ADR 0052 (proposed) — an init step is a container run once to completion

A module can declare state but not a step that runs. mosquitto must seed its
dynsec admin into dynamic-security.json before the broker starts, or the plugin
aborts; the database providers need the same for first-boot migrations and
health gates (04-ISSUES/037). The old event-hook engine that did this was
powerful and flaky; this is the narrowest sound mechanism instead.

A run-once step is an ordinary container marked `run-once: true`: the host runs
it to completion, requires exit 0, and gates the apply on it — so what the
declaration places after it (the broker) starts only once it has finished.
Gating is by declaration order, not a resolved dependency (ADR 0005); the
completion marker is the recorded declaration digest (ADR 0018), so a re-apply
does not re-run it unless the declaration changed. No new host shape and no
arbitrary host command: strictly less powerful than an `action`.

Points 04-ISSUES/037 fixed-by/amended-design at the record; index regenerated;
records.py and index.py pass.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md

@@ -1,9 +1,9 @@
 ---
-status: open
+status: located
 opened: 2026-09-05
-located-in: []
-fixed-by:
-amended-design:
+located-in: [mesh-control, mesh-host, mesh-catalog]
+fixed-by: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
+amended-design: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
 ---
 
 # 037 — A module cannot run its own code at a lifecycle phase