# Current App Fact and Consumer Inventory

> **Status: A1a current-tree evidence, not an App contract.** This inventory is
> descriptive. It does not create `AppDefinition`, select the first CRM
> capability, evolve or retire `PackManifest`, or approve any target table,
> API, protobuf, or production behavior. C0 chooses the real consumer; A1b owns
> the App-domain decision.

> **A1b successor:** the normative decision is now
> [`app-authority-contract.md`](../../design/app-authority-contract.md). The
> `target-only` rows and A1b handoff language below remain pre-decision evidence,
> not a competing App contract.

> **P1x disposition:** this inventory captured the pre-cleanup compatibility
> tree. P1x subsequently deleted every release-shaped issue-tracker pack,
> dialect, frontend, distribution, install, and deploy consumer. Those entries
> are historical evidence only; they are not current App facts. The sealed
> selected-root conformance fixture is not an App-domain input.

The machine-readable companion is
[`app-fact-consumer-inventory.json`](app-fact-consumer-inventory.json). It is the
complete owner/writer/reader list and is checked by the `boundarygate` module
test.

## Evidence boundary

This inventory was derived from these exact revisions on 2026-07-13:

| Repository | Revision | Scope |
|---|---|---|
| `pingcap-inc/NexusCRM` | `41061972fa7796e1d763f9e1737bb500fd39f3b8` | L0 schema, persistence, startup, Runtime admission, backend composition, frontend host, and target design |
| `pingcap-inc/nexuscrm-controlplane` | `dbd2fbbbc920a9863772865f7e3ef8b6c4e51788` | neutral pack grammar, install/reapply/remove, verify, and runtime projections |
| `pingcap-inc/nexuscrm-app-packs` | `a84ba803073c90e279af21f35eeeadd12962cac4` | official CRM pack and L1 frontend source/contributions |
| `pingcap-inc/nexuscrm-contract` | `3784e01cb99ae97cf24bbc192aaa11db15282419` | real Runtime capability and delegation grammar only |

NexusCRM currently consumes `nexuscrm-controlplane v0.1.18` and
`nexuscrm-contract v0.1.5`
([`backend/go.mod:15-17`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/go.mod#L15-L17)).
The peeled release commits are controlplane
`394bd0b79b3b55fe31196c78d87e9f45e31f2e21` and contract
`3784e01cb99ae97cf24bbc192aaa11db15282419`. Every controlplane path cited by
this inventory is byte-identical between the consumed `v0.1.18` commit and the
audited main commit; the JSON records both the current repository revision and
the actual NexusCRM consumption pin.

The audit searched production and test Go/TypeScript/JSON trees for
`PackManifest`, `AppPackage`, `AppManifest`, `AppRelease`,
`AppInstallationID`, `_System_InstalledPack`, `_System_App`, capability
declarations, route ownership, handler bindings, and frontend app ownership.
It also searched all non-test Go call sites of `ActivateProjection` and
`IssueLease`. The latter methods exist, but their only current callers are
tests; no production Catalog/AppInstallation projection publisher was found.
That negative result is an ownership gap, not permission to invent a writer in
A1a.

## Executive ownership map

| Current fact | Author | Current sole owner/read path | State | A1b consequence |
|---|---|---|---|---|
| `PackManifest` payload | pack publisher (official CRM: L1 app-packs) | publisher owns product facts; controlplane owns neutral grammar/source resolution | authoritative source fact | Decide its target mapping only after C0; do not evolve it here. |
| Pack source identity | operator source + L1 accepted revision locks | controlplane persists resolved kind/URI/revision; product composition validates accepted revisions | transitional release fact | Map source revision/hash/version to `AppRelease`; do not assume equivalence. |
| `_System_InstalledPack` | controlplane lifecycle | one install/reapply/remove registry | authoritative current lifecycle | `PackInstallId` is a pack incarnation, not an approved `AppInstallationID`. |
| Installed-pack `Runtime*` columns | controlplane derivation | persisted startup input; process caches are derived | derived | P7/A1b must cut all consumers over before deletion. |
| Known-pack and active-app-pack projections | controlplane query, built at boot | host threads them to dialect/capability/composition gates | derived | They are pack liveness/source projections, not AppManifest. |
| `AppPackage`, `AppManifest`, `AppRelease` | target design only | no current implementation | target-only | A1b must define the minimum model; no current type is already authoritative. |
| `AppInstallationID` domain fact | target Catalog | no current authoring/persistence owner | target-only gap | Must exist before a real issuer/serving cutover; do not use `_System_App` or `PackInstallId`. |
| Runtime security binding | intended Catalog projection; Runtime serving copy | Runtime state/binding/lease tables and one admission read | transitional serving substrate | Keep as projection; add one upstream authority/publication path later. |
| Host requirements | L1 pack | pack requirement + L0 available primitive registry | authoritative compatibility facts | Requirements and provided primitives have different owners/directions. |
| Connector capabilities | connector pack | persisted declaration joined atomically to installed-pack liveness | authoritative Integration fact | Do not flatten into an ambiguous general App capability. |
| `ProductHooks` capabilities | compiled L1 distribution | binary declarations composed into process-local registries | transitional | Classify each fact in A1b; executable implementations may remain binary. |
| selected-root Runtime capability | neutral contract + Runtime | contract grammar, Runtime enforcement, security grant projection | authoritative RPC fact | It does not prove which CRM App capability/route C0 will select. |
| Flow action handler binding | L1 pack descriptor + L1 binary implementation | persisted descriptor joined to exact process implementation | transitional split binding | It is reusable evidence, not a generic HandlerBinding decision. |
| Route/dialect bindings | compiled L1 distribution/dialect | process-local callbacks/manifests, active-pack-gated by L0 | transitional | C0 must first identify a real route before A1b freezes a binding. |
| Frontend source/contributions | L1 frontend source + platform release locks | source manifest/hash supply, then process-local host registries | transitional | Map `FrontendManifestRef` and owner identity without merging frontend/backend locks by assumption. |
| `_System_App` | org metadata admins/metadata operations | mutable ApplicationNavigation/UI metadata read path | authoritative UI fact | Keep it UI/navigation-only; it is not product App authority. |

## 1. Pack authoring, source identity, and installed lifecycle

### Pack authoring authority

The neutral `PackManifest` grammar contains manifest format, pack name/category/
version, platform compatibility, dependencies, host requirements, and component
descriptors. Its `extensions` field is informational and deliberately excluded
from canonical hash/apply/verify behavior
([controlplane `pack_source.go:59-131`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/pack_source.go#L59-L131)).
The official CRM authoring artifact is the app-packs `salesforce-crm-standard`
manifest: it declares an `app-pack`, semantic version, platform range, host
requirements, and component list
([app-packs `pack.json:1-45`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/pack.json#L1-L45)).

This makes the source split explicit:

- L1 owns official CRM product facts and payload files.
- Controlplane owns generic manifest decoding, validation, apply, and verify.
- A1a does not decide whether the future AppManifest wraps, replaces, or
  evolves this artifact.

### Source identity

Controlplane accepts `official_repo` and `local_path`; it normalizes legacy
`in_repo` rows to `official_repo`, and a resolved source carries kind, URI,
revision, manifest bytes, and deterministic file references
([controlplane `pack_source.go:24-78`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/pack_source.go#L24-L78)).
Official sources resolve only through the configured official repository root;
there is no in-binary fallback
([controlplane `pack_source_load.go:47-109`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/pack_source_load.go#L47-L109)).

The current CRM binary also carries three kinds of release lock: a repo-wide
backend source-supply revision, a deliberately separate frontend source-supply
revision, and accepted per-product pack revisions
([NexusCRM `source.go:3-35`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/distributions/appsource/source.go#L3-L35)).
These locks are current compatibility mechanisms. They are not already one
immutable `AppRelease`.

### Installed-pack authority and lifecycle

`_System_InstalledPack` is the current authoritative install/convergence
registry. It stores pack identity/category/status/version, a fresh
`PackInstallId` for each install incarnation, source identity, desired/applied
hashes, host-requirement digest, runtime rebuild declarations, error/timestamp
state, and soft deletion
([NexusCRM `system_tables.json:904-944`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L904-L944)).
Controlplane owns the lifecycle values `installing`, `active`, `removing`, and
`failed`
([controlplane `installed_packs.go:23-26`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/installed_packs.go#L23-L26)).
Install mints the incarnation ID and writes the source/hash/declaration facts
([controlplane `installed_packs.go:98-157`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/installed_packs.go#L98-L157));
activation atomically updates the active hash/source/runtime declarations and
related dependency/projection state before commit
([controlplane `installed_packs.go:704-761`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/installed_packs.go#L704-L761)).

`PackInstallId` therefore names one pack-install incarnation. No current-tree
evidence binds it to target `AppID + AppRelease + authorized workloads +
capabilities`; A1b must not silently rename it `AppInstallationID`.

### Derived serving/startup projections

The installed row's `Runtime*` JSON columns are written only by explicit
install/apply convergence
([NexusCRM `system_tables.json:923-929`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L923-L929)).
Controlplane rebuilds process caches from those declarations and explicitly says
the caches are deterministic accelerators, not sources of truth
([controlplane `runtime_metadata.go:31-52`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/runtime_metadata.go#L31-L52)).

Two boot projections have distinct jobs:

- `KnownInstalledPackCatalog` is a three-state map: active, known inactive, or
  absent/unknown; it reads every non-deleted installed row and unions
  compile-time platform packs
  ([controlplane `runtime_metadata.go:346-392`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/runtime_metadata.go#L346-L392)).
- `ActiveInstalledAppPacks` projects active app-pack source/hash identity for
  distribution composition
  ([controlplane `runtime_metadata.go:395-442`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/runtime_metadata.go#L395-L442)).

NexusCRM constructs both once during startup
([NexusCRM `runtime.go:340-362`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/runtime.go#L340-L362)).
The known catalog gates dialect mounting; the active projection validates
product binary/source composition and is exposed only through the setup-gated
neutral platform inventory
([NexusCRM `routes.go:148-176`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/routes.go#L148-L176),
[NexusCRM `routes.go:213-220`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/routes.go#L213-L220)).

## 2. Target App concepts are not current facts

The target design says an `AppPackage` is mandatory and an `AppService` is
optional, then sketches `AppManifest` fields including AppID, immutable
AppRelease, publisher, protocol/engine requirements, dependencies, namespaces,
capabilities, and frontend manifest reference
([target architecture `:497-515`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/docs/design/nexuscrm-serviceification-target-architecture.md#L497-L515)).
It defines AppRelease as an immutable installed digest/version for dependency,
upgrade, rollback, and provenance
([target architecture `:632-635`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/docs/design/nexuscrm-serviceification-target-architecture.md#L632-L635)).

No `AppPackage`, `AppManifest`, or `AppRelease` implementation type, durable
row, writer, or serving reader exists in the inspected current revisions.
Current PackManifest, installed-pack, ProductHooks, frontend-source, and security
facts are inputs to A1b; none may be declared the target authority by naming
similarity alone.

## 3. AppInstallationID: target authority versus Runtime projection

The target Catalog binding is explicit:

```text
OrgID + AppInstallationID
-> AppID + AppRelease
-> AuthorizedWorkloadIdentities
-> GrantedCapabilities
-> OwnedNamespaces
```

It also says AppInstallation is an authorization/audience dimension, not the
identity of every shared record
([target architecture `:587-612`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/docs/design/nexuscrm-serviceification-target-architecture.md#L587-L612)).
That authoritative Catalog fact has no current implementation in the inspected
trees.

The Runtime side does exist. `_System_RuntimeSecurityBinding` is explicitly a
fenced projection of AppInstallation grants to canonical workloads, alongside
the Runtime security epoch and replica lease tables
([NexusCRM `system_tables.json:14311-14365`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L14311-L14365)).
`ActivateProjection` replaces the whole Org binding set and invalidates old
leases in one transaction
([NexusCRM `runtime_security_repository.go:83-147`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-persistence/runtime_security_repository.go#L83-L147));
`ReadAdmissionState` joins state, installation/workload binding, lease, and
revocation in one statement
([NexusCRM `runtime_security_repository.go:222-271`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-persistence/runtime_security_repository.go#L222-L271)).
Runtime rejects missing/inactive installations or absent capability before
session/Records execution
([NexusCRM `security_admission.go:238-274`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/internal/runtimeapi/security_admission.go#L238-L274)).

The signed delegation contains `AppInstallationID`, but its validation explicitly
does not consult authority
([contract `claims.go:37-62`](https://github.com/pingcap-inc/nexuscrm-contract/blob/3784e01cb99ae97cf24bbc192aaa11db15282419/pkg/runtime/delegationv1/claims.go#L37-L62)).
The verifier likewise requires Runtime to authorize the signed selector against
authoritative security state before trusted context is installed
([contract `token.go:75-89`](https://github.com/pingcap-inc/nexuscrm-contract/blob/3784e01cb99ae97cf24bbc192aaa11db15282419/pkg/runtime/delegationv1/token.go#L75-L89)).

The resulting current state is deliberately asymmetric:

- Runtime projection, persistence, and enforcement are implemented.
- The upstream Catalog/AppInstallation author and production projection
  publisher are absent.
- Claims are a signed carrier, not an alternate authority.

## 4. Capability declaration families

“Capability” currently names several non-equivalent facts. A1b must preserve
their owner and direction instead of merging them into one string bag.

### Required host primitives

The pack owns `hostRequirements`; the host owns the primitives it can provide.
The CRM pack currently requires one product dialect and four renderer
capabilities
([app-packs `pack.json:11-33`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/pack.json#L11-L33)).
The installed row stores a separate requirements digest so compatibility drift
can be checked without changing component payload identity
([NexusCRM `system_tables.json:920-929`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L920-L929)).

### Connector capabilities

Connector packs can author a closed v1 namespace/kind declaration. Controlplane
currently accepts only `signature_verifier` and `envelope_parser`
([controlplane `connector_capability_component.go:13-30`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/connector_capability_component.go#L13-L30)).
The apply hook writes `_System_ConnectorCapabilityDeclaration`
([controlplane `connector_capability_component.go:96-140`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/connector_capability_component.go#L96-L140)),
and the serving helper joins it to active, hash-converged installed-pack state in
one query
([controlplane `installed_pack_helpers.go:393-464`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/installed_pack_helpers.go#L393-L464)).

### ProductHooks capabilities

`ProductCapabilities` is a compiled, process-local L1 declaration surface for
host primitives, source revisions, routes, OAuth profiles, Flow handler
implementations, streaming mappings, and other host integrations
([NexusCRM `product.go:209-253`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/product.go#L209-L253)).
The CRM distribution supplies those declarations and binds them to its owning
pack
([NexusCRM CRM `product.go:174-235`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/distributions/crm/product.go#L174-L235)).
These are binary/runtime composition facts, not persisted AppManifest facts.

### Runtime RPC capability

The neutral contract defines
`runtime.records.read-selected-root.v1` and its semantic limits
([contract `recordsv1/types.go:5-29`](https://github.com/pingcap-inc/nexuscrm-contract/blob/3784e01cb99ae97cf24bbc192aaa11db15282419/pkg/runtime/recordsv1/types.go#L5-L29)).
Runtime admission requires that exact capability after signature verification
([NexusCRM `security_admission.go:350-364`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/internal/runtimeapi/security_admission.go#L350-L364)).
This is one coarse RPC authorization fact. It does not select the first CRM
route or freeze an App capability before C0.

## 5. HandlerBinding-like facts

No current `HandlerBinding` implementation exists. Two current patterns are
inputs to A1b.

### Flow actionCall: persisted descriptor plus binary implementation

`_System_FlowActionCallHandler` stores global action type, single owning pack,
opaque handler reference, and execution policies; ordinary writes are blocked
([NexusCRM `system_tables.json:12530-12557`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L12530-L12557)).
Controlplane reads the active descriptors
([controlplane `flow_action_call_handler_component.go:252-294`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/flow_action_call_handler_component.go#L252-L294))
and explicitly calls exact mirroring to the executor registry transitional
([controlplane `flow_action_call_handler_component.go:323-372`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/packs/flow_action_call_handler_component.go#L323-L372)).
At startup, serverruntime combines those descriptors with ProductHooks-supplied
implementations and registers the result
([NexusCRM `product.go:1583-1602`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/product.go#L1583-L1602)).

### Routes: compiled callback/manifests plus active-pack gate

`RuntimeRouteSurfaceRegistration` is a compiled name/register callback with
optional dialect route replacement and injected owning packs
([NexusCRM `product.go:62-85`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/product.go#L62-L85)).
The host mounts only registrations with an active owner and applies validated
dialect replacements
([NexusCRM `product_route_surfaces.go:39-105`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/product_route_surfaces.go#L39-L105)).
This is not durable binding metadata and cannot be generalized before C0 shows
which real route needs ownership transfer.

## 6. Frontend and navigation facts

### Frontend source and release locks

App-packs owns a source index mapping the real CRM frontend to its source
manifest. P1x removed the transitional issue-tracker entry and all corresponding
NexusCRM source locks/proofs; the sealed selected-root fixture has no frontend.
The CRM source manifest names its source roots, build descriptors, and exported
entrypoints
([app-packs `source-manifest.json:1-41`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/frontend/source-manifest.json#L1-L41)).
NexusCRM records distribution-only component hashes and says they are not
installable metadata
([NexusCRM `app-frontend-source-components.lock.json:1-27`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/frontend/app-frontend-source-components.lock.json#L1-L27)).

### Frontend process contribution

The CRM source contribution supplies an owner ID, routes, renderer IDs, setup
surfaces, navigation capabilities, and standard tabs
([app-packs `frontend-contribution.ts:80-132`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/frontend/src/frontend-contribution.ts#L80-L132)).
The host adapter registers those into process-local app/route/renderer/setup
registries and installs a fallback app-config owner
([app-packs `host-adapter.tsx:239-257`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/frontend/src/host-adapter.tsx#L239-L257)).
The generic frontend host rejects duplicate app IDs and explicit frontend owners
that have no registered runtime services
([NexusCRM `app-runtime.ts:114-149`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/frontend/src/host-sdk/app-runtime.ts#L114-L149)).

The frontend owner ID is a UI registry/routing identity. It is not target AppID
or AppInstallationID.

### `_System_App` is UI/navigation authority, not product App identity

`_System_App` is classified as `system_metadata`/`ui` and stores mutable label,
icon/color, `FrontendAppId`, navigation items, utility items, assigned profiles,
default state, and timestamps
([NexusCRM `system_tables.json:2305-2393`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-kernel/pkg/schemacatalog/system_tables.json#L2305-L2393)).
MetadataService exposes administrator create/update/delete and requires a
frontend owner on creation
([NexusCRM `metadata_apps.go:45-85`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-metadata/metadata_apps.go#L45-L85),
[NexusCRM `metadata_apps.go:88-160`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/nexuscrm-metadata/metadata_apps.go#L88-L160)).
ApplicationNavigation reads the rows and filters them by effective app/tab
visibility
([NexusCRM `application_navigation_contract.go:31-66`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/internal/application/services/application_navigation_contract.go#L31-L66)).
The CRM frontend consumes the Salesforce-shaped UI API and authors apps through
the Tooling-compatible surface
([app-packs `metadata.ts:17-63`](https://github.com/pingcap-inc/nexuscrm-app-packs/blob/a84ba803073c90e279af21f35eeeadd12962cac4/salesforce-crm-standard/frontend/src/platform/infrastructure/api/metadata.ts#L17-L63)).

It has no immutable release, installed product binding, workload authorization,
capability grant, source digest, or ownership contract. Its `Id`/`Name` therefore
cannot be reused as product App identity. The safe A1b relation is an explicit
mapping from product/frontend ownership into mutable navigation metadata, not a
reinterpretation of the table.

## 7. Current operation and reader paths

### Install and upgrade/reapply

`InstallPackFromSource` validates the source before acquiring the mutation lock;
`ReapplyPackFromSource` validates and serializes with full apply
([controlplane `source_pack_ops.go:53-76`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/source_pack_ops.go#L53-L76)).
The install path validates schema, source, category, dependencies, payload hash,
and ownership, applies the resolved pack, and optionally verifies it
([controlplane `source_pack_ops.go:174-235`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/source_pack_ops.go#L174-L235)).
There is no separate AppRelease upgrade state machine; reapply is the current
pack-level upgrade/convergence path.

### Verify

Readiness verify checks installed app packs from `_System_InstalledPack`; shallow
verify rebuilds from persisted runtime declarations, while deep/operator verify
resolves source-backed packs
([controlplane `verify.go:67-90`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/verify.go#L67-L90),
[controlplane `verify.go:154-182`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/verify.go#L154-L182),
[controlplane `verify.go:255-305`](https://github.com/pingcap-inc/nexuscrm-controlplane/blob/dbd2fbbbc920a9863772865f7e3ef8b6c4e51788/verify.go#L255-L305)).

### Startup and runtime

NexusCRM startup rebuilds persisted runtime metadata, then reads the known-pack
catalog and active-app-pack projection before constructing services
([NexusCRM `runtime.go:340-380`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/runtime.go#L340-L380)).
Route setup registers L1 dialects and lifecycle hooks, validates composition,
then mounts dialect routes through the one threaded pack catalog
([NexusCRM `routes.go:60-70`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/routes.go#L60-L70),
[NexusCRM `routes.go:148-176`](https://github.com/pingcap-inc/NexusCRM/blob/41061972fa7796e1d763f9e1737bb500fd39f3b8/backend/pkg/serverruntime/routes.go#L148-L176)).
Runtime security uses its independent AppInstallation grant projection before
constructing request-scoped `TrustedCall`; this is not currently connected to a
Catalog AppInstallation publisher.

## 8. Duplicate paths and unresolved ownership gaps

These are the concrete A1b inputs, not proposals from A1a:

1. **Missing App-domain authority.** `AppPackage`, `AppManifest`, `AppRelease`,
   and authoritative `AppInstallation` do not exist in current code or storage.
2. **Serving security without an upstream publisher.** Runtime has the correct
   projection/enforcement shape, but current production composition has no
   Catalog writer for `ActivateProjection`/`IssueLease`.
3. **Three release-lock families.** Backend source supply, frontend source
   supply, and accepted per-pack revisions overlap but have deliberately
   different release jobs. A1b must map them rather than delete one by name.
4. **Descriptor/implementation split.** Flow action handlers have durable L1
   descriptors and binary implementations with an explicit transitional parity
   guard. Route surfaces are still entirely binary/process-local.
5. **Frontend owner fallback.** `_System_App.FrontendAppId` is explicit UI
   ownership, while the CRM frontend still registers a fallback owner for
   legacy/admin rows. The fallback is migration residue, not App identity.
6. **Terminology collision.** `_System_App`, pack name, frontend app ID,
   `PackInstallId`, target AppID, and target AppInstallationID are six different
   current/target identifiers. No implicit equality is evidenced.
7. **P1x residue disposition.** Compiled issue-tracker pack, distribution, and
   frontend references were physically deleted. The sealed CI selected-root
   fixture remains outside the product-App authority map and A1a introduces no
   dependency on it.

## 9. A1b handoff

A1b can now decide one minimum App-domain contract without rediscovering the
tree. It must consume this inventory and C0, then state:

1. which exact real CRM capability/route needs App identity;
2. which current authoring fact maps to AppID and immutable AppRelease;
3. which owner publishes AppInstallation authority into the existing Runtime
   security projection;
4. which capability family is being referenced and why;
5. whether the first binding can reuse the descriptor/implementation split or
   needs a new neutral fact;
6. how frontend source/owner/navigation facts relate without reusing
   `_System_App` as product authority;
7. the old current read path deleted in the same ownership-flip unit.

A1b must still decide PackManifest evolution/retirement. This document does not
pre-approve that answer.