Here's the reasoning behind the current behavior:
- If a user installs a package, it gets added to the package cache (regardless of where it came from: double-clicked from the desktop or downloaded from a repository)
- The package list gets populated from a combination of the repository and what's found in the cache.
Now, it might make sense to tweak this behavior, such that deprecated packages (as defined by a repository) are flushed from the cache. I think that this behavior would meet your needs and wouldn't have any negative side-effects (except that people who choose to actively install a deprecated package would need to download it again, since it wouldn't ever be cached).
Additionally, it might be helpful if unpublished packages (when we query the repo and we detect that it was in the repo previously but no longer in the repo) were flushed from the cache. This would be a little trickier, since we would have to catch the event at the time the package is unpublished (we would see the package is published and then it disappears from the repository's package list).
I'll pass the ideas along to the JKI team.