diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a74301..b95facf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,6 +48,8 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
   workflow submission, prompt injection, polling, seed derivation, and image retrieval.
 - **Casting Constraint Coverage.** Added deterministic regression coverage proving casting filters invented voice IDs
   and avoids unnecessary duplicate assignments when distinct catalogue voices are available.
+- **4 GiB Container Validation.** Verified the current image serves the application under a hard 4 GiB cgroup limit
+  with no OOM kill; the probe recorded approximately 50.6 MiB idle memory and 0.09% CPU.
 - **STT Cancellation Safety.** Queued transcription cancels before consuming the single STT slot, and timed-out
   requests keep the device slot held until the underlying worker actually exits.
 - **Credential Boundary Review.** Provider credentials are now documented as server-only; only the explicitly
diff --git a/TODO.md b/TODO.md
index 06587f9..0fdf24c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -60,8 +60,9 @@ the first block before investing in architecture or polish.
 - [x] **M — Add explicit cache invalidation and eviction.** Fish.audio search responses, persisted synthesized
   audio, image-generation job mappings, and browser object URLs have bounded cleanup.
 - [ ] **M — Add constrained-device validation.** Test with Chrome CPU/memory throttling,
-  a 4 GB VM/container, and measure browser, Docker and temporary-disk usage. Automated browser emulation now proves
-  the 4 GB shared-pool cap; physical VM/container and resource measurements remain.
+  a 4 GB VM/container, and measure browser, Docker and temporary-disk usage. Automated browser emulation proves
+  the 4 GB shared-pool cap, and the current `1.23.3` image served successfully under a hard 4 GiB cgroup limit
+  without OOM; browser heap/DOM/audio and workload resource measurements remain.
 - [ ] **L — Add background jobs and bounded queues.** Image generation already has the full interactive job path,
   and transcription, voice design, and casting now have optional ID/status/cancel/timeout paths while preserving
   synchronous callers. Job metadata now persists in SQLite and marks interrupted work after restart; durable binary
@@ -197,7 +198,8 @@ the first block before investing in architecture or polish.
 - [x] Add explicit Docker memory limits; the web container defaults to `mem_limit: 8g` and `mem_reservation: 2g`, configurable per host.
 - [x] Limit upload sizes and clean converted upload intermediates; continue expanding endpoint-specific temporary-file and job limits.
 - [ ] Test with Chrome DevTools CPU/memory throttling.
-- [ ] Test in a VM or container limited to 4 GB RAM.
+- [x] Test the current image in a container limited to 4 GB RAM; the app served `/` with a 4 GiB cgroup limit,
+  ~50.6 MiB idle memory, 0.09% CPU, and no OOM kill.
 - [ ] Monitor browser-tab memory, JavaScript heap, DOM-node count, active audio blobs, Docker memory, and temporary disk usage.
 - [ ] Add a memory diagnostics page showing browser heap where supported, rendered rows, cache count/size, active jobs, server/container memory, and largest recent operations.
 
diff --git a/VERSION b/VERSION
index ac1df3f..27ddcc1 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.23.3
+1.23.4