[rbuergi]

Delete half of moving the deployment sidecars out of core (core slimming). Core keeps what produces or seals its image set, or proves the set sound. Everything else under deploy/ that only a deployment consumes now lives in the public MeshWeaver.Deploy, at the same paths.

DRAFT on purpose. Release it only after the add half has merged and has published, and after the estate's vendored-chart check has been repointed (see "What blocks releasing this draft").

Pairs-with: Systemorph/MeshWeaver.Deploy#32
Pairs-with: Systemorph/MeshWeaver.Deploy#36
Pairs-with: Systemorph/Memex#860

(The pair gate only reads src/. This change removes YAML, Dockerfiles, Python, Bicep and docs, so the pairing is declared by hand. No public src/ type or member is removed.)

Verdict per directory

Path	Verdict	Why
deploy/ocr, deploy/ollama, deploy/whisper, deploy/s1-extract + {ocr,ollama,whisper,s1-extract}-image.yml	moved	These are service images an instance may run beside its portal. Each is a self-contained build context with no core source in it. Nothing in core's CI builds, runs or tests them, and their consumers are deployments: the estate vendors the charts, and an approved ApplyChart binds the immutable tag. #7184 put deploy/ocr in core only to sit beside whisper/s1-extract ("built the way deploy/whisper and deploy/s1-extract are"); it gave no core reason.
deploy/compose, deploy/compose-ha, deploy/aca, deploy/marketplace, deploy/.env.example	moved	Generated deployment targets. Their producer is MeshWeaver.Plugins' Memex.Deploy.AppHost (aspire publish -o deploy/…), and nothing in core reads them.
deploy/aks/README.md, SELF-UPDATE.md, INSTANCE-LIFECYCLE.md	moved	These are the AKS bring-up docs. The scripts and manifests they describe left with #7127, and they link ../helm and ../aca, which only resolve in Deploy.
deploy/base-images (+ base-image-acr.yml)	stays	portal-ai is the base image that main-cd.yml builds the product FROM. dotnet-test.yml holds CI's fonts and Playwright version to that Dockerfile.
deploy/core-tests	stays	This is the set's fifth image, mw-core-tests. main-cd.yml packs and pushes it, dotnet-test.yml self-tests core-tests.py, and .github/build-stages.json runs it.
deploy/{node,python,pandas}-gate	stays	Each is built from the REPOSITORY ROOT and packs core's own SDKs (clients/python, clients/typescript) plus the one canonical mesh.proto. Moving them would make another repository check core out at a ref just to build core's bytes. No workflow builds them.
deploy/CHANGE-PROPAGATION.md	stays	It is the cost model of core's own delivery and the bake tax, and Directory.Build.props cites it. It belongs in the doc tree rather than in deploy/; that is a follow-up, not a move.

What changes here so nothing goes unguarded

• release-channels.json. The four service-line writers (s1-extract-line, whisper-line, ocr-line, ollama-line) now carry "repo": "Systemorph/MeshWeaver.Deploy", the chore(operator): the hosting operator leaves core for MeshWeaver.Plugins (delete half) #7119 shape. check therefore does not look for the deleted workflows, and the pruners still protect the line tags. The self-test gains two expectations: all four writers name Deploy, and tesseract-5.5 and 0.33.2-qwen3.6-bge-m3 are still protected.
• acr-retention/instances.json. Core's four deploy/*/helm/values.yaml were the only files in this tree that match the overlay path filter. With them gone, the nightly --discover run would go red on core's own repositories entry ("declares … and no repository … carries a deployment overlay"), so the entry is removed. The Deploy entry's reason now names the service charts. lock-pinned-digests.py --self-test ARM 35 now asserts that this repository is declared exactly when its own tree carries an overlay file. Negative control: planting deploy/negctl/values.yaml turns the self-test red (exit 1) with that message.
• scripts/check-chart-freeze.py. Every moved path is now frozen delete-only, so a second publisher of those image names cannot grow back here. The self-test has 19 cases:
  • re-adding or editing a moved path is refused (5);
  • this PR's deletions pass;
  • what core keeps under deploy/ is not frozen.
• Docs.
  • CarvingProjectsOutOfCore → "Files" gets one row per verdict above, plus a new "The service images — the sidecar move" section on identity, tags, retention, the estate check and the freeze.
  • RepositoryDependencyDirection → "What is NOT an inverted edge" now covers a "repo" writer binding.
  • Repointed to Deploy:
    • OcrService, LocalModelService, CentralizedSpeech, VoiceModelDistribution (current-state sentences only; the dated history stays as evidence);
    • DocumentIngestionEndVision, DockerHubInCi, ReleaseEditions, DeploymentAKS, OnboardingNewEnvironment, MemexCloudDeployment;
    • InstanceIdentityAndSetup, ModelProviderSetup, Readme.md. Its deploy/helm and deploy/aks links had been dead since move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127.
  • Comments in main-cd.yml, clients/voice-gateway and MigrationWorkloadModelGuard are repointed too.
• .gitignore / .dockerignore. The rules for deploy/.env.example, the compose data and deploy/whisper/models/ move to Deploy's .gitignore.

Images and consumers

• Names stay the same. Registry repositories and line tags are unchanged, and every existing tag stays valid. Since the move, the per-build <line>-<sha7> names a MeshWeaver.Deploy commit.
• Core never dispatches. Deploy's lanes run on Deploy's own pushes, and no core job reads or waits on them (policy dependents-verify-on-their-side, PlatformReleaseNotifyGuard green).
• Live consumer: the estate's Vendored charts match core job. It checks out core's main and compares its whisper, s1-extract and ollama copies, so it would fail closed here. Memex#860 repoints it at Deploy.
• Text mentions only, nothing that reads core's tree. MeshWeaver.Plugins mentions these paths in src/MeshWeaver.Ocr (README, OcrOptions doc comment), src/Memex.LocalMesh/Program.cs, src/Memex.Deploy.AppHost/Program.cs ("committed in the platform repository") and Hosting/*.md. Those are a follow-up for Plugins.

Merge with main (#7306, resolved by intent)

#7306 moved clients/voice-gateway to MeshWeaver.Plugins.

• Its deletion of clients/voice-gateway/{Dockerfile,README.md} wins, so the comment repoints this PR made there are dropped.
• DockerHubInCi and VoiceModelDistribution now name both moves: the voice gateway in Plugins, and the service images and .gitignore rule in Deploy.

Verified locally (head 91f28c95d7, merged with origin/main)

(The figures below were re-run on that merge; see the update in the PR history.)

• MeshWeaver.Documentation.Test. Built with -c Release -warnaserror: 0 warnings, 0 errors. Run via the trx: 878 total, 878 passed, 0 failed. This includes DocumentationLinkIntegrityTest, PlatformReleaseNotifyGuard and MigrationWorkloadModelGuard.
• release-channels.py. --self-test passed with 0 failures; check . reports 13 labels, all consistent.
• lock-pinned-digests.py. --self-test exits 0, the planted-overlay negative control exits 1, and --check-registry-retention . exits 0.
• check-chart-freeze.py. --self-test holds 19/19, and --base origin/main reports no frozen path added or modified.
• Workflow guards:
  • check-workflow-timeouts: 111 jobs, 0 violations;
  • check-workflow-yaml-keys: 50 files, 0 violations;
  • check-pr-secret-preflight: 0 violations;
  • check-workflow-permission-pairing: 12 pairs, 0 violations;
  • check-workflow-shell: 0 live findings;
  • test-cd-steps.py: exit 0.

What blocks releasing this draft

1. ollama must be proven from Deploy. Deploy#32 merged as e4cfec672. Its first main runs proved three lanes, ocr, whisper and s1-extract: each pushed its immutable tag as Deploy's identity, and converge-line read the registry tag list and moved the line in round 1 (runs 40493629433, 40493629244, 40493629555).
   • ollama's run 40493629457 was cut at 45 min inside the ~24 GB push.
   • The fix is fix(ollama-image): upload the weights once, through a registry build cache; publish by reference MeshWeaver.Deploy#36: the weights go up once through a registry build cache, and the image is published by reference.
   • This draft stays a draft until a Deploy main run publishes ollama:<line>-<sha7> and the line converges onto it.
2. Memex#860 must merge after Deploy#32. Before Deploy#32 the job has nothing to compare against; after this PR, core has nothing either.
3. Until this lands, both repositories carry the lanes, and a core change under those paths would publish from here too. The freeze guards future edits only once this merges.

Not verified

• No push to the registry from either repository.
• The pinned-digest nightly --discover was not run here. Only the offline ARM 35 assertion covers the removal of the roster entry.
• That ApplyChart approvals or estate overlays need nothing new. They pin immutable tags that already exist, and none were enumerated live.

🤖 Generated with Claude Code

[github-actions]

Test Results

    25 files  ±0      25 suites  ±0   56m 39s ⏱️ + 1m 43s
11 963 tests ±0  11 961 ✅ ±0  2 💤 ±0  0 ❌ ±0 
11 989 runs  ±0  11 987 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit 91f28c9. ± Comparison against base commit 65c16ce.

This pull request removes 59 and adds 22 tests. Note that renamed tests count towards both.

   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "x". The address may reactivate (recycle / restart); retry to get the authoritative answer.
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
…

MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
 ---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.ArgumentException: Value does not fall within the expected range.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---

   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall wrapped as InnerException", fault: System.InvalidOperationException: outer
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "an aggregate of unrelated faults", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Value does not fall within the expected range.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a bare disposed object with no context — not prova"···, exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'MemoryStream'., kind: "Fault", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a cancellation whose timeout cause sits at aggrega"···, exception: System.OperationCanceledException: t
 ---> System.AggregateException: One or more errors occurred. (x) (The operation has timed out.)
 ---> System.InvalidOperationException: x
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.TimeoutException: The operation has timed out.<---

   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a driver wrapping a connect timeout", exception: MeshWeaver.Messaging.Hub.Test.FaultClassifierTest+FakeDbException (0x80004005): Failed to connect
 ---> System.TimeoutException: The operation has timed out., kind: "Transient", layer: "Store")
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a hub announcing its disposal", exception: MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "stream". The address may reactivate (recycle / restart); retry to get the authoritative answer.
Object name: 'node/a'., kind: "HubTeardown", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a mixed aggregate keeps the defect", exception: System.AggregateException: One or more errors occurred. (Success) (boom)
 ---> System.Net.Sockets.SocketException (0x80004005): Success
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
, kind: "Fault", layer: null)
…

♻️ This comment has been updated with latest results.

[Copilot]

🔵 Needs a closer look

The deletion requires human verification of cross-repository prerequisites because Deploy’s Ollama publication was skipped and the Memex#860 consumer-repoint change was unavailable for review.

No open issues 🎉

What changed in this PR

This is the delete half of moving deployment-only sidecars and generated deployment targets from core to MeshWeaver.Deploy. Core retains the recipes and tooling needed to build, seal, and validate its own image set.

Changes:

• Removes sidecar build contexts, charts, and deployment templates now owned by MeshWeaver.Deploy.
• Updates release-channel ownership, retention checks, and delete-only guards while preserving service-tag protection.
• Repoints documentation and comments to the new repository without changing runtime APIs.

File	Description
test/​MeshWeaver.Documentation.Test/​MigrationWorkloadModelGuard.cs	Repoints a documentation reference in a comment only.
src/​MeshWeaver.Documentation/​Data/​Architecture/​VoiceModelDistribution.md	Names Deploy as the Whisper build and ignore-rule owner.
src/​MeshWeaver.Documentation/​Data/​Architecture/​RepositoryDependencyDirection.md	Explains external release-channel writer declarations.
src/​MeshWeaver.Documentation/​Data/​Architecture/​ReleaseEditions.md	Attributes service-image publishing to Deploy.
src/​MeshWeaver.Documentation/​Data/​Architecture/​OnboardingNewEnvironment.md	Links to the relocated AKS guide.
src/​MeshWeaver.Documentation/​Data/​Architecture/​OcrService.md	Repoints OCR build, workflow, and chart references.
src/​MeshWeaver.Documentation/​Data/​Architecture/​MemexCloudDeployment.md	Links to Deploy’s AKS instructions.
src/​MeshWeaver.Documentation/​Data/​Architecture/​LocalModelService.md	Repoints Ollama build and chart ownership.
src/​MeshWeaver.Documentation/​Data/​Architecture/​InstanceIdentityAndSetup.md	Identifies Deploy as the Compose topology owner.
src/​MeshWeaver.Documentation/​Data/​Architecture/​DocumentIngestionEndVision.md	Updates local-service ownership in the implementation plan.
src/​MeshWeaver.Documentation/​Data/​Architecture/​DockerHubInCi.md	Distinguishes core and relocated image build contexts.
src/​MeshWeaver.Documentation/​Data/​Architecture/​DeploymentAKS.md	Repoints AKS documentation references.
src/​MeshWeaver.Documentation/​Data/​Architecture/​CentralizedSpeech.md	Names Deploy as the Whisper container owner.
src/​MeshWeaver.Documentation/​Data/​AI/​ModelProviderSetup.md	Repoints the deployment environment-template reference.
scripts/​check-chart-freeze.py	Freezes moved paths against reintroduction and adds cases.
Readme.md	Links production recipes and sidecars to Deploy.
deploy/​whisper/​README.md	Removes relocated Whisper instructions.
deploy/​whisper/​helm/​values.yaml	Removes relocated Whisper chart defaults.
deploy/​whisper/​helm/​templates/​service.yaml	Removes relocated Whisper Service template.
deploy/​whisper/​helm/​templates/​NOTES.txt	Removes relocated Whisper installation notes.
deploy/​whisper/​helm/​templates/​deployment.yaml	Removes relocated Whisper Deployment template.
deploy/​whisper/​helm/​templates/​_helpers.tpl	Removes relocated Whisper chart helpers.
deploy/​whisper/​helm/​Chart.yaml	Removes relocated Whisper chart metadata.
deploy/​whisper/​helm/​.helmignore	Removes relocated Whisper packaging exclusions.
deploy/​whisper/​docker-compose.yml	Removes relocated Whisper Compose recipe.
deploy/​s1-extract/​requirements.txt	Removes relocated extractor dependency pins.
deploy/​s1-extract/​README.md	Removes relocated extractor instructions.
deploy/​s1-extract/​helm/​values.yaml	Removes relocated extractor chart defaults.
deploy/​s1-extract/​helm/​templates/​serviceaccount.yaml	Removes relocated extractor authentication resources.
deploy/​s1-extract/​helm/​templates/​service.yaml	Removes relocated extractor Service template.
deploy/​s1-extract/​helm/​templates/​networkpolicy.yaml	Removes relocated extractor network policy.
deploy/​s1-extract/​helm/​templates/​deployment.yaml	Removes relocated extractor Deployment template.
deploy/​s1-extract/​helm/​templates/​_helpers.tpl	Removes relocated extractor chart helpers.
deploy/​s1-extract/​helm/​Chart.yaml	Removes relocated extractor chart metadata.
deploy/​s1-extract/​helm/​.helmignore	Removes relocated extractor packaging exclusions.
deploy/​s1-extract/​export_model.py	Removes relocated model-export tooling.
deploy/​s1-extract/​Dockerfile	Removes relocated extractor image recipe.
deploy/​s1-extract/​app/​test_server.py	Removes relocated extractor service tests.
deploy/​s1-extract/​app/​smoke_model.py	Removes relocated model-loading smoke test.
deploy/​s1-extract/​app/​auth.py	Removes relocated TokenReview authentication implementation.
deploy/​ollama/​README.md	Removes relocated Ollama instructions.
deploy/​ollama/​helm/​values.yaml	Removes relocated Ollama chart defaults.
deploy/​ollama/​helm/​templates/​tests/​smoke.yaml	Removes relocated in-cluster smoke-test template.
deploy/​ollama/​helm/​templates/​service.yaml	Removes relocated Ollama Service template.
deploy/​ollama/​helm/​templates/​networkpolicy.yaml	Removes relocated Ollama network policy.
deploy/​ollama/​helm/​templates/​deployment.yaml	Removes relocated Ollama Deployment template.
deploy/​ollama/​helm/​templates/​_helpers.tpl	Removes relocated Ollama chart helpers.
deploy/​ollama/​helm/​Chart.yaml	Removes relocated Ollama chart metadata.
deploy/​ollama/​Dockerfile	Removes relocated Ollama image recipe.
deploy/​ollama/​app/​entrypoint.sh	Removes relocated startup and model-preload script.
deploy/​ollama/​app/​bake.sh	Removes relocated model-baking script.
deploy/​ocr/​helm/​values.yaml	Removes relocated OCR chart defaults.
deploy/​ocr/​helm/​templates/​service.yaml	Removes relocated OCR Service template.
deploy/​ocr/​helm/​templates/​networkpolicy.yaml	Removes relocated OCR network policy.
deploy/​ocr/​helm/​templates/​deployment.yaml	Removes relocated OCR Deployment template.
deploy/​ocr/​helm/​templates/​_helpers.tpl	Removes relocated OCR chart helpers.
deploy/​ocr/​helm/​Chart.yaml	Removes relocated OCR chart metadata.
deploy/​ocr/​fixtures/​make_fixtures.py	Removes relocated OCR fixture generator.
deploy/​ocr/​Dockerfile	Removes relocated OCR image recipe.
deploy/​marketplace/​README.md	Removes relocated Marketplace packaging instructions.
deploy/​marketplace/​createUiDefinition.json	Removes relocated Marketplace wizard definition.
deploy/​compose/​docker-compose.yaml	Removes relocated single-node Compose topology.
deploy/​compose-ha/​docker-compose.yaml	Removes relocated high-availability Compose topology.
deploy/​aca/​memex-postgres/​memex-postgres.bicep	Removes relocated Postgres Container Apps template.
deploy/​aca/​memex-portal/​memex-portal.bicep	Removes relocated portal Container Apps template.
deploy/​aca/​memex-migration/​memex-migration.bicep	Removes relocated migration Container Apps template.
deploy/​aca/​memex-aca-acr/​memex-aca-acr.bicep	Removes relocated Azure registry template.
deploy/​aca/​main.bicep	Removes relocated Azure deployment entry point.
deploy/​.env.example	Removes relocated environment template.
.gitignore	Removes moved-path rules and clarifies retained recipes.
.github/​workflows/​main-cd.yml	Repoints AKS references in comments only.
.github/​scripts/​release-channels.py	Adds assertions for moved writers and protected tags.
.github/​scripts/​lock-pinned-digests.py	Checks core roster membership against overlay presence.
.github/​release-channels.json	Declares Deploy as the four service-image writers’ home.
.github/​acr-retention/​instances.json	Removes core’s overlay entry and updates Deploy’s scope.
.dockerignore	Removes the obsolete Compose data exclusion.

_{Review effort: Balanced}