boburning · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026
diff --git a/build/dependencies.lock b/build/dependencies.lock
@@ -207,11 +207,11 @@ legacy_channels = ["development"]
 [legacy_inventory]
 manifest = "build/legacy-manifest.json"
 schema = 1
-component_count = 333
-file_count = 1974
-byte_count = 261292177
+component_count = 331
+file_count = 1972
+byte_count = 260959742
 source_build_components = 232
-unresolved_components = 101
+unresolved_components = 99
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"
 
 [themes]

diff --git a/build/legacy-manifest.json b/build/legacy-manifest.json
@@ -431,32 +431,6 @@
       "build_recipe": null,
       "resolution": "replace-source-build-or-exclude"
     },
-    {
-      "id": "runtime-tmp-update-bin-bftpd",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/bin/bftpd",
-      "file_count": 1,
-      "byte_count": 268895,
-      "tree_sha256": "2ac00ecd46d5af4fafd125dce4fb753c804fe63d400b0946dbee32b64950c566",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
-    {
-      "id": "runtime-tmp-update-bin-bftpdutmp",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/bin/bftpdutmp",
-      "file_count": 1,
-      "byte_count": 62100,
-      "tree_sha256": "7ac25e26813dbf435940025f1432d2ebcf04856ad5f1ac5d81a5de0370a8060d",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
     {
       "id": "runtime-tmp-update-bin-bloom-controls",
       "kind": "runtime",
@@ -2347,8 +2321,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/script/network",
       "file_count": 5,
-      "byte_count": 25000,
-      "tree_sha256": "0a925e68531db9099042ecf3ffbb3af5249cc5ae3ed2001c1468ca4eb9b99e0e",
+      "byte_count": 23560,
+      "tree_sha256": "c0c20b192a1f736c4e8d6ff20dd0ffbf8133d20e98e12229dd1cacae022fd593",
       "source": "https://github.com/OnionUI/Onion",
       "source_revision": "07505ea58c7bba698d6b9220ff43946a43cac76b",
       "license": "GPL-3.0-only",

diff --git a/docs/1.0_TEST_MATRIX.md b/docs/1.0_TEST_MATRIX.md
@@ -52,7 +52,7 @@ shoulder button.
 | Critical lifecycle | Exact 640x480 and 752x560 built-in projections; source/target/path and legacy-file rejection; boot/shutdown/save/low-battery/recovery/Safe Mode ignore theme/config/media; charging reflects bounded actual level; installer uses one deterministic surface; missing optional text/font fallback; signed Full-update boot/charging/shutdown/recovery checkpoint |
 | Settings | One sectioned surface; inline values; capability filtering; one-layer details; hidden Developer section; optional overlapping L1/R1 list paging |
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi opens the dedicated detail surface; Wi-Fi left/right never mutates the radio; readable battery; B/START close |
-| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; dormant Telnet and FileBrowser HTTP launcher/Tweaks exposure plus rejected Samba payloads absent from newly assembled stable artifacts while older-card remnants remain locked down |
+| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; inherited FTP/Telnet/FileBrowser HTTP launcher and Tweaks exposure plus rejected Samba payloads absent from newly assembled stable artifacts while older-card remnants remain locked down |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; sanitized `network connect status` with internal profile-handle validation and public omission; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
 | Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; explicit inactive-profile X/confirm forget flow; active-row refusal in Shell and store; fixed nonblocking delete; exact acknowledgement; terminal projection reload; graceful TERM cleanup before bounded KILL; exact guarded-connect status model with fixed phases/operations/failures, lease consistency, 64-byte transaction-ID and 300-second deadline ceilings, and discarded transaction/overlay identity; fixed no-follow `network connect status` loader with less-than-4-KiB output, five-second read ceiling, and stale-state clearing; separately typed single-flight nonblocking status request with process-group timeout and generic-poller refusal; controller-owned single request, 100-ms opportunities, duplicate-begin refusal, typed terminal state, teardown reaping, explicit guarded-state presentation, one-second freshness, fail-closed mutation gating for stale/unavailable/lease-armed/rollback-failed results, read-only refresh without queued intent, and exit teardown; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
@@ -26,6 +26,10 @@ are no longer exposed by the stable UI.
 The inherited Telnet environment launcher, dormant start logic, and visible
 Tweaks toggle are also excluded; stale-state cleanup and exact BusyBox
 `telnetd` termination remain for older-card compatibility.
+The inherited bftpd executables, anonymous/authenticated configurations, start
+logic, default credentials, and visible Tweaks controls are excluded as well;
+stale FTP state cleanup and exact `bftpd` termination remain for older-card
+compatibility.
 The reviewed key-only Dropbear transport is the only stable remote listener;
 SFTP is independently gated and confined through that same transport.
 Its chroot is materialized from the versioned canonical transfer policy rather

diff --git a/src/tweaks/appstate.h b/src/tweaks/appstate.h
@@ -17,7 +17,6 @@ bool isMenu(List *target)
 
 static List _menu_network;
 static List _menu_wifi;
-static List _menu_ftp;
 static List _menu_wps;
 static List _menu_smbd;
 static List _menu_vnc;
@@ -26,7 +25,6 @@ void menu_network_free_all(void)
 {
     list_free(&_menu_network);
     list_free(&_menu_wifi);
-    list_free(&_menu_ftp);
     list_free(&_menu_wps);
     list_free(&_menu_smbd);
     list_free(&_menu_vnc);

diff --git a/src/tweaks/network.h b/src/tweaks/network.h
@@ -28,12 +28,10 @@
 
 static struct network_s {
     bool smbd;
-    bool ftp;
     bool hotspot;
     bool ntp;
     bool ntp_wait;
     bool auth_smbd;
-    bool auth_ftp;
     bool manual_tz;
     bool check_updates;
     bool keep_alive;
@@ -51,12 +49,10 @@ void network_loadState(void)
         return;
 
     network_state.smbd = config_flag_get(".smbdState");
-    network_state.ftp = config_flag_get(".ftpState");
     network_state.hotspot = config_flag_get(".hotspotState");
     network_state.ntp = config_flag_get(".ntpState");
     network_state.ntp_wait = config_flag_get(".ntpWait");
     network_state.force_wifi_on_startup = config_flag_get(".ntpForce");
-    network_state.auth_ftp = config_flag_get(".authftpState");
     network_state.manual_tz = config_flag_get(".manual_tz");
     network_state.check_updates = config_flag_get(".checkUpdates");
     network_state.keep_alive = config_flag_get(".keepServicesAlive");
@@ -212,21 +208,6 @@ void network_execServiceState(const char *service_name, bool background)
     printf_debug("network_execServiceState: %s\n", state);
 }
 
-void network_execServiceAuth(const char *service_name)
-{
-    char authed[256];
-    char command[512];
-
-    sync();
-
-    sprintf(authed, NET_SCRIPT_PATH "/update_networking.sh %s authed", service_name);
-    sprintf(command, "%s 2>&1", authed);
-
-    system(command);
-
-    printf_debug("network_execServiceAuth: %s\n", authed);
-}
-
 void network_commonEnableToggle(List *list, ListItem *item, bool *value_pt, const char *service_name, const char *service_flag)
 {
     bool enabled = item->value == 1;
@@ -244,11 +225,6 @@ void network_setSmbdState(void *pt)
     network_commonEnableToggle(&_menu_smbd, (ListItem *)pt, &network_state.smbd, "smbd", ".smbdState");
 }
 
-void network_setFtpState(void *pt)
-{
-    network_commonEnableToggle(&_menu_ftp, (ListItem *)pt, &network_state.ftp, "ftp", ".ftpState");
-}
-
 void network_setHotspotState(void *pt)
 {
     network_setState(&network_state.hotspot, ".hotspotState", ((ListItem *)pt)->value);
@@ -286,12 +262,6 @@ void network_keepServicesAlive(void *pt)
     network_setState(&network_state.keep_alive, ".keepServicesAlive", !((ListItem *)pt)->value);
 }
 
-void network_setFtpAuthState(void *pt)
-{
-    network_setState(&network_state.auth_ftp, ".authftpState", ((ListItem *)pt)->value);
-    network_execServiceAuth("ftp");
-}
-
 void network_wpsConnect(void *pt)
 {
     system("sh " NET_SCRIPT_PATH "/wpsclient.sh");
@@ -416,37 +386,6 @@ void menu_smbd(void *pt)
     header_changed = true;
 }
 
-void menu_ftp(void *pt)
-{
-    ListItem *item = (ListItem *)pt;
-    item->value = (int)network_state.ftp;
-    if (!_menu_ftp._created) {
-        _menu_ftp = list_create(2, LIST_SMALL);
-        strcpy(_menu_ftp.title, "FTP");
-        list_addItemWithInfoNote(&_menu_ftp,
-                                 (ListItem){
-                                     .label = "Enable",
-                                     .item_type = TOGGLE,
-                                     .value = (int)network_state.ftp,
-                                     .action = network_setFtpState},
-                                 item->info_note);
-        list_addItemWithInfoNote(&_menu_ftp,
-                                 (ListItem){
-                                     .label = "Enable authentication",
-                                     .item_type = TOGGLE,
-                                     .disabled = !network_state.ftp,
-                                     .value = (int)network_state.auth_ftp,
-                                     .action = network_setFtpAuthState},
-                                 "Username: onion\n"
-                                 "Password: onion\n"
-                                 " \n"
-                                 "We're using a new auth system. User defined\n"
-                                 "passwords will come in a future update.");
-    }
-    menu_stack[++menu_level] = &_menu_ftp;
-    header_changed = true;
-}
-
 void menu_wps(void *_)
 {
     if (!_menu_wps._created) {
@@ -533,7 +472,7 @@ void menu_wifi(void *_)
 void menu_network(void *_)
 {
     if (!_menu_network._created) {
-        _menu_network = list_create(8, LIST_SMALL);
+        _menu_network = list_create(7, LIST_SMALL);
         strcpy(_menu_network.title, "Network");
 
         network_loadState();
@@ -562,19 +501,6 @@ void menu_network(void *_)
                                  " \n"
                                  "Username: onion\n"
                                  "Password: onion\n");
-        list_addItemWithInfoNote(&_menu_network,
-                                 (ListItem){
-                                     .label = "FTP: File server...",
-                                     .item_type = TOGGLE,
-                                     .disabled = !settings.wifi_on,
-                                     .alternative_arrow_action = true,
-                                     .arrow_action = network_setFtpState,
-                                     .value = (int)network_state.ftp,
-                                     .action = menu_ftp},
-                                 "FTP provides a method of transferring files\n"
-                                 "between BloomOS and a PC, phone, or tablet.\n"
-                                 "You'll need an FTP client installed on the\n"
-                                 "other device.");
         list_addItemWithInfoNote(&_menu_network,
                                  (ListItem){
                                      .label = "VNC: Screen share...",

diff --git a/src/tweaks/tweaks.c b/src/tweaks/tweaks.c
@@ -46,7 +46,6 @@ void check_networkChanged(void)
 {
     bool modified = temp_flag_get("network_changed");
     modified |= check_menuHasChanges(&_menu_network);
-    modified |= check_menuHasChanges(&_menu_ftp);
     modified |= check_menuHasChanges(&_menu_date_time);
     temp_flag_set("network_changed", modified);
 }

diff --git a/static/build/.tmp_update/bin/bftpd b/static/build/.tmp_update/bin/bftpd
diff --git a/static/build/.tmp_update/bin/bftpdutmp b/static/build/.tmp_update/bin/bftpdutmp
diff --git a/static/build/.tmp_update/script/network/update_networking.sh b/static/build/.tmp_update/script/network/update_networking.sh
@@ -243,51 +243,6 @@ smbd_authed() {
     fi
 }
 
-# Starts bftpd if the toggle is set to on
-check_ftpstate() {
-    if flag_enabled ftpState; then
-        if is_running bftpd; then
-            if wifi_disabled; then
-                log "FTP: Wifi is turned off, disabling the toggle for FTP and killing the process"
-                disable_flag ftpState
-                killall -9 bftpd
-            fi
-        else
-            if wifi_enabled; then
-                log "FTP: Starting bftpd"
-                sync
-                if flag_enabled authftpState; then
-                    ftp_authed
-                else
-                    bftpd -d -c /mnt/SDCARD/.tmp_update/config/bftpd.conf
-                    log "FTP: Starting bftpd without auth"
-                fi
-            else
-                disable_flag ftpState
-            fi
-        fi
-    else
-        if is_running bftpd; then
-            killall -9 bftpd
-            log "FTP: Killed"
-        fi
-    fi
-}
-
-# Called by above function on boot or when auth state is toggled in tweaks
-ftp_authed() {
-    if flag_enabled ftpState; then
-        if is_running_exact "bftpd -d -c /mnt/SDCARD/.tmp_update/config/bftpd.conf" || flag_enabled authftpState; then
-            killall -9 bftpd
-            bftpd -d -c /mnt/SDCARD/.tmp_update/config/bftpdauth.conf
-            log "FTP: Starting bftpd with auth"
-        else
-            killall -9 bftpd
-            bftpd -d -c /mnt/SDCARD/.tmp_update/config/bftpd.conf
-        fi
-    fi
-}
-
 # Starts only Bloom's explicit developer-mode, key-only SSH service.
 check_sshstate() {
     if $sysdir/bin/bloom-dev-ssh start; then

diff --git a/static/configs/.tmp_update/config/bftpd.conf b/static/configs/.tmp_update/config/bftpd.conf