The receipt claims the catalogue the beds read

A bed installs a catalogue module by reading its manifest from MESH_LAB_CATALOG at
run time, so a receipt naming no catalogue commit cannot say whether a catalogue
change was ever proven. Claimed under either spelling of the variable; not built,
because a manifest is read, not compiled (novox/hq 04-ISSUES/073).

src/repos.ts

@@ -10,7 +10,7 @@
  * pointed at is neither built nor claimed.
  */
 
-import { dirname } from "node:path";
+import { basename, dirname } from "node:path";
 
 export interface Repositories {
   /** Absolute path to the repository root, by name. */
@@ -24,5 +24,16 @@ export function repositories(env: NodeJS.ProcessEnv = process.env): Repositories
   if (host) found["mesh-host"] = dirname(host);
   const modules = env["MESH_LAB_MODULES"];
   if (modules) found["mesh-controller"] = dirname(dirname(modules));
+  // The catalogue is read, not built: a bed installs a module by reading its manifest from this
+  // checkout at run time (novox/hq 04-ISSUES/073). A receipt that did not name the catalogue's
+  // commit could not say whether a catalogue change had been proven — the beds used to carry
+  // their own copies of the manifests, and then it could not.
+  const catalogue = env["MESH_LAB_CATALOG"];
+  if (catalogue) found["mesh-catalog"] = catalogueRoot(catalogue);
   return found;
 }
+
+/** MESH_LAB_CATALOG is accepted under either spelling — the checkout, or its `modules` directory. */
+export function catalogueRoot(catalogue: string): string {
+  return basename(catalogue) === "modules" ? dirname(catalogue) : catalogue;
+}