out.println("size          : " + articles.size());
+        System.out.println("element class : " + articles.get(0).getClass().getSimpleName());
+        System.out.println("first title   : " + articles.get(0).title());
+
+        // WRONG: List.class erases the element type. This COMPILES and does not throw
+        // here — the failure is deferred to the first time you treat an element as an
+        // Article, which is what makes it such an unpleasant bug.
+        @SuppressWarnings("rawtypes")
+        List raw = mapper.readValue(jsonArray, List.class);
+        System.out.println("raw element   : " + raw.get(0).getClass().getSimpleName()
+                + "  <- not Article");
+        try {
+            Article boom = (Article) raw.get(0);
+            System.out.println("unreachable: " + boom);
+        } catch (ClassCastException e) {
+            System.out.println("cast fails   : ClassCastException, as expected");
+        }
+
+        // A Map value type needs the same treatment.
+        String jsonObject = "{\"a\":{\"articleId\":9,\"title\":\"Nine\"}}";
+        Map<String, Article> byKey =
+                mapper.readValue(jsonObject, new TypeReference<Map<String, Article>>() { });
+        System.out.println("map value     : " + byKey.get("a").title());
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part1objectmapper/B04PropertyOrdering.java
+++ b/src/main/java/com/ankurm/jackson3/part1objectmapper/B04PropertyOrdering.java
@@ -0,0 +1,50 @@
+package com.ankurm.jackson3.part1objectmapper;
+
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POST — no blog section covers this, but it bites on first run.
+ *
+ * A record serialises in declaration order. A getter-based POJO serialises in
+ * ALPHABETICAL order. If you are diffing Jackson output against a fixture, this
+ * is usually the reason the diff is not empty.
+ */
+public class B04PropertyOrdering {
+
+    /** Getter-based POJO: output is alphabetical, NOT declaration order. */
+    public static class ProductPojo {
+        private Long   productId;
+        private String productName;
+        private double listPrice;
+        public ProductPojo(Long i, String n, double p) { productId = i; productName = n; listPrice = p; }
+        public Long   getProductId()   { return productId; }
+        public String getProductName() { return productName; }
+        public double getListPrice()   { return listPrice; }
+    }
+
+    /** Record: output follows the component declaration order. */
+    public record ProductRecord(Long productId, String productName, double listPrice) { }
+
+    /** Explicit ordering wins over both defaults. */
+    @JsonPropertyOrder({ "productId", "productName", "listPrice" })
+    public static class ProductOrdered {
+        private final Long   productId;
+        private final String productName;
+        private final double listPrice;
+        public ProductOrdered(Long i, String n, double p) { productId = i; productName = n; listPrice = p; }
+        public Long   getProductId()   { return productId; }
+        public String getProductName() { return productName; }
+        public double getListPrice()   { return listPrice; }
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+        System.out.println("POJO    : " + mapper.writeValueAsString(
+                new ProductPojo(1L, "Mechanical Keyboard", 79.99)));
+        System.out.println("record  : " + mapper.writeValueAsString(
+                new ProductRecord(1L, "Mechanical Keyboard", 79.99)));
+        System.out.println("ordered : " + mapper.writeValueAsString(
+                new ProductOrdered(1L, "Mechanical Keyboard", 79.99)));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part2modernjava/C01RecordRoundTrip.java
+++ b/src/main/java/com/ankurm/jackson3/part2modernjava/C01RecordRoundTrip.java
@@ -0,0 +1,36 @@
+package com.ankurm.jackson3.part2modernjava;
+
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson with Records, Optionals, Sealed Classes
+ *       https://ankurm.com/jackson-java-records-optionals/
+ * Section: "Jackson with Java Records"
+ *
+ * Records need no module, no annotation and no -parameters compiler flag in
+ * Jackson 3. Check the pom: there is no jackson-module-parameter-names dependency
+ * and no <compilerArgs>.
+ */
+public class C01RecordRoundTrip {
+
+    /** A concise, immutable data transfer object. */
+    public record ProductRecord(Long productId, String productName, double unitPrice) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        // Serialise: Record -> JSON. Accessor methods replace getters.
+        ProductRecord product = new ProductRecord(101L, "Wireless Keyboard", 49.99);
+        String jsonOutput = mapper.writeValueAsString(product);
+        System.out.println(jsonOutput);
+
+        // Deserialise: JSON -> Record. The canonical constructor is located through
+        // the RecordComponent reflection API (Java 16+), not through parameter names.
+        String json = "{\"productId\":101,\"productName\":\"Wireless Keyboard\",\"unitPrice\":49.99}";
+        ProductRecord restored = mapper.readValue(json, ProductRecord.class);
+        System.out.println(restored.productName());
+
+        // Records also give you equals() for free, so a round-trip is assertable.
+        System.out.println("round-trip equal: " + product.equals(restored));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part2modernjava/C02OptionalFields.java
+++ b/src/main/java/com/ankurm/jackson3/part2modernjava/C02OptionalFields.java
@@ -0,0 +1,51 @@
+package com.ankurm.jackson3.part2modernjava;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.Optional;
+
+/**
+ * Post: Jackson with Records, Optionals, Sealed Classes
+ *       https://ankurm.com/jackson-java-records-optionals/
+ * Section: "Jackson with Optional<T>"
+ *
+ * Jackson 3 handles Optional natively. There is no jackson-datatype-jdk8
+ * dependency in the pom and no registerModule(new Jdk8Module()) call — those are
+ * Jackson 2 requirements, and the Jdk8Module class does not exist under
+ * tools.jackson at all.
+ */
+public class C02OptionalFields {
+
+    public record CustomerProfile(String customerName, Optional<String> middleName) { }
+
+    /** NON_ABSENT is the inclusion value that understands Optional.empty(). */
+    @JsonInclude(JsonInclude.Include.NON_ABSENT)
+    public record CompactProfile(String customerName, Optional<String> middleName) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        // Present value: the Optional is unwrapped, not wrapped in {"present":true}.
+        System.out.println("present : "
+                + mapper.writeValueAsString(new CustomerProfile("Alice", Optional.of("Marie"))));
+
+        // Empty Optional: serialises as null by default.
+        System.out.println("empty   : "
+                + mapper.writeValueAsString(new CustomerProfile("Bob", Optional.empty())));
+
+        // NON_ABSENT omits the property entirely instead of writing null.
+        System.out.println("absent  : "
+                + mapper.writeValueAsString(new CompactProfile("Bob", Optional.empty())));
+
+        // Deserialise back.
+        String json = "{\"customerName\":\"Alice\",\"middleName\":\"Marie\"}";
+        CustomerProfile restored = mapper.readValue(json, CustomerProfile.class);
+        System.out.println("isPresent: " + restored.middleName().isPresent());
+
+        // A missing property deserialises to Optional.empty(), never to null.
+        CustomerProfile missing = mapper.readValue("{\"customerName\":\"Carol\"}", CustomerProfile.class);
+        System.out.println("missing -> " + missing.middleName() + " (null? "
+                + (missing.middleName() == null) + ")");
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part2modernjava/C03SealedWithSubTypes.java
+++ b/src/main/java/com/ankurm/jackson3/part2modernjava/C03SealedWithSubTypes.java
@@ -0,0 +1,57 @@
+package com.ankurm.jackson3.part2modernjava;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.List;
+
+/**
+ * Post: Jackson with Records, Optionals, Sealed Classes
+ *       https://ankurm.com/jackson-java-records-optionals/
+ * Section: "Jackson with Sealed Classes (Java 17+)"
+ *
+ * The explicit-registry form: @JsonTypeInfo plus a hand-maintained @JsonSubTypes.
+ * Compare with C04SealedAutoDiscovery, which drops the registry entirely.
+ */
+public class C03SealedWithSubTypes {
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "shapeType")
+    @JsonSubTypes({
+            @JsonSubTypes.Type(value = Circle.class,    name = "circle"),
+            @JsonSubTypes.Type(value = Rectangle.class, name = "rectangle")
+    })
+    public sealed interface Shape permits Circle, Rectangle { }
+
+    public record Circle(double radius) implements Shape { }
+    public record Rectangle(double width, double height) implements Shape { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        String json = "["
+                + "{\"shapeType\":\"circle\",\"radius\":5.0},"
+                + "{\"shapeType\":\"rectangle\",\"width\":10.0,\"height\":4.0}"
+                + "]";
+
+        List<Shape> shapes = mapper.readValue(json, new TypeReference<List<Shape>>() { });
+
+        // Java 21 pattern matching for switch — exhaustive because Shape is sealed,
+        // so no default branch is needed and a new permitted type is a compile error.
+        for (Shape shape : shapes) {
+            String description = switch (shape) {
+                case Circle c    -> "Circle with radius: " + c.radius();
+                case Rectangle r -> "Rectangle " + r.width() + " x " + r.height();
+            };
+            System.out.println(description);
+        }
+
+        // CAREFUL: writeValueAsString(List<Shape>) loses the discriminator, because
+        // the runtime type of the list carries no element type for Jackson to read.
+        // The result does not round-trip. See part5polymorphic/F02 for the full story.
+        System.out.println("lossy   : " + mapper.writeValueAsString(shapes));
+        System.out.println("correct : " + mapper.writerFor(new TypeReference<List<Shape>>() { })
+                .writeValueAsString(shapes));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part2modernjava/C04SealedAutoDiscovery.java
+++ b/src/main/java/com/ankurm/jackson3/part2modernjava/C04SealedAutoDiscovery.java
@@ -0,0 +1,40 @@
+package com.ankurm.jackson3.part2modernjava;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeName;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POST — the Jackson-3-only shortcut.
+ *
+ * Jackson 3 introspects the `permits` clause of a sealed type, so @JsonSubTypes
+ * can be dropped as long as each permitted type carries @JsonTypeName. That
+ * removes the parallel registry which, in Jackson 2, silently drifts out of sync
+ * with `permits` whenever someone adds a subtype.
+ *
+ * Note there is NO @JsonSubTypes anywhere in this file.
+ */
+public class C04SealedAutoDiscovery {
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "shapeType")
+    public sealed interface Shape permits Circle, Rectangle, Triangle { }
+
+    @JsonTypeName("circle")    public record Circle(double radius) implements Shape { }
+    @JsonTypeName("rectangle") public record Rectangle(double width, double height) implements Shape { }
+    // Added later. In Jackson 2 this line alone would break deserialisation until
+    // someone remembered to also add it to @JsonSubTypes. Here it just works.
+    @JsonTypeName("triangle")  public record Triangle(double base, double height) implements Shape { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        for (Shape original : new Shape[] {
+                new Circle(5.0), new Rectangle(10.0, 4.0), new Triangle(3.0, 6.0) }) {
+
+            String json = mapper.writeValueAsString(original);
+            Shape restored = mapper.readValue(json, Shape.class);
+            System.out.printf("%-24s -> %-52s -> %s%n",
+                    original.getClass().getSimpleName(), json, restored);
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part3annotations/D01RenameAndIgnore.java
+++ b/src/main/java/com/ankurm/jackson3/part3annotations/D01RenameAndIgnore.java
@@ -0,0 +1,44 @@
+package com.ankurm.jackson3.part3annotations;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson Annotations Cheat Sheet — https://ankurm.com/jackson-annotations-guide/
+ * Sections: "@JsonProperty" and "@JsonIgnore"
+ *
+ * Every @Json* annotation is imported from com.fasterxml.jackson.annotation, even
+ * on Jackson 3. jackson-annotations deliberately keeps the old group ID and package
+ * so one copy can be shared by Jackson 2 and Jackson 3 code on the same classpath.
+ */
+public class D01RenameAndIgnore {
+
+    public record OrderSummary(
+            @JsonProperty("order_id")      Long   orderId,
+            @JsonProperty("customer_name") String customerName) { }
+
+    public record UserAccount(
+            String username,
+            @JsonIgnore String passwordHash) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        System.out.println("rename    : "
+                + mapper.writeValueAsString(new OrderSummary(1001L, "Alice")));
+
+        // Deserialisation honours the renamed key in both directions.
+        OrderSummary back = mapper.readValue(
+                "{\"order_id\":1001,\"customer_name\":\"Alice\"}", OrderSummary.class);
+        System.out.println("read back : " + back);
+
+        System.out.println("ignore    : "
+                + mapper.writeValueAsString(new UserAccount("alice", "$2a$10$secret")));
+
+        // @JsonIgnore is bidirectional: the field is not read from JSON either.
+        UserAccount ignored = mapper.readValue(
+                "{\"username\":\"alice\",\"passwordHash\":\"injected\"}", UserAccount.class);
+        System.out.println("read back : passwordHash=" + ignored.passwordHash());
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part3annotations/D02InclusionAndFormat.java
+++ b/src/main/java/com/ankurm/jackson3/part3annotations/D02InclusionAndFormat.java
@@ -0,0 +1,46 @@
+package com.ankurm.jackson3.part3annotations;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.time.LocalDate;
+import java.util.List;
+
+/**
+ * Post: Jackson Annotations Cheat Sheet — https://ankurm.com/jackson-annotations-guide/
+ * Sections: "@JsonInclude" and "@JsonFormat"
+ *
+ * One correction to the post: it says "Without @JsonFormat, Jackson writes LocalDate
+ * as a numeric array by default." That was true in Jackson 2. In Jackson 3, java.time
+ * support is built in and ISO-8601 is the default — the annotation is only needed for
+ * a NON-standard pattern. The `defaultDate` field below proves it.
+ */
+public class D02InclusionAndFormat {
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record ProductDetails(String productName, String productDescription, Double discountRate) { }
+
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public record CompactProduct(String productName, String notes, List<String> tags) { }
+
+    public record InvoiceRecord(
+            Long invoiceId,
+            LocalDate defaultDate,                                        // no annotation
+            @JsonFormat(shape = JsonFormat.Shape.STRING, pattern = "dd/MM/yyyy")
+            LocalDate ukStyleDate,                                        // custom pattern
+            @JsonFormat(shape = JsonFormat.Shape.STRING)
+            double totalAmount) { }                                       // number as string
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        System.out.println("NON_NULL  : "
+                + mapper.writeValueAsString(new ProductDetails("Keyboard", null, null)));
+        System.out.println("NON_EMPTY : "
+                + mapper.writeValueAsString(new CompactProduct("Keyboard", "", List.of())));
+
+        System.out.println("formats   : " + mapper.writeValueAsString(new InvoiceRecord(
+                500L, LocalDate.of(2026, 4, 9), LocalDate.of(2026, 4, 9), 199.99)));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part3annotations/D03AliasAndUnknownFields.java
+++ b/src/main/java/com/ankurm/jackson3/part3annotations/D03AliasAndUnknownFields.java
@@ -0,0 +1,55 @@
+package com.ankurm.jackson3.part3annotations;
+
+import com.fasterxml.jackson.annotation.JsonAlias;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson Annotations Cheat Sheet — https://ankurm.com/jackson-annotations-guide/
+ * Sections: "@JsonAlias" and "@JsonIgnoreProperties"
+ *
+ * Correction to the post: it frames @JsonIgnoreProperties(ignoreUnknown = true) as the
+ * per-class alternative to configuring FAIL_ON_UNKNOWN_PROPERTIES globally. In Jackson 3
+ * that feature is already DISABLED by default, so unknown fields are tolerated with no
+ * annotation at all. The annotation now matters mainly when you have deliberately turned
+ * strictness back ON — which is what the `strict` mapper below does.
+ */
+public class D03AliasAndUnknownFields {
+
+    public record SearchQuery(
+            @JsonAlias({ "q", "query", "search_term" }) String searchKeyword) { }
+
+    public record LenientResponse(String status, String message) { }
+
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record OptedOutResponse(String status, String message) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        for (String json : new String[] {
+                "{\"q\":\"jackson\"}", "{\"query\":\"jackson\"}", "{\"search_term\":\"jackson\"}" }) {
+            System.out.println("alias " + String.format("%-24s", json)
+                    + " -> " + mapper.readValue(json, SearchQuery.class).searchKeyword());
+        }
+
+        String extra = "{\"status\":\"OK\",\"message\":\"done\",\"undocumentedField\":42}";
+
+        // Default Jackson 3 mapper: unknown fields are already ignored.
+        System.out.println("default mapper : " + mapper.readValue(extra, LenientResponse.class));
+
+        // A mapper with strictness deliberately re-enabled.
+        JsonMapper strict = JsonMapper.builder()
+                .enable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                .build();
+        try {
+            strict.readValue(extra, LenientResponse.class);
+            System.out.println("strict mapper  : unreachable");
+        } catch (Exception e) {
+            System.out.println("strict mapper  : " + e.getClass().getSimpleName() + " (as expected)");
+        }
+        // ...but the annotation opts this one class back out of the strictness.
+        System.out.println("strict + anno  : " + strict.readValue(extra, OptedOutResponse.class));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part3annotations/D04CreatorsAndUnwrapping.java
+++ b/src/main/java/com/ankurm/jackson3/part3annotations/D04CreatorsAndUnwrapping.java
@@ -0,0 +1,71 @@
+package com.ankurm.jackson3.part3annotations;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonAnySetter;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonUnwrapped;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Post: Jackson Annotations Cheat Sheet — https://ankurm.com/jackson-annotations-guide/
+ * Sections: "@JsonCreator", plus @JsonUnwrapped which the post's table lists but
+ * never demonstrates. @JsonAnyGetter/@JsonAnySetter are beyond the post entirely.
+ */
+public class D04CreatorsAndUnwrapping {
+
+    /** Immutable class with no setters: the creator tells Jackson how to build it. */
+    public static class ImmutablePoint {
+        private final double xCoordinate;
+        private final double yCoordinate;
+
+        @JsonCreator
+        public ImmutablePoint(@JsonProperty("x") double xCoordinate,
+                              @JsonProperty("y") double yCoordinate) {
+            this.xCoordinate = xCoordinate;
+            this.yCoordinate = yCoordinate;
+        }
+        @JsonProperty("x") public double getXCoordinate() { return xCoordinate; }
+        @JsonProperty("y") public double getYCoordinate() { return yCoordinate; }
+        @Override public String toString() {
+            return "ImmutablePoint(x=" + xCoordinate + ", y=" + yCoordinate + ")";
+        }
+    }
+
+    public record Address(String street, String city) { }
+
+    /** @JsonUnwrapped flattens the nested object into the parent's JSON object. */
+    public static class Customer {
+        public String customerName;
+        @JsonUnwrapped public Address address;
+        public Customer() { }
+        public Customer(String n, Address a) { customerName = n; address = a; }
+    }
+
+    /** Any unmapped properties land in a Map instead of being dropped. */
+    public static class FlexiblePayload {
+        public String knownField;
+        private final Map<String, Object> extras = new LinkedHashMap<>();
+        @JsonAnyGetter public Map<String, Object> extras()            { return extras; }
+        @JsonAnySetter public void put(String k, Object v)            { extras.put(k, v); }
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        ImmutablePoint point = mapper.readValue("{\"x\":3.5,\"y\":7.2}", ImmutablePoint.class);
+        System.out.println("creator   : " + point);
+        System.out.println("round-trip: " + mapper.writeValueAsString(point));
+
+        System.out.println("unwrapped : " + mapper.writeValueAsString(
+                new Customer("Alice", new Address("123 Main St", "Springfield"))));
+
+        FlexiblePayload flexible = mapper.readValue(
+                "{\"knownField\":\"a\",\"surprise\":1,\"another\":[true,false]}", FlexiblePayload.class);
+        System.out.println("any-setter: " + flexible.extras());
+        System.out.println("any-getter: " + mapper.writeValueAsString(flexible));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/E01MoneyValueSerializer.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/E01MoneyValueSerializer.java
@@ -0,0 +1,38 @@
+package com.ankurm.jackson3.part4custom;
+
+import tools.jackson.core.JsonGenerator;
+import tools.jackson.databind.SerializationContext;
+import tools.jackson.databind.ser.std.StdSerializer;
+
+import java.math.RoundingMode;
+
+/**
+ * Post: Custom Serialisers and Mix-ins — https://ankurm.com/jackson-custom-serializer-mixin/
+ * Section: "Writing a Custom Serialiser"
+ *
+ * Three Jackson 3 differences from the code in the post:
+ *   1. Package is tools.jackson.databind.ser.std, not com.fasterxml.jackson...
+ *   2. The third parameter is SerializationContext, not SerializerProvider.
+ *   3. There is no `throws IOException` — JacksonException is unchecked in Jackson 3.
+ *
+ * (StdSerializer still exists under its old name; only JsonSerializer was renamed,
+ *  to ValueSerializer. StdSerializer extends ValueSerializer.)
+ */
+public class E01MoneyValueSerializer extends StdSerializer<Money> {
+
+    public E01MoneyValueSerializer() {
+        super(Money.class);
+    }
+
+    @Override
+    public void serialize(Money moneyValue, JsonGenerator jsonGenerator, SerializationContext ctxt) {
+        jsonGenerator.writeStartObject();
+        // Write the amount rounded to 2 decimal places
+        jsonGenerator.writeNumberProperty("amount",
+                moneyValue.amount().setScale(2, RoundingMode.HALF_UP));
+        // Write the ISO currency code in uppercase
+        jsonGenerator.writeStringProperty("currency",
+                moneyValue.currencyCode().toUpperCase());
+        jsonGenerator.writeEndObject();
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/E02MoneyValueDeserializer.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/E02MoneyValueDeserializer.java
@@ -0,0 +1,35 @@
+package com.ankurm.jackson3.part4custom;
+
+import tools.jackson.core.JsonParser;
+import tools.jackson.databind.DeserializationContext;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.deser.std.StdDeserializer;
+
+import java.math.BigDecimal;
+
+/**
+ * Post: Custom Serialisers and Mix-ins — https://ankurm.com/jackson-custom-serializer-mixin/
+ * Section: "Writing a Custom Deserialiser"
+ *
+ * Jackson 3 differences from the post's code:
+ *   1. jsonParser.getCodec().readTree(jsonParser) is gone. Use ctxt.readTree(parser).
+ *   2. No `throws IOException` — JacksonException is unchecked.
+ *   3. path() rather than get(), so a missing field yields a MissingNode instead of
+ *      a NullPointerException. The post's version NPEs on {"currency":"USD"}.
+ *   4. A bare decimalValue() on a MissingNode THROWS in Jackson 3 (it returned
+ *      BigDecimal.ZERO in Jackson 2). Use the defaulting overload.
+ */
+public class E02MoneyValueDeserializer extends StdDeserializer<Money> {
+
+    public E02MoneyValueDeserializer() {
+        super(Money.class);
+    }
+
+    @Override
+    public Money deserialize(JsonParser jsonParser, DeserializationContext ctxt) {
+        JsonNode rootNode = ctxt.readTree(jsonParser);
+        BigDecimal amount = rootNode.path("amount").decimalValue(BigDecimal.ZERO);
+        String currency   = rootNode.path("currency").asString("GBP");  // default when absent
+        return new Money(amount, currency);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/E03SimpleModuleRegistration.java
@@ -0,0 +1,57 @@
+package com.ankurm.jackson3.part4custom;
+
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.module.SimpleModule;
+
+import java.math.BigDecimal;
+
+/**
+ * Post: Custom Serialisers and Mix-ins — https://ankurm.com/jackson-custom-serializer-mixin/
+ * Section: "Registering the Serialiser and Deserialiser via SimpleModule"
+ *
+ * Jackson 3 differences:
+ *   1. SimpleModule moved to tools.jackson.databind.module.
+ *   2. The Version-taking constructor from the post is gone; pass just a name.
+ *   3. The module is attached with builder.addModule(...), not mapper.registerModule(...),
+ *      because a built mapper is immutable.
+ */
+public class E03SimpleModuleRegistration {
+
+    public static void main(String[] args) {
+        SimpleModule moneyModule = new SimpleModule("MoneyModule");
+        moneyModule.addSerializer(Money.class,   new E01MoneyValueSerializer());
+        moneyModule.addDeserializer(Money.class, new E02MoneyValueDeserializer());
+
+        JsonMapper mapper = JsonMapper.builder()
+                .addModule(moneyModule)
+                .build();
+
+        // Serialise: note the rounding and the upper-casing done by the serialiser.
+        Money price = new Money(new BigDecimal("19.999"), "usd");
+        System.out.println("serialised   : " + mapper.writeValueAsString(price));
+
+        // Deserialise. NOTE: the scale is NOT preserved by default — Jackson parses
+        // 20.00 as a double first, so you get 20.0 and not 20.00. The blog post claims
+        // 20.00; that only holds if you turn on USE_BIG_DECIMAL_FOR_FLOATS, below.
+        Money restored = mapper.readValue("{\"amount\":20.00,\"currency\":\"USD\"}", Money.class);
+        System.out.println("amount       : " + restored.amount() + "  (scale lost)");
+
+        JsonMapper exact = JsonMapper.builder()
+                .addModule(moneyModule)
+                .enable(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS)
+                .build();
+        System.out.println("amount exact : "
+                + exact.readValue("{\"amount\":20.00,\"currency\":\"USD\"}", Money.class).amount()
+                + "  (scale preserved)");
+
+        // The path()-based deserialiser tolerates a missing field; the post's get()
+        // version would throw NullPointerException here.
+        Money partial = mapper.readValue("{\"currency\":\"EUR\"}", Money.class);
+        System.out.println("missing field: " + partial);
+
+        // Without the module the record would serialise structurally instead.
+        JsonMapper plain = JsonMapper.builder().build();
+        System.out.println("no module    : " + plain.writeValueAsString(price));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/E04MixinAnnotations.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/E04MixinAnnotations.java
@@ -0,0 +1,48 @@
+package com.ankurm.jackson3.part4custom;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Custom Serialisers and Mix-ins — https://ankurm.com/jackson-custom-serializer-mixin/
+ * Section: "Mix-in Annotations — Annotating Third-Party Classes"
+ *
+ * Jackson 3 difference: mixins are registered on the BUILDER (addMixIn), because
+ * mapper.addMixIn(...) does not exist on an immutable mapper.
+ */
+public class E04MixinAnnotations {
+
+    /** Stand-in for a third-party class whose source you cannot modify. */
+    public static class Address {
+        public String street;
+        public String city;
+        public String postalCode;
+        public String internalTrackingCode;   // must never reach the wire
+    }
+
+    /** Mix-in: carries the annotations Jackson should apply to Address. */
+    public abstract static class AddressMixin {
+        @JsonIgnore            public String internalTrackingCode;  // suppress
+        @JsonProperty("zip")   public String postalCode;            // rename
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder()
+                .addMixIn(Address.class, AddressMixin.class)
+                .build();
+
+        Address address = new Address();
+        address.street               = "123 Main St";
+        address.city                 = "Springfield";
+        address.postalCode           = "12345";
+        address.internalTrackingCode = "INTERNAL-X99";
+
+        System.out.println("with mixin   : " + mapper.writeValueAsString(address));
+
+        // The target class is untouched — a mapper without the mixin still sees
+        // every field under its original name.
+        System.out.println("without mixin: "
+                + JsonMapper.builder().build().writeValueAsString(address));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/E05ValueSerializerDirect.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/E05ValueSerializerDirect.java
@@ -0,0 +1,43 @@
+package com.ankurm.jackson3.part4custom;
+
+import tools.jackson.core.JsonGenerator;
+import tools.jackson.databind.SerializationContext;
+import tools.jackson.databind.ValueSerializer;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.module.SimpleModule;
+
+/**
+ * BEYOND THE POST — the rename that breaks every custom handler on upgrade.
+ *
+ * Jackson 2's JsonSerializer<T>/JsonDeserializer<T> are gone. The Jackson 3 names
+ * are ValueSerializer<T>/ValueDeserializer<T>. Extending ValueSerializer directly
+ * (rather than StdSerializer) is the leanest form and shows the rename plainly.
+ */
+public class E05ValueSerializerDirect {
+
+    public record UserId(String value) { }
+
+    /** Renders the wrapper as a bare JSON string rather than {"value":"..."}. */
+    static class UserIdSerializer extends ValueSerializer<UserId> {
+        @Override
+        public void serialize(UserId id, JsonGenerator gen, SerializationContext ctxt) {
+            gen.writeString(id.value());
+        }
+    }
+
+    public record Ticket(UserId assignee, String title) { }
+
+    public static void main(String[] args) {
+        SimpleModule module = new SimpleModule("UserIdModule");
+        module.addSerializer(UserId.class, new UserIdSerializer());
+
+        JsonMapper mapper = JsonMapper.builder().addModule(module).build();
+        System.out.println("custom  : "
+                + mapper.writeValueAsString(new Ticket(new UserId("u-42"), "Fix build")));
+        System.out.println("default : "
+                + JsonMapper.builder().build()
+                        .writeValueAsString(new Ticket(new UserId("u-42"), "Fix build")));
+        System.out.println("base class: "
+                + UserIdSerializer.class.getSuperclass().getName());
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part4custom/Money.java
+++ b/src/main/java/com/ankurm/jackson3/part4custom/Money.java
@@ -0,0 +1,6 @@
+package com.ankurm.jackson3.part4custom;
+
+import java.math.BigDecimal;
+
+/** The domain value object used by the custom serialiser and deserialiser. */
+public record Money(BigDecimal amount, String currencyCode) { }
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/BankTransferPayment.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/BankTransferPayment.java
@@ -0,0 +1,11 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+public class BankTransferPayment extends PaymentMethod {
+    private String bankAccountIban;
+    private String bankName;
+
+    public String getBankAccountIban() { return bankAccountIban; }
+    public String getBankName()        { return bankName; }
+    public void setBankAccountIban(String v) { this.bankAccountIban = v; }
+    public void setBankName(String v)        { this.bankName = v; }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/CreditCardPayment.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/CreditCardPayment.java
@@ -0,0 +1,11 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+public class CreditCardPayment extends PaymentMethod {
+    private String cardNumberLastFour;
+    private String cardNetwork;                 // "VISA", "MASTERCARD", etc.
+
+    public String getCardNumberLastFour() { return cardNumberLastFour; }
+    public String getCardNetwork()        { return cardNetwork; }
+    public void setCardNumberLastFour(String v) { this.cardNumberLastFour = v; }
+    public void setCardNetwork(String v)        { this.cardNetwork = v; }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/F01SerialiseMixedList.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/F01SerialiseMixedList.java
@@ -0,0 +1,60 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.List;
+
+/**
+ * Post: Polymorphic Deserialisation — https://ankurm.com/jackson-polymorphic-deserialization/
+ * Section: "Serialising a Mixed List"
+ *
+ * CORRECTION TO THE POST. The post shows
+ *
+ *     mapper.writerWithDefaultPrettyPrinter().writeValueAsString(payments)
+ *
+ * producing JSON that contains "paymentType". It does not. Passing a List to
+ * writeValueAsString gives Jackson only the runtime class (ImmutableCollections.ListN),
+ * which carries no element type, so the polymorphic type serialiser is never engaged
+ * and the discriminator is silently omitted. The resulting JSON then fails to
+ * deserialise — see F02DeserialiseMixedList.
+ *
+ * Two things do work: a typed array, or writerFor(TypeReference).
+ */
+public class F01SerialiseMixedList {
+
+    static List<PaymentMethod> samplePayments() {
+        CreditCardPayment card = new CreditCardPayment();
+        card.setPaymentId(1L);
+        card.setAmountDue(99.99);
+        card.setCardNumberLastFour("4242");
+        card.setCardNetwork("VISA");
+
+        BankTransferPayment bank = new BankTransferPayment();
+        bank.setPaymentId(2L);
+        bank.setAmountDue(250.00);
+        bank.setBankAccountIban("GB29NWBK60161331926819");
+        bank.setBankName("National Bank");
+
+        return List.of(card, bank);
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+        List<PaymentMethod> payments = samplePayments();
+
+        System.out.println("--- 1. single element: discriminator present ---");
+        System.out.println(mapper.writeValueAsString(payments.get(0)));
+
+        System.out.println("--- 2. BROKEN: writeValueAsString(List) drops paymentType ---");
+        System.out.println(mapper.writeValueAsString(payments));
+
+        System.out.println("--- 3. FIX A: writerFor(TypeReference) ---");
+        System.out.println(mapper.writerFor(new TypeReference<List<PaymentMethod>>() { })
+                .withDefaultPrettyPrinter()
+                .writeValueAsString(payments));
+
+        System.out.println("--- 4. FIX B: a typed array carries its component type ---");
+        System.out.println(mapper.writeValueAsString(payments.toArray(new PaymentMethod[0])));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/F02DeserialiseMixedList.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/F02DeserialiseMixedList.java
@@ -0,0 +1,56 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.util.List;
+
+/**
+ * Post: Polymorphic Deserialisation — https://ankurm.com/jackson-polymorphic-deserialization/
+ * Section: "Deserialising a Mixed List"
+ *
+ * Deserialisation is the half that works exactly as the post describes — and it is
+ * also what proves the serialisation defect in F01: feed it the discriminator-less
+ * JSON and it fails outright.
+ */
+public class F02DeserialiseMixedList {
+
+    private static final String GOOD_JSON = "["
+            + "{\"paymentType\":\"credit_card\",\"paymentId\":1,\"amountDue\":99.99,"
+            + "\"cardNumberLastFour\":\"4242\",\"cardNetwork\":\"VISA\"},"
+            + "{\"paymentType\":\"bank_transfer\",\"paymentId\":2,\"amountDue\":250.0,"
+            + "\"bankAccountIban\":\"GB29NWBK60161331926819\",\"bankName\":\"National Bank\"}"
+            + "]";
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        List<PaymentMethod> payments =
+                mapper.readValue(GOOD_JSON, new TypeReference<List<PaymentMethod>>() { });
+
+        for (PaymentMethod payment : payments) {
+            if (payment instanceof CreditCardPayment cc) {
+                System.out.println("Card ending: " + cc.getCardNumberLastFour());
+            } else if (payment instanceof BankTransferPayment bt) {
+                System.out.println("Bank: " + bt.getBankName());
+            }
+        }
+
+        // Now prove the F01 defect matters: the lossy output cannot be read back.
+        String lossy = mapper.writeValueAsString(F01SerialiseMixedList.samplePayments());
+        try {
+            mapper.readValue(lossy, new TypeReference<List<PaymentMethod>>() { });
+            System.out.println("unreachable");
+        } catch (Exception e) {
+            System.out.println("lossy JSON round-trip -> " + e.getClass().getSimpleName());
+        }
+
+        // Whereas the correctly written output does round-trip.
+        String correct = mapper.writerFor(new TypeReference<List<PaymentMethod>>() { })
+                .writeValueAsString(F01SerialiseMixedList.samplePayments());
+        List<PaymentMethod> again =
+                mapper.readValue(correct, new TypeReference<List<PaymentMethod>>() { });
+        System.out.println("correct JSON round-trip -> " + again.size() + " payments, "
+                + again.get(0).getClass().getSimpleName() + " first");
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/F03IncludeStrategies.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/F03IncludeStrategies.java
@@ -0,0 +1,54 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Polymorphic Deserialisation — https://ankurm.com/jackson-polymorphic-deserialization/
+ * Section: "@JsonTypeInfo Placement Options"
+ *
+ * The post gives a table of the four include strategies. This runs all four so you
+ * can see the actual wire format instead of trusting the table.
+ */
+public class F03IncludeStrategies {
+
+    // ---- As.PROPERTY: discriminator is an ordinary field inside the object ----
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.PROPERTY, property = "kind")
+    @JsonSubTypes(@JsonSubTypes.Type(value = PropCard.class, name = "card"))
+    public interface PropBase { }
+    public record PropCard(double amountDue) implements PropBase { }
+
+    // ---- As.WRAPPER_OBJECT: object wrapped in a single-key envelope ----
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.WRAPPER_OBJECT)
+    @JsonSubTypes(@JsonSubTypes.Type(value = WrapObjCard.class, name = "card"))
+    public interface WrapObjBase { }
+    public record WrapObjCard(double amountDue) implements WrapObjBase { }
+
+    // ---- As.WRAPPER_ARRAY: two-element [name, object] array ----
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.WRAPPER_ARRAY)
+    @JsonSubTypes(@JsonSubTypes.Type(value = WrapArrCard.class, name = "card"))
+    public interface WrapArrBase { }
+    public record WrapArrCard(double amountDue) implements WrapArrBase { }
+
+    // ---- As.EXISTING_PROPERTY: reuses a field the class already declares ----
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.EXISTING_PROPERTY,
+                  property = "kind", visible = true)
+    @JsonSubTypes(@JsonSubTypes.Type(value = ExistingCard.class, name = "card"))
+    public interface ExistingBase { String kind(); }
+    public record ExistingCard(String kind, double amountDue) implements ExistingBase { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        System.out.println("PROPERTY          : " + mapper.writeValueAsString((PropBase)     new PropCard(99.0)));
+        System.out.println("WRAPPER_OBJECT    : " + mapper.writeValueAsString((WrapObjBase)  new WrapObjCard(99.0)));
+        System.out.println("WRAPPER_ARRAY     : " + mapper.writeValueAsString((WrapArrBase)  new WrapArrCard(99.0)));
+        System.out.println("EXISTING_PROPERTY : " + mapper.writeValueAsString((ExistingBase) new ExistingCard("card", 99.0)));
+
+        // Each form reads back to the correct concrete type.
+        System.out.println("read PROPERTY       -> " + mapper.readValue("{\"kind\":\"card\",\"amountDue\":99.0}", PropBase.class));
+        System.out.println("read WRAPPER_OBJECT -> " + mapper.readValue("{\"card\":{\"amountDue\":99.0}}", WrapObjBase.class));
+        System.out.println("read WRAPPER_ARRAY  -> " + mapper.readValue("[\"card\",{\"amountDue\":99.0}]", WrapArrBase.class));
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/F04UnknownTypeId.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/F04UnknownTypeId.java
@@ -0,0 +1,36 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POST — what actually happens when the discriminator is wrong.
+ *
+ * The security post asserts that an unregistered type name throws
+ * InvalidTypeIdException. This runs the three failure modes so the exception types
+ * are on the record rather than assumed: unknown name, attacker-supplied class name,
+ * and a missing discriminator.
+ */
+public class F04UnknownTypeId {
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        attempt(mapper, "unknown logical name",
+                "{\"paymentType\":\"crypto\",\"paymentId\":9,\"amountDue\":1.0}");
+
+        attempt(mapper, "attacker-supplied class name",
+                "{\"paymentType\":\"com.malicious.Gadget\",\"paymentId\":9,\"amountDue\":1.0}");
+
+        attempt(mapper, "missing discriminator",
+                "{\"paymentId\":9,\"amountDue\":1.0}");
+    }
+
+    private static void attempt(JsonMapper mapper, String label, String json) {
+        try {
+            PaymentMethod result = mapper.readValue(json, PaymentMethod.class);
+            System.out.printf("%-30s -> UNEXPECTEDLY OK: %s%n", label, result);
+        } catch (Exception e) {
+            System.out.printf("%-30s -> %s%n", label, e.getClass().getSimpleName());
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part5polymorphic/PaymentMethod.java
+++ b/src/main/java/com/ankurm/jackson3/part5polymorphic/PaymentMethod.java
@@ -0,0 +1,27 @@
+package com.ankurm.jackson3.part5polymorphic;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+
+/**
+ * Post: Polymorphic Deserialisation — https://ankurm.com/jackson-polymorphic-deserialization/
+ * Section: "Setting Up the Hierarchy with @JsonTypeInfo and @JsonSubTypes"
+ */
+@JsonTypeInfo(
+        use      = JsonTypeInfo.Id.NAME,      // use a logical name as the discriminator
+        include  = JsonTypeInfo.As.PROPERTY,  // embed it as a field in the JSON object
+        property = "paymentType"              // the JSON key that carries the type name
+)
+@JsonSubTypes({
+        @JsonSubTypes.Type(value = CreditCardPayment.class,   name = "credit_card"),
+        @JsonSubTypes.Type(value = BankTransferPayment.class, name = "bank_transfer")
+})
+public abstract class PaymentMethod {
+    private Long   paymentId;
+    private double amountDue;
+
+    public Long   getPaymentId()  { return paymentId; }
+    public double getAmountDue()  { return amountDue; }
+    public void setPaymentId(Long v)   { this.paymentId = v; }
+    public void setAmountDue(double v) { this.amountDue = v; }
+}
--- a/src/main/java/com/ankurm/jackson3/part6streaming/G01StreamingParserFilter.java
+++ b/src/main/java/com/ankurm/jackson3/part6streaming/G01StreamingParserFilter.java
@@ -0,0 +1,73 @@
+package com.ankurm.jackson3.part6streaming;
+
+import tools.jackson.core.JsonParser;
+import tools.jackson.core.JsonToken;
+import tools.jackson.core.json.JsonFactory;
+
+import java.io.File;
+import java.nio.file.Files;
+
+/**
+ * Post: Streaming API and JsonNode — https://ankurm.com/jackson-streaming-api-jsonnode/
+ * Section: "Reading a Large JSON Array with JsonParser"
+ *
+ * Jackson 3 differences from the post's code:
+ *   1. JsonFactory is in tools.jackson.core.json — NOT tools.jackson.core.
+ *   2. parser.getCurrentName() is now parser.currentName().
+ *   3. parser.getText() is now parser.getString().
+ *   4. JsonToken.FIELD_NAME is now JsonToken.PROPERTY_NAME.
+ *   5. No `throws IOException` — Jackson 3 exceptions are unchecked.
+ */
+public class G01StreamingParserFilter {
+
+    private static final String SAMPLE = """
+            [
+              {"level":"INFO","message":"Application started"},
+              {"level":"ERROR","message":"Database connection failed"},
+              {"level":"INFO","message":"Retrying connection"}
+            ]
+            """;
+
+    public static void main(String[] args) throws Exception {
+        File logFile = File.createTempFile("large-logs", ".json");
+        Files.writeString(logFile.toPath(), SAMPLE);
+        logFile.deleteOnExit();
+
+        JsonFactory jsonFactory = new JsonFactory();
+        int errorCount = 0;
+
+        try (JsonParser parser = jsonFactory.createParser(tools.jackson.core.ObjectReadContext.empty(), logFile)) {
+
+            // Confirm the root is an array
+            if (parser.nextToken() != JsonToken.START_ARRAY) {
+                throw new IllegalStateException("Expected a JSON array at the root");
+            }
+
+            // Walk each element in the array
+            while (parser.nextToken() != JsonToken.END_ARRAY) {
+
+                String logLevel   = null;
+                String logMessage = null;
+
+                // Walk each property inside the current object
+                while (parser.nextToken() != JsonToken.END_OBJECT) {
+                    String fieldName = parser.currentName();
+                    parser.nextToken();                       // move to the value
+
+                    if ("level".equals(fieldName)) {
+                        logLevel = parser.getString();
+                    } else if ("message".equals(fieldName)) {
+                        logMessage = parser.getString();
+                    }
+                    // All other fields are skipped automatically
+                }
+
+                if ("ERROR".equals(logLevel)) {
+                    System.out.println("ERROR: " + logMessage);
+                    errorCount++;
+                }
+            }
+        }
+        System.out.println("Total errors found: " + errorCount);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part6streaming/G02StreamingGenerator.java
+++ b/src/main/java/com/ankurm/jackson3/part6streaming/G02StreamingGenerator.java
@@ -0,0 +1,55 @@
+package com.ankurm.jackson3.part6streaming;
+
+import tools.jackson.core.JsonEncoding;
+import tools.jackson.core.JsonGenerator;
+import tools.jackson.core.ObjectWriteContext;
+import tools.jackson.core.json.JsonFactory;
+
+import java.io.File;
+
+/**
+ * Post: Streaming API and JsonNode — https://ankurm.com/jackson-streaming-api-jsonnode/
+ * Section: "Writing JSON with JsonGenerator"
+ *
+ * Jackson 3 differences: writeNumberField/writeStringField are now
+ * writeNumberProperty/writeStringProperty, and the factory needs an
+ * ObjectWriteContext. The post's 1,000,000-record loop is kept — it is the whole
+ * point of streaming — and the peak heap is measured so "constant memory" is a
+ * number rather than a claim.
+ */
+public class G02StreamingGenerator {
+
+    private static final int RECORD_COUNT = 1_000_000;
+
+    public static void main(String[] args) throws Exception {
+        File output = File.createTempFile("output", ".json");
+        output.deleteOnExit();
+
+        JsonFactory jsonFactory = new JsonFactory();
+        Runtime runtime = Runtime.getRuntime();
+        long before = runtime.totalMemory() - runtime.freeMemory();
+        long start  = System.nanoTime();
+
+        try (JsonGenerator generator = jsonFactory.createGenerator(
+                ObjectWriteContext.empty(), output, JsonEncoding.UTF8)) {
+
+            generator.writeStartArray();
+            for (int recordIndex = 0; recordIndex < RECORD_COUNT; recordIndex++) {
+                generator.writeStartObject();
+                generator.writeNumberProperty("id",     recordIndex);
+                generator.writeStringProperty("status", "active");
+                generator.writeEndObject();
+            }
+            generator.writeEndArray();
+        }
+
+        long elapsedMs = (System.nanoTime() - start) / 1_000_000;
+        long after     = runtime.totalMemory() - runtime.freeMemory();
+
+        System.out.println("records written : " + RECORD_COUNT);
+        System.out.println("file size       : " + (output.length() / 1024 / 1024) + " MB");
+        System.out.println("elapsed         : " + elapsedMs + " ms");
+        System.out.println("heap delta      : " + ((after - before) / 1024 / 1024) + " MB"
+                + "   <- the document is never held in memory");
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part6streaming/G03TreeModelNavigation.java
+++ b/src/main/java/com/ankurm/jackson3/part6streaming/G03TreeModelNavigation.java
@@ -0,0 +1,50 @@
+package com.ankurm.jackson3.part6streaming;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Streaming API and JsonNode — https://ankurm.com/jackson-streaming-api-jsonnode/
+ * Sections: "The Tree Model" and "Mixing Tree Model with Data Binding"
+ *
+ * Jackson 3 difference: JsonNode.asText() is now asString(). asInt() survives.
+ */
+public class G03TreeModelNavigation {
+
+    public record CustomerRecord(String name, String tier) { }
+
+    private static final String JSON = "{"
+            + "\"orderId\":1001,"
+            + "\"customer\":{\"name\":\"Alice\",\"tier\":\"gold\"},"
+            + "\"items\":[{\"sku\":\"KB-01\",\"qty\":2},{\"sku\":\"MS-42\",\"qty\":1}]"
+            + "}";
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        JsonNode rootNode = mapper.readTree(JSON);
+
+        // path() never returns null — a missing node is a MissingNode.
+        String customerName = rootNode.path("customer").path("name").asString();
+        System.out.println("Customer: " + customerName);
+
+        for (JsonNode itemNode : rootNode.path("items")) {
+            System.out.println(itemNode.path("sku").asString() + " x" + itemNode.path("qty").asInt());
+        }
+
+        System.out.println("Has discount: " + rootNode.has("discountCode"));
+
+        // path() vs get() on an absent field — the difference that causes NPEs.
+        System.out.println("path(missing) : " + rootNode.path("nope")
+                + "  (class " + rootNode.path("nope").getClass().getSimpleName() + ")");
+        System.out.println("get(missing)  : " + rootNode.get("nope"));
+
+        // Deep navigation stays null-safe all the way down.
+        System.out.println("deep path     : '"
+                + rootNode.path("a").path("b").path("c").asString("<default>") + "'");
+
+        // Switch from tree to data binding at any node.
+        CustomerRecord customer = mapper.treeToValue(rootNode.path("customer"), CustomerRecord.class);
+        System.out.println("treeToValue   : " + customer);
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part6streaming/G04ThreeApproachesMeasured.java
+++ b/src/main/java/com/ankurm/jackson3/part6streaming/G04ThreeApproachesMeasured.java
@@ -0,0 +1,101 @@
+package com.ankurm.jackson3.part6streaming;
+
+import tools.jackson.core.JsonParser;
+import tools.jackson.core.JsonToken;
+import tools.jackson.core.json.JsonFactory;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.io.File;
+import java.nio.file.Files;
+import java.util.List;
+
+/**
+ * BEYOND THE POST — the decision table, measured.
+ *
+ * The post ends with a table claiming data binding "loads full object", tree model
+ * "loads full tree", and streaming uses "constant" memory. This generates a real
+ * file and measures all three so the table has numbers behind it.
+ *
+ * These are indicative single-shot measurements on one JVM, not JMH benchmarks —
+ * the ordering is the point, not the absolute figures.
+ */
+public class G04ThreeApproachesMeasured {
+
+    public record LogEntry(long id, String level, String message) { }
+
+    private static final int ENTRIES = 200_000;
+
+    public static void main(String[] args) throws Exception {
+        File file = generate();
+        System.out.println("input file : " + (file.length() / 1024 / 1024) + " MB, "
+                + ENTRIES + " entries");
+        System.out.println();
+
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        measure("data binding (readValue)", () -> {
+            List<LogEntry> all = mapper.readValue(file, new TypeReference<List<LogEntry>>() { });
+            return all.stream().filter(e -> e.level().equals("ERROR")).count();
+        });
+
+        measure("tree model (readTree)", () -> {
+            JsonNode root = mapper.readTree(file);
+            long n = 0;
+            for (JsonNode node : root) if ("ERROR".equals(node.path("level").asString())) n++;
+            return n;
+        });
+
+        measure("streaming (JsonParser)", () -> {
+            long n = 0;
+            JsonFactory factory = new JsonFactory();
+            try (JsonParser p = factory.createParser(tools.jackson.core.ObjectReadContext.empty(), file)) {
+                p.nextToken();
+                while (p.nextToken() != JsonToken.END_ARRAY) {
+                    String level = null;
+                    while (p.nextToken() != JsonToken.END_OBJECT) {
+                        String f = p.currentName();
+                        p.nextToken();
+                        if ("level".equals(f)) level = p.getString();
+                    }
+                    if ("ERROR".equals(level)) n++;
+                }
+            }
+            return n;
+        });
+
+        file.delete();
+    }
+
+    private interface Counter { long count() throws Exception; }
+
+    private static void measure(String label, Counter counter) throws Exception {
+        Runtime rt = Runtime.getRuntime();
+        System.gc();
+        Thread.sleep(120);
+        long heapBefore = rt.totalMemory() - rt.freeMemory();
+        long start = System.nanoTime();
+        long errors = counter.count();
+        long ms = (System.nanoTime() - start) / 1_000_000;
+        long heapAfter = rt.totalMemory() - rt.freeMemory();
+        System.out.printf("%-28s errors=%-6d  %5d ms   heap delta %5d MB%n",
+                label, errors, ms, (heapAfter - heapBefore) / 1024 / 1024);
+    }
+
+    private static File generate() throws Exception {
+        File f = File.createTempFile("logs", ".json");
+        f.deleteOnExit();
+        StringBuilder sb = new StringBuilder("[");
+        for (int i = 0; i < ENTRIES; i++) {
+            if (i > 0) sb.append(',');
+            sb.append("{\"id\":").append(i)
+              .append(",\"level\":\"").append(i % 50 == 0 ? "ERROR" : "INFO")
+              .append("\",\"message\":\"event number ").append(i)
+              .append(" with some padding to make the payload realistic\"}");
+        }
+        sb.append(']');
+        Files.writeString(f.toPath(), sb);
+        return f;
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part7security/H01SafePolymorphismByAnnotation.java
+++ b/src/main/java/com/ankurm/jackson3/part7security/H01SafePolymorphismByAnnotation.java
@@ -0,0 +1,49 @@
+package com.ankurm.jackson3.part7security;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson Security Best Practices — https://ankurm.com/jackson-security-best-practices/
+ * Section: "Use @JsonTypeInfo Instead of Default Typing"
+ *
+ * The safe pattern: the permitted types are fixed at compile time, so no JSON payload
+ * can introduce a class name of its own.
+ */
+public class H01SafePolymorphismByAnnotation {
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "type")
+    @JsonSubTypes({
+            @JsonSubTypes.Type(value = EmailNotification.class, name = "email"),
+            @JsonSubTypes.Type(value = SmsNotification.class,   name = "sms")
+    })
+    public abstract static class Notification { }
+
+    public static class EmailNotification extends Notification {
+        public String recipientEmail;
+        @Override public String toString() { return "EmailNotification[" + recipientEmail + "]"; }
+    }
+
+    public static class SmsNotification extends Notification {
+        public String recipientPhone;
+        @Override public String toString() { return "SmsNotification[" + recipientPhone + "]"; }
+    }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        System.out.println("email : " + mapper.readValue(
+                "{\"type\":\"email\",\"recipientEmail\":\"a@example.com\"}", Notification.class));
+        System.out.println("sms   : " + mapper.readValue(
+                "{\"type\":\"sms\",\"recipientPhone\":\"+441234567890\"}", Notification.class));
+
+        // A class name supplied by an attacker is not a registered logical name.
+        try {
+            mapper.readValue("{\"type\":\"com.malicious.Gadget\"}", Notification.class);
+            System.out.println("attack: UNEXPECTEDLY ACCEPTED");
+        } catch (Exception e) {
+            System.out.println("attack: rejected with " + e.getClass().getSimpleName());
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java
+++ b/src/main/java/com/ankurm/jackson3/part7security/H02DefaultTypingRemoved.java
@@ -0,0 +1,52 @@
+package com.ankurm.jackson3.part7security;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+
+/**
+ * Post: Jackson Security Best Practices — https://ankurm.com/jackson-security-best-practices/
+ * Section: "The Safe Alternative: PolymorphicTypeValidator"
+ *
+ * CORRECTION TO THE POST. The post shows the remediation as
+ *
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.activateDefaultTyping(validator, DefaultTyping.NON_FINAL, As.PROPERTY);
+ *
+ * That is Jackson 2 code. In Jackson 3 BOTH enableDefaultTyping and
+ * activateDefaultTyping are absent from the mapper — the mapper has no mutators at
+ * all. activateDefaultTyping survives only on JsonMapper.Builder. This prints the
+ * reflective proof for each claim rather than asserting it.
+ *
+ * See H03PolymorphicTypeValidatorAllowlist for the working builder-based form.
+ */
+public class H02DefaultTypingRemoved {
+
+    public static void main(String[] args) {
+        System.out.println("--- tools.jackson.databind.ObjectMapper ---");
+        report(ObjectMapper.class, "enableDefaultTyping");
+        report(ObjectMapper.class, "activateDefaultTyping");
+        report(ObjectMapper.class, "setSerializationInclusion");
+        report(ObjectMapper.class, "registerModule");
+        report(ObjectMapper.class, "addMixIn");
+        System.out.println("total set*() mutators: " + Arrays.stream(ObjectMapper.class.getMethods())
+                .filter(m -> m.getName().startsWith("set")).count());
+
+        System.out.println();
+        System.out.println("--- tools.jackson.databind.json.JsonMapper.Builder ---");
+        report(JsonMapper.Builder.class, "activateDefaultTyping");
+        report(JsonMapper.Builder.class, "deactivateDefaultTyping");
+        report(JsonMapper.Builder.class, "polymorphicTypeValidator");
+        report(JsonMapper.Builder.class, "changeDefaultPropertyInclusion");
+        report(JsonMapper.Builder.class, "serializationInclusion");
+    }
+
+    private static void report(Class<?> type, String methodName) {
+        boolean present = Arrays.stream(type.getMethods())
+                .map(Method::getName)
+                .anyMatch(methodName::equals);
+        System.out.printf("  %-32s %s%n", methodName, present ? "present" : "ABSENT");
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part7security/H03PolymorphicTypeValidatorAllowlist.java
+++ b/src/main/java/com/ankurm/jackson3/part7security/H03PolymorphicTypeValidatorAllowlist.java
@@ -0,0 +1,75 @@
+package com.ankurm.jackson3.part7security;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import tools.jackson.databind.DefaultTyping;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
+import tools.jackson.databind.jsontype.PolymorphicTypeValidator;
+
+/**
+ * Post: Jackson Security Best Practices — https://ankurm.com/jackson-security-best-practices/
+ * Section: "The Safe Alternative: PolymorphicTypeValidator"
+ *
+ * The post's snippet in working Jackson 3 form. Note DefaultTyping is a top-level
+ * enum in tools.jackson.databind, not ObjectMapper.DefaultTyping as in Jackson 2.
+ *
+ * Default typing remains a last resort. Prefer H01. This exists because legacy object
+ * graphs and plugin systems sometimes genuinely need it, and when they do, the
+ * allowlist has to be provable — hence the negative test at the bottom.
+ */
+public class H03PolymorphicTypeValidatorAllowlist {
+
+    public abstract static class BasePayload { }
+    public static class SafePayload extends BasePayload {
+        public String note;
+        public SafePayload() { }
+        public SafePayload(String n) { note = n; }
+        @Override public String toString() { return "SafePayload[" + note + "]"; }
+    }
+
+    /** Deliberately outside the allowlisted base type. */
+    public static class RoguePayload {
+        public String note;
+    }
+
+    public static class Envelope {
+        public Object body;                 // the field default typing has to resolve
+        public Envelope() { }
+        public Envelope(Object b) { body = b; }
+    }
+
+    public static void main(String[] args) {
+        // Permit ONLY the envelope and our own payload hierarchy. Anything else is
+        // refused at type-resolution time, before any class is instantiated.
+        //
+        // Note the gotcha: with DefaultTyping.NON_FINAL, Jackson writes a type id for
+        // the ROOT object too, so Envelope must be allowlisted as well. Allowlisting
+        // only BasePayload makes even the happy path fail — which is how most people
+        // first meet this API.
+        PolymorphicTypeValidator safeTypeValidator = BasicPolymorphicTypeValidator.builder()
+                .allowIfSubType(Envelope.class)
+                .allowIfSubType(BasePayload.class)
+                .build();
+
+        JsonMapper mapper = JsonMapper.builder()
+                .activateDefaultTyping(safeTypeValidator,
+                        DefaultTyping.NON_FINAL,
+                        JsonTypeInfo.As.PROPERTY)
+                .build();
+
+        String allowed = mapper.writeValueAsString(new Envelope(new SafePayload("ok")));
+        System.out.println("allowed written : " + allowed);
+        System.out.println("allowed read    : "
+                + ((Envelope) mapper.readValue(allowed, Envelope.class)).body);
+
+        // Negative test: a class outside the allowlist is rejected even though it
+        // exists on the classpath and would deserialise perfectly well otherwise.
+        String rogue = "{\"body\":[\"" + RoguePayload.class.getName() + "\",{\"note\":\"pwn\"}]}";
+        try {
+            mapper.readValue(rogue, Envelope.class);
+            System.out.println("rogue           : UNEXPECTEDLY ACCEPTED");
+        } catch (Exception e) {
+            System.out.println("rogue           : rejected with " + e.getClass().getSimpleName());
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part7security/H04StreamReadConstraints.java
+++ b/src/main/java/com/ankurm/jackson3/part7security/H04StreamReadConstraints.java
@@ -0,0 +1,57 @@
+package com.ankurm.jackson3.part7security;
+
+import tools.jackson.core.StreamReadConstraints;
+import tools.jackson.core.json.JsonFactory;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * BEYOND THE POST — the hardening the security post does not mention.
+ *
+ * Gadget attacks are not the only deserialisation risk. A small payload can also
+ * exhaust the stack or the heap: deeply nested arrays, gigantic numbers, enormous
+ * strings. Jackson 3 ships StreamReadConstraints with defaults for all three, and
+ * they are tunable. Any service accepting external JSON should know what they are.
+ */
+public class H04StreamReadConstraints {
+
+    public static void main(String[] args) {
+        StreamReadConstraints defaults = StreamReadConstraints.defaults();
+        System.out.println("--- Jackson 3 defaults ---");
+        System.out.println("max nesting depth : " + defaults.getMaxNestingDepth());
+        System.out.println("max number length : " + defaults.getMaxNumberLength());
+        System.out.println("max string length : " + defaults.getMaxStringLength());
+        System.out.println("max name length   : " + defaults.getMaxNameLength());
+        System.out.println("max doc length    : " + defaults.getMaxDocumentLength()
+                + "  (-1 = unlimited)");
+        System.out.println();
+
+        JsonMapper plain = JsonMapper.builder().build();
+        String deep = "[".repeat(1200) + "]".repeat(1200);
+        System.out.println("1200-deep nesting, default limits -> " + attempt(plain, deep));
+
+        // Tighten the limits for an endpoint that should never see nested data.
+        JsonFactory strictFactory = JsonFactory.builder()
+                .streamReadConstraints(StreamReadConstraints.builder()
+                        .maxNestingDepth(10)
+                        .maxStringLength(2_000)
+                        .build())
+                .build();
+        JsonMapper strict = JsonMapper.builder(strictFactory).build();
+
+        System.out.println("20-deep nesting,  strict limits  -> "
+                + attempt(strict, "[".repeat(20) + "]".repeat(20)));
+        System.out.println("5-deep nesting,   strict limits  -> "
+                + attempt(strict, "[".repeat(5) + "]".repeat(5)));
+        System.out.println("3KB string,       strict limits  -> "
+                + attempt(strict, "\"" + "x".repeat(3_000) + "\""));
+    }
+
+    private static String attempt(JsonMapper mapper, String json) {
+        try {
+            mapper.readTree(json);
+            return "accepted";
+        } catch (Exception e) {
+            return "rejected (" + e.getClass().getSimpleName() + ")";
+        }
+    }
+}
--- a/src/main/java/com/ankurm/jackson3/part7security/H05NeverDeserialiseIntoObject.java
+++ b/src/main/java/com/ankurm/jackson3/part7security/H05NeverDeserialiseIntoObject.java
@@ -0,0 +1,42 @@
+package com.ankurm.jackson3.part7security;
+
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Post: Jackson Security Best Practices — https://ankurm.com/jackson-security-best-practices/
+ * Section: "Never Deserialise Untrusted JSON into Object.class"
+ *
+ * Worth knowing precisely what readValue(json, Object.class) does on a DEFAULT
+ * Jackson 3 mapper, because the answer is reassuring and often misunderstood:
+ * with no default typing active it produces plain Maps, Lists, Strings and numbers.
+ * The danger only returns when default typing is switched on — as H03 shows.
+ *
+ * The rule still stands. Target a specific type; you get validation for free.
+ */
+public class H05NeverDeserialiseIntoObject {
+
+    public record MyRequestDto(String action, int quantity) { }
+
+    public static void main(String[] args) {
+        JsonMapper mapper = JsonMapper.builder().build();
+
+        String untrusted = "{\"action\":\"ship\",\"quantity\":3,\"extra\":{\"nested\":[1,2]}}";
+
+        Object loose = mapper.readValue(untrusted, Object.class);
+        System.out.println("as Object   : " + loose);
+        System.out.println("runtime type: " + loose.getClass().getName()
+                + "   <- a plain Map, no arbitrary class was instantiated");
+
+        MyRequestDto typed = mapper.readValue(untrusted, MyRequestDto.class);
+        System.out.println("as DTO      : " + typed);
+
+        // The real benefit of a specific target type: malformed input fails loudly
+        // instead of flowing onward as an untyped Map.
+        try {
+            mapper.readValue("{\"action\":\"ship\",\"quantity\":\"not-a-number\"}", MyRequestDto.class);
+            System.out.println("bad input   : UNEXPECTEDLY ACCEPTED");
+        } catch (Exception e) {
+            System.out.println("bad input   : rejected with " + e.getClass().getSimpleName());
+        }
+    }
+}