1 files changed, 5 insertions, 3 deletions

diff --git a/docs/TESTING.md b/docs/TESTING.md
index 6cac6fa..55f5422 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -15,19 +15,21 @@ shared global database. Each test owns its state.
 | `tests/client_ui.rs` | Help, history, completion, bet parsing, display width, cursor math. |
 | `tests/protocol.rs` | Newline buffering and timeout/error classification. |
 | `tests/server_core.rs` | Handler, bcrypt migration, SQL injection, transaction rollback, `plays` audit, sessions. |
+| `tests/server_setup.rs` | `--init` identity generation, PKCS#12 loadability, overwrite refusal. |
 | `tests/slots.rs` | Server slots payout rules and overflow handling. |
 | `tests/storage.rs` | Client/server SQLite storage helpers. |
 | `tests/tofu.rs` | SPKI fingerprint and TOFU decisions. |
 
-`tests/tofu.rs` shells out to `openssl`, so run it on a machine where the
-`openssl` CLI is available.
+`tests/tofu.rs` and `tests/server_setup.rs` shell out to `openssl`, so run them
+on a machine where the `openssl` CLI is available.
 
 ## Manual TUI checklist
 
 There is no CI. Run this on Linux and on a Windows VM before a release.
 Use an 80-column terminal because several output lines are width-sensitive.
 
-1. Start the server with a valid `identity.p12`, then start the client.
+1. Run `cargo run --bin server -- --init` once, then start the server with a
+   valid `identity.p12` and start the client.
 2. First contact prints three lines and the 64-character fingerprint does not
    wrap at 80 columns. `Connected to ...` shows a one-decimal ping.
 3. `register` / `login`: backspace removes one `*` per key, Esc cancels the