The server refused every membership the controller published after a push (2026-10-01, Permissions Violation for Publish to mesh.assignment.<node>.<module>): the controller's own grant named the control, node and JetStream subjects and not the assignments it alone issues (hq ADR 0160). Broker golden regenerated; one line differs.