diff --git a/docs/dashy-soc-board.md b/docs/dashy-soc-board.md
index 35027d7..cdbb652 100644
--- a/docs/dashy-soc-board.md
+++ b/docs/dashy-soc-board.md
@@ -16,6 +16,17 @@ This board didn't start from nothing — it absorbed several formerly-standalone
 | Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
 | Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node |
 
+The fourteen, enumerated directly from the function's own upstream calls rather than counted by hand:
+
+```
+$ grep -oE 'https?://[a-zA-Z0-9._-]+\.[service-to-service zone]' soc_board_func.js | sort -u
+authentik, hyper1 (Proxmox API), kestra, loki, n8n, pbs, prometheus,
+technitium, vault, wazuh-api, wazuh-indexer      → 11 distinct hosts
++ slack.com                                       → 12
++ fleetAudit (Node-RED global context, no HTTP call — see table above) → 13
++ pfSense (own dedicated collector, folded into the Prometheus query)  → 14
+```
+
 This is the real function, not a claimed size — one single Node-RED function, not several smaller ones stitched together:
 
 ```