# Topic Tracker

<style>
table th,
table td {
	vertical-align: top;
}
</style>

Last updated: 2026-09-10

## Prioritised Topics to Be Actioned

| Priority | Topic | Date noted | Next step | Notes |
|---|---|---|---|---|
| P1 | Update vulnerable MailKit and MimeKit dependencies | 2026-09-10 | Select a patched compatible MailKit release, update the direct dependency, and rerun both target test suites plus downstream BusinessMgr validation. | Restore reports `NU1902` for MailKit 4.13.0 (`GHSA-9j88-vvj5-vhgr`) and its MimeKit 4.13.0 dependency (`GHSA-g7hc-96xr-gvvx`). Keep this security update distinct from the framework retargeting commit. |
| P2 | Resolve .NET 10 migration warnings in non-MAUI Common code | 2026-09-10 | Replace the obsolete `Rfc2898DeriveBytes` constructor, make the three `FileStream.Read` operations exact, and review removal of the redundant `Microsoft.Win32.Registry` package. | The .NET 10 build reports `SYSLIB0060`, three `CA2022` warnings, and `NU1510`. The cryptography change overlaps the existing encryption-hardening topic and requires compatibility tests. |
| P1 | Prevent synchronous and asynchronous execution from overlapping in `SaProcess_Base` | 2026-09-09 | Route `RunProcess()` and `RunAsync()` through one guarded start operation and extend the lifecycle tests. | A synchronous call can currently reuse and dispose the asynchronous worker's task data. |
| P2 | Retain cancellation as a completed process outcome | 2026-09-09 | Store a durable cancellation result until the next process reset and test post-completion state. | `IsInterrupted` currently loses token-based cancellation after task-data cleanup. |
| P2 | Handle `OperationCanceledException` as cancellation | 2026-09-09 | Catch cancellation separately in `RunProcess()` and avoid recording it as an error. | The general exception handler currently consumes cancellation before `RunAsync()` can distinguish it. |
| P2 | Observe background `RunAsync()` tasks in consumers | 2026-09-09 | Review downstream fire-and-forget call sites and give their process consoles ownership of the returned task. | Rebuilt consumers are binary-compatible, but some source call sites still discard the task. |
| P3 | Define disposal and cross-thread status semantics | 2026-09-09 | Decide whether to add asynchronous disposal and a synchronized process-status snapshot. | Disposal currently requests cancellation without awaiting termination; several status properties are read across threads. |

## Project-Specific Trackers

- [`SacsMobileMaui`](../SacsMobileMaui/docs/topics.md) tracks the MAUI framework upgrade, UI-thread helpers, native handlers, controls, and resources.

## .NET 10 Dependencies and Sequence

| Work item | Depends on | Unblocks |
|---|---|---|
| Commit documentation and tracking changes | None | A clean pre-migration baseline and focused migration history |
| Capture Common baseline | Documentation change separation; current SDK availability | Evidence for identifying migration regressions |
| Decide `SacsMobileXamarin` disposition | Confirmation of whether the legacy project is still consumed | Final Common solution and target-framework scope |
| Add the .NET 10 SDK pin and temporary Common targets | Common baseline; Xamarin scope decision | BusinessMgr retargeting and non-MAUI .NET 10 validation |
| Remove temporary .NET 8 Common targets | Completed migration of all in-scope downstream consumers | Final .NET 10-only Common state |

## In-Progress Topics

| Priority | Topic | Date noted | Date started | Next step | Notes |
|---|---|---|---|---|---|
| P1 | Review and harden `SaProcess_Base` lifecycle and cancellation | 2026-09-08 | 2026-09-08 | Address the prioritised Process Base findings above, beginning with prevention of mixed synchronous/asynchronous execution. | Task ownership, timeout retention, cancellation lock ordering, documentation, and initial lifecycle tests are complete. Cooperative polling in individual derived processes will be handled separately. |

## Completed Topics

| Topic | Date noted | Date started | Date completed | Outcome |
|---|---|---|---|---|
| Make asynchronous Process Base execution awaitable and retain state after a stop timeout | 2026-09-08 | 2026-09-08 | 2026-09-08 | `RunAsync()` returns `Task`; `StopProcessAsync()` reports success and leaves active state owned by a worker that has not stopped. |
| Remove cancellation callbacks from the Process Base lifecycle lock | 2026-09-08 | 2026-09-08 | 2026-09-08 | Cancellation and task-data disposal use separate synchronization; worker cleanup detaches state before disposal. |
| Add Process Base lifecycle tests | 2026-09-08 | 2026-09-08 | 2026-09-08 | Five focused MSTest cases cover completion, duplicate starts, stop timeout retention, cooperative cancellation, and cancellation callback lock behavior. |
| Capture the pre-migration Common build and test baseline | 2026-09-10 | 2026-09-10 | 2026-09-10 | Using SDK 10.0.401, `dotnet restore SaCommonVS.sln` and the full Debug solution build succeeded. The build produced 110 warnings and no errors; most are repeated MAUI API obsolescence warnings across four targets, plus `NETSDK1202` for out-of-support MAUI 9 Android and `NU1902` for the moderate-severity MailKit 4.13.0 vulnerability. `SacsCoreUnitTests` passed 94 of 94 tests. |
| Pin the Common .NET 10 SDK | 2026-09-10 | 2026-09-10 | 2026-09-10 | Added `global.json` for SDK 10.0.401 with `latestPatch` roll-forward and prerelease SDKs disabled. |
| Isolate `SacsMobileXamarin` from the supported Common build | 2026-09-10 | 2026-09-10 | 2026-09-10 | Removed the project from `SaCommonVS.sln` while retaining all source. Added `SaCommonVS.LegacyXamarin.sln` and `docs/legacy-xamarin.md` for reference-only access. The project is outside the supported .NET 10 migration scope. |
| Prepare Common libraries for the coordinated .NET 10 migration | 2026-09-10 | 2026-09-10 | 2026-09-10 | `SacsStandardBase`, `SacsStandardDbas`, `SacsStandardProc`, `SacsCoreWeb`, `SacsStandardAccounts`, and `SacsCoreUnitTests` now target `net8.0;net10.0`. The supported solution builds both targets with no errors; 94 of 94 tests pass on each target. BusinessMgr continues to build successfully on .NET 8 against the temporary compatible outputs. New .NET 10 warnings are tracked separately. |