A push issues the memberships of the machines it told

sendTo — the path a roll-out, a rotation and a secret change take — issued memberships after its
sends (ADR 0160); the push command, which sends the same declarations through its own loop, did
not, so the one command operators run issued none. Said once in the same words after the sends.

cmd/mesh-controller/push.go

@@ -384,6 +384,15 @@ func pushCommand(ctx context.Context, args []string) error {
 	}
 	release()
 	fmt.Printf("\n%d node(s) told\n", len(sending))
+	// And each machine's memberships, as every other send does (ADR 0160): a push is the one most
+	// operators run, and on 2026-10-01 it was the one path that issued none.
+	var told []string
+	for _, s := range sending {
+		told = append(told, s.node)
+	}
+	if err := issueMemberships(ctx, open, server, told); err != nil {
+		return err
+	}
 
 	// **A named push leaves the mesh consistent, not just the machine it named** (novox/hq
 	// issue 057, ADR 0083). Assigning a cross-node consumer mints a provision, and the PROVIDER's