diff --git a/src/server.tsx b/src/server.tsx
index b44c1c91..7957e019 100644
--- a/src/server.tsx
+++ b/src/server.tsx
@@ -15,7 +15,7 @@ import { chatWebsocket } from './servers/api/chat/websocket';
 import { taskRunnerWebsocket } from './servers/api/tasks/task-executor';
 import { pipelineWebsocket } from './servers/api/tasks/pipeline-executor';
 import { cliampWebsocket, cliampAudioWebsocket } from './servers/api/cliamp/relay';
-import { desktopWebsocket } from './servers/api/desktop/websocket';
+// import { desktopWebsocket } from './servers/api/desktop/websocket';
 // import { vaultWebsocket, upgradeVaultWs } from './servers/api/vault/websocket';
 import officerWeb from './apps/officer-web/index.gen.html';
 // import { startBrowserRelay } from './servers/api/browser/relay';  // switched off — see below
@@ -41,10 +41,10 @@ type WSData = {
     | 'chat'
     | 'task-runner'
     | 'pipeline'
-    // | 'cliamp'
-    // | 'cliamp-audio'
+    | 'cliamp'
+    | 'cliamp-audio'
     | 'desktop'
-    // | 'vault'
+    | 'vault'
     | 'sidecar';
   sessionId?: string;
   cwd?: string;
@@ -137,7 +137,7 @@ const handlers: Record<string, any> = {
   pipeline: pipelineWebsocket,
   // cliamp: cliampWebsocket,
   // 'cliamp-audio': cliampAudioWebsocket,
-  desktop: desktopWebsocket,
+  // desktop: desktopWebsocket,
   // vault: vaultWebsocket,
   sidecar: sidecarWebsocket,
 };
@@ -295,7 +295,7 @@ const server = serve({
     '/api/chat/ws': (req, server) => upgradeWs(req, server, 'chat'),
     '/api/cliamp/ws': (req, server) => upgradeWs(req, server, 'cliamp'),
     '/api/cliamp/audio/ws': (req, server) => upgradeWs(req, server, 'cliamp-audio'),
-    '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
+    // '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
     // CalDAV/CardDAV. These live OUTSIDE /api because DAV clients are given a bare domain and probe
     // fixed, spec-defined paths — `/.well-known/caldav` unauthenticated, before they hold any
     // credential at all. They need naming explicitly here or the `/*` SPA fallback below swallows them
diff --git a/src/servers/capabilities/registry.ts b/src/servers/capabilities/registry.ts
index 3e91b364..b33142da 100644
--- a/src/servers/capabilities/registry.ts
+++ b/src/servers/capabilities/registry.ts
@@ -334,8 +334,9 @@ export const CAPABILITIES: Capability[] = [
     label: 'Desktop',
     description: "The server owner's physical screen",
     kind: 'execution',
-    api: ['/desktop'],
-    ws: ['desktop'],
+    // api: ['/desktop'],  // plugin — switched off 2026-08-13
+    // ws: ['desktop'],
+    api: [],
     routes: ['/desktop'],
   },
   // `/browser` — the Chrome-extension relay — is unmounted as of 2026-08-13 and dropped from this claim,
diff --git a/src/servers/hono.ts b/src/servers/hono.ts
index df6a5d50..720935a9 100644
--- a/src/servers/hono.ts
+++ b/src/servers/hono.ts
@@ -52,7 +52,7 @@ import { queueRouter } from './api/queue/queue';
 // The browser relay is switched off — see server.tsx. Restoring this mount means restoring the
 // registry's claim on '/browser' in the same commit, or assertCapabilityTotality refuses to boot.
 // import { browserRouter } from './api/browser/router';
-import { desktopRouter } from './api/desktop/rest';
+// import { desktopRouter } from './api/desktop/rest';
 import { bugReportRouter } from './api/bug-report/bug-report';
 import { agentStatusRouter } from './api/agent-status/router';
 import { chatRouter } from './api/chat/chat';
@@ -227,7 +227,7 @@ const PROTECTED_MOUNTS: [prefix: string, router: ReturnType<typeof createRouter>
   ['/chat', chatRouter],
   ['/pipeline-jobs', pipelineJobsRouter],
   ['/jobs', pipelineJobsRouter], // unified jobs API (script + pipeline); /pipeline-jobs kept for the existing UI
-  ['/desktop', desktopRouter],
+  // ['/desktop', desktopRouter],  // plugin — switched off 2026-08-13
 ];
 
 for (const [prefix, router] of PROTECTED_MOUNTS) protectedRouter.route(prefix, router);