diff --git a/AGENTS.md b/AGENTS.md
index e5cedb9..2787f4b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,7 +33,7 @@ REST on `:8400`, browser UI on `:8405`. The UI serves only a setup page until yo
 run `gateway ui set-password`.
 
 ```bash
-npm test          # 500+ tests, ~7s
+npm test          # 469 tests, ~7s
 npm run build     # tsc, then copies the UI assets into dist
 ```
 
diff --git a/DECISIONS.md b/DECISIONS.md
index f832dde..cbf6fc1 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -5,6 +5,20 @@ Why things are the way they are. Newest first.
 Operational entries about the private deployment this was extracted from have
 been left out. What remains is the reasoning that shaped the code.
 
+## The README states the real test count
+
+The Testing section claimed "500+ tests". `npm test` reports 469.
+
+That is a bad claim to round up in this particular README, which spends most of
+its length being careful about what CipherGate is not: no HA, no dynamic
+secrets, no PKI or SSO and a pointer to Vault or OpenBao for anyone who needs
+them. It is also the cheapest claim in the file to check. A reader who runs one
+command, finds the number padded and then re-reads the disclaimers has been
+given a reason to discount the part that is actually worth trusting.
+
+The number is now exact, in README and AGENTS.md both. It will drift low as
+tests are added, which is the safe direction for it to drift.
+
 ## Never gate authentication on a raw URL string
 
 A pre-landing review of the browser UI found an authentication bypass that every
diff --git a/README.md b/README.md
index 8b06834..14ddb5d 100644
--- a/README.md
+++ b/README.md
@@ -184,7 +184,7 @@ it is the highest-value surface in the system.
 npm test
 ```
 
-500+ tests. They cover the encryption round-trip, consumer authorization, the
+469 tests. They cover the encryption round-trip, consumer authorization, the
 auth-bypass regression, the no-plaintext-in-any-response guarantee, and the
 partial-update property the UI depends on.