diff --git a/crates/mvm-build/src/runtime_layer.rs b/crates/mvm-build/src/runtime_layer.rs
index 3b471f3c39..11047ae66b 100644
--- a/crates/mvm-build/src/runtime_layer.rs
+++ b/crates/mvm-build/src/runtime_layer.rs
@@ -526,30 +526,6 @@ pub fn stage_runtime_layer(
     Ok(stage)
 }
 
-/// Compose authenticated runtime archives without Nix or a builder VM.
-///
-/// This prepares reusable filesystem input only. It cannot be booted, signed as
-/// an application, or installed as a `.mvmpkg` without the signed base, an
-/// application entrypoint, policy admission, verity and final bundle signing.
-/// A directory may recur across layers, but no file or symlink may overlap.
-///
-/// # Errors
-///
-/// Refuses revoked or changed archives, unresolved dependencies, path
-/// collisions, and any tar semantics not faithfully retained by extraction.
-pub fn compose_runtime_layers(
-    archives: &[&VerifiedRuntimeLayerArchive],
-) -> Result<ComposedRuntimeLayers, RuntimeLayerStageError> {
-    if archives.is_empty() || archives.len() > MAX_LAYERS {
-        return Err(RuntimeLayerStageError::InconsistentLayers);
-    }
-    let arch = &archives[0].descriptor().manifest().runtime_layer.guest_arch;
-    let pins = runtime_pins(archives, arch)?;
-    let mut composed = ComposedRuntimeLayers::new(pins)?;
-    add_runtime_archives(&mut composed, archives)?;
-    Ok(composed)
-}
-
 /// Compose precisely the authenticated layers a v2 application requests.
 ///
 /// The host selects the generic base profile; the author cannot choose a
diff --git a/crates/mvm-vmm/src/vsock_egress_bridge/egress_gate.rs b/crates/mvm-vmm/src/vsock_egress_bridge/egress_gate.rs
index 9878be03f4..8bd7a9e2e9 100644
--- a/crates/mvm-vmm/src/vsock_egress_bridge/egress_gate.rs
+++ b/crates/mvm-vmm/src/vsock_egress_bridge/egress_gate.rs
@@ -440,20 +440,6 @@ impl EgressGate {
         }
     }
 
-    /// Decide a TCP connect to an already-resolved address.
-    ///
-    /// When the address belongs to a pinned host, the verdict carries that
-    /// host's whole admitted address set (IPv4 first), not just the single
-    /// address requested. A guest that resolved a dual-stack host locally and
-    /// dialed the numeric IPv6 (macOS `getaddrinfo` returns IPv6 first) then
-    /// falls over to the pinned IPv4 sibling when the IPv6 route is unreachable
-    /// instead of stranding the connect — the same happy-eyeballs behaviour the
-    /// hostname path already gets. Every offered address is independently
-    /// policy-checked, so widening the set never admits an unpinned target.
-    pub fn decide_addr(&self, ip: IpAddr, port: u16) -> EgressVerdict {
-        self.decide_addr_for_proto(Proto::Tcp, ip, port)
-    }
-
     /// Decide a guest connect request — either a numeric `"<ip>:<port>"` or a
     /// `"<hostname>:<port>"` (DNS-over-vsock: the `socks5h` client sends a name and
     /// the host resolves it here against the pin registry, never the guest). A