[rbuergi]

Core's Directory.Packages.props now pins only packages that some core project restores. 48 entries that no core project restores at any depth are deleted, along with MeshWeaver.Graph's Humanizer.Core reference, which nothing in that project calls.

How it was measured. I ran a full solution restore and read every project.assets.json. Of 146 pins, 67 have no direct reference:

• 12 of them appear in core's graph transitively (Azure.Core, System.ClientModel, OpenTelemetry.Api, …) and stay.
• 48 appear in no core project's graph, and they are deleted here.
• 8 more stay because core still pins part of their family: the four Orleans clustering and persistence packages, ModelContextProtocol and ModelContextProtocol.AspNetCore (core restores ModelContextProtocol.Core), Microsoft.Agents.AI and Microsoft.Extensions.AI.
• Not in this PR: the module-library shelf pins, which include Radzen.Blazor and leave with the shelf list, and Octokit, which leaves on the two conditions in GitHubSync.

Doc. CarvingProjectsOutOfCore gets a new section, "Package versions follow the projects": the rule, how to measure it, the family exception, and what is still pinned for Plugins and why.

Verified locally.

• The full solution restore is clean.
• MeshWeaver.Graph builds in Release with -warnaserror with 0 warnings and 0 errors, also after merging main.
• The Plugins hosts and test projects, built against this tree, are listed on the counterpart PR.

Pairs-with: Systemorph/MeshWeaver.Plugins#4297 — that PR adds these 48 pins to Plugins as fill-in entries; this PR stays in DRAFT until it has merged into Plugins main.

Satellite-pins: AspNet.Security.OAuth.Apple, Aspire.Azure.Npgsql, Aspire.Azure.Storage.Blobs, Aspire.Hosting, Aspire.Hosting.AppHost, Aspire.Hosting.Docker, Aspire.Hosting.Kubernetes, Aspire.Hosting.PostgreSQL, Aspire.Hosting.Azure.PostgreSQL, Aspire.Hosting.Azure.AppContainers, Aspire.Hosting.Azure.KeyVault, Aspire.Hosting.Orleans, Aspire.Npgsql, Azure.Provisioning.Storage, Azure.Storage.Blobs, Azure.Storage.Common, Microsoft.Azure.Cosmos, DocSharp.Markdown, Grpc.AspNetCore, Grpc.AspNetCore.Web, Grpc.Net.Client, HtmlAgilityPack, Azure.Extensions.AspNetCore.DataProtection.Blobs, Microsoft.AspNetCore.DataProtection, Microsoft.AspNetCore.SignalR.Client, Microsoft.Data.Sqlite, SQLitePCLRaw.lib.e_sqlite3, Microsoft.Extensions.Azure, Microsoft.Identity.Web, Microsoft.Identity.Web.Ui, MessagePack, Fido2, Serilog.AspNetCore, Serilog.Settings.Configuration, Serilog.Sinks.File, SkiaSharp, SkiaSharp.NativeAssets.Linux.NoDependencies, Svg.Skia, Microsoft.Diagnostics.Runtime, Npgsql, Pgvector, Snowflake.Data, Namotion.Reflection, Aspire.Hosting.Azure.Storage, Aspire.Azure.Data.Tables, UglyToad.PdfPig, NSubstitute, Humanizer.Core — I parsed every .csproj, .props and .targets in shallow clones of the default branches of MeshWeaver.Education, .Reinsurance, .SocialMedia, .Manufacturing, .Crm, .FundReporting, Memex and MeshWeaver.Deploy for a versionless PackageReference to any of these ids that the repository does not pin itself. The only hit is SkiaSharp in Reinsurance's legacy/Claims.Simulate. That repository's CI skips legacy/, and the project imports no central list. MeshWeaver.Plugins references 47 of the 48 versionless; #4297 pins all 48 there, and its hosts and the 14 affected test projects restore and build against this tree.

Refs #7205 (the same pattern for YamlDotNet).

🤖 Generated with Claude Code

[github-actions]

Test Results

    25 files  ±0      25 suites  ±0   55m 19s ⏱️ +18s
11 770 tests ±0  11 768 ✅ ±0  2 💤 ±0  0 ❌ ±0 
11 796 runs  ±0  11 794 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit 402dfb8. ± Comparison against base commit 93d883d.

This pull request removes 59 and adds 22 tests. Note that renamed tests count towards both.

   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "x". The address may reactivate (recycle / restart); retry to get the authoritative answer.
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
…

MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
 ---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.ArgumentException: Value does not fall within the expected range.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---

   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall wrapped as InnerException", fault: System.InvalidOperationException: outer
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "an aggregate of unrelated faults", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Value does not fall within the expected range.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a bare disposed object with no context — not prova"···, exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'MemoryStream'., kind: "Fault", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a cancellation whose timeout cause sits at aggrega"···, exception: System.OperationCanceledException: t
 ---> System.AggregateException: One or more errors occurred. (x) (The operation has timed out.)
 ---> System.InvalidOperationException: x
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.TimeoutException: The operation has timed out.<---

   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a driver wrapping a connect timeout", exception: MeshWeaver.Messaging.Hub.Test.FaultClassifierTest+FakeDbException (0x80004005): Failed to connect
 ---> System.TimeoutException: The operation has timed out., kind: "Transient", layer: "Store")
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a hub announcing its disposal", exception: MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "stream". The address may reactivate (recycle / restart); retry to get the authoritative answer.
Object name: 'node/a'., kind: "HubTeardown", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a mixed aggregate keeps the defect", exception: System.AggregateException: One or more errors occurred. (Success) (boom)
 ---> System.Net.Sockets.SocketException (0x80004005): Success
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
, kind: "Fault", layer: null)
…

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

The reduced package list violates the existing package-family guard’s pin-count and Aspire-presence assertions.

1 open issue

• Update package family guard checks for core and Plugins ownership · New

What changed in this PR

This PR removes package pins that core no longer restores, moving dependency ownership toward the repositories that consume them.

Changes:

• Deletes 48 central package pins while retaining shared-family and module-library entries.
• Removes Graph’s unused Humanizer.Core reference.
• Documents package ownership, restore-graph checks, and migration ordering.

File	Description
src/​MeshWeaver.Graph/​MeshWeaver.Graph.csproj	Removes the unused Humanizer dependency.
src/​MeshWeaver.Documentation/​Data/​Architecture/​CarvingProjectsOutOfCore.md	Documents pin ownership and migration checks.
Directory.Packages.props	Removes 48 package version entries no longer needed by core.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The reduced package list still violates the existing package-family guard’s pin-count and Aspire assertions.

No open issues 🎉

1 resolved since last review

• Update package family guard checks for core and Plugins ownership

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Safe deletion depends on the Plugins counterpart landing first, and its replacement dependencies and merged state remain unverified.

No open issues 🎉

_{Review effort: Balanced}