diff --git a/docs/TODO.md b/docs/TODO.md
index f96b7b4..9447b08 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1559,6 +1559,28 @@ now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + ply
 - **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
   "initramfs largest files" log line for the post-omit size + next targets.
 
+**[x] FIXED — the `nss-mdns` drop bricked the kiosk (regression found+fixed 2026-07-04):**
+the "render should be safe" call above (5cc72cc) was WRONG — it broke the kiosk, just
+not via i915. `trim-rpm-48dc3e1` booted to a **flashing cursor, no kiosk**, and the image
+was a suspicious **500 MB**. Root cause: the 2d `dnf remove -y nss-mdns` removed
+**chromium** as a *dependent package* — the EPEL `chromium` **hard-Requires `nss-mdns`**
+(Chromium uses `.local` mDNS hostnames for WebRTC ICE candidates) — then reaped chromium's
+orphaned GUI stack (avahi, at-spi2, atk, adwaita, chromium-common; ~49 pkgs, 523→472).
+With no browser, `kiosk-session` died at the `${BROWSER:?}` guard in 4 ms, before weston.
+The original commit checked what `nss-mdns` NEEDS (avahi) but not what NEEDS it (chromium).
+GPU/i915/firmware/plymouth were all healthy — a red herring. Fix (`2bc2daf`):
+- **Keep `nss-mdns` + avahi** (satisfy chromium's Requires); **mask the avahi daemon +
+  socket** instead — nss-mdns is only an NSS module, needs no listener, and :5353 was the
+  real attack-surface concern. ~1.5 MB kept.
+- **FINAL GUARD in 2d**: `rpm -q chromium chromium-common weston mesa-{dri-drivers,libEGL,libgbm}`
+  asserts the kiosk stack survived the whole pipeline, else **fail the build**. A missing
+  browser must brick the BUILD, never the fleet — catches any future remove-cascade /
+  oscap `package_*_removed` / autoremove. Look for `==> guard: kiosk stack intact` in CI.
+**RE-VERIFIED 2026-07-04 (`trim-rpm-2bc2daf`): boots into the kiosk on the 820; image 755 MiB.**
+
+**Measured end-to-end (2026-07-04, `trim-rpm-2bc2daf`): container artifact image
+1.8 GiB → 755 MiB (~58%, >1 GB off every host's per-boot NVMe/TCP read).**
+
 **Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
 kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
 candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),