diff --git a/code/inventory/scan.c b/code/inventory/scan.c
index e9be4fd..a1d4e97 100644
--- a/code/inventory/scan.c
+++ b/code/inventory/scan.c
@@ -1,45 +1,42 @@
 /*
- * scan.c - Phase 1 barcode diagnostic: read the integral laser via WL2:D.
+ * scan.c - Phase 1: read the integral laser via WL2:D (reverse-engineered init).
  *
- * The MX ROM shows the scanner port is WL2 with units A and D, decoder
- * "Symbol2" (Workabout MX scanner). WL2:A returned -9 (in use); WL2:D (the
- * top-slot position, as TTY:D was) is untried. This opens WL2:D (falling back
- * to WL2:A), and if a channel opens, reads it barcode-style
- * (p_iow(pcb, P_FREAD, buf)) and dumps the bytes. Press the scan key to fire.
+ * From disassembling SCANNER.DYL in the MX ROM, the scanner is driven over the
+ * SIBO I/O executive (int 0xCF), i.e. the p_iow(chan, func, ...) layer. After
+ * opening WL2:D the driver is enabled with two control ops (function codes 6
+ * then 7 on the channel), after which decoded barcodes can be read. Decoded
+ * output is terminated by CR LF (default Symbol2 postamble 0x0D 0x0A).
+ *
+ * This is the first RE-based attempt: the enable-then-read path. The full config
+ * download (cl=0x0C command-byte writes) is not replicated here - if the driver
+ * applies Symbol2 defaults on open, enable+read should suffice; if not, we add
+ * the config writes next. Press the scan key to fire the laser.
  */
 #include <plib.h>
 
-#define NU 2
+#define WL2_ENABLE1 6
+#define WL2_ENABLE2 7
 
 GLDEF_C INT main(VOID)
 {
     VOID *chan;
     UBYTE buf[256];
-    INT   r, i, opened;
-    UINT  k;
+    INT   err, r, i;
 
-    static TEXT *names[NU] = { "WL2:D", "WL2:A" };
-    INT results[NU];
-
-    opened = -1;
-    for (k = 0; k < NU; k++) {
-        r = p_open(&chan, names[k], (UINT)-1);
-        results[k] = r;
-        if (r >= 0 && opened < 0)
-            opened = k;
-    }
-
-    for (k = 0; k < NU; k++)
-        p_printf("open %s: %d\n", names[k], results[k]);
-
-    if (opened < 0) {
-        p_printf("\nNothing opened. Press a key.\n");
+    err = p_open(&chan, "WL2:D", (UINT)-1);
+    p_printf("open WL2:D: %d\n", err);
+    if (err < 0) {
+        p_printf("Press a key to exit.\n");
         p_getch();
         return 1;
     }
 
-    p_open(&chan, names[opened], (UINT)-1);   /* reopen the winner */
-    p_printf("\nOpened %s. Scan (press scan key). Dumping:\n\n", names[opened]);
+    r = p_iow(chan, WL2_ENABLE1);
+    p_printf("enable op6: %d\n", r);
+    r = p_iow(chan, WL2_ENABLE2);
+    p_printf("enable op7: %d\n", r);
+
+    p_printf("\nScan a barcode (press scan key). Dumping reads:\n\n");
 
     for (;;) {
         r = p_iow(chan, P_FREAD, buf);