The lab said nothing was running while two machines were

'incus list' failed because this shell had no permission to reach the daemon,
incusOk returned null, and the caller wrote ?? "[]". So 'mesh-lab list'
printed 'no scenario instances standing' -- confidently, about a question it
had never managed to ask.

The comment on incusOk warns about exactly this, in those words: absence and
success made indistinguishable. Three of its own callers then did it. Two
listings and the live diagram, which would have drawn an empty scenario rather
than fail -- a picture that is confidently wrong, which is worse than none.

Anything enumerating what exists now goes through enumerate() and throws.
incusOk stays right where failure genuinely means no, like instanceExists,
and there is a test holding that line so this does not get over-corrected
until nothing can be asked at all.

Worth noting 'mesh-lab check' already diagnoses this precise cause, down to
'a session that predates it cannot see it'. The diagnosis existed; the
listing just never asked for it.

scenarios/first-node.yml

@@ -1,8 +1,10 @@
 # One machine, raising a substrate from the bundle its host carries.
 #
-# This is the bootstrap class (novox/hq ADR 0009): no forge, no control plane, no delivery. It
-# exists to develop the first three steps of raising a mesh — a container runtime, a store, and
-# a database inside it — which is as far as the bootstrap can go until a control plane exists.
+# This is the bootstrap class (novox/hq ADR 0009): no forge, no control plane to talk to, no
+# delivery. It exists to develop the steps of raising a mesh on a machine with no route out —
+# a container runtime, a store, the control plane's schema in it, and the broker.
+#
+# It stops before the control plane *runs*, because there is nothing for it to serve yet.
 scenario: first-node
 
 segments:
@@ -15,8 +17,13 @@ machines:
     at: { segment: hosting, address: [192.0.2.10] }
     inbound: allow
 
+# Placed into a registry the scenario raises, which is what a real node pulls from anyway. The
+# digests below are the ones that registry assigns, and that satisfies pinning: what is required
+# is a reference that is exact and cannot move (novox/hq ADR 0006).
 images:
   - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
 
 place:
   all: [host, runtime]