diff --git a/kernel/src/Fs/ProtectedPaths.cpp b/kernel/src/Fs/ProtectedPaths.cpp
index 0e9a99a..e448f2a 100644
--- a/kernel/src/Fs/ProtectedPaths.cpp
+++ b/kernel/src/Fs/ProtectedPaths.cpp
@@ -2,9 +2,6 @@
     * ProtectedPaths.cpp
     * Capability required to modify paths on the booted system volume
     * Copyright (c) 2026 Daniel Hammer
-    *
-    * Split out of Ipc.cpp: this is filesystem security policy, not IPC. It
-    * lived there only because OpenFileHandleForSlot was its first caller.
 */
 
 #include "ProtectedPaths.hpp"
@@ -15,22 +12,9 @@
 namespace Fs {
 
     // ==== Protected system paths ====
-    // The capability required to modify (create, write, delete or rename) a
-    // path. The kernel only ever enumerates paths here; it never parses a
-    // policy file. Userspace grant policy lives in 0:/config/capabilities.toml
-    // and can only ever narrow what the kernel already delegated, so no input
-    // to that file can produce authority this table does not already allow.
-    //
-    // Rules apply ONLY to the system volume. Drive 0 is always the boot
-    // ramdisk (Fs/Boot.cpp registers it unconditionally); every other drive is
-    // a partition discovered at probe time, in probe order. A user data disk
-    // that happens to contain an "apps" or "config" directory must not inherit
-    // system protection, and an installed system's files on another volume are
-    // inert data until that disk is booted -- at which point its contents are
-    // themselves the drive-0 ramdisk.
-    // Anything the kernel itself reads belongs here:
-    // guarding only the syscall leaves the file as an unguarded second path to
-    // the same state (bluetooth.toml feeds the BD_ADDR override at bring-up).
+
+    // Rules apply ONLY to the system volume (drive 0).
+
     struct ProtectedPath {
         const char* pattern;    // drive-relative, leading '/'
         bool        prefix;     // also match everything beneath the pattern
@@ -38,29 +22,15 @@ namespace Fs {
     };
 
     static constexpr ProtectedPath g_protectedPaths[] = {
-        // Authentication, first-boot administrator creation, trusted service
-        // activation and capability grants. Readable by anyone; writable only
-        // with administrative authority. The bare directory is listed so it
-        // cannot be renamed or deleted out from under the files inside it.
-        {"/config",                  false, montauk::abi::CAP_USER_ADMIN},
+        {"/config",                  false, montauk::abi::CAP_USER_ADMIN}, /* listing the directory here prevents it being renamed or deleted */
         {"/config/users.toml",       false, montauk::abi::CAP_USER_ADMIN},
         {"/config/setup.toml",       false, montauk::abi::CAP_USER_ADMIN},
         {"/config/init.toml",        false, montauk::abi::CAP_USER_ADMIN},
         {"/config/ssh.toml",         false, montauk::abi::CAP_USER_ADMIN},
         {"/config/capabilities.toml",false, montauk::abi::CAP_USER_ADMIN},
-        // Pre-scaled wallpaper the login screen blits before it has decoded
-        // anything. It is drawn on a screen that is about to take a password,
-        // so it must not be plantable by an unprivileged process.
         {"/config/wallpaper.cache",  false, montauk::abi::CAP_USER_ADMIN},
         // Read by the Bluetooth driver at controller bring-up.
         {"/config/bluetooth.toml",   false, montauk::abi::CAP_DEVICE_ADMIN},
-        // Program images. Capability grants are keyed on binary path, so a
-        // writable image would let an unprivileged process substitute a binary
-        // and inherit the grant the next time a privileged launcher runs it.
-        // This is CAP_SYSTEM_IMAGE and not CAP_STORAGE_ADMIN precisely because
-        // it is the trusted computing base: partitioning and formatting a data
-        // volume is an ordinary administrative act, while replacing the image
-        // of login.elf is a route to every capability the system can issue.
         {"/apps",                    true,  montauk::abi::CAP_SYSTEM_IMAGE},
         {"/os",                      true,  montauk::abi::CAP_SYSTEM_IMAGE},
     };
@@ -70,7 +40,7 @@ namespace Fs {
     }
 
     // The volume the running system was booted from.
-    static constexpr uint64_t SystemDrive = 0;
+    static constexpr uint64_t SystemDrive = 0; // pinned to drive 0. Must be changed in MontaukOS ever allows non-zero system drives.
 
     // Strip the "<digits>:" prefix, but only for the system volume. Returns
     // nullptr for any other drive, meaning no rule applies to it.