A run-once step leaves nothing to ask, and V4 asked anyway

V4's first run reported a working mesh as broken: it asserted that lavinmq's
run-once bootstrap container existed, and the host removes an exited run-once
container on purpose — so a later apply is not confused by a stopped one, keeping
the record that it ran in its own store instead.

So the check asserted the opposite of correct behaviour. The step had run; it is
why the broker came up configured.

Counted as unverified now rather than assumed good. What would verify a step is
the host's own record of having run it, and this walks the machine rather than
the host — so the honest answer is that this check says nothing about steps, and
it now says so.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

test/integration/one-node-mesh.test.ts

@@ -893,10 +893,16 @@ before(async () => {
         case "container": {
           const name = String(r["name"]);
           if (r["run-once"] === true || r["schedule"]) {
-            // Not expected to be running: it ran, or it runs later. What matters is that it exists
-            // and, if it ran, that it succeeded.
-            await check(`docker inspect ${quote(name)} >/dev/null 2>&1`,
-              `the container ${name} was never created`);
+            // **A run-once step leaves nothing to ask, deliberately.** The host removes the exited
+            // container so a later apply is not confused by a stopped one, and keeps the record
+            // that it ran in its own store instead. So asserting the container exists asserts the
+            // opposite of correct behaviour — which this did, and reported a working mesh as
+            // broken on its first run.
+            //
+            // A scheduled step is the same between fires. Both are counted as unverified here
+            // rather than assumed good: what would verify them is the host's own record, and this
+            // asks the machine rather than the host.
+            unchecked.push(`${kind} ${id} (a step leaves nothing running to ask)`);
           } else {
             await check(`docker ps --format '{{.Names}}' | grep -qx ${quote(name)}`,
               `the container ${name} is not running`);