Daily notes on .NET, C#, EF Core, MAUI, Blazor, and Flutter - for developers who ship.

ACP (Agent Client Protocol, v1) connects an editor to a coding agent; MCP (spec 2026-07-28) connects an agent to tools. They sit on opposite sides of the agent and are used together: ACP's session/new even carries the MCP servers the agent should start. Here is the feature matrix, the wire flow, and a working agent and client checked against @agentclientprotocol/sdk 2.4.0.

AutoMapper 16.3.0 and 15.1.4 fix two high-severity advisories where deeply nested input bypassed MaxDepth and crashed the process with an uncatchable StackOverflowException. Here is which mapping paths were exposed and what changes when you upgrade.

Math.Round uses banker's rounding (MidpointRounding.ToEven) by default, so 2.5 rounds to 2 and 3.5 rounds to 4. How to get 'school' rounding with AwayFromZero, why Math.Round(2.675, 2) still gives 2.67, how .NET 11 changed Math.Round(double, digits) to round the exact binary value, and why ToString("F2") disagrees with decimal formatting. Verified on .NET 10.0.14 and .NET 11 RC3.

Since .NET Core, string.GetHashCode() is seeded with a random per-process value (Marvin hashing), so the same string hashes differently in every process. Why the runtime does it, which types are affected (HashCode.Combine, ValueTuple, records with string members), how Dictionary<string, T> quietly avoids the cost, and how to get a stable hash with XxHash3 or FNV-1a, verified on .NET 10.0.10.

Starting December 2, 2026, GitHub Actions blocks pull_request_target events in all public repositories unless an Actions event policy allows them. Brownouts hit on November 9 and 16. Here is how to find affected workflows and either migrate to pull_request or opt back in.

MXC is Microsoft's MIT-licensed SDK for running untrusted code, including model output, plugins and tools, under one deny-by-default policy that it maps to Seatbelt on macOS, bubblewrap on Linux and ProcessContainer on Windows. Here is what MXC SDK 1.0.1 and schema 1.0.0 actually define, how Copilot CLI hands it a policy per process, and what stays outside the box.

In Dart, identical(a, b) asks whether two references point to the same object, while a == b calls the left operand's operator == method, which falls back to Object.== (identity) unless the class overrides it. Null checks, const canonicalization, numbers, NaN, records, hashCode, and the places where the VM and dart2js disagree, verified on Dart 3.12.2.

ChainedPartitionedRateLimiter walks each limiter once, but the ASP.NET Core rate limiting middleware calls the chain twice when the first pass fails: AttemptAcquire, then AcquireAsync. With fixed window or token bucket limiters a rejected request burns two permits from the first limiter, and a queued request does too. Reproduced on ASP.NET Core 10.0.10 and 11.0 RC3, with a wrapper that makes the middleware walk the chain once.

A Dart Timer is a promise never to fire early, not a promise to fire on time. The VM truncates the Duration to whole milliseconds, adds one millisecond on purpose, and delivers the timer as an event that waits behind running code and every pending microtask. Measured lateness on Dart 3.12.2, periodic tick skipping, drift in chained delays, the 4 ms browser clamp, and the 30-day delay that fires instantly on the web.

On November 3, 2026 the .NET team showed agent skills shipping inside NuGet packages as skills/<name>/SKILL.md. Here is the layout, how restore exposes it through project.assets.json, the two tools that read it today, and what is still missing.