diff --git a/docs/APPLICATION.md b/docs/APPLICATION.md
index deafe9168..c5a2642e6 100644
--- a/docs/APPLICATION.md
+++ b/docs/APPLICATION.md
@@ -158,7 +158,7 @@ routing and regional caches. Request parameters cannot override these endpoints.
 Voice controls accept an action runner and a controller factory through
 `createVoiceCommands` (`./voice/commands`). The default Realtime controller owns
 microphone tracks, playback, push-to-talk, tool cancellation and radio handoff.
-Its backend supplies `requestToken({ tier, signal })` and
+Its backend supplies `requestToken({ tier, authMode, signal })` and
 `negotiate({ offerSdp, credential, signal })`. The Realtime-compatible adapter
 (`./voice/realtime-backend`) accepts separate token and connection transports
 and endpoints. Only the short-lived client secret reaches the SDP endpoint.
diff --git a/docs/VOICE-OWNERSHIP.md b/docs/VOICE-OWNERSHIP.md
index 98b6b0c5c..bb28eb3e9 100644
--- a/docs/VOICE-OWNERSHIP.md
+++ b/docs/VOICE-OWNERSHIP.md
@@ -26,8 +26,8 @@ The backend is replaceable per deployment: `realtimeController.js` accepts it as
 `backend` option and falls back to `createRealtimeBackend()`. Its two method
 signatures live with [application construction](APPLICATION.md); what belongs here
 is the ownership. The connection is the backend's only consumer in the application.
-The resolved credential is opaque to the connection and is handed to `negotiate`
-whole. Client-secret expiry is refused inside the backend, not by the connection.
+The connection reads credential metadata for diagnostics and cost accounting,
+then passes the complete credential unchanged to `negotiate`. Client-secret expiry is refused inside the backend, not by the connection.
 `realtimeOwners.test.mjs` drives whole sessions through a substitute that
 implements only those two methods.