diff --git a/docs/agent-lifecycle/persistence.md b/docs/agent-lifecycle/persistence.md
index 08eb802f..c28f7b15 100644
--- a/docs/agent-lifecycle/persistence.md
+++ b/docs/agent-lifecycle/persistence.md
@@ -578,18 +578,20 @@ agent has one; a `null` URL with no operator-declared account is the
 "this agent has no matrix" state.
 
 **First-boot ordering**: a token can arrive after the container comes
-up — a file the hive delivers, or a token the swarm mints into the store.
+up — a declared token file, or a token the swarm mints into the store.
 Without the path-trigger sibling
 (`systemd.paths.hive-matrix-daemon`, `PathExistsGlob =
 <this agent's state dir>/matrix-token*` — the trailing `*` also catches
-a secondary multi-account token like `matrix-token-ccc`), the daemon
+a declared secondary token file like `matrix-token-ccc`), the daemon
 would exit 0 quietly the first time it ran and the MCP would have no
 daemon until the next restart. The `.path` unit makes the appearance
 of the token re-fire the service so the daemon comes alive in the
 same boot cycle as
 provisioning. A token in the store changes no file, so a store-backed agent
 also gets a timer that restarts the daemon five minutes after it last
-exited. The same token watcher also drives avatar setting: on a
+exited. A running daemon re-lists its linked accounts in the store
+every two minutes and, when the set changed, exits with status
+75, which the unit's `RestartForceExitStatus` restarts. The same token watcher also drives avatar setting: on a
 restart the daemon re-runs each account's bring-up, which sets the
 avatar (see below).
 
diff --git a/docs/tools/matrix.md b/docs/tools/matrix.md
index 14f5236d..5cd8eeeb 100644
--- a/docs/tools/matrix.md
+++ b/docs/tools/matrix.md
@@ -104,8 +104,15 @@ evaluation with a message saying so. Declaring an external account with
 its own `homeserver` is enough on its own; a hive homeserver isn't
 required.
 
+An account linked from the swarm UI needs no entry in this map.
+`swarm-controller` stores it at `swarm/agents/<agent>/matrix/<account>`.
+The daemon lists that directory under the agent's own certificate at
+start and every two minutes, and restarts itself when the set of linked
+accounts changes. A declared entry of the same name wins.
+
 Every matrix tool above takes an optional `account` parameter (a name
-from this map) to act as that identity instead of the primary one.
+from this map, or a linked account's) to act as that identity instead
+of the primary one.
 
 Declaring an extra account also changes what the agent *receives*: wake
 bodies and invite todos gain an `[acct:<name>]` prefix — see
diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md
index cf843b05..b14bdc62 100644
--- a/docs/trust-boundary/security.md
+++ b/docs/trust-boundary/security.md
@@ -295,11 +295,10 @@ known operations; there is no arbitrary command pass-through:
 | `RemoveServiceDropin`                                          | remove `container@<name>.service.d/` drop-in on destroy                                                                                                                                                                                                                                                                                   |
 | `DaemonReload`                                                 | `systemctl daemon-reload`                                                                                                                                                                                                                                                                                                                 |
 | `RunForgeAdmin`                                                | `nixos-container run hive-forge -- runuser -u forgejo -- forgejo admin <args>`                                                                                                                                                                                                                                                            |
-| `WriteAgentMatrixToken`                                        | write `0600` credential file into agent state dir                                                                                                                                                                                                                                                                                         |
 | `ControlInfraContainer`                                        | `systemctl <action> container@<container>.service` — the `InfraContainer` enum is the allowlist, and serde rejects unknown names at the wire boundary (`hive-c0re` has no variant, so no request can name it)                                                                                                                             |
 | `SyncAgentTmpfiles`                                            | legacy: unlink `/etc/tmpfiles.d/hyperhive-agents.conf` and return `Ok`; kept one release for an older hive-c0re                                                                                                                                                                                                                           |
 | `SetAgentPaused`                                               | create / remove the `<state>/<name>/harness/paused` marker that parks an agent's turn loop                                                                                                                                                                                                                                                |
-| `WriteAgentGithubToken`                                        | write `0600` `github-token` into agent state dir (same semantics as the forge/matrix token writes)                                                                                                                                                                                                                                        |
+| `WriteAgentGithubToken`                                        | write `0600` `github-token` into agent state dir (same semantics as the extra-forge account writes)                                                                                                                                                                                                                                       |
 | `WriteAgentExtraForgeAccount` / `DeleteAgentExtraForgeAccount` | write / remove `forge-<label>-token` + a `forge-<label>.json` base-URL sidecar, both `0600`. hive-priv validates `label` as a plain identifier before it reaches the filename — an unchecked one traverses out of the state dir                                                                                                           |
 | `RegisterCiRunner`                                             | write `/run/hive-ci/runner-token` (host path, root-owned) then `systemctl --machine=hive-ci restart gitea-runner-hive.service`. Only the registration token crosses; the forge admin token never enters the container                                                                                                                     |
 | `EnsureAgentSubvolume`                                         | `btrfs subvolume create <state>/<name>` for a new agent — no-op when the path exists or the filesystem isn't btrfs                                                                                                                                                                                                                        |
diff --git a/frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx b/frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx
index de08cdbe..55bcceac 100644
--- a/frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx
+++ b/frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx
@@ -6,9 +6,9 @@
 //              (required, here) homeserver itself and stores the token
 //              that comes back. The password is sent once, over this
 //              PUT, straight to swarm-controller — never held here past
-//              the request, never sent to the hive.
+//              the request, never stored.
 // PUTs `/api/hives/{hive}/agents/{agent}/matrix-accounts/{account}` —
-// 200 (`{ user_id? }`) on success, 400/503/500 on the documented failure
+// 200 (`{ user_id? }`) on success, 400/500 on the documented failure
 // arms — all handled generically via `readApiError`/`ApiErrorPanel`,
 // same as every other form here, since the response is `problem+json`
 // regardless of which arm fired.
@@ -138,9 +138,9 @@ export function LinkMatrixAccountForm({
       onClose={onClose}
     >
       <p>
-        Writes the credential to the swarm secret store and notifies{" "}
-        <strong>{hive}</strong> to deliver it. The agent's own matrix daemon
-        picks it up next — nothing here restarts anything directly.
+        Writes the credential to the swarm secret store. The agent's own matrix
+        daemon reads it from there within two minutes — nothing here restarts
+        anything directly.
       </p>
       <form class="link-matrix-account-form" onSubmit={submit}>
         <TextField
diff --git a/hive-c0re/src/lifecycle/agent_identity.rs b/hive-c0re/src/lifecycle/agent_identity.rs
index 9fff4044..604b59b8 100644
--- a/hive-c0re/src/lifecycle/agent_identity.rs
+++ b/hive-c0re/src/lifecycle/agent_identity.rs
@@ -94,9 +94,7 @@ enum Skipped {
 async fn collect(agent: &str, dir: &Path) -> Result<(), Skipped> {
     // The hive's name is the cert-auth role it logs in as: `glue-bao-tls.nix`
     // mints this host's client certificate with the hive name as its CN and a
-    // bao cert role matches on CN, so the two share a name by construction —
-    // the same reasoning `swarm_status::handle_credential_notice` records for
-    // the other read this hive does on an agent's behalf.
+    // bao cert role matches on CN, so the two share a name by construction.
     let Some(hive) = crate::container_view::hive_swarm_names().0 else {
         return Err(Skipped::NotConfigured(
             "HYPERHIVE_HIVE_NAME is unset, so this hive has no role to log in as",
diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index 87ebffd8..25f95e89 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -217,7 +217,7 @@ fn persist_sender_token(path: &std::path::Path, access_token: &str) -> Result<()
 /// store identity.
 ///
 /// The cert role is the hive's name, straight out of `HYPERHIVE_HIVE_NAME` —
-/// the same role string `workers::credential` logs in with, and already in
+/// the same role string `lifecycle::agent_identity` logs in with, and already in
 /// this process's environment, so the store read costs no plumbing through
 /// [`ensure_all`]. That name is also the path's own hive segment, which is
 /// what makes this read reach **this** hive's token and 403 on any other's:
diff --git a/hive-c0re/src/priv_client.rs b/hive-c0re/src/priv_client.rs
index d93b698f..a490aef0 100644
--- a/hive-c0re/src/priv_client.rs
+++ b/hive-c0re/src/priv_client.rs
@@ -369,32 +369,6 @@ pub async fn set_agent_paused(agent_name: &str, paused: bool) -> Result<()> {
     .await?)
 }
 
-/// Write a Matrix access token for `agent_name` via hive-priv (running as
-/// root). `account: None` writes the hive-internal
-/// `<state>/matrix-token`; `account: Some(name)` writes
-/// `<state>/matrix-token-<name>` for an extra (external) account. The file
-/// is written 0600 and chowned to the agent user so it is readable from
-/// inside the agent container. hive-priv validates the account suffix.
-///
-/// `homeserver: Some(url)` (only meaningful with `account: Some`) also
-/// writes the sidecar `<state>/matrix-account-<name>.json` so the daemon
-/// can auto-discover the extra account without a `matrixAccounts` config
-/// declaration (see issue tracker "external matrix account auto-discovery").
-pub async fn write_agent_matrix_token(
-    agent_name: &str,
-    token: &str,
-    account: Option<&str>,
-    homeserver: Option<&str>,
-) -> Result<()> {
-    ok(call(&PrivRequest::WriteAgentMatrixToken {
-        agent_name: agent_name.to_owned(),
-        token: token.to_owned(),
-        account: account.map(ToOwned::to_owned),
-        homeserver: homeserver.map(ToOwned::to_owned),
-    })
-    .await?)
-}
-
 /// Write a GitHub personal access token (PAT) for `agent_name` via hive-priv
 /// (running as root). Writes `<state>/github-token` 0600, chowned to the agent
 /// user so the `gh` wrapper / git credential helper can read it from inside the
diff --git a/hive-c0re/src/swarm_status.rs b/hive-c0re/src/swarm_status.rs
index 49825a5a..23689732 100644
--- a/hive-c0re/src/swarm_status.rs
+++ b/hive-c0re/src/swarm_status.rs
@@ -207,22 +207,8 @@ async fn drain_swarm_events(
             return;
         }
     };
-    // Also this hive's own, and for a second reason on top of the deploy
-    // subject's: the payload names an agent in *this* hive's state dir, so a
-    // notice for another hive is not merely noise, it is unactionable here.
-    let credential_subject = swarm_queue_client::credential_subject(&hive);
-    let mut credential_sub = match client.subscribe(credential_subject.clone()).await {
-        Ok(sub) => sub,
-        Err(e) => {
-            tracing::warn!(
-                subject = %credential_subject, error = %e,
-                "swarm events: subscribe failed; this hive will not hear credential notices"
-            );
-            return;
-        }
-    };
     tracing::info!(
-        %subject, %deploy_subject, %credential_subject,
+        %subject, %deploy_subject,
         "swarm events: listening"
     );
 
@@ -254,13 +240,6 @@ async fn drain_swarm_events(
                 };
                 handle_deploy_request(&coord, &msg.payload).await;
             }
-            msg = credential_sub.next() => {
-                let Some(msg) = msg else {
-                    tracing::warn!(subject = %credential_subject, "swarm events: credential subscription closed");
-                    return;
-                };
-                handle_credential_notice(&hive, &msg.payload).await;
-            }
             _ = shutdown.changed() => {
                 tracing::info!("swarm events: shutdown signal received");
                 return;
@@ -274,39 +253,6 @@ async fn drain_swarm_events(
 ///
 /// A payload that will not decode is worth a `warn`: the controller and this
 /// end share one type, so a decode failure means they disagree about it.
-/// Deliver the credential a [`swarm_queue_client::CredentialNotice`] names.
-///
-/// `hive` doubles as the cert-auth role this hive logs into the store as:
-/// `glue-bao-tls.nix` mints the client certificate with the hive name as its
-/// CN, and a bao cert role matches on CN — so the two share a name by
-/// construction rather than by convention.
-///
-/// ⚠️ Nothing here can log the secret, and that is structural rather than
-/// careful: the notice carries only names, and `deliver` writes the value
-/// without returning it.
-async fn handle_credential_notice(hive: &str, payload: &[u8]) {
-    let notice: swarm_queue_client::CredentialNotice = match serde_json::from_slice(payload) {
-        Ok(notice) => notice,
-        Err(e) => {
-            tracing::warn!(error = %e, "swarm events: undecodable credential notice");
-            return;
-        }
-    };
-    if let Err(e) = crate::workers::credential::deliver(&notice, hive).await {
-        // Warn rather than retry: the controller republishes, and a hive that
-        // spun here would hold the queue task off its other two subjects.
-        tracing::warn!(
-            agent = %notice.agent, account = %notice.account, error = ?e,
-            "swarm events: credential delivery failed"
-        );
-        return;
-    }
-    tracing::info!(
-        agent = %notice.agent, account = %notice.account,
-        "swarm events: credential delivered"
-    );
-}
-
 async fn handle_deploy_request(
     coord: &std::sync::Arc<crate::coordinator::Coordinator>,
     payload: &[u8],
diff --git a/hive-c0re/src/workers/credential.rs b/hive-c0re/src/workers/credential.rs
deleted file mode 100644
index 72ee4745..00000000
--- a/hive-c0re/src/workers/credential.rs
+++ /dev/null
@@ -1,116 +0,0 @@
-//! Delivering an agent's external-account credential from the swarm's secret
-//! store into that agent's own state dir.
-//!
-//! The controller publishes a [`CredentialNotice`] naming an agent and an
-//! account; this reads the value out of the store and hands it to `hive-priv`,
-//! which writes it where the agent's matrix daemon already watches. The write
-//! goes through the privileged helper because the file lands in a directory
-//! owned by the agent and has to be chowned to it — written from here it
-//! arrives owned by `hive-core` and the agent cannot read its own credential.
-//! `hive-priv` also builds the filename, so nothing in this module decides it.
-//!
-//! Nothing here activates anything: `nix/agent-modules/matrix.nix` has a
-//! `systemd.paths` unit globbing `matrix-token*` inside that agent's own state
-//! dir, which re-fires the daemon when a token appears, so arrival is the
-//! whole trigger.
-//!
-//! 🔑 The notice carries no secret — see [`swarm_queue_client::credential_subject`]
-//! for why that is a requirement rather than a preference. The value is read
-//! from the store under this hive's own identity.
-
-use anyhow::{Context, Result};
-use hive_types::Ident;
-use swarm_queue_client::CredentialNotice;
-use swarm_secret_client::{SecretStore, matrix};
-
-/// Read the credential `notice` names and write it into the agent's state dir.
-///
-/// `cert_role` is the role on the store's `cert` auth mount whose policy scopes
-/// what this hive may read.
-///
-/// # Errors
-/// The store refusing, being unreachable, or holding nothing at that path; a
-/// name that is not a single path segment; or the write failing.
-pub async fn deliver(notice: &CredentialNotice, cert_role: &str) -> Result<()> {
-    // Parsed before anything is read, so a malformed name costs a decode and
-    // not a round trip to the store.
-    let agent = Ident::parse(&notice.agent)
-        .map_err(|e| anyhow::anyhow!("agent name {:?} off the queue: {e}", notice.agent))?;
-    let secret_path = matrix::account_path(&notice.agent, &notice.account)
-        .context("building the credential's path in the store")?;
-
-    let store = SecretStore::from_env(cert_role)
-        .await
-        .context("connecting to the swarm secret store")?;
-    let credential: matrix::Credential = store
-        .read(&secret_path)
-        .await
-        .with_context(|| format!("reading {secret_path} from the store"))?;
-
-    // Through hive-priv rather than writing here: the file lands in a directory
-    // owned by the agent, and only root can chown it there. Written directly it
-    // arrives owned by `hive-core` at 0600 — the daemon wakes on it appearing
-    // and cannot read it. hive-priv also builds the filename, so the name the
-    // watcher globs for is decided in one place now.
-    //
-    // A homeserver is passed through when the stored credential carries one;
-    // hive-priv then writes the `matrix-account-<name>.json` sidecar beside the
-    // token, which is how the daemon discovers an extra account's homeserver
-    // without a static `matrixAccounts` entry. Credentials written before that
-    // field existed carry `None`, and the sidecar is simply not written — the
-    // account then needs a configured entry, exactly as it did before.
-    crate::priv_client::write_agent_matrix_token(
-        agent.as_str(),
-        &credential.value,
-        Some(&notice.account),
-        credential.homeserver.as_deref(),
-    )
-    .await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_name_that_could_address_another_agent_is_refused() {
-        // `matrix::account_path` owns this rule; asserted here because this is
-        // the module that feeds it names off the wire.
-        assert!(matrix::account_path("../argus", "ccc").is_err());
-        assert!(matrix::account_path("dmatrix", "../../etc/x").is_err());
-        assert!(matrix::account_path("dmatrix", "ccc").is_ok());
-    }
-
-    #[test]
-    fn an_agent_name_off_the_queue_must_pass_the_ident_parser_too() {
-        // Two independent refusals, not one restated: `matrix::account_path`
-        // guards the address in the *store*, and `Ident` guards the name this
-        // module hands to hive-priv, which builds the on-disk path from it.
-        for bad in ["../argus", "dmatrix/../argus", "Dmatrix", "d matrix", ""] {
-            assert!(Ident::parse(bad).is_err(), "{bad:?} must be refused");
-        }
-        // The control: without it, a parser that rejected everything would
-        // satisfy the loop above.
-        assert!(Ident::parse("dmatrix").is_ok());
-    }
-
-    /// The account half of that same rule now lives where the filename is
-    /// built — `hive-priv`'s `validate_account_name`, asserted there with the
-    /// same arms and the same two controls. It is not restated here because
-    /// this module no longer builds the path.
-    #[test]
-    fn an_account_name_off_the_queue_is_refused_for_the_store_path() {
-        for bad in ["../argus", "a/b", "a b", ""] {
-            assert!(
-                matrix::account_path("dmatrix", bad).is_err(),
-                "account {bad:?} must be refused"
-            );
-        }
-        // Controls: the legal charset stays reachable, so the loop above is not
-        // passing because everything is refused. Uppercase and underscore are
-        // deliberate — `matrixAccounts` is an attrset, so both are names an
-        // operator can already write, and hive-priv must accept them too.
-        assert!(matrix::account_path("dmatrix", "ops-relay").is_ok());
-        assert!(matrix::account_path("dmatrix", "Ops_Relay9").is_ok());
-    }
-}
diff --git a/hive-c0re/src/workers/mod.rs b/hive-c0re/src/workers/mod.rs
index bc6f232b..da62baaa 100644
--- a/hive-c0re/src/workers/mod.rs
+++ b/hive-c0re/src/workers/mod.rs
@@ -8,7 +8,6 @@
 pub mod agent_sockets;
 pub mod auto_update;
 pub mod crash_watch;
-pub mod credential;
 pub mod knowledge;
 pub mod mcp_sockets;
 pub mod scheduled_prompts_worker;
diff --git a/hive-matrix-mcp/src/accounts.rs b/hive-matrix-mcp/src/accounts.rs
index 39cd36bc..7aff40f5 100644
--- a/hive-matrix-mcp/src/accounts.rs
+++ b/hive-matrix-mcp/src/accounts.rs
@@ -2,11 +2,13 @@
 //!
 //! A single `hive-matrix-daemon` can serve N matrix accounts (one
 //! matrix-sdk `Client` each, with its own session/store dir + sync
-//! loop). Accounts come from the `HIVE_MATRIX_ACCOUNTS` env var (JSON,
-//! written by the nix harness module from
+//! loop). Accounts come from two places: the `HIVE_MATRIX_ACCOUNTS` env var
+//! (JSON, written by the nix harness module from
 //! `services.hyperhive.agent.matrixAccounts`), which declares the
 //! **hive-internal account** (named `main`) as an ordinary entry
-//! alongside any others.
+//! alongside any others; and the accounts the swarm secret store links to
+//! this agent ([`discover_linked`]), which an operator linked through the
+//! swarm UI.
 //!
 //! `main` is always present and is always the primary: it is moved to
 //! index 0 whichever position it was declared at, and if the env var
@@ -22,7 +24,7 @@
 //! `Registry::resolve` / `pick_name`) — the agent can't tell more than one
 //! account exists, so it must choose explicitly.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
@@ -30,9 +32,9 @@ use anyhow::Context as _;
 use matrix_sdk::Client;
 use serde::{Deserialize, Serialize};
 
-use crate::paths;
+use crate::{credential, paths};
 
-/// One declared matrix account. `homeserver` is optional per account
+/// One matrix account. `homeserver` is optional per account
 /// (defaults to the daemon-wide `HIVE_MATRIX_URL`) so accounts on the
 /// same homeserver need not repeat it.
 #[derive(Debug, Clone, Deserialize)]
@@ -40,9 +42,10 @@ pub struct AccountCfg {
     /// Logical name the agent uses to address this account
     /// (`account` arg on the MCP tools). Unique within the daemon.
     pub name: String,
-    /// Path to the bearer-token file for this account (hive-c0re
-    /// writes it; the daemon reads it).
-    pub token_file: PathBuf,
+    /// The declared bearer-token file, read when the store has no token for
+    /// this account. `None` for an account the store links, whose token only
+    /// the store holds.
+    pub token_file: Option<PathBuf>,
     /// Per-account matrix-sdk sqlite store dir (crypto keys + cache).
     pub state_dir: PathBuf,
     /// Homeserver URL; falls back to [`paths::homeserver_url`] when absent.
@@ -54,9 +57,7 @@ impl AccountCfg {
     /// The effective homeserver URL — this account's own, else the
     /// daemon-wide `HIVE_MATRIX_URL` — or `None` when neither is set.
     ///
-    /// `None` is a real answer, not a failure: the account is skipped, the
-    /// same way `discover_token_accounts_in` already skips a discovered
-    /// token whose homeserver sidecar is missing.
+    /// `None` is a real answer, not a failure: the account is skipped.
     #[must_use]
     pub fn homeserver(&self) -> Option<String> {
         self.homeserver.clone().or_else(paths::homeserver_url)
@@ -67,10 +68,9 @@ impl AccountCfg {
 /// resolves to when it omits `account`.
 const HIVE_ACCOUNT: &str = "main";
 
-/// Build the account list: everything declared in `HIVE_MATRIX_ACCOUNTS`,
+/// Build the declared account list: everything in `HIVE_MATRIX_ACCOUNTS`,
 /// with the hive-internal `main` account hoisted to index 0 (= primary)
-/// or synthesized there when the declaration doesn't carry one, plus any
-/// dashboard-provisioned accounts discovered on disk.
+/// or synthesized there when the declaration doesn't carry one.
 ///
 /// With no `HIVE_MATRIX_ACCOUNTS` set this returns just `main`, so a
 /// single-account agent is unchanged.
@@ -85,19 +85,7 @@ pub fn configured() -> anyhow::Result<Vec<AccountCfg>> {
             .map_err(|e| anyhow::anyhow!("parse HIVE_MATRIX_ACCOUNTS as JSON array: {e}"))?,
         None => Vec::new(),
     };
-    let mut accounts = ensure_hive_account(declared)?;
-    // Append dashboard-provisioned accounts (a `matrix-token-<name>` file +
-    // its `matrix-account-<name>.json` homeserver sidecar) that aren't
-    // already declared in config, so an account logged in via the dashboard
-    // form works without a `matrixAccounts` edit + rebuild. Explicit config
-    // wins on name collision — pass the configured set so discovery skips
-    // those names silently (a statically-configured account keeps its token
-    // on disk but is brought up from config, not discovery, so it must not
-    // log a spurious "no homeserver sidecar" warning).
-    let configured: std::collections::HashSet<String> =
-        accounts.iter().map(|a| a.name.clone()).collect();
-    accounts.extend(discover_token_accounts(&configured));
-    Ok(accounts)
+    ensure_hive_account(declared)
 }
 
 /// Put the hive-internal `main` account at index 0 of `declared`, then
@@ -135,13 +123,13 @@ fn ensure_hive_account(mut declared: Vec<AccountCfg>) -> anyhow::Result<Vec<Acco
             0,
             AccountCfg {
                 name: HIVE_ACCOUNT.to_owned(),
-                token_file: paths::token_file(),
+                token_file: Some(paths::token_file()),
                 state_dir: paths::matrix_state_dir(),
                 homeserver: None,
             },
         ),
     }
-    let mut seen = std::collections::HashSet::new();
+    let mut seen = HashSet::new();
     for a in &declared {
         if !seen.insert(a.name.as_str()) {
             anyhow::bail!("duplicate matrix account name {:?}", a.name);
@@ -150,88 +138,119 @@ fn ensure_hive_account(mut declared: Vec<AccountCfg>) -> anyhow::Result<Vec<Acco
     Ok(declared)
 }
 
-/// Scan the agent state dir for extra matrix accounts provisioned via the
-/// dashboard login form: each is a `matrix-token-<name>` file plus a
-/// `matrix-account-<name>.json` sidecar carrying the homeserver. Returns one
-/// [`AccountCfg`] per discovered account that has BOTH files — a token
-/// without a sidecar is skipped, because the homeserver is then unknown and
-/// defaulting to the hive homeserver would be wrong for an external account.
-/// Best-effort: an unreadable dir or malformed sidecar yields fewer
-/// accounts, never an error — explicit `HIVE_MATRIX_ACCOUNTS` config stays
-/// authoritative.
-///
-/// `configured` is the set of names already declared in
-/// `HIVE_MATRIX_ACCOUNTS`; those are brought up from config regardless of
-/// their on-disk sidecar, so discovery skips them silently rather than
-/// warning about a missing sidecar for an account that isn't actually down.
-fn discover_token_accounts(configured: &std::collections::HashSet<String>) -> Vec<AccountCfg> {
-    let token_path = paths::token_file();
-    let Some(state_dir) = token_path.parent() else {
-        return Vec::new();
-    };
-    discover_token_accounts_in(state_dir, configured)
+/// The accounts the store links to this agent beyond the declared ones, and
+/// the linked names that could not be brought up.
+#[derive(Debug, Default)]
+pub struct Discovery {
+    /// Accounts to bring up, in the order the store lists them.
+    pub accounts: Vec<AccountCfg>,
+    /// Listed names the store holds no credential for.
+    pub missing: Vec<String>,
+    /// Linked accounts stored without a homeserver. Defaulting to the hive's
+    /// would be wrong for an external account, so they are skipped.
+    pub no_homeserver: Vec<String>,
 }
 
-/// Body of [`discover_token_accounts`] with the state dir injected, so the
-/// scan (and the configured-name skip) is unit-testable against a tempdir.
-fn discover_token_accounts_in(
-    state_dir: &Path,
-    configured: &std::collections::HashSet<String>,
-) -> Vec<AccountCfg> {
-    let Ok(rd) = std::fs::read_dir(state_dir) else {
-        return Vec::new();
+/// Ask the store which accounts it links to this agent, as [`AccountCfg`]s
+/// for every one `declared` does not already name.
+///
+/// Empty when the harness names no agent or the container was given no store.
+///
+/// # Errors
+/// The store refusing or failing a read; see [`credential::linked_accounts`].
+pub async fn discover_linked(declared: &[AccountCfg]) -> anyhow::Result<Discovery> {
+    let Some(agent) = credential::agent_name() else {
+        return Ok(Discovery::default());
     };
-    let mut out = Vec::new();
-    for entry in rd.flatten() {
-        let fname = entry.file_name();
-        let Some(fname) = fname.to_str() else {
-            continue;
-        };
-        // `matrix-token` (no suffix) is the hive account, handled separately;
-        // only `matrix-token-<name>` files are extra accounts.
-        let Some(name) = fname.strip_prefix("matrix-token-") else {
-            continue;
-        };
-        if name.is_empty() {
+    let Some(linked) = credential::linked_accounts(&agent).await? else {
+        return Ok(Discovery::default());
+    };
+    let declared: HashSet<&str> = declared.iter().map(|a| a.name.as_str()).collect();
+    let mut out = linked_cfgs(&state_root(), &declared, linked.found);
+    out.missing = linked.missing;
+    Ok(out)
+}
+
+/// The pure half of [`discover_linked`], with the state dir injected so it is
+/// testable without a store.
+fn linked_cfgs(
+    state_root: &Path,
+    declared: &HashSet<&str>,
+    linked: Vec<credential::Linked>,
+) -> Discovery {
+    let mut out = Discovery::default();
+    for l in linked {
+        // A declared account is brought up from its declaration.
+        if declared.contains(l.name.as_str()) {
             continue;
         }
-        // Already declared in config: it's brought up from `HIVE_MATRIX_ACCOUNTS`,
-        // not discovery, and its on-disk token needs no sidecar. Skip silently so
-        // a statically-configured account doesn't log a spurious missing-sidecar
-        // warning.
-        if configured.contains(name) {
-            continue;
-        }
-        let sidecar = state_dir.join(format!("matrix-account-{name}.json"));
-        let Some(homeserver) = read_account_homeserver(&sidecar) else {
-            tracing::warn!(
-                account = name,
-                sidecar = %sidecar.display(),
-                "matrix: discovered token but no homeserver sidecar; skipping account \
-                 (re-link the account from the swarm UI to write it)"
-            );
+        let Some(homeserver) = l.homeserver.filter(|h| !h.is_empty()) else {
+            out.no_homeserver.push(l.name);
             continue;
         };
-        out.push(AccountCfg {
-            name: name.to_owned(),
-            token_file: entry.path(),
-            state_dir: state_dir.join(format!("matrix-sdk-state-{name}")),
+        out.accounts.push(AccountCfg {
+            state_dir: state_root.join(format!("matrix-sdk-state-{}", l.name)),
+            name: l.name,
+            token_file: None,
             homeserver: Some(homeserver),
         });
     }
     out
 }
 
-/// Read `{"homeserver": "<url>"}` from a sidecar file. `None` when the file
-/// is missing, unreadable, not valid JSON, or the `homeserver` field is
-/// absent / empty.
-fn read_account_homeserver(path: &Path) -> Option<String> {
-    let raw = std::fs::read_to_string(path).ok()?;
-    let json: serde_json::Value = serde_json::from_str(&raw).ok()?;
-    json.get("homeserver")?
-        .as_str()
-        .filter(|s| !s.is_empty())
-        .map(ToOwned::to_owned)
+/// This agent's state dir, the parent of the `main` token file.
+fn state_root() -> PathBuf {
+    paths::token_file()
+        .parent()
+        .map(Path::to_path_buf)
+        .unwrap_or_default()
+}
+
+/// Remove token files a hive delivered into this agent's state dir: each
+/// `matrix-account-<name>.json` homeserver sidecar, and the
+/// `matrix-token-<name>` beside it unless `declared` names `<name>`.
+///
+/// Nothing in this tree writes those files: an account linked through the
+/// swarm comes from the store. A sidecar is what marks a pair as delivered
+/// rather than an operator's: a declared `tokenFile` has none. Best-effort —
+/// a failure is logged and skipped.
+pub fn remove_delivered_files(declared: &[AccountCfg]) {
+    let declared: HashSet<&str> = declared.iter().map(|a| a.name.as_str()).collect();
+    remove_delivered_files_in(&state_root(), &declared);
+}
+
+/// Body of [`remove_delivered_files`] with the state dir injected.
+fn remove_delivered_files_in(state_root: &Path, declared: &HashSet<&str>) {
+    let Ok(rd) = std::fs::read_dir(state_root) else {
+        return;
+    };
+    for entry in rd.flatten() {
+        let fname = entry.file_name();
+        let Some(name) = fname
+            .to_str()
+            .and_then(|f| f.strip_prefix("matrix-account-"))
+            .and_then(|f| f.strip_suffix(".json"))
+            .filter(|n| !n.is_empty())
+        else {
+            continue;
+        };
+        let mut doomed = vec![entry.path()];
+        if !declared.contains(name) {
+            doomed.push(state_root.join(format!("matrix-token-{name}")));
+        }
+        for path in doomed {
+            match std::fs::remove_file(&path) {
+                Ok(()) => {
+                    tracing::info!(path = %path.display(), "removed a hive-delivered matrix file");
+                }
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+                Err(e) => tracing::warn!(
+                    path = %path.display(), error = %e,
+                    "could not remove a hive-delivered matrix file"
+                ),
+            }
+        }
+    }
 }
 
 /// Live status of one matrix account, as reported by [`Registry::list`]
@@ -393,10 +412,9 @@ impl Registry {
 /// file. Idempotent — skips the rewrite when the on-disk content already
 /// matches, keeping the mtime stable. Used for the boot-time publish.
 ///
-/// The daemon rebuilds this file fresh on every boot (and is restarted
-/// by the `matrix-token*` path-watcher when a new account is
-/// provisioned), so the file lists exactly the accounts that restored at
-/// the last start. Real-time liveness is conveyed by the file mtime,
+/// The daemon rebuilds this file fresh on every boot, and restarts itself
+/// when the store's linked accounts change, so the file lists exactly the
+/// accounts that restored at the last start. Real-time liveness is conveyed by the file mtime,
 /// which the daemon advances on a timer via
 /// [`heartbeat_accounts_snapshot`] — a stalled mtime means the daemon is
 /// down, so a reader can treat an old snapshot as stale.
@@ -454,19 +472,21 @@ fn write_accounts_snapshot_inner(
 #[cfg(test)]
 mod tests {
     use std::collections::HashSet;
-
-    use std::path::PathBuf;
+    use std::path::{Path, PathBuf};
 
     use super::{
-        AccountCfg, AccountStatus, discover_token_accounts_in, ensure_hive_account,
-        heartbeat_accounts_snapshot, pick_name, write_accounts_snapshot,
+        AccountCfg, AccountStatus, ensure_hive_account, heartbeat_accounts_snapshot, linked_cfgs,
+        pick_name, remove_delivered_files_in, write_accounts_snapshot,
     };
+    use crate::credential::Linked;
 
     /// A declared account, as the nix module would serialize it.
     fn cfg(name: &str) -> AccountCfg {
         AccountCfg {
             name: name.to_owned(),
-            token_file: PathBuf::from(format!("/agents/a/state/matrix-token-{name}")),
+            token_file: Some(PathBuf::from(format!(
+                "/agents/a/state/matrix-token-{name}"
+            ))),
             state_dir: PathBuf::from(format!("/agents/a/state/matrix-sdk-state-{name}")),
             homeserver: Some(format!("https://{name}.example")),
         }
@@ -482,7 +502,7 @@ mod tests {
         assert_eq!(out[0].name, "main");
         assert_eq!(
             out[0].token_file,
-            PathBuf::from("/agents/a/state/matrix-token-main")
+            Some(PathBuf::from("/agents/a/state/matrix-token-main"))
         );
         assert_eq!(out[0].homeserver.as_deref(), Some("https://main.example"));
     }
@@ -521,9 +541,43 @@ mod tests {
     }
 
     #[test]
-    fn discovery_skips_configured_names_and_orphan_tokens() {
+    fn linked_accounts_skip_declared_names_and_ones_with_no_homeserver() {
+        let linked = vec![
+            Linked {
+                name: "catgirl".to_owned(),
+                homeserver: Some("https://declared.example".to_owned()),
+            },
+            Linked {
+                name: "bare".to_owned(),
+                homeserver: None,
+            },
+            Linked {
+                name: "good".to_owned(),
+                homeserver: Some("https://good.example".to_owned()),
+            },
+        ];
+        let declared: HashSet<&str> = ["main", "catgirl"].into_iter().collect();
+        let out = linked_cfgs(Path::new("/agents/a/state"), &declared, linked);
+
+        let names: Vec<&str> = out.accounts.iter().map(|a| a.name.as_str()).collect();
+        assert_eq!(names, ["good"]);
+        assert_eq!(out.no_homeserver, ["bare"]);
+        let good = &out.accounts[0];
+        // The store holds the token, so there is no file to fall back to; the
+        // session dir keeps the name a hive-delivered account had, so its
+        // crypto store carries over.
+        assert_eq!(good.token_file, None);
+        assert_eq!(
+            good.state_dir,
+            PathBuf::from("/agents/a/state/matrix-sdk-state-good")
+        );
+        assert_eq!(good.homeserver.as_deref(), Some("https://good.example"));
+    }
+
+    #[test]
+    fn delivered_files_go_and_operator_files_stay() {
         let dir = std::env::temp_dir().join(format!(
-            "hh-acct-disc-{}-{}",
+            "hh-acct-clean-{}-{}",
             std::process::id(),
             std::time::SystemTime::now()
                 .duration_since(std::time::UNIX_EPOCH)
@@ -531,33 +585,35 @@ mod tests {
                 .as_nanos()
         ));
         std::fs::create_dir_all(&dir).unwrap();
-
-        // A statically-configured account: token on disk, NO sidecar.
+        let sidecar = r#"{"homeserver":"https://x.example"}"#;
+        // Delivered and not declared: both files go.
+        std::fs::write(dir.join("matrix-token-linked"), "tok").unwrap();
+        std::fs::write(dir.join("matrix-account-linked.json"), sidecar).unwrap();
+        // Delivered and also declared: the sidecar goes, the declared token stays.
         std::fs::write(dir.join("matrix-token-catgirl"), "tok").unwrap();
-        // An orphan dashboard token: no sidecar, not configured.
-        std::fs::write(dir.join("matrix-token-orphan"), "tok").unwrap();
-        // A fully dashboard-provisioned account: token + sidecar.
-        std::fs::write(dir.join("matrix-token-good"), "tok").unwrap();
-        std::fs::write(
-            dir.join("matrix-account-good.json"),
-            r#"{"homeserver":"https://good.example"}"#,
-        )
-        .unwrap();
-        // The hive account's own token must never be treated as an extra.
+        std::fs::write(dir.join("matrix-account-catgirl.json"), sidecar).unwrap();
+        // An operator's by-hand token has no sidecar, and the hive account's own
+        // token is not an extra: both stay.
+        std::fs::write(dir.join("matrix-token-byhand"), "tok").unwrap();
         std::fs::write(dir.join("matrix-token"), "tok").unwrap();
 
-        let configured: HashSet<String> = ["main", "catgirl"]
-            .iter()
-            .map(|s| (*s).to_owned())
-            .collect();
-        let mut found: Vec<String> = discover_token_accounts_in(&dir, &configured)
-            .into_iter()
-            .map(|a| a.name)
-            .collect();
-        found.sort();
+        let declared: HashSet<&str> = ["main", "catgirl"].into_iter().collect();
+        remove_delivered_files_in(&dir, &declared);
 
-        // catgirl (configured) + orphan (no sidecar) skipped; only `good` discovered.
-        assert_eq!(found, vec!["good".to_owned()]);
+        let mut left: Vec<String> = std::fs::read_dir(&dir)
+            .unwrap()
+            .flatten()
+            .map(|e| e.file_name().to_string_lossy().into_owned())
+            .collect();
+        left.sort();
+        assert_eq!(
+            left,
+            [
+                "matrix-token",
+                "matrix-token-byhand",
+                "matrix-token-catgirl"
+            ]
+        );
 
         std::fs::remove_dir_all(&dir).ok();
     }
diff --git a/hive-matrix-mcp/src/credential.rs b/hive-matrix-mcp/src/credential.rs
index 8488ba92..da283457 100644
--- a/hive-matrix-mcp/src/credential.rs
+++ b/hive-matrix-mcp/src/credential.rs
@@ -1,5 +1,5 @@
 //! The matrix access token as a value this process holds, and the two places
-//! it comes from.
+//! it comes from; and the accounts the store links to this agent.
 //!
 //! 🩸 **A secret is a path, not a value.** Nothing here writes the token
 //! anywhere, interpolates it into a command, or lets it reach a log line or an
@@ -14,10 +14,12 @@
 //! systemd credential (`nix/agent-modules/bao.nix`). The hive is not in the
 //! path of the value at all.
 //!
-//! The file arm is the hive-side delivery that still runs beside this one for
-//! extra accounts (`hive_c0re::workers::credential`), and the `main` token a
-//! hive minted before the swarm did. That is what this replaces, not something
-//! it depends on, and it is the arm that goes when the hive-side loop does.
+//! Which accounts exist is read the same way: [`linked_accounts`] lists this
+//! agent's `matrix/` directory, which its policy grants `list` on
+//! (`swarm_secret_client::policy::render_agent`).
+//!
+//! The file arm is a `tokenFile` an operator declared in `matrixAccounts`, or
+//! the `main` token a hive minted before the swarm did.
 
 use std::path::{Path, PathBuf};
 
@@ -44,7 +46,7 @@ pub const ENV_AGENT: &str = "HIVE_AGENT_NAME";
 /// the whole point of this module is that the thing beside it never is.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum Origin {
-    /// A file in this agent's state dir, written by the hive-side delivery.
+    /// A `tokenFile` declared for this account.
     File(PathBuf),
     /// A path in the swarm secret store, read by this agent as itself.
     Store(String),
@@ -102,34 +104,21 @@ impl Token {
     /// Read this agent's credential for `account` out of the swarm secret
     /// store, under this agent's own certificate.
     ///
-    /// `Ok(None)` means this deployment has no store: the agent's hive was
-    /// given no `BAO_ADDR` to forward, so `nix/agent-modules/bao.nix` minted no
-    /// identity check and there is nothing here to log in to. That is an absent
-    /// integration, not a failure — the caller falls back to the file the hive
-    /// delivered.
+    /// `Ok(None)` means this container was given no store (no `BAO_ADDR`).
     ///
     /// # Errors
     /// A name that is not a single path segment, an environment naming an
     /// identity that cannot be read, a store that refuses the certificate or
     /// the path, or a credential stored empty.
     pub async fn from_store(agent: &str, account: &str) -> Result<Option<Self>> {
-        let Some(settings) = store_settings(|k| std::env::var(k).ok())? else {
-            return Ok(None);
-        };
         let path = matrix::account_path(agent, account)
             .context("building this agent's credential path in the store")?;
-        let role = policy::agent_object_name(agent)
-            .context("building this agent's cert-auth role name")?;
-
-        let store = SecretStore::connect(&settings, &role, DEFAULT_CERT_MOUNT)
-            .await
-            .context("logging in to the swarm secret store as this agent")?;
-        // The stored object also carries the account's homeserver, and it is
-        // deliberately dropped here: the account's URL is already settled by
-        // the time this runs (`AccountCfg::homeserver`), and taking it from the
-        // store instead would change which accounts come up at all — that is
-        // the discovery half of this move, which goes with the hive-side loop
-        // rather than with the read.
+        let Some(store) = connect(agent).await? else {
+            return Ok(None);
+        };
+        // The stored object also carries the account's homeserver, dropped
+        // here: the account's URL is settled before this runs
+        // (`AccountCfg::homeserver`), from config or from [`linked_accounts`].
         let credential: matrix::Credential = store
             .read(&path)
             .await
@@ -145,7 +134,7 @@ impl Token {
         }))
     }
 
-    /// Read a token out of the file the hive-side delivery wrote.
+    /// Read a token out of an account's declared `tokenFile`.
     ///
     /// `Ok(None)` when the file is not there — the account has not been
     /// provisioned yet, which the caller treats as "skip", not "fail".
@@ -190,11 +179,93 @@ impl Token {
     }
 }
 
+/// An account the store links to this agent: its name, and the homeserver
+/// stored beside its token.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Linked {
+    /// The account name, as the store lists it.
+    pub name: String,
+    /// `None` for a credential stored without one.
+    pub homeserver: Option<String>,
+}
+
+/// What [`linked_accounts`] found.
+#[derive(Debug, Default)]
+pub struct LinkedAccounts {
+    /// The listed accounts the store holds a credential for.
+    pub found: Vec<Linked>,
+    /// Listed names whose newest version the store answers 404 for: an account
+    /// whose credential was deleted while its metadata stays listed.
+    pub missing: Vec<String>,
+}
+
+/// The accounts the store lists under `agent`'s `matrix/` directory, each read
+/// for its homeserver.
+///
+/// `Ok(None)` means this container was given no store (no `BAO_ADDR`). An
+/// empty directory is an agent with no linked accounts, not an error.
+///
+/// # Errors
+/// A name that is not a single path segment, an environment naming an
+/// identity that cannot be read, or a store that refuses the certificate, the
+/// listing or a path. A policy minted without `list` on the agent's metadata
+/// path is refused the listing.
+pub async fn linked_accounts(agent: &str) -> Result<Option<LinkedAccounts>> {
+    let dir = matrix::accounts_dir(agent).context("building this agent's accounts path")?;
+    let Some(store) = connect(agent).await? else {
+        return Ok(None);
+    };
+    let keys = store
+        .list(&dir)
+        .await
+        .with_context(|| format!("listing {dir} in the store"))?;
+    let mut out = LinkedAccounts::default();
+    // A key ending in `/` is a directory below `dir`, not an account.
+    for name in keys.into_iter().filter(|k| !k.ends_with('/')) {
+        let path = matrix::account_path(agent, &name)
+            .with_context(|| format!("building the path of listed account {name:?}"))?;
+        let stored: Option<matrix::Credential> = store
+            .read_optional(&path)
+            .await
+            .with_context(|| format!("reading {path} from the store"))?;
+        match stored {
+            Some(credential) => out.found.push(Linked {
+                name,
+                homeserver: credential.homeserver,
+            }),
+            None => out.missing.push(name),
+        }
+    }
+    Ok(Some(out))
+}
+
+/// Log in to the store as `agent`, or `None` when this container was given no
+/// store.
+///
+/// `None` is an absent integration, not a failure: the agent's hive was given
+/// no `BAO_ADDR` to forward, so `nix/agent-modules/bao.nix` minted no identity
+/// and there is nothing to log in to.
+///
+/// # Errors
+/// An environment naming an identity that cannot be read, or a store that
+/// refuses the certificate.
+async fn connect(agent: &str) -> Result<Option<SecretStore>> {
+    let Some(settings) = store_settings(|k| std::env::var(k).ok())? else {
+        return Ok(None);
+    };
+    let role =
+        policy::agent_object_name(agent).context("building this agent's cert-auth role name")?;
+    let store = SecretStore::connect(&settings, &role, DEFAULT_CERT_MOUNT)
+        .await
+        .context("logging in to the swarm secret store as this agent")?;
+    Ok(Some(store))
+}
+
 /// This agent's name, or `None` when the harness did not say.
 ///
 /// `None` is not a failure: it is what an agent whose harness predates
-/// [`ENV_AGENT`] looks like, and such an agent keeps working off the file its
-/// hive delivers.
+/// [`ENV_AGENT`] looks like, and such an agent keeps working off its declared
+/// token files.
 #[must_use]
 pub fn agent_name() -> Option<String> {
     std::env::var(ENV_AGENT).ok().filter(|v| !v.is_empty())
diff --git a/hive-matrix-mcp/src/main.rs b/hive-matrix-mcp/src/main.rs
index 17b805bd..40c78aab 100644
--- a/hive-matrix-mcp/src/main.rs
+++ b/hive-matrix-mcp/src/main.rs
@@ -5,16 +5,17 @@
 //! respawn every turn.
 //!
 //! Lifecycle:
-//! 1. Read the configured account list (`accounts::configured()` —
-//!    `HIVE_MATRIX_ACCOUNTS` JSON, or the single legacy account).
+//! 1. Read the account list: `accounts::configured()` (declared) plus
+//!    `accounts::discover_linked` (linked in the swarm secret store).
 //! 2. For each account: resolve its access token (`account_token` — the
-//!    swarm secret store first, read by this agent as itself, then the
-//!    file its hive delivered) → whoami probe → recover `user_id` + `device_id`
+//!    swarm secret store first, read by this agent as itself, then a declared
+//!    token file) → whoami probe → recover `user_id` + `device_id`
 //!    → restore matrix-sdk session (no login flow), install the
 //!    message-event handler, and spawn its own sync loop.
-//! 3. Serve the MCP tools against an account→Client registry; each tool
-//!    call routes to the account named in its `account` arg (the
-//!    primary account when omitted).
+//! 3. Serve the MCP tools against an account→Client registry; each tool call
+//!    routes to its `account` arg (the primary account when omitted).
+//! 4. Every [`LINKED_REFRESH`], re-read the linked accounts; exit with
+//!    [`ACCOUNTS_CHANGED_EXIT`] when the set changed, so systemd restarts us.
 //!
 //! Standalone-degraded boot: the PRIMARY account having no token →
 //! exit 0 cleanly; systemd restarts us once one exists (the path-watcher for
@@ -28,6 +29,8 @@
 //! is removed and that one account is skipped so the daemon keeps serving
 //! the primary and any other healthy account.
 
+use std::collections::{BTreeSet, HashSet};
+use std::process::ExitCode;
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
@@ -68,8 +71,18 @@ const ACCOUNTS_HEARTBEAT_SECS: u64 = 30;
 /// case; the total wait is ~52s before we give up.
 const SECONDARY_RETRY_DELAYS_SECS: &[u64] = &[2, 5, 15, 30];
 
+/// How often the daemon re-reads the store's linked accounts. A newly linked
+/// account comes up within this long of the swarm UI storing it.
+const LINKED_REFRESH: std::time::Duration = std::time::Duration::from_mins(2);
+
+/// The exit status the daemon leaves with when the store's linked accounts
+/// changed. `nix/agent-modules/matrix.nix` names the same number in the unit's
+/// `RestartForceExitStatus` and `SuccessExitStatus`, so systemd restarts it
+/// without counting a failure.
+const ACCOUNTS_CHANGED_EXIT: u8 = 75;
+
 #[tokio::main]
-async fn main() -> Result<()> {
+async fn main() -> Result<ExitCode> {
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()
@@ -83,7 +96,13 @@ async fn main() -> Result<()> {
         .init();
 
     let cli = Cli::parse();
-    let cfgs = accounts::configured().context("read matrix account config")?;
+    let declared = accounts::configured().context("read matrix account config")?;
+    accounts::remove_delivered_files(&declared);
+    let mut warned = HashSet::new();
+    let linked = linked_now(&declared, &mut warned).await.unwrap_or_default();
+    let booted = account_names(&declared, &linked);
+    let mut cfgs = declared.clone();
+    cfgs.extend(linked);
     let multi = cfgs.len() > 1;
     let primary = cfgs[0].name.clone();
     let mut registry = Registry::new(primary);
@@ -108,7 +127,7 @@ async fn main() -> Result<()> {
                     "primary matrix account has no token yet; exiting cleanly \
                      (systemd restarts us once one exists)"
                 );
-                return Ok(());
+                return Ok(ExitCode::SUCCESS);
             }
             Ok(None) => {
                 tracing::warn!(account = %cfg.name, "secondary matrix account has no token; skipping");
@@ -130,7 +149,7 @@ async fn main() -> Result<()> {
 
     if registry.is_empty() {
         tracing::warn!("no matrix accounts restored; exiting cleanly");
-        return Ok(());
+        return Ok(ExitCode::SUCCESS);
     }
 
     // Publish the live-account snapshot (BE-4) for the dashboard: the
@@ -174,22 +193,106 @@ async fn main() -> Result<()> {
         }
     });
 
-    // Drive all per-account sync loops concurrently on this task (they
-    // aren't `Send`, so no `tokio::spawn`). matrix-sdk reconnects
-    // internally, so any loop returning is exceptional — log it and exit
-    // so systemd restarts the whole daemon cleanly.
-    let (result, idx, _rest) = futures_util::future::select_all(sync_loops).await;
-    match result {
-        Ok(()) => tracing::warn!(
-            account_index = idx,
-            "a matrix sync loop exited cleanly; restarting daemon"
-        ),
-        Err(e) => {
-            tracing::error!(account_index = idx, error = %format!("{e:#}"), "a matrix sync loop errored; restarting daemon");
+    Ok(drive(sync_loops, wait_for_linked_change(declared, booted, warned)).await)
+}
+
+/// Drive all per-account sync loops concurrently on this task (they aren't
+/// `Send`, so no `tokio::spawn`) until one returns or `changed` resolves.
+/// matrix-sdk reconnects internally, so any loop returning is exceptional —
+/// log it and exit so systemd restarts the whole daemon cleanly.
+async fn drive(
+    sync_loops: Vec<SyncLoop>,
+    changed: impl std::future::Future<Output = ()>,
+) -> ExitCode {
+    tokio::select! {
+        (result, idx, _rest) = futures_util::future::select_all(sync_loops) => {
+            match result {
+                Ok(()) => tracing::warn!(
+                    account_index = idx,
+                    "a matrix sync loop exited cleanly; restarting daemon"
+                ),
+                Err(e) => {
+                    tracing::error!(account_index = idx, error = %format!("{e:#}"), "a matrix sync loop errored; restarting daemon");
+                }
+            }
+            ExitCode::SUCCESS
+        }
+        () = changed => {
+            tracing::info!("the store's linked matrix accounts changed; exiting to be restarted onto them");
+            ExitCode::from(ACCOUNTS_CHANGED_EXIT)
         }
     }
+}
 
-    Ok(())
+/// The accounts the store links to this agent beyond `declared`, or `None`
+/// when the store could not be read.
+///
+/// Each linked name that cannot be brought up is logged the first time it is
+/// seen and recorded in `warned`, so a refresh does not repeat it.
+async fn linked_now(
+    declared: &[AccountCfg],
+    warned: &mut HashSet<String>,
+) -> Option<Vec<AccountCfg>> {
+    let found = match accounts::discover_linked(declared).await {
+        Ok(found) => found,
+        Err(e) => {
+            tracing::warn!(
+                error = %format!("{e:#}"),
+                "could not read this agent's linked matrix accounts from the store"
+            );
+            return None;
+        }
+    };
+    for name in found.missing {
+        if warned.insert(name.clone()) {
+            tracing::warn!(
+                account = %name,
+                "the store lists this matrix account but holds no credential for it; skipping"
+            );
+        }
+    }
+    for name in found.no_homeserver {
+        if warned.insert(name.clone()) {
+            tracing::warn!(
+                account = %name,
+                "this linked matrix account was stored without a homeserver; skipping \
+                 (re-link it from the swarm UI with one)"
+            );
+        }
+    }
+    Some(found.accounts)
+}
+
+/// Every account name the daemon would bring up from `declared` + `linked`.
+fn account_names(declared: &[AccountCfg], linked: &[AccountCfg]) -> BTreeSet<String> {
+    declared
+        .iter()
+        .chain(linked)
+        .map(|a| a.name.clone())
+        .collect()
+}
+
+/// Re-read the store's linked accounts every [`LINKED_REFRESH`] and resolve
+/// once they name a different set than `booted`. A failed read is logged and
+/// skipped rather than counted as a change.
+async fn wait_for_linked_change(
+    declared: Vec<AccountCfg>,
+    booted: BTreeSet<String>,
+    mut warned: HashSet<String>,
+) {
+    let mut tick = tokio::time::interval(LINKED_REFRESH);
+    tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+    // The first tick is immediate, and boot has just read the store.
+    tick.tick().await;
+    loop {
+        tick.tick().await;
+        let Some(linked) = linked_now(&declared, &mut warned).await else {
+            continue;
+        };
+        if account_names(&declared, &linked) != booted {
+            return;
+        }
+    }
 }
 
 /// Try to bring up a secondary account, retrying with exponential backoff
@@ -276,10 +379,10 @@ async fn bring_up_secondary_with_retry(
 /// mints it any more. An agent whose harness forwards no
 /// [`credential::ENV_AGENT`] cannot name its own subtree, so it reads the file.
 ///
-/// The file is what remains when the store answers nothing: an extra account
-/// the hive-side delivery loop still writes, or a `main` token a hive minted
-/// before the swarm did. A store read that *fails* falls back too, and says
-/// why.
+/// The file is what remains when the store answers nothing: a `tokenFile` an
+/// operator declared, or a `main` token a hive minted before the swarm did. An
+/// account the store links has no file. A store read that *fails* falls back
+/// too, and says why.
 ///
 /// # Errors
 /// As [`credential::Token::from_file`]: a token file that exists but cannot be
@@ -288,18 +391,21 @@ async fn account_token(cfg: &AccountCfg) -> Result<Option<Token>> {
     if let Some(agent) = credential::agent_name() {
         match Token::from_store(&agent, &cfg.name).await {
             Ok(Some(token)) => return Ok(Some(token)),
-            // No store in this deployment: nothing to report, the hive-side
-            // delivery is the whole mechanism here.
+            // No store in this deployment: the declared file is the whole
+            // mechanism here.
             Ok(None) => {}
             Err(e) => tracing::warn!(
                 account = %cfg.name,
                 error = %format!("{e:#}"),
                 "could not read this account's credential from the store as this agent; \
-                 falling back to the token the hive delivered"
+                 falling back to its declared token file"
             ),
         }
     }
-    Token::from_file(&cfg.token_file).await
+    match &cfg.token_file {
+        Some(path) => Token::from_file(path).await,
+        None => Ok(None),
+    }
 }
 
 /// Restore one account's client (when its token exists), install its
diff --git a/hive-priv-sock/src/lib.rs b/hive-priv-sock/src/lib.rs
index b4b13fe6..82803560 100644
--- a/hive-priv-sock/src/lib.rs
+++ b/hive-priv-sock/src/lib.rs
@@ -479,40 +479,11 @@ pub enum PrivRequest {
     },
 
     // --- Agent credential writes ---
-    /// Write a matrix access token into the agent's state dir. With
-    /// `account: None` it targets the hive-internal `matrix-token`; with
-    /// `account: Some(name)` it targets `matrix-token-<name>` for an extra
-    /// (external) account. hive-priv validates both `agent_name` and the
-    /// `account` suffix as plain identifiers before building the path, so a
-    /// crafted account name cannot traverse out of the state dir.
-    ///
-    /// hive-priv validates the names, creates the state dir if absent,
-    /// writes the file 0600, and chowns it to the state dir's owner so the
-    /// agent process can read it. Required because hive-c0re runs
-    /// unprivileged and cannot write to agent-owned state directories.
-    WriteAgentMatrixToken {
-        /// Logical agent name (validated by `validate_agent_name`).
-        agent_name: String,
-        /// Token value. hive-priv appends a trailing newline before writing.
-        token: String,
-        /// Extra-account suffix. `None` → `matrix-token` (the hive account);
-        /// `Some(name)` → `matrix-token-<name>` (validated as a plain ident).
-        account: Option<String>,
-        /// Homeserver URL for an extra account. When `Some` (only meaningful
-        /// alongside `account: Some`), hive-priv also writes the sidecar
-        /// `matrix-account-<name>.json` (`{"homeserver": <url>}`, 0600,
-        /// chowned to the agent) so the daemon can auto-discover the account
-        /// without a config declaration. `None` → no sidecar written.
-        #[serde(default)]
-        homeserver: Option<String>,
-    },
-
     /// Write `github-token` into `AGENT_STATE_ROOT/<agent_name>/state/github-token`.
     ///
     /// The operator-supplied GitHub personal access token (PAT) for the
-    /// agent's GitHub integration (`services.hyperhive.agent.github.enable`). Same write
-    /// semantics as
-    /// `WriteAgentMatrixToken` — validates `agent_name`, creates the state dir
+    /// agent's GitHub integration (`services.hyperhive.agent.github.enable`).
+    /// hive-priv validates `agent_name`, creates the state dir
     /// if absent, writes the file 0600, and chowns it to the agent so the
     /// `gh` wrapper / git credential helper can read it. No account suffix
     /// (single GitHub account per agent).
@@ -528,15 +499,13 @@ pub enum PrivRequest {
     /// `AGENT_STATE_ROOT/<agent_name>/state/forge-<label>-token` (0600) and
     /// a `forge-<label>.json` sidecar (`{"base_url": <base_url>}`, 0600) so
     /// the base URL survives without any host-side nix config — the whole
-    /// account (label + URL + token) is operator-entered on the dashboard,
-    /// same shape as `WriteAgentMatrixToken`'s homeserver sidecar.
+    /// account (label + URL + token) is operator-entered on the dashboard.
     ///
-    /// `label` MUST be validated as a plain identifier (same rule as the
-    /// matrix `account` suffix) before it goes into the filename — a
-    /// crafted label could otherwise traverse out of the state dir. Same
-    /// write semantics as `WriteAgentMatrixToken` — validates `agent_name`,
-    /// creates the state dir if absent, writes both files 0600, chowns to
-    /// the agent.
+    /// `label` MUST be validated as a plain identifier before it goes into
+    /// the filename — a crafted label could otherwise traverse out of the
+    /// state dir. Same write semantics as `WriteAgentGithubToken` — validates
+    /// `agent_name`, creates the state dir if absent, writes both files 0600,
+    /// chowns to the agent.
     WriteAgentExtraForgeAccount {
         /// Logical agent name (validated by `validate_agent_name`).
         agent_name: String,
diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 2ad506d7..fadcd290 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -408,13 +408,6 @@ async fn exec(
             paused,
         } => exec_set_agent_paused(agent_name, paused),
 
-        PrivRequest::WriteAgentMatrixToken {
-            ref agent_name,
-            ref token,
-            ref account,
-            ref homeserver,
-        } => write_matrix_token(agent_name, token, account.as_deref(), homeserver.as_deref()),
-
         PrivRequest::WriteAgentGithubToken {
             ref agent_name,
             ref token,
@@ -530,34 +523,6 @@ async fn exec_forge_admin(args: &[String]) -> Result<(String, String)> {
     run_forge_admin(args).await
 }
 
-/// `WriteAgentMatrixToken`: `account = None` writes the hive account's
-/// `matrix-token`; `Some(a)` writes `matrix-token-<a>`. The account suffix
-/// MUST be validated as a plain identifier (no `/`, `.`, `..`) before it goes
-/// into the filename, or a crafted account could traverse out of the state
-/// dir — `write_agent_state_file` trusts its `filename` argument. When both
-/// `account` and `homeserver` are `Some`, also persists a
-/// `matrix-account-<a>.json` sidecar so the daemon can auto-discover the
-/// extra account without a static `matrixAccounts` config entry.
-fn write_matrix_token(
-    agent_name: &str,
-    token: &str,
-    account: Option<&str>,
-    homeserver: Option<&str>,
-) -> Result<(String, String)> {
-    validate_agent_name(agent_name)?;
-    if let Some(a) = account {
-        validate_account_name(a)?;
-    }
-    let filename = matrix_token_filename(account);
-    let res = write_agent_state_file(agent_name, &filename, &format!("{token}\n"))?;
-    if let (Some(a), Some(hs)) = (account, homeserver) {
-        let meta = serde_json::to_string(&MatrixAccountSidecar { homeserver: hs })
-            .context("serialize matrix account sidecar")?;
-        write_agent_state_file(agent_name, &format!("matrix-account-{a}.json"), &meta)?;
-    }
-    Ok(res)
-}
-
 /// `WriteAgentExtraForgeAccount`: writes the token, then a
 /// `forge-<label>.json` sidecar carrying the base URL — there's no
 /// host-side nix config for extra forges, so this is the only place it's
@@ -1405,27 +1370,12 @@ fn ensure_plain_filename(who: &str, filename: &str) -> Result<()> {
     Ok(())
 }
 
-/// Basename an agent's matrix token is written under — `matrix-token` for the
-/// hive's own account, `matrix-token-<account>` for an extra one.
-///
-/// Half of an agreement whose other half is a `systemd.paths` glob in
-/// `nix/agent-modules/matrix.nix`, which no test here can reach: a name that
-/// stopped matching `matrix-token*` would land a credential the agent's daemon
-/// never wakes for — no error, just a token that silently never arrives.
-fn matrix_token_filename(account: Option<&str>) -> String {
-    match account {
-        None => "matrix-token".to_owned(),
-        Some(a) => format!("matrix-token-{a}"),
-    }
-}
-
 /// Name the content is written under before being renamed onto `filename`,
 /// unique per call so two concurrent writes of one file never share a temp.
 ///
-/// The leading dot and the `.partial` suffix are load-bearing:
-/// `nix/agent-modules/matrix.nix` starts the agent's matrix daemon on the glob
-/// `matrix-token*`, and systemd reads only `*.conf` out of `tmpfiles.d` and
-/// drop-in dirs, so none of them can pick up a half-written temp.
+/// The leading dot and the `.partial` suffix are load-bearing: a reader
+/// globbing on a published name's prefix, or systemd reading `*.conf` out of
+/// `tmpfiles.d` and drop-in dirs, cannot pick up a half-written temp.
 fn partial_name(filename: &str) -> String {
     use std::sync::atomic::{AtomicU64, Ordering};
     static SEQ: AtomicU64 = AtomicU64::new(0);
@@ -1581,20 +1531,6 @@ fn publish_file(path: &Path, content: &[u8], mode: u32, owner: Option<(u32, u32)
     staged.publish()
 }
 
-/// Sidecar written alongside an extra matrix account's token
-/// (`matrix-account-<name>.json`) so `hive-matrix-mcp` can auto-discover
-/// the account's homeserver without a static `matrixAccounts` config
-/// entry. Read side: `hive-matrix-mcp/src/accounts.rs`'s
-/// `read_account_homeserver` (deliberately reads via a bare
-/// `serde_json::Value` rather than this shape — that side treats a
-/// malformed/missing sidecar as "skip this account" rather than an
-/// error, so it stays loosely typed; this side is the one place the
-/// file is written, so it gets the precise shape).
-#[derive(Serialize)]
-struct MatrixAccountSidecar<'a> {
-    homeserver: &'a str,
-}
-
 /// Sidecar written alongside a dashboard-provisioned extra forge
 /// account's token (`forge-<label>.json`) so `hive-forge` can resolve
 /// the account's base URL. Read side: `hive-forge/src/client.rs`'s own
@@ -3051,29 +2987,6 @@ fn validate_name_chars(name: &str) -> Result<()> {
     Ok(())
 }
 
-/// Validate a matrix account name, which is a wider charset than
-/// [`validate_name_chars`] allows on purpose.
-///
-/// An agent name is an `Ident` and lowercase by design. An account name is an
-/// attribute name in `services.hyperhive.agent.matrixAccounts`, typed `attrsOf` with no
-/// charset constraint, so `Ops_Relay9` is a key an operator may already have
-/// written. `swarm_secret_client::path::checked_segment` accepts exactly this
-/// set for the same name in the secret store — the two must agree, or a
-/// credential reads out of the store and then fails to land on disk.
-///
-/// Still a single plain component: no `/`, no `.`, no whitespace, so it cannot
-/// climb out of the agent's state dir or name the dir itself.
-fn validate_account_name(name: &str) -> Result<()> {
-    if name.is_empty()
-        || !name
-            .bytes()
-            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
-    {
-        bail!("invalid account name {name:?}: must be non-empty [A-Za-z0-9_-]");
-    }
-    Ok(())
-}
-
 /// Validate a bind-mount path: must be absolute, non-empty, and contain
 /// no newlines, null bytes, double-quotes, or colons.
 ///
@@ -3393,10 +3306,10 @@ mod tests {
         BindMount, BoundedRun, OwnedFd, PAUSED_MARKER_FILE, PrivRequest, StagedFile,
         check_fd_agreement, clear_runner_credentials, contains_secret_shaped_run,
         describe_forge_admin, ensure_plain_filename, ensure_socket_dir_in, git_overlay_flags,
-        limits_dropin_body, matrix_token_filename, open_dir, open_export_dest, partial_name,
-        publish_file, redact_secret_line, remove_marker_in, run_bounded, single_output_path,
-        toplevel_attr, validate_account_name, validate_credential_name, validate_snapshot_name,
-        write_agent_dir_file, write_bridge_dns_marker_in,
+        limits_dropin_body, open_dir, open_export_dest, partial_name, publish_file,
+        redact_secret_line, remove_marker_in, run_bounded, single_output_path, toplevel_attr,
+        validate_credential_name, validate_snapshot_name, write_agent_dir_file,
+        write_bridge_dns_marker_in,
     };
     use std::path::PathBuf;
     use std::sync::atomic::{AtomicU32, Ordering};
@@ -3780,39 +3693,6 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
-    /// Ported from `hive-c0re`'s `credential.rs`, which used to build this path
-    /// itself. The controls are the load-bearing half: an account name is an
-    /// attrset key in `services.hyperhive.agent.matrixAccounts`, so uppercase and underscore
-    /// are names an operator can already have written, and the secret store
-    /// accepts exactly this set for the same name. A validator narrower than
-    /// the store's reads a credential out and then refuses to land it.
-    #[test]
-    fn an_account_name_is_checked_against_the_same_charset_the_store_uses() {
-        for bad in ["../argus", "a/b", "a b", "a.b", ""] {
-            assert!(
-                validate_account_name(bad).is_err(),
-                "account {bad:?} must be refused"
-            );
-        }
-        assert!(validate_account_name("ops-relay").is_ok());
-        assert!(validate_account_name("Ops_Relay9").is_ok());
-    }
-
-    /// Pinned here because here is where the name is decided. `hive-c0re` used
-    /// to assert this against a path helper of its own, which stopped deciding
-    /// anything the moment credential delivery started routing through this
-    /// process — a test that would have kept passing while the real filename
-    /// drifted.
-    #[test]
-    fn a_matrix_token_is_named_for_the_glob_the_daemon_watches() {
-        assert_eq!(matrix_token_filename(None), "matrix-token");
-        assert_eq!(matrix_token_filename(Some("ccc")), "matrix-token-ccc");
-        // And the temp the publish goes through must not match that same glob,
-        // which is only checkable now that both names are built in one place.
-        let tmp = partial_name(&matrix_token_filename(Some("ccc")));
-        assert!(!tmp.starts_with("matrix-token"), "got {tmp}");
-    }
-
     /// The temp name is the whole reason the rename is safe to watch: a
     /// `systemd.path` unit globbing `matrix-token*` would fire on a temp that
     /// merely suffixed the real name, on exactly the empty file the rename
diff --git a/nix/agent-modules/matrix.nix b/nix/agent-modules/matrix.nix
index 3dc6af81..61c0899c 100644
--- a/nix/agent-modules/matrix.nix
+++ b/nix/agent-modules/matrix.nix
@@ -14,10 +14,9 @@
 }:
 let
   userName = config.services.hyperhive.agent.user.name;
-  # This agent's own state dir, where a hive used to write the `main`
-  # account's token (`matrix-token`, now the store's fallback) and the
-  # daemon keeps its matrix-sdk store. Shared by the `main` account entry
-  # below and the path-watcher glob at the bottom of this file.
+  # This agent's own state dir: `main`'s fallback token file (`matrix-token`)
+  # and the daemon's matrix-sdk stores. Shared by the `main` account entry below
+  # and the path-watcher glob at the bottom of this file.
   stateDir = "/agents/${userName}/state";
   accounts = config.services.hyperhive.agent.matrixAccounts;
   # This agent's own identity at the swarm secret store (./bao.nix). The daemon
@@ -390,6 +389,11 @@ in
         # non-zero exit, which `on-failure` already restarts.
         Restart = "on-failure";
         RestartSec = 5;
+        # The daemon exits 75 (`ACCOUNTS_CHANGED_EXIT` in
+        # hive-matrix-mcp/src/main.rs) when the store's linked accounts change:
+        # a clean exit that must still restart it onto the new set.
+        RestartForceExitStatus = "75";
+        SuccessExitStatus = "75";
         User = userName;
         Group = userName;
       }
@@ -416,18 +420,16 @@ in
       timerConfig.OnUnitInactiveSec = "5min";
     };
 
-    # Re-fire the daemon when the matrix token appears (a token
-    # file: an extra account the hive delivers, or a `main` from before the
-    # swarm minted it). Without this
+    # Re-fire the daemon when a matrix token file appears (a declared
+    # `tokenFile`, or a `main` from before the swarm minted it). Without this
     # the daemon would exit 0 silently on first boot and the MCP
     # would have no backend until next restart. See
     # `docs/agent-lifecycle/persistence.md` (same section as above).
     systemd.paths.hive-matrix-daemon = lib.mkIf matrixEnabled {
       description = "trigger hive-matrix-daemon when a matrix token appears";
       wantedBy = [ "multi-user.target" ];
-      # `matrix-token*` (not just `matrix-token`) so a secondary
-      # multi-account token (e.g. `matrix-token-ccc`) landing also
-      # re-fires the daemon to pick up the freshly-provisioned account.
+      # `matrix-token*` (not just `matrix-token`) so a declared secondary
+      # token file (e.g. `matrix-token-ccc`) landing also re-fires the daemon.
       #
       # ⚠️ This agent's own state dir, not a glob over `/agents/*/`. Every
       # agent's state dir is visible from inside every container, so a
diff --git a/nix/host-modules/hive-c0re/environment.nix b/nix/host-modules/hive-c0re/environment.nix
index 4d0e0564..33045847 100644
--- a/nix/host-modules/hive-c0re/environment.nix
+++ b/nix/host-modules/hive-c0re/environment.nix
@@ -323,7 +323,7 @@ in
     }
 //
   # Where the swarm's secret store is, and the identity this hive presents to
-  # it (hive-c0re::workers::credential). `swarm_secret_client` reads these
+  # it (hive-c0re::lifecycle::agent_identity). `swarm_secret_client` reads these
   # spellings explicitly rather than vaultrs's `VAULT_*` defaults — falling
   # through to those would build a client with no identity and fail at the TLS
   # handshake, naming neither.
diff --git a/swarm-controller/src/matrix_account.rs b/swarm-controller/src/matrix_account.rs
index 3994dd42..5b40ccdf 100644
--- a/swarm-controller/src/matrix_account.rs
+++ b/swarm-controller/src/matrix_account.rs
@@ -8,24 +8,17 @@
 //!
 //! **The external one** — [`put_matrix_account`] and everything under it — is
 //! an account somewhere else that an operator hands us a credential for: put it
-//! in the swarm's secret store, then tell that agent's hive it is there.
+//! in the swarm's secret store.
 //!
-//! The hive end is `hive-c0re/src/workers/credential.rs`, which reads the
-//! value under its own identity and writes it into the agent's state dir. The
-//! notice carries only names, so the queue never holds the secret — see
-//! [`swarm_queue_client::credential_subject`] for why that is a requirement
-//! rather than a preference.
-//!
-//! ⚠️ Store first, notify second, and the order cannot be swapped: a notice
-//! that overtakes its own write reaches a hive that reads nothing, and the
-//! hive deliberately does not retry.
+//! The agent end is `hive-matrix-daemon`, which lists the agent's accounts and
+//! reads each under the agent's own certificate. No hive is in the path.
 //!
 //! Two credential modes, chosen by `PutMatrixAccountRequest::mode`: `token`
 //! (default, back-compat with the original blind-store shape — the caller
 //! already has a bearer token) and `password` (this daemon performs
 //! `m.login.password` against the caller-given homeserver itself and stores
-//! the resulting token; the password is never stored, and is not sent to the
-//! hive either — only the derived token is). Done here so the browser never
+//! the resulting token; the password is never stored — only the derived token
+//! is). Done here so the browser never
 //! has to hold the password long enough to call an arbitrary homeserver
 //! directly.
 
@@ -33,7 +26,6 @@ use axum::Json;
 use axum::extract::State;
 use axum::http::StatusCode;
 use serde::{Deserialize, Serialize};
-use swarm_queue_client::{CredentialNotice, credential_subject};
 use swarm_secret_client::matrix;
 use utoipa::ToSchema;
 
@@ -103,11 +95,8 @@ pub struct PutMatrixAccountRequest {
     /// Password-mode only. Never logged and never stored — only the token
     /// `m.login.password` returns is.
     password: Option<String>,
-    /// The account's homeserver, when it is not this swarm's own.
-    ///
-    /// Stored beside the token rather than sent on the notice: a notice is a
-    /// queue message, so a homeserver carried there would exist only in
-    /// flight, with nowhere to reconstruct it from on a re-delivery.
+    /// The account's homeserver, when it is not this swarm's own. Stored
+    /// beside the token, which is where the agent's daemon reads it.
     ///
     /// Optional in token mode (omitted means "resolve to the agent's own
     /// `services.hyperhive.agent.matrix.url` on the hive side" — this route never needs to
@@ -128,7 +117,7 @@ pub struct PutMatrixAccountResponse {
     user_id: Option<String>,
 }
 
-/// Store an agent's external matrix account credential and notify its hive.
+/// Store an agent's external matrix account credential.
 ///
 /// Idempotent: the store keeps versions, so repeating a call replaces the
 /// value the agent will next read rather than adding a second account.
@@ -136,16 +125,15 @@ pub struct PutMatrixAccountResponse {
     put,
     path = "/api/hives/{hive}/agents/{agent}/matrix-accounts/{account}",
     params(
-        ("hive" = String, Path, description = "hive whose agent receives the credential"),
-        ("agent" = String, Path, description = "agent the credential is delivered to"),
+        ("hive" = String, Path, description = "hive the agent runs on"),
+        ("agent" = String, Path, description = "agent the credential belongs to"),
         ("account" = String, Path, description = "the external account this credential authenticates as"),
     ),
     request_body = PutMatrixAccountRequest,
     responses(
-        (status = 200, description = "stored, and the hive has been told", body = PutMatrixAccountResponse),
+        (status = 200, description = "stored", body = PutMatrixAccountResponse),
         (status = 400, description = "a name is not an identifier, the account name is not a single path segment, the account is 'main' (reserved), the mode is unrecognized, a mode's required fields are missing, or the hive is not in this swarm (problem+json)", body = String),
-        (status = 503, description = "no swarm queue is wired up, or it is not connected (problem+json)", body = String),
-        (status = 500, description = "the store write, the encode or the publish failed (problem+json)", body = String),
+        (status = 500, description = "the store write failed (problem+json)", body = String),
     ),
     tag = "agents"
 )]
@@ -154,15 +142,6 @@ pub async fn put_matrix_account(
     axum::extract::Path((hive, agent, account)): axum::extract::Path<(String, String, String)>,
     Json(req): Json<PutMatrixAccountRequest>,
 ) -> Result<Json<PutMatrixAccountResponse>, problem_details::ProblemDetails> {
-    // The queue first, so a deployment that has none answers 503 whatever the
-    // caller spelled — and before the store is touched, so a request that
-    // could never be delivered does not leave a credential behind.
-    let Some(status) = state.status.as_ref() else {
-        return Err(error_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "this deployment wired up no swarm queue, so there is no hive to notify",
-        ));
-    };
     let hive = swarm_hive(&state, &hive).map_err(|(s, d)| error_problem(s, &d))?;
     let agent = hive_types::Ident::parse(&agent)
         .map_err(|reason| error_problem(StatusCode::BAD_REQUEST, reason))?
@@ -191,21 +170,6 @@ pub async fn put_matrix_account(
     // touched, so a failed login leaves no partial state behind.
     let (token, homeserver, user_id) = resolve_credential(&req).await.map_err(|b| *b)?;
 
-    // A queue that is configured but not yet (or no longer) connected does
-    // not fail the `publish`/`flush` further down outright — it *hangs*
-    // them, per `swarm_queue_client::ensure_connected`'s own doc. Checked
-    // here, immediately before the store is touched, so a request that
-    // cannot be delivered never leaves a credential behind — the same
-    // ordering rule the module doc states for "store first, notify
-    // second", extended one step earlier.
-    let client = status.queue_client();
-    swarm_queue_client::ensure_connected(&client).map_err(|e| {
-        error_problem(
-            StatusCode::SERVICE_UNAVAILABLE,
-            &swarm_queue_client::chain(&e),
-        )
-    })?;
-
     let store = crate::store::connect().await.map_err(|e| {
         tracing::warn!(error = %e, "connecting to the swarm secret store failed");
         error_problem(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string())
@@ -225,37 +189,7 @@ pub async fn put_matrix_account(
             error_problem(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string())
         })?;
 
-    let notice = CredentialNotice {
-        agent: agent.clone(),
-        account: account.clone(),
-    };
-    let payload = serde_json::to_vec(&notice).map_err(|e| {
-        error_problem(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            &format!("encoding the credential notice failed: {e}"),
-        )
-    })?;
-    let subject = credential_subject(&hive);
-    client
-        .publish(subject.clone(), payload.into())
-        .await
-        .map_err(|e| {
-            error_problem(
-                StatusCode::INTERNAL_SERVER_ERROR,
-                &format!("publishing to {subject} failed: {e}"),
-            )
-        })?;
-    // Flushed for the reason `publish_deploy` flushes: `publish` hands the
-    // message to the connection's write buffer and returns, so without this
-    // the response can outrun the notice it reports as sent.
-    client.flush().await.map_err(|e| {
-        error_problem(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            &format!("flushing the credential notice to {subject} failed: {e}"),
-        )
-    })?;
-
-    tracing::info!(%subject, %hive, %agent, %account, "credential stored; hive notified");
+    tracing::info!(%hive, %agent, %account, "credential stored");
     Ok(Json(PutMatrixAccountResponse { user_id }))
 }
 
@@ -544,32 +478,17 @@ mod tests {
         );
     }
 
-    // ── the connected-but-not-yet-connected queue ───────────────────────
-
-    /// A client that exists but has never connected — the `Pending` state
-    /// `ensure_connected`'s own doc says a `Disconnected` check would miss.
-    /// `retry_on_initial_connect` is what makes `.connect()` return
-    /// immediately instead of blocking on a handshake that will never
-    /// succeed against a loopback port nothing listens on.
-    async fn disconnected_client() -> async_nats::Client {
-        async_nats::ConnectOptions::new()
-            .retry_on_initial_connect()
-            .connect("127.0.0.1:1")
-            .await
-            .expect("retry_on_initial_connect returns without waiting for a real connection")
-    }
-
-    /// Bare-minimum `AppState` for a handler test: one hive, no queue-backed
-    /// helpers beyond `status` (the field this handler actually reads), and
-    /// an empty in-memory job graph the endpoint under test never touches.
-    fn state_with_status(status: super::super::status::StatusReader) -> super::super::AppState {
+    /// Bare-minimum `AppState` for a handler test: one hive, nothing
+    /// queue-backed, and an empty in-memory job graph the endpoint under test
+    /// never touches.
+    fn state() -> super::super::AppState {
         super::super::AppState {
             hives: std::sync::Arc::new(vec![super::super::HiveEntry {
                 name: "pr1ma".to_owned(),
                 domain: "pr1ma.example".to_owned(),
             }]),
             links: std::sync::Arc::new(Vec::new()),
-            status: Some(std::sync::Arc::new(status)),
+            status: None,
             wanted: None,
             agent_status: None,
             agent_icons: None,
@@ -586,35 +505,44 @@ mod tests {
         }
     }
 
-    /// The defect this whole PR exists to close: a queue that is
-    /// configured but not connected must not let this handler reach the
-    /// store write at all.
-    ///
-    /// `BAO_ADDR`/`BAO_CLIENT_CERT`/`BAO_CLIENT_KEY` are asserted unset
-    /// first — not incidental setup, but the control that makes the 503
-    /// meaningful. If `put_matrix_account` reached `crate::store::connect()`
-    /// with those unset, *that* call fails too, and would also answer with
-    /// a `problem+json` body (500, "connecting to the swarm secret store
-    /// failed"). A 503 here is therefore proof execution never got past
-    /// `ensure_connected`, not a coincidence of two paths landing on the
-    /// same status family.
+    /// Refused before the store is reached: with `BAO_*` unset a store
+    /// connect would answer 500, so a 400 is the reserved-name check.
     #[tokio::test]
-    async fn a_disconnected_queue_answers_503_and_never_reaches_the_store() {
+    async fn a_reserved_account_name_is_refused_before_the_store() {
         for var in ["BAO_ADDR", "BAO_CLIENT_CERT", "BAO_CLIENT_KEY"] {
             assert!(
                 std::env::var(var).is_err(),
                 "{var} must be unset for this test to prove anything"
             );
         }
-
-        let reader = super::super::status::StatusReader::new(
-            disconnected_client().await,
-            std::time::Duration::from_mins(1),
-        );
-        let state = state_with_status(reader);
-
         let result = super::put_matrix_account(
-            axum::extract::State(state),
+            axum::extract::State(state()),
+            axum::extract::Path(("pr1ma".to_owned(), "atlas".to_owned(), "main".to_owned())),
+            axum::Json(PutMatrixAccountRequest {
+                mode: "token".to_owned(),
+                token: Some("t0k3n".to_owned()),
+                user_id: None,
+                password: None,
+                homeserver: None,
+            }),
+        )
+        .await;
+
+        let problem = result.expect_err("'main' is reserved");
+        assert_eq!(
+            problem.status,
+            Some(axum::http::StatusCode::BAD_REQUEST),
+            "{problem:?}"
+        );
+    }
+
+    /// The control for the test above: an ordinary name gets past every check
+    /// and fails at the store connect, so the 400 above is not what every call
+    /// answers.
+    #[tokio::test]
+    async fn an_ordinary_account_name_reaches_the_store() {
+        let result = super::put_matrix_account(
+            axum::extract::State(state()),
             axum::extract::Path((
                 "pr1ma".to_owned(),
                 "atlas".to_owned(),
@@ -630,48 +558,10 @@ mod tests {
         )
         .await;
 
-        let problem = result.expect_err("a disconnected queue must refuse, not hang or 500");
+        let problem = result.expect_err("no store is configured in a test");
         assert_eq!(
             problem.status,
-            Some(axum::http::StatusCode::SERVICE_UNAVAILABLE),
-            "{problem:?}"
-        );
-    }
-
-    /// The control for the test above: a client that starts in `Pending`
-    /// but genuinely never connects is exactly what `ensure_connected` is
-    /// specified to reject — proving the 503 above tracks the connection
-    /// state and is not simply what every call through this handler
-    /// returns. Same client shape, mode rejected before either queue or
-    /// store is touched, so it exercises a different early return
-    /// (`is_reserved_account`) and confirms the handler still validates
-    /// normally on a path that never reaches `ensure_connected`'s sibling
-    /// checks.
-    #[tokio::test]
-    async fn a_reserved_account_name_is_still_refused_before_any_queue_check_matters() {
-        let reader = super::super::status::StatusReader::new(
-            disconnected_client().await,
-            std::time::Duration::from_mins(1),
-        );
-        let state = state_with_status(reader);
-
-        let result = super::put_matrix_account(
-            axum::extract::State(state),
-            axum::extract::Path(("pr1ma".to_owned(), "atlas".to_owned(), "main".to_owned())),
-            axum::Json(PutMatrixAccountRequest {
-                mode: "token".to_owned(),
-                token: Some("t0k3n".to_owned()),
-                user_id: None,
-                password: None,
-                homeserver: None,
-            }),
-        )
-        .await;
-
-        let problem = result.expect_err("'main' is reserved regardless of queue state");
-        assert_eq!(
-            problem.status,
-            Some(axum::http::StatusCode::BAD_REQUEST),
+            Some(axum::http::StatusCode::INTERNAL_SERVER_ERROR),
             "{problem:?}"
         );
     }
diff --git a/swarm-nats-auth/src/policy.rs b/swarm-nats-auth/src/policy.rs
index a88bf116..8c45997a 100644
--- a/swarm-nats-auth/src/policy.rs
+++ b/swarm-nats-auth/src/policy.rs
@@ -498,17 +498,6 @@ impl Policy {
             // admission). Same failure mode as the knowledge event above: a
             // refused publish reaches the client as a timeout.
             swarm_queue_client::DEPLOY_SUBJECT_WILDCARD.to_owned(),
-            // The credential notices: same per-hive family and same wildcard
-            // reasoning as the deploy events, and the same timeout-not-error
-            // failure if this line is missing.
-            //
-            // 🔑 Worth being explicit that this grant is not a confidentiality
-            // boundary, because it looks like one. `sub` is unrestricted, so
-            // any hive could subscribe to another's notices — which is exactly
-            // why the payload names a credential and never carries one. What
-            // scopes the secret is the store's own policy at read time, under
-            // the reading hive's certificate.
-            swarm_queue_client::CREDENTIAL_SUBJECT_WILDCARD.to_owned(),
             // The wanted-state buckets — one per hive, all created and written
             // by this single client.
             //
@@ -759,36 +748,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn a_reader_may_publish_a_credential_notice_to_any_hive() {
-        let p = policy().permissions("swarm-controller").expect("a reader");
-        assert!(
-            p.publish
-                .contains(&swarm_queue_client::CREDENTIAL_SUBJECT_WILDCARD.to_owned()),
-            "without this grant the controller's publish is refused, and a \
-             refusal arrives as a timeout — a hive that silently never receives \
-             a credential, with nothing in either log saying why"
-        );
-    }
-
-    #[test]
-    fn a_hive_may_not_publish_a_credential_notice() {
-        // A forged notice cannot leak a secret — the payload carries none — but
-        // it can make a hive fetch and overwrite an agent's token file with
-        // whatever the store holds for a name the forger chose.
-        let p = policy()
-            .permissions("hive-alpha")
-            .expect("a hive is admitted");
-        assert!(
-            !p.publish
-                .iter()
-                .any(|s| s == swarm_queue_client::CREDENTIAL_SUBJECT_WILDCARD
-                    || s == &swarm_queue_client::credential_subject("hive-alpha")),
-            "a hive must not publish credential notices, its own included: {:?}",
-            p.publish
-        );
-    }
-
     #[test]
     fn a_hive_may_not_publish_a_deploy_event_to_anyone_including_itself() {
         // Same arm as the knowledge event's, and it matters more here: a forged
diff --git a/swarm-queue-client/src/lib.rs b/swarm-queue-client/src/lib.rs
index ca46594c..009fb7bf 100644
--- a/swarm-queue-client/src/lib.rs
+++ b/swarm-queue-client/src/lib.rs
@@ -221,42 +221,6 @@ pub const DEPLOY_SUBJECT_WILDCARD: &str = "$SWARM.deploy.*";
 /// cannot drift into naming different families.
 const DEPLOY_SUBJECT_PREFIX: &str = "$SWARM.deploy";
 
-/// The subject the controller publishes on to tell `hive` that a credential
-/// for one of its agents is waiting in the secret store. Same per-hive family
-/// as [`deploy_subject`], here for the same three-crate reason.
-///
-/// 🔑 **The message NAMES a credential and never carries one**, and the note
-/// on [`deploy_subject`] is why: the family split buys quiet, not
-/// confidentiality — the auth-callout responder scopes `pub` and leaves `sub`
-/// unrestricted, so any hive that wanted another's messages could subscribe to
-/// them. A secret in this payload would be readable swarm-wide. The hive reads
-/// the value from the store under its own identity instead, where the store's
-/// policy is the thing that actually scopes it.
-#[must_use]
-pub fn credential_subject(hive: &str) -> String {
-    format!("{CREDENTIAL_SUBJECT_PREFIX}.{hive}")
-}
-
-/// The publish grant covering every [`credential_subject`] — a wildcard for
-/// the same no-roster reason as [`DEPLOY_SUBJECT_WILDCARD`].
-pub const CREDENTIAL_SUBJECT_WILDCARD: &str = "$SWARM.credential.*";
-
-/// Shared by [`credential_subject`] and [`CREDENTIAL_SUBJECT_WILDCARD`] so the
-/// two cannot drift into naming different families.
-const CREDENTIAL_SUBJECT_PREFIX: &str = "$SWARM.credential";
-
-/// What a [`credential_subject`] message says: which agent's credential
-/// changed, and which account it belongs to. Deliberately the whole payload —
-/// anything more would be either derivable by the reader or a secret that
-/// must not be on the wire.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub struct CredentialNotice {
-    /// The agent whose state dir receives the credential.
-    pub agent: String,
-    /// The external account the credential authenticates as.
-    pub account: String,
-}
-
 /// What a [`deploy_subject`] message carries.
 ///
 /// Only the agent: the subject already names the hive, and repeating it here
diff --git a/swarm-secret-client/src/client.rs b/swarm-secret-client/src/client.rs
index 7a80b89b..7a6f0adb 100644
--- a/swarm-secret-client/src/client.rs
+++ b/swarm-secret-client/src/client.rs
@@ -202,6 +202,32 @@ impl SecretStore {
         }
     }
 
+    /// The keys stored directly under `path`, or none when nothing is.
+    ///
+    /// A key ending in `/` is a directory below `path` rather than an object;
+    /// keys come back as the store spells them, so a caller wanting objects
+    /// filters those out.
+    ///
+    /// Addresses `secret/metadata/<path>`, which the store ACLs separately
+    /// from the `secret/data/<path>` that [`read`][Self::read] uses: a token
+    /// that may read every object under a path is refused here until its
+    /// policy grants `list` on the metadata path too.
+    ///
+    /// **Only a 404 is "none"**, as in [`read_optional`][Self::read_optional]:
+    /// the store answers a `LIST` on an empty directory with a 404, and a
+    /// denial stays an error.
+    ///
+    /// # Errors
+    /// [`Error::Vault`] for anything that is not a 404: a denial, or an
+    /// unreachable store.
+    pub async fn list(&self, path: &str) -> Result<Vec<String>, Error> {
+        match vaultrs::kv2::list(&self.inner, MOUNT, path).await {
+            Ok(keys) => Ok(keys),
+            Err(e) if is_absent(&e) => Ok(Vec::new()),
+            Err(e) => Err(e.into()),
+        }
+    }
+
     /// Write `value` at `path`, creating a new version.
     ///
     /// # Errors
diff --git a/swarm-secret-client/src/matrix.rs b/swarm-secret-client/src/matrix.rs
index c3eb13c5..c07248d9 100644
--- a/swarm-secret-client/src/matrix.rs
+++ b/swarm-secret-client/src/matrix.rs
@@ -21,9 +21,18 @@ use crate::{
 /// `[A-Za-z0-9_-]`, which is what keeps one agent's name from addressing
 /// another agent's secret.
 pub fn account_path(agent: &str, account: &str) -> Result<String, Error> {
-    let prefix = principal_prefix(Kind::Agent, agent)?;
     checked_segment("account", account)?;
-    Ok(format!("{prefix}/matrix/{account}"))
+    Ok(format!("{}/{account}", accounts_dir(agent)?))
+}
+
+/// The directory every one of `agent`'s [`account_path`]s is under, in the
+/// form [`crate::SecretStore::list`] takes.
+///
+/// # Errors
+/// [`Error::PathSegment`] when `agent` contains anything but `[A-Za-z0-9_-]`.
+pub fn accounts_dir(agent: &str) -> Result<String, Error> {
+    let prefix = principal_prefix(Kind::Agent, agent)?;
+    Ok(format!("{prefix}/matrix"))
 }
 
 /// The localpart `hive` acts as on the homeserver, and the `sender_localpart`
@@ -117,10 +126,9 @@ pub fn swarm_appservice_token_path() -> Result<String, Error> {
 
 /// What an account's path holds: the token, plus the homeserver it belongs to.
 ///
-/// The homeserver rides with the token rather than on the queue notice that
-/// triggers a delivery, because a notice is not persistence — re-delivering a
-/// credential has to reconstruct it, and the store is the only thing that keeps
-/// it.
+/// The homeserver rides with the token because the agent's daemon learns both
+/// from this one object: an account it finds by listing [`accounts_dir`] has
+/// no other place its homeserver is written down.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Credential {
     /// `glue-matrix-bao-token.nix` reads the store with