diff --git a/nix/host-modules/glue-matrix-bao-token.nix b/nix/host-modules/glue-matrix-bao-token.nix
index 89f77cc2..34a62a80 100644
--- a/nix/host-modules/glue-matrix-bao-token.nix
+++ b/nix/host-modules/glue-matrix-bao-token.nix
@@ -103,9 +103,22 @@ in
         # store can answer". `TimeoutStartSec` above is the bound; the
         # homeserver only `Wants=` this unit, so hitting it degrades to
         # keeping the local token rather than holding up the container.
-        if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
-          echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
-          echo "Keeping the token hive-matrix already has." >&2
+        # `bao`'s own message is the only thing separating a missing value
+        # from a refused identity from an unreachable host. This unit's
+        # degraded mode is correct for all three, so it reports which one
+        # rather than asserting all three in a sentence of ours — a reader
+        # that cannot say why it read nothing is indistinguishable from a
+        # broken one.
+        err="$(mktemp)"
+        trap 'rm -f "$err"' EXIT
+
+        if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>"$err")"; then
+          echo "swarm-bao did not return ${tokenPath}; keeping the token hive-matrix already has." >&2
+          if [ -s "$err" ]; then
+            cat "$err" >&2
+          else
+            echo "bao failed without writing a diagnostic." >&2
+          fi
           exit 0
         fi
 
diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index a6e4a81c..7a2c81d9 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -1556,6 +1556,18 @@ let
         in
         s ? swarm-bao-matrix-token && s.swarm-bao-matrix-token.requires == [ "swarm-bao-pki.service" ];
     }
+    {
+      # Nothing asserted this script before, which is how it kept a branch that
+      # named three states and threw away the only thing telling them apart. A
+      # missing value, a refused identity and an unreachable host all end in the
+      # same degraded mode here, correctly — what must survive is which one.
+      name = "the matrix token reader carries the store's own diagnostic into the journal";
+      ok =
+        let
+          s = baoWithMatrix.systemd.services.swarm-bao-matrix-token.script;
+        in
+        !(lib.hasInfix "2>/dev/null" s) && lib.hasInfix ''cat "''$err"'' s;
+    }
     {
       # hive-c0re runs as hive-core and the client key is `0600` root-owned
       # inside a `0700` directory, so the identity reaches the daemon as a