diff --git a/docs/TODO.md b/docs/TODO.md
index 8ba4b02..1387cb1 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1018,6 +1018,15 @@ reachable step-ca, populate `serving/enrol-pki/`, and `ENROL_ADMIN_INSECURE=fals
 
 **STEP SIGNER VERIFIED end-to-end 2026-06-28** (broker → real step-ca → signed
 cert that chains to the fleet root; hostnqn derived from serial; EKU clientAuth).
+**Re-VERIFIED ON THE SERVING HOST 2026-07-02** against step-ca 0.30.2 via
+`verify-serving.sh` through the nginx `/enrol/` proxy: issuer = Fleet Bench CA
+Intermediate, cert validity exactly 720h (confirms the maxTLSCertDuration claim
+raise took effect), EKU clientAuth, `enrol` provisioner extension present,
+hostnqn = cert serial. Bring-up gotchas hit + fixed (all in the commits): the CA
+wouldn't init (compose used `_PASSWORD_FILE` for a nonexistent file → use
+`_PASSWORD`); Docker auto-created `./pki` root-owned (bootstrap self-heals perms +
+pre-create the bind-mount dirs); the CLI couldn't resolve `ca.fleet.lab` on the
+serving host (connect via `localhost`, which is in the CA SAN).
 Verification found + fixed two things the `mock` path had hidden:
 - **BUG FIXED (`signer.go`):** `--not-after` was passed to `step ca token`
   (validity capped ~1h → "token validity too long") instead of `step ca sign`.