Admin's second and final write path into the control plane. It creates instances and users and nothing else; inject still owns exactly three licence fields and is untouched. The owner's password hash is copied from the HQ account, not shared. The two diverge on the next password change, which is accepted: propagating a hash across two databases is worse than two passwords that started equal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>