diff --git a/.gitmodules b/.gitmodules
index d3463ab..7da8aff 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,5 +1,9 @@
 # generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+# disposable DEN-2877 canary: this branch and PR must never be merged.
 [submodule "vendor/zed-clients"]
 	path = vendor/zed-clients
 	url = https://github.com/zed-pkg/zed-clients.git
 
+[submodule "vendor/java-lib"]
+	path = vendor/java-lib
+	url = https://github.com/zed-pkg-test/java-lib.git
diff --git a/.zpkg.toml b/.zpkg.toml
index 744dce6..fbb0b01 100644
--- a/.zpkg.toml
+++ b/.zpkg.toml
@@ -1,4 +1,5 @@
 # generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+# disposable DEN-2877 canary: this branch and PR must never be merged.
 [package]
 org = "zed-pkg-test"
 name = "java-app"
@@ -15,3 +16,4 @@ dir = ".vendor/.zed"
 
 [dependencies]
 "zed-pkg/zed-clients" = "^0.1.0"
+"zed-pkg-test/java-lib" = "^0.1.1"
diff --git a/canary/nightly-reconciliation-dependent.json b/canary/nightly-reconciliation-dependent.json
new file mode 100644
index 0000000..677626d
--- /dev/null
+++ b/canary/nightly-reconciliation-dependent.json
@@ -0,0 +1,16 @@
+{
+  "schema_version": "nightly-reconciliation-canary.v1",
+  "linear_issue": "DEN-2877",
+  "source_policy_pr": "ORESoftware/project-registry#44",
+  "scenario": "dependent-pr-references-open-dependency-pr-through-zed-and-gitlink",
+  "repository": "zed-pkg-test/java-app",
+  "base_sha": "59ea6f7473edfc6e8675fc7c2f7d7b0589611060",
+  "dependency_repository": "zed-pkg-test/java-lib",
+  "dependency_pull_request": 2,
+  "dependency_head_sha": "c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd",
+  "zed_requirement": "^0.1.1",
+  "gitlink_path": "vendor/java-lib",
+  "disposable": true,
+  "merge_forbidden": true,
+  "purpose": "Prove that the nightly reconciler discovers and re-evaluates a dependent PR when an open dependency PR changes, using both Zed metadata and an exact git submodule edge."
+}
diff --git a/source-pins.json b/source-pins.json
index d624485..4371dfd 100644
--- a/source-pins.json
+++ b/source-pins.json
@@ -1,5 +1,5 @@
 {
-  "generatedBy": "generated by zed-pkg-test/test-org-fleet",
+  "generatedBy": "generated by zed-pkg-test/test-org-fleet; disposable DEN-2877 canary",
   "sources": {
     "zed-pkg/zed-cli": {
       "branch": "main",
@@ -10,6 +10,13 @@
       "branch": "main",
       "sha": "c97ead9ce1cd3675be7704d35e2395fa59f4baa4",
       "exists": true
+    },
+    "zed-pkg-test/java-lib": {
+      "branch": "canary/den-2877-java-lib-dependency",
+      "sha": "c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd",
+      "exists": true,
+      "pullRequest": 2,
+      "mergeForbidden": true
     }
   }
 }
diff --git a/test-plan.json b/test-plan.json
index e9244f4..b7e3907 100644
--- a/test-plan.json
+++ b/test-plan.json
@@ -1,5 +1,5 @@
 {
-  "generatedBy": "generated by zed-pkg-test/test-org-fleet",
+  "generatedBy": "generated by zed-pkg-test/test-org-fleet; disposable DEN-2877 canary",
   "schemaVersion": 1,
   "sourceOrganization": "zed-pkg",
   "testOrganization": "zed-pkg-test",
@@ -9,7 +9,8 @@
   "focus": [
     "consumer install",
     "classpath wiring",
-    "offline frozen restore"
+    "offline frozen restore",
+    "nightly dependent reconciliation through Zed and gitlinks"
   ],
   "services": [],
   "matrix": {},
@@ -34,6 +35,13 @@
       "branch": "main",
       "sha": "c97ead9ce1cd3675be7704d35e2395fa59f4baa4",
       "visibility": "public"
+    },
+    {
+      "fullName": "zed-pkg-test/java-lib",
+      "exists": true,
+      "branch": "canary/den-2877-java-lib-dependency",
+      "sha": "c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd",
+      "visibility": "public"
     }
   ],
   "sourceGates": [],
@@ -51,6 +59,15 @@
       "source": "zed-pkg/zed-clients",
       "mode": "native-package",
       "manager": "maven"
+    },
+    {
+      "source": "zed-pkg-test/java-lib",
+      "mode": "git-submodule",
+      "path": "vendor/java-lib"
+    },
+    {
+      "source": "zed-pkg-test/java-lib",
+      "mode": "zed"
     }
   ],
   "security": {
@@ -58,5 +75,11 @@
     "pullRequestCredentials": false,
     "leastPrivilege": true,
     "redactSecretsAndRawMedia": true
+  },
+  "canary": {
+    "linearIssue": "DEN-2877",
+    "dependencyPullRequest": "zed-pkg-test/java-lib#2",
+    "mergeForbidden": true,
+    "disposable": true
   }
 }
diff --git a/vendor/java-lib b/vendor/java-lib
new file mode 160000
index 0000000..c9fa3cb
--- /dev/null
+++ b/vendor/java-lib
@@ -0,0 +1 @@
+Subproject commit c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd