diff --git a/dev/connectors/README.md b/dev/connectors/README.md
index c5c27b6..5dcf97f 100644
--- a/dev/connectors/README.md
+++ b/dev/connectors/README.md
@@ -139,12 +139,20 @@ cd /mnt/DATA/git/govoplan-files/dev/connectors
 ```
 
 The script reads `.env` from this directory when present and seeds tiny WebDAV,
-Nextcloud, SMB, and MinIO fixtures. WebDAV and Nextcloud are browsed and imported
-through the pinned connector transport. SMB and S3 product access deliberately
-fails closed until their SDK transports support peer pinning, so their fixtures
-are retained for transport development and reported as expected optional skips.
-The `--require-smb` and `--require-s3` switches are useful only while developing
-that transport support and currently make the smoke check fail by design.
+Nextcloud, SMB, and MinIO fixtures. WebDAV and Nextcloud use the pinned HTTP
+transport. SMB uses the Files-owned `smbprotocol` connection cache so initial
+connections, reconnects, aliases, and DFS referral targets are pinned. S3 uses
+pinned botocore pools for retries, redirects, discovery, and aliases. Every
+socket destination is revalidated when it opens, including when private-network
+access is enabled for these local fixtures.
+
+SMB and S3 are optional by default: a missing provider dependency or unavailable
+target is reported as `SKIP`. Use `--require-smb` and `--require-s3` to turn such
+provider failures into a non-zero smoke result during deployment validation. The
+bundled Samba service is a deterministic single-share target, not a DFS
+topology. Referral and reconnect behavior is covered by the transport contract
+tests; deployments using DFS must additionally run the required SMB smoke check
+against their actual referral topology and record the resolved peers.
 
 SMB smoke checks need the optional Python dependency in the environment running
 the script:
diff --git a/docs/FILES_HANDBOOK.md b/docs/FILES_HANDBOOK.md
index 2116940..7d7ff19 100644
--- a/docs/FILES_HANDBOOK.md
+++ b/docs/FILES_HANDBOOK.md
@@ -1034,6 +1034,16 @@ attempt. Botocore retries, redirects, endpoint discovery, and aliases, plus SMB
 reconnects and DFS referrals, must pass through the pinned factories. A changed
 or unsupported SDK seam must fail before a usable client/session is returned.
 
+SMB deployments use `smbprotocol>=1.13`; signing is required by default and SMB
+encryption can be required per connector profile. Private targets additionally
+require the governed private-network setting, but that setting never bypasses
+per-connection address validation. The bundled development Samba target checks
+live initial browse/import behavior with `smoke.py --require-smb`. It is a
+single-share fixture rather than a DFS topology: reconnect and referral handling
+is enforced by the transport contract suite, while operators using DFS must run
+the same required smoke check against their institutional referral topology and
+record the initial and referred peers as deployment evidence.
+
 ### Imported evidence and sync
 
 Given a permitted WebDAV file is imported, its managed response and audit event