chore: prepare 0.7.25 so hardened packages publish consistently

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to ConfigContraband will be documented in this file.
 
-## Unreleased
+## 0.7.25 - 2026-07-26
 
 - Replaced obsolete Roslyn workspace-failure and code-fix testing APIs with
   `RegisterWorkspaceFailedHandler` and `CodeActionEquivalenceKey`, then removed the two blanket
@@ -30,6 +30,21 @@ All notable changes to ConfigContraband will be documented in this file.
   before binding. Runtime order is preserved: a later empty container may overwrite an earlier
   value without invalidating the file. Matching paths across separate files and duplicate object
   members with disjoint leaves remain supported.
+- Extended the existing `CFG006`-`CFG008` content checks to sound direct `Get<T>()` targets and
+  inline-object `Bind(...)` calls, while retaining the framework-identity, provenance, side-effect,
+  strict-binding, and deduplication gates. Reordered named `OptionsBuilder.Bind(...)` arguments are
+  now resolved by parameter identity instead of source order.
+- Suppressed `CFG003` and `CFG004` automatic fixes when a later fluent call retargets the options
+  builder, so a fix is offered only when it can append validation to the builder that is actually
+  bound. Added document, project, and solution Fix All contracts for all five automatic-fix
+  families, including mixed CFG001/CFG009 suggestions and cross-document CFG005 edits.
+- Made schema registration extraction conservative when framework identity, the options type,
+  section argument, or invocation provenance cannot be proved; same-name lookalike APIs no longer
+  create bogus schema sections. The CLI now fails closed on incomplete workspace or project-load
+  analysis instead of writing a partial schema.
+- Strengthened the public-package path by installing and exercising the packed CLI across help,
+  generation, current, stale, and load-failure paths; binding the .NET 8 compiler-host smoke to the
+  exact candidate package; and enforcing the CFG001-CFG009 showcase contract during publication.
 
 ## 0.7.24 - 2026-07-25
 

README.md

@@ -46,7 +46,7 @@ Use it when your app relies on strongly typed options and you want configuration
 ## Install
 
 ```xml
-  <PackageReference Include="ConfigContraband" Version="0.7.24" PrivateAssets="all" />
+  <PackageReference Include="ConfigContraband" Version="0.7.25" PrivateAssets="all" />
 ```
 
 The package includes `buildTransitive` props that pass visible `appsettings.json` and `appsettings.*.json` files to the analyser automatically. Add the package, build, and let your editor or CI tell you when your options contract and configuration drift apart.

analyzer-health.md

@@ -3,8 +3,8 @@
 This file tracks the current ConfigContraband analyzer surface and the next hardening work that is still worth doing. It should stay practical: scores drive priority, notes describe shipped behavior, and gaps should be specific enough to turn into a focused PR.
 
 Last refreshed: 2026-07-26
-Package version: `0.7.24`
-Base audited commit: `a5a19bf`
+Package version: `0.7.25`
+Base audited commit: `c99d112`
 
 ## Scoring Rubric
 
@@ -497,7 +497,7 @@ CI and the publish workflow additionally run `scripts/verify-net8-analyzer-host.
 analyzer loads without `CS9057` and emits the expected `CFG001`, proving execution at the supported
 compiler-host floor before merge and publication.
 
-Last executed 2026-07-26 verifier status: 775 analyzer/fixer, 303 core, and 9 tool tests passed (1,087 total); all six offline coverage-policy scenarios passed; the CI-mode Release build (`ContinuousIntegrationBuild=true`) completed with zero warnings and zero errors after removing both `CS0618` suppressions; formatter verification passed; both `0.7.24` packages passed payload/version/README verification; Codecov's official endpoint validated the no-regression project and 100% patch policies; and `git diff --check` was clean on the iteration-139 branch. The showcase contract emitted exactly one each of CFG001-CFG009 and no unrelated warnings. The prior Roslyn analyzer-testing reference-assembly resolution failure remains resolved and is not an active release-readiness blocker.
+Last executed 2026-07-26 verifier status: 775 analyzer/fixer, 303 core, and 9 tool tests passed (1,087 total); all six offline coverage-policy scenarios passed; the CI-mode Release build (`ContinuousIntegrationBuild=true`) completed with zero warnings and zero errors after removing both `CS0618` suppressions; formatter verification passed; both `0.7.25` packages passed payload/version/README verification; Codecov's official endpoint validated the no-regression project and 100% patch policies; and `git diff --check` was clean on the release branch. The showcase contract emitted exactly one each of CFG001-CFG009 and no unrelated warnings. The prior Roslyn analyzer-testing reference-assembly resolution failure remains resolved and is not an active release-readiness blocker.
 
 Latest follow-up audit evidence on 2026-07-25 reported verification status `pass`, with both package projects and the public GitHub release at `0.7.23`, a Roslyn 4.8 compatibility floor on the shipped analyzer assemblies, and no score-math issue. Exact-HEAD CI, CodeQL, and publish workflows passed, including the .NET 8 analyzer-host smoke gate. That smoke script could not be replayed locally because only .NET 10 SDKs are installed, so the exact remote runs are the compatibility proof. Release Readiness remains `5`; rule severity and score math are otherwise unchanged.
 

src/ConfigContraband.Tool/ConfigContraband.Tool.csproj

@@ -16,7 +16,7 @@
     <PackAsTool>true</PackAsTool>
     <ToolCommandName>configcontraband</ToolCommandName>
     <PackageId>ConfigContraband.Tool</PackageId>
-    <Version>0.7.24</Version>
+    <Version>0.7.25</Version>
     <Authors>George Wall</Authors>
     <Title>ConfigContraband.Tool</Title>
     <Description>Generates appsettings.schema.json from your .NET Options types so editors give live autocomplete, type checking, and required-key hints while editing appsettings.json.</Description>

src/ConfigContraband/ConfigContraband.csproj

@@ -14,7 +14,7 @@
 
   <PropertyGroup>
     <PackageId>ConfigContraband</PackageId>
-    <Version>0.7.24</Version>
+    <Version>0.7.25</Version>
     <Authors>George Wall</Authors>
     <Title>ConfigContraband</Title>
     <Description>Stop smuggling broken appsettings into production. ConfigContraband is a Roslyn analyzer for .NET Options and configuration correctness.</Description>
@@ -25,7 +25,7 @@
     <RepositoryUrl>https://github.com/georgepwall1991/ConfigContraband</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageProjectUrl>https://github.com/georgepwall1991/ConfigContraband</PackageProjectUrl>
-    <PackageReleaseNotes>Precision release: CFG002 now recognizes non-null array initializer forms that already satisfy RequiredAttribute. CFG008 now follows ConfigurationBinder container semantics by suppressing loose collection/dictionary conversion failures that the runtime skips and reporting supported malformed elements only when strict binding rethrows. CI now enforces exactly one CFG001-CFG009 showcase diagnostic. No diagnostic IDs, severities, messages, or code fixes changed.</PackageReleaseNotes>
+    <PackageReleaseNotes>Reliability release: adds conservative CFG006-CFG008 analysis for direct Get&lt;T&gt;/Bind targets; supports reordered named Bind arguments; suppresses unsafe validation fixes after builder retargeting; aligns duplicate JSON-path handling with the runtime; makes CFG005 deterministic and cancellation-aware; hardens schema extraction and fail-closed CLI behavior; adds rule help links and Fix All contracts; and strengthens warning, coverage, showcase, packed-tool, and exact .NET 8 release gates. Diagnostic IDs and severities are unchanged.</PackageReleaseNotes>
     <DevelopmentDependency>true</DevelopmentDependency>
     <IncludeBuildOutput>false</IncludeBuildOutput>
     <SuppressDependenciesWhenPacking>true</SuppressDependenciesWhenPacking>

tests/Compatibility/Net8Consumer/Net8Consumer.csproj

@@ -8,7 +8,7 @@
     <!-- The top-level options type is intentional in this compiler-host smoke fixture. -->
     <NoWarn>$(NoWarn);CA1050</NoWarn>
     <WarningsAsErrors>$(WarningsAsErrors);CFG001;CS9057</WarningsAsErrors>
-    <ConfigContrabandVersion Condition="'$(ConfigContrabandVersion)' == ''">0.7.24</ConfigContrabandVersion>
+    <ConfigContrabandVersion Condition="'$(ConfigContrabandVersion)' == ''">0.7.25</ConfigContrabandVersion>
     <RestoreSources>$(MSBuildThisFileDirectory)../../../artifacts/packages;https://api.nuget.org/v3/index.json</RestoreSources>
   </PropertyGroup>
 

tests/ConfigContraband.Tests/AnalyzerInfrastructureTests.cs

@@ -236,7 +236,7 @@ public void Net8_host_verifier_loads_the_exact_packed_candidate()
         Assert.Contains(".nupkg.metadata", verifier, StringComparison.Ordinal);
         Assert.Contains("metadata.get(\"source\")", verifier, StringComparison.Ordinal);
         Assert.Contains(
-            "<ConfigContrabandVersion Condition=\"'$(ConfigContrabandVersion)' == ''\">0.7.24</ConfigContrabandVersion>",
+            "<ConfigContrabandVersion Condition=\"'$(ConfigContrabandVersion)' == ''\">0.7.25</ConfigContrabandVersion>",
             consumerProject,
             StringComparison.Ordinal);
         Assert.Contains(