The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.

It is a Tuesday in late September 2026. A maintainer publishes a fix for an actively exploited vulnerability in a base image your platform team maintains: company/base-runtime. Somewhere in a Slack ch