diff --git a/build/dependencies.lock b/build/dependencies.lock
index 5dfb86d74..dc11658f7 100644
--- a/build/dependencies.lock
+++ b/build/dependencies.lock
@@ -207,11 +207,11 @@ legacy_channels = ["development"]
 [legacy_inventory]
 manifest = "build/legacy-manifest.json"
 schema = 1
-component_count = 328
-file_count = 1969
-byte_count = 260922113
+component_count = 326
+file_count = 1967
+byte_count = 260659274
 source_build_components = 232
-unresolved_components = 96
+unresolved_components = 94
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"
 
 [themes]
diff --git a/build/legacy-manifest.json b/build/legacy-manifest.json
index 59eeb579e..9250a4eba 100644
--- a/build/legacy-manifest.json
+++ b/build/legacy-manifest.json
@@ -579,8 +579,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloom-listener-audit",
       "file_count": 1,
-      "byte_count": 2723,
-      "tree_sha256": "d0d0cc448e9122be7275d73c474619bb0515a9785b7beecf11af0574f73756ed",
+      "byte_count": 2830,
+      "tree_sha256": "7ece6dcb6d57117033a2be3d275d47dafb8bb9f5a82eb6380e0bef92dadd1e4e",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",
@@ -1367,19 +1367,6 @@
       "build_recipe": null,
       "resolution": "replace-source-build-or-exclude"
     },
-    {
-      "id": "runtime-tmp-update-bin-vncserver",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/bin/vncserver",
-      "file_count": 1,
-      "byte_count": 41692,
-      "tree_sha256": "3dc532356c29271a15e00dc46f4d2d96b79b2cb1e78e9672a0766aeae9b9fdc4",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
     {
       "id": "runtime-tmp-update-bin-wget",
       "kind": "runtime",
@@ -1874,19 +1861,6 @@
       "build_recipe": null,
       "resolution": "replace-source-build-or-exclude"
     },
-    {
-      "id": "runtime-tmp-update-lib-libvncserver-so-1",
-      "kind": "runtime",
-      "path": "static/build/.tmp_update/lib/libvncserver.so.1",
-      "file_count": 1,
-      "byte_count": 221311,
-      "tree_sha256": "3ce79f4e60262c7628756b145a10d3401c2ba0c7275f66d2817ddab040c70556",
-      "source": null,
-      "source_revision": null,
-      "license": null,
-      "build_recipe": null,
-      "resolution": "replace-source-build-or-exclude"
-    },
     {
       "id": "runtime-tmp-update-lib-libx264-so-155",
       "kind": "runtime",
@@ -2282,8 +2256,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/script/network",
       "file_count": 5,
-      "byte_count": 19961,
-      "tree_sha256": "13e9a2fbae9c29f9f1909ef750630d8e04c6ecdd9b4e4cb958477ec5228d330b",
+      "byte_count": 20018,
+      "tree_sha256": "bd82793eb547e1e1d3a922e39040ce631fb27c0dd3a6d1efe6e90152e6a8db0d",
       "source": "https://github.com/OnionUI/Onion",
       "source_revision": "07505ea58c7bba698d6b9220ff43946a43cac76b",
       "license": "GPL-3.0-only",
diff --git a/docs/1.0_TEST_MATRIX.md b/docs/1.0_TEST_MATRIX.md
index bb21cccb9..97897fd00 100644
--- a/docs/1.0_TEST_MATRIX.md
+++ b/docs/1.0_TEST_MATRIX.md
@@ -52,7 +52,7 @@ shoulder button.
 | Critical lifecycle | Exact 640x480 and 752x560 built-in projections; source/target/path and legacy-file rejection; boot/shutdown/save/low-battery/recovery/Safe Mode ignore theme/config/media; charging reflects bounded actual level; installer uses one deterministic surface; missing optional text/font fallback; signed Full-update boot/charging/shutdown/recovery checkpoint |
 | Settings | One sectioned surface; inline values; capability filtering; one-layer details; hidden Developer section; optional overlapping L1/R1 list paging |
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi opens the dedicated detail surface; Wi-Fi left/right never mutates the radio; readable battery; B/START close |
-| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; inherited FTP/Telnet/FileBrowser HTTP and rejected Samba launchers, configurations, and Tweaks exposure absent from newly assembled stable artifacts; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
+| Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot/VNC flags cannot activate listeners; process-aware listener audit including inherited TCP/5900 and vncserver; inherited FTP/Telnet/FileBrowser HTTP, rejected Samba, and unresolved VNC launchers, configurations, libraries, and Tweaks exposure absent from newly assembled stable artifacts; WPS progress assets, WPS controls, inherited hotspot controls, and dormant hotspot mutation functions absent while fail-closed entrypoints and older-card process cleanup remain |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; sanitized `network connect status` with internal profile-handle validation and public omission; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
 | Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, explicit secret clearing, nonblocking submit/poll, 4-KiB acknowledgement cap, exact upsert response, timeout process-group cleanup, exact saved-ID reuse, 104-bit no-follow random new handles, collision/security/full-store rejection, one editing/submitting controller with 100-ms poll opportunities, exact cancellation, terminal clearing, bounded focus return, supported scan-result selection, explicit saved-not-connected result, and no implicit association; explicit inactive-profile X/confirm forget flow; active-row refusal in Shell and store; fixed nonblocking delete; exact acknowledgement; terminal projection reload; graceful TERM cleanup before bounded KILL; exact guarded-connect status model with fixed phases/operations/failures, lease consistency, 64-byte transaction-ID and 300-second deadline ceilings, and discarded transaction/overlay identity; fixed no-follow `network connect status` loader with less-than-4-KiB output, five-second read ceiling, and stale-state clearing; separately typed single-flight nonblocking status request with process-group timeout and generic-poller refusal; controller-owned single request, 100-ms opportunities, duplicate-begin refusal, typed terminal state, teardown reaping, explicit guarded-state presentation, one-second freshness, fail-closed mutation gating for stale/unavailable/lease-armed/rollback-failed results, read-only refresh without queued intent, and exit teardown; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index a011f00ab..7249dd9dd 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -15,7 +15,7 @@ public-key authentication only, and refuses unknown or changed host keys.
 
 Inherited Onion listener flags are migration-only input. Bloom reconciliation
 never starts FTP, Telnet, whole-card FileBrowser HTTP, inherited Samba, WPS, or
-the inherited hotspot, even when stale flags remain on the SD card. It actively
+the inherited hotspot or VNC server, even when stale flags remain on the SD card. It actively
 stops their known processes. `bloom-listener-audit` provides a bounded,
 process-aware check that names service classes without publishing addresses.
 The dormant FileBrowser executable, database, web theme, icon, and boot-time
@@ -38,6 +38,10 @@ older-card compatibility.
 Stable Tweaks does not expose WPS or the inherited hotspot. The WPS compatibility
 entry point remains only to reject inherited callers, while hotspot state is
 migration-only until NET-08 supplies a separately reviewed transactional owner.
+The unresolved inherited VNC executable and library, direct input/display
+launcher, and stable Tweaks controls are excluded. Older-card `.vncServer`
+intent is migration-only, and reconciliation plus listener audit detect and stop
+the exact inherited process without publishing an address.
 The reviewed key-only Dropbear transport is the only stable remote listener;
 SFTP is independently gated and confined through that same transport.
 Its chroot is materialized from the versioned canonical transfer policy rather
diff --git a/src/tweaks/appstate.h b/src/tweaks/appstate.h
index 74cc1c719..818350e6c 100644
--- a/src/tweaks/appstate.h
+++ b/src/tweaks/appstate.h
@@ -16,12 +16,10 @@ bool isMenu(List *target)
 }
 
 static List _menu_network;
-static List _menu_vnc;
 
 void menu_network_free_all(void)
 {
     list_free(&_menu_network);
-    list_free(&_menu_vnc);
 }
 
 static List _menu_icons;
diff --git a/src/tweaks/network.h b/src/tweaks/network.h
index e6753e8db..39f018333 100644
--- a/src/tweaks/network.h
+++ b/src/tweaks/network.h
@@ -19,7 +19,6 @@
 #include "utils/json.h"
 #include "utils/keystate.h"
 #include "utils/netinfo.h"
-#include "utils/process.h"
 
 #include "./appstate.h"
 
@@ -31,13 +30,9 @@ static struct network_s {
     bool manual_tz;
     bool check_updates;
     bool keep_alive;
-    bool vncserv;
     bool loaded;
     bool force_wifi_on_startup;
-    int vncfps;
-} network_state = {
-    .vncfps = 20,
-};
+} network_state;
 
 void network_loadState(void)
 {
@@ -50,8 +45,6 @@ void network_loadState(void)
     network_state.manual_tz = config_flag_get(".manual_tz");
     network_state.check_updates = config_flag_get(".checkUpdates");
     network_state.keep_alive = config_flag_get(".keepServicesAlive");
-    network_state.vncserv = config_flag_get(".vncServer");
-    config_get(".vncfps", CONFIG_INT, &network_state.vncfps);
     network_state.loaded = true;
 }
 
@@ -147,80 +140,10 @@ void network_setTzSelectState(void *pt)
     config_setString(".tz", utc_str);
 }
 
-void network_toggleVNC(void *pt)
-{
-    char command_start[STR_MAX];
-    char command_stop[STR_MAX];
-
-    int new_fps = (int)network_state.vncfps;
-
-    sprintf(command_start, "/mnt/SDCARD/.tmp_update/bin/vncserver -k /dev/input/event0 -F %d -r 180 > /dev/null 2>&1 &", new_fps);
-    sprintf(command_stop, "killall -9 vncserver");
-
-    if (!network_state.vncserv) {
-        network_state.vncserv = true;
-        network_setState(&network_state.vncserv, ".vncServer", true);
-        reset_menus = true;
-        if (!process_isRunning("vncserver")) {
-            system(command_start);
-        }
-    }
-    else {
-        network_state.vncserv = false;
-        network_setState(&network_state.vncserv, ".vncServer", false);
-        reset_menus = true;
-        if (process_isRunning("vncserver")) {
-            system(command_stop);
-        }
-    }
-}
-
-void network_setVNCFPS(void *pt)
-{
-    network_state.vncfps = ((ListItem *)pt)->value;
-    config_setNumber(".vncfps", network_state.vncfps);
-
-    if (network_state.vncserv) {
-        network_toggleVNC(pt);
-        network_state.vncserv = false;
-        network_setState(&network_state.vncserv, ".vncServer", false);
-        reset_menus = true;
-    }
-}
-
-void menu_vnc(void *pt)
-{
-    ListItem *item = (ListItem *)pt;
-    item->value = (int)network_state.vncserv;
-    if (!_menu_vnc._created) {
-        _menu_vnc = list_create(2, LIST_SMALL);
-        strcpy(_menu_vnc.title, "VNC");
-        list_addItem(&_menu_vnc,
-                     (ListItem){
-                         .label = "Enable",
-                         .item_type = TOGGLE,
-                         .value = (int)network_state.vncserv,
-                         .action = network_toggleVNC});
-        list_addItemWithInfoNote(&_menu_vnc,
-                                 (ListItem){
-                                     .label = "Framerate",
-                                     .item_type = MULTIVALUE,
-                                     .value_max = 20,
-                                     .value_min = 1,
-                                     .value = (int)network_state.vncfps,
-                                     .action = network_setVNCFPS},
-                                 "Set the framerate of the VNC server\n"
-                                 "between 1 and 20. The higher the \n"
-                                 "framerate the more CPU it will use \n");
-    }
-    menu_stack[++menu_level] = &_menu_vnc;
-    header_changed = true;
-}
-
 void menu_network(void *_)
 {
     if (!_menu_network._created) {
-        _menu_network = list_create(3, LIST_SMALL);
+        _menu_network = list_create(2, LIST_SMALL);
         strcpy(_menu_network.title, "Network");
 
         network_loadState();
@@ -230,17 +153,6 @@ void menu_network(void *_)
                          .label = "IP address: N/A",
                          .disabled = true,
                          .action = NULL});
-        list_addItemWithInfoNote(&_menu_network,
-                                 (ListItem){
-                                     .label = "VNC: Screen share...",
-                                     .item_type = TOGGLE,
-                                     .disabled = !settings.wifi_on,
-                                     .alternative_arrow_action = true,
-                                     .arrow_action = network_toggleVNC,
-                                     .value = (int)network_state.vncserv,
-                                     .action = menu_vnc},
-                                 "Connect to your MMP from another device\n"
-                                 "to view the screen and interact with it.");
         list_addItemWithInfoNote(&_menu_network,
                                  (ListItem){
                                      .label = "Disable services in game",
diff --git a/static/build/.tmp_update/bin/bloom-listener-audit b/static/build/.tmp_update/bin/bloom-listener-audit
index 2e52b3408..e2a3260c5 100755
--- a/static/build/.tmp_update/bin/bloom-listener-audit
+++ b/static/build/.tmp_update/bin/bloom-listener-audit
@@ -45,6 +45,7 @@ listener_present '(:|[.])23[[:space:]].*(telnetd|busybox)' && append_unique proh
 listener_present '(:|[.])(80|8080)[[:space:]].*(filebrowser|uhttpd)' && append_unique prohibited filebrowser_http
 listener_present '(:|[.])(137|138|139|445)[[:space:]].*smbd' && append_unique prohibited samba
 listener_present '(:|[.])(53|67)[[:space:]].*(dnsmasq|hostapd)' && append_unique prohibited hotspot
+listener_present '(:|[.])5900[[:space:]].*vncserver' && append_unique prohibited vnc
 listener_present '(:|[.])22[[:space:]].*dropbear' && append_unique reviewed key_only_ssh
 if listener_present '(:|[.])2222[[:space:]].*dropbear'; then
     append_unique reviewed key_only_ssh_shadow
@@ -52,7 +53,8 @@ if listener_present '(:|[.])2222[[:space:]].*dropbear'; then
 fi
 
 for mapping in 'bftpd:ftp' 'ftpd:ftp' 'telnetd:telnet' 'filebrowser:filebrowser_http' \
-    'uhttpd:filebrowser_http' 'smbd:samba' 'hostapd:hotspot' 'dnsmasq:hotspot'; do
+    'uhttpd:filebrowser_http' 'smbd:samba' 'hostapd:hotspot' 'dnsmasq:hotspot' \
+    'vncserver:vnc'; do
     process=${mapping%%:*}
     service=${mapping#*:}
     if process_present "$process"; then
diff --git a/static/build/.tmp_update/bin/vncserver b/static/build/.tmp_update/bin/vncserver
deleted file mode 100644
index f2cbe6b4c..000000000
Binary files a/static/build/.tmp_update/bin/vncserver and /dev/null differ
diff --git a/static/build/.tmp_update/lib/libvncserver.so.1 b/static/build/.tmp_update/lib/libvncserver.so.1
deleted file mode 100644
index 7acdc7a59..000000000
Binary files a/static/build/.tmp_update/lib/libvncserver.so.1 and /dev/null differ
diff --git a/static/build/.tmp_update/script/network/update_networking.sh b/static/build/.tmp_update/script/network/update_networking.sh
index dc0dc3968..96e5189dd 100644
--- a/static/build/.tmp_update/script/network/update_networking.sh
+++ b/static/build/.tmp_update/script/network/update_networking.sh
@@ -14,7 +14,7 @@ export PATH="$sysdir/bin:$PATH"
 is_booting=$([ -f /tmp/is_booting ] && echo 1 || echo 0)
 
 # Legacy listener flags are migration input only. Bloom never restores them.
-legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState"
+legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState vncServer"
 
 logfile=$(basename "$0" .sh)
 . $sysdir/script/log.sh
@@ -130,7 +130,7 @@ lockdown_legacy_listeners() {
     # cannot see it. Match only the exact applet argv and kill only that PID.
     stop_busybox_telnet
 
-    for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do
+    for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do
         if is_running "$process"; then
             killall -9 "$process"
             log "Bloom security: stopped inherited $process process"
@@ -148,8 +148,9 @@ disable_all_services() {
     disable_flag httpState
     disable_flag authhttpState
     disable_flag smbdState
+    disable_flag vncServer
 
-    for process in dropbear bftpd filebrowser telnetd hostapd dnsmasq smbd; do
+    for process in dropbear bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do
         if is_running $process; then
             killall -9 $process
         fi
diff --git a/test/shell/bloom_shell_runtime.bats b/test/shell/bloom_shell_runtime.bats
index 13f1c23bb..bed46fdb6 100644
--- a/test/shell/bloom_shell_runtime.bats
+++ b/test/shell/bloom_shell_runtime.bats
@@ -212,7 +212,7 @@
     ! grep -F 'bin/filebrowser' "$runtime"
     grep -F 'filebrowser' /workspace/static/build/.tmp_update/bin/bloom-listener-audit
     network=/workspace/static/build/.tmp_update/script/network/update_networking.sh
-    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do' "$network"
+    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do' "$network"
     ! grep -F 'filebrowserbin=' "$network"
     ! grep -F 'check_httpstate()' "$network"
     ! grep -F 'http_authed()' "$network"
diff --git a/test/shell/ci_validation.bats b/test/shell/ci_validation.bats
index e3164d675..102fb282a 100644
--- a/test/shell/ci_validation.bats
+++ b/test/shell/ci_validation.bats
@@ -165,3 +165,19 @@
     [ "$status" -eq 0 ]
     [ "$output" = "full" ]
 }
+
+@test "stable VNC payload retirement keeps packaging exhaustive" {
+    scope=/workspace/tools/ci-scope.sh
+    run sh -c "printf '%s\n' static/build/.tmp_update/bin/vncserver | '$scope' build"
+    [ "$status" -eq 0 ]
+    [ "$output" = "full" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/lib/libvncserver.so.1 | '$scope' static-analysis"
+    [ "$status" -eq 0 ]
+    [ "$output" = "none" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/bin/vncserver | '$scope' risk"
+    [ "$status" -eq 0 ]
+    [ "$output" = "3" ]
+    run sh -c "printf '%s\n' static/build/.tmp_update/lib/libvncserver.so.1 | '$scope' shell-tests"
+    [ "$status" -eq 0 ]
+    [ "$output" = "full" ]
+}
diff --git a/test/shell/legacy_manifest.bats b/test/shell/legacy_manifest.bats
index 935398432..9f4380b7c 100644
--- a/test/shell/legacy_manifest.bats
+++ b/test/shell/legacy_manifest.bats
@@ -6,7 +6,7 @@
         --manifest /workspace/build/legacy-manifest.json
 
     [ "$status" -eq 0 ]
-    [[ "$output" == "legacy manifest validate: 328 components" ]]
+    [[ "$output" == "legacy manifest validate: 326 components" ]]
     [ ! -e "/workspace/static/packages/RApp/SNK - Neo Geo (GnGeo)" ]
     [ ! -e "/workspace/static/packages/RApp/PICO-8 (PICO-8 standalone)" ]
     [ ! -e "/workspace/static/packages/RApp/SCUMM (ScummVM standalone)" ]
diff --git a/test/shell/listener_lockdown.bats b/test/shell/listener_lockdown.bats
index 4fd3d5273..4434fa027 100644
--- a/test/shell/listener_lockdown.bats
+++ b/test/shell/listener_lockdown.bats
@@ -42,16 +42,18 @@ tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 11/busybox
 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 12/filebrowser
 tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 13/smbd
 udp 0 0 0.0.0.0:53 0.0.0.0:* 14/dnsmasq
+tcp 0 0 0.0.0.0:5900 0.0.0.0:* LISTEN 15/vncserver
 EOF
     printf '%s\n' '10 bftpd' '11 busybox telnetd' '12 filebrowser' '13 smbd' '14 dnsmasq' \
+        '15 vncserver -k /dev/input/event0' \
         >"$INPUT/processes"
 
     run env BLOOM_LISTENER_AUDIT_INPUT_DIR="$INPUT" sh "$AUDIT"
 
     [ "$status" -eq 1 ]
     [[ "$output" == *'"clean":false'* ]]
-    [[ "$output" == *'"prohibited":["ftp","telnet","filebrowser_http","samba","hotspot"]'* ]]
-    [[ "$output" == *'"prohibited_processes":["ftp","telnet","filebrowser_http","samba","hotspot"]'* ]]
+    [[ "$output" == *'"prohibited":["ftp","telnet","filebrowser_http","samba","hotspot","vnc"]'* ]]
+    [[ "$output" == *'"prohibited_processes":["ftp","telnet","filebrowser_http","samba","hotspot","vnc"]'* ]]
     [[ "$output" != *'0.0.0.0'* ]]
 }
 
@@ -124,7 +126,7 @@ EOF
     ! grep -F 'bftpd -d' "$network"
     grep -F 'disable_flag ftpState' "$network"
     grep -F 'disable_flag authftpState' "$network"
-    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do' "$network"
+    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do' "$network"
     ! grep -F 'network_state.ftp' "$tweaks"
     ! grep -F 'network_setFtpState' "$tweaks"
     ! grep -F 'FTP: File server' "$tweaks"
@@ -147,12 +149,12 @@ EOF
     printf '#!/bin/sh\nprintf 0\n' >"$root/customer/app/jsonval"
     printf '#!/bin/sh\nexit 0\n' >"$sysdir/bin/bloom-dev-ssh"
     chmod +x "$root/customer/app/jsonval" "$sysdir/bin/bloom-dev-ssh"
-    for flag in httpState ftpState telnetState smbdState authftpState authhttpState hotspotState; do
+    for flag in httpState ftpState telnetState smbdState authftpState authhttpState hotspotState vncServer; do
         : >"$sysdir/config/.$flag"
     done
     cat >"$mock/pgrep" <<'EOF'
 #!/bin/sh
-case "$1" in bftpd|filebrowser|telnetd|hostapd|dnsmasq|smbd) exit 0;; *) exit 1;; esac
+case "$1" in bftpd|filebrowser|telnetd|hostapd|dnsmasq|smbd|vncserver) exit 0;; *) exit 1;; esac
 EOF
     cat >"$mock/killall" <<'EOF'
 #!/bin/sh
@@ -163,7 +165,7 @@ EOF
     run env BLOOM_NETWORK_ROOT="$root" CALLS="$calls" PATH="$mock:$PATH" sh "$COMPAT" services
 
     [ "$status" -eq 0 ]
-    for flag in httpState ftpState telnetState smbdState authftpState authhttpState hotspotState; do
+    for flag in httpState ftpState telnetState smbdState authftpState authhttpState hotspotState vncServer; do
         [ ! -e "$sysdir/config/.$flag" ] || {
             printf 'active legacy flag remains: %s\n' "$flag" >&2
             false
@@ -175,6 +177,7 @@ EOF
     grep -Fx -- '-9 smbd' "$calls"
     grep -Fx -- '-9 hostapd' "$calls"
     grep -Fx -- '-9 dnsmasq' "$calls"
+    grep -Fx -- '-9 vncserver' "$calls"
 }
 
 @test "legacy activation entry points and WPS fail closed" {
@@ -195,7 +198,7 @@ EOF
     [ ! -e /workspace/static/build/.tmp_update/res/wpstrying.png ]
     ! grep -F 'start_hotspot()' "$network"
     ! grep -F 'check_hotspotstate()' "$network"
-    grep -F 'legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState"' "$network"
+    grep -F 'legacy_services="httpState ftpState telnetState smbdState authftpState authhttpState hotspotState vncServer"' "$network"
     grep -F 'ftp | telnet | http | smbd | hotspot)' "$network"
     ! grep -F 'network_state.hotspot' "$tweaks"
     ! grep -F 'network_setHotspotState' "$tweaks"
@@ -206,3 +209,26 @@ EOF
     ! grep -F 'Enabling hotspot' "$hotspot_doc"
     ! grep -F 'WiFi: Hotspot/WPS' /workspace/website/docs/07-apps/01-included-in-onion/tweaks.mdx
 }
+
+@test "stable unauthenticated VNC payload and controls remain retired" {
+    audit=/workspace/static/build/.tmp_update/bin/bloom-listener-audit
+    network=/workspace/static/build/.tmp_update/script/network/update_networking.sh
+    tweaks=/workspace/src/tweaks/network.h
+    vnc_doc=/workspace/website/docs/07-apps/03-network-features/07-vnc-server.md
+
+    [ ! -e /workspace/static/build/.tmp_update/bin/vncserver ]
+    [ ! -e /workspace/static/build/.tmp_update/lib/libvncserver.so.1 ]
+    [ ! -e /workspace/website/docs/07-apps/03-network-features/assets/vnc.webp ]
+    [ ! -e /workspace/website/docs/07-apps/03-network-features/assets/vnc-client.webp ]
+    grep -F "5900[[:space:]].*vncserver" "$audit"
+    grep -F "'vncserver:vnc'" "$audit"
+    grep -F 'disable_flag vncServer' "$network"
+    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do' "$network"
+    ! grep -F 'network_state.vncserv' "$tweaks"
+    ! grep -F 'network_toggleVNC' "$tweaks"
+    ! grep -F 'VNC: Screen share' "$tweaks"
+    grep -F 'BloomOS does not ship or start the inherited VNC server' "$vnc_doc"
+    grep -F '/docs/network/ssh' "$vnc_doc"
+    ! grep -F 'Enabling VNC access' "$vnc_doc"
+    ! grep -F 'VNC: Screen share' /workspace/website/docs/07-apps/01-included-in-onion/tweaks.mdx
+}
diff --git a/test/shell/samba_source_build.bats b/test/shell/samba_source_build.bats
index bd9b78bd7..8ec80ff7a 100644
--- a/test/shell/samba_source_build.bats
+++ b/test/shell/samba_source_build.bats
@@ -72,7 +72,7 @@ setup() {
     ! grep -F 'start_smbd.sh' "$network"
     ! sed -n '/^print_usage()/,/^}/p' "$network" | grep -F 'smbd'
     grep -F 'disable_flag smbdState' "$network"
-    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd; do' "$network"
+    grep -F 'for process in bftpd filebrowser telnetd hostapd dnsmasq smbd vncserver; do' "$network"
     ! grep -F 'network_state.smbd' "$tweaks"
     ! grep -F 'network_setSmbdState' "$tweaks"
     ! grep -F 'Samba: Network file share' "$tweaks"
diff --git a/test/test_retroarch_build_identity.py b/test/test_retroarch_build_identity.py
index fe1f73084..6d0cf706a 100644
--- a/test/test_retroarch_build_identity.py
+++ b/test/test_retroarch_build_identity.py
@@ -36,9 +36,9 @@ def test_identity_is_stable_for_unrelated_inventory_totals(self):
         self.assertRegex(baseline.stdout.strip(), r"^[0-9a-f]{64}$")
 
         changed = LOCK.read_text(encoding="utf-8")
-        changed = changed.replace("component_count = 328", "component_count = 999")
-        changed = changed.replace("file_count = 1969", "file_count = 9999")
-        changed = changed.replace("byte_count = 260922113", "byte_count = 999999999")
+        changed = changed.replace("component_count = 326", "component_count = 999")
+        changed = changed.replace("file_count = 1967", "file_count = 9999")
+        changed = changed.replace("byte_count = 260659274", "byte_count = 999999999")
         self.assertNotEqual(changed, LOCK.read_text(encoding="utf-8"))
         with tempfile.TemporaryDirectory() as directory:
             candidate = pathlib.Path(directory) / "dependencies.lock"
diff --git a/tools/ci-scope.sh b/tools/ci-scope.sh
index 437df910e..c6109e906 100755
--- a/tools/ci-scope.sh
+++ b/tools/ci-scope.sh
@@ -306,6 +306,12 @@ while IFS= read -r path; do
             # does not expand unrelated C/C++ static analysis.
             [ "$mode" != build ] || full=1
             ;;
+        static/build/.tmp_update/bin/vncserver|\
+        static/build/.tmp_update/lib/libvncserver.so.1)
+            # Retiring the unresolved remote-input listener changes stable
+            # packaging and therefore keeps the complete ARM release gate.
+            [ "$mode" != build ] || full=1
+            ;;
         build/dependencies.lock|build/legacy-manifest.json|build/core-selection-policy*.json|\
         build/core-inventory-disposition*.json|\
         build/save-migration-policy*.json|\
@@ -547,6 +553,14 @@ while IFS= read -r path; do
             add_shell_target /workspace/test/shell/provenance_policy.bats
             add_shell_target /workspace/test/shell/fat_payload.bats
             ;;
+        static/build/.tmp_update/bin/vncserver|\
+        static/build/.tmp_update/lib/libvncserver.so.1)
+            raise_risk 3
+            add_shell_target /workspace/test/shell/listener_lockdown.bats
+            add_shell_target /workspace/test/shell/legacy_manifest.bats
+            add_shell_target /workspace/test/shell/provenance_policy.bats
+            add_shell_target /workspace/test/shell/fat_payload.bats
+            ;;
         test/test_bloom_ui_system_view.cpp|src/bloomUi/bloom_ui_system_view.c|src/bloomUi/bloom_ui_system_view.h)
             raise_risk 1
             add_native_filter 'BloomUiSystemView*'
diff --git a/website/docs/01-features/index.md b/website/docs/01-features/index.md
index 7753d39ac..9736d4158 100644
--- a/website/docs/01-features/index.md
+++ b/website/docs/01-features/index.md
@@ -210,7 +210,7 @@ For the Miyoo Mini Plus (equipped with wifi) Onion offers many additional possib
 - [Automatic date/time synchronisation](apps/tweaks#set-automatically-via-the-internet) (NTP, via Tweaks app)
 - [Retroachivements](https://www.retroarch.com/?page=achievements)
 - [Scraper](/docs/apps/scraper): import game covers directly from your MMP
-- [Network Services](network-features): [HTTP server (retired)](network/http), [SSH/SFTP](network/ssh), [Hotspot/WPS (retired pending transactional replacement)](network/hotspot), [VNC server](network/vnc)...
+- [Network Services](network-features): [HTTP server (retired)](network/http), [SSH/SFTP](network/ssh), [Hotspot/WPS (retired pending transactional replacement)](network/hotspot), [VNC server (retired)](network/vnc)...
 :::
 
 
diff --git a/website/docs/07-apps/01-included-in-onion/tweaks.mdx b/website/docs/07-apps/01-included-in-onion/tweaks.mdx
index 3f741ca4d..a5d19eabf 100644
--- a/website/docs/07-apps/01-included-in-onion/tweaks.mdx
+++ b/website/docs/07-apps/01-included-in-onion/tweaks.mdx
@@ -161,18 +161,6 @@ It can be MainUI, [GameSwitcher](./game-switcher), [Retroarch](./retroarch) or [
 </details>
 <details><summary>
 
-### VNC: Screen share...
-</summary>
-<div>Share your MMP Screen to another device for demonstrations or applications or themes (The MMP does not have the performance to stream game footage through this feature).</div>
-</details>
-<details><summary>
-
-### VNC: Screen share
-</summary>
-<div>Share your MMP Screen to another device for demonstrations or applications or themes (The MMP does not have the performance to stream game footage through this feature).</div>
-</details>
-<details><summary>
-
 ### Disable services in-game
 </summary>
 <div>Disable all network services (except WiFi) while playing games. This helps to conserve battery and to keep performance at a maximum.</div>
diff --git a/website/docs/07-apps/03-network-features/07-vnc-server.md b/website/docs/07-apps/03-network-features/07-vnc-server.md
index f73d57eb4..84185ec8c 100644
--- a/website/docs/07-apps/03-network-features/07-vnc-server.md
+++ b/website/docs/07-apps/03-network-features/07-vnc-server.md
@@ -5,58 +5,21 @@ slug: /network/vnc
 
 # VNC Server
 
-![](./assets/vnc.webp)
+BloomOS does not ship or start the inherited VNC server. The carried executable
+and library had no pinned source, revision, license, or reproducible build
+recipe, and the service exposed unauthenticated, unencrypted remote display and
+input control on TCP port 5900.
 
-Remote display and remote control of your Miyoo Mini+ from your computer thanks to VNC.
+Stable Tweaks therefore has no VNC control. Compatibility reconciliation treats
+an older `.vncServer` marker as migration input only, disables it, and stops an
+exact inherited `vncserver` process. The listener audit also reports either the
+port or process as prohibited without exposing a device address.
 
+## Safe alternatives
 
-## Features
+Use the reviewed key-only [SSH/SFTP service](/docs/network/ssh) for remote
+administration and file transfer. BloomOS has no certified remote-display or
+remote-input service.
 
-- Remote display of the Miyoo Mini+
-- Remote control of the Miyoo Mini+
-
-
-## Enabling VNC access
-
-You'll find it in Tweaks app: [`Network` -› `VNC: Screen share`](/docs/apps/tweaks#vnc-screen-share).
-
-You can either use the master toggle to turn the VNC Server on with your right/left arrows, or press A to enter the submenu and you'll get 2 options:
-
-1. **Enable** - Activate VNC Server
-2. **Framerate** - Set the framerate of the VNC Server between 1 and 20. The higher the framerate, the more CPU will be use
-
-## Logging in
-
-
-Then from your computer, you can login with any VNC client. [RealVNC](https://www.realvnc.com/fr/connect/download/viewer/) for example is declined on all platforms. UltraVNC is a Windows alternative.
-You'll need the IP of the device, found below (**Tweaks** › **Network**)
-
-![](https://github.com/OnionUI/Onion/assets/47260768/23ee6dbf-48c8-4484-b98b-9a8642b8fd49)
-
-Copy it to your VNC client (the default port is used so no need to specify it: 5900).
-
-For example: 
-
-![](./assets/vnc-client.webp)
-
-Once connected, Keybinds need to match what MainUI/SDL is expecting, which are:
-
-```
-# A = K_SPACE
-# B = K_LCTRL
-# Y = K_LALT
-# X = K_LSHIFT
-# L = K_e
-# R = K_t
-# L2 = K_TAB
-# R2 = K_BACKSPACE
-# start = K_RETURN
-# select = K_RCTRL
-# menu = K_ESCAPE
-```
-
-## Security
-
-:::caution Network security
-VNC server must be used on local private network only as there is no password and no encryption. It is not recommended you use VNC on an insecure Wi-Fi network that is open or public as traffic is unencrypted, for this reason we strongly recommend you toggle VNC off when you're on the move!
-:::
+Historical Onion documentation remains available only in the versioned 4.2
+documentation and is not a BloomOS enablement path.
diff --git a/website/docs/07-apps/03-network-features/assets/vnc-client.webp b/website/docs/07-apps/03-network-features/assets/vnc-client.webp
deleted file mode 100644
index b537cedf4..000000000
Binary files a/website/docs/07-apps/03-network-features/assets/vnc-client.webp and /dev/null differ
diff --git a/website/docs/07-apps/03-network-features/assets/vnc.webp b/website/docs/07-apps/03-network-features/assets/vnc.webp
deleted file mode 100644
index 75b55f818..000000000
Binary files a/website/docs/07-apps/03-network-features/assets/vnc.webp and /dev/null differ