VaultSync 1.8.7: Trust and Portability

[ATAC-Helicopter]

Summary

This is the single release PR for VaultSync 1.8.7, Trust and Portability, targeting Dev.

The branch currently includes:

• complete 1.8.6 closeout and permanent Dev branch protection;
• explicit 1.8.7 implementation, acceptance, safety, and release-gate contracts;
• the security-serviced .NET 10.0.11 runtime and coordinated package baseline;
• a canonical, checksummed release manifest consumed by release automation and the updater;
• durable installation identity, repository writer leases, explicit per-destination writer inspection, and fail-closed deferred metadata handling;
• shared-code and duplication cleanup across metadata, network, theme, and backup-filter paths;
• compact theme-aware Snapshot Explorer, metadata-import review, and updater windows;
• corrected, modernized built-in backup presets with one shared cross-platform resolver;
• deduplicated metadata-import previews when portable records and legacy folders represent the same content;
• serviced Microsoft.NET.Test.Sdk, xUnit analyzers, and the Visual Studio test runner from the combined Dependabot updates.

Current safety position

Cross-machine metadata remains intentionally conservative. Repository leases now prevent existing 1.8.7-aware writers from racing, but versioned three-way merge, durable conflict decisions, and mixed-version qualification remain release work.

Full-repository backup also remains gated by #296 / VS-1801. Source presets protect shareable Git control files but continue excluding live .git internals until consistency, credential, restore, and verification safeguards are implemented.

Validation

• Release build: 0 warnings, 0 errors
• Core/UI tests: 703 passed
• Preset safety tests: 40 passed
• Localization audit: no missing, extra, duplicate, blank, or placeholder-mismatched keys
• Release-script tests: 47 passed
• NuGet vulnerability audit: zero vulnerable direct or transitive packages in every release-branch project
• git diff --check: passed
• Sonar quality gate: passed with no unresolved new-code issues and the coverage threshold satisfied
• 1.8.6 release: published with 18 assets and no open milestone issues

Release work

Tracks #480, #481, #482, #483, #484, #485, #487, #541, #543, #545, #548.

Closes #549.
Closes #550.
Closes #554.
Closes #555.
Closes #556.
Closes #547.
Closes #557.
Closes #542.
Closes #558.
Closes #486.
Closes #545.

Completed repository-preparation defect: #544.

Target: 24 August 2026. Base branch: Dev.

Release cadence

Stable deadline: 24 August 2026. Minor releases target one week and must not exceed two weeks; non-blocking polish can roll forward, while P0 safety or security blockers cannot. Major releases follow the completed minor train and use explicit beta qualification.

Security servicing baseline

• SDK/runtime and coordinated Microsoft packages use the security-fixed .NET 10.0.11 baseline.
• Unused cross-platform RuntimeIdentifiers no longer cause ordinary restores and Dependabot to materialize unrelated runtime packs.
• CI audits a real self-contained publish and release outputs for win-x64, linux-x64, linux-arm64, osx-x64, and osx-arm64.
• Dependabot alerts on the default branch remain visible until this release work reaches Stable.
• Dependabot PRs Bump Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0 #551, Bump xunit.analyzers from 1.27.0 to 2.0.0 #552, and Bump xunit.runner.visualstudio from 3.1.5 to 4.0.0 #553 are incorporated together here and validated as one dependency set.

Recent UI and preset work

• BUG-18103 / BUG-18103: Modernize outdated utility windows and restore theme consistency #549 modernizes Snapshot Explorer, metadata-import review, and updater UI.
• BUG-18104 / BUG-18104: Correct stale preset exclusions and platform filter drift #550 corrects stale preset rules, unsupported VS Code negation, current generated-cache coverage, and Windows resolver drift.
• BUG-18105 / BUG-18105: Prevent metadata import preview from double-counting represented folders #554 prevents metadata-import preview from double-counting content represented in both portable metadata and legacy folders.
• BUG-18106 / BUG-18106: Normalize credential-free SMB mount diagnostics #555 normalizes macOS SMB diagnostics to remove the credential-bearing share identity before masking any remaining raw or escaped password text.
• BUG-18107 / BUG-18107: Export tombstones only for snapshots actually deleted during import #556 prevents metadata import from propagating tombstones for snapshots retained by local backups or absent from the local repository.
• BUG-18108 / BUG-18108: Stop repeated immutable updater manifest downloads #557 persists digest-verified canonical and platform updater manifests across restarts so scheduled checks do not repeatedly inflate GitHub JSON asset counters.
• BUG-18098 / BUG-18098: Preserve complete contracts when syncing roadmap issues #542 rebuilds roadmap synchronization around wrapped-contract fixtures, ownership-aware preservation, and a structured write-free dry run.
• BUG-18109 / BUG-18109: Bound disposable local storage and reject unbacked managed mounts #558 bounds disposable local storage and rejects unbacked managed macOS mount paths before backup folders are created.
• BUG-18101 / BUG-18101: Make cross-machine conflict resolution complete and durable #545 makes all portable project fields reviewable, keeps machine-local keys and unmatched destinations local, persists bounded resolution decisions, records project writers/revisions, and gates destructive tombstones behind manual review.
• VS-1877 / VS-1877: Add source-machine identity and repository writer safety #486 exposes the current repository writer per destination and requires a nonce-bound, evidence-preserving confirmation before stale takeover.
• VS-1880 / VS-1880: Simplify and standardize shared application code #548 records the reusable-filter work while the broader duplication effort remains open.

Relevant commits: e24b48a, e402742, 0ba5c30, 4ce0081, 13ed4d2, 0304ff6, 064f468, 9349e56, a2690be, 9f90a1c, 5b27351, b1ce7b6, 221a95e, f396ee6, bde641d, e86f86f, 911db42, 2acb090, 64c001e, and 173c4e9.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.7% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud