Push subscription updates are broadcast to every node, and the push manager only checked the role when loading subscriptions at startup. A node whose role turns push off still registered each updated subscription and sent its own copy, so a client was pushed once per node. Event::Update now checks the role as well as the shard. A node that loses its id lease (silent for over an hour, another host took the id) only logged the failed renewal and carried on minting snowflake ids as that node, which can collide with the new holder's. The node now claims a fresh id, re-points the id generator and logs cluster.node-id-reassigned. The registry's node id is atomic for that; the claim loop is shared by startup and the step-down.