diff --git a/armsrc/bwm_forward.h b/armsrc/bwm_forward.h
index 290410731..1ad04ccdb 100644
--- a/armsrc/bwm_forward.h
+++ b/armsrc/bwm_forward.h
@@ -9,25 +9,6 @@
 // See LICENSE.txt for the text of the license.
 //-----------------------------------------------------------------------------
 // Proxmark5 Battery Wireless Module (BWM) transport shim.
-//
-// The BWM (ESP32-C2, RfidResearchGroup/Proxmark5_BWM_esp32) bridges the AT32
-// host <-> BLE/WiFi. Its ESP<->AT32 UART link does NOT carry raw PacketCommandNG;
-// it uses a framed "app_com" protocol. Transparent host<->wireless traffic rides
-// inside that framing:
-//
-//   AT32 -> ESP (our reply, toward wireless host):
-//       [0x7C 0xC7] cmd=APP_CMD_SEND_FORWARD_DATA(5000) len(LE) payload CRC16(LE)
-//   ESP -> AT32 (command from wireless host):
-//       [0xD2 0xD3] cmd=APP_BROADCAST_DATA_FORWARD(8089) len(LE) payload CRC16(LE)
-//
-//   Frame = HDR1 HDR2 | CMD(LE16) | LEN(LE16) | PAYLOAD[LEN] | CRC(LE16)
-//   CRC   = CRC-16/CCITT-FALSE (poly 0x1021, init 0xFFFF, MSB-first, no xorout)
-//           over HDR..PAYLOAD. (NOT compute_crc(CRC_14443_A) - different CRC.)
-//
-// This shim wraps outgoing NG/OLD reply bytes into a SEND_FORWARD_DATA frame and
-// de-frames incoming DATA_FORWARD frames back into a raw NG byte stream, so the
-// stock reply_ng()/receive_ng() paths work unchanged over the BWM link.
-//
 // Enabled by -DWITH_BWM_FORWARD (implies WITH_FPC_USART_HOST).
 //-----------------------------------------------------------------------------
 
@@ -36,43 +17,27 @@
 
 #include "common.h"
 
-// app_com framing constants (verified against BWM firmware app_cmd_uart.[ch] /
-// app_com_defs.h).
-#define BWM_HDR_HOST_CMD_1     0x7C   // AT32 -> ESP  (host command)
+#define BWM_HDR_HOST_CMD_1     0x7C
 #define BWM_HDR_HOST_CMD_2     0xC7
-#define BWM_HDR_SLAVE_BCAST_1  0xD2   // ESP  -> AT32 (slave broadcast)
+#define BWM_HDR_SLAVE_BCAST_1  0xD2
 #define BWM_HDR_SLAVE_BCAST_2  0xD3
-#define BWM_HDR_SLAVE_RESP_1   0x2D   // ESP  -> AT32 (slave response, skipped here)
+#define BWM_HDR_SLAVE_RESP_1   0x2D
 #define BWM_HDR_SLAVE_RESP_2   0x3D
 
-#define BWM_CMD_SEND_FORWARD_DATA   5000   // host cmd: payload -> BLE/WiFi endpoint
-#define BWM_CMD_DATA_FORWARD        8089   // slave bcast: payload came from endpoint
-#define BWM_CMD_FLOW_CREDIT         8092   // slave bcast: payload = uint16 cumulative granted-frame count (LE)
-
-// Flow control (credit window). The ESP grants the ARM permission to send a
-// bounded number of forward frames; it advances the cumulative grant as it
-// drains frames to BLE. Sizing: BWM_FC_INITIAL_CREDIT frames must fit inside the
-// ESP's UART RX FIFO + BLE mbuf pool so an in-flight window never overflows.
-#define BWM_FC_INITIAL_CREDIT       8      // frames the ARM may send before the first grant
-#ifndef BWM_FC_STALL_SPINS
-#define BWM_FC_STALL_SPINS          200000
-#endif // safety valve: give up waiting for credit (avoid hard hang)
+#define BWM_CMD_SEND_FORWARD_DATA   5000
+#define BWM_CMD_DATA_FORWARD        8089
+#define BWM_FC_WINDOW               4
+#ifndef BWM_FC_ACK_TIMEOUT_SPINS
+#define BWM_FC_ACK_TIMEOUT_SPINS    200000
+#endif
 
 #define BWM_CRC16_POLY  0x1021
 #define BWM_CRC16_INIT  0xFFFF
 
-// Wrap `len` raw reply bytes (a whole PacketResponseNG/OLD frame) into one
-// SEND_FORWARD_DATA app_com frame and write it synchronously to the FPC USART.
-// Returns PM3_SUCCESS or the underlying usart error. Drop-in for the FPC
-// usart_writebuffer_sync() call in reply_ng_internal()/reply_old().
 int bwm_fwd_writebuffer_sync(const uint8_t *data, size_t len);
 
-// De-framed read: returns up to `len` raw NG bytes recovered from inbound
-// DATA_FORWARD frames, blocking-with-timeout exactly like usart_read_ng().
-// Drop-in for usart_read_ng() as the receive_ng() read callback.
 uint32_t bwm_read_ng(uint8_t *data, size_t len);
 
-// >0 when raw bytes are waiting on the FPC USART (gate for receive_ng()).
 uint16_t bwm_fwd_rxdata_available(void);
 
-#endif // __BWM_FORWARD_H
+#endif