diff --git a/stacks/esphome/README.md b/stacks/esphome/README.md
index 9c43f97..603baf5 100644
--- a/stacks/esphome/README.md
+++ b/stacks/esphome/README.md
@@ -21,9 +21,18 @@ exclusion list). It is created on the host once, from the vault.
 ## Remote build is off
 
 Device Builder 1.0.0 ships remote-build **on by default** and it binds
-`0.0.0.0:6055` with mDNS advertisement. Disabled 2026-09-14 via the dashboard's
-own `/ws` API — `remote_build/set_settings {"enabled": false}` — persisted at
-`_remote_build.enabled` in `/config/.device-builder.json`.
+`0.0.0.0:6055`. Disabled 2026-09-14 via the dashboard's own `/ws` API —
+`remote_build/set_settings {"enabled": false}` — persisted at
+`_remote_build.enabled` in `/config/.device-builder.json`. Verified by `ss`
+(6055 absent) and by the absence of a peer-link "site listening" line on the
+current boot.
+
+⚠ **The dashboard is still discoverable over mDNS**, and that is a different,
+milder thing than what was closed. `helpers.dashboard_advertise` announces
+`_esphomebuilder._tcp.local.` pointing at **6052**, the auth-gated dashboard,
+independent of remote-build. It leaks existence, address, dashboard id, Device
+Builder + ESPHome versions and hostname — LAN version fingerprinting, not
+reachability into a firmware-writing subsystem. Left alone deliberately.
 
 ⚠ **There are two switches and only one closes the port.**
 `remote_build/set_offloader_settings {remote_builds_enabled}` is the *outbound*
diff --git a/stacks/esphome/compose.yaml b/stacks/esphome/compose.yaml
index 3e2ef03..25f83a0 100644
--- a/stacks/esphome/compose.yaml
+++ b/stacks/esphome/compose.yaml
@@ -52,7 +52,17 @@ services:
       # RESOLVED 2026-09-14: remote-build is now genuinely OFF —
       # `remote_build/set_settings {enabled: false}` over the dashboard's /ws
       # API, persisted at `_remote_build.enabled` in /config/.device-builder.json.
-      # Verified across a restart: no listener, no mDNS advertisement.
+      # Verified across a restart: 6055 absent from `ss`, and no peer-link
+      # "site listening" line on the current boot.
+      #
+      # ⚠ The dashboard is STILL discoverable over mDNS and that is a separate,
+      # milder thing. `helpers.dashboard_advertise` announces
+      # `_esphomebuilder._tcp.local.` pointing at 6052 — the auth-gated
+      # dashboard — independent of remote-build. It leaks existence, address,
+      # dashboard id, Device Builder + ESPHome versions and hostname. Version
+      # fingerprinting on the LAN, not reachability into the build subsystem.
+      # An earlier revision of this comment claimed mDNS was gone; it was not,
+      # and the claim came from a log grep rather than from the network.
       #
       # ⚠ Two switches, and only one of them closes the port. The obvious
       # candidate — `remote_build/set_offloader_settings {remote_builds_enabled}`