A catalogue you derive now keeps a working check on its vendored `credbroker` code.catalogue init --preset self-hosted copied the vendored copy of that code but left its source behind, and the check that compares the two passed by finding nothing to compare. The copy was frozen: an edit to it went unreported, and catalogue self-host never produced the staged floor it is meant to write. Selecting the credential-brokers pack now brings the source across too, so the comparison is real again.
`--attribution white-label` no longer leaves the upstream catalogue's name in a file you commit. That mode promises no upstream trace, and the scan enforcing it allows the upstream name zero occurrences anywhere — but the scan runs before .agentbundle/self-host-state.json is written, so the name landed there unchecked. The file now records your own catalogue's name. --attribution attributed is unchanged and still records the upstream name.