Merge core vertical slice (2610231)

Foundation landed the same MAUI 11.0.0-preview.7.26426.4 bump this branch had taken
ahead of it, so both conflicts were this branch's temporary pin against foundation's
official one. Foundation's version is taken verbatim for both Directory.Packages.props
and eng/baselines.json - they own those files, and the branch now carries no delta in
either.

The gesture work built on that pin is unaffected: same package stamp, same public
Tap/Pointer APIs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Redth

Directory.Packages.props

@@ -12,14 +12,10 @@
 
   <ItemGroup Label="MAUI (neutral assemblies consumed from the published feed)">
     <!--
-      Pinned to eng/baselines.json > developmentPackageBaseline. Bumping this without
-      regenerating the API baselines will produce misleading diffs.
-
-      Moved from 26418.3 (nuspec commit 0b3bb76d2d) to 26426.4 (nuspec commit bedd1b18b7)
-      to pick up the public gesture dispatch APIs from dotnet/maui#37420 and #37671.
-      26418.3 predates both merges, so TapGestureRecognizer.SendTapped and the
-      PointerGestureRecognizer send members are internal there and an out-of-tree backend
-      cannot raise those gestures at all. Verified by reflecting over both packages.
+      Pinned to eng/baselines.json > developmentPackageBaseline: the first coherent
+      public-feed net11 MAUI package set, whose nuspec repository commits all resolve to
+      0b3bb76d2d (PR #36657). Bumping this without regenerating the API baselines will
+      produce misleading diffs.
     -->
     <PackageVersion Include="Microsoft.Maui.Core" Version="11.0.0-preview.7.26426.4" />
     <PackageVersion Include="Microsoft.Maui.Controls" Version="11.0.0-preview.7.26426.4" />
@@ -35,19 +31,21 @@
       DIFFERENT VERSION LINE FROM MAUI, deliberately.
 
       These are ASP.NET Core packages, not MAUI packages, and they do not share MAUI's
-      version stamp. There is no Microsoft.AspNetCore.Components.WebView at
-      11.0.0-preview.7.26426.4 - that version simply does not exist - and pinning it there
-      produced NU1102 for the whole BlazorWebView graph.
+      version stamp. Pinning them to it produced NU1102/NU1603 for the whole BlazorWebView
+      graph, because no ASP.NET Core package exists at a MAUI build number.
 
       11.0.0-preview.7.26381.103 is not a guess: it is what
-      Microsoft.AspNetCore.Components.WebView.Maui 11.0.0-preview.7.26426.4 declares in its
-      own nuspec, and it matches the SDK build we pin in global.json
-      (11.0.100-preview.7.26381.103), so the whole graph stays on one ASP.NET Core build.
+      Microsoft.AspNetCore.Components.WebView.Maui declares in its own nuspec, and it
+      matches the SDK build pinned in global.json (11.0.100-preview.7.26381.103), so the
+      whole graph stays on one ASP.NET Core build.
+
+      NOTE: this floor did NOT move when the MAUI baseline was bumped from
+      11.0.0-preview.7.26418.3 to 11.0.0-preview.7.26426.4 - the newer WebView.Maui nuspec
+      declares the same 26381.103 dependencies. Verify against the nuspec before changing
+      it; do not assume it tracks the MAUI stamp.
 
-      A higher version such as 11.0.0-rc.1.26378.118 also resolves, but it silently
-      upgrades the transitive dependency past what MAUI asked for and mixes rc.1 ASP.NET
-      Core bits with preview.7 MAUI bits. Matching the declared dependency is the coherent
-      choice.
+      A higher version resolves but silently upgrades past what MAUI asked for and mixes
+      version lines. Matching the declared dependency is the coherent choice.
 
       Verified by eng/tests/PackageGraphProbe.
     -->

PROVENANCE.md

@@ -18,7 +18,7 @@ import was being prepared. A branch name would have made the import unreproducib
 | `sourceBaseline` | `ee4d06cde6b49e297631b08426a33fb34f3152ef` | dotnet/maui `net11.0` @ 2026-08-18. The forward source baseline. |
 | `requiredAncestor` | `0b3bb76d2dd68d76b7c1302f43a76270d5949564` | PR [#36657](https://github.com/dotnet/maui/pull/36657), the Essentials/MainThread extensibility work. Minimum API floor. |
 | `behaviorBaseline` | `c1f4f7d879f6126029009902289efd6a4bb1bda9` | Tag `9.0.120`, the last published Tizen behaviour/API baseline. Retained here as tag `upstream/9.0.120`. |
-| `developmentPackageBaseline` | `11.0.0-preview.7.26418.3` | First coherent public-feed MAUI package set, from the [dnceng `dotnet11` feed](https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet11/nuget/v3/index.json). All key nuspec repository commits resolve to `0b3bb76d2d`. |
+| `developmentPackageBaseline` | `11.0.0-preview.7.26426.4` | Coherent public-feed MAUI package set, from the [dnceng `dotnet11` feed](https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet11/nuget/v3/index.json). All key nuspec repository commits resolve to `bedd1b18b7`. |
 
 Two details are easy to get wrong and are worth stating explicitly:
 

docs/migration.md

@@ -97,7 +97,7 @@ the few hours the initial import was prepared.
 | `sourceBaseline` | `ee4d06cde6` — dotnet/maui `net11.0` @ 2026-08-18 |
 | `requiredAncestor` | `0b3bb76d2d` — PR #36657, Essentials/MainThread extensibility |
 | `behaviorBaseline` | `c1f4f7d879` — tag `9.0.120`, last published Tizen release |
-| `developmentPackageBaseline` | `11.0.0-preview.7.26418.3` from the dnceng `dotnet11` feed |
+| `developmentPackageBaseline` | `11.0.0-preview.7.26426.4` from the dnceng `dotnet11` feed |
 
 Two traps worth repeating:
 

docs/net11-status.md

@@ -121,10 +121,15 @@ Foundation-owned; flagged rather than changed here.
 dotnet/maui#36657 (`0b3bb76d2d`) merged 2026-08-18. The newest .NET 11 MAUI build on nuget.org is
 `11.0.0-preview.7.26406.9`, which predates it.
 
-Resolved, not blocked: the repository consumes `11.0.0-preview.7.26418.3` from the `dotnet11` dnceng
+Resolved, not blocked: the repository consumes `11.0.0-preview.7.26426.4` from the `dotnet11` dnceng
 feed, pinned centrally in `Directory.Packages.props` and mapped in `nuget.config` via
-`packageSourceMapping`. The frozen source baseline (`ee4d06cde6`) is later than that package, so a
-newer coherent dev build can be dropped in without touching anything else.
+`packageSourceMapping`.
+
+Note that these packages are built from `bedd1b18b7`, which is 46 commits *ahead* of the frozen
+source baseline `ee4d06cde6` that the history import is pinned to. `eng/baselines.json` records the
+consequence in full: the gap is one-directional and applies to imported **source**, not to the
+assemblies this slice compiles against. Nothing in this backend depends on the three Tizen-touching
+commits in that gap.
 
 ### B5 - Runtime packs
 

eng/baselines.json

@@ -34,6 +34,7 @@
           "is also written down."
         ],
         "observedAgainst": "bedd1b18b7682193e05b47267509cec8c49c6853",
+        "$note": "bedd1b18b7 is also developmentPackageBaseline.nuspecRepositoryCommit, so the Microsoft.Maui.* packages this repository compiles against DO contain these three API additions while the imported source baseline does not. The gap therefore applies to imported source only.",
         "commits": [
           { "commit": "62418a4ec4", "pullRequest": 37420, "title": "Expose gesture recognizer dispatch APIs" },
           { "commit": "78502a5325", "pullRequest": 37671, "title": "Harden gesture recognizer dispatch API contracts" },
@@ -60,8 +61,26 @@
       "version": "11.0.0-preview.7.26426.4",
       "feed": "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet11/nuget/v3/index.json",
       "nuspecRepositoryCommit": "bedd1b18b7682193e05b47267509cec8c49c6853",
-      "role": "Public-feed MAUI package set for net11. Used when building against published MAUI packages rather than source.",
-      "note": "Moved from 11.0.0-preview.7.26418.3 (nuspec commit 0b3bb76d2d) to pick up the public gesture dispatch APIs from dotnet/maui#37420 and #37671. 26418.3 predates both merges, so TapGestureRecognizer.SendTapped and the PointerGestureRecognizer send members are internal there. LongPressGestureRecognizer.SendLongPressed/SendLongPressing remain internal even in 26426.4."
+      "role": "Coherent public-feed MAUI package set for net11. Used when building against published MAUI packages rather than source.",
+      "$comment": [
+        "IMPORTANT: this is a DIFFERENT commit from sourceBaseline, and deliberately so.",
+        "",
+        "  sourceBaseline               ee4d06cde6   what the history import is pinned to",
+        "  nuspecRepositoryCommit       bedd1b18b7   what these packages were built from",
+        "",
+        "bedd1b18b7 is 46 commits ahead of ee4d06cde6 and INCLUDES the three Tizen-touching",
+        "commits recorded in sourceBaseline.knownGapAfterThisPin (#37420, #37671, #37755).",
+        "",
+        "So the gap is one-directional and applies only to imported SOURCE, not to the",
+        "packages we compile against: the referenced Microsoft.Maui.* assemblies already",
+        "carry those three API additions, while the imported PublicAPI.Unshipped.txt",
+        "baseline does not. Anyone diffing our API baselines against these packages should",
+        "expect exactly that delta and should not read it as drift."
+      ],
+      "aspNetCoreDependencyFloor": {
+        "version": "11.0.0-preview.7.26381.103",
+        "note": "Declared by Microsoft.AspNetCore.Components.WebView.Maui's own nuspec at this package version, and unchanged by the MAUI bump. ASP.NET Core packages are on their own version line and must NOT be moved to the MAUI stamp - that version does not exist for them."
+      }
     },
     "provenancePullRequests": [
       { "number": 2360, "title": "Adds Tizen backend", "upstreamCommit": "438aef2e5d" },

tests/UnitTests/RepositoryInvariantTests.cs

@@ -188,6 +188,37 @@ public void ImportToolingIsPresent(string relativePath)
 		Assert.True(File.Exists(Path.Combine(RepoRoot, relativePath)), $"Missing: {relativePath}");
 	}
 
+	[Fact]
+	public void BaselinePinRecordsWhatItExcludes()
+	{
+		// A pin is only genuinely reproducible if what it EXCLUDES is written down too.
+		//
+		// sourceBaseline (ee4d06cde6) is 4 commits after requiredAncestor, none touching
+		// Tizen. But net11.0 continued past the pin, and three later commits do - all of
+		// them touching only src/Controls/src/Core/PublicAPI/net-tizen/PublicAPI.Unshipped.txt.
+		// So the Controls net-tizen Unshipped baseline sits three API additions behind
+		// current net11.0: relevant to API baseline diffing, not to source migration.
+		//
+		// This survived several review-fix rounds by luck rather than design. Whoever
+		// regenerates API baselines needs it, and it is the kind of prose that quietly
+		// disappears in a rebase, so it is pinned here.
+		var gap = ReadRepoJson("eng/baselines.json")
+			.GetProperty("source").GetProperty("sourceBaseline").GetProperty("knownGapAfterThisPin");
+
+		var commits = gap.GetProperty("commits").EnumerateArray().ToList();
+		Assert.Equal(3, commits.Count);
+
+		var pullRequests = commits.Select(c => c.GetProperty("pullRequest").GetInt32()).ToHashSet();
+		Assert.Equal(new HashSet<int> { 37420, 37671, 37755 }, pullRequests);
+
+		// The characterisation matters as much as the list: these are API surface
+		// declarations, not imported implementation. Losing that distinction would make
+		// the gap look like missing code.
+		var provenance = ReadRepoFile("PROVENANCE.md");
+		Assert.Contains("What the pin excludes", provenance);
+		Assert.Contains("PublicAPI.Unshipped.txt", provenance);
+	}
+
 	[Theory]
 	[InlineData("2360")]
 	[InlineData("9619")]
@@ -362,6 +393,56 @@ public void NoProjectTargetsBelowTheDotNetFloor()
 			$"These projects target below the .NET {floor} floor: " + string.Join(", ", offenders));
 	}
 
+	[Fact]
+	public void MauiPackageVersionsMatchTheDeclaredDevelopmentBaseline()
+	{
+		// Directory.Packages.props and eng/baselines.json both state which MAUI package set
+		// this repository builds against. They are edited at different times for different
+		// reasons, so they drift - and the symptom (API baselines generated against one
+		// version while the build consumes another) is slow and confusing to diagnose.
+		var baseline = ReadRepoJson("eng/baselines.json")
+			.GetProperty("source").GetProperty("developmentPackageBaseline")
+			.GetProperty("version").GetString();
+
+		var packages = ReadRepoFile("Directory.Packages.props");
+
+		var mismatched = Regex.Matches(packages, @"Include=""(Microsoft\.Maui\.[^""]+)"" Version=""([^""]+)""")
+			.Where(m => m.Groups[2].Value != baseline)
+			.Select(m => $"{m.Groups[1].Value}={m.Groups[2].Value}")
+			.ToList();
+
+		Assert.True(
+			mismatched.Count == 0,
+			$"These MAUI packages do not match developmentPackageBaseline ({baseline}): "
+				+ string.Join(", ", mismatched));
+	}
+
+	[Fact]
+	public void AspNetCoreFloorMatchesTheDeclaredDependencyFloor()
+	{
+		// The ASP.NET Core floor is declared by WebView.Maui's own nuspec and does NOT
+		// track the MAUI stamp - it stayed at 26381.103 across the MAUI bump from
+		// 26418.3 to 26426.4. Recorded in baselines.json so a future bump has something
+		// to check against rather than an assumption to make.
+		var floor = ReadRepoJson("eng/baselines.json")
+			.GetProperty("source").GetProperty("developmentPackageBaseline")
+			.GetProperty("aspNetCoreDependencyFloor").GetProperty("version").GetString();
+
+		var packages = ReadRepoFile("Directory.Packages.props");
+
+		foreach (Match m in Regex.Matches(packages, @"Include=""(Microsoft\.AspNetCore\.[^""]+|Microsoft\.JSInterop)"" Version=""([^""]+)"""))
+		{
+			// The .Maui bridge package IS a MAUI package and legitimately uses the MAUI stamp.
+			if (m.Groups[1].Value.EndsWith(".Maui", StringComparison.Ordinal))
+				continue;
+
+			Assert.True(
+				m.Groups[2].Value == floor,
+				$"{m.Groups[1].Value} is pinned to {m.Groups[2].Value} but the declared "
+					+ $"ASP.NET Core floor is {floor}.");
+		}
+	}
+
 	[Fact]
 	public void EveryProjectReferencedBySolutionExists()
 	{