diff --git a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
index 92a00c7..028ef45 100644
--- a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
+++ b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
@@ -172,6 +172,22 @@ enough (only 2). Each primitive must be captured **at the moment its SEND fires*
 of them run tile-by-tile through `igc_array.py`. The frame is many primitives, not
 two — object + terrain, z-buffered across ~105 tiles.
 
+## Attempt: reconstruct frame geometry from payload coords — DID NOT WORK
+
+`scratchpad/frame_geometry.py` hooks the coeff-copy, snapshots each SEND payload
+as it's referenced (deduped by content), and extracts fixed-point screen coords
+(words <0x10000 with value/256 in screen range). Honest outcome (run to cmd 2345):
+**5 distinct primitives, only 11 coords, all clustered x∈[66,236] = the object**,
+no terrain, far too sparse to rebuild triangles. The recovered values (236.0,
+181.2, 65.5) are edge *constants*, not vertex lists — the payload does NOT store
+extractable per-vertex geometry; it stores compiled edge/plane coefficients whose
+constants happen to be a couple of coords. So "grep the coords and plot" is a dead
+end: a real from-scratch render needs the full plane-role assembly (pair each
+edge's slope+constant into a line, group 3 lines into a triangle, add z+color)
+run through `igc_array.py` — the coefficients are all decoded and verified, but
+assembling them into primitives is non-trivial and unsolved. Negative result kept
+so the next session doesn't repeat the coord-extraction shortcut.
+
 ## What this changes
 
 The micro-code decode is now **extraction + bit-serial execution**, not blind
diff --git a/emulator/firmware-decomp/frame_geometry.py b/emulator/firmware-decomp/frame_geometry.py
new file mode 100644
index 0000000..f327c4b
--- /dev/null
+++ b/emulator/firmware-decomp/frame_geometry.py
@@ -0,0 +1,82 @@
+"""From-scratch full-frame geometry from the micro-code. Hook the coefficient-copy; each
+time a SEND(addr,size) pair is written, read that payload block RIGHT THEN (before the
+double-buffer is overwritten), dedup by content, and extract the fixed-point screen
+coordinates it carries (words < 0x10000 whose value/256 lands in screen range). Plot all
+of them = the frame's geometry reconstructed from the compiled stream, terrain + object."""
+import sys, time, struct, pickle, hashlib
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+
+COPY = 0xf0411cd4
+def rw(a):
+    try: return cpu.mem.r32(a & 0xffffffff)
+    except Exception: return 0
+
+prims = {}            # content-hash -> {'addr':, 'coords':[...], 'floats':[...]}
+pend = []             # pending copy words to pair up
+orig = emu860.Mem.w32
+def read_payload(addr, size):
+    ws = [rw(addr + 4 * i) for i in range(min(size, 80))]
+    h = hashlib.md5(bytes(str(ws), 'ascii')).hexdigest()[:10]
+    if h in prims:
+        return
+    coords = []
+    for w in ws:
+        if 0 < w < 0x10000:
+            v = w / 256.0
+            if 12.0 <= v <= 600.0:
+                coords.append(round(v, 1))
+    prims[h] = {'addr': addr, 'coords': coords, 'nwords': len(ws)}
+
+def w32(self, addr, val):
+    if cpu.pc == COPY:
+        pend.append(val & 0xffffffff)
+        if len(pend) >= 2:
+            a, op = pend[-2], pend[-1]
+            code = (op >> 28) & 0xf
+            if code in (0x1, 0x9) and 0x08000000 <= a < 0x08100000:   # SEND/SENDE
+                read_payload(a, op & 0x7f)
+    return orig(self, addr, val)
+emu860.Mem.w32 = w32
+
+t0 = time.time()
+while time.time() - t0 < 200:
+    if len(prims) >= 400: break
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+    # stop once the draw's copy activity has clearly ended
+    if len(prims) and (time.time() - t0) > 12 and r.qi > snap['qi'] + 1 and cpu.pc != COPY and len(pend) > 4 and (len(pend) & 1) == 0:
+        pass
+emu860.Mem.w32 = orig
+
+allc = [c for p in prims.values() for c in p['coords']]
+print("distinct primitive payloads captured: %d   (ran to cmd %d)" % (len(prims), r.qi))
+print("total fixed-point screen coords extracted: %d" % len(allc))
+if allc:
+    print("coord range: [%.0f .. %.0f]" % (min(allc), max(allc)))
+# save + a 1D histogram of coords to see spread
+pickle.dump({'prims': prims}, open(S + r'\frame_geo.pkl', 'wb'))
+import collections
+hist = collections.Counter(int(c // 40) * 40 for c in allc)
+print("\ncoord spread (bucketed by 40):")
+for b in sorted(hist):
+    print("  %3d-%3d: %s" % (b, b + 39, '#' * min(60, hist[b])))
+# per-primitive summary
+print("\nfirst 12 primitives:")
+for i, (h, p) in enumerate(list(prims.items())[:12]):
+    print("  %-10s @%#010x  %2d coords: %s" % (h, p['addr'], len(p['coords']), p['coords'][:10]))