refactor: scaffold module + dependency hygiene script

- Collapse breakpoints/state/ui into scaffold/; re-export at crate root for API stability
- Add scripts/deps_check.sh (cargo tree -d, audit, outdated); document in README/CONTRIBUTING
- cargo audit: no vulnerabilities in current Cargo.lock; tree -d notes thiserror v1+v2

Made-with: Cursor

Author: Alex J Lennon

CONTRIBUTING.md

@@ -46,6 +46,14 @@ From the repo root, run the same checks CI uses (fmt, tests with `--all-features
 
 On Windows, use **Git Bash** or **WSL** so the script runs, or run the `cargo` commands from that script by hand.
 
+### Optional — dependency hygiene (before releases)
+
+```bash
+./scripts/deps_check.sh
+```
+
+This runs **`cargo tree -d`** (duplicate transitive versions — often benign, e.g. `thiserror` v1 via `svd-parser` and v2 via `tracing-appender`), **`cargo audit`** against [RustSec](https://github.com/RustSec/advisory-db) (install: `cargo install cargo-audit`), and **`cargo outdated --workspace`** if `cargo-outdated` is installed (`cargo install cargo-outdated`). Major upgrades (e.g. `toml` 0.8 → 1.x) need a deliberate PR, not blind `cargo update`.
+
 ### Phase A — RSP-only regression (fast, no `gdb` binary)
 
 Codec framing + proxy TCP integration tests only (~1s):
@@ -321,7 +329,8 @@ rsgdb/
 ├── src/                     # Library + binary
 ├── tests/                   # Integration tests (e.g. proxy RSP smoke)
 ├── scripts/
-│   └── validate_local.sh    # Local CI parity (run before PRs)
+│   ├── validate_local.sh    # Local CI parity (run before PRs)
+│   └── deps_check.sh        # Optional: tree -d, audit, outdated
 ├── rsgdb.toml.example
 └── .github/workflows/       # CI
 ```

README.md

@@ -261,6 +261,7 @@ rsgdb/
 ├── src/                     # Library + CLI
 ├── tests/                   # Integration tests
 ├── scripts/validate_local.sh
+├── scripts/deps_check.sh         # optional: duplicate deps, cargo audit, cargo outdated
 ├── scripts/e2e_gdb_smoke.sh      # gdbserver → rsgdb → gdb (batch); CI E2E job
 ├── scripts/e2e_zephyr_native_sim.sh  # optional: west build native_sim + multi-printf stepping test
 ├── scripts/e2e_rsp_regression.sh     # fast: codec + proxy integration only (no gdb)

scripts/deps_check.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Optional dependency hygiene: duplicates, security advisories, newer crate versions.
+# Install helpers once (add ~/.cargo/bin to PATH): cargo install cargo-audit cargo-outdated
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+echo "==> cargo tree -d (duplicate crate versions in the graph)"
+cargo tree -d
+
+echo ""
+echo "==> cargo audit (RustSec advisory DB against Cargo.lock)"
+cargo audit
+
+echo ""
+echo "==> cargo outdated --workspace"
+if cargo outdated --workspace 2>/dev/null; then
+  :
+else
+  echo "(Skipped — install cargo-outdated and ensure it is on PATH: cargo install cargo-outdated)"
+fi
+
+echo ""
+echo "==> OK — dependency checks finished."

src/lib.rs

@@ -8,7 +8,7 @@
 //! - **Proxy**: TCP RSP forward between GDB and a stub (OpenOCD, probe-rs, etc.)
 //! - **Recording / replay**: JSONL session capture and `replay` mock backend
 //! - **SVD**: Read-only peripheral/register (and field) labels for memory packets in logs
-//! - **Breakpoints / state / UI**: Lightweight modules and config for future work; proxy does not rewrite breakpoint RSP yet
+//! - **Scaffold** ([`scaffold`]): placeholder breakpoints / state / UI types; proxy does not rewrite breakpoint RSP yet
 //!
 //! ## Example
 //!
@@ -23,7 +23,6 @@
 //! ```
 
 pub mod backends;
-pub mod breakpoints;
 pub mod config;
 pub mod error;
 pub mod flash;
@@ -34,9 +33,13 @@ pub mod proxy;
 pub mod recorder;
 pub mod replay;
 pub mod rtos;
-pub mod state;
+pub mod scaffold;
 pub mod svd;
-pub mod ui;
+
+// Stable names for scaffold submodules (see `scaffold` module docs).
+pub use scaffold::breakpoints;
+pub use scaffold::state;
+pub use scaffold::ui;
 
 // Re-export commonly used types
 pub use config::{Config, FlashConfig, SvdConfig};

src/breakpoints/mod.rs src/scaffold/breakpoints.rssrc/breakpoints/mod.rs renamed to src/scaffold/breakpoints.rs

@@ -1,11 +1,7 @@
-//! Breakpoints module
+//! Breakpoints — scaffold types for future breakpoint management.
 //!
-//! Advanced breakpoint management with support for named, conditional,
-//! and grouped breakpoints.
-//!
-//! **Status — scaffold:** types and config exist; the TCP proxy does not run a breakpoint
-//! manager on the wire yet (RSP `Z`/`z` packets are forwarded unchanged). Safe to ignore unless
-//! you are extending this API.
+//! **Status:** The TCP proxy forwards RSP `Z`/`z` unchanged. Safe to ignore unless extending
+//! this API.
 
 /// Breakpoint type
 #[derive(Debug, Clone, PartialEq)]

src/scaffold/mod.rs

@@ -0,0 +1,9 @@
+//! Placeholder APIs not wired into the TCP proxy yet (breakpoints, session state, UI).
+//!
+//! These live under one module so the crate root stays focused on the shipped proxy, recorder,
+//! SVD, and RTOS paths. Submodules remain **`pub`** and are re-exported at the crate root for
+//! stability (`rsgdb::breakpoints`, `rsgdb::state`, `rsgdb::ui`).
+
+pub mod breakpoints;
+pub mod state;
+pub mod ui;

src/state/mod.rs src/scaffold/state.rssrc/state/mod.rs renamed to src/scaffold/state.rs

@@ -1,9 +1,6 @@
-//! State module
+//! Target/session state — scaffold for future tracking.
 //!
-//! State tracking and inspection for debugging sessions.
-//!
-//! **Status — scaffold:** not wired into the proxy; placeholder enum for future session/target
-//! state. Safe to ignore unless you are extending this API.
+//! **Status:** Not wired into the proxy. Safe to ignore unless extending this API.
 
 /// Represents the target state
 #[derive(Debug, Clone, PartialEq)]

src/ui/mod.rs src/scaffold/ui.rssrc/ui/mod.rs renamed to src/scaffold/ui.rs

@@ -1,9 +1,6 @@
-//! UI module
+//! UI — scaffold for future TUI / web frontends.
 //!
-//! User interface implementations (TUI, web).
-//!
-//! **Status — scaffold:** `UiConfig`-style placeholders only; no TUI/web server in the binary yet.
-//! Safe to ignore unless you are extending this API.
+//! **Status:** No TUI or web server in the binary. Safe to ignore unless extending this API.
 
 /// UI configuration
 #[derive(Debug, Clone)]