The controller now accesses /var/lib/mesh-broker-tls (mesh-controller #54) and the push refused whole: lavinmq declared the directory as an owned resource, and shared data is the operator's, owned by no module (ADR 0051). lavinmq only ever reads the certs — genesis laid them down — so it declares a read access like the controller does, and the directory belongs to nobody.