diff --git a/README.md b/README.md
index 705e9e6..9b58abb 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Project Template
 
 A working documentation skeleton, the tracker convention that goes with it, and
-twenty scripts that enforce both. Copy `docs/` into a new project, replace the
+the scripts that enforce both. Copy `docs/` into a new project, replace the
 angle-bracket placeholders, delete the paragraphs that do not apply — then
 create the labels and the first milestone in the repository's issue tracker.
 
@@ -248,7 +248,10 @@ on day one:
 | `release.sh` | version bump, guards, build, verify, push. Refuses to build on a half-run test suite or a malformed public origin — both of which had shipped in every release of the project this came from. |
 | `verify.sh` | every check the project has, in one command, with one table saying which passed, which failed, and which did not run |
 | `check-env.sh` | which variables are set and which are missing, before anything reads them |
-| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down |
+| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down — and `--built`, the compiled bundle, which is the artifact users actually receive and the one the repository scan never sees |
+| `backup.sh` `restore-check.sh` | a dump verified before it is trusted, and the restore that proves it is a backup rather than a file. The second exists because the first says so: *a backup nobody has restored is a guess.* |
+| `preflight.sh` | headers, TLS, and — behind `--auth` — login rate limiting and account enumeration, against a live URL. Refuses any host but its configured origin. |
+| `controls.sh` | which operational controls this project has, each row saying whether that is measured, declared, not applicable, or simply unknown |
 | `prove-guard.sh` | breaks what a guard protects and requires the guard to go red, then restores the file from a trap. `GUARDS.md` §1 as a command — the rule that a guard nobody has seen fail is not yet evidence. |
 | `doc-claims.sh` | every file a document names must exist — and `--covers`, whether every file that exists is named. The second is the one that catches a list quietly missing rows. |
 | `duplication.py` `dead-code.py` | code that exists twice; exports nothing imports and assets nothing renders |