# Catalog installed-relationship closure evidence

This evidence is bound to the Catalog source change in this downstream PR and
compares the exact `nexuscrm-controlplane` revisions:

- previous: `2178447f7e69f844d685ca688c8d9582067edb03`
- candidate: `7ae53e69acc235a69b255befb8d74d1eb62e50d6`

The one-commit range is
[`pingcap-inc/nexuscrm-controlplane#166`](https://github.com/pingcap-inc/nexuscrm-controlplane/pull/166).
It changes only `catalogreconcile/metadata.go` and its tests. The deployed
`cmd/catalog-reconcile` dependency closure is otherwise unchanged.

## Real failure and ownership decision

The signed D2A test2 run
[`29781057927`](https://github.com/pingcap-inc/nexuscrm-pingcap-pack/actions/runs/29781057927)
verified the release tuple, built the exact L2 metadata tree in isolated TiDB,
and created the complete 201-row query fixture. Catalog reconcile then rejected
an ordinary field-derived reference because its target object was not installed.

The field is valid source metadata and its stored root value remains a reference
identifier. It is not, however, a navigable Runtime relationship when the target
App/object is absent. Changing the L2 field type would have introduced an
unrelated schema migration and a second owner for the field fact.

The Catalog adapter now closes the navigable relationship graph over the
installed object set:

- an ordinary field-derived lookup to an absent target remains an opaque root
  identifier and is omitted from the graph;
- a lookup to an installed target remains in the query projection;
- explicit relationship rows, sharing-parent/master-detail edges, and malformed
  identities continue into the canonical compiler and fail closed.

No L2 metadata, field type, stored value, AppRelease, or Runtime query contract
is changed by this source pin.

## Exact verification and owner artifact

The exact PR head `f1d877ff626494e3fdd55ee0dfcb7047b4b763ab`
passed both standard and adversarial review with no blockers or suggestions.
The merge revision passed:

```text
go test ./catalogreconcile -count=1
go test -race ./catalogreconcile -count=1
go vet ./...
git diff --check
```

The exact-main owner publisher
[`29784892881`](https://github.com/pingcap-inc/nexuscrm-controlplane/actions/runs/29784892881)
validated the command, built the image, produced provenance and SBOM, signed it
with the Catalog owner's KMS key, independently verified it, and committed the
immutable source-SHA tag. The owner-signed image is:

```text
ghcr.io/pingcap-inc/nexuscrm-controlplane-catalog-reconcile@sha256:766d577a950a1afeb7e33873a04997890dc5df1e457dc5b62345d4c9f11a4d9c
```

This file is range evidence, not a second release authority. The desired BOM is
non-deployable; the existing resolved-BOM producer must resolve this exact
source tag and independently verify its owner signature before emitting the
deployable digest tuple.