The headless-mixed set was active although the site runs full headless. On
any request whose Accept header equals exactly 'application/json' it
re-imported the headless page configuration, and 'page < lib.headlessPage'
replaced the whole page object - dropping every field later sets had added:
mainNavigation, footerMenu, metaMenu, megaMenu, jsonLd. The header is not
part of the page cache key, so whichever request rendered first decided what
everyone got, which made it look like a concurrency race. Removing the set
restores the full 15-key payload for every Accept variant.
fix-asset-perms.sh only covered _assets, fileadmin/icons and the extension's
Resources/Public, so anything an importer wrote under public/fileadmin kept
the mount's permissions and returned 403 - most visibly the success-story
images in the megamenu. It now covers public/fileadmin as a whole.
Oliver Rasche
c90649fc1e