[abewheel]

Completed vulnerability scans scoped to Components were rejected for System populations because completion matching only compared literal IDs. Resolve explicitly tested Components through their typed System memberships so existing, valid execution records can satisfy System baselines and obligation occurrences.

The shared matcher also preserves explicit System boundaries, requires Evidence naming both the Component and intended System for shared Components, and prevents proof fallback from widening explicit Component scope. System results do not automatically cover individual Components. Existing completion dates, reviews, results, Evidence checks, and population reconciliation remain required. No model migration or consumer record changes are needed.

Coordinated patch release: filegrc and create-filegrc 0.18.8.

Validation:

• Five independent combined correctness and security passes, ending clean.
• Focused scope and operating-preparation regressions: 19 passing.
• Node 24 complete local validation, package checks, and npm audit.
• Fresh generated consumer with the local package: 224 resources, zero errors or warnings.
• Local browser changed-path verification: existing Component scan accepted for its System baseline, with no JavaScript, console, or failed-request errors.