diff --git a/.changes/playback-stalker-stream-credentials.md b/.changes/playback-stalker-stream-credentials.md
index 85159ebd5..2519cb4cc 100644
--- a/.changes/playback-stalker-stream-credentials.md
+++ b/.changes/playback-stalker-stream-credentials.md
@@ -7,6 +7,7 @@ issues: [849, 910, 732]
 Stalker portal streams that require the portal session now play in the
 built-in players (HTML5, Video.js, ArtPlayer), not only in VLC/MPV: the
 player's own requests carry the portal cookie and token, scoped to that
-stream and cleared when playback ends. VOD, series and radio streams get the
-same portal headers live TV already had, including on same-host streaming
-ports.
+stream and dropped when the player closes or the channel changes. VOD,
+series and radio streams get the same portal headers live TV already had,
+including on same-host streaming ports and when opened from Favorites or
+Recently Viewed.
diff --git a/docs/architecture/electron-security.md b/docs/architecture/electron-security.md
index 7a46a78c1..060bdcc0c 100644
--- a/docs/architecture/electron-security.md
+++ b/docs/architecture/electron-security.md
@@ -171,8 +171,13 @@ deliberately stricter than the general scope:
   also cover, and never to third-party hosts an HLS manifest may point at
 - they live only in the in-memory override: never in the session cookie jar,
   never on disk, so they cannot outlive the app process
-- they are dropped whenever the scoped override is replaced (channel change)
-  or cleared (playback end, `WebPlayerViewComponent` destroy)
+- they are dropped whenever the scoped override is replaced (channel or
+  source change) or released — player close/destroy, a radio host's close, or
+  a new selection that mounts no player surface. The media `ended` event
+  deliberately does **not** clear the override: the mounted player still owns
+  the session (replay, or a seek into an unbuffered range, must keep working
+  against a gated stream), and the credentials only ever travel to the exact
+  origin that issued them; every dismount path above releases them
 
 The header-injection design was chosen over `session.cookies.set()`
 deliberately: jar cookies only attach to credentialed requests, which would