diff --git a/google_secops_parser/README.md b/google_secops_parser/README.md
index ba0525d0..ff4d4ed6 100644
--- a/google_secops_parser/README.md
+++ b/google_secops_parser/README.md
@@ -274,7 +274,7 @@ Suggested order:
 Community resources (not official Google documentation) that informed this parser's JSON handling and are useful when validating it:
 
 - [Parsing 101: Best Practices & Tips](https://medium.com/@thatsiemguy/parsing-101-best-practices-tips-c2e8b7ce9db8) (Chris Martin / @thatsiemguy) — basis for initializing every `if`-tested field before the `json` filter to avoid `_failed_parsing_`.
-- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates the "convert JSON booleans/numbers to strings" idiom this parser relies on (the `json` filter preserves the original JSON type).
+- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates converting type-preserved JSON booleans to strings before testing them in conditionals, which this parser does in step 1b (storage is a separate matter: this parser stores booleans as typed `bool_value` per Google's parser extension examples).
 - [chronicle/cbn-tool](https://github.com/chronicle/cbn-tool) — CLI for the CBN parser APIs (submit and validate a parser).
 
 ## License
diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf
index 841ab594..0c3b267d 100644
--- a/google_secops_parser/parsedmarc.conf
+++ b/google_secops_parser/parsedmarc.conf
@@ -203,14 +203,16 @@ filter {
   }
 
   # ---------------------------------------------------------------------------
-  # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared.
-  #     The json{} filter PRESERVES the original JSON type, so without this
-  #     [dmarc_aligned] is a boolean and `== "false"` never matches. Booleans are
-  #     stored as string_value (matching Google's content-hub parsers, which
-  #     never use bool_value). Numeric fields are deliberately NOT converted
-  #     here -- they are stored as number_value (not string) in additional.fields
-  #     so SecOps can range-query and sort them; see the count / *_session_count
-  #     / source_asn blocks below.
+  # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared
+  #     in conditionals. The json{} filter PRESERVES the original JSON type,
+  #     and CBN conditionals compare against that type, so without this
+  #     [dmarc_aligned] is a boolean and `== "false"` never matches. This is
+  #     ONLY for the `if` guards: in additional.fields these values are
+  #     converted back and stored as typed bool_value (see the alignment
+  #     blocks below), matching the [gsecops] API output. Numeric fields are
+  #     deliberately NOT converted here -- they are stored as number_value in
+  #     additional.fields so SecOps can range-query and sort them; see the
+  #     count / *_session_count / source_asn blocks below.
   # ---------------------------------------------------------------------------
   mutate {
     convert => {