diff --git a/src/agents/embedded-runner.ts b/src/agents/embedded-runner.ts
deleted file mode 100644
index 7f7ff9b754f..00000000000
--- a/src/agents/embedded-runner.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-export {
-  abortEmbeddedAgentRun,
-  compactEmbeddedAgentSession,
-  isEmbeddedAgentRunActive,
-  isEmbeddedAgentRunStreaming,
-  queueEmbeddedAgentMessage,
-  resolveActiveEmbeddedAgentRunSessionId,
-  resolveEmbeddedSessionLane,
-  runEmbeddedAgent,
-  waitForEmbeddedAgentRunEnd,
-} from "./pi-embedded-runner.js";
-export type {
-  EmbeddedAgentCompactResult,
-  EmbeddedAgentMeta,
-  EmbeddedAgentRunMeta,
-  EmbeddedAgentRunResult,
-} from "./pi-embedded-runner.js";
diff --git a/src/agents/pi-embedded-runner/aliases.test.ts b/src/agents/pi-embedded-runner/aliases.test.ts
index a9923dec93a..272fa61d97b 100644
--- a/src/agents/pi-embedded-runner/aliases.test.ts
+++ b/src/agents/pi-embedded-runner/aliases.test.ts
@@ -1,5 +1,4 @@
 import { describe, expect, it } from "vitest";
-import { runEmbeddedAgent as runEmbeddedAgentFromNeutralBarrel } from "../embedded-runner.js";
 import {
   abortEmbeddedAgentRun,
   abortEmbeddedPiRun,
@@ -12,7 +11,6 @@ import {
 describe("embedded runner compatibility aliases", () => {
   it("keeps neutral embedded-agent aliases bound to the PI compatibility exports", () => {
     expect(runEmbeddedAgent).toBe(runEmbeddedPiAgent);
-    expect(runEmbeddedAgentFromNeutralBarrel).toBe(runEmbeddedPiAgent);
     expect(compactEmbeddedAgentSession).toBe(compactEmbeddedPiSession);
     expect(abortEmbeddedAgentRun).toBe(abortEmbeddedPiRun);
   });
diff --git a/src/channel-web.ts b/src/channel-web.ts
deleted file mode 100644
index 2a2fc17f82b..00000000000
--- a/src/channel-web.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-// Barrel exports for the web channel pieces. Splitting the original 900+ line
-// module keeps responsibilities small and testable.
-import { resolveWebChannelAuthDir } from "./plugins/runtime/runtime-web-channel-plugin.js";
-
-export { HEARTBEAT_PROMPT } from "./auto-reply/heartbeat.js";
-export { HEARTBEAT_TOKEN } from "./auto-reply/tokens.js";
-export { loadWebMedia, optimizeImageToJpeg } from "./media/web-media.js";
-export {
-  createWebChannelSocket as createWaSocket,
-  extractMediaPlaceholder,
-  extractText,
-  formatError,
-  getStatusCode,
-  logWebSelfId,
-  loginWeb,
-  logoutWeb,
-  monitorWebChannel,
-  monitorWebInbox,
-  pickWebChannel,
-  resolveHeartbeatRecipients,
-  runWebHeartbeatOnce,
-  sendWebChannelMessage as sendMessageWhatsApp,
-  sendWebChannelReaction as sendReactionWhatsApp,
-  waitForWebChannelConnection as waitForWaConnection,
-  webAuthExists,
-} from "./plugins/runtime/runtime-web-channel-plugin.js";
-
-// Keep the historic constant surface available, but resolve it through the
-// web-channel plugin boundary only when a caller actually coerces the value to string.
-class LazyWebChannelAuthDir {
-  #value: string | null = null;
-
-  #read(): string {
-    this.#value ??= resolveWebChannelAuthDir();
-    return this.#value;
-  }
-
-  toString(): string {
-    return this.#read();
-  }
-
-  valueOf(): string {
-    return this.#read();
-  }
-
-  [Symbol.toPrimitive](): string {
-    return this.#read();
-  }
-}
-
-export const WA_WEB_AUTH_DIR = new LazyWebChannelAuthDir() as unknown as string;
diff --git a/src/channels/channels-misc.test.ts b/src/channels/channels-misc.test.ts
index 9582710bb26..c82d6964f8b 100644
--- a/src/channels/channels-misc.test.ts
+++ b/src/channels/channels-misc.test.ts
@@ -1,8 +1,6 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 import { normalizeChatType } from "./chat-type.js";
 
-const readLazyString = (value: unknown): string => String(value);
-
 describe("normalizeChatType", () => {
   it.each([
     { name: "normalizes direct", value: "direct", expected: "direct" },
@@ -28,43 +26,3 @@ describe("normalizeChatType", () => {
     });
   });
 });
-
-describe("WA_WEB_AUTH_DIR", () => {
-  afterEach(() => {
-    vi.doUnmock("../plugins/runtime/runtime-web-channel-plugin.js");
-  });
-
-  it("resolves lazily and caches across the legacy and channels/web entrypoints", async () => {
-    const resolveWebChannelAuthDir = vi.fn(() => "/tmp/openclaw-whatsapp-auth");
-
-    vi.resetModules();
-    vi.doMock("../plugins/runtime/runtime-web-channel-plugin.js", () => ({
-      createWebChannelSocket: vi.fn(),
-      extractMediaPlaceholder: vi.fn(),
-      extractText: vi.fn(),
-      formatError: vi.fn(),
-      getStatusCode: vi.fn(),
-      logWebSelfId: vi.fn(),
-      loginWeb: vi.fn(),
-      logoutWeb: vi.fn(),
-      monitorWebChannel: vi.fn(),
-      monitorWebInbox: vi.fn(),
-      pickWebChannel: vi.fn(),
-      resolveHeartbeatRecipients: vi.fn(),
-      resolveWebChannelAuthDir,
-      runWebHeartbeatOnce: vi.fn(),
-      sendWebChannelMessage: vi.fn(),
-      sendWebChannelReaction: vi.fn(),
-      waitForWebChannelConnection: vi.fn(),
-      webAuthExists: vi.fn(),
-    }));
-
-    const channelWeb = await import("../channel-web.js");
-    const webEntry = await import("./web/index.js");
-
-    expect(resolveWebChannelAuthDir).not.toHaveBeenCalled();
-    expect(readLazyString(channelWeb.WA_WEB_AUTH_DIR)).toBe("/tmp/openclaw-whatsapp-auth");
-    expect(readLazyString(webEntry.WA_WEB_AUTH_DIR)).toBe("/tmp/openclaw-whatsapp-auth");
-    expect(resolveWebChannelAuthDir).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/src/channels/web/index.ts b/src/channels/web/index.ts
deleted file mode 100644
index c75a5f39440..00000000000
--- a/src/channels/web/index.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/* istanbul ignore file */
-export {
-  createWaSocket,
-  loginWeb,
-  logWebSelfId,
-  monitorWebChannel,
-  monitorWebInbox,
-  pickWebChannel,
-  sendMessageWhatsApp,
-  WA_WEB_AUTH_DIR,
-  waitForWaConnection,
-  webAuthExists,
-} from "../../channel-web.js";
diff --git a/src/commands/onboard-channels.e2e.test.ts b/src/commands/onboard-channels.e2e.test.ts
index 2ca1d588d0b..fa5c610bdef 100644
--- a/src/commands/onboard-channels.e2e.test.ts
+++ b/src/commands/onboard-channels.e2e.test.ts
@@ -438,10 +438,6 @@ vi.mock("node:fs/promises", () => ({
   },
 }));
 
-vi.mock("../channel-web.js", () => ({
-  loginWeb: vi.fn(async () => {}),
-}));
-
 vi.mock("../channels/plugins/catalog.js", async () => {
   const actual = await vi.importActual<typeof import("../channels/plugins/catalog.js")>(
     "../channels/plugins/catalog.js",
diff --git a/src/gateway/test-helpers.mocks.ts b/src/gateway/test-helpers.mocks.ts
index f2668c328d6..641adc90b65 100644
--- a/src/gateway/test-helpers.mocks.ts
+++ b/src/gateway/test-helpers.mocks.ts
@@ -260,16 +260,6 @@ vi.mock("../commands/health.js", () => ({
 vi.mock("../commands/status.js", () => ({
   getStatusSummary: vi.fn().mockResolvedValue({ ok: true }),
 }));
-vi.mock("../channels/web/index.js", async () => {
-  const actual = await vi.importActual<typeof import("../channels/web/index.js")>(
-    "../channels/web/index.js",
-  );
-  return {
-    ...actual,
-    sendMessageWhatsApp: (...args: unknown[]) =>
-      (gatewayTestHoisted.sendWhatsAppMock as (...args: unknown[]) => unknown)(...args),
-  };
-});
 vi.mock("../commands/agent.js", () => ({
   agentCommand,
   agentCommandFromIngress: agentCommand,
diff --git a/src/infra/net/proxy/index.ts b/src/infra/net/proxy/index.ts
deleted file mode 100644
index 05ca2220276..00000000000
--- a/src/infra/net/proxy/index.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Network proxy module — public API surface.
- *
- * This module routes OpenClaw process HTTP and WebSocket traffic through an
- * operator-managed filtering forward proxy. The proxy must enforce
- * destination filtering at connect time; OpenClaw only owns process-wide
- * routing into that proxy.
- *
- * Integration:
- *   1. Call startProxy(config?.proxy) early in protected daemon/CLI startup.
- *   2. Subsequent normal HTTP and WebSocket egress routes through the
- *      configured operator proxy.
- *   3. On shutdown, call stopProxy(handle).
- *
- * Fail-closed behavior:
- *   If proxy.enabled=true but no valid proxy URL is configured, or activation
- *   fails, protected commands must fail startup instead of falling back to
- *   direct network access.
- */
-
-export { startProxy, stopProxy } from "./proxy-lifecycle.js";
-export type { ProxyHandle } from "./proxy-lifecycle.js";
-
-export { ProxyConfigSchema } from "../../../config/zod-schema.proxy.js";
-export type { ProxyConfig } from "../../../config/zod-schema.proxy.js";
diff --git a/test/vitest/vitest.shared.config.ts b/test/vitest/vitest.shared.config.ts
index a934a171795..559ed31e3d4 100644
--- a/test/vitest/vitest.shared.config.ts
+++ b/test/vitest/vitest.shared.config.ts
@@ -317,7 +317,6 @@ export const sharedVitestConfig = {
         "src/entry.ts",
         "src/index.ts",
         "src/runtime.ts",
-        "src/channel-web.ts",
         "src/logging.ts",
         "src/cli/**",
         "src/commands/**",
@@ -363,7 +362,6 @@ export const sharedVitestConfig = {
         "src/tui/**",
         "src/wizard/**",
         "src/browser/**",
-        "src/channels/web/**",
         "src/webchat/**",
         "src/gateway/server.ts",
         "src/gateway/client.ts",