`systemctl is-active` exits non-zero for a unit that failed, so `must` threw before the assertion carrying every diagnostic — and the run said only "failed". The journal, the config, what the mesh wrote and resolv.conf are all things the next run should not have to be re-run to see.