Its own package rather than a pass inside inject: inject writes three licence fields and nothing else, and that narrowness is what makes admin's reach into the control plane reviewable. Repairs by copying HQ's hash, not by re-hashing — two bcrypt hashes of one password differ by salt, so a re-hash would never converge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>