Written as an open question; it has an answer, and leaving it open would have made the fix look harder than it is.
The runtime every module compiles against cannot be built by the mesh, so the one rule that would catch it moving can never fire. And a container keeps the values it was created with, so two good applies can leave it running on neither.
jschoubben