diff --git a/vendor/wheels/WheelsTest.cfc b/vendor/wheels/WheelsTest.cfc
index 0bf71385c0..3d51e64759 100644
--- a/vendor/wheels/WheelsTest.cfc
+++ b/vendor/wheels/WheelsTest.cfc
@@ -201,7 +201,8 @@ component extends="wheels.wheelstest.system.BaseSpec" {
 
     /**
      * Runs `callback` and returns the SQL statements the model layer sent while it ran, as an array of
-     * `{sql, dataSource}`. Each `sql` has a `?` for every bound value; values are never recorded.
+     * `{sql, dataSource}`. Each `sql` has a `?` for every bound value, so bound values aren't recorded; a
+     * value written into the SQL itself (`parameterize=false`) appears as written.
      * Statements a request query cache answered aren't sent, so they aren't recorded; neither are raw
      * `QueryExecute()` / `cfquery` calls, transaction control, or requests made through a TestClient.
      *
diff --git a/vendor/wheels/databaseAdapters/Base.cfc b/vendor/wheels/databaseAdapters/Base.cfc
index 2de7b58f4c..85271e3e1d 100755
--- a/vendor/wheels/databaseAdapters/Base.cfc
+++ b/vendor/wheels/databaseAdapters/Base.cfc
@@ -127,8 +127,9 @@ component output=false extends="wheels.Global"{
 
 	/**
 	 * Internal function. Adds a statement to every active query recorder (F4): its SQL with a `?` for
-	 * each bound value (an IN list shows one `?` per list), never the values, so a failure message can't
-	 * leak data into a log. A recorder with a `dataSource` filter only takes that datasource's statements.
+	 * each bound value (an IN list shows one `?` per list), so a failure message doesn't put bound data
+	 * in a log. A value written into the SQL itself (`parameterize=false`) appears as written. A recorder
+	 * with a `dataSource` filter only takes that datasource's statements.
 	 */
 	public void function $recordQuery(required array sql, required struct queryAttributes) {
 		local.text = "";
diff --git a/vendor/wheels/global/cache.cfm b/vendor/wheels/global/cache.cfm
index a9e35ada21..fcea02fbdb 100644
--- a/vendor/wheels/global/cache.cfm
+++ b/vendor/wheels/global/cache.cfm
@@ -382,7 +382,12 @@
 	 * until the entry expires or is deleted. When `callback` returns nothing, nothing is cached and `""`
 	 * is returned; when it throws, nothing is cached and the error propagates. `callback` runs outside
 	 * the cache lock, so two requests that miss at the same moment may both call it (the later write
-	 * wins). The cache lives in this server's memory and empties on an application reload or restart.
+	 * wins). When the cache is full, the computed value is returned but not cached, so the next call
+	 * computes it again. The cache lives in this server's memory and empties on an application reload
+	 * or restart.
+	 *
+	 * Keys are shared by every user, session, tenant and host: nothing about the request is added. For
+	 * per-user, per-role or per-tenant data, put that identity in the key, e.g. `"digest-" & userId`.
 	 *
 	 * [section: Global Helpers]
 	 * [category: Caching Functions]
@@ -413,6 +418,7 @@
 	/**
 	 * Returns the value cached under `key`, or `defaultValue` when there is no unexpired entry. A cached
 	 * `false`, `0` or `""` is returned as it is. Complex values come back as a copy.
+	 * Keys are shared by every user, session, tenant and host (see `appCacheFetch()`).
 	 *
 	 * [section: Global Helpers]
 	 * [category: Caching Functions]