@edgehero/pi-dispatch 2.1.0 → 3.0.0

package/src/up.mjs

@@ -8,8 +8,10 @@
  * Doctrine this module must never drift from:
  *   - init's never-clobber is contractual: up always calls runInit, and it always leaves existing
  *     files (and an existing WEBHOOK_SECRET value) untouched — see env-file.mjs.
- *   - up only ever pulls the repo's OWN default image (ghcr.io/edgehero/pi-job:latest, re-tagged
- *     pi-job:latest). NEVER a trigger-named run.image: those are operator-declared and doctor's
+ *   - up only ever pulls the image the worker will run as its deployment default, and only when it is
+ *     absent (issue #523): the repo's own ghcr.io/edgehero/pi-job:latest, re-tagged pi-job:latest, when
+ *     PI_JOB_IMAGE is unset, and otherwise exactly the image PI_JOB_IMAGE names, with no tag.
+ *     NEVER a trigger-named run.image: those are operator-declared and doctor's
  *     presence check covers them — a setup convenience must not become "pull whatever the triggers
  *     file happens to name" (the same reasoning as jobs running with --pull=never).
  *   - no secrets printed: the generated WEBHOOK_SECRET is announced, never echoed.
@@ -30,7 +32,7 @@
  */
 import { randomBytes } from "node:crypto";
 import { spawn as nodeSpawn } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { mkdirSync, readFileSync as readPackageFile } from "node:fs";
 import { connect as netConnect } from "node:net";
 import { lookup as dnsLookup } from "node:dns/promises";
@@ -39,21 +41,31 @@ import { dirname, join, posix, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PODMAN_BOOT_REFUSING_CAUSES, makePodmanInfoReader, decidePodmanJobUser, podmanJobUserRefusal } from "./backend-podman.mjs";
 import { venuesOf } from "./backends.mjs";
-import { logsDirPath, settingsFilePath } from "./config.mjs";
+import { jobImageFrom, logsDirPath, settingsFilePath } from "./config.mjs";
+import { jobImageFix, pullOffered, registryQualified } from "./image-ref.mjs";
 import { DEFAULT_EGRESS_PROXY, egressArmed as egressArmedFn, egressProxyName } from "./egress.mjs";
-import { envKeyIsBlank, envValueShown, readEnvAssignments, updateEnvFile } from "./env-file.mjs";
+import { ENV_WRITER_FS, ENV_VALUE_UNWRITABLE, envKeyIsBlank, envValueShown, readEnvAssignments, updateEnvFile } from "./env-file.mjs";
 import { COMPOSE_FILE, COMPOSE_VALKEY_OVERRIDE, OWNER_MARKER_KEY, VALKEY_PASSWORD_KEY, VALKEY_PORT_KEY, OWNER_CHECK_CONTAINER, OWNER_CHECK_EXEC, VALKEY_VOLUME_RECORD, adoptVolumeQuestion, composeArgs, ownerCheckAnswer, readVolumeRecord, valkeyOwnerCheckArgs, volumeRecordMatches, volumeRecordText, composeProjectName, foreignContainerSentence, foreignMarkerRefusal, foreignVolumeLabelRefusal, foreignVolumeRefusal, foreignVolumeUsers, isLoopbackHost, newValkeyPassword, unadoptedVolumeRefusal, valkeyContainerOwner, valkeyDockerRunArgs, valkeyPasswordDecision, valkeyPortEnvDecision, valkeyVolumeCreateArgs, valkeyVolumeOwner } from "./valkey-auth.mjs";
 import { deploymentValkeyEnv, deploymentVenueEnv } from "./deployment-venue.mjs";
+import { resolveServiceEnv, serviceEnvFileOf, serviceEnvLoader } from "./service-env.mjs";
 import { PACKAGED_EGRESS_PROXY_CONF, judgeProxyConfCopy, packageCopyName, readPackagedProxyConf, replaceProxyConfCopy } from "./egress-conf-copy.mjs";
-import { EGRESS_PROXY_IMAGE, PROXY_STATE_FORMAT, jobNetworksOf, parseProxyState, shippedProxyDrift } from "./egress-proxy-state.mjs";
-import { DEFAULT_VALKEY_PORT, NETNS_KEEPER, NETNS_KEEPER_FORMAT, QUADLET_FILES, STACK_KEYS, applyStack, decideValkey, describeRollBack, passwdNameFrom, readSubuidRanges, rollBackWrites, valkeySharedOn, VALKEY_SHARED_KEY, readValkeyKeys, valkeyTarget, judgeNetnsKeeper, keeperUnderRunningProxyHint, managerEnvRefusal, describeAction, foreignContainerRefusal, foreignContainers, lingerNote, planStack, readLinger, readStackKeys, stackComponents, unknownContainerRefusal, userBusRefusal } from "./podman-stack.mjs";
+import { EGRESS_PROXY_IMAGE, MODEL_ENDPOINTS_TARGET, PROXY_STATE_FORMAT, jobNetworksOf, parseProxyState, rulesIncludeEndpoints, shippedProxyDrift } from "./egress-proxy-state.mjs";
+import { endpointsDeclaredIn, rulesFileIncludes, rulesPredateEndpointsLine } from "./egress-cli.mjs";
+import { MODEL_ENDPOINTS_INCLUDE_NAME } from "./model-endpoints.mjs";
+import { DEFAULT_VALKEY_PORT, proxyConfCopyPath, NETNS_KEEPER, NETNS_KEEPER_FORMAT, QUADLET_FILES, STACK_KEYS, applyStack, decideValkey, describeRollBack, passwdNameFrom, readSubuidRanges, rollBackWrites, valkeySharedOn, VALKEY_SHARED_KEY, readValkeyKeys, valkeyTarget, judgeNetnsKeeper, keeperUnderRunningProxyHint, managerEnvRefusal, describeAction, foreignContainerRefusal, foreignContainers, lingerNote, planStack, readLinger, readStackKeys, stackComponents, unknownContainerRefusal, userBusRefusal } from "./podman-stack.mjs";
+
+/** This command's default fs seam: its own calls, and every call the `.env` writer makes (`ENV_WRITER_FS`, issue #522). */
+export const UP_FS = { existsSync, lstatSync, ...ENV_WRITER_FS };
 
 // The shipped Quadlet templates, module-relative like service.mjs's: worker/deploy in a checkout, <pkg>/deploy under npm.
 const TEMPLATES_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..", "deploy");
 
-// The one image up may ever fetch, and the local name jobs run under. Literal on purpose (not
-// env.PI_JOB_IMAGE): an operator who pointed PI_JOB_IMAGE elsewhere has outgrown the quickstart, and
-// up pulling an arbitrary configured name would break the only-our-own-image doctrine above.
+// The default image up fetches, and the local name jobs run under when PI_JOB_IMAGE is unset: the worker's own default
+// (`jobImageFrom`, `PI_JOB_IMAGE || "pi-job:latest"`) is a local-only tag with no registry behind it, so the re-tag is
+// what makes the pulled image the one the worker runs. It is load-bearing for that default ONLY. Issue #523: up used to
+// check and pull these two whatever PI_JOB_IMAGE said, so a deployment running ghcr.io/edgehero/pi-job:2.1.0, present
+// on the host, was handed a 3 GB pull of an image its worker never runs. An image PI_JOB_IMAGE names is now checked
+// under that name and, when absent, pulled under that name (`overrideImageStep`), and these two are never touched.
 const UPSTREAM_IMAGE = "ghcr.io/edgehero/pi-job:latest";
 const LOCAL_IMAGE = "pi-job:latest";
 const PULL_ARGS = ["pull", UPSTREAM_IMAGE];
@@ -74,8 +86,8 @@ const VALKEY_STOP_ARGS = ["stop", "pi-dispatch-valkey"];
 const VALKEY_RM_ARGS = ["rm", "pi-dispatch-valkey"];
 
 // deploy/docker-compose.yml's `egress` profile, reproduced as one docker run (REQ-EGRESS-ALLOWLIST):
-// same digest-pinned image, same two mounts, same explicit container name, same restart policy, on the
-// same upstream network. Written out here for the same reason VALKEY_RUN_ARGS is -- an operator who runs
+// same digest-pinned image, same three mounts, same host entry, same explicit container name, same restart
+// policy, on the same upstream network. Written out here for the same reason VALKEY_RUN_ARGS is -- an operator who runs
 // `up` and one who runs compose must end up with the same component, and two ways of starting one thing
 // is two places for it to drift.
 //
@@ -86,9 +98,13 @@ const EGRESS_NETWORK_ARGS = ["network", "create", "pi-dispatch-egress-out"];
 // the argv below (issue #453; the reasons are at step e2).
 const EGRESS_START_ARGS = ["start", "pi-dispatch-egress-proxy"];
 const EGRESS_UNPAUSE_ARGS = ["unpause", "pi-dispatch-egress-proxy"];
-const EGRESS_RM_ARGS = ["rm", "-f", "pi-dispatch-egress-proxy"];
+// `-v` (issue #503's review): a replaced proxy would otherwise leave the image's two anonymous squid volumes behind, one
+// pair per replace. They hold squid's logs and an unused cache, nothing a later proxy reads.
+const EGRESS_RM_ARGS = ["rm", "-f", "-v", "pi-dispatch-egress-proxy"];
 // Issue #484: how a running proxy reads refreshed rules (see the refresh step in `runUp` for why a restart).
 const EGRESS_RESTART_ARGS = ["restart", "pi-dispatch-egress-proxy"];
+// The deployment folder's files the shipped proxy mounts, each checked before a start or a recreate.
+const PROXY_FOLDER_FILES = Object.freeze(["egress-allowlist.conf", "deploy/egress-proxy.conf", MODEL_ENDPOINTS_INCLUDE_NAME]);
 const EGRESS_RUN_ARGS = [
 	"run",
 	"-d",
@@ -105,6 +121,15 @@ const EGRESS_RUN_ARGS = [
 	"./deploy/egress-proxy.conf:/etc/squid/squid.conf:ro,z",
 	"-v",
 	"./egress-allowlist.conf:/etc/pi-dispatch/allowlist.conf:ro,z",
+	// Issue #503: the declared model endpoints' rules, which the rules `include`. `init` scaffolds the file, and squid
+	// will not start without it. `egress render` rewrites it in place and prints the reload.
+	"-v",
+	`./${MODEL_ENDPOINTS_INCLUDE_NAME}:/etc/pi-dispatch/model-endpoints.conf:ro,z`,
+	// How the proxy reaches a model server on this host (issue #503): on Docker Engine the name does not exist without
+	// it, and host-gateway is the bridge gateway. Docker Desktop resolves the name already and host-gateway there is the
+	// same host address, so it is on both, as in the compose file. The PROXY only: no job gets it.
+	"--add-host",
+	"host.docker.internal:host-gateway",
 	EGRESS_PROXY_IMAGE,
 ];
 
@@ -137,7 +162,7 @@ export async function runUp(argv = [], deps = {}) {
 		// regular file. It calls it optionally, so leaving it out here made that repair dead code in the
 		// only production caller, and the test that covered it attached the method to its own fake.
 		// `lstatSync` for the rules refresh (issue #484), which follows no symlink.
-		fs = { existsSync, lstatSync, readFileSync, writeFileSync, renameSync, statSync, chmodSync, realpathSync, unlinkSync },
+		fs = UP_FS,
 		probeTcp = defaultProbeTcp,
 		// Issue #468: whether the Valkey on 127.0.0.1:6379 answers a client that sends NO password ("ok" when it does),
 		// through the project's one connection function. Real only where the TCP probe is: a test that stands in for the
@@ -238,6 +263,12 @@ export async function runUp(argv = [], deps = {}) {
 	else
 	out("pi-dispatch up — one pass over the quickstart; every docker action asks first (--yes accepts)\n\n");
 
+	// Issue #523: the image the worker will run as its deployment default, resolved as the worker resolves it, from where
+	// the service reads it. Both image steps below check (and offer to pull) this image and no other.
+	const jobImage = deploymentJobImage({ env, fs, envPath: join(cwd, ".env"), platform });
+	if (jobImage.skip) out(`⚠ ${jobImage.skip}\n`);
+	if (jobImage.note) out(`⚠ ${jobImage.note}\n`);
+
 	if (dockerUsed) {
 	// (a) docker binary + daemon, before anything is offered: every mutation below runs through the
 	// docker CLI, so with the daemon down the prompts would only collect consent for failures.
@@ -251,7 +282,9 @@ export async function runUp(argv = [], deps = {}) {
 	out("✓ Docker daemon reachable\n");
 
 	// (b) the default job image. Presence first, so the happy path re-run prompts for nothing.
-	if (await runCmd(spawn, "docker", ["image", "inspect", LOCAL_IMAGE]) === 0) {
+	if (jobImage.skip) summary.push(["job image", "not checked: which image the worker runs is unknown (see above)"]);
+	else if (!jobImage.isDefault) await overrideImageStep({ bin: "docker", jobImage, spawn, out, yes, prompt, summary });
+	else if (await runCmd(spawn, "docker", ["image", "inspect", LOCAL_IMAGE]) === 0) {
 		out(`✓ Job image present (${LOCAL_IMAGE})\n`);
 		summary.push(["job image", `already present (${LOCAL_IMAGE})`]);
 	} else {
@@ -292,7 +325,7 @@ export async function runUp(argv = [], deps = {}) {
 			out("  the docker steps above are unaffected; the podman steps below are skipped\n");
 		} else {
 			podmanReady = true;
-			await podmanImageStep({ spawn, out, yes, prompt, summary });
+			await podmanImageStep({ jobImage, spawn, out, yes, prompt, summary });
 		}
 	}
 
@@ -327,7 +360,9 @@ export async function runUp(argv = [], deps = {}) {
 	// `loadPauseWindows`/`loadScopedLimits` unconditionally at boot, which throw on a path that does not
 	// exist: the worker does not ignore the feature, it refuses to start. `PI_LOGS_DIR` and
 	// `PI_SETTINGS_FILE` use `||` and fall back to the account default; `WEBHOOK_SECRET` reads as absent.
-	const EMPTY_REFUSES_BOOT = new Set(["PI_PAUSE_WINDOWS_FILE", "PI_SCOPED_LIMITS_FILE"]);
+	// Issue #504 part B: PI_ENVELOPE_FILE refuses the boot on an empty value too, and joins this set ONLY: up never writes
+	// it (unset means no delegation, the safe default), so it is said below only when the operator's line is blank.
+	const EMPTY_REFUSES_BOOT = new Set(["PI_PAUSE_WINDOWS_FILE", "PI_SCOPED_LIMITS_FILE", "PI_PROJECTS_FILE", "PI_ENVELOPE_FILE"]);
 	const emptyNote = (key) =>
 		EMPTY_REFUSES_BOOT.has(key)
 			? `left untouched: the line is there and its value is EMPTY, which is not the same as no line -- a shell that sources this file exports it as "", the worker keeps it and REFUSES TO BOOT. up never clobbers a key an operator wrote, so fill it in or delete the line`
@@ -384,13 +419,13 @@ export async function runUp(argv = [], deps = {}) {
 		// `.env.example`). Same never-clobber discipline as WEBHOOK_SECRET, at key granularity: a value the
 		// operator set survives untouched.
 		//
-		// TWO get the deployment folder and TWO get the RESOLVED ACCOUNT DEFAULT, and the split is the
-		// sharpest edge in this change rather than an inconsistency. `pause-windows.json` and
-		// `scoped-limits.json` are scaffolded by `init` into this folder, and the panel defaults to this
-		// folder, so pointing the worker here is what makes the three agree. `PI_LOGS_DIR` and
+		// THREE get the deployment folder and TWO get the RESOLVED ACCOUNT DEFAULT, and the split is the
+		// sharpest edge in this change rather than an inconsistency. `pause-windows.json`,
+		// `scoped-limits.json` and (issue #499) `projects.json` are scaffolded by `init` into this folder, and the
+		// panel defaults to this folder, so pointing the worker here is what makes the three agree. `PI_LOGS_DIR` and
 		// `PI_SETTINGS_FILE` are different in kind: `makeLogReaper` unlinks EVERY `.log` and `.json` in
 		// `PI_LOGS_DIR` past the window with no name shape and no ownership check, so a deployment folder
-		// there would eat `triggers.json`, `pause-windows.json`, `scoped-limits.json` and
+		// there would eat `triggers.json`, `pause-windows.json`, `scoped-limits.json`, `projects.json` and
 		// `subscriptions.json` thirty days in, silently, and the worker would then run nothing while
 		// reporting success. `<deployment>/logs` is no better: `service.mjs` creates exactly that directory
 		// at install time and the plist puts `worker.out.log` in it. So these two get what
@@ -400,6 +435,7 @@ export async function runUp(argv = [], deps = {}) {
 		for (const [key, raw, durable] of [
 			["PI_PAUSE_WINDOWS_FILE", join(cwd, "pause-windows.json"), false],
 			["PI_SCOPED_LIMITS_FILE", join(cwd, "scoped-limits.json"), false],
+			["PI_PROJECTS_FILE", join(cwd, "projects.json"), false],
 			["PI_LOGS_DIR", logsDirPathFn(env), true],
 			["PI_SETTINGS_FILE", settingsFilePathFn(env), true],
 		]) {
@@ -416,8 +452,8 @@ export async function runUp(argv = [], deps = {}) {
 			//
 			// RELATIVE is the sharper of the two and it is not hypothetical: `PI_LOGS_DIR=.` resolves against
 			// the unit's `WorkingDirectory`, which IS the deployment folder, so the retention sweep then
-			// deletes `triggers.json`, `pause-windows.json`, `scoped-limits.json` and `subscriptions.json`
-			// thirty days in. All three deploy templates document this key as absolute for exactly that
+			// deletes `triggers.json`, `pause-windows.json`, `scoped-limits.json`, `projects.json` and
+			// `subscriptions.json` thirty days in. All three deploy templates document this key as absolute for exactly that
 			// reason. INSIDE THIS FOLDER is the same harm reached with an absolute path.
 			//
 			// The refusals live here and not in the resolver, because the resolver is right for the worker:
@@ -451,8 +487,13 @@ export async function runUp(argv = [], deps = {}) {
 			try {
 				({ changed } = updateEnvFile(envPath, key, value, { fs, platform }));
 			} catch (err) {
+				// Advice about THE VALUE only where the value is what was refused (issue #522). Every other refusal of the writer
+				// is about the file and ends in its own fix; this sentence once followed all of them, so a gid mismatch was told
+				// to move the deployment somewhere "without that character in its path". Where the value came from decides the
+				// advice: the two folder keys are this folder's own paths, the two durable ones the account default or this shell.
+				const valueAdvice = err?.code !== ENV_VALUE_UNWRITABLE ? "" : durable ? ". Set it by hand, to a path without that character" : ". Set it by hand, or move the deployment somewhere without that character in its path";
 				out(`✗ ${key} could not be written: ${err?.message}\n`);
-				summary.push([key, `NOT written: ${err?.message}. Set it by hand, or move the deployment somewhere without that character in its path`]);
+				summary.push([key, `NOT written: ${err?.message}${valueAdvice}`]);
 				continue;
 			}
 			if (changed) {
@@ -463,9 +504,11 @@ export async function runUp(argv = [], deps = {}) {
 				summary.push([key, writtenButEmpty(key) ? emptyNote(key) : "already set — left untouched"]);
 			}
 		}
+		// Never written, never defaulted: only a blank line the operator left is worth a word, since it refuses the boot.
+		if (writtenButEmpty("PI_ENVELOPE_FILE")) summary.push(["PI_ENVELOPE_FILE", emptyNote("PI_ENVELOPE_FILE")]);
 	} else {
 		summary.push(["WEBHOOK_SECRET", "no .env here — skipped (set it wherever your env lives)"]);
-		for (const key of ["PI_PAUSE_WINDOWS_FILE", "PI_SCOPED_LIMITS_FILE", "PI_LOGS_DIR", "PI_SETTINGS_FILE"]) {
+		for (const key of ["PI_PAUSE_WINDOWS_FILE", "PI_SCOPED_LIMITS_FILE", "PI_PROJECTS_FILE", "PI_LOGS_DIR", "PI_SETTINGS_FILE"]) {
 			summary.push([key, "no .env here — skipped (set it wherever your env lives)"]);
 		}
 	}
@@ -761,7 +804,36 @@ export async function runUp(argv = [], deps = {}) {
 	// (e1b) the folder's copy of the proxy's rules (issue #484), before the proxy step so that a proxy started, replaced
 	// or restarted below reads the refreshed file. Only where the shipped docker proxy mounts it: a proxy PI_EGRESS_PROXY
 	// names is the operator's, and the podman venue mounts an account-owned copy `service install` writes.
-	const confRefreshed = dockerUsed && egressArmedFn(venueEnv) && proxyName === DEFAULT_EGRESS_PROXY ? await proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackagedConf, now, yes }) : false;
+	//
+	// Issue #503's governing rule: the folder's rules include model-endpoints.conf only together with a proxy that mounts
+	// it. So when the refresh brings the include and a proxy without the third mount exists, the refresh and that proxy's
+	// replacement are ONE step, asked once (`coupled` below): declined, or not possible, nothing is written; a replace that
+	// fails puts the old rules back. Otherwise the proxy's next restart would exit on the missing include (measured).
+	const coupled = {
+		// The proxy as it is now, read only when a refresh is about to be offered.
+		inspect: async () => {
+			const inspect = await runCmdQuery(spawn, "docker", ["inspect", PROXY_STATE_FORMAT, DEFAULT_EGRESS_PROXY]);
+			return inspect.code === 0 ? parseProxyState(inspect.stdout) : null;
+		},
+		// Why the replace could not happen from here, or null: a file the run mounts is missing, or a mount of it cannot
+		// be compared on this host while nothing else shows it stale (up never removes a proxy on that ground alone).
+		blocked: (state) => {
+			const missing = PROXY_FOLDER_FILES.find((f) => f !== "deploy/egress-proxy.conf" && (!fs.existsSync(join(cwd, f)) || pathIsDirectory(fs, join(cwd, f))));
+			if (missing) return `${missing} is not a file in this folder, so the proxy could not be started with it`;
+			const judged = shippedProxyDrift(state, { cwd, platform, realpath: (p) => (typeof fs.realpathSync === "function" ? fs.realpathSync(p) : p) });
+			const configStale = shippedProxyDrift(state, { cwd, compareMounts: false }).drift.length > 0;
+			if (judged.unknown && !configStale) return `its mounts could not be compared on this host (${judged.unknown}), and up does not remove a proxy it cannot show is this folder's`;
+			return null;
+		},
+		lines: async (network) => [`docker ${EGRESS_RM_ARGS.join(" ")}`, ...(await egressNetworkLines(spawn, network)), `docker ${quoteArgs(EGRESS_RUN_ARGS)}`],
+		replace: async (network) => {
+			await runStreamed(spawn, "docker", EGRESS_RM_ARGS, out);
+			await ensureEgressNetwork(spawn, out, network);
+			return (await runStreamed(spawn, "docker", EGRESS_RUN_ARGS, out)) === 0;
+		},
+		handled: false,
+	};
+	const confRefreshed = dockerUsed && egressArmedFn(venueEnv) && proxyName === DEFAULT_EGRESS_PROXY ? await proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackagedConf, now, yes, coupled }) : false;
 	if (dockerUsed && egressArmedFn(venueEnv) && proxyName !== DEFAULT_EGRESS_PROXY) {
 		// PI_EGRESS_PROXY names the operator's own proxy (issue #430). This step used to look for, and offer to start, the
 		// shipped name whatever that key said, so it could report a proxy present that no job attaches to, or start one
@@ -783,6 +855,8 @@ export async function runUp(argv = [], deps = {}) {
 			out(`\n✗ PI_EGRESS_PROXY names ${proxyName}, and docker has no container of that name. up starts only the shipped ${DEFAULT_EGRESS_PROXY}, so start ${proxyName} yourself\n`);
 			summary.push(["egress", `${proxyName} (PI_EGRESS_PROXY) not found; every job is refused pre-spend until it runs`]);
 		}
+	} else if (dockerUsed && egressArmedFn(venueEnv) && coupled.handled) {
+		// The refresh step replaced the proxy itself, or wrote nothing and said why (above): nothing more to judge here.
 	} else if (dockerUsed && egressArmedFn(venueEnv)) {
 		// RUNNING and CURRENT, from one inspect (issue #453; `egress-proxy-state.mjs` says why each). Running is
 		// `.State.Status` "running". Current is the pinned image with its own entrypoint and command and THIS folder's two
@@ -790,14 +864,25 @@ export async function runUp(argv = [], deps = {}) {
 		// whether it is running or stopped. Mounts whose sources do not resolve on this host are UNKNOWN, never stale.
 		const inspect = await runCmdQuery(spawn, "docker", ["inspect", PROXY_STATE_FORMAT, DEFAULT_EGRESS_PROXY]);
 		const state = inspect.code === 0 ? parseProxyState(inspect.stdout) : null;
-		const judged = state ? shippedProxyDrift(state, { cwd, platform, realpath: (p) => (typeof fs.realpathSync === "function" ? fs.realpathSync(p) : p) }) : { drift: [], unknown: null };
+		// Issue #503: a proxy without the third mount is current until the include is needed (`shippedProxyDrift`). Read
+		// AFTER the rules refresh above, so a refreshed copy that includes the file makes a two-mount proxy stale here and
+		// it is replaced rather than restarted into squid's missing-include FATAL.
+		const rulesInclude = rulesFileIncludes(join(cwd, "deploy/egress-proxy.conf"), fs);
+		const judged = state ? shippedProxyDrift(state, { cwd, platform, realpath: (p) => (typeof fs.realpathSync === "function" ? fs.realpathSync(p) : p), rulesInclude }) : { drift: [], unknown: null };
+		// Endpoints declared under rules that predate #503: not drift (a replace would cut tunnels and change nothing), the
+		// rules refresh's to fix, said in the one line up, doctor and egress render share.
+		if (!rulesInclude && endpointsDeclaredIn({ env, cwd, fs, platform })) {
+			out(`\n⚠ ${rulesPredateEndpointsLine("docker")}\n`);
+			summary.push(["model endpoints", "unreachable: deploy/egress-proxy.conf predates #503; accept the rules refresh"]);
+		}
 		const drift = judged.drift;
 		// The files a start or a recreate mounts. Both, not the allowlist alone: a missing egress-proxy.conf is bind-mounted
 		// as a directory the runtime creates in its place (measured, Docker Engine 29.8.1: the host path became a root-owned
 		// directory, and the create failed "not a directory: Are you trying to mount a directory onto a file", exit 127).
 		// A DIRECTORY at either path counts as missing too (PR #488's review): it is mounted where squid reads a file.
 		const fileProblem = (f) => (!fs.existsSync(join(cwd, f)) ? "is not here" : pathIsDirectory(fs, join(cwd, f)) ? "here is a directory, not a file" : null);
-		const missingFile = ["egress-allowlist.conf", "deploy/egress-proxy.conf"].find((f) => fileProblem(f) !== null);
+		// Issue #503: and the model endpoints' include, which the rules name; squid will not start without it (measured).
+		const missingFile = PROXY_FOLDER_FILES.find((f) => fileProblem(f) !== null);
 		const missingSaid = missingFile ? `${missingFile} ${fileProblem(missingFile)}` : "";
 		const noFile = missingFile ? (fileProblem(missingFile) === "is not here" ? `no ${missingFile} in this folder` : `${missingFile} in this folder is a directory`) : "";
 		// Whether the proxy's network is missing, filled by `egressNetworkLines` when an offer is about to be shown.
@@ -872,7 +957,8 @@ export async function runUp(argv = [], deps = {}) {
 			// STALE, running or not: never started as it is. Its policy is not this deployment's, so the offer is to replace
 			// it with the shipped one, shown line for line. A running one may be carrying jobs: its job and sandbox networks
 			// are named, since removing it cuts each of them off mid-run.
-			out(`\n✗ ${DEFAULT_EGRESS_PROXY} exists (${state.status}) but is not this deployment's proxy: ${drift.join("; ")}\n`);
+			// Issue #503 (gate): a proxy of THIS folder made before #503 is said as what it is, out of date, not a stranger.
+			out(judged.outOfDate ? `\n✗ ${DEFAULT_EGRESS_PROXY} exists (${state.status}) and is this deployment's proxy but out of date: ${drift.join("; ")}\n` : `\n✗ ${DEFAULT_EGRESS_PROXY} exists (${state.status}) but is not this deployment's proxy: ${drift.join("; ")}\n`);
 			const attached = jobNetworksOf(state);
 			// Never removed on its mounts while one of its two own mounts is unknown (round-cap re-review): the other findings
 			// are said. Its image, entrypoint or command is ground enough (`configStale` above).
@@ -901,8 +987,8 @@ export async function runUp(argv = [], deps = {}) {
 					summary.push(["egress", "replaced the stale pi-dispatch-egress-proxy with the shipped one"]);
 				}
 			} else {
-				out(`skipped: until it is replaced, jobs use a proxy whose policy is not this deployment's (\`docker ${EGRESS_RM_ARGS.join(" ")}\`, then \`pi-dispatch up\`)\n`);
-				summary.push(["egress", "stale proxy left as it is (declined): its policy is not this deployment's"]);
+				out(judged.outOfDate ? `skipped: it runs until its next restart, which exits on the missing include (\`docker ${EGRESS_RM_ARGS.join(" ")}\`, then \`pi-dispatch up\`)\n` : `skipped: until it is replaced, jobs use a proxy whose policy is not this deployment's (\`docker ${EGRESS_RM_ARGS.join(" ")}\`, then \`pi-dispatch up\`)\n`);
+				summary.push(["egress", judged.outOfDate ? "out-of-date proxy left as it is (declined): its next restart exits on the missing include" : "stale proxy left as it is (declined): its policy is not this deployment's"]);
 			}
 		} else if (missingFile) {
 			out(`\n✗ the egress policy is on but ${missingSaid}, so no proxy is started without it\n`);
@@ -1061,8 +1147,120 @@ async function podmanGate({ readPodmanInfo, platform, euid, egid, out }) {
 	return { ok: false, why };
 }
 
+/**
+ * The job image the worker will run as its deployment default (issue #523), as `up` must judge it:
+ * `{ image, isDefault, from, skip }`. The worker's own rule (`jobImageFrom`: `PI_JOB_IMAGE || "pi-job:latest"`, then
+ * the one image rule), over the value the service reads (`resolveServiceEnv`, doctor's resolver): this shell's where
+ * it sets the key, else the deployment `.env`'s, read with the service's own loader. Where `up` cannot tell which image
+ * that is (the shell and the file disagree, the file's line or the file itself is one the loader reads differently,
+ * or the worker refuses the value at boot), `skip` says why and nothing is checked or pulled: a guess here is exactly
+ * the 3 GB pull of an image the worker never runs that this exists to stop. Doctor, below, names each of those cases.
+ */
+export function deploymentJobImage({ env, fs, envPath, platform }) {
+	let file = null;
+	let unreadable = false;
+	if (fs.existsSync(envPath)) {
+		try {
+			// Bytes, as the service's loader meets them (`serviceEnvFileOf` judges what systemd refuses to load).
+			file = serviceEnvFileOf(fs.readFileSync(envPath), envPath, serviceEnvLoader(platform));
+		} catch {
+			// Unreadable is not unset: the service may well read a PI_JOB_IMAGE this account cannot.
+			unreadable = true;
+			if (typeof env.PI_JOB_IMAGE !== "string") return { skip: `${envPath} could not be read, so up cannot tell which job image the worker runs (PI_JOB_IMAGE): it checks and pulls none` };
+		}
+	}
+	// A file the service's loader reads differently somewhere, which spells the key, gives no value (round 2): where this
+	// shell sets the key `resolveServiceEnv` records nothing for it, so the shell's value was credited to `.env` and a
+	// different value on a line after the hazard went unseen. Cannot tell, whoever sets it.
+	if (file?.hazard && file.text.includes("PI_JOB_IMAGE")) {
+		return { skip: `${envPath} has a line in it that the service's loader may read differently from this reader (line ${file.hazard.line}), so up cannot tell which job image the worker runs: it checks and pulls none. Doctor below names the line` };
+	}
+	const read = resolveServiceEnv({ env, file, keys: ["PI_JOB_IMAGE"] });
+	// Compared as the worker READS them (review), as `deploymentVenueEnv` compares the venue keys: an empty value and
+	// `pi-job:latest` are both the default, and refusing them sent an operator to reconcile two values that agree.
+	const [disagreement] = read.disagreements.filter((d) => jobImageMeaning(d.shell) !== jobImageMeaning(d.file));
+	if (disagreement) {
+		return { skip: `PI_JOB_IMAGE is ${JSON.stringify(disagreement.shell)} in this shell and ${JSON.stringify(disagreement.file)} in ${envPath}, so up cannot tell which job image the worker runs: it checks and pulls none. Make them agree (the service runs the file's), then re-run` };
+	}
+	// `hazardSkipped` is answered above, before the resolver, whoever sets the key.
+	if (read.unread.length > 0) {
+		return { skip: `${envPath} has a line in it that the service's loader may read differently from this reader, so up cannot tell which job image the worker runs: it checks and pulls none. Doctor below names the line` };
+	}
+	let image;
+	try {
+		image = jobImageFrom(read.env);
+	} catch (err) {
+		return { skip: `${err.message}: the worker refuses to boot on it, so up checks and pulls no job image. Fix PI_JOB_IMAGE, then re-run` };
+	}
+	const shellSet = typeof env.PI_JOB_IMAGE === "string" && env.PI_JOB_IMAGE !== "";
+	// The file sets no PI_JOB_IMAGE of its own: there is none, or `resolveServiceEnv` found the key in this shell only.
+	const fileLacks = !unreadable && (file === null || read.shellOnly.includes("PI_JOB_IMAGE"));
+	const from = shellSet && (fileLacks || unreadable) ? "this shell" : Object.hasOwn(read.fromFile, "PI_JOB_IMAGE") || shellSet ? envPath : null;
+	// Said, never silent (review): a worker started by hand from this shell runs this image, an installed service does
+	// not, since it reads `.env` (where init writes PI_JOB_IMAGE=pi-job:latest), so the image up readies may not be its.
+	const note = shellSet && fileLacks ? `PI_JOB_IMAGE comes from this shell only: a worker started from this shell runs ${image}, but an installed service reads ${envPath}, not this shell (init writes PI_JOB_IMAGE=pi-job:latest there), so put it there if the service should run it` : null;
+	return { image, isDefault: image === LOCAL_IMAGE, from, note, skip: null };
+}
+
+/** What a PI_JOB_IMAGE value means to the worker (`jobImageFrom`), for comparing two spellings of it; a refused value keeps its raw spelling. */
+function jobImageMeaning(value) {
+	try {
+		return `image:${jobImageFrom({ PI_JOB_IMAGE: value })}`;
+	} catch {
+		return `raw:${value}`;
+	}
+}
+
+/**
+ * The image an overriding PI_JOB_IMAGE names (issue #523), into the store `bin` reads: present is left alone, absent is
+ * offered as ONE pull of exactly that name when it names its registry (a short name is never pulled). No tag: the worker runs the name as configured, so `pi-job:latest` means
+ * nothing to it, and re-pointing that tag would change what a later unset PI_JOB_IMAGE runs. The name is the operator's
+ * own configuration, shown in full before consent, and jobs still run with --pull=never.
+ */
+async function overrideImageStep({ bin, jobImage, spawn, out, yes, prompt, summary }) {
+	const { image, from } = jobImage;
+	const podman = bin === "podman";
+	const row = podman ? "podman job image" : "job image";
+	const where = podman ? "in this account's Podman store" : "on this host";
+	const named = `PI_JOB_IMAGE from ${from}`;
+	const pullArgs = ["pull", image];
+	if ((await runCmd(spawn, bin, podman ? ["image", "exists", image] : ["image", "inspect", image])) === 0) {
+		out(`✓ Job image present ${podman ? "in this account's Podman store " : ""}(${image}, ${named})\n`);
+		summary.push([row, `already present (${image})`]);
+		return;
+	}
+	// A SHORT name is never pulled (issue #523, review): with no registry host the runtime resolves it on Docker Hub (or
+	// podman's search registries), where anyone can publish `pi-job:2.1.0` or `my-job:dev`, and under --yes that would
+	// fetch and later run a stranger's image unprompted. Such a name is almost always one built or tagged here, so up
+	// says how to provide it and pulls nothing; doctor below still fails on the missing image. A `localhost/` name
+	// (round 2) is a locally built one with no registry behind it, so it is never offered as a pull either.
+	if (!pullOffered(image)) {
+		out(`✗ The job image ${named} names (${image}) is not ${where}, and up does not pull it: ${jobImageFix(bin, image)}\n`);
+		summary.push([row, `${image} is not present: not pulled, since ${registryQualified(image) ? "it is a locally built name" : "it names no registry host"} (build or tag it here)`]);
+		return;
+	}
+	const accepted = await consent(`The job image ${named} names (${image}) is not ${where}. up would run:`, [`${bin} ${pullArgs.join(" ")}`], { yes, out, prompt });
+	if (!accepted) {
+		out("skipped: pull it later with the command above\n");
+		summary.push([row, `skipped (declined): ${image} is not present, and jobs run with --pull=never, so nothing fetches it later`]);
+	} else if ((await runStreamed(spawn, bin, pullArgs, out)) !== 0) {
+		out(`✗ ${bin} pull failed: continuing; doctor below will re-check the image\n`);
+		summary.push([row, `pull of ${image} FAILED: re-run \`pi-dispatch up\`, or pull it by hand`]);
+	} else {
+		out(`✓ pulled ${image}${podman ? " into this account's Podman store" : ""}\n`);
+		summary.push([row, `pulled ${image}`]);
+	}
+}
+
 /** The default job image into this account's Podman store, mirroring the docker step (b) line for line. */
-async function podmanImageStep({ spawn, out, yes, prompt, summary }) {
+async function podmanImageStep({ jobImage, spawn, out, yes, prompt, summary }) {
+	// The same rule as docker's step (issue #523): only the image the worker runs, under its own name when PI_JOB_IMAGE
+	// names one. The podman venue reads the same key (`jobImageFrom`), so its store needs exactly that image too.
+	if (jobImage.skip) {
+		summary.push(["podman job image", "not checked: which image the worker runs is unknown (see above)"]);
+		return;
+	}
+	if (!jobImage.isDefault) return overrideImageStep({ bin: "podman", jobImage, spawn, out, yes, prompt, summary });
 	if ((await runCmd(spawn, "podman", PODMAN_EXISTS_ARGS)) === 0) {
 		out(`✓ Job image present in this account's Podman store (${LOCAL_IMAGE})\n`);
 		summary.push(["podman job image", `already present (${LOCAL_IMAGE})`]);
@@ -1173,6 +1371,12 @@ async function podmanStackStep({ env, valkeyKeys = {}, state = {}, venues, spawn
 	}
 	const components = stackComponents({ venues, env, includeValkey, armed, valkeyPort, valkeyPassword });
 	for (const note of components.notes) out(`\n⚠ ${note}\n`);
+	// Issue #503: endpoints declared while the account's rules copy predates the include, in the one line up, doctor and
+	// egress render share. No copy yet is not that state: the unit's install writes the current rules.
+	if (components.proxy && fs.existsSync(proxyConfCopyPath(home)) && !rulesFileIncludes(proxyConfCopyPath(home), fs) && endpointsDeclaredIn({ env, cwd, fs, platform })) {
+		out(`\n⚠ ${rulesPredateEndpointsLine("podman")}\n`);
+		summary.push(["model endpoints", "unreachable: the podman proxy's rules predate #503; `pi-dispatch service install --force`"]);
+	}
 	let keeperRestart = false;
 	if (components.proxy) {
 		// RUNNING, read off the output: `podman inspect` exits 0 for an EXITED container too and prints `false`
@@ -1190,6 +1394,11 @@ async function podmanStackStep({ env, valkeyKeys = {}, state = {}, venues, spawn
 			out(`\n✗ the egress policy is on but egress-allowlist.conf ${pathIsDirectory(fs, join(cwd, "egress-allowlist.conf")) ? "here is a directory, not a file" : "is not here"}, not starting a proxy with no allowlist\n`);
 			summary.push(["egress (podman)", "skipped: no egress-allowlist.conf in this folder; run `pi-dispatch init` here, then `up` again"]);
 			components.proxy = false;
+		} else if (!fs.existsSync(join(cwd, MODEL_ENDPOINTS_INCLUDE_NAME)) || pathIsDirectory(fs, join(cwd, MODEL_ENDPOINTS_INCLUDE_NAME))) {
+			// Issue #503: the rules include it, and squid will not start without it.
+			out(`\n✗ the egress policy is on but ${MODEL_ENDPOINTS_INCLUDE_NAME} ${pathIsDirectory(fs, join(cwd, MODEL_ENDPOINTS_INCLUDE_NAME)) ? "here is a directory, not a file" : "is not here"}, and the proxy's rules include it, so no proxy is started without it\n`);
+			summary.push(["egress (podman)", `skipped: no ${MODEL_ENDPOINTS_INCLUDE_NAME} in this folder; run \`pi-dispatch init\` here, then \`up\` again`]);
+			components.proxy = false;
 		}
 	}
 	if (components.keeper) {
@@ -1345,7 +1554,7 @@ export function valkeyContainerPublishes(line, port) {
  * bytes are kept beside it either way (`replaceProxyConfCopy`), since an edit lost to a wrong "y" is still the
  * operator's.
  */
-async function proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackagedConf, now, yes }) {
+async function proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackagedConf, now, yes, coupled = null }) {
 	const rel = "deploy/egress-proxy.conf";
 	const path = join(cwd, rel);
 	// A directory there is the proxy step's to say (it starts nothing on one), so it is not read as a copy here.
@@ -1360,6 +1569,14 @@ async function proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackage
 	}
 	out(`\n⚠ ${rel} differs from ${packageCopyName()}: ${judged.summary}. An upgrade does not rewrite it, so it is either an older version's rules or an edit of your own (\`diff ${rel} ${PACKAGED_EGRESS_PROXY_CONF}\` shows which)\n`);
 	if (yes) out("--yes does not cover replacing a file that may hold your own edits: answer below\n");
+	// Issue #503's governing rule: new rules that include model-endpoints.conf go in only together with a proxy that
+	// mounts it. A proxy of the shipped name without that mount is replaced in the same step, asked once.
+	if (coupled && rulesIncludeEndpoints(judged.packaged) && !rulesFileIncludes(path, fs)) {
+		const state = await coupled.inspect();
+		if (state && !state.mounts.some((m) => m.type === "bind" && m.destination === MODEL_ENDPOINTS_TARGET)) {
+			return coupledRefreshStep({ fs, path, rel, judged, state, coupled, out, prompt, summary, now });
+		}
+	}
 	const accepted = await consent(
 		`up would replace it with ${packageCopyName()}, keeping yours beside it:`,
 		[`cp ${rel} ${rel}.bak-<timestamp>`, `write ${PACKAGED_EGRESS_PROXY_CONF}'s content beside ${rel}, then rename it over ${rel}`],
@@ -1382,6 +1599,63 @@ async function proxyConfRefreshStep({ fs, cwd, out, prompt, summary, readPackage
 	return true;
 }
 
+/**
+ * Issue #503: the rules refresh and the replacement of a proxy that lacks the model endpoints' mount, as ONE step. The
+ * new rules include a file that proxy does not mount, so on their own they would make its next start exit (measured:
+ * `docker start` of such a proxy exited 1 on squid's missing-include FATAL). Asked once, never under `--yes` (the
+ * refresh never is). Declined, or not possible from here, nothing is written. A replace that fails puts the old rules
+ * back from the backup it just wrote, so the folder never holds rules no proxy can start on. Returns true when the
+ * rules were replaced. `coupled.handled` is set ONLY when the replace succeeded: declined, blocked or failed, the old
+ * rules are in place and the proxy step below judges the proxy as it always does (start a stopped one, unpause a
+ * paused one, offer a stale one's replace, name declared endpoints the old rules cannot reach).
+ */
+async function coupledRefreshStep({ fs, path, rel, judged, state, coupled, out, prompt, summary, now }) {
+	const why = "the new rules include model-endpoints.conf, which this proxy does not mount, so they go in only together with a proxy that mounts it";
+	const blocked = coupled.blocked(state);
+	if (blocked) {
+		out(`not replaced: ${why}, and up cannot replace the proxy here: ${blocked}. ${rel} and the proxy are left as they are. To take the new rules, remove the proxy with \`docker ${EGRESS_RM_ARGS.join(" ")}\` (fix a missing file first with \`pi-dispatch init\`), then run \`pi-dispatch up\` again, which starts the shipped proxy on them\n`);
+		summary.push(["egress rules", `${rel} left as it is: ${blocked}`]);
+		return false;
+	}
+	const attached = jobNetworksOf(state);
+	const network = { missing: false };
+	const lines = [`cp ${rel} ${rel}.bak-<timestamp>`, `write ${PACKAGED_EGRESS_PROXY_CONF}'s content beside ${rel}, then rename it over ${rel}`, ...(await coupled.lines(network))];
+	const accepted = await consent(
+		`up would replace ${rel} with ${packageCopyName()}, keeping yours beside it, and replace the proxy (${state.status}) with the shipped one in the same step: ${why}${attached.length > 0 ? `. It is attached to ${attached.join(", ")}: removing it cuts those jobs off from their egress mid-run, so stop the worker first (and let running jobs finish)` : ""}:`,
+		lines,
+		{ yes: false, out, prompt },
+	);
+	if (!accepted) {
+		out(`skipped: ${rel} and the proxy are left as they are; \`pi-dispatch up\` offers this again\n`);
+		summary.push(["egress rules", `${rel} differs from ${packageCopyName()}, left as it is with its proxy (declined)`]);
+		return false;
+	}
+	const done = replaceProxyConfCopy({ path, text: judged.packaged, fs, now });
+	if (!done.ok) {
+		out(`✗ not replaced: ${done.reason}. The proxy is left as it is\n`);
+		summary.push(["egress rules", `NOT replaced: ${done.reason}`]);
+		return false;
+	}
+	const backup = `${rel}${done.backup.slice(path.length)}`;
+	if (await coupled.replace(network)) {
+		coupled.handled = true;
+		out(`✓ replaced ${rel} with ${packageCopyName()} (yours is kept as ${backup}) and the proxy with the shipped one, which mounts model-endpoints.conf\n`);
+		summary.push(["egress rules", `${rel} replaced with ${packageCopyName()} (the old one is ${backup})`]);
+		summary.push(["egress", "replaced pi-dispatch-egress-proxy with the shipped one, on the refreshed rules"]);
+		return true;
+	}
+	let restored = false;
+	try {
+		fs.renameSync(done.backup, path);
+		restored = true;
+	} catch {
+		// Said below: the new rules stay, and the backup is where it was.
+	}
+	out(`✗ could not start the shipped proxy; ${restored ? `${rel} is put back as it was (from ${backup}), since no proxy that mounts model-endpoints.conf runs` : `and ${rel} could not be put back: \`mv ${backup} ${rel}\` does it`}. Continuing; doctor below will re-check it\n`);
+	summary.push(["egress", `replace FAILED after the rules refresh; ${restored ? `${rel} put back as it was` : `${rel} NOT put back (${backup} holds the old one)`}`]);
+	return false;
+}
+
 /**
  * Show the exact commands, then ask. Printing happens with or without `--yes`: consent is what the
  * flag waives, never visibility — every host mutation is on screen before it runs. The prompt

package/src/valkey-endpoint.mjs

@@ -30,6 +30,7 @@ import { readFileSync } from "node:fs";
 import { networkInterfaces, userInfo } from "node:os";
 import { join } from "node:path";
 import { venuesOf } from "./backends.mjs";
+import { DEFAULT_VALKEY_URL } from "./config.mjs";
 import { VALKEY_SHARED_KEY, judgeValkeyListeners, passwdNameFrom, pinnedValkeyUrl, probeTcpAddress, readStackKeys, readSubuidRanges, readValkeyKeys, valkeySharedOn, valkeySchemeOf } from "./podman-stack.mjs";
 import { VALKEY_PASSWORD_KEY, isLoopbackHost } from "./valkey-auth.mjs";
 
@@ -184,8 +185,8 @@ export function valkeyDbRangeSentence(url, db, databases) {
 	return `VALKEY_URL ${urlShown(url)} names database ${db}, which that Valkey does not have: ${has}. No client uses another database in its place; name one it has, or raise \`databases\` in that Valkey's configuration`;
 }
 
-/** The default VALKEY_URL, the worker's own (config.mjs). */
-export const DEFAULT_VALKEY_URL = "redis://127.0.0.1:6379";
+/** The default VALKEY_URL, the worker's own, defined once in config.mjs. */
+export { DEFAULT_VALKEY_URL };
 
 /**
  * The VALKEY_URL a command run from a deployment folder uses (PR #475's review), by the same rule as the password it