Fix stale app.config binding redirects across the solution

[drmoisan]

Fix stale app.config binding redirects across the solution

Summary

• Corrects stale <bindingRedirect> newVersion/oldVersion entries in app.config across 9 first-party projects so each redirect matches the assembly version actually referenced by the project's own .csproj.
• Eliminates a live System.IO.FileLoadException: ... manifest definition does not match the assembly reference risk at runtime — not test-only, since these redirects govern assembly loading for the VSTO add-in itself.
• No production .cs files changed; the fix is a config-only correction plus a durable, test-covered audit/fix script.
• Adds a pytest suite for the new audit/fix script (94% line coverage) in response to a feature-review finding from the first review pass.
• Full MSTest suite (5468 tests) passes with 0 failures both before and after the fix; the specific defect this closes was already reproduced and fixed locally prior to this PR (see Verification).

Why

While remediating Dependabot NuGet PRs #343–#348, a prior remediation script (fix_reference_versions.ps1) corrected each project's <Reference Include="..."> Version= attribute to match the real assembly version read from the restored DLL, but never updated the sibling app.config <bindingRedirect> entry for the same assembly. An audit of main found 57 stale redirects across QuickFiler, QuickFiler.Test, Tags.Test, TaskMaster, TaskMaster.Test, TaskTree.Test, TaskVisualization.Test, ToDoModel.Test, UtilitiesCS, UtilitiesCS.Test, and VBFunctions.Test, spanning Microsoft.Bcl.TimeProvider, the Microsoft.Extensions.* family, Microsoft.Identity.Client(.Extensions.Msal), the Microsoft.IdentityModel.* family, System.ClientModel, System.IdentityModel.Tokens.Jwt, System.Collections.Immutable, System.Diagnostics.DiagnosticSource, System.Formats.Asn1, System.Memory.Data, System.Net.Http.WinHttpHandler, System.Reflection.Metadata, System.Security.Cryptography.ProtectedData, System.Text.Encoding.CodePages, System.Text.Encodings.Web, System.Text.Json, Microsoft.ApplicationInsights, and Microsoft.Web.WebView2.Core.

A mismatched redirect causes the CLR to redirect a dependent-assembly reference to a version number that doesn't correspond to the DLL physically present at the HintPath, throwing FileLoadException at load time. This was reproduced and confirmed with Microsoft.Bcl.TimeProvider in QuickFiler.Test: correcting the redirect from newVersion="10.0.0.7" to newVersion="10.0.0.10" took QfcHomeControllerMetricsTests + QfcStreamingDequeueConfidenceGateTests from 8 failing (of 21) to 0 failing.

What Changed

Core fix

• QuickFiler.Test/app.config, Tags.Test/app.config, TaskMaster.Test/app.config, TaskTree.Test/app.config, TaskVisualization.Test/app.config, ToDoModel.Test/app.config, UtilitiesCS/app.config, UtilitiesCS.Test/app.config, VBFunctions.Test/app.config — every <bindingRedirect> corrected to match the corresponding .csproj <Reference Version=...>.

Tooling

• docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/scripts/fix_binding_redirects.py — durable audit/fix script: parses each project's .csproj <Reference Include="{pid}, Version={ver}, ..."> entries as ground truth, finds the matching app.config <dependentAssembly> block by assembly name + publicKeyToken, and corrects oldVersion's upper bound and newVersion on mismatch. Idempotent (a second run reports zero changes).
• docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/tests/scripts/test_fix_binding_redirects.py — new pytest suite (94% line coverage) covering stale-redirect correction, idempotency on an already-correct redirect, and skip-without-error when a project's app.config/.csproj doesn't reference the target assembly.

Docs/process

• docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/ — issue, plan, remediation plan, policy-audit/code-review/feature-audit artifacts (both review passes), and evidence for every toolchain stage run during this fix.

Architecture / How It Fits Together

No architectural change. app.config <bindingRedirect> entries are read by the .NET Framework CLR at assembly-load time; this fix only corrects data values in those XML files so they agree with the assemblies each project's .csproj already declares it uses. The audit/fix script is a one-time-per-drift developer tool, not part of the shipped add-in.

Verification

Completed (from evidence in docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/evidence/):

• CSharpier format, .NET analyzer build, and nullable build all clean (0 errors) before and after the fix.
• Full MSTest suite via vstest.console.exe across all 8 first-party test assemblies: 5468/5468 passing, 0 failures, both pre-fix and post-fix (line coverage 71.05% → 71.08%).
• Audit/fix script re-run after applying fixes reports TOTAL: 0 (idempotency confirmed).
• git diff --name-only scope-lock check confirms zero .cs/.csproj files touched, only app.config.
• Remediation cycle: black, ruff, pyright clean on the new Python script and its test file; pytest --cov reports 8/8 tests passing, 94% line coverage.
• Two independent feature-review passes (initial + post-remediation re-audit) both completed; the second reports zero blocking findings.

Recommended (for reviewer, not run in this PR):

• gh pr checks against this PR's head SHA once CI completes.

Backward Compatibility / Migration Notes

None. This is a corrective change to redirect metadata only; no public API, schema, or behavior contract changes.

Risks and Mitigations

• Risk: A binding-redirect correction could theoretically mask a real version-compatibility problem if the "actual" .csproj reference version were itself wrong.
  Mitigation: The .csproj reference versions were independently established and verified during the Dependabot PR Bump the analyzers-dev-deps group with 3 updates #343–Bump Microsoft.Web.WebView2 from 1.0.3912.50 to 1.0.4078.44 #348 remediation (each cross-checked against the real restored DLL version via reflection), so this fix aligns redirects to already-verified ground truth rather than introducing a new assumption.
• Risk: Scope creep to unrelated projects.
  Mitigation: SVGControl/SVGControl.Test are intentionally excluded (pre-existing, conventionally vendored/exempt in this repo); one residual stale redirect there is documented as a non-blocking follow-up, not fixed in this PR.

Review Guide

Suggested order:

1. docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/issue.md — root cause and acceptance criteria (AC1–AC5).
2. The 9 app.config diffs — each is a small, mechanical bindingRedirect value change; spot-check one or two against the corresponding .csproj.
3. docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/scripts/fix_binding_redirects.py + its test file — the durable tooling and its coverage.
4. docs/features/active/2026-07-18-stale-app-config-binding-redirects-354/policy-audit.2026-07-18T16-00.md, code-review.2026-07-18T16-00.md, feature-audit.2026-07-18T16-00.md — the final, clean review pass.

The bulk of the diff (44 files) is process/evidence documentation under the feature folder and is not code review-relevant in the traditional sense — it exists to satisfy this repo's evidence-and-timestamp conventions.

Follow-ups

• Open a small follow-up issue for SVGControl/app.config's residual stale System.Runtime.CompilerServices.Unsafe redirect (6.0.2.0 vs. csproj's 6.0.3.0), or formally document why SVGControl/SVGControl.Test are exempt from binding-redirect audits the same way they're exempt from other build gates.
• Optional: add a short addendum to issue.md noting that the originally-reported 8-failing-test repro was not reproducible in this branch's actual baseline capture (that specific package's redirect already matched by the time this branch was cut) — the broader 57-redirect defect was real and is what this PR fixes.

GitHub Auto-close

• Closes Bug: stale-app-config-binding-redirects #354