nuget.org deprecation metadata: point 61 retired packages at their replacements #43

Sixty-one published ktsu.* packages carry deprecation metadata that is wrong, missing, or reaches
only the newest version. Retired packages should point consumers at their replacement, and one of
them currently points at a dead end.

This touches no repository. It is metadata on nuget.org, applied through the gallery's deprecation
API. Naming work is tracked separately in #36.

Blocked on nuget.org

Every call returns 403. Test-NuGetDeprecationAccess.ps1 shows the key authenticates and reaches
the gallery, so this is the gallery refusing this specific operation rather than an edge block.
IsManageDeprecationApiEnabled is off for the account. A request to enable it is with nuget.org
support, sent through the signed-in contact form at https://www.nuget.org/policies/Contact so the
form proves account ownership.

Push scope is never consulted on this path, so widening the key will not help.

Two traps when diagnosing this:

• Do not read the 403 body. You do not have permission to view this directory or page. is IIS's
  stock page. NuGetGallery returns its refusals through HttpStatusCodeWithBodyResult, which does
  not set TrySkipIisCustomErrors, so IIS overwrites genuine gallery messages here. Body text
  cannot tell you who refused you. Use Test-NuGetDeprecationAccess.ps1 instead, which probes
  verifykey and the real endpoint and compares the two.
• Deprecation state is not in the flat-container API. Read it from
  api.nuget.org/v3/registration5-gz-semver2/<lowercase-id>/index.json.

Tooling

Set-NuGetDeprecation.ps1 drives PUT https://www.nuget.org/api/v2/package/{id}/deprecations
across every version of a package. It previews by default and needs -Execute to send.
ktsu-deprecations.json holds the manifest, 61 packages in four groups, verified against nuget.org
on 20 August 2026. Full docs in the accompanying README.md.

Two rules the script enforces, both worth keeping:

• Listing state is never touched. listedVerb is always Unchanged.
• Any package whose alternate is unpublished is skipped. A dead hint is worse than no hint.

Run order

Once access is granted, run the groups in this order.

1. appdatastorage-repair, 1 package, undeprecate. Urgent, and tracked in ktsu.AppDataStorage: 155 published versions deprecate to a package that stopped at 1.0.7-pre.2 #41. 155 versions of
   the live ktsu.AppDataStorage point at ktsu.AppData, which stopped at 1.0.7-pre.2.
2. reapply-all-versions, 9 packages that are already deprecated on their latest version only.
   Re-applying across all versions is what makes the hint reach pinned consumers.
3. essentials-consolidation, 39 packages from the seven archived repos plus
   ktsu.PhysicalQuantity and ktsu.AppData, each with an unambiguous published successor. This is
   also what deprecates ktsu.AppData in the correct direction, so it pairs with step 1.

The fourth group, needs-a-decision, is disabled and tracked in #42.

Tasks

• nuget.org enables the deprecation API for the account
• Re-run Test-NuGetDeprecationAccess.ps1 and confirm a clean result before sending anything live
• Run appdatastorage-repair (ktsu.AppDataStorage: 155 published versions deprecate to a package that stopped at 1.0.7-pre.2 #41)
• Run reapply-all-versions
• Run essentials-consolidation
• Settle the 12 ambiguous mappings and enable the fourth group (Decide the 12 deprecation mappings that have no unambiguous successor #42)
• Give the scripts a home. They currently sit in C:\dev\ktsu-dev\scripts, tracked by no
  repository, so a stray delete loses them. Sdk/scripts/ is the natural place, since it
  already carries the org-wide PowerShell tooling.