diff --git a/apps/docs/personal-settings.mdx b/apps/docs/personal-settings.mdx
index 72a519eef..62b9b9440 100644
--- a/apps/docs/personal-settings.mdx
+++ b/apps/docs/personal-settings.mdx
@@ -65,11 +65,22 @@ Personal Settings also include app preferences such as:
   you can still collapse or expand individual thought messages
 - **Narration Mode** for a more streamlined task conversation view
 - **Therapist Mode** to explain which remembered fact informed a Session or task
+- **Home suggestions** under **Settings > Experimental** to suggest tasks from
+  your recent completed work
 - **How to work with me** for private personal instructions and conversational
   learning
 
 Most teammates only need profile, linked accounts, and theme settings.
 
+### Use Home suggestions
+
+**Home suggestions** is off by default. When you enable it and [Memory](/memory)
+is configured, Roomote uses your recent completed-task memories to generate
+personalized prompts in the Home composer. If no usable memories are available
+or suggestion generation fails, the composer falls back to its standard example
+prompts. Turning the setting off stops the Home page from reading memories for
+this feature.
+
 ### Understand Therapist Mode
 
 Therapist Mode is an opt-in disclosure setting. When a specific fact returned
diff --git a/apps/docs/session-secrets.mdx b/apps/docs/session-secrets.mdx
index baf2e9973..c6e7a15d4 100644
--- a/apps/docs/session-secrets.mdx
+++ b/apps/docs/session-secrets.mdx
@@ -4,15 +4,14 @@ description: "Approve a short-lived credential for read-only requests to one tru
 ---
 
 Session secrets let a Roomote agent make a narrow HTTP request without receiving
-the credential as a tool argument. This prototype is available from **Session
-secrets** in a Session's web header, to the Session's signed-in owner. It is not a
-general-purpose credential vault or a replacement for [integrations](/integrations).
+the credential as a tool argument. The Session's signed-in owner opens the secure
+approval link prepared by the agent. It is not a general-purpose credential vault
+or a replacement for [integrations](/integrations).
 
 ## Approve and use
 
 1. Tell the agent which service and read request you need, without including an
    API key. The agent prepares the access request and links to **Session secrets**.
-   You can also open it from the Session's web header.
 2. Select the prepared request if there is more than one. Review the service's
    exact HTTPS origin (the default port 443 is omitted; other ports are shown).
    The approval covers **all paths** on this origin, not one endpoint.
@@ -25,15 +24,15 @@ general-purpose credential vault or a replacement for [integrations](/integratio
    copy or send a reference. If notification is unavailable, the approval remains
    saved: ask the agent to check `list_session_secrets` and continue. Tell it the
    desired GET or HEAD path if you have not already done so.
-5. Open **Manage approved secrets** to inspect the header, prefix, and expiry,
-   or choose **Revoke** when finished. New requests are denied, and an in-flight
-   result is suppressed if revocation is detected before returning it. A request
-   already sent cannot be recalled from the upstream. Revoke the credential at
-   its issuer too if it may have been compromised.
+5. The approval expires automatically at the time prepared by the agent. The
+   approval dialog does not list or revoke saved approvals. To end access sooner,
+   revoke the credential at its issuer. A request already sent cannot be recalled
+   from the upstream.
 
-Only the bound Session owner can manage or use the approval. Other Session
-participants cannot use its reference. Closing the dialog, saving or revoking
-clears the entry form. Existing approvals expose metadata, not credential values.
+Only the bound Session owner can approve or use the request. Other Session
+participants cannot use its reference. Closing the dialog or saving clears the
+entry form. Approval metadata is available to the agent, but credential values
+are not.
 
 Approved access works in Fast and coding runs attached to that same Session.
 The API resolves the signed Fast conversation or persisted task-run attachment,
@@ -132,9 +131,10 @@ GET /repos/octocat/Hello-World, accept application/json.
 Report the status and repository full_name. Do not use another HTTP tool.
 ```
 
-Revoke the approval, then ask the agent to repeat the same tool call with the same
-reference. It should return `Secret request unavailable`, not fall back to a
-different credential or tool.
+After the approval expires or you revoke the credential at its issuer, do not ask
+the agent to repeat the request with that credential. The issuer-side revocation
+prevents the upstream from accepting it; Roomote does not provide a saved-approval
+management control in this prototype.
 
 For an echo check, use only a disposable made-up value with a public HTTPS echo
 endpoint you trust and operate. Approve its origin and request its header-echo