diff --git a/TESTING.md b/TESTING.md
index d216a73..bd7dc04 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -19,11 +19,13 @@ works correctly in production.
 ### Constraints
 
 - Tests hit real DNS infrastructure and require network access
-- Test duration depends on network conditions; timeout tuning keeps the suite
-  within the 60-second target
-- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms) plus
-  processing margin
-- Root server fan-out is limited to reduce parallel query load
+- Test duration depends on network conditions. `make test` must finish in under
+  60 seconds, the hard cap in `REPO_POLICIES.md`; under 20 seconds is the target
+- Each query to a nameserver has a 2-second timeout, and a query over UDP that
+  gets no reply is sent once more (`queryTimeoutDuration` and `maxRetries` in
+  `internal/resolver/iterative.go`)
+- In the walk to a name's nameservers, the servers of each zone are asked one at
+  a time in a random order, as the README's DNS Resolution Strategy describes
 - Live lookups that expect an answer go through `internal/livednstest`, which
   limits how many run at once in a test binary and retries a lookup that got
   none
diff --git a/TODO.md b/TODO.md
index 4fb2e39..f7b8c17 100644
--- a/TODO.md
+++ b/TODO.md
@@ -19,6 +19,10 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Completed Steps
 
+- 2026-10-15: `TESTING.md` Constraints give the resolver's 2-second query
+  timeout and second try, say a zone's servers are asked one at a time in a
+  random order, and give the 60-second cap and 20-second target for `make test`
+  (closes #289).
 - 2026-10-13: a hostname or a domain whose zone's nameservers all stop answering
   gets an NS Failure for each, then an NS Recovery (closes #284).
 - 2026-10-13: an IPv6 address is written in brackets before its port, as in