Step 3 published mesh.stream.mesh-mail.event.mail.send.approved on the controller's connection, which the controller is never granted. Added the runtime module to the fixture's assigned set, gave mesh-mail its Streams so the carried-module path grants ownStreamGrants, minted the runtime's password through aMesh like the other principals, and publish over that connection with its own inbox prefix.