A grant writes a real control-plane user; the instance_members row is only admin's index of it, which is why a failed insert unwinds the projection. Self-hosted instances refuse all three mutations: their users live in a deployment we cannot see. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>