Yeah, we can disucss that, but then again we need to track that and the dependency chain might be broken afterwards without us knowing.
I see the PackageStates transforming more and more into a cached merge of all composer.jsons. Problem is that we need quite some information from them during runtime and you don’t want to read all of them. Also with the current “best practice” of base respository + site package (or any other package) - which I still find no good idea - we need PackageStates to keep track of those packages that are actually there but not composer installed. (Think Bootstrap, Resources etc.)