diff --git a/README.md b/README.md
index 24ddb95..993f149 100644
--- a/README.md
+++ b/README.md
@@ -310,10 +310,12 @@ later one) never drops what an earlier one changed. Half-finished pages are not
 written: closing the dialog without **Save and close** leaves the entry as it was.
 
 The **setup** flow follows the same shape: its first form is unchanged (name, host,
-transports, the linked entities), and after it the flow is a menu — Receiver /
-Connection / pairing rows / Create the entry — so anything you want to correct is one
-row away instead of buried in a form you have already submitted. The pairing rows
-appear only while a transport still needs pairing.
+transports, the linked entities), and after it the flow is a menu — **Receiver**,
+**Connection**, **Set up ADB**, **Pair the remote protocol**, **Create the entry** — so
+anything you want to correct is one row away instead of buried in a form you have
+already submitted. The two pairing rows appear only while that transport still needs
+pairing (a skip leaves its row there to retry; a successful pairing removes it), and
+the menu's description names what is still to pair.
 
 ### The Apps table
 
@@ -437,7 +439,9 @@ is missing only if Android itself does not report it.
 Names come from the same cached path the Current App sensor uses: a `pm dump` per
 package, parsed for `application-label`, cached for 24 h. A full sweep runs the dumps
 in a small burst (4 at a time, 50 ms apart), which finishes a typical Shield in
-seconds instead of the minutes a strictly serialised sweep would take. A label fetch
+seconds instead of the minutes a strictly serialised sweep would take; the commands
+share the watchdog's own ADB connection, and `adb-shell` serialises the I/O on it, so
+the burst queues politely instead of interleaving on the socket. A label fetch
 that **fails is not cached**, so that app shows its package id in this table and the
 next sweep tries again — this is the same rule as the entity path, and it is why a
 transient ADB hiccup no longer sticks.