18 CycloneDX 1.6 snapshots × 4 services × 18 months. Diff between snapshots: added / removed / bumped. The audit trail EO 14028 + NIST SSDF demand.