diff --git a/docs/swarm/builder.md b/docs/swarm/builder.md
index 3f6941dc..98ec002c 100644
--- a/docs/swarm/builder.md
+++ b/docs/swarm/builder.md
@@ -103,10 +103,9 @@ status has no link.
   hive's. A green check can therefore still fail on a hive, and the reverse.
 - The agent base is the builder's host's, not the hive's. Hives on another
   hyperhive or nixpkgs pin build something else.
-- The check pushes nothing. The closure stays in the builder
+- The builder pushes nothing. The closure stays in the builder
   host's store until it's collected, so on a host that also runs the hive, the
-  hive's own build can reuse whatever matches. A [meta build](#deploy-gate)
-  can push to [a binary cache](#binary-cache).
+  hive's own build can reuse whatever matches.
 - The PR check gates nothing. A merge deploys whatever the status says. The
   [deploy gate](#deploy-gate) is a separate build, from `internal/meta`.
 - A lost webhook delivery isn't retried: the head isn't built until the next
@@ -248,115 +247,13 @@ On a built reply the controller writes the agent's key in the `agent-closures`
 KV bucket: the `internal/meta` commit, the closure's store path, the builder's
 platform and the time. Only the controller writes the bucket, and the builder
 holds no grant on it. A failed build writes nothing and leaves the previous key.
-The record's `cached` field says whether the builder pushed the closure to
-[the binary cache](#binary-cache). Nothing reads the bucket yet. The closure stays
-unrooted in the builder host's store.
+Nothing reads the bucket yet. The closure stays unrooted in the builder host's
+store.
 
 The controller gives the `builder` forge account read on `internal/meta` when it
 updates the flake, and again before each build, since the repo is private. A
 grant the forge refuses fails the build with no verdict.
 
-## Binary cache
-
-With `services.hyperhive.swarm.attic.domain` and `cache` set, the builder pushes
-each green meta build's closure to that cache, an attic server inside or outside the
-swarm, before it replies. It runs `attic push swarm:<cache> <out path>` once per build,
-not `attic watch`, and the builder pushes again when the controller runs a build again. The
-push has ten minutes, or less when the reply is due sooner, because it must end
-inside the 61 minutes the controller waits. `attic` checks the server's certificate
-against the system roots and pins nothing, so a Let's Encrypt certificate
-works.
-
-Set both options or neither: evaluation refuses a domain without a cache name.
-The cache name follows attic's rule, 1 to 50 letters, digits, `-`, `_` or `+`,
-starting with a letter or digit, and evaluation refuses any other name.
-
-The push token is the swarm's own cache's to create, or the operator's to write for an
-external one. The builder reads it on every push from `secret/swarm/services/attic/push-token` (field `value`), writes it to
-a file and an `attic` config naming that file (`token-file`) in the unit's private
-runtime directory (`/run/swarm-builder`, mode `0700`, both files `0600`), points
-`attic` at the config with `XDG_CONFIG_HOME` and removes both after the push.
-The token is in no argument or variable, so no process listing shows it.
-
-The reply's `cached` says whether the push finished. A push that fails, times out
-or can't read the token leaves the build green with `cached` false and logs a
-warning with the reason; the deploy goes ahead and the next build of the agent
-tries again. With no cache set, the builder pushes nothing and `cached` is always
-false.
-
-Mixed versions:
-
-| controller | builder | what happens                                                  |
-| ---------- | ------- | ------------------------------------------------------------- |
-| new        | new     | `cached` in the reply and in the `agent-closures` record      |
-| new        | old     | the reply has no `cached`, which reads as `false`             |
-| old        | new     | the controller ignores `cached`; its record has no such field |
-
-A record written before the field existed also reads as `false`.
-
-### The swarm's own cache
-
-`services.hyperhive.deploy.attic.enable` runs an attic server in a `swarm-attic`
-container behind the gateway, at `attic.<swarm domain>`. It defaults on where
-you set `deploy.allSwarmServices` and the host holds the cache's store identity
-(`deploy.bao.atticClient{Cert,Key}File`, which the store's host mints). You write
-no secret: on first start, two host units log in to the store as the cache's own
-principal and create what's missing.
-
-- `swarm-bao-attic-secret` creates the key atticd signs tokens with at
-  `secret/swarm/services/attic/jwt-secret` and writes it where the container
-  reads it.
-- `swarm-bao-attic-tokens` creates the cache and mints the push token, which
-  the builder reads, at `secret/swarm/services/attic/push-token`, and a
-  read-only pull token for the hives at `secret/swarm/services/attic/pull-token`.
-
-A unit creates each secret only while the store holds none, so a second start
-mints nothing. Both tokens last ten years and nothing renews them. To replace one,
-write the new token to its path in the store: nothing mints over a value that
-exists. A new signing key invalidates both tokens.
-
-With the switch on, `swarm.attic.domain` and `swarm.attic.cache` default to
-`attic.<swarm domain>` and `swarm`, so the builder on that host pushes to it.
-Naming either option yourself wins over its default. The defaults apply only on
-the host that runs the cache: on any other host, name both options too, with the
-same values.
-
-Storage is local disk in the container's state (`/var/lib/swarm-attic`). A store
-path nobody added or fetched for 14 days goes at the next garbage collection,
-which runs every 12 hours (`deploy.attic.retentionPeriod`). The next build of
-that agent pushes a closure the cache lost.
-
-The gateway terminates TLS with a swarm services certificate and forwards to
-`127.0.0.1:8910` (`deploy.attic.port`) with no login in front: attic checks its
-own tokens, and a nix client can't follow a login redirect. The container logs
-to its journal only; its journal doesn't reach the swarm log store.
-
-### External cache
-
-The cache can be an attic tenant on an instance outside the swarm. To point
-the swarm at an existing tenant:
-
-1. On the builder host, set `services.hyperhive.swarm.attic.domain` to the
-   instance's host name (no scheme, `host:port` if it isn't on 443) and
-   `services.hyperhive.swarm.attic.cache` to the cache's name on it.
-2. Seed the push token in the swarm secret store at
-   `secret/swarm/services/attic/push-token`, field `value`. Use the store's UI,
-   or `bao kv put` with `value=-` and the token on stdin, so the token is in no
-   command line. The token needs push rights on that cache. Until it
-   exists, every push fails and builds stay green with `cached` false.
-
-The builder checks the instance's certificate against the system roots and
-pins nothing, so a Let's Encrypt certificate needs no setup. The builder
-reads the token again on every push, so a new token takes effect on the next
-build.
-
-Where you host the shared services, `deploy.attic.enable` defaults on and runs
-the swarm's own cache. To use an external one, set it to `false` with
-`lib.mkForce`, then set the two options by hand and seed the token as above.
-The swarm then renders no container, vhost or unit of its own cache, and
-creates no secret in the store. The store's host still mints the cache's
-leaf and writes its role, which nothing logs in to.
-
 ## Credentials
 
 | What                    | Where                                             | Who reads it                                       |
@@ -364,7 +261,6 @@ leaf and writes its role, which nothing logs in to.
 | store leaf              | `deploy.bao.builderClient{Cert,Key}File`          | nspawn, into the service as a credential           |
 | queue client secret     | `secret/swarm/services/swarm-builder/oidc/client` | the builder, at start and when authelia refuses it |
 | forge token (read-only) | `secret/swarm/services/builder/forge/token`       | the builder, on every build                        |
-| cache push token        | `secret/swarm/services/attic/push-token`          | the builder, on every push                         |
 
 The token belongs to the `builder` forge account, which swarm-controller
 creates, puts in the `hives` team of `agent-configs` (read on every config
@@ -374,7 +270,7 @@ gets the token through a credential helper reading the child's environment:
 it's in no argument, URL or lock, so no line `nix` prints can carry it into a
 status. The same `git` fetches a config's own inputs, so the builder registers
 the helper for the forge's URL only, and the helper answers only an `https`
-request for the forge's host: any other host gets nothing. The builder holds no forge write credential; swarm-controller writes the
+request for the forge's host: any other host gets nothing. The builder holds no write credential; swarm-controller writes the
 status with its own forge token. Details per path:
 [`credentials-reference.md`](credentials-reference.md).
 
diff --git a/docs/swarm/credentials-reference.md b/docs/swarm/credentials-reference.md
index ef3055eb..93349050 100644
--- a/docs/swarm/credentials-reference.md
+++ b/docs/swarm/credentials-reference.md
@@ -14,38 +14,35 @@ the rest of the cell says how.
 
 <!-- vale write-good.Passive = NO -->
 
-| store path                                                  | minter                                                                                                                                                                                   | reader                                              | automatic re-mint                                                                                              | automatic re-pull                                                                                                                                                                                                                                            |
-| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `swarm/agents/<agent>/matrix/main`                          | `swarm-controller`, at agent creation and every 5 minutes                                                                                                                                | the agent                                           | ✅ when missing or rejected by the homeserver                                                                  | ✅ the daemon restarts within 5 minutes of a rejection                                                                                                                                                                                                       |
-| `swarm/agents/<agent>/matrix/<account>`                     | `swarm-controller`, from a credential you hand it                                                                                                                                        | the agent                                           | must be stated                                                                                                 | ✅ retried within 2 to 16 minutes after a rejection                                                                                                                                                                                                          |
-| `swarm/agents/<agent>/matrix-recovery/<account>`            | `swarm-controller`, a random passphrase per account                                                                                                                                      | the agent                                           | ❌ never replaced: the account's key backup opens only with this passphrase                                    | ❌ read when the account comes up                                                                                                                                                                                                                            |
-| `swarm/controller/swarm-controller/matrix/appservice-token` | `swarm-matrix-ctl` in `hive-matrix`, once                                                                                                                                                | `swarm-controller`                                  | ❌ minted once                                                                                                 | ✅ read every 5 minutes                                                                                                                                                                                                                                      |
-| `swarm/controller/swarm-controller/oidc/client`             | authelia, first boot                                                                                                                                                                     | `swarm-controller`                                  | ❌ minted once; `swarm-secret-publish` republishes a re-mint                                                   | ✅ re-read when authelia refuses it                                                                                                                                                                                                                          |
-| `swarm/controller/swarm-controller/forge/token`             | the forge, once                                                                                                                                                                          | `swarm-controller`                                  | ❌ minted once; delete `/var/lib/forgejo/swarm-controller-token-name` in the forge container to mint a new one | ✅ re-read on a 401                                                                                                                                                                                                                                          |
-| `swarm/controller/swarm-controller/grafana/token`           | `swarm-bao-grafana-controller-token` on Grafana's host                                                                                                                                   | `swarm-controller`                                  | ✅ every 10 minutes, when Grafana refuses it or none is stored                                                 | ✅ re-read on a 401                                                                                                                                                                                                                                          |
-| `swarm/controller/swarm-controller/forge/webhook-secret`    | `swarm-controller`, at start, from its old `webhook-secret` file; a new one only when there is no file                                                                                   | `swarm-controller`                                  | ❌ minted once; a rotated secret fails every delivery until the forge hooks are re-registered                  | ❌ read at start                                                                                                                                                                                                                                             |
-| `swarm/agents/<agent>/bao-mtls`                             | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation                                                                                                          | `hive-c0re`, then the agent                         | ✅ re-issued every 5 minutes once past half its 7-day validity                                                 | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid                                                                                                                                                                       |
-| `swarm/agents/<agent>/queue`                                | `swarm-controller`, at agent creation                                                                                                                                                    | the agent; the queue, log and metrics auth services | ✅ re-minted at 45 days; skipped for `Destroyed` agents, whose path is deleted                                 | ✅ read on every reconnect; an open connection keeps the old secret for up to an hour; the log and metrics stores honour a replaced secret for up to `deploy.victorialogs.authVerdictTtl` and `deploy.victoriametrics.agentAuthVerdictTtl` (60 s by default) |
-| `swarm/agents/<agent>/forge-token`                          | `swarm-controller`, at agent creation and every 5 minutes                                                                                                                                | the agent                                           | ✅ when missing or no longer matching the forge                                                                | ✅ every 10 minutes                                                                                                                                                                                                                                          |
-| `swarm/agents/<agent>/forge/<label>`                        | `swarm-controller`, when you link an external forge account in the swarm UI                                                                                                              | the agent                                           | ❌ your token; delete it and link the label again                                                              | ✅ every 2 minutes                                                                                                                                                                                                                                           |
-| `swarm/agents/<agent>/github-token`                         | `swarm-controller`, when you link a GitHub account in the swarm UI                                                                                                                       | the agent                                           | ❌ your token; delete it and link again                                                                        | ✅ every 2 minutes                                                                                                                                                                                                                                           |
-| `swarm/agents/<agent>/claude-credentials`                   | `swarm-claude-login`, when you log the agent in from its card; one version per login                                                                                                     | the agent, while it waits for a login               | ❌ log in again                                                                                                | ✅ every 30 seconds while waiting                                                                                                                                                                                                                            |
-| `swarm/hives/<hive>/matrix/sender-token`                    | `swarm-controller`, every 5 minutes                                                                                                                                                      | `swarm-controller` and the hive                     | ✅ when missing or rejected by the homeserver                                                                  | ✅ the hive re-reads on every sweep                                                                                                                                                                                                                          |
-| `swarm/hives/<hive>/forge/token`                            | `swarm-controller`, every 5 minutes                                                                                                                                                      | `swarm-controller` and the hive                     | ✅ when missing or no longer matching the forge                                                                | ✅ read on every forge call                                                                                                                                                                                                                                  |
-| `swarm/hives/<hive>/oidc/client`                            | authelia, first boot; `swarm-secret-publish` copies it in                                                                                                                                | the hive                                            | ❌ minted once; `swarm-secret-publish` republishes a re-mint                                                   | ✅ re-read when authelia refuses it                                                                                                                                                                                                                          |
-| `swarm/services/<clientId>/oidc/client`                     | authelia                                                                                                                                                                                 | that service                                        | must be stated                                                                                                 | must be stated                                                                                                                                                                                                                                               |
-| `swarm/services/ci-runner/registration-token`               | `swarm-controller`, from the forge, at start and every 5 minutes                                                                                                                         | `swarm-bao-ci-runner` on the runner's host          | ❌ the forge keeps one token until an admin resets it; the controller then writes the new one within 5 minutes | ✅ every 10 minutes; restarts the runner on a change                                                                                                                                                                                                         |
-| `swarm/services/<grafana client id>/metrics/bearer`         | `swarm-bao-grafana-metrics-bearer` on Grafana's host, when none is stored                                                                                                                | `swarm-metrics-auth` and `swarm-logs-grafana-auth`  | ❌ delete it and restart `swarm-bao-grafana-metrics-bearer`                                                    | ✅ the auth services re-read within a minute; ❌ Grafana restarts when its copy changes                                                                                                                                                                      |
-| `swarm/services/<grafana client id>/secret-key`             | `swarm-bao-grafana-secret-key` on Grafana's host, from the key an earlier release generated; a new one only when there is none                                                           | Grafana                                             | ❌ minted once; a different key leaves Grafana unable to read its stored datasource secrets                    | ❌ Grafana reads it at start; the unit restarts Grafana when the file changes                                                                                                                                                                                |
-| `swarm/services/review-classifier/anthropic-api-key`        | you, in the store's UI, field `api_key`                                                                                                                                                  | `swarm-review-classifier`                           | ❌ write a new key                                                                                             | ✅ read on every run                                                                                                                                                                                                                                         |
-| `swarm/services/review-classifier/acp-provider`             | you, in the store's UI, field `api_key`                                                                                                                                                  | `swarm-review-classifier`                           | ❌ write a new key                                                                                             | ✅ read on every run                                                                                                                                                                                                                                         |
-| `swarm/services/review-classifier/forge/token`              | `swarm-controller`, at start and every 5 minutes                                                                                                                                         | `swarm-controller`                                  | ✅ when missing or no longer matching the forge                                                                | ✅ read on every review                                                                                                                                                                                                                                      |
-| `swarm/services/builder/forge/token`                        | `swarm-controller`, at start and every 5 minutes                                                                                                                                         | `swarm-builder`, `swarm-controller`                 | ✅ when missing or no longer matching the forge                                                                | ✅ read on every build                                                                                                                                                                                                                                       |
-| `swarm/services/attic/push-token`                           | `swarm-bao-attic-tokens` on the cache's host, when none is stored; with an external cache, you, in the store's UI (field `value`), or `bao kv put` with `value=-` and the token on stdin | `swarm-builder`                                     | ❌ write a new token; a token the cache refuses fails the push, and the build stays green with `cached` false  | ✅ read on every push; with no `swarm.attic` cache set, nothing reads it                                                                                                                                                                                     |
-| `swarm/services/attic/pull-token`                           | `swarm-bao-attic-tokens` on the cache's host, when none is stored; read-only, ten years                                                                                                  | nothing yet                                         | ❌ write a new token                                                                                           | must be stated                                                                                                                                                                                                                                               |
-| `swarm/services/attic/jwt-secret`                           | `swarm-bao-attic-secret` on the cache's host, when none is stored                                                                                                                        | `swarm-bao-attic-secret`, `swarm-bao-attic-tokens`  | ❌ a new key invalidates both tokens                                                                           | ❌ atticd restarts when the file changes                                                                                                                                                                                                                     |
-| `swarm/services/ci-metrics/forge/token`                     | `swarm-controller`, at start and every 5 minutes                                                                                                                                         | `swarm-ci-metrics`, `swarm-controller`              | ✅ when missing or no longer matching the forge                                                                | ✅ read on every pass                                                                                                                                                                                                                                        |
-| _(not in the store)_ a hive's mTLS leaf                     | the store's PKI, or you by hand                                                                                                                                                          | the hive itself, from disk                          | must be stated                                                                                                 | must be stated                                                                                                                                                                                                                                               |
+| store path                                                  | minter                                                                                                                         | reader                                              | automatic re-mint                                                                                              | automatic re-pull                                                                                                                                                                                                                                            |
+| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `swarm/agents/<agent>/matrix/main`                          | `swarm-controller`, at agent creation and every 5 minutes                                                                      | the agent                                           | ✅ when missing or rejected by the homeserver                                                                  | ✅ the daemon restarts within 5 minutes of a rejection                                                                                                                                                                                                       |
+| `swarm/agents/<agent>/matrix/<account>`                     | `swarm-controller`, from a credential you hand it                                                                              | the agent                                           | must be stated                                                                                                 | ✅ retried within 2 to 16 minutes after a rejection                                                                                                                                                                                                          |
+| `swarm/agents/<agent>/matrix-recovery/<account>`            | `swarm-controller`, a random passphrase per account                                                                            | the agent                                           | ❌ never replaced: the account's key backup opens only with this passphrase                                    | ❌ read when the account comes up                                                                                                                                                                                                                            |
+| `swarm/controller/swarm-controller/matrix/appservice-token` | `swarm-matrix-ctl` in `hive-matrix`, once                                                                                      | `swarm-controller`                                  | ❌ minted once                                                                                                 | ✅ read every 5 minutes                                                                                                                                                                                                                                      |
+| `swarm/controller/swarm-controller/oidc/client`             | authelia, first boot                                                                                                           | `swarm-controller`                                  | ❌ minted once; `swarm-secret-publish` republishes a re-mint                                                   | ✅ re-read when authelia refuses it                                                                                                                                                                                                                          |
+| `swarm/controller/swarm-controller/forge/token`             | the forge, once                                                                                                                | `swarm-controller`                                  | ❌ minted once; delete `/var/lib/forgejo/swarm-controller-token-name` in the forge container to mint a new one | ✅ re-read on a 401                                                                                                                                                                                                                                          |
+| `swarm/controller/swarm-controller/grafana/token`           | `swarm-bao-grafana-controller-token` on Grafana's host                                                                         | `swarm-controller`                                  | ✅ every 10 minutes, when Grafana refuses it or none is stored                                                 | ✅ re-read on a 401                                                                                                                                                                                                                                          |
+| `swarm/controller/swarm-controller/forge/webhook-secret`    | `swarm-controller`, at start, from its old `webhook-secret` file; a new one only when there is no file                         | `swarm-controller`                                  | ❌ minted once; a rotated secret fails every delivery until the forge hooks are re-registered                  | ❌ read at start                                                                                                                                                                                                                                             |
+| `swarm/agents/<agent>/bao-mtls`                             | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation                                                | `hive-c0re`, then the agent                         | ✅ re-issued every 5 minutes once past half its 7-day validity                                                 | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid                                                                                                                                                                       |
+| `swarm/agents/<agent>/queue`                                | `swarm-controller`, at agent creation                                                                                          | the agent; the queue, log and metrics auth services | ✅ re-minted at 45 days; skipped for `Destroyed` agents, whose path is deleted                                 | ✅ read on every reconnect; an open connection keeps the old secret for up to an hour; the log and metrics stores honour a replaced secret for up to `deploy.victorialogs.authVerdictTtl` and `deploy.victoriametrics.agentAuthVerdictTtl` (60 s by default) |
+| `swarm/agents/<agent>/forge-token`                          | `swarm-controller`, at agent creation and every 5 minutes                                                                      | the agent                                           | ✅ when missing or no longer matching the forge                                                                | ✅ every 10 minutes                                                                                                                                                                                                                                          |
+| `swarm/agents/<agent>/forge/<label>`                        | `swarm-controller`, when you link an external forge account in the swarm UI                                                    | the agent                                           | ❌ your token; delete it and link the label again                                                              | ✅ every 2 minutes                                                                                                                                                                                                                                           |
+| `swarm/agents/<agent>/github-token`                         | `swarm-controller`, when you link a GitHub account in the swarm UI                                                             | the agent                                           | ❌ your token; delete it and link again                                                                        | ✅ every 2 minutes                                                                                                                                                                                                                                           |
+| `swarm/agents/<agent>/claude-credentials`                   | `swarm-claude-login`, when you log the agent in from its card; one version per login                                           | the agent, while it waits for a login               | ❌ log in again                                                                                                | ✅ every 30 seconds while waiting                                                                                                                                                                                                                            |
+| `swarm/hives/<hive>/matrix/sender-token`                    | `swarm-controller`, every 5 minutes                                                                                            | `swarm-controller` and the hive                     | ✅ when missing or rejected by the homeserver                                                                  | ✅ the hive re-reads on every sweep                                                                                                                                                                                                                          |
+| `swarm/hives/<hive>/forge/token`                            | `swarm-controller`, every 5 minutes                                                                                            | `swarm-controller` and the hive                     | ✅ when missing or no longer matching the forge                                                                | ✅ read on every forge call                                                                                                                                                                                                                                  |
+| `swarm/hives/<hive>/oidc/client`                            | authelia, first boot; `swarm-secret-publish` copies it in                                                                      | the hive                                            | ❌ minted once; `swarm-secret-publish` republishes a re-mint                                                   | ✅ re-read when authelia refuses it                                                                                                                                                                                                                          |
+| `swarm/services/<clientId>/oidc/client`                     | authelia                                                                                                                       | that service                                        | must be stated                                                                                                 | must be stated                                                                                                                                                                                                                                               |
+| `swarm/services/ci-runner/registration-token`               | `swarm-controller`, from the forge, at start and every 5 minutes                                                               | `swarm-bao-ci-runner` on the runner's host          | ❌ the forge keeps one token until an admin resets it; the controller then writes the new one within 5 minutes | ✅ every 10 minutes; restarts the runner on a change                                                                                                                                                                                                         |
+| `swarm/services/<grafana client id>/metrics/bearer`         | `swarm-bao-grafana-metrics-bearer` on Grafana's host, when none is stored                                                      | `swarm-metrics-auth` and `swarm-logs-grafana-auth`  | ❌ delete it and restart `swarm-bao-grafana-metrics-bearer`                                                    | ✅ the auth services re-read within a minute; ❌ Grafana restarts when its copy changes                                                                                                                                                                      |
+| `swarm/services/<grafana client id>/secret-key`             | `swarm-bao-grafana-secret-key` on Grafana's host, from the key an earlier release generated; a new one only when there is none | Grafana                                             | ❌ minted once; a different key leaves Grafana unable to read its stored datasource secrets                    | ❌ Grafana reads it at start; the unit restarts Grafana when the file changes                                                                                                                                                                                |
+| `swarm/services/review-classifier/anthropic-api-key`        | you, in the store's UI, field `api_key`                                                                                        | `swarm-review-classifier`                           | ❌ write a new key                                                                                             | ✅ read on every run                                                                                                                                                                                                                                         |
+| `swarm/services/review-classifier/acp-provider`             | you, in the store's UI, field `api_key`                                                                                        | `swarm-review-classifier`                           | ❌ write a new key                                                                                             | ✅ read on every run                                                                                                                                                                                                                                         |
+| `swarm/services/review-classifier/forge/token`              | `swarm-controller`, at start and every 5 minutes                                                                               | `swarm-controller`                                  | ✅ when missing or no longer matching the forge                                                                | ✅ read on every review                                                                                                                                                                                                                                      |
+| `swarm/services/builder/forge/token`                        | `swarm-controller`, at start and every 5 minutes                                                                               | `swarm-builder`, `swarm-controller`                 | ✅ when missing or no longer matching the forge                                                                | ✅ read on every build                                                                                                                                                                                                                                       |
+| `swarm/services/ci-metrics/forge/token`                     | `swarm-controller`, at start and every 5 minutes                                                                               | `swarm-ci-metrics`, `swarm-controller`              | ✅ when missing or no longer matching the forge                                                                | ✅ read on every pass                                                                                                                                                                                                                                        |
+| _(not in the store)_ a hive's mTLS leaf                     | the store's PKI, or you by hand                                                                                                | the hive itself, from disk                          | must be stated                                                                                                 | must be stated                                                                                                                                                                                                                                               |
 
 <!-- vale write-good.Passive = YES -->
 
@@ -147,9 +144,9 @@ pieces fit, and the reasoning behind them, is in [`credentials.md`](credentials.
 ### Store identities, one per principal
 
 Bao matches a cert-auth role on the certificate's subject, so a certificate is an
-identity and sharing one merges the identities. Each of these leaves has
+identity and sharing one merges the identities. Each of these ten leaves has
 a role and a policy of its own, and reaches one path, except the review
-classifier's, the CI runner's, the builder's, the cache's, the CI run poller's, the claude
+classifier's, the CI runner's, the builder's, the CI run poller's, the claude
 login minter's, the forge host's and Grafana's, which reach more than one:
 
 | unit                                                                                                                                  | option pair under `deploy.bao.`                                    | reads, or writes                                                                                                                                                                                                                                 |
@@ -161,8 +158,7 @@ login minter's, the forge host's and Grafana's, which reach more than one:
 | `swarm-review-classifier`, in its container                                                                                           | `reviewClassifierClientCertFile` / `reviewClassifierClientKeyFile` | `swarm/services/review-classifier/anthropic-api-key`, `swarm/services/review-classifier/acp-provider` and `swarm/services/<classifier client id>/oidc/client`                                                                                    |
 | `swarm-claude-login`, in its container                                                                                                | `claudeLoginClientCertFile` / `claudeLoginClientKeyFile`           | creates and updates `swarm/agents/+/claude-credentials`; reads `swarm/services/<minter client id>/oidc/client`                                                                                                                                   |
 | `swarm-notify-router`, in its container                                                                                               | `notifyRouterClientCertFile` / `notifyRouterClientKeyFile`         | `swarm/services/<router client id>/oidc/client`                                                                                                                                                                                                  |
-| `swarm-builder`, in its container                                                                                                     | `builderClientCertFile` / `builderClientKeyFile`                   | `swarm/services/builder/forge/token`, `swarm/services/attic/push-token` and `swarm/services/<builder client id>/oidc/client`                                                                                                                     |
-| `swarm-bao-attic-secret` and `swarm-bao-attic-tokens`                                                                                 | `atticClientCertFile` / `atticClientKeyFile`                       | creates and reads `swarm/services/attic/jwt-secret`, `swarm/services/attic/push-token` and `swarm/services/attic/pull-token`                                                                                                                     |
+| `swarm-builder`, in its container                                                                                                     | `builderClientCertFile` / `builderClientKeyFile`                   | `swarm/services/builder/forge/token` and `swarm/services/<builder client id>/oidc/client`                                                                                                                                                        |
 | `swarm-ci-metrics`                                                                                                                    | `ciMetricsClientCertFile` / `ciMetricsClientKeyFile`               | `swarm/services/ci-metrics/forge/token` and `swarm/services/<poller client id>/oidc/client`                                                                                                                                                      |
 | `swarm-bao-forge-oidc` and the forge's controller-token mint and its journal forwarder in its container                               | `forgePublisherClientCertFile` / `forgePublisherClientKeyFile`     | writes `swarm/controller/swarm-controller/forge/token`; reads `swarm/services/<forge client id>/oidc/client` and `swarm/services/<forge forwarder client id>/oidc/client`                                                                        |
 
diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md
index 8ecfc0b7..13597a34 100644
--- a/docs/swarm/credentials.md
+++ b/docs/swarm/credentials.md
@@ -416,19 +416,19 @@ each is enough and their subjects are the flat
 `deploy.bao.grafanaOidcCommonName`, `deploy.bao.otelOidcCommonName`,
 `deploy.bao.forwarderOidcCommonName`, `deploy.bao.ciRunnerCommonName`,
 `deploy.bao.reviewClassifierCommonName`, `deploy.bao.builderCommonName`,
-`deploy.bao.ciMetricsCommonName`, `deploy.bao.atticCommonName`,
-`deploy.bao.claudeLoginCommonName` and `deploy.bao.forgePublisherCommonName`.
-The last three are the writers, and the last is the one leaf two units share:
+`deploy.bao.ciMetricsCommonName`, `deploy.bao.claudeLoginCommonName` and
+`deploy.bao.forgePublisherCommonName`.
+The last two are the writers, and the last is the one leaf two units share:
 the forge's host holds one store identity for the token it publishes and the
 OIDC client secret it reads.
 
-On a host that mints its own PKI, `glue-bao-tls.nix` signs all ten and defaults
-all twenty options, and there is nothing to do. Elsewhere you copy each leaf from
+On a host that mints its own PKI, `glue-bao-tls.nix` signs all nine and defaults
+all eighteen options, and there is nothing to do. Elsewhere you copy each leaf from
 the store's host and name it here: a service principal's from the top of
 `/var/lib/swarm-bao-pki/`, another hive's leaves from
 `/var/lib/swarm-bao-pki/hives/<hive>/` ([bao.md § TLS](bao.md#tls) lists that
 directory). That's one file per principal rather than one file
-shared by ten, which is the whole of what this buys. `swarm-ci-runner.nix`
+shared by nine, which is the whole of what this buys. `swarm-ci-runner.nix`
 refuses the build wherever the runner runs without its pair, as
 `swarm-review-classifier.nix` does for the classifier, `swarm-ci-metrics.nix`
 for the CI run poller and `swarm-grafana.nix` for Grafana. The forge's pair refuses nothing: without
diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index 9d657007..62db9d6b 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -433,25 +433,6 @@ the private config repo with the read-only token of its own `builder` forge
 account. On a host without the store, that leaf is the one file to copy, as
 for the CI runner. What it builds and why are in [`builder.md`](builder.md).
 
-### Binary cache
-
-The swarm's attic server, in a `swarm-attic` container on the host that sets
-`deploy.attic.enable`. `allSwarmServices` defaults it on wherever the host has
-the cache's store identity, as for the builder: the host that runs the store has
-it. Set `deploy.attic.enable = lib.mkForce false` to use an external cache
-instead and name `swarm.attic.{domain,cache}` yourself.
-
-The container shares the host's network namespace and atticd listens on loopback
-only. The gateway serves it at `swarm.attic.domain` (default
-`attic.<swarm domain>`) over TLS, with no login in front, because attic checks
-its own tokens. Storage is local disk in the container's state.
-
-It needs no manual secret. Two host units, under the cache's own `attic` leaf,
-create its signing key, the cache and the push and pull tokens in the secret
-store, each only while absent. On a host without the store, that leaf is the one
-file to copy. The builder pushes green builds to it. How it works, and the
-external alternative, are in [`builder.md`](builder.md#binary-cache).
-
 ### CI metrics
 
 The CI run poller, a `swarm-ci-metrics` oneshot on a 5-minute timer on the host
diff --git a/nix/checks.nix b/nix/checks.nix
index 51640ee6..f84e74c4 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -68,10 +68,6 @@ in
   # Runs ./host-modules/lib/refresh-consumer.nix's restart decision under a
   # comma-decimal locale, against a stub `systemctl`.
   script-test-refresh-consumer = import ./script-tests/refresh-consumer.nix { inherit pkgs; };
-  # Runs ./host-modules/lib/attic-init.nix's two scripts, which create the swarm
-  # cache's key, cache and tokens, twice over against stub tools: the second
-  # run must mint nothing.
-  script-test-attic-init = import ./script-tests/attic-init.nix { inherit pkgs; };
   module-eval-nats-tls = import ./module-eval/nats-tls.nix {
     inherit pkgs self nixosSystem;
     inherit (pkgs) lib;
diff --git a/nix/host-modules/default.nix b/nix/host-modules/default.nix
index fdb721f5..cd5d6363 100644
--- a/nix/host-modules/default.nix
+++ b/nix/host-modules/default.nix
@@ -62,8 +62,6 @@
     ./glue-swarm-otel-oidc-client.nix
     ./glue-victorialogs-otel-oidc-client.nix
     ./glue-victoriametrics-otel-oidc-client.nix
-    ./swarm-attic-options.nix
-    ./swarm-attic.nix
     ./swarm-authelia-service.nix
     ./swarm-authelia.nix
     ./swarm-bao-service.nix
diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index 4640b9d6..67c79238 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -505,28 +505,6 @@ in
       '';
     };
 
-    attic.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = ''
-        Run the swarm's binary cache in a `swarm-attic` container on this
-        host: an attic server behind the gateway, with its signing key, its
-        cache and its push and pull tokens created in the secret store on first
-        start. The swarm builder pushes green builds to it. Run it on one host.
-
-        On by default where
-        {option}`services.hyperhive.deploy.allSwarmServices` is set and this
-        host has the cache's store identity (the pair
-        {option}`services.hyperhive.deploy.bao.atticClientCertFile` and
-        `atticClientKeyFile`, minted on the store's host).
-
-        With it on, {option}`services.hyperhive.swarm.attic.domain` and `cache`
-        default to the cache's own name and cache; naming either yourself wins.
-        With it off, those two options name an external cache or stay unset.
-      '';
-    };
-
     hive-controller.enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
diff --git a/nix/host-modules/glue-bao-readers-policy-order.nix b/nix/host-modules/glue-bao-readers-policy-order.nix
index 4be4c384..5401dcab 100644
--- a/nix/host-modules/glue-bao-readers-policy-order.nix
+++ b/nix/host-modules/glue-bao-readers-policy-order.nix
@@ -79,16 +79,6 @@ let
       here = deployCfg.grafana.enable;
       policies = [ "swarm-bao-grafana-oidc-policy" ];
     };
-    # ./swarm-attic.nix, under the cache's leaf, which may create the signing
-    # key and the two tokens only once that policy is written.
-    swarm-bao-attic-secret = {
-      here = deployCfg.attic.enable;
-      policies = [ "swarm-bao-attic-policy" ];
-    };
-    swarm-bao-attic-tokens = {
-      here = deployCfg.attic.enable;
-      policies = [ "swarm-bao-attic-policy" ];
-    };
     # ./hive-matrix.nix, under matrix-ctl's leaf.
     swarm-bao-matrix-oidc = {
       here = deployCfg.matrix.enable;
diff --git a/nix/host-modules/glue-bao-readers-store-order.nix b/nix/host-modules/glue-bao-readers-store-order.nix
index e385f556..b746a2c8 100644
--- a/nix/host-modules/glue-bao-readers-store-order.nix
+++ b/nix/host-modules/glue-bao-readers-store-order.nix
@@ -60,9 +60,6 @@ let
     swarm-bao-nats-callout-xkey = deployCfg.nats.enable;
     # ./swarm-ci-runner.nix
     swarm-bao-ci-runner = deployCfg.ci-runner.enable;
-    # ./swarm-attic.nix
-    swarm-bao-attic-secret = deployCfg.attic.enable;
-    swarm-bao-attic-tokens = deployCfg.attic.enable;
     # ./swarm-otel.nix
     swarm-bao-otel-oidc =
       deployCfg.swarm-otel.enable
diff --git a/nix/host-modules/glue-bao-tls.nix b/nix/host-modules/glue-bao-tls.nix
index d7b44cb4..71286f26 100644
--- a/nix/host-modules/glue-bao-tls.nix
+++ b/nix/host-modules/glue-bao-tls.nix
@@ -124,8 +124,6 @@ in
       claudeLoginClientKeyFile = lib.mkDefault "${pkiDir}/claude-login-key.pem";
       notifyRouterClientCertFile = lib.mkDefault "${pkiDir}/notify-router.pem";
       notifyRouterClientKeyFile = lib.mkDefault "${pkiDir}/notify-router-key.pem";
-      atticClientCertFile = lib.mkDefault "${pkiDir}/attic.pem";
-      atticClientKeyFile = lib.mkDefault "${pkiDir}/attic-key.pem";
       forgePublisherClientCertFile = lib.mkDefault "${pkiDir}/forge-publisher.pem";
       forgePublisherClientKeyFile = lib.mkDefault "${pkiDir}/forge-publisher-key.pem";
       servicesIssuerClientCertFile = lib.mkDefault "${pkiDir}/services-issuer.pem";
@@ -330,13 +328,6 @@ in
         [ -s ${pkiDir}/notify-router.pem ] || ${signLeaf} ${pkiDir} notify-router \
           ${lib.escapeShellArg deployCfg.bao.notifyRouterCommonName} "" clientAuth
 
-        # The in-swarm cache's, which creates and reads its three secrets.
-        # Minted here for the matrix-ctl leaf's reason: the cache is a swarm
-        # service, so on a cache host without the store this is the file an
-        # operator copies.
-        [ -s ${pkiDir}/attic.pem ] || ${signLeaf} ${pkiDir} attic \
-          ${lib.escapeShellArg deployCfg.bao.atticCommonName} "" clientAuth
-
         # The forge's token publisher. Minted here for the matrix-ctl leaf's
         # reason: the forge is a swarm singleton, so on a forge host without the
         # store this is the file an operator copies.
diff --git a/nix/host-modules/lib/attic-init.nix b/nix/host-modules/lib/attic-init.nix
deleted file mode 100644
index 6b00fa96..00000000
--- a/nix/host-modules/lib/attic-init.nix
+++ /dev/null
@@ -1,165 +0,0 @@
-# The shell for the in-swarm cache's first start: what its two host units run
-# after they log in to the secret store under the cache's own certificate.
-# Each secret is created only while the store holds none, so a second run reads
-# what the first one stored and mints nothing.
-#
-# Pure function — NOT a NixOS module. Call it from a module's `let`:
-#
-#   atticInit = import ./lib/attic-init.nix { inherit lib; } { … };
-#   script = ''
-#     ${atticInit.prelude}
-#     ${atticInit.ensureJwt}
-#   '';
-#
-# `prelude` expects `./atomic-write-secret.nix` and `./refresh-consumer.nix`
-# above it, and `bao`, `coreutils` and `systemd` on the caller's `path`.
-# `ensureJwt` also wants `openssl` there; `provision` wants `atticadm`, `attic`
-# and `curl`.
-{ lib }:
-{
-  # Store paths in the form `bao kv` takes, mount first.
-  jwtPath,
-  pullPath,
-  pushPath,
-  # The cache's name on the server.
-  cache,
-  # Where the host reaches atticd, scheme included.
-  endpoint,
-  # The server's config file, which the host's `atticadm` reads as well.
-  configFile,
-  # The file atticd loads its signing key from, and the container that does.
-  envFile,
-  machine,
-  unit,
-}:
-let
-  q = lib.escapeShellArg;
-in
-{
-  prelude = ''
-    err="$(mktemp)"
-    work="$(mktemp -d)"
-    trap 'rm -rf "$err" "$work"' EXIT
-
-    if ! BAO_TOKEN="$(bao login -method=cert -token-only 2>"$err")"; then
-      echo "could not log in to swarm-bao with the cache's certificate; leaving the cache as it is." >&2
-      cat "$err" >&2
-      exit 1
-    fi
-    export BAO_TOKEN
-
-    # <store path> <mint function>: the stored value, created with the
-    # function's output first while the store holds none. `bao kv get` exits 2
-    # both for "nothing stored" and for a refusal, so a failed read always
-    # tries the create, which `-cas=0` refuses when the path exists, and the
-    # second read decides. The value reaches `bao` on stdin, never in an
-    # argument.
-    ensure_secret() {
-      local path="$1" mint="$2" value minted
-      if ! value="$(bao kv get -field=value "$path" 2>"$err")"; then
-        minted="$("$mint")" || return 1
-        if [ -z "$minted" ]; then
-          echo "minting $path produced nothing." >&2
-          return 1
-        fi
-        if ! printf '%s' "$minted" | bao kv put -cas=0 "$path" value=- >/dev/null 2>"$err"; then
-          echo "could not create $path; reading it back in case another run created it." >&2
-          cat "$err" >&2
-        fi
-        if ! value="$(bao kv get -field=value "$path" 2>"$err")"; then
-          echo "swarm-bao did not return $path." >&2
-          cat "$err" >&2
-          return 1
-        fi
-      fi
-      if [ -z "$value" ]; then
-        echo "swarm-bao returned an empty $path." >&2
-        return 1
-      fi
-      printf '%s' "$value"
-    }
-  '';
-
-  # The signing key atticd verifies tokens with, and the file it loads it from.
-  # The key is a base64 RSA PEM in PKCS#1 form, which is what `-traditional`
-  # asks for.
-  ensureJwt = ''
-    mint_jwt() {
-      openssl genrsa -traditional 4096 2>/dev/null | base64 -w0
-    }
-
-    jwt="$(ensure_secret ${q jwtPath} mint_jwt)" || exit 1
-    line="ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=$jwt"
-    if secret_differs ${q envFile} "$line"; then
-      atomic_write_secret 0400 "" ${q envFile} "$line"
-    fi
-
-    # atticd reads the key as it starts, and only then.
-    refresh_consumer ${q machine} ${q unit} ${q envFile}
-  '';
-
-  # The cache and the two tokens, once atticd answers. The tokens are signed
-  # here with the key the store holds; the cache is created through the API by a
-  # token that lives for five minutes and is never stored.
-  provision = ''
-    up=0
-    for _ in $(seq 1 30); do
-      if curl -s -o /dev/null --max-time 2 ${q endpoint}; then
-        up=1
-        break
-      fi
-      sleep 2
-    done
-    if [ "$up" != 1 ]; then
-      echo "atticd did not answer at ${endpoint}." >&2
-      exit 1
-    fi
-
-    if ! jwt="$(bao kv get -field=value ${q jwtPath} 2>"$err")" || [ -z "$jwt" ]; then
-      echo "swarm-bao did not return ${jwtPath}; the cache's tokens are not minted." >&2
-      cat "$err" >&2
-      exit 1
-    fi
-    export ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$jwt"
-
-    # <subject> <validity> <grant…>
-    mint_token() {
-      local sub="$1" validity="$2"
-      shift 2
-      atticadm -f ${q configFile} make-token --sub "$sub" --validity "$validity" "$@"
-    }
-    mint_pull() { mint_token swarm-hives-pull 10y --pull ${q cache}; }
-    mint_push() { mint_token swarm-builder-push 10y --pull ${q cache} --push ${q cache}; }
-
-    pull="$(ensure_secret ${q pullPath} mint_pull)" || exit 1
-    ensure_secret ${q pushPath} mint_push >/dev/null || exit 1
-
-    # The client reads its token from a file, so the token is in no argument.
-    export XDG_CONFIG_HOME="$work"
-    use_token() {
-      install -d -m 0700 "$work/attic"
-      (umask 077 && printf '%s' "$1" >"$work/token")
-      printf 'default-server = "local"\n\n[servers.local]\nendpoint = "%s"\ntoken-file = "%s"\n' \
-        ${q endpoint} "$work/token" >"$work/attic/config.toml"
-    }
-
-    # The pull token reads the cache's configuration when the cache exists, so
-    # a cache that is there costs no token. The server's database can be empty
-    # while the store still holds both tokens.
-    use_token "$pull"
-    if ! attic cache info ${q "local:${cache}"} >/dev/null 2>"$err"; then
-      admin="$(mint_token swarm-attic-init 5m --create-cache ${q cache} --pull ${q cache})" || exit 1
-      use_token "$admin"
-      if ! attic cache create ${q "local:${cache}"} >/dev/null 2>"$err"; then
-        echo "could not create the cache ${cache}; checking whether another run did." >&2
-        cat "$err" >&2
-      fi
-      use_token "$pull"
-      if ! attic cache info ${q "local:${cache}"} >/dev/null 2>"$err"; then
-        echo "the cache ${cache} is not there after creating it." >&2
-        cat "$err" >&2
-        exit 1
-      fi
-    fi
-  '';
-}
diff --git a/nix/host-modules/swarm-attic-options.nix b/nix/host-modules/swarm-attic-options.nix
deleted file mode 100644
index 222d6ae8..00000000
--- a/nix/host-modules/swarm-attic-options.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-# The binary cache the swarm pushes agent closures to, as every host sees it:
-# which attic server, and which cache on it. A host that sets
-# `deploy.attic.enable` runs the swarm's own and fills both in (./swarm-attic.nix);
-# otherwise the instance is the operator's, outside the swarm.
-{ lib, config, ... }:
-let
-  swarmDomain = config.services.hyperhive.swarm.domain;
-
-  # Total on a null swarm domain, as every sibling module is: the
-  # required-domain assertion in hive-network.nix is what an operator should
-  # see, not a coercion error from here.
-  domainBase = if swarmDomain == null then "invalid" else swarmDomain;
-in
-{
-  options.services.hyperhive.swarm.attic = {
-    ownDomain = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      default = "attic.${domainBase}";
-      defaultText = lib.literalExpression ''"attic.''${services.hyperhive.swarm.domain}"'';
-      description = ''
-        Read-only: the name the swarm's own cache is served under, which
-        {option}`services.hyperhive.deploy.attic.enable` defaults
-        {option}`services.hyperhive.swarm.attic.domain` to. A sibling of the
-        swarm's other service names, so the swarm-services sub-CA can issue for it,
-        and in `swarm.serviceDomains` on every host whether or not one runs it.
-      '';
-    };
-
-    domain = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "cache.example.org";
-      description = ''
-        Name of the attic server, with no scheme: the swarm builder pushes to
-        `https://<domain>`, and trusts the certificate the system roots do, so
-        a Let's Encrypt certificate works and none is pinned. Set together with
-        {option}`services.hyperhive.swarm.attic.cache`; evaluation fails when only
-        one is set.
-
-        Null pushes nothing: the swarm builder does not push, and the closure
-        record says it is not cached.
-
-        {option}`services.hyperhive.deploy.attic.enable` defaults this to
-        `attic.<swarm.domain>` on the host that runs the swarm's own cache. Every
-        other host reads it from the same option, so name it there too.
-
-        The push token is not an option. It is at
-        `secret/swarm/services/attic/push-token` in the swarm secret store
-        (field `value`), and the builder reads it on every push. The swarm's own
-        cache creates it; for an external cache the operator writes it.
-      '';
-    };
-
-    cache = lib.mkOption {
-      # attic's own rule for a cache name; the builder checks the same at start.
-      type = lib.types.nullOr (lib.types.strMatching "^[A-Za-z0-9][A-Za-z0-9_+-]{0,49}$");
-      default = null;
-      example = "grid";
-      description = ''
-        Name of the cache on {option}`services.hyperhive.swarm.attic.domain`
-        that the swarm builder pushes closures to, `swarm` by default on the
-        host that runs the swarm's own cache. The push token must be allowed to
-        push to it. The name follows attic's rule: 1 to 50 letters,
-        digits, `-`, `_` or `+`, starting with a letter or digit.
-      '';
-    };
-  };
-}
diff --git a/nix/host-modules/swarm-attic.nix b/nix/host-modules/swarm-attic.nix
deleted file mode 100644
index d9527052..00000000
--- a/nix/host-modules/swarm-attic.nix
+++ /dev/null
@@ -1,332 +0,0 @@
-# The swarm's binary cache: an attic server in a `swarm-attic` container on the
-# host that sets `deploy.attic.enable`, which `deploy.allSwarmServices` defaults
-# on where the host has the cache's store identity. The swarm builder pushes
-# green builds to it (docs/swarm/builder.md).
-#
-# Two host units run under the cache's own store leaf, the shape
-# ./swarm-grafana.nix gives its admin password. One creates the key atticd signs
-# tokens with, if the store holds none, and hands it to the container. The other
-# creates the cache and the push and pull tokens, each only while absent
-# (./lib/attic-init.nix). Neither needs a manual step.
-#
-# The container shares the host's network namespace, as ./swarm-victorialogs.nix
-# does, and atticd listens on loopback only: the gateway's vhost is the way in,
-# and attic's own tokens are the authentication. Storage is local disk under the
-# container's state.
-#
-# The two `swarm.attic` options every host reads (./swarm-attic-options.nix) get
-# their values from here, at `mkDefault`: naming them yourself wins, and with
-# the switch off nothing is set.
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  hyperhiveCfg = config.services.hyperhive;
-  cfg = hyperhiveCfg.deploy.attic;
-  atticCfg = hyperhiveCfg.swarm.attic;
-  baoCfg = hyperhiveCfg.swarm.bao;
-  baoDeploy = hyperhiveCfg.deploy.bao;
-
-  machine = "swarm-attic";
-  unit = "swarm-attic";
-
-  # Where the container keeps its database and the cache's files.
-  stateName = "swarm-attic";
-  stateDir = "/var/lib/${stateName}";
-
-  # The host directory that carries the signing key into the container. The
-  # key's file is the only thing in it.
-  secretDir = "/run/swarm-attic-secrets";
-  envFile = "${secretDir}/server.env";
-
-  # Where the host units reach atticd: the shared loopback, not the gateway.
-  endpoint = "http://127.0.0.1:${toString cfg.port}";
-
-  configFile = (pkgs.formats.toml { }).generate "swarm-attic.toml" {
-    listen = "127.0.0.1:${toString cfg.port}";
-    # What clients are told to use for the cache's API.
-    api-endpoint = "https://${atticCfg.domain}/";
-    database.url = "sqlite://${stateDir}/server.db?mode=rwc";
-    storage = {
-      type = "local";
-      path = "${stateDir}/storage";
-    };
-    # attic's defaults, which its config requires spelled out.
-    chunking = {
-      nar-size-threshold = 65536;
-      min-size = 16384;
-      avg-size = 65536;
-      max-size = 262144;
-    };
-    garbage-collection = {
-      interval = "12 hours";
-      default-retention-period = cfg.retentionPeriod;
-    };
-  };
-
-  atticInit = import ./lib/attic-init.nix { inherit lib; } {
-    jwtPath = "secret/swarm/services/attic/jwt-secret";
-    pullPath = "secret/swarm/services/attic/pull-token";
-    pushPath = "secret/swarm/services/attic/push-token";
-    cache = atticCfg.cache;
-    inherit
-      endpoint
-      configFile
-      envFile
-      machine
-      unit
-      ;
-  };
-
-  atomicWriteSecret = import ./lib/atomic-write-secret.nix { };
-  refreshConsumer = import ./lib/refresh-consumer.nix { };
-  storeRetry = import ./lib/store-retry.nix { };
-
-  haveClientIdentity = baoDeploy.atticClientCertFile != null && baoDeploy.atticClientKeyFile != null;
-
-  # Both host units log in as the cache's principal.
-  storeEnvironment = {
-    BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
-    BAO_CLIENT_CERT = baoDeploy.atticClientCertFile;
-    BAO_CLIENT_KEY = baoDeploy.atticClientKeyFile;
-  }
-  // lib.optionalAttrs (baoDeploy.serverCaFile != null) {
-    BAO_CACERT = baoDeploy.serverCaFile;
-  };
-in
-{
-  options.services.hyperhive.deploy.attic = {
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.attic-server;
-      defaultText = lib.literalExpression "pkgs.attic-server";
-      description = "The attic server package: `atticd`, and `atticadm` for the tokens.";
-    };
-
-    clientPackage = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.attic-client;
-      defaultText = lib.literalExpression "pkgs.attic-client";
-      description = "The attic client package, which creates the cache.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8910;
-      description = ''
-        Loopback port atticd listens on, which the gateway proxies to.
-
-        ⚠️ Every swarm container shares the host's network namespace, so this
-        is a swarm-wide claim: two modules picking the same number collide at
-        runtime with no bind error. No repo-wide check catches it.
-      '';
-    };
-
-    retentionPeriod = lib.mkOption {
-      type = lib.types.str;
-      default = "14 days";
-      example = "30 days";
-      description = ''
-        How long a store path stays in the cache after it was added or last
-        fetched. A garbage collection every twelve hours removes what is older;
-        a build the cache no longer holds is rebuilt on the next miss.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.hyperhive.swarm.attic = {
-      domain = lib.mkDefault atticCfg.ownDomain;
-      cache = lib.mkDefault "swarm";
-    };
-
-    assertions = [
-      {
-        assertion = haveClientIdentity;
-        message = ''
-          services.hyperhive.deploy.attic.enable requires the cache's
-          swarm-secret-store client identity: set both
-
-            services.hyperhive.deploy.bao.atticClientCertFile
-            services.hyperhive.deploy.bao.atticClientKeyFile
-
-          The cache creates its signing key and tokens in the store with it.
-
-          Both default to the pair glue-bao-tls.nix mints when
-          services.hyperhive.deploy.bao.enable is true (the host that runs the
-          store). Otherwise copy attic.pem and attic-key.pem from the store
-          host's /var/lib/swarm-bao-pki/ and name them in those two options.
-        '';
-      }
-      {
-        assertion = atticCfg.domain != null && atticCfg.cache != null;
-        message = ''
-          services.hyperhive.deploy.attic.enable needs
-          services.hyperhive.swarm.attic.domain and
-          services.hyperhive.swarm.attic.cache: it serves the cache at that name
-          and creates it by that name. They default when unset, so one of them
-          is set to null.
-        '';
-      }
-    ];
-
-    services.hyperhive.gateway.localNames = [ atticCfg.domain ];
-
-    # This host serves the vhost, and the host's own resolver finds the name.
-    services.hyperhive.gateway.enable = lib.mkDefault true;
-    services.hyperhive.gateway.dns.enable = lib.mkDefault true;
-
-    # `forceSSL`: the tokens ride in a header. No `auth_request`: attic checks
-    # its own tokens, and a nix client cannot follow a login redirect. A store
-    # path is uploaded as one request that can run for minutes, so the body is
-    # neither size-limited nor buffered.
-    services.hyperhive.gateway.vhosts."${atticCfg.domain}" = {
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-        extraConfig = ''
-          client_max_body_size 0;
-          proxy_request_buffering off;
-          proxy_read_timeout 1h;
-          proxy_send_timeout 1h;
-        '';
-      };
-    };
-
-    # The key's directory is the container's read-only bind source, so it has
-    # to exist before the container starts even when the store does not answer.
-    # The delivery unit creates it too, which covers a switch.
-    systemd.tmpfiles.rules = [ "d ${secretDir} 0700 root root -" ];
-
-    # The signing key, created in the store if it holds none and written where
-    # the container reads it. Before the container and wanted by it: a store
-    # that comes up later fails this run, atticd restarts until the file is
-    # there, and the retry that lands it restarts atticd.
-    systemd.services.swarm-bao-attic-secret = {
-      description = "create the swarm cache's signing key in the secret store if absent and hand it to the container";
-      # Ordered after the store where it runs here:
-      # ./glue-bao-readers-store-order.nix and ./glue-bao-readers-policy-order.nix.
-      before = [ "container@${machine}.service" ];
-      wantedBy = [
-        "multi-user.target"
-        "container@${machine}.service"
-      ];
-      path = [
-        baoDeploy.package
-        pkgs.coreutils
-        pkgs.openssl
-        pkgs.systemd
-      ];
-      inherit (storeRetry) startLimitBurst startLimitIntervalSec;
-      serviceConfig = storeRetry.serviceConfig // {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        SyslogIdentifier = "swarm-bao-attic-secret";
-        # Generating a 4096-bit key takes seconds.
-        TimeoutStartSec = 120;
-      };
-      environment = storeEnvironment;
-      script = ''
-        set -euo pipefail
-
-        ${atomicWriteSecret}
-        ${refreshConsumer}
-
-        install -d -m 0700 ${lib.escapeShellArg secretDir}
-
-        ${atticInit.prelude}
-        ${atticInit.ensureJwt}
-      '';
-    };
-
-    # The cache and its two tokens, once atticd answers. The push token is the
-    # path the swarm builder reads; the pull token is for the hives.
-    systemd.services.swarm-bao-attic-tokens = {
-      description = "create the swarm cache, and its push and pull tokens in the secret store, if absent";
-      after = [
-        "container@${machine}.service"
-        "swarm-bao-attic-secret.service"
-      ];
-      wants = [ "container@${machine}.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [
-        baoDeploy.package
-        cfg.package
-        cfg.clientPackage
-        pkgs.coreutils
-        pkgs.curl
-      ];
-      inherit (storeRetry) startLimitBurst startLimitIntervalSec;
-      serviceConfig = storeRetry.serviceConfig // {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        SyslogIdentifier = "swarm-bao-attic-tokens";
-        # Up to a minute waiting for atticd.
-        TimeoutStartSec = 180;
-      };
-      environment = storeEnvironment;
-      script = ''
-        set -euo pipefail
-
-        ${atticInit.prelude}
-        ${atticInit.provision}
-      '';
-    };
-
-    containers.${machine} = {
-      autoStart = true;
-      ephemeral = false;
-      privateNetwork = false;
-      bindMounts.${secretDir} = {
-        hostPath = secretDir;
-        isReadOnly = true;
-      };
-
-      config =
-        { ... }:
-        {
-          imports = [ ../container-modules/swarm-container.nix ];
-
-          services.hyperhive.swarmContainer.privateNetwork = false;
-
-          systemd.services.${unit} = {
-            description = "attic binary cache server";
-            wantedBy = [ "multi-user.target" ];
-            serviceConfig = {
-              ExecStart = "${cfg.package}/bin/atticd -f ${configFile} --mode monolithic";
-              # The signing key, in an environment file the host unit writes.
-              EnvironmentFile = envFile;
-              StateDirectory = stateName;
-              DynamicUser = true;
-              Restart = "on-failure";
-              RestartSec = 10;
-              SyslogIdentifier = unit;
-              UMask = "0077";
-              CapabilityBoundingSet = [ "" ];
-              NoNewPrivileges = true;
-              PrivateDevices = true;
-              PrivateTmp = true;
-              ProtectSystem = "strict";
-              ProtectHome = true;
-              ProtectKernelTunables = true;
-              ProtectKernelModules = true;
-              ProtectControlGroups = true;
-              RestrictAddressFamilies = [
-                "AF_INET"
-                "AF_INET6"
-                "AF_UNIX"
-              ];
-              RestrictNamespaces = true;
-              RestrictRealtime = true;
-              RestrictSUIDSGID = true;
-              LockPersonality = true;
-              SystemCallArchitectures = "native";
-            };
-          };
-        };
-    };
-  };
-}
diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 99f32317..c27b4ac1 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -692,17 +692,6 @@ let
   # to fetch config repos.
   builderForgeTokenLeaf = "swarm/services/builder/forge/token";
 
-  # The token the swarm builder pushes closures to the binary cache with, the nix
-  # half of `swarm_secret_client::builder::attic_push_token_path`. The builder
-  # reads it on every push. The operator writes it for an external cache; the
-  # in-swarm cache's host units create it.
-  atticPushTokenLeaf = "swarm/services/attic/push-token";
-
-  # The in-swarm cache's other two secrets, which its host units create: the
-  # key atticd signs tokens with, and the read-only token for the hives' pulls.
-  atticJwtLeaf = "swarm/services/attic/jwt-secret";
-  atticPullTokenLeaf = "swarm/services/attic/pull-token";
-
   # The CI run poller's forge token, the nix half of
   # `swarm_secret_client::ci_metrics::forge_token_path`. The controller mints it
   # and reads it back before deciding whether to re-mint; the poller reads it
@@ -1157,42 +1146,18 @@ let
     }
   ];
 
-  # The swarm builder: its forge token, read once per build, the cache push token,
-  # read once per push, and its own queue client secret, read at start. All by the
-  # daemon inside its container.
+  # The swarm builder: its forge token, read once per build, and its own queue
+  # client secret, read at start. Both by the daemon inside its container.
   builderReaders = [
     {
       name = "swarm-builder";
       cn = baoDeploy.builderCommonName;
       policyText =
         readStanza "${credentialMountPath}/data/${builderForgeTokenLeaf}"
-        + readStanza "${credentialMountPath}/data/${atticPushTokenLeaf}"
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.builder.clientId}/oidc/client";
     }
   ];
 
-  # The in-swarm cache's three secrets, create and read and nothing more: its
-  # host units create each one only while it is absent, so none needs `update`,
-  # and a rewrite of a signing key or a token an operator holds is refused.
-  atticWriters = [
-    {
-      name = "swarm-attic";
-      cn = baoDeploy.atticCommonName;
-      policyText =
-        lib.concatMapStrings
-          (leaf: ''
-            path "${credentialMountPath}/data/${leaf}" {
-              capabilities = ["create", "read"]
-            }
-          '')
-          [
-            atticJwtLeaf
-            atticPushTokenLeaf
-            atticPullTokenLeaf
-          ];
-    }
-  ];
-
   # The CI run poller: its forge token and its own OIDC client secret, both
   # read once per pass by the host unit.
   ciMetricsReaders = [
@@ -2116,8 +2081,8 @@ in
       description = ''
         Subject the store's `swarm-builder` cert-auth role accepts: the
         identity the swarm builder presents from inside its container. Its
-        grant is three paths, read only: `swarm/services/builder/forge/token`,
-        `swarm/services/attic/push-token` and its own queue client secret.
+        grant is two paths, read only: `swarm/services/builder/forge/token`
+        and its own queue client secret.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
       '';
@@ -2436,43 +2401,6 @@ in
       '';
     };
 
-    atticCommonName = lib.mkOption {
-      type = lib.types.str;
-      default = "swarm-attic";
-      description = ''
-        Subject the store's `swarm-attic` cert-auth role accepts: the identity
-        the in-swarm cache's host units present. Its grant is create and read on
-        three paths, `swarm/services/attic/jwt-secret`, `push-token` and
-        `pull-token`, and nothing else.
-
-        ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
-      '';
-    };
-
-    atticClientCertFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "/var/lib/swarm-bao-pki/attic.pem";
-      description = ''
-        Certificate the in-swarm cache's host units present to the store. Its
-        subject must be {option}`services.hyperhive.deploy.bao.atticCommonName`.
-
-        ./glue-bao-tls.nix points it at the leaf it mints on the store's host.
-        On a cache host without the store, it is a file the operator copies
-        from the store's host. A path, never a value.
-      '';
-    };
-
-    atticClientKeyFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "/var/lib/swarm-bao-pki/attic-key.pem";
-      description = ''
-        Private key for {option}`services.hyperhive.deploy.bao.atticClientCertFile`.
-        A path, never a value.
-      '';
-    };
-
     claudeLoginClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -3635,8 +3563,6 @@ in
 
       systemd.services.swarm-bao-claude-login-policy = readerPolicyUnit "write the claude login minter's credentials-writer bao policy and cert-auth role" claudeLoginWriters;
 
-      systemd.services.swarm-bao-attic-policy = readerPolicyUnit "write the in-swarm cache's secret-creator bao policy and cert-auth role" atticWriters;
-
       systemd.services.swarm-bao-notify-router-policy = readerPolicyUnit "write the notification router's client-secret-reader bao policy and cert-auth role" notifyRouterReaders;
 
       systemd.services.swarm-bao-forge-publisher-policy = readerPolicyUnit "write the forge's controller-token-publisher bao policy and cert-auth role" forgePublisherWriters;
diff --git a/nix/host-modules/swarm-builder.nix b/nix/host-modules/swarm-builder.nix
index 1fb12bd7..d8ddf1ac 100644
--- a/nix/host-modules/swarm-builder.nix
+++ b/nix/host-modules/swarm-builder.nix
@@ -17,8 +17,8 @@
 #
 # The container holds one credential, its own store leaf, which nspawn hands in
 # as a system credential with no copy on disk. The daemon reads everything else
-# from the store with it: its queue client secret at start, its forge token
-# on every build and, where a cache is set, its cache push token on every push.
+# from the store with it: its queue client secret at start and its forge token
+# on every build.
 {
   pkgs,
   lib,
@@ -33,7 +33,6 @@ let
   natsCfg = hyperhiveCfg.swarm.nats;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   forgeCfg = hyperhiveCfg.swarm.forge;
-  atticCfg = hyperhiveCfg.swarm.attic;
   gatewayCfg = hyperhiveCfg.gateway;
   networkCfg = hyperhiveCfg.network;
   tlsCfg = hyperhiveCfg.deploy.hive-controller.tls;
@@ -90,9 +89,6 @@ let
   hyperhiveFlake = hyperhiveCfg.c0re.hyperhiveFlake;
   nixpkgsFlake = hyperhiveCfg.c0re.nixpkgsFlake;
 
-  # The assertion below keeps the two options together.
-  pushesToCache = atticCfg.domain != null;
-
   privateNetwork = true;
 in
 {
@@ -133,14 +129,6 @@ in
           host's /var/lib/swarm-bao-pki/ and name them in those two options.
         '';
       }
-      {
-        assertion = (atticCfg.domain == null) == (atticCfg.cache == null);
-        message = ''
-          services.hyperhive.swarm.attic.domain and services.hyperhive.swarm.attic.cache
-          must be set together: the swarm builder pushes to a cache on a server, and
-          either alone names nothing to push to.
-        '';
-      }
       {
         assertion = lib.all oneWord (lib.attrValues storeFiles);
         message = ''
@@ -242,9 +230,8 @@ in
             wantedBy = [ "multi-user.target" ];
             wants = [ "network-online.target" ];
             after = [ "network-online.target" ];
-            # nix fetches the config repo with `git`, and a green build is pushed
-            # with `attic` where a cache is set.
-            path = [ pkgs.git ] ++ lib.optional pushesToCache pkgs.attic-client;
+            # nix fetches the config repo with `git`.
+            path = [ pkgs.git ];
             environment = {
               BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
               BAO_CLIENT_CERT = credential "builder-bao-cert";
@@ -265,10 +252,6 @@ in
               SWARM_BUILDER_FORGE_URL = "https://${forgeCfg.domain}";
               SWARM_BUILDER_CONFIG_ORG = "agent-configs";
             }
-            // lib.optionalAttrs pushesToCache {
-              SWARM_BUILDER_ATTIC_DOMAIN = atticCfg.domain;
-              SWARM_BUILDER_ATTIC_CACHE = atticCfg.cache;
-            }
             // lib.optionalAttrs (storeFiles ? builder-bao-server-ca) {
               BAO_CACERT = credential "builder-bao-server-ca";
             }
@@ -281,10 +264,6 @@ in
               ExecStart = "${cfg.package}/bin/swarm-builder";
               DynamicUser = true;
               CacheDirectory = unit;
-              # /run/swarm-builder, mode 0700 and owned by the dynamic user: the
-              # push writes its token file and `attic` config under it.
-              RuntimeDirectory = unit;
-              RuntimeDirectoryMode = "0700";
               # Bare ids: the system credentials nspawn handed in.
               LoadCredential = lib.attrNames storeFiles;
               Restart = "on-failure";
diff --git a/nix/host-modules/swarm-required-services.nix b/nix/host-modules/swarm-required-services.nix
index a7477fdb..9b6d6835 100644
--- a/nix/host-modules/swarm-required-services.nix
+++ b/nix/host-modules/swarm-required-services.nix
@@ -130,15 +130,6 @@ in
     && deployCfg.bao.ciMetricsClientKeyFile != null
   );
 
-  # The binary cache, on the same terms: its units log in to the store as the
-  # cache's own principal. An operator running an external cache sets this to
-  # `false` and names `swarm.attic.{domain,cache}` itself.
-  config.services.hyperhive.deploy.attic.enable = lib.mkDefault (
-    deployCfg.allSwarmServices
-    && deployCfg.bao.atticClientCertFile != null
-    && deployCfg.bao.atticClientKeyFile != null
-  );
-
   # The claude login minter, defaulted on the same terms as the review
   # classifier.
   config.services.hyperhive.deploy.claude-login.enable = lib.mkDefault (
diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix
index e3dd6dcd..1f15661b 100644
--- a/nix/host-modules/swarm.nix
+++ b/nix/host-modules/swarm.nix
@@ -62,7 +62,6 @@ let
     deployCfg.bao.ciMetricsCommonName
     deployCfg.bao.claudeLoginCommonName
     deployCfg.bao.notifyRouterCommonName
-    deployCfg.bao.atticCommonName
     deployCfg.bao.forgePublisherCommonName
   ]
   # The per-hive subject, spelled out per hive rather than as the prefix.
@@ -113,10 +112,6 @@ let
     swarmCfg.victoriametrics.domain
     swarmCfg.otel.domain
     swarmCfg.victorialogs.domain
-    # The name the swarm's own cache is served under, listed whether or not any
-    # host runs one, as every name here is. `swarm.attic.domain` is not: it is
-    # null where there is no cache and may name an external one.
-    swarmCfg.attic.ownDomain
     # The store's browser UI, not the store: `swarm.bao.domain` is mTLS and
     # never gets a gateway certificate.
     swarmCfg.bao.ui.domain
diff --git a/nix/module-eval/bao-grants.nix b/nix/module-eval/bao-grants.nix
index 42852ceb..1c3ad40b 100644
--- a/nix/module-eval/bao-grants.nix
+++ b/nix/module-eval/bao-grants.nix
@@ -163,7 +163,7 @@ let
     _: u: (u.environment.BAO_CLIENT_CERT or null) == granterCertFile
   ) baoGrantWithConsumers.systemd.services;
 
-  # The twenty-two units that write a `swarm-*` grant, by name, for the
+  # The twenty-one units that write a `swarm-*` grant, by name, for the
   # discovery control below.
   grantingUnitNames = [
     "swarm-bao-controller-policy"
@@ -187,7 +187,6 @@ let
     "swarm-bao-ci-metrics-policy"
     "swarm-bao-claude-login-policy"
     "swarm-bao-notify-router-policy"
-    "swarm-bao-attic-policy"
   ];
 
   # Comment lines dropped first: both the HCL and the scripts explain
@@ -1075,24 +1074,24 @@ let
     }
     {
       # A store host without the granter's pair writes its grants some other
-      # way, so none of the twenty-two units may exist. Without this arm
+      # way, so none of the twenty-one units may exist. Without this arm
       # `lib.mkIf haveGranter` could be dropped from any of them and every other
       # case here would still pass.
-      name = "without the granter's pair none of the twenty-two granting units render";
+      name = "without the granter's pair none of the twenty-one granting units render";
       ok =
         let
           s = baoGranterOptOut.systemd.services;
         in
         lib.all (unit: !(s ? ${unit})) (grantingUnitNames ++ [ "swarm-bao-granter-role" ])
-        # The control: the same store with the pair renders all twenty-two.
+        # The control: the same store with the pair renders all twenty-one.
         && lib.all (unit: baoGrantHere.systemd.services ? ${unit}) grantingUnitNames;
     }
     {
-      # 🩸 What replaced the silent skip. With no bootstrap token the twenty-two
+      # 🩸 What replaced the silent skip. With no bootstrap token the twenty-one
       # still render, and a refused granter fails them with the step that fixes it.
       # A store host that never named a token is told to name one, since the
       # unit that sets the granter up renders only where it has.
-      name = "a store host without a bootstrap token renders the twenty-two, each failing loudly with the one-time step";
+      name = "a store host without a bootstrap token renders the twenty-one, each failing loudly with the one-time step";
       ok =
         let
           s = baoGranterNoToken.systemd.services;
@@ -1744,18 +1743,17 @@ let
         ];
     }
     {
-      # The builder reads its forge token, the cache push token and its own queue
-      # client secret, each read-only and spelled to the leaf: `services/*` would
-      # reach every swarm service's secret.
-      name = "the swarm builder's grant is its forge token, the cache push token and its queue client secret, and nothing else";
+      # The builder reads its forge token and its own queue client secret,
+      # each read-only and spelled to the leaf: `services/*` would reach every
+      # swarm service's secret.
+      name = "the swarm builder's grant is its forge token and its queue client secret, and nothing else";
       ok =
         let
           s = baoGrantHere.systemd.services.swarm-bao-builder-policy.script;
         in
         lib.hasInfix "path \"secret/data/swarm/services/builder/forge/token\" {\n  capabilities = [\"read\"]\n}" s
-        && lib.hasInfix "path \"secret/data/swarm/services/attic/push-token\" {\n  capabilities = [\"read\"]\n}" s
         && lib.hasInfix "path \"secret/data/swarm/services/swarm-builder/oidc/client\" {\n  capabilities = [\"read\"]\n}" s
-        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 3
+        && lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 2
         && !(lib.hasInfix "secret/data/swarm/services/*" s)
         && lib.hasInfix "auth/cert/certs/swarm-builder" s
         && lib.hasInfix "allowed_common_names=swarm-builder" s
@@ -1938,48 +1936,6 @@ let
         in
         lib.hasInfix "/notify-router.pem ]" s && lib.hasInfix "swarm-notify-router \"\" clientAuth" s;
     }
-    {
-      # The cache's host units create each of its three secrets and read them
-      # back, and may not replace one: no `update`. The notification router's
-      # grant is the control that `grantsIn` reads a one-path grant too.
-      name = "the cache's grant is create and read on its signing key and its two tokens, and nothing else";
-      ok =
-        let
-          s = baoGrantHere.systemd.services.swarm-bao-attic-policy.script;
-          grants = grantsIn s;
-          caps = [
-            "create"
-            "read"
-          ];
-        in
-        (grantFor grants "secret/data/swarm/services/attic/jwt-secret").caps == caps
-        && (grantFor grants "secret/data/swarm/services/attic/push-token").caps == caps
-        && (grantFor grants "secret/data/swarm/services/attic/pull-token").caps == caps
-        && lib.length grants == 3
-        && lib.length (grantsIn baoGrantHere.systemd.services.swarm-bao-notify-router-policy.script) == 1
-        && lib.hasInfix "auth/cert/certs/swarm-attic" s
-        && lib.hasInfix "allowed_common_names=swarm-attic" s
-        && lib.hasInfix "token_policies=swarm-attic" s;
-    }
-    {
-      # The signing key and the pull token are the cache's alone; the push
-      # token is also the builder's, and is read there.
-      name = "no granting unit but the cache's names its signing key or its pull token";
-      ok =
-        lib.filter (
-          u:
-          lib.hasInfix "services/attic/jwt-secret" baoGrantHere.systemd.services.${u}.script
-          || lib.hasInfix "services/attic/pull-token" baoGrantHere.systemd.services.${u}.script
-        ) grantingUnitNames == [ "swarm-bao-attic-policy" ];
-    }
-    {
-      name = "the PKI unit signs the cache's leaf under its own subject";
-      ok =
-        let
-          s = baoGrantHere.systemd.services.swarm-bao-pki.script;
-        in
-        lib.hasInfix "/attic.pem ]" s && lib.hasInfix "swarm-attic \"\" clientAuth" s;
-    }
     {
       name = "the PKI unit signs the CI runner's leaf under its own subject";
       ok =
@@ -2264,8 +2220,8 @@ let
     }
     {
       # What makes the case above mean something: discovery by the granter's
-      # certificate reaches all twenty-two units, and each yields calls.
-      name = "the granter-policy check sees all twenty-two granting units, and parses calls from each";
+      # certificate reaches all twenty-one units, and each yields calls.
+      name = "the granter-policy check sees all twenty-one granting units, and parses calls from each";
       ok =
         lib.sort lib.lessThan (lib.attrNames granterUnits) == lib.sort lib.lessThan grantingUnitNames
         && lib.all (u: baoCalls u.script != [ ]) (lib.attrValues granterUnits)
diff --git a/nix/module-eval/builder.nix b/nix/module-eval/builder.nix
index e1ee2ca9..4cfcb075 100644
--- a/nix/module-eval/builder.nix
+++ b/nix/module-eval/builder.nix
@@ -20,7 +20,6 @@ let
         ;
     })
     hive
-    hiveWithController
     runGroup
     ;
 
@@ -30,8 +29,6 @@ let
   withBuilder = hive {
     deploy.bao.enable = true;
     deploy.builder.enable = true;
-    swarm.attic.domain = "cache.example.org";
-    swarm.attic.cache = "grid";
   };
 
   servicesHere = shared.swarmServicesWithController;
@@ -40,21 +37,6 @@ let
     m:
     lib.any (a: !a.assertion && lib.hasInfix "deploy.builder.enable requires" a.message) m.assertions;
 
-  # The one fixture that fires the cache assertion: a domain with no cache name.
-  halfCache = hive {
-    deploy.bao.enable = true;
-    deploy.builder.enable = true;
-    swarm.attic.domain = "cache.example.org";
-  };
-  refusedHalfCache =
-    m:
-    lib.any (
-      a:
-      !a.assertion && lib.hasInfix "swarm.attic.domain and services.hyperhive.swarm.attic.cache" a.message
-    ) m.assertions;
-  # Only the option is read, so the host around it is never evaluated.
-  cacheNamed = name: (hive { swarm.attic.cache = name; }).services.hyperhive.swarm.attic.cache;
-
   natsHere = shared.natsQueueOnly;
 
   autheliaHere = hive {
@@ -66,44 +48,6 @@ let
   inner = container.config;
   svc = inner.systemd.services.swarm-builder;
   env = svc.environment;
-  hasOnPath = name: s: lib.any (p: lib.getName p == name) s.path;
-  # A builder with no cache named anywhere.
-  withBuilderNoCache = hive {
-    deploy.bao.enable = true;
-    deploy.builder.enable = true;
-  };
-  withoutCache = withBuilderNoCache.containers.swarm-builder.config.systemd.services.swarm-builder;
-
-  # Hosting the shared services runs the swarm's own cache, which names itself.
-  atticHere = servicesHere;
-  atticDeploy = atticHere.services.hyperhive.deploy.attic;
-  atticSwarm = m: m.services.hyperhive.swarm.attic;
-  atticUnit = atticHere.containers.swarm-attic.config.systemd.services.swarm-attic;
-  atticSecret = atticHere.systemd.services.swarm-bao-attic-secret;
-  atticTokens = atticHere.systemd.services.swarm-bao-attic-tokens;
-  atticVhost = atticHere.services.hyperhive.gateway.vhosts."attic.t.local";
-
-  # The cache switched on while the operator names the options by hand.
-  atticByHand = hive {
-    deploy.bao.enable = true;
-    deploy.attic.enable = true;
-    swarm.attic.domain = "cache.example.org";
-    swarm.attic.cache = "grid";
-  };
-
-  # An external cache on a host that hosts the shared services: the switch forced
-  # off, the two options named.
-  atticExternal = hiveWithController {
-    deploy.allSwarmServices = true;
-    deploy.attic.enable = lib.mkForce false;
-    swarm.attic.domain = "cache.example.org";
-    swarm.attic.cache = "grid";
-  };
-  hasAtticHost =
-    m:
-    m.containers ? swarm-attic
-    || m.systemd.services ? swarm-bao-attic-secret
-    || m.systemd.services ? swarm-bao-attic-tokens;
 
   # The check flake on the inputs the builder's unit names, called as
   # `nix build` calls it. `hyperhive` is entered through the filtered source's
@@ -172,49 +116,6 @@ let
         && svc.serviceConfig.DynamicUser
         && !(lib.any (lib.hasSuffix "TOKEN") (lib.attrNames env));
     }
-    {
-      # The closure is pushed with `attic` from the unit, whose config file holds
-      # the push token: it goes in a runtime directory only the dynamic user can
-      # enter, and the token is in no variable. The host without a cache is the
-      # control: same unit, none of it, with `git` still on the path to show
-      # the lookup finds what is there.
-      name = "the builder pushes to the configured cache with attic from a private runtime directory, and pushes nowhere without one";
-      ok =
-        env.SWARM_BUILDER_ATTIC_DOMAIN == "cache.example.org"
-        && env.SWARM_BUILDER_ATTIC_CACHE == "grid"
-        && hasOnPath "attic" svc
-        && svc.serviceConfig.RuntimeDirectory == "swarm-builder"
-        && svc.serviceConfig.RuntimeDirectoryMode == "0700"
-        && !(lib.any (lib.hasSuffix "TOKEN") (lib.attrNames env))
-        && hasOnPath "git" withoutCache
-        && !(hasOnPath "attic" withoutCache)
-        && !(withoutCache.environment ? SWARM_BUILDER_ATTIC_DOMAIN)
-        && !(withoutCache.environment ? SWARM_BUILDER_ATTIC_CACHE);
-    }
-    {
-      # A domain with no cache name would crash-loop the builder at start, so
-      # evaluation refuses it. `withBuilder`, with both set, is the control: the
-      # same assertion list holds the entry and it passes.
-      name = "the builder refuses a cache domain without a cache name";
-      ok =
-        refusedHalfCache halfCache
-        && !(refusedHalfCache withBuilder)
-        && lib.any (a: lib.hasInfix "swarm.attic.domain and" a.message) withBuilder.assertions;
-    }
-    {
-      # attic refuses a cache name outside its rule, which would fail every push.
-      # `grid` is the control that the lookup reads a name.
-      name = "the cache name must follow attic's rule";
-      ok =
-        cacheNamed "grid" == "grid"
-        && cacheNamed "A-b_c+d" == "A-b_c+d"
-        && lib.all (n: !(builtins.tryEval (cacheNamed n)).success) [
-          "grid.v2"
-          "-grid"
-          ""
-          (lib.concatStrings (lib.genList (_: "a") 51))
-        ];
-    }
     {
       # The minting unit goes inactive after each run, so a start that pulls it
       # runs it again and mints a leaf that is missing; an active
@@ -308,102 +209,6 @@ let
           autheliaHere.containers.swarm-authelia.config.systemd.services.swarm-secret-publish.script
         );
     }
-    {
-      # The switch is on wherever the shared services are and the host holds the
-      # cache's leaf, and the two options every host reads come from the cache.
-      # The builder on the same host pushes to it. `bare` is the control that the
-      # lookup reads null where nothing runs a cache.
-      name = "hosting the shared services runs the swarm's cache and fills the cache options, which the builder follows";
-      ok =
-        atticDeploy.enable
-        && atticHere.containers ? swarm-attic
-        && atticHere.services.hyperhive.deploy.bao.atticClientCertFile != null
-        && atticHere.services.hyperhive.deploy.bao.atticClientKeyFile != null
-        && (atticSwarm atticHere).domain == "attic.t.local"
-        && (atticSwarm atticHere).cache == "swarm"
-        &&
-          atticHere.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_DOMAIN
-          == "attic.t.local"
-        &&
-          atticHere.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_CACHE
-          == "swarm"
-        && (atticSwarm bare).domain == null
-        && (atticSwarm bare).cache == null
-        && !(hasAtticHost bare);
-    }
-    {
-      # Names the operator gives win over the cache's own, and the gateway then
-      # serves the cache under the operator's name. `atticHere` is the control
-      # that the same lookups find the defaults.
-      name = "options named by hand win over the cache's defaults";
-      ok =
-        atticByHand.services.hyperhive.deploy.attic.enable
-        && atticByHand.containers ? swarm-attic
-        && (atticSwarm atticByHand).domain == "cache.example.org"
-        && (atticSwarm atticByHand).cache == "grid"
-        && atticByHand.services.hyperhive.gateway.vhosts ? "cache.example.org"
-        && !(atticByHand.services.hyperhive.gateway.vhosts ? "attic.t.local")
-        && atticHere.services.hyperhive.gateway.vhosts ? "attic.t.local";
-    }
-    {
-      # An operator's external cache on a host that hosts the shared services:
-      # with the switch forced off nothing of the cache is rendered, and the
-      # options keep what was named. `atticHere` is the control that the same
-      # lookups find the cache's pieces where it runs.
-      name = "with the cache switched off the options are the operator's and no cache runs";
-      ok =
-        !atticExternal.services.hyperhive.deploy.attic.enable
-        && !(hasAtticHost atticExternal)
-        && !(atticExternal.services.hyperhive.gateway.vhosts ? "attic.t.local")
-        && (atticSwarm atticExternal).domain == "cache.example.org"
-        && (atticSwarm atticExternal).cache == "grid"
-        &&
-          atticExternal.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_DOMAIN
-          == "cache.example.org"
-        && hasAtticHost atticHere
-        && atticHere.systemd.services ? swarm-bao-attic-secret
-        && atticHere.systemd.services ? swarm-bao-attic-tokens;
-    }
-    {
-      # Both host units log in as the cache's principal, not the hive's, and
-      # the container reaches the key through a read-only directory. The
-      # unit script holds the create calls only in ./lib/attic-init.nix, which a
-      # script test runs.
-      name = "the cache's host units use its own store leaf, and the container gets the key read-only";
-      ok =
-        atticSecret.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/attic.pem"
-        && atticSecret.environment.BAO_CLIENT_KEY == "/var/lib/swarm-bao-pki/attic-key.pem"
-        && atticTokens.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/attic.pem"
-        && atticSecret.serviceConfig.Type == "oneshot"
-        && lib.elem "container@swarm-attic.service" atticSecret.before
-        && lib.elem "container@swarm-attic.service" atticTokens.after
-        && lib.elem "swarm-bao-attic-policy.service" atticSecret.after
-        && lib.elem "swarm-bao-attic-policy.service" atticTokens.after
-        && atticHere.containers.swarm-attic.bindMounts."/run/swarm-attic-secrets".isReadOnly
-        && !atticHere.containers.swarm-attic.privateNetwork
-        && atticUnit.serviceConfig.EnvironmentFile == "/run/swarm-attic-secrets/server.env"
-        && lib.hasInfix "--mode monolithic" atticUnit.serviceConfig.ExecStart
-        && atticDeploy.retentionPeriod == "14 days";
-    }
-    {
-      # attic checks its own tokens and a nix client cannot follow a login
-      # redirect, so the vhost carries no `auth_request`; the tokens ride in a
-      # header, so it is TLS only; and a store path is one long upload.
-      name = "the cache's vhost is TLS only, unauthenticated at the gateway and streams uploads, and its name is a swarm service name on every host";
-      ok =
-        let
-          names = m: m.services.hyperhive.swarm.serviceDomains;
-        in
-        atticVhost.forceSSL
-        && atticVhost.locations."/".proxyPass == "http://127.0.0.1:8910"
-        && !(lib.hasInfix "auth_request" atticVhost.locations."/".extraConfig)
-        && lib.hasInfix "client_max_body_size 0" atticVhost.locations."/".extraConfig
-        && lib.hasInfix "proxy_request_buffering off" atticVhost.locations."/".extraConfig
-        && lib.elem "attic.t.local" (names atticHere)
-        && names atticHere == names bare
-        && names atticExternal == names bare
-        && !(lib.elem "cache.example.org" (names atticExternal));
-    }
   ];
 in
 runGroup "builder" cases
diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index 1df72a4d..b22e038a 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -302,17 +302,6 @@ let
         && !(swarmServicesBaoElsewhere.containers ? swarm-notify-router)
         && swarmServicesBaoElsewhere.services.hyperhive.deploy.nats.enable;
     }
-    {
-      # The cache's units assert the store identity the store's host mints, as
-      # the router's do; its options stay as unset as they were.
-      name = "the swarm's cache stays off where the shared services are hosted without the store";
-      ok =
-        !swarmServicesBaoElsewhere.services.hyperhive.deploy.attic.enable
-        && !(swarmServicesBaoElsewhere.containers ? swarm-attic)
-        && swarmServicesBaoElsewhere.services.hyperhive.swarm.attic.domain == null
-        && swarmServicesHere.services.hyperhive.deploy.attic.enable
-        && swarmServicesBaoElsewhere.services.hyperhive.deploy.nats.enable;
-    }
     {
       # The CLI is the one the agents run, not the container's own nixpkgs'.
       # Unpinned is the control: it falls back to the container's own `claude-code`.
@@ -642,21 +631,21 @@ let
       # that lost a container can't pass by comparing fewer of them.
       name = "every service container restates its host-side privateNetwork";
       ok =
-        lib.length (lib.attrNames serviceContainers) == 15
+        lib.length (lib.attrNames serviceContainers) == 14
         && lib.all (
           c: c.privateNetwork == (c.config.services.hyperhive.swarmContainer.privateNetwork or null)
         ) (lib.attrValues serviceContainers);
     }
     {
       # Both values come from ../container-modules/swarm-container.nix.
-      # Five of the 15 service containers share the host netns (hive-forge, bao,
-      # the queue, the log store, the cache) and ten have one of their own.
+      # Four of the 14 service containers share the host netns (hive-forge, bao,
+      # the queue, the log store) and ten have one of their own.
       name = "a service container on the host netns runs no firewall or resolvconf of its own";
       ok =
         let
           shared = lib.filter (c: !c.privateNetwork) (lib.attrValues serviceContainers);
         in
-        lib.length shared == 5
+        lib.length shared == 4
         && lib.all (
           c: !c.config.networking.firewall.enable && !c.config.networking.resolvconf.enable
         ) shared;
diff --git a/nix/script-tests/attic-init.nix b/nix/script-tests/attic-init.nix
deleted file mode 100644
index 7d648633..00000000
--- a/nix/script-tests/attic-init.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-# `checks.script-test-attic-init` — runs ../host-modules/lib/attic-init.nix's two
-# scripts, as the cache's host units run them, against stub `bao`, `openssl`,
-# `atticadm`, `attic`, `curl` and `systemctl`. The cases are in ./attic-init.sh.
-#
-# What runs is the rendered script, behind the same helpers the units put in
-# front of it.
-{
-  pkgs,
-  ...
-}:
-let
-  init = import ../host-modules/lib/attic-init.nix { inherit (pkgs) lib; } {
-    jwtPath = "secret/swarm/services/attic/jwt-secret";
-    pullPath = "secret/swarm/services/attic/pull-token";
-    pushPath = "secret/swarm/services/attic/push-token";
-    cache = "grid";
-    endpoint = "http://127.0.0.1:8910";
-    configFile = "@DIR@/server.toml";
-    envFile = "@DIR@/secrets/server.env";
-    machine = "swarm-attic";
-    unit = "swarm-attic";
-  };
-  render =
-    name: body:
-    pkgs.writeText name ''
-      set -euo pipefail
-      ${import ../host-modules/lib/atomic-write-secret.nix { }}
-      ${import ../host-modules/lib/refresh-consumer.nix { }}
-      ${init.prelude}
-      ${body}
-    '';
-in
-pkgs.runCommand "hyperhive-script-test-attic-init"
-  {
-    ENSURE_JWT = render "ensure-jwt.sh" init.ensureJwt;
-    PROVISION = render "provision.sh" init.provision;
-  }
-  ''
-    ${pkgs.bash}/bin/bash ${./attic-init.sh}
-    touch "$out"
-  ''
diff --git a/nix/script-tests/attic-init.sh b/nix/script-tests/attic-init.sh
deleted file mode 100644
index a1eb6118..00000000
--- a/nix/script-tests/attic-init.sh
+++ /dev/null
@@ -1,232 +0,0 @@
-# Cases for ../host-modules/lib/attic-init.nix. Each case runs the key script or
-# the cache script against stubs that record every call, over a store kept in
-# files, and compares the record and what the script left behind.
-set -uo pipefail
-
-failures=0
-count=0
-case="setup"
-
-fail() {
-  echo "FAILED: $case: $*" >&2
-  failures=$((failures + 1))
-}
-
-dir=$(mktemp -d)
-mkdir -p "$dir/bin" "$dir/store" "$dir/secrets"
-
-# The scripts name their files under @DIR@, which is this run's directory.
-for s in ENSURE_JWT PROVISION; do
-  sed "s|@DIR@|$dir|g" "${!s}" >"$dir/$s.sh"
-  export "$s=$dir/$s.sh"
-done
-calls=$dir/calls
-export DIR=$dir
-
-# The store is a directory with one file per path. `get` exits 2 on a miss, as
-# `bao kv get` does. `put -cas=0` refuses an existing path; without it a put
-# overwrites. $RACE_PATH makes another run create that path just before our put
-# lands.
-cat >"$dir/bin/bao" <<STUB
-#!$BASH
-file() { printf '%s/store/%s' "\$DIR" "\$(printf '%s' "\$1" | tr / _)"; }
-case "\$1 \$2" in
-  "login -method=cert")
-    echo "bao login" >>"$calls"
-    if [ "\${LOGIN_FAIL:-0}" = 1 ]; then echo denied >&2; exit 2; fi
-    echo store-token
-    ;;
-  "kv get")
-    path=\${4}
-    f=\$(file "\$path")
-    echo "bao get \$path" >>"$calls"
-    [ -f "\$f" ] || exit 2
-    cat "\$f"
-    ;;
-  "kv put")
-    if [ "\$3" = "-cas=0" ]; then cas=1; path=\$4; else cas=0; path=\$3; fi
-    f=\$(file "\$path")
-    echo "bao put cas=\$cas \$path" >>"$calls"
-    value=\$(cat)
-    if [ "\${RACE_PATH:-}" = "\$path" ] && [ ! -f "\$f" ]; then
-      printf '%s' raced >"\$f"
-    fi
-    if [ "\$cas" = 1 ] && [ -f "\$f" ]; then echo "check-and-set parameter did not match" >&2; exit 1; fi
-    printf '%s' "\$value" >"\$f"
-    ;;
-esac
-STUB
-
-# The key is a fixed word, so the file the script writes is predictable.
-cat >"$dir/bin/openssl" <<STUB
-#!$BASH
-echo openssl >>"$calls"
-echo FAKEPEM
-STUB
-
-# A token carries the subject and a serial, so a case can tell which one a call
-# used. The key comes in the environment, as the real tool takes it.
-cat >"$dir/bin/atticadm" <<STUB
-#!$BASH
-[ -n "\${ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64:-}" ] || { echo "no key in the environment" >&2; exit 1; }
-echo "atticadm \$*" >>"$calls"
-n=\$(grep -c '^atticadm' "$calls")
-sub=\$2
-[ "\$1" = "-f" ] && sub=\$5
-echo "tok-\$sub-\$n"
-STUB
-
-# The cache exists once \`cache create\` ran. Each call records the token the
-# client config names.
-cat >"$dir/bin/attic" <<STUB
-#!$BASH
-tokenfile=\$(sed -n 's/^token-file = "\(.*\)"$/\1/p' "\$XDG_CONFIG_HOME/attic/config.toml")
-token=\$(cat "\$tokenfile")
-echo "attic \$* | token=\$token" >>"$calls"
-case "\$1 \$2" in
-  "cache info") [ -f "\$DIR/cache-exists" ] ;;
-  "cache create") touch "\$DIR/cache-exists" ;;
-  *) exit 1 ;;
-esac
-STUB
-chmod +x "$dir/bin/"*
-
-cat >"$dir/bin/curl" <<STUB
-#!$BASH
-echo curl >>"$calls"
-[ "\${CURL_FAIL:-0}" != 1 ]
-STUB
-printf '#!%s\nexit 0\n' "$BASH" >"$dir/bin/sleep"
-# A container that is not running has nothing to refresh.
-printf '#!%s\nexit 1\n' "$BASH" >"$dir/bin/systemctl"
-chmod +x "$dir/bin/"*
-
-export PATH="$dir/bin:$PATH"
-
-# n <pattern>: how many recorded calls match.
-n() { grep -c -- "$1" "$calls" || true; }
-
-# run <script> [VAR=value…]: the script's exit status.
-run() {
-  local script=$1
-  shift
-  env "$@" bash "$script" >"$dir/out" 2>"$dir/err"
-}
-
-reset() {
-  rm -rf "$dir/store" "$dir/secrets" "$dir/cache-exists" "$calls"
-  mkdir -p "$dir/store" "$dir/secrets"
-  : >"$calls"
-}
-
-stored() { cat "$dir/store/$1" 2>/dev/null || true; }
-JWT=secret_swarm_services_attic_jwt-secret
-PULL=secret_swarm_services_attic_pull-token
-PUSH=secret_swarm_services_attic_push-token
-ENVFILE=$dir/secrets/server.env
-
-expect() { # <description> <got> <want>
-  count=$((count + 1))
-  if [ "$2" != "$3" ]; then fail "$1: got '$2', wanted '$3'"; fi
-}
-
-# ── the key ──────────────────────────────────────────────────────────────
-case="first start creates the key and hands it over"
-reset
-run "$ENSURE_JWT"
-expect "exit status" $? 0
-expect "key minted once" "$(n '^openssl')" 1
-expect "stored key" "$(stored $JWT)" "$(printf 'FAKEPEM\n' | base64 -w0)"
-expect "env file" "$(cat "$ENVFILE")" "ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=$(stored $JWT)"
-expect "env file mode" "$(stat -c %a "$ENVFILE")" 400
-
-case="a second start mints nothing and keeps the key"
-first=$(stored $JWT)
-run "$ENSURE_JWT"
-expect "exit status" $? 0
-expect "key minted still once" "$(n '^openssl')" 1
-expect "no second create" "$(n '^bao put')" 1
-expect "stored key unchanged" "$(stored $JWT)" "$first"
-
-case="a stored key is used, not replaced, when the file is gone"
-rm -f "$ENVFILE"
-run "$ENSURE_JWT"
-expect "exit status" $? 0
-expect "key minted still once" "$(n '^openssl')" 1
-expect "env file rewritten from the store" "$(cat "$ENVFILE")" "ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=$first"
-
-case="a create lost to another run uses the winner's key"
-reset
-run "$ENSURE_JWT" RACE_PATH=secret/swarm/services/attic/jwt-secret
-expect "exit status" $? 0
-expect "stored key is the winner's" "$(stored $JWT)" raced
-expect "env file has the winner's" "$(cat "$ENVFILE")" "ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=raced"
-
-case="a refused login stops before anything is minted"
-reset
-run "$ENSURE_JWT" LOGIN_FAIL=1
-expect "exit status" $? 1
-expect "nothing minted" "$(n '^openssl')" 0
-expect "nothing written" "$(ls "$dir/secrets" | wc -l)" 0
-
-# ── the cache and the tokens ─────────────────────────────────────────────
-case="first start creates the cache and both tokens"
-reset
-run "$ENSURE_JWT"
-: >"$calls"
-run "$PROVISION"
-expect "exit status" $? 0
-expect "pull token stored" "$(stored $PULL)" "tok-swarm-hives-pull-1"
-expect "push token stored" "$(stored $PUSH)" "tok-swarm-builder-push-2"
-expect "cache created once" "$(n '^attic cache create')" 1
-expect "cache created by the short-lived token" "$(n '^attic cache create local:grid | token=tok-swarm-attic-init-3')" 1
-expect "tokens minted: pull, push, the creator" "$(n '^atticadm')" 3
-expect "pull token reads only the cache" "$(n 'make-token --sub swarm-hives-pull --validity 10y --pull grid$')" 1
-expect "push token pulls and pushes" "$(n 'make-token --sub swarm-builder-push --validity 10y --pull grid --push grid$')" 1
-expect "the creator may create and pull, for minutes" "$(n 'make-token --sub swarm-attic-init --validity 5m --create-cache grid --pull grid$')" 1
-
-case="a second start mints nothing and creates nothing"
-pull=$(stored $PULL)
-push=$(stored $PUSH)
-: >"$calls"
-run "$PROVISION"
-expect "exit status" $? 0
-expect "no token minted" "$(n '^atticadm')" 0
-expect "no create call" "$(n '^bao put')" 0
-expect "no cache create" "$(n '^attic cache create')" 0
-expect "the pull token looked the cache up" "$(n "^attic cache info local:grid | token=$pull")" 1
-expect "pull token unchanged" "$(stored $PULL)" "$pull"
-expect "push token unchanged" "$(stored $PUSH)" "$push"
-
-case="an empty server gets its cache back with the stored tokens"
-rm -f "$dir/cache-exists"
-: >"$calls"
-run "$PROVISION"
-expect "exit status" $? 0
-expect "only the creator is minted" "$(n '^atticadm')" 1
-expect "no secret rewritten" "$(n '^bao put')" 0
-expect "cache created" "$(n '^attic cache create')" 1
-expect "pull token unchanged" "$(stored $PULL)" "$pull"
-
-case="no tokens are minted while the server is down"
-reset
-run "$ENSURE_JWT"
-: >"$calls"
-run "$PROVISION" CURL_FAIL=1
-expect "exit status" $? 1
-expect "nothing minted" "$(n '^atticadm')" 0
-expect "nothing stored" "$(n '^bao put')" 0
-
-case="the client reads its token from a file, not from an argument"
-reset
-run "$ENSURE_JWT"
-run "$PROVISION"
-expect "no token among the client's arguments" "$(grep -c -- '^attic [^|]*tok-' "$calls" || true)" 0
-# The control: the client did see tokens, through its config file.
-expect "tokens seen through the config file" "$(grep -c -- '| token=tok-' "$calls" || true)" 3
-
-if [ "$failures" -ne 0 ]; then
-  echo "$failures of $count checks failed" >&2
-  exit 1
-fi
-echo "$count checks passed"
diff --git a/swarm-builder/README.md b/swarm-builder/README.md
index 8a3864be..97994501 100644
--- a/swarm-builder/README.md
+++ b/swarm-builder/README.md
@@ -19,7 +19,7 @@ the answer into a `swarm-builder` commit status on the PR's head.
   as an untrusted client, so a config can neither set daemon options nor read
   this service's environment.
 - Nothing is pushed and nothing is recorded: the closure stays in the host's
-  store until it is collected. (A meta build can push, see below.)
+  store until it is collected.
 
 ## Meta builds
 
@@ -31,21 +31,16 @@ the platform it builds for. The controller records the answer; the service
 writes nothing. It takes the same one-build slot as the PR checks. See
 [`docs/swarm/builder.md`](../docs/swarm/builder.md#deploy-gate).
 
-Where `services.hyperhive.swarm.attic.{domain,cache}` are set, it first pushes a
-green build's closure to that cache with `attic push`, and the answer says
-whether that worked. A failed push leaves the build green. See
-[`docs/swarm/builder.md`](../docs/swarm/builder.md#binary-cache).
-
 ## Credentials
 
 The container holds one credential: its own store certificate, which nspawn
 hands in at start without a copy on disk. With it the service reads its
 queue client secret at start and again when authelia refuses it, and its
-read-only forge token at every build, and the cache push token at every push.
+read-only forge token at every build.
 `git` gets the token through a credential helper reading the child's
 environment, never in a URL or an argument, and the helper answers only an
 `https` request for the forge's host. Its store role reads exactly
-those three paths.
+those two paths.
 
 ## Archetypes
 
diff --git a/swarm-builder/src/main.rs b/swarm-builder/src/main.rs
index c8f1470e..4d274b65 100644
--- a/swarm-builder/src/main.rs
+++ b/swarm-builder/src/main.rs
@@ -16,8 +16,6 @@
 //! and an `internal/meta` commit, and the answer is the store path of that
 //! agent's toplevel, built at the flake's own lock. They take the build slot
 //! PR checks take. The controller records the path; the builder writes nothing.
-//! When a cache is set (see [`push`]), a green meta build is pushed to it before
-//! the reply, and the reply says whether that worked.
 //!
 //! The store identity comes from the `BAO_*` environment. The queue client
 //! secret is read at start and again when authelia refuses it, the forge token
@@ -41,7 +39,6 @@ use swarm_wire::builder::{
 
 mod archetypes;
 mod nix_build;
-mod push;
 
 /// The cert-auth role this service logs in to the store as. `swarm-bao.nix`
 /// writes it, matching the leaf's subject.
@@ -67,17 +64,6 @@ const MAX_SLOT_WAIT: Duration = REPLY_DEADLINE
     .saturating_sub(BUILD_DEADLINE)
     .saturating_sub(SLOT_MARGIN);
 
-/// What is held back from a meta build's reply deadline for publishing the reply
-/// after its push.
-const REPLY_MARGIN: Duration = Duration::from_secs(10);
-
-/// How long the push of a meta build that ends at now may run: at most
-/// [`push::PUSH_DEADLINE`], and never past `reply_by`, so a push cannot make the
-/// reply later than the controller waits.
-fn push_budget(reply_by: tokio::time::Instant) -> Duration {
-    push::PUSH_DEADLINE.min(reply_by.saturating_duration_since(tokio::time::Instant::now()))
-}
-
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
@@ -97,7 +83,6 @@ async fn main() -> Result<()> {
         deadline: BUILD_DEADLINE,
         lock_deadline: LOCK_DEADLINE,
         system: var("SYSTEM")?,
-        cache: push_target()?,
     });
     let secret =
         swarm_secret_client::read_with_startup_retry("reading the queue client secret", || {
@@ -315,7 +300,7 @@ async fn answer_meta_builds(
                         &slot,
                         received,
                         || busy_meta(&job),
-                        handle_meta(&job, &builder, received + REPLY_DEADLINE - REPLY_MARGIN),
+                        handle_meta(&job, &builder),
                     )
                     .await
                     else {
@@ -398,36 +383,19 @@ fn busy_meta(job: &BuildFromMeta) -> FromMetaReply {
 }
 
 /// Build one meta request and log the build.
-async fn handle_meta(
-    job: &BuildFromMeta,
-    builder: &nix_build::Builder,
-    reply_by: tokio::time::Instant,
-) -> FromMetaReply {
+async fn handle_meta(job: &BuildFromMeta, builder: &nix_build::Builder) -> FromMetaReply {
     let reply = match within(TOKEN_DEADLINE, forge_token()).await {
         Ok(token) => builder.build_from_meta(job, &token).await,
         Err(e) => FromMetaReply::Unavailable {
             reason: format!("{e:#}"),
         },
     };
-    let reply = push::cache_built(
-        reply,
-        builder.cache.as_ref(),
-        attic_push_token(),
-        push_budget(reply_by),
-        &job.agent,
-    )
-    .await;
     match &reply {
-        FromMetaReply::Built {
-            out_path,
-            system,
-            cached,
-        } => tracing::info!(
+        FromMetaReply::Built { out_path, system } => tracing::info!(
             agent = %job.agent,
             meta_rev = %job.meta_rev,
             %out_path,
             %system,
-            cached,
             "agent meta build built"
         ),
         FromMetaReply::Failed { error_tail } => tracing::warn!(
@@ -490,23 +458,6 @@ fn log_build(job: &BuildAgent, reply: &Reply) {
     }
 }
 
-/// The token the builder pushes closures to the cache with, read on every push so
-/// a rotation takes effect on the next one.
-async fn attic_push_token() -> Result<String> {
-    let path = swarm_secret_client::builder::attic_push_token_path()?;
-    let store = swarm_secret_client::SecretStore::from_env(CERT_ROLE)
-        .await
-        .context("logging in to the secret store")?;
-    let stored: Option<swarm_secret_client::builder::AtticPushToken> = store
-        .read_optional(&path)
-        .await
-        .with_context(|| format!("reading {path}"))?;
-    match stored {
-        Some(t) if !t.value.trim().is_empty() => Ok(t.value.trim().to_owned()),
-        _ => bail!("nothing at {path}: the cache push token has not been written"),
-    }
-}
-
 /// The forge token the builder fetches config repos with, read on every
 /// build so a rotation takes effect on the next one.
 async fn forge_token() -> Result<String> {
@@ -544,17 +495,6 @@ async fn client_secret(client_id: &str) -> Result<String> {
     }
 }
 
-/// The cache the unit's environment names, if any. systemd sets
-/// `RUNTIME_DIRECTORY` for the unit's runtime directory.
-fn push_target() -> Result<Option<push::Remote>> {
-    let var = |name: &str| std::env::var(name).ok();
-    push::Remote::from_settings(
-        var(&format!("{PREFIX}_ATTIC_DOMAIN")),
-        var(&format!("{PREFIX}_ATTIC_CACHE")),
-        var("RUNTIME_DIRECTORY"),
-    )
-}
-
 /// The forge's base URL, which must be `https`: the credential helper offers
 /// the token to `https` requests for its host alone.
 fn forge_url() -> Result<String> {
@@ -640,7 +580,6 @@ mod tests {
             FromMetaReply::Built {
                 out_path: "/nix/store/x".to_owned(),
                 system: "s".to_owned(),
-                cached: false,
             }
         })
         .await;
@@ -655,7 +594,6 @@ mod tests {
             FromMetaReply::Built {
                 out_path: "/nix/store/x".to_owned(),
                 system: "s".to_owned(),
-                cached: false,
             }
         })
         .await;
@@ -678,20 +616,6 @@ mod tests {
         assert_eq!(prompt.expect("read"), "t");
     }
 
-    #[tokio::test(start_paused = true)]
-    async fn a_push_gets_the_deadline_unless_the_reply_is_due_sooner() {
-        let now = Instant::now();
-        assert_eq!(
-            push_budget(now + Duration::from_hours(1)),
-            push::PUSH_DEADLINE
-        );
-        assert_eq!(
-            push_budget(now + Duration::from_secs(90)),
-            Duration::from_secs(90)
-        );
-        assert_eq!(push_budget(now), Duration::ZERO);
-    }
-
     #[test]
     fn a_build_started_at_the_slot_limit_ends_inside_the_reply_deadline() {
         assert!(MAX_SLOT_WAIT > Duration::ZERO);
diff --git a/swarm-builder/src/nix_build.rs b/swarm-builder/src/nix_build.rs
index e20124e7..2e0c1da0 100644
--- a/swarm-builder/src/nix_build.rs
+++ b/swarm-builder/src/nix_build.rs
@@ -59,9 +59,6 @@ pub struct Builder {
     pub lock_deadline: Duration,
     /// The platform this host builds for, reported with each meta build.
     pub system: String,
-    /// Where a meta build's closure is pushed after it succeeds; `None` pushes
-    /// nothing.
-    pub cache: Option<crate::push::Remote>,
 }
 
 impl Builder {
@@ -91,7 +88,6 @@ impl Builder {
                 Reply::Built { out_path } => FromMetaReply::Built {
                     out_path,
                     system: self.system.clone(),
-                    cached: false,
                 },
                 Reply::Failed { error_tail } => FromMetaReply::Failed { error_tail },
             },
@@ -441,7 +437,6 @@ mod tests {
             deadline: BUILD_DEADLINE,
             lock_deadline: LOCK_DEADLINE,
             system: "x86_64-linux".to_owned(),
-            cache: None,
         }
     }
 
@@ -519,7 +514,6 @@ mod tests {
             FromMetaReply::Built {
                 out_path: format!("{} {}", BUILD_FLAGS.join(" "), b.meta_attr(&meta_job())),
                 system: "x86_64-linux".to_owned(),
-                cached: false,
             }
         );
     }
diff --git a/swarm-builder/src/push.rs b/swarm-builder/src/push.rs
deleted file mode 100644
index 39c09eac..00000000
--- a/swarm-builder/src/push.rs
+++ /dev/null
@@ -1,500 +0,0 @@
-//! The push of a built closure to the binary cache, with `attic push`.
-//!
-//! The cache is an attic server: the swarm's own or an external instance. Its push token is read
-//! from the secret store per push and written to a file in a
-//! directory only the builder's unit can enter, beside a config that names it with
-//! `token-file`. `attic` finds the config through `XDG_CONFIG_HOME`.
-//! `attic login <name> <url> <token>` is not used: it puts the token in the
-//! process list. `attic` verifies the server's certificate
-//! against the system roots.
-//!
-//! A push that does not happen or does not finish leaves the build green with
-//! `cached` false: the closure is still in the host's store, and the next build
-//! of the agent pushes again.
-
-use std::future::Future;
-use std::path::{Path, PathBuf};
-use std::process::Stdio;
-use std::time::Duration;
-
-use anyhow::{Result, bail};
-use swarm_wire::builder::FromMetaReply;
-
-/// The longest one push may run, when the reply deadline leaves that much.
-pub const PUSH_DEADLINE: Duration = Duration::from_mins(10);
-
-/// The server name in the config file, and in the cache argument of the push.
-const SERVER: &str = "swarm";
-
-/// Where the builder pushes: one cache on one attic server.
-pub struct Remote {
-    /// The `attic` binary: a name found in the unit's path in production.
-    pub attic: PathBuf,
-    /// The server's name, without scheme: `host` or `host:port`.
-    pub domain: String,
-    /// The cache's name on that server.
-    pub cache: String,
-    /// A directory only the builder can enter, which the config files go in.
-    pub state_dir: PathBuf,
-}
-
-impl Remote {
-    /// The cache the environment names: `None` when neither value is set, so
-    /// the builder pushes nothing.
-    ///
-    /// # Errors
-    /// When only one of the two is set, or a value would bend the config file
-    /// or the command.
-    pub fn from_settings(
-        domain: Option<String>,
-        cache: Option<String>,
-        state_dir: Option<String>,
-    ) -> Result<Option<Self>> {
-        let (domain, cache) = match (domain, cache) {
-            (None, None) => return Ok(None),
-            (Some(domain), Some(cache)) => (domain, cache),
-            _ => bail!("the cache domain and the cache name must be set together"),
-        };
-        let plain_domain = !domain.is_empty()
-            && domain
-                .bytes()
-                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b':'));
-        if !plain_domain {
-            bail!("the cache domain {domain:?} is not a host name with an optional port");
-        }
-        if !cache_name_ok(&cache) {
-            bail!("the cache name {cache:?} is not one attic accepts");
-        }
-        let Some(state_dir) = state_dir else {
-            bail!("a cache is set, but the unit has no runtime directory to hold its config");
-        };
-        Ok(Some(Self {
-            attic: PathBuf::from("attic"),
-            domain,
-            cache,
-            state_dir: PathBuf::from(state_dir),
-        }))
-    }
-
-    /// Push `out_path` with `token`. The result is what `attic` printed.
-    ///
-    /// # Errors
-    /// Why the push did not finish: the config could not be written, `attic`
-    /// could not start, or it exited with an error.
-    pub async fn push(&self, token: &str, out_path: &str) -> Result<String, String> {
-        if !out_path.starts_with("/nix/store/") || out_path.contains(char::is_whitespace) {
-            return Err(format!("{out_path:?} is not a store path"));
-        }
-        let home = ConfigHome::write(&self.state_dir, &self.domain, token)
-            .map_err(|e| format!("writing the attic config: {e}"))?;
-        let output = self
-            .command(&home.0, out_path)
-            .output()
-            .await
-            .map_err(|e| format!("starting attic: {e}"))?;
-        let said = |bytes: &[u8]| {
-            crate::nix_build::last_lines(&String::from_utf8_lossy(bytes))
-                .unwrap_or_default()
-                .replace(token, "<redacted>")
-        };
-        if output.status.success() {
-            Ok(said(&output.stdout))
-        } else {
-            Err(format!(
-                "attic exited with {}: {}",
-                output.status,
-                said(&output.stderr)
-            ))
-        }
-    }
-
-    /// `attic push` of `out_path`, reading its config from `config_home`. The
-    /// token is in a file beside it and in no argument or variable.
-    fn command(&self, config_home: &Path, out_path: &str) -> tokio::process::Command {
-        let mut cmd = tokio::process::Command::new(&self.attic);
-        cmd.arg("push")
-            .arg(format!("{SERVER}:{}", self.cache))
-            .arg(out_path)
-            .env("XDG_CONFIG_HOME", config_home)
-            .stdin(Stdio::null())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .kill_on_drop(true);
-        cmd
-    }
-}
-
-/// Whether `name` is a cache name attic accepts, which is
-/// `^[A-Za-z0-9][A-Za-z0-9-_+]{0,49}$`. `services.hyperhive.swarm.attic.cache`
-/// states the same rule in nix.
-fn cache_name_ok(name: &str) -> bool {
-    let mut bytes = name.bytes();
-    bytes.next().is_some_and(|b| b.is_ascii_alphanumeric())
-        && name.len() <= 50
-        && bytes.all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'+'))
-}
-
-/// Numbers the config directories of one process's pushes.
-static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
-
-/// The config directory of one push, removed with the token in it on drop.
-struct ConfigHome(PathBuf);
-
-impl ConfigHome {
-    /// `<parent>/push-<n>/attic/config.toml`, which names `token` beside it, both
-    /// readable by this user alone.
-    fn write(parent: &Path, domain: &str, token: &str) -> std::io::Result<Self> {
-        use std::io::Write as _;
-        use std::os::unix::fs::{DirBuilderExt as _, OpenOptionsExt as _};
-        if token.is_empty() || token.bytes().any(|b| b < b' ') {
-            return Err(std::io::Error::other(
-                "the push token is empty or holds a control character",
-            ));
-        }
-        let home = Self(parent.join(format!(
-            "push-{}-{}",
-            std::process::id(),
-            NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
-        )));
-        let dir = home.0.join("attic");
-        let token_file = dir.join("token");
-        let token_path = token_file.to_string_lossy();
-        // A quote or backslash in the path would end the TOML string early.
-        if token_path.contains(['"', '\\']) {
-            return Err(std::io::Error::other(
-                "the runtime directory's path holds a quote or a backslash",
-            ));
-        }
-        std::fs::DirBuilder::new()
-            .recursive(true)
-            .mode(0o700)
-            .create(&dir)?;
-        let private = |name: &str| {
-            std::fs::OpenOptions::new()
-                .write(true)
-                .create_new(true)
-                .mode(0o600)
-                .open(dir.join(name))
-        };
-        private("token")?.write_all(token.as_bytes())?;
-        write!(
-            private("config.toml")?,
-            "default-server = \"{SERVER}\"\n\n[servers.{SERVER}]\n\
-             endpoint = \"https://{domain}\"\ntoken-file = \"{token_path}\"\n"
-        )?;
-        Ok(home)
-    }
-}
-
-impl Drop for ConfigHome {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-/// `reply` with `cached` set by pushing its closure, when it is a built one and
-/// a cache is set. `read_token` is not polled without a cache. The token read
-/// and the push together get `budget`.
-///
-/// Whatever happens to the push, a built reply stays built: a failure is logged
-/// and leaves `cached` false.
-pub async fn cache_built(
-    reply: FromMetaReply,
-    cache: Option<&Remote>,
-    read_token: impl Future<Output = Result<String>>,
-    budget: Duration,
-    agent: &str,
-) -> FromMetaReply {
-    let (
-        Some(cache),
-        FromMetaReply::Built {
-            out_path, system, ..
-        },
-    ) = (cache, &reply)
-    else {
-        return reply;
-    };
-    let pushed = tokio::time::timeout(budget, async {
-        let token = read_token
-            .await
-            .map_err(|e| format!("reading the push token: {e:#}"))?;
-        cache.push(&token, out_path).await
-    })
-    .await
-    .unwrap_or_else(|_| {
-        Err(format!(
-            "the push did not finish within {} s",
-            budget.as_secs()
-        ))
-    });
-    match pushed {
-        Ok(_) => {
-            tracing::info!(%agent, %out_path, cache = %cache.cache, "closure pushed to the cache");
-            FromMetaReply::Built {
-                out_path: out_path.clone(),
-                system: system.clone(),
-                cached: true,
-            }
-        }
-        Err(reason) => {
-            tracing::warn!(%agent, %out_path, cache = %cache.cache, %reason, "closure not pushed to the cache");
-            reply
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::os::unix::fs::PermissionsExt as _;
-    use std::sync::atomic::{AtomicBool, Ordering};
-
-    use super::*;
-
-    const TOKEN: &str = "eyJ0b2tlbiI6InNlY3JldCJ9.c2lnbmVk";
-    const OUT: &str = "/nix/store/0123456789abcdfghijklmnpqrsvwxyz-nixos-system-atlas";
-
-    fn built() -> FromMetaReply {
-        FromMetaReply::Built {
-            out_path: OUT.to_owned(),
-            system: "x86_64-linux".to_owned(),
-            cached: false,
-        }
-    }
-
-    fn cached(reply: &FromMetaReply) -> bool {
-        match reply {
-            FromMetaReply::Built { cached, .. } => *cached,
-            other => panic!("not built: {other:?}"),
-        }
-    }
-
-    /// A cache whose `attic` is the program `attic`: `true` and `false` stand
-    /// in for a push that works and one that fails, and `echo` for one that
-    /// says what it was run with.
-    fn cache_with(attic: &str) -> Remote {
-        Remote {
-            attic: PathBuf::from(attic),
-            domain: "cache.example.org".to_owned(),
-            cache: "grid".to_owned(),
-            state_dir: std::env::temp_dir(),
-        }
-    }
-
-    fn token() -> impl Future<Output = Result<String>> {
-        std::future::ready(Ok(TOKEN.to_owned()))
-    }
-
-    #[tokio::test]
-    async fn a_push_that_works_marks_the_build_cached() {
-        let cache = cache_with("true");
-        let reply = cache_built(built(), Some(&cache), token(), PUSH_DEADLINE, "atlas").await;
-        assert!(cached(&reply), "{reply:?}");
-    }
-
-    #[tokio::test]
-    async fn a_push_that_fails_leaves_the_build_green_and_not_cached() {
-        let cache = cache_with("false");
-        let reply = cache_built(built(), Some(&cache), token(), PUSH_DEADLINE, "atlas").await;
-        assert_eq!(reply, built());
-    }
-
-    #[tokio::test]
-    async fn a_push_that_cannot_start_leaves_the_build_green_and_not_cached() {
-        let cache = cache_with("/nonexistent/attic");
-        let reply = cache_built(built(), Some(&cache), token(), PUSH_DEADLINE, "atlas").await;
-        assert_eq!(reply, built());
-    }
-
-    #[tokio::test]
-    async fn an_unreadable_token_leaves_the_build_green_and_not_cached() {
-        let cache = cache_with("true");
-        let reply = cache_built(
-            built(),
-            Some(&cache),
-            async { anyhow::bail!("nothing at the path") },
-            PUSH_DEADLINE,
-            "atlas",
-        )
-        .await;
-        assert_eq!(reply, built());
-    }
-
-    #[tokio::test(start_paused = true)]
-    async fn a_token_read_that_outlasts_the_budget_leaves_the_build_green() {
-        let cache = cache_with("true");
-        let started = tokio::time::Instant::now();
-        let reply = cache_built(
-            built(),
-            Some(&cache),
-            std::future::pending(),
-            Duration::from_secs(5),
-            "atlas",
-        )
-        .await;
-        assert_eq!(reply, built());
-        assert_eq!(started.elapsed(), Duration::from_secs(5));
-    }
-
-    #[tokio::test]
-    async fn without_a_cache_nothing_is_read_or_pushed() {
-        let polled = std::sync::Arc::new(AtomicBool::new(false));
-        let tracked = |polled: &std::sync::Arc<AtomicBool>| {
-            let polled = std::sync::Arc::clone(polled);
-            async move {
-                polled.store(true, Ordering::SeqCst);
-                token().await
-            }
-        };
-        let reply = cache_built(built(), None, tracked(&polled), PUSH_DEADLINE, "atlas").await;
-        assert_eq!(reply, built());
-        assert!(!polled.load(Ordering::SeqCst), "the token was read");
-
-        // Control: with a cache the same future runs.
-        let cache = cache_with("true");
-        cache_built(
-            built(),
-            Some(&cache),
-            tracked(&polled),
-            PUSH_DEADLINE,
-            "atlas",
-        )
-        .await;
-        assert!(polled.load(Ordering::SeqCst));
-    }
-
-    #[tokio::test]
-    async fn a_build_that_is_not_built_is_not_pushed() {
-        let cache = cache_with("true");
-        let failed = FromMetaReply::Failed {
-            error_tail: "e".to_owned(),
-        };
-        let reply = cache_built(
-            failed.clone(),
-            Some(&cache),
-            token(),
-            PUSH_DEADLINE,
-            "atlas",
-        )
-        .await;
-        assert_eq!(reply, failed);
-    }
-
-    #[tokio::test]
-    async fn the_push_command_has_no_token_in_it() {
-        // `echo` prints the arguments it is given.
-        let cache = cache_with("echo");
-        let said = cache.push(TOKEN, OUT).await.expect("echo succeeds");
-        assert_eq!(said, format!("push swarm:grid {OUT}"));
-        assert!(!said.contains(TOKEN));
-
-        let cmd = cache.command(Path::new("/run/home"), OUT);
-        let cmd = cmd.as_std();
-        let args: Vec<_> = cmd.get_args().collect();
-        assert_eq!(args, ["push", "swarm:grid", OUT]);
-        let env: Vec<_> = cmd.get_envs().collect();
-        assert_eq!(
-            env,
-            [(
-                std::ffi::OsStr::new("XDG_CONFIG_HOME"),
-                Some(std::ffi::OsStr::new("/run/home"))
-            )]
-        );
-    }
-
-    #[test]
-    fn the_token_is_in_a_private_file_the_config_names_and_both_are_removed_after() {
-        let parent = std::env::temp_dir().join(format!("push-test-{}", std::process::id()));
-        std::fs::create_dir_all(&parent).expect("parent");
-        let home = ConfigHome::write(&parent, "cache.example.org", TOKEN).expect("written");
-        let file = home.0.join("attic/config.toml");
-        let text = std::fs::read_to_string(&file).expect("reads");
-        let token_file = home.0.join("attic/token");
-        assert!(
-            text.contains(&format!("token-file = \"{}\"", token_file.display())),
-            "{text}"
-        );
-        assert!(!text.contains(TOKEN), "{text}");
-        assert_eq!(std::fs::read_to_string(&token_file).expect("reads"), TOKEN);
-        assert!(
-            text.contains("endpoint = \"https://cache.example.org\""),
-            "{text}"
-        );
-        let mode = |p: &Path| std::fs::metadata(p).expect("stat").permissions().mode() & 0o777;
-        assert_eq!(mode(&file), 0o600);
-        assert_eq!(mode(&token_file), 0o600);
-        assert_eq!(mode(&home.0), 0o700);
-        let root = home.0.clone();
-        drop(home);
-        assert!(!root.exists());
-        std::fs::remove_dir_all(&parent).expect("cleanup");
-    }
-
-    #[test]
-    fn an_empty_token_or_one_with_a_control_character_is_refused() {
-        let parent = std::env::temp_dir();
-        for bad in ["", "a\nb", "a\0b"] {
-            assert!(ConfigHome::write(&parent, "h", bad).is_err(), "{bad:?}");
-        }
-    }
-
-    #[test]
-    fn a_path_that_would_end_the_config_string_is_refused() {
-        let parent = std::env::temp_dir().join("a\"b");
-        assert!(ConfigHome::write(&parent, "h", TOKEN).is_err());
-        assert!(!parent.exists());
-    }
-
-    #[test]
-    fn the_cache_name_rule_is_attics() {
-        let fifty = "a".repeat(50);
-        for ok in ["grid", "a", "A-b_c+d", "0", fifty.as_str()] {
-            assert!(cache_name_ok(ok), "{ok:?}");
-        }
-        let fifty_one = "a".repeat(51);
-        for bad in [
-            "",
-            "grid.v2",
-            "-x",
-            "_x",
-            "+x",
-            "a:b",
-            "a b",
-            "a/b",
-            fifty_one.as_str(),
-        ] {
-            assert!(!cache_name_ok(bad), "{bad:?}");
-        }
-    }
-
-    #[tokio::test]
-    async fn a_path_that_is_not_a_store_path_is_not_pushed() {
-        let cache = cache_with("true");
-        assert!(cache.push(TOKEN, "--help").await.is_err());
-        assert!(cache.push(TOKEN, "/nix/store/x y").await.is_err());
-        assert!(cache.push(TOKEN, OUT).await.is_ok());
-    }
-
-    #[test]
-    fn the_settings_name_a_cache_only_when_both_are_set() {
-        let state = || Some("/run/swarm-builder".to_owned());
-        let some = |s: &str| Some(s.to_owned());
-        assert!(
-            Remote::from_settings(None, None, None)
-                .expect("ok")
-                .is_none()
-        );
-        let cache = Remote::from_settings(some("cache.example.org"), some("grid"), state())
-            .expect("ok")
-            .expect("set");
-        assert_eq!(cache.domain, "cache.example.org");
-        assert_eq!(cache.cache, "grid");
-        assert!(Remote::from_settings(some("cache.example.org"), None, state()).is_err());
-        assert!(Remote::from_settings(None, some("grid"), state()).is_err());
-        assert!(Remote::from_settings(some("https://cache"), some("grid"), state()).is_err());
-        assert!(Remote::from_settings(some("cache"), some("a\"b"), state()).is_err());
-        assert!(Remote::from_settings(some("cache"), some("grid.v2"), state()).is_err());
-        assert!(Remote::from_settings(some("cache"), some("-grid"), state()).is_err());
-        assert!(Remote::from_settings(some("cache"), some("g_r+i-d"), state()).is_ok());
-        assert!(Remote::from_settings(some("cache"), some("grid"), None).is_err());
-    }
-}
diff --git a/swarm-controller/src/meta_build.rs b/swarm-controller/src/meta_build.rs
index aeee6c7c..5829e3ba 100644
--- a/swarm-controller/src/meta_build.rs
+++ b/swarm-controller/src/meta_build.rs
@@ -306,18 +306,13 @@ pub(crate) async fn run(
             }
             Outcome::Failed(error_tail)
         }
-        Ok(FromMetaReply::Built {
-            out_path,
-            system,
-            cached,
-        }) => {
+        Ok(FromMetaReply::Built { out_path, system }) => {
             let built_rev = meta_rev.clone();
             let closure = AgentClosure {
                 meta_rev,
                 store_path: out_path.clone(),
                 system,
                 built_unix: unix_now(),
-                cached,
             };
             match queue.record(&agent, &closure).await {
                 Ok(()) => {
@@ -420,14 +415,9 @@ mod tests {
         }
 
         fn built() -> Self {
-            Self::built_cached(false)
-        }
-
-        fn built_cached(cached: bool) -> Self {
             Self::answering(Ok(FromMetaReply::Built {
                 out_path: "/nix/store/x-toplevel".to_owned(),
                 system: "x86_64-linux".to_owned(),
-                cached,
             }))
         }
     }
@@ -480,22 +470,6 @@ mod tests {
         assert_eq!(closure.store_path, "/nix/store/x-toplevel");
         assert_eq!(closure.system, "x86_64-linux");
         assert!(closure.built_unix > 0);
-        assert!(!closure.cached);
-    }
-
-    /// The record says what the builder said about the cache, both ways.
-    #[tokio::test]
-    async fn the_record_carries_whether_the_builder_cached_the_closure() {
-        for cached in [true, false] {
-            let queue = FakeQueue::built_cached(cached);
-            let outcome = run_with(&FakeHead::reading(Ok(Some(REV))), &queue).await;
-            assert_eq!(outcome, Outcome::Done);
-            let recorded = queue.recorded.lock().unwrap();
-            let [(_, closure)] = recorded.as_slice() else {
-                panic!("one record: {recorded:?}")
-            };
-            assert_eq!(closure.cached, cached);
-        }
     }
 
     /// Any `nix` failure, a timeout included, fails the node at once with what
@@ -775,7 +749,6 @@ mod tests {
             store_path: "/nix/store/a".to_owned(),
             system: "x86_64-linux".to_owned(),
             built_unix: 1,
-            cached: false,
         };
         client.record("atlas", &closure).await.expect("written");
         closure.store_path = "/nix/store/b".to_owned();
diff --git a/swarm-secret-client/src/builder.rs b/swarm-secret-client/src/builder.rs
index 2e3444c2..e5e69701 100644
--- a/swarm-secret-client/src/builder.rs
+++ b/swarm-secret-client/src/builder.rs
@@ -2,9 +2,8 @@
 //! secret live in the store, and what each object holds.
 //!
 //! swarm-controller mints the forge token; the builder reads it, and its queue
-//! client secret, under its own certificate. It also reads the cache push
-//! token, which the operator writes. Its read stanza in `swarm-bao.nix` names
-//! exactly these three paths.
+//! client secret, under its own certificate. Its read stanza in
+//! `swarm-bao.nix` names exactly these two paths.
 
 use serde::{Deserialize, Serialize};
 
@@ -27,30 +26,6 @@ pub fn forge_token_path() -> Result<String, Error> {
     Ok(format!("{prefix}/forge/token"))
 }
 
-/// The path holding the token the builder pushes closures to the binary cache
-/// with, as an [`AtticPushToken`]. The operator writes it by hand: the cache is
-/// an instance outside the swarm, and no swarm unit mints the token.
-///
-/// Under the cache's own name segment rather than the builder's, since the
-/// token belongs to the cache's tenant.
-///
-/// # Errors
-/// Never in practice: the name segment is a constant. The `Result` is
-/// [`principal_prefix`]'s.
-pub fn attic_push_token_path() -> Result<String, Error> {
-    let prefix = principal_prefix(Kind::Service, "attic")?;
-    Ok(format!("{prefix}/push-token"))
-}
-
-/// What [`attic_push_token_path`] holds.
-///
-/// No `Debug`: `value` writes to the binary cache.
-#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AtticPushToken {
-    /// The token, under the field name the operator writes.
-    pub value: String,
-}
-
 /// The path holding the queue client secret of the builder's OIDC client
 /// `client_id`, where `swarm-secret-publisher.nix` puts every swarm service's.
 ///
@@ -85,9 +60,5 @@ mod tests {
             client_secret_path("swarm-builder").expect("a plain id is legal"),
             "swarm/services/swarm-builder/oidc/client"
         );
-        assert_eq!(
-            attic_push_token_path().expect("a constant segment is legal"),
-            "swarm/services/attic/push-token"
-        );
     }
 }
diff --git a/swarm-wire/src/agent_closures.rs b/swarm-wire/src/agent_closures.rs
index 68aea9c8..2830ff2b 100644
--- a/swarm-wire/src/agent_closures.rs
+++ b/swarm-wire/src/agent_closures.rs
@@ -32,10 +32,6 @@ pub struct AgentClosure {
     pub system: String,
     /// When the controller recorded the build, in unix seconds.
     pub built_unix: i64,
-    /// Whether the builder pushed the closure to the binary cache. A record
-    /// written before the field existed reads as false.
-    #[serde(default)]
-    pub cached: bool,
 }
 
 #[cfg(test)]
@@ -55,14 +51,12 @@ mod tests {
             store_path: "/nix/store/x".to_owned(),
             system: "x86_64-linux".to_owned(),
             built_unix: 7,
-            cached: true,
         };
         let wire = serde_json::json!({
             "meta_rev": "abc",
             "store_path": "/nix/store/x",
             "system": "x86_64-linux",
             "built_unix": 7,
-            "cached": true,
         });
         assert_eq!(serde_json::to_value(&value).expect("encodes"), wire);
         assert_eq!(
@@ -70,16 +64,4 @@ mod tests {
             value
         );
     }
-
-    #[test]
-    fn a_record_without_the_field_reads_as_not_cached() {
-        let old = serde_json::json!({
-            "meta_rev": "abc",
-            "store_path": "/nix/store/x",
-            "system": "x86_64-linux",
-            "built_unix": 7,
-        });
-        let record = serde_json::from_value::<AgentClosure>(old).expect("decodes");
-        assert!(!record.cached);
-    }
 }
diff --git a/swarm-wire/src/builder.rs b/swarm-wire/src/builder.rs
index 2a5d67b3..ea71bb87 100644
--- a/swarm-wire/src/builder.rs
+++ b/swarm-wire/src/builder.rs
@@ -140,16 +140,8 @@ pub struct BuildFromMeta {
 #[serde(tag = "state", rename_all = "kebab-case")]
 pub enum FromMetaReply {
     /// The toplevel built; `out_path` is its store path in the builder host's
-    /// store and `system` the platform the builder host builds for. `cached`
-    /// is whether the builder pushed the closure to the binary cache; a failed
-    /// push leaves the build green with `cached` false. A builder that predates
-    /// the field answers without it, which reads as false.
-    Built {
-        out_path: String,
-        system: String,
-        #[serde(default)]
-        cached: bool,
-    },
+    /// store and `system` the platform the builder host builds for.
+    Built { out_path: String, system: String },
     /// The build did not succeed: the last lines `nix` printed, or why it
     /// stopped (it timed out, or could not start). The controller holds the
     /// deploy back and builds again on its next round.
@@ -261,14 +253,8 @@ mod tests {
                 FromMetaReply::Built {
                     out_path: "/nix/store/x".to_owned(),
                     system: "x86_64-linux".to_owned(),
-                    cached: true,
                 },
-                json!({
-                    "state": "built",
-                    "out_path": "/nix/store/x",
-                    "system": "x86_64-linux",
-                    "cached": true,
-                }),
+                json!({"state": "built", "out_path": "/nix/store/x", "system": "x86_64-linux"}),
             ),
             (
                 FromMetaReply::Failed {
@@ -291,19 +277,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn a_built_reply_from_a_builder_without_the_field_reads_as_not_cached() {
-        let old = json!({"state": "built", "out_path": "/nix/store/x", "system": "s"});
-        assert_eq!(
-            serde_json::from_value::<FromMetaReply>(old).expect("decodes"),
-            FromMetaReply::Built {
-                out_path: "/nix/store/x".to_owned(),
-                system: "s".to_owned(),
-                cached: false,
-            }
-        );
-    }
-
     #[test]
     fn the_subjects_are_pinned() {
         assert_eq!(SUBJECT, "$SWARM.builder.build");