application expects a Greeting and writes: String greeting = (Greeting) in.readObject()
  >>> Noisy.readObject() is running -- code of the class named in the stream
ClassCastException AFTER the side effect: class com.ankurm.serialization.ReadObjectRunsCodeDemo$Noisy cannot be cast to class com.ankurm.serialization.ReadObjectRunsCodeDemo$Greeting (com.ankurm.serialization.ReadObjectRunsCodeDemo$Noisy and com.ankurm.serialization.ReadObjectRunsCodeDemo$Greeting are in unnamed module of loader 'app')

same bytes, allow-list filter that only admits Greeting:
InvalidClassException: filter status: REJECTED