The '#18 render should be safe' call on the nss-mdns drop (5cc72cc) was wrong: it bricked the kiosk on trim-rpm-48dc3e1 (chromium hard-Requires nss-mdns, so the 2d remove cascaded chromium + its GUI stack out → 500 MB browserless image, flashing cursor). Fixed in2bc2daf(keep nss-mdns, mask avahi daemon; final build guard asserts the kiosk stack survived). Re-verified booting into the kiosk on the 820; container image measured 1.8 GiB → 755 MiB (~58%).