diff --git a/src/board/nl_board.c b/src/board/nl_board.c
index a0140a1..f061612 100644
--- a/src/board/nl_board.c
+++ b/src/board/nl_board.c
@@ -27,7 +27,8 @@ const nl_board_t nl_boards[] = {
      {NONE, NONE, NONE, CH(2, NL_PB(16)), CH(4, NL_PB(8))}, NO_SM},
     {"gu10_cw", "Klyqa GU10 CW/WW", NL_DRV_PWM, false, 2500, 5000, 600,
      {NONE, NONE, NONE, CH(2, NL_PB(16)), CH(4, NL_PB(8))}, NO_SM},
-    /* G95: pin assignment still to be verified on a series bulb (old note: PB16=WW, PB15=CW). */
+    /* G95: current table: CW=PB13, WW=PB15 (new assignment); old bulbs may use
+     * PB16=WW, PB15=CW - verify on a series bulb. */
     {"g95_cw", "Klyqa G95 Vintage CW/WW", NL_DRV_PWM, false, 2500, 5000, 600,
      {NONE, NONE, NONE, CH(1, NL_PB(13)), CH(3, NL_PB(15))}, NO_SM},
 };
diff --git a/src/config/nl_flash_w600.c b/src/config/nl_flash_w600.c
index 453ff02..ef0a79e 100644
--- a/src/config/nl_flash_w600.c
+++ b/src/config/nl_flash_w600.c
@@ -5,12 +5,19 @@
 #include "config/nl_flash.h"
 
 /*
- * The ninlight flash region lies above FLASH_1M_END_ADDR, where the SDK routes
- * tls_fls_read/write/erase to the external SPI flash path without taking its own
- * fls_lock (see sdk/Platform/Drivers/internalflash/wm_internal_fls.c). The app task
+ * The ninlight flash region lies above FLASH_1M_END_ADDR, where the SDK's
+ * tls_fls_read/write/erase switch the flash pins (CS/CK/DI/DO ioclose/open, see the
+ * tls_spifls_*_switch() calls around the >1 MB branch in
+ * sdk/Platform/Drivers/internalflash/wm_internal_fls.c) to reach the external SPI
+ * flash - and that pin switching is not serialised by the SDK itself. The app task
  * (periodic nl_state_log_append) and the console task (nl_app_save_settings,
  * nl_app_factory_reset) can therefore issue concurrent SPI transactions and corrupt
- * each other. Serialise all flash accesses with our own mutex.
+ * each other. Serialise all of *ninlight's own* flash accesses with our own mutex.
+ *
+ * This mutex only covers ninlight's own tasks. Other SDK-internal users of the
+ * tls_fls_* / tls_spifls_* functions in the same >1 MB region (e.g. the params
+ * store, fwup) are not serialised against us or each other by this lock - tracked
+ * for plan 2.
  *
  * The mutex is created once in nl_flash_init(), called as the very first statement
  * of app_task() before any other task can touch flash - not lazily from inside a
@@ -70,6 +77,9 @@ int nl_flash_erase_sector(uint32_t addr)
 
 uint32_t nl_flash_region_base(void)
 {
-    /* The first user sector is TLS_FLASH_PARAM_DEFAULT (SDK), ninlight starts one sector later. */
+    /* TLS_FLASH_PARAM_DEFAULT is set by the SDK to the same address as USER_ADDR_START
+     * (see sdk/Platform/Common/fwup/wm_fwup.c) - i.e. the first user sector doubles as
+     * the SDK's own parameter-store sector. ninlight must not touch that sector, so its
+     * region starts one sector after USER_ADDR_START. */
     return USER_ADDR_START + NL_FLASH_SECTOR_SIZE;
 }