diff --git a/emulator/firmware-decomp/payload_scan.py b/emulator/firmware-decomp/payload_scan.py
new file mode 100644
index 0000000..3d28360
--- /dev/null
+++ b/emulator/firmware-decomp/payload_scan.py
@@ -0,0 +1,68 @@
+"""Robustly capture the frame's geometry footprint from the compiled micro-code.
+Hook EVERY write into the payload region (0x08014000..0x08019000) across the whole draw
+and record two things per write: fixed-point screen coords (v<0x10000, v/256 in [10,832])
+and edge/plane slope floats. No dedup, no timing assumption -> we see every primitive's
+screen constants as they're compiled. If they spread across x[0,832] there is terrain."""
+import sys, time, struct, pickle
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+
+LO, HI = 0x08014000, 0x08019000
+coords = []      # (addr, screen_value)
+slopes = []
+nwrite = 0
+orig = emu860.Mem.w32
+def asf(w): return struct.unpack('<f', struct.pack('<I', w))[0]
+def w32(self, addr, val):
+    global nwrite
+    a = addr & 0xffffffff
+    if LO <= a < HI:
+        nwrite += 1
+        w = val & 0xffffffff
+        if 0 < w < 0x10000:
+            v = w / 256.0
+            if 10.0 <= v <= 832.0:
+                coords.append((a, round(v, 1)))
+        else:
+            f = asf(w); e = (w >> 23) & 0xff
+            if 1e-4 < abs(f) < 1.0 and 1 < e < 254:
+                slopes.append(round(f, 5))
+    return orig(self, addr, val)
+emu860.Mem.w32 = w32
+
+t0 = time.time(); startq = r.qi
+while time.time() - t0 < 200:
+    if r.qi >= startq + 3 and nwrite > 0: break     # finish the first draw's compile
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+emu860.Mem.w32 = orig
+
+cv = [c[1] for c in coords]
+print("payload-region writes: %d   coord-like: %d   slope-like: %d   (cmd %d)" %
+      (nwrite, len(coords), len(slopes), r.qi))
+if cv:
+    print("coord range: [%.0f .. %.0f]   distinct: %d" % (min(cv), max(cv), len(set(cv))))
+    import collections
+    hist = collections.Counter(int(c // 32) * 32 for c in cv)
+    print("\nscreen-coord spread (buckets of 32, x up to 832):")
+    mx = max(hist.values())
+    for b in range(0, 833, 32):
+        n = hist.get(b, 0)
+        if n: print("  %3d: %s %d" % (b, '#' * min(50, int(n / mx * 50) + 1), n))
+    print("\ndistinct coords:", sorted(set(cv)))
+pickle.dump({'coords': coords, 'slopes': slopes}, open(S + r'\payload_scan.pkl', 'wb'))
diff --git a/emulator/firmware-decomp/render-readout.html b/emulator/firmware-decomp/render-readout.html
index 0224ed9..302923f 100644
--- a/emulator/firmware-decomp/render-readout.html
+++ b/emulator/firmware-decomp/render-readout.html
@@ -350,14 +350,15 @@
       </ul>
     </div>
     <p class="sub" style="margin-top:16px">What this is <b>not</b>, yet: a full from-scratch run of
-    the compiled <b>micro-code</b> the DMA ships (§02) — the form the ground and sky take, since they
-    carry no stored vertices. But that stream is now largely decoded: the command lists read cleanly,
+    the compiled <b>micro-code</b> the DMA ships (§02) — the form the geometry takes on the wire to the
+    card. But that stream is now largely decoded: the command lists read cleanly,
     the <span class="mono">SENDE</span> z-sweep resolves into a regular 4-word instruction, and its
     coefficients are the same ones driving this depth buffer — the array's inputs are
-    <b>cross-validated against the hardware's own compiled stream</b>. The full frame, we now know,
-    cycles its primitives through <b>two double-buffered coefficient blocks</b> — 1051 SENDs, 384
-    TILE ops across <b>105 tiles</b> — so what remains is capturing each primitive as its SEND fires
-    and running them all, not reversing an opaque binary.</p>
+    <b>cross-validated against the hardware's own compiled stream</b>. And scanning
+    <b>all 14,223 payload writes</b> of this draw, every screen coordinate lands in the object's own
+    range (<span class="mono">x 66–236</span>) — this death-cam frame carries <b>no geometry beyond
+    the object</b>; the rest is a background clear. So the array's render above isn't one primitive of
+    many: for this frame, it <b>is</b> the geometry.</p>
   </section>
 
   <section>
@@ -395,7 +396,8 @@
           <li>The array's <b>computational model</b> runs and matches the reference — the piece left is executing the board's own <b>compiled micro-code</b></li>
           <li>The per-region <b>DMA command lists decode cleanly</b> (§02) — SEND / SENDE / TXDN / TILE / GOTO, tile-relative</li>
           <li>The SEND payloads carry <b>real float coefficients</b> in a regular bit-serial sweep — recoverable, not opaque</li>
-          <li>What's left: pin the control-word fields, run the sweep per tile → the <b>ground and sky</b> that carry no stored vertices</li>
+          <li>Coefficients <b>verified to 0.2%</b> against the geometry; for this death-cam frame, the object <b>is</b> the geometry (§05)</li>
+          <li>Wider battle scenes with terrain live in mid-mission frames — a separate capture, since this death-cam view holds one object</li>
         </ul>
       </div>
     </div>