diff --git a/Dockerfile b/Dockerfile
index 1b1ca00b7e..a074a3c36b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -148,32 +148,24 @@ RUN cd /build/q2/.claude/maps \
 # the first suspect. Two ways out: push any q2 commit (busts COPY, busts this), or
 # redeploy with the build cache disabled.
 #
-# THE FIX BELOW makes the sibling HEADs an actual layer input. Each `ADD` of a
-# repo's `commits/main` fetches on every build and writes a file whose CONTENT is
-# that repo's current commit; Docker hashes it, so the clone layer busts exactly
-# when a sibling moves and stays cached when none did. Four small requests buy
-# back the property this comment used to claim for free.
+# NO CACHE-BUST FETCH HERE, deliberately — and the reason is that the failure
+# above no longer has teeth. What made a stale sibling clone FATAL was
+# `lance-graph-ogar`'s COUNT_FUSE: a compile-time length assert that turned
+# "this clone's codebook mirror is one concept behind OGAR" into E0080 at
+# const-eval. lance-graph #954 removed it — activation now verifies the
+# PLUGGED concepts against the mirror at runtime and reports drift by name
+# (`MirrorDrift { concept, authority_id, mirror_id }`). A slightly stale
+# sibling compiles; real drift surfaces where it can be read.
 #
-# Unauthenticated on purpose — the same URLs the `git clone` lines below already
-# fetch without credentials, so these are reachable on the same terms.
-#
-# ⚠ The ATOM FEED, not `api.github.com`, and the difference is load-bearing.
-# Unauthenticated api.github.com allows 60 requests/hour PER IP, and CI builders
-# share egress IPs — so the API form would eventually 403, and a failed `ADD`
-# FAILS THE BUILD. That trades a stale cache for a new outage cause, which is
-# the opposite of the point. `github.com/<repo>/commits/main.atom` is served by
-# the web frontend, is not under that quota, and its entries carry commit ids +
-# commit dates, so its content changes exactly when HEAD moves.
-#
-# This does NOT replace the deeper choice — explicit SHA ARGs bumped
-# deliberately, or removing the hand-maintained mirror via hotplug enumeration
-# so the fuse's whole failure class disappears. Those are architectural calls,
-# deliberately not made here. This one only restores "latest of everything" to
-# being true per DEPLOY instead of per COMMIT.
-ADD https://github.com/AdaWorldAPI/lance-graph/commits/main.atom /tmp/rev/lance-graph.atom
-ADD https://github.com/AdaWorldAPI/ndarray/commits/main.atom /tmp/rev/ndarray.atom
-ADD https://github.com/AdaWorldAPI/OGAR/commits/main.atom /tmp/rev/OGAR.atom
-ADD https://github.com/AdaWorldAPI/openstreetmap-website-rs/commits/main.atom /tmp/rev/osm-website.atom
+# An earlier revision of this file put four `ADD https://…/commits/main.atom`
+# lines here to make sibling HEADs a layer input. That was the wrong
+# instrument twice over: it defended a failure class that had already been
+# retired, and it put four network fetches in the build's critical path where
+# any 404 or blip kills the deploy — which is exactly what happened, because
+# `AdaWorldAPI/ndarray`'s default branch is `master`, not `main`, so one of
+# the four could only ever 404. If cache staleness needs solving again, solve
+# it with explicit SHA ARGs (an ARG change busts the layer with zero network
+# calls and fails legibly at `git checkout`), never with a build-time fetch.
 #
 # Sibling checkouts the path deps (and the [patch] in q2's Cargo.toml) resolve against:
 #   /build/lance-graph  → lance-graph @ main HEAD — carries guid-v2-tail +