# Evidence and technical references

## Review scope

Originally prepared 23 September 2026 from read-only references. Implementation and physical verification continued through 26 September 2026; chapters 30, 33 and 34 now record the authoritative runtime and device evidence. The original evidence list remains provenance for initial architectural choices.

## Local evidence

| Source | Observation | Design implication |
| --- | --- | --- |
| Existing workspace: Merchant_Terminal_Identity_Chain.html | Documents UIC MVC .NET 8, Claims/Session, gRPC, Dapper and SQL Server architecture | Preserve the layer pattern; independent TMS database proposed |
| Existing workspace: UIC_Connect_Device_Parameters_and_Telemetry_Proposal.html | Earlier merchant-module proposal for direct device configuration and telemetry | Background only; current requested bank module adds groups, remote control and app management |
| D:/Source/repos/TMS_Source/MQTT/TMSMQTT.csproj | net9.0; MQTTnet 4.3.7.1207; Dapper 2.1.35; SQL client | Source reuse requires runtime/dependency assessment |
| D:/Source/repos/TMS_Source/MQTT/Program.cs | Broker host plus polling/notification/housekeeping workers | Adapt responsibilities behind service/transport boundaries |
| D:/Source/repos/TMS_Source/MQTT/Services/MqttAuthorizationService.cs | Own-terminal topic checks plus global broadcast and internal service access | Add scoped identity/epoch checks; remove customer cross-fleet broadcast |
| D:/Source/repos/TMS_Source/MQTT/Models/MqttTopics.cs | Legacy terminal notify/status/cmd and parameter acknowledgement topics | Preserve through compatibility adapter where needed |
| D:/Source/repos/TMS_Source/MQTT/Data/TmsRepository.cs | Direct legacy SQL access for status, blocking, tasks and version information | Rewrite persistence integration through TMS.DataService |
| D:/Source/repos/TMS_Source/TMSRemoteControlServer/TMSRemoteControlServer.csproj | net9.0 Kestrel relay with Dapper dependency | Separate runtime process or source adaptation needed |
| D:/Source/repos/TMS_Source/TMSRemoteControlServer/README.md and Endpoints/ViewerWsHandler.cs | H.264 relay and static viewer API-key admission | Reuse streaming mechanics, replace admission model |
| Separate schema reference: schemaTypes.ts, SchemaEditorPage.tsx, SchemaPreviewPane.tsx | Catalog/tree schema, typed fields, layout, properties/preview and import comparison | Reimplement interaction concepts within MVC; independent contracts |

The separate reference solution's name and absolute path are intentionally excluded from the product documentation. It is a design reference only. Existing UIC compatibility is supported by the supplied architecture documents, not a completed audit of the entire merchant portal source repository.

## Browser evidence

Inspected the existing Edge tab at [UIC Connect demo](https://demo.uic-connect.com/Login), then the authenticated [Home](https://demo.uic-connect.com/), [Setup & Control](https://demo.uic-connect.com/DeviceManagement/SetupControl), [Status Monitor](https://demo.uic-connect.com/DeviceManagement/Statusmonitor) and [Tags](https://demo.uic-connect.com/DeviceManagement/Tag) pages. Review covered visible branding, navigation, filters and table structures. Device operations and data correctness were not tested. Documentation mockups use fictional data and do not reproduce account credentials or merchant records.

## Primary technical references

- [.NET support policy](https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core): runtime lifecycle decision; .NET 8/9 end support 10 November 2026.
- [ASP.NET Core gRPC service documentation](https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/grpc/aspnetcore.md): HTTP/2 and hosting requirements.
- [ASP.NET Core session management](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/app-state?view=aspnetcore-8.0): session is ephemeral/non-locking; distributed cache and Data Protection considerations.
- [Dapper](https://github.com/DapperLib/Dapper): SQL data access and result mapping; transaction/migration/tenant design remains application responsibility.
- [AWS IoT MQTT](https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.html): QoS, retained messages and protocol behavior.
- [AWS IoT Device Shadows](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html): optional desired/reported device-state facility.

## Confidence and unresolved validation

Required product capabilities come from the current request. Local implementation observations come from the specific files above. All new project structure, schema tables, RPC methods, SLOs, retention periods, permission roles beyond the two required administrator roles, and UI sketches are proposals. Broker high availability, source-code retargeting, terminal-agent behavior and production sizing remain unvalidated until implementation spikes and device tests.