diff --git a/docs/mx-re/toolchain-and-plan.md b/docs/mx-re/toolchain-and-plan.md
index 73fbbe8..98f6650 100644
--- a/docs/mx-re/toolchain-and-plan.md
+++ b/docs/mx-re/toolchain-and-plan.md
@@ -30,6 +30,18 @@ Useful `CMDS.txt` debugger commands:
 This resolves the segment/relocation mapping that flat static disassembly of the
 ROM could not (e.g. `SCANNER.DYL` / `SCANAPP` code).
 
+
+**Decompilation (Ghidra headless):** extract the DYL region to a slice and load
+as 16-bit real-mode x86:
+```
+ghidra-analyzeHeadless PROJ NAME -import slice.bin -processor "x86:LE:16:Real Mode" \
+  -scriptPath SCRIPTS -postScript decomp.java -deleteProject
+```
+`SCANNER.DYL`/`SCANAPP` decompile to readable pseudo-C this way (Ghidra 12 needs
+a Java GhidraScript, not Python). Caveat: TopSpeed C uses the register-based
+`jpi` calling convention, so argument recovery may need convention hints, but
+control flow, struct access and the `int` service calls read clearly.
+
 **Static RE:** `radare2 -e asm.arch=x86 -e asm.bits=16 w2mx_v7.20f_eng.bin`
 (good for strings, byte-pattern search, and clean fixed-mapped regions).