Clarify managed proxy IP stability is per-session, not across sessions (#368)

* clarify managed proxy IP stability is per-session, not across sessions

Managed ISP/datacenter proxies are stable within a session but do not
guarantee the same egress IP across sessions. For destinations that need
a single static IP across every session — IP allowlists, managed-auth
connections whose health checks and reauths must look like the same
client — point a custom (BYO) proxy at infrastructure you control.

* collapse cross-session IP caveat to a link to overview

per-proxy pages now state only the per-session stability fact and link
to proxies/overview for the cross-session caveat, so the detailed
explanation lives in one place.

Author: masnwilliams

auth/configuration.mdx

@@ -66,9 +66,9 @@ Pin the auth flow to a specific [proxy](/proxies/overview) so logins, health che
 
 How stable the exit IP is depends on the proxy type:
 
-- **[ISP](/proxies/isp)** and **[datacenter](/proxies/datacenter)** proxies provide a static exit IP that stays consistent across all connections.
+- **[ISP](/proxies/isp)** and **[datacenter](/proxies/datacenter)** proxies provide a stable exit IP within a single session, but Kernel does not guarantee the same IP across sessions. Sites with adaptive auth that trigger a step-up challenge (one-time code, device verification) when the client IP changes may flag the IP shift between the initial login and a subsequent health check or reauth.
 - **[Residential](/proxies/residential)** proxies rotate IPs per connection — use them when you need legitimacy from a real ISP pool but can tolerate IP changes.
-- **[Custom (BYO)](/proxies/custom)** proxies route through whatever you point them at, so this is the right pick if you need a truly static IP under your own control (e.g. an allowlisted egress your security team owns).
+- **[Custom (BYO)](/proxies/custom)** proxies route through whatever you point them at, so this is the right pick if you need a truly static IP that persists across the initial login and every subsequent health check and reauth (e.g. an allowlisted egress your security team owns).
 
 Create a proxy first, then attach it to the connection:
 

proxies/datacenter.mdx

@@ -6,7 +6,9 @@ Datacenter proxies use IP addresses assigned from datacenter servers to route yo
 
 ## IP Rotation Behavior
 
-Datacenter proxies provide a **static exit IP** — the same IP address is used for all connections throughout the lifetime of the proxy. Every tab, request, and reconnection within a browser session exits through the same IP.
+Datacenter proxies provide a **stable exit IP within a single browser session** — every tab, request, and reconnection inside that session exits through the same IP, and it does not rotate mid-session (unlike residential).
+
+For cross-session IP stability (e.g. IP allowlists or [managed auth](/auth/overview) health checks), see [IP rotation behavior across proxy types](/proxies/overview).
 
 ## Configuration
 

proxies/isp.mdx

@@ -6,7 +6,9 @@ ISP (Internet Service Provider) proxies combine the speed of datacenter proxies
 
 ## IP Rotation Behavior
 
-ISP proxies provide a **static exit IP** — the same IP address is used for all connections throughout the lifetime of the proxy. Every tab, request, and reconnection within a browser session exits through the same IP. This makes ISP proxies ideal for session-based workflows, login flows, and any use case where a consistent IP is important.
+ISP proxies provide a **stable exit IP within a single browser session** — every tab, request, and reconnection inside that session exits through the same IP, and it does not rotate mid-session (unlike residential).
+
+For cross-session IP stability (e.g. IP allowlists or [managed auth](/auth/overview) health checks), see [IP rotation behavior across proxy types](/proxies/overview).
 
 ## Configuration
 

proxies/overview.mdx

@@ -16,7 +16,9 @@ Kernel supports four types of proxies:
 Datacenter has the fastest speed, while residential is least detectable. ISP is a balance between the two options, with less-flexible geotargeting. Kernel recommends to use the first option in the list that works for your use case.
 
 <Info>
-Datacenter and ISP proxies provide a **stable exit IP** that stays consistent across all connections. Residential proxies use **rotating exit IPs** that may change per connection — see [Residential Proxies](/proxies/residential#ip-rotation-behavior) for details.
+Datacenter and ISP proxies provide a **stable exit IP within a single browser session** — the IP does not rotate mid-session. Across separate sessions, however, Kernel does not guarantee the same exit IP. If you need a truly static IP that persists across every session (for example, an IP allowlist or a [managed auth](/auth/overview) connection whose health checks must egress from a single IP), use a [custom (BYO) proxy](/proxies/custom) pointed at infrastructure you control.
+
+Residential proxies use **rotating exit IPs** that may change per connection — see [Residential Proxies](/proxies/residential#ip-rotation-behavior) for details.
 </Info>
 
 ## Create a proxy