diff --git a/hive-c0re/src/bin/hivectl.rs b/hive-c0re/src/bin/hivectl.rs
index fee6c191..e2fd156d 100644
--- a/hive-c0re/src/bin/hivectl.rs
+++ b/hive-c0re/src/bin/hivectl.rs
@@ -3,10 +3,11 @@
 //! Sibling binary to the `hive-c0re` daemon. Where `hive-c0re`'s
 //! subcommands focus on the broker / approval / topology surface
 //! (`spawn`, `kill`, `rebuild`, `approve` …), `hivectl` covers
-//! host-side administration — both manual provisioning operations
-//! that work without the daemon running (forge, matrix, gateway) AND
-//! daemon-assisted agent management (agents restart/restart-all) that
-//! goes through the host admin socket.
+//! host-side administration that doesn't need the daemon running —
+//! starting with manual user provisioning on the bundled forge +
+//! matrix containers when c0re's automatic boot-time sweep is
+//! inappropriate (recovery, debugging, single-shot reprovisioning,
+//! verifying the registration token path).
 //!
 //! Verbs read configuration off the same on-disk paths c0re uses
 //! (`/var/lib/hyperhive/forge-core-token`,
@@ -63,12 +64,6 @@ enum Cmd {
         #[command(subcommand)]
         cmd: GatewayCmd,
     },
-    /// Agent container management. Requires the hive-c0re daemon to be
-    /// running (connects to the host admin socket).
-    Agents {
-        #[command(subcommand)]
-        cmd: AgentsCmd,
-    },
 }
 
 #[derive(Subcommand)]
@@ -201,32 +196,6 @@ enum GatewayCmd {
     },
 }
 
-/// Default host admin socket path (same as `hive-c0re`'s default).
-const DEFAULT_HOST_SOCKET: &str = "/run/hive/host.sock";
-
-#[derive(Subcommand)]
-enum AgentsCmd {
-    /// Stop and start a single agent container without rebuilding config.
-    /// Useful for "kick the container" when the process is stuck or the
-    /// container needs a clean restart without changing the NixOS config.
-    Restart {
-        /// Agent name (e.g. `damocles`, `ruth`).
-        name: String,
-        /// Path to the hive-c0re host admin socket.
-        #[arg(long, default_value = DEFAULT_HOST_SOCKET)]
-        socket: PathBuf,
-    },
-    /// Stop and restart ALL managed agent containers in sequence.
-    /// Iterates the live container list and restarts each one. Any per-agent
-    /// failure is reported at the end rather than stopping mid-run, so all
-    /// containers get a restart attempt.
-    RestartAll {
-        /// Path to the hive-c0re host admin socket.
-        #[arg(long, default_value = DEFAULT_HOST_SOCKET)]
-        socket: PathBuf,
-    },
-}
-
 #[tokio::main]
 async fn main() -> Result<()> {
     tracing_subscriber::fmt()
@@ -261,10 +230,6 @@ async fn main() -> Result<()> {
             GatewayCmd::DeleteUser { file, username } => gateway_delete_user(&file, &username),
             GatewayCmd::ListUsers { file } => gateway_list_users(&file),
         },
-        Cmd::Agents { cmd } => match cmd {
-            AgentsCmd::Restart { name, socket } => agents_restart(&socket, &name).await,
-            AgentsCmd::RestartAll { socket } => agents_restart_all(&socket).await,
-        },
     }
 }
 
@@ -496,48 +461,6 @@ fn gateway_list_users(file: &Path) -> Result<()> {
     Ok(())
 }
 
-// ---------------------------------------------------------------------------
-// Agent management helpers (require daemon via host admin socket)
-// ---------------------------------------------------------------------------
-
-async fn agents_restart(socket: &Path, name: &str) -> Result<()> {
-    let resp = hive_c0re::client::request(socket, hive_sh4re::HostRequest::Restart {
-        name: name.to_owned(),
-    })
-    .await
-    .with_context(|| format!("connect to daemon socket {}", socket.display()))?;
-    if resp.ok {
-        println!("restarted: {name}");
-        Ok(())
-    } else {
-        bail!(
-            "restart {name}: {}",
-            resp.error.as_deref().unwrap_or("unknown error")
-        )
-    }
-}
-
-async fn agents_restart_all(socket: &Path) -> Result<()> {
-    let resp = hive_c0re::client::request(socket, hive_sh4re::HostRequest::RestartAll)
-        .await
-        .with_context(|| format!("connect to daemon socket {}", socket.display()))?;
-    let agents = resp.agents.as_deref().unwrap_or(&[]);
-    if agents.is_empty() {
-        println!("restart-all: no managed containers found");
-    } else {
-        for a in agents {
-            println!("restarted: {a}");
-        }
-    }
-    if !resp.ok {
-        bail!(
-            "restart-all: {}",
-            resp.error.as_deref().unwrap_or("unknown error")
-        );
-    }
-    Ok(())
-}
-
 /// Reject usernames containing `:` (field separator) or control chars
 /// that would corrupt the htpasswd file format.
 fn validate_htpasswd_username(username: &str) -> Result<()> {
diff --git a/hive-c0re/src/server.rs b/hive-c0re/src/server.rs
index 074d5ff0..0987ef48 100644
--- a/hive-c0re/src/server.rs
+++ b/hive-c0re/src/server.rs
@@ -140,35 +140,6 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                 });
                 HostResponse::success()
             }
-            HostRequest::Restart { name } => {
-                tracing::info!(%name, "restart");
-                lifecycle::restart(name).await?;
-                HostResponse::success()
-            }
-            HostRequest::RestartAll => {
-                tracing::info!("restart-all");
-                let agents = lifecycle::list().await?;
-                let mut ok_agents: Vec<String> = Vec::new();
-                let mut errors: Vec<String> = Vec::new();
-                for agent in &agents {
-                    if let Err(e) = lifecycle::restart(agent).await {
-                        tracing::warn!(%agent, error = ?e, "restart-all: failed to restart agent");
-                        errors.push(format!("{agent}: {e:#}"));
-                    } else {
-                        ok_agents.push(agent.clone());
-                    }
-                }
-                if errors.is_empty() {
-                    HostResponse::list(ok_agents)
-                } else {
-                    HostResponse {
-                        ok: false,
-                        error: Some(errors.join("; ")),
-                        agents: Some(ok_agents),
-                        approvals: None,
-                    }
-                }
-            }
             HostRequest::Destroy { name, purge } => {
                 actions::destroy(&coord, name, *purge).await?;
                 HostResponse::success()
diff --git a/hive-sh4re/src/lib.rs b/hive-sh4re/src/lib.rs
index 6f861623..66dd820d 100644
--- a/hive-sh4re/src/lib.rs
+++ b/hive-sh4re/src/lib.rs
@@ -31,14 +31,6 @@ pub enum HostRequest {
         #[serde(default)]
         purge: bool,
     },
-    /// Stop and start a managed container without rebuilding config.
-    /// For "kick the container" operations that don't touch the flake or
-    /// nspawn flags. Mirrors `lifecycle::restart` (kill + start).
-    Restart { name: String },
-    /// Stop and restart all managed containers in sequence. Convenience
-    /// wrapper for `hivectl agents restart-all`; iterates the live
-    /// container list and restarts each one.
-    RestartAll,
     /// Apply pending config to a managed container.
     Rebuild { name: String },
     /// List managed containers.