System.Text.Json 10.0

Apply the C# 14 baseline first. These rules cover System.Text.Json 10.0 contracts, input models, polymorphism, converters, naming, numeric handling, depth, DOM use, source generation, output, and diagnostics.

Strict input contracts

• Set JsonSerializerOptions.AllowDuplicateProperties=false at untrusted boundaries; its default is true, and divergent first-value versus last-value consumers can turn duplicate names into validation or signature bypasses.
• Set UnmappedMemberHandling=JsonUnmappedMemberHandling.Disallow or apply [JsonUnmappedMemberHandling(JsonUnmappedMemberHandling.Disallow)] where extra fields must fail; the default Skip silently ignores them.
• Review every [JsonExtensionData] property because it intentionally captures otherwise unmapped fields and can reintroduce overposting or ambiguous round trips.
• Deserialize into narrow request DTOs and keep tenant, owner, role, status, price, discriminator, and audit fields out of writable contracts.
• Mark required members with required or [JsonRequired], then perform semantic validation; presence does not make null, empty, out-of-range, or unauthorized values valid.

Constructor and naming behavior

• Set RespectRequiredConstructorParameters=true when non-optional constructor parameters must be present; it is false by default unless the application enables the corresponding feature switch or selects JsonSerializerDefaults.Strict.
• If enabling RespectNullableAnnotations, remember it checks only supported non-generic member annotations, not root values, generic collection elements, or