diff --git a/docs/adr/2026_08_p2p_transport_compatibility.md b/docs/adr/2026_08_p2p_transport_compatibility.md
index 5eb38be0..48ef540b 100644
--- a/docs/adr/2026_08_p2p_transport_compatibility.md
+++ b/docs/adr/2026_08_p2p_transport_compatibility.md
@@ -46,7 +46,7 @@ LiveSync will expose a separate `Connection path` choice:
 - `Automatic` retains normal ICE selection and is the default.
 - `TURN relay only` supplies `iceTransportPolicy: 'relay'` and prevents direct or server-reflexive candidates from being selected.
 
-`TURN relay only` is enabled only when at least one syntactically valid `turn:` or `turns:` URL is configured. If the last valid TURN URL is removed while relay-only mode is selected, the dialogue restores `Automatic` and displays a concise explanation.
+`TURN relay only` is enabled when a managed TURN provider is selected or at least one syntactically valid manual `turn:` or `turns:` URL is configured. If neither is available while relay-only mode is selected, the dialogue restores `Automatic` and displays a concise explanation. Selecting a managed provider does not itself force relay use; `Automatic` retains normal ICE selection.
 
 The route policy is an ordinary P2P profile property. It is retained in P2P connection strings and encrypted Setup URIs so that an imported compatibility profile has reproducible transport behaviour.
 
diff --git a/docs/design_docs/renewable_turn_credentials.md b/docs/design_docs/renewable_turn_credentials.md
index 4398e9d4..d9f2c082 100644
--- a/docs/design_docs/renewable_turn_credentials.md
+++ b/docs/design_docs/renewable_turn_credentials.md
@@ -1,6 +1,6 @@
 ---
 date: 2026-09-16
-commonlib-version: "0.1.25-dev.turn-credentials.6"
+commonlib-version: "0.1.25"
 self-hosted-livesync-version: "1.0.28"
 status: unreleased
 ---
@@ -65,6 +65,10 @@ Its HTTP request must settle on cancellation and has a bounded deadline. The roo
 owner also stops waiting for preparation when the connection request is retired.
 An explicitly managed configuration requires a preparation hook and usable ICE
 credentials; acquisition failure does not select a fallback provider or route.
+Managed credential acquisition is independent of the connection path. `Automatic`
+retains normal ICE selection, including direct candidates; only `TURN relay only`
+forces relay use. Acquisition must still succeed before opening a managed room
+when `Automatic` is selected.
 
 ## Room reuse and expiry
 
@@ -137,8 +141,10 @@ endpoint, SDK, credential broker, or renewal interval setting.
 
 The provider function uses Cloudflare's
 [credential-generation endpoint](https://developers.cloudflare.com/realtime/turn/generate-credentials/)
-and converts its response into ICE servers. The implementation requests a 24-hour
-lifetime and derives local expiry from the clock before the request starts.
+and converts its response into ICE servers. The implementation requests a fixed
+24-hour lifetime and derives local expiry from the clock before the request starts.
+This lifetime applies to the issued TURN credentials, not the provider API token.
+There is currently no setting to change it.
 
 The HTTP boundary uses the injected standard fetch adapter with cancellation,
 a 15-second deadline, refused redirects, omitted cookies, and disabled caching.