diff --git a/site/src/content/docs/firmware/version-comparison.mdx b/site/src/content/docs/firmware/version-comparison.mdx
index 5d2eb4e..ec00036 100644
--- a/site/src/content/docs/firmware/version-comparison.mdx
+++ b/site/src/content/docs/firmware/version-comparison.mdx
@@ -11,12 +11,12 @@ Five firmware versions have been analyzed through Ghidra reverse engineering and
 
 | Firmware | Version ID | Build Date | Target PID | Functions | Binary Size | Stack Pointer |
 |----------|-----------|------------|------------|-----------|-------------|---------------|
-| v2.06.04 | `0x020604` | 2007-07-13 | `0x0203` | 61 | 9,472 bytes | `0x72` |
-| Rev.2 v2.10.04 | `0x020A04` | 2010-03-12 | `0x0202` | 107 | 8,843 bytes | `0x4F` |
+| Custom v3.01.0 | `0x030100` | 2026-02-12 | `0x0203` | N/A | ~3 KB (RAM) | N/A |
 | v2.13.01 (FW1) | `0x020D01` | 2010-03-12 | `0x0203` | 82-88 | 9,322 bytes | `0x50` |
 | v2.13.02 (FW2) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,377 bytes | `0x50` |
 | v2.13.03 (FW3) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,369 bytes | `0x52` |
-| Custom v3.01.0 | `0x030100` | 2026-02-12 | `0x0203` | N/A | ~3 KB (RAM) | N/A |
+| Rev.2 v2.10.04 | `0x020A04` | 2010-03-12 | `0x0202` | 107 | 8,843 bytes | `0x4F` |
+| v2.06.04 | `0x020604` | 2007-07-13 | `0x0203` | 61 | 9,472 bytes | `0x72` |
 
 <Aside type="note">
 Rev.2 v2.10 targets PID `0x0202` (a different product line). All other versions target `0x0203` (SkyWalker-1). The custom v3.01.0 is compiled with SDCC + fx2lib and loaded into FX2 RAM, not flashed to EEPROM.
@@ -25,64 +25,31 @@ Rev.2 v2.10 targets PID `0x0202` (a different product line). All other versions
 ## Version-by-Version Details
 
 <Tabs>
-<TabItem label="v2.06">
+<TabItem label="Custom v3.01">
 
-### v2.06.04 <Badge text="Stock" variant="note" />
+### Custom v3.01.0 <Badge text="Custom" variant="success" />
 
-The original SkyWalker-1 firmware extracted from the device's onboard EEPROM.
+Open-source replacement firmware built with SDCC + fx2lib. RAM-loaded for testing.
 
 | Property | Value |
 |----------|-------|
-| Version ID | `0x020604` |
-| Build date | 2007-07-13 |
-| Functions | 61 |
-| Binary size | 9,472 bytes |
-| Stack pointer | `0x72` |
-| Config byte IRAM | `0x6D` |
-| Descriptor base | `0x1200` |
-| Init table address | `CODE:0B46` |
-| Vendor commands | 30 (`0x80`--`0x9D`) |
-| DiSEqC data pin | P0.7 |
+| Version ID | `0x030100` |
+| Build date | 2026-02-12 |
+| Toolchain | SDCC + fx2lib |
+| Source | `firmware/skywalker1.c` (1351 lines) |
+| Binary size | ~3 KB |
+| Load method | RAM upload via `tools/fw_load.py` |
+| DiSEqC data pin | P0.7 (v2.06 assignment) |
 
-**Characteristics:**
-- Simplest firmware with the fewest functions
-- INT0 handler performs USB re-enumeration (CPUCS pulse)
-- No demodulator probe at boot
-- No retry loops or integrity verification
-- BCM4500 status polling reads 3 registers (0xA2, 0xA8, 0xA4) up to 6 times
-- Commands 0x99, 0x9A, 0x9C route to STALL
-- Command 0x9D reads descriptor byte and sets mode flag based on hardware revision (4, 5, or 6)
-</TabItem>
+**Additions over stock:**
+- Seven new diagnostic commands (`0xB0`--`0xB6`)
+- Incremental debug boot modes (wValue `0x80`--`0x85` for BOOT_8PSK)
+- I2C timeout protection (6000-iteration countdown vs. infinite spin)
+- I2C bus scan for device discovery
+- Spectrum sweep and blind scan capabilities
+- Raw BCM4500 register access
 
-<TabItem label="Rev.2 v2.10">
-
-### Rev.2 v2.10.04 <Badge text="Transitional" variant="caution" />
-
-Firmware for the Rev.2 hardware variant (PID `0x0202`). Architecturally sits between v2.06 and v2.13.
-
-| Property | Value |
-|----------|-------|
-| Version ID | `0x020A04` |
-| Build date | 2010-03-12 |
-| Functions | 107 (most of any version) |
-| Binary size | 8,843 bytes (smallest) |
-| Stack pointer | `0x4F` |
-| Config byte IRAM | `0x4E` |
-| Descriptor base | `0x0E00` |
-| Init table address | `CODE:0B48` |
-| Vendor commands | 27 (`0x80`--`0x9A`) |
-| DiSEqC data pin | P0.4 |
-
-**Characteristics:**
-- Highest function count due to granular decomposition (10-30 byte helper functions)
-- Smallest binary despite having the most functions
-- Retained v2.06's INT0 USB re-enumeration behavior
-- Already adopted v2.13's descriptor base (`0x0E00`) and similar stack pointer
-- Contains `FUN_CODE_0800`: a massive 874-byte configuration dispatcher with embedded main loop
-- Lacks v2.13's demodulator polling, retry loops, and additional vendor commands (0x9B--0x9D out of range)
-- 0x99/0x9A present as prototype implementations
-
-See the [Rev.2 Analysis](/firmware/rev2-analysis/) page for the complete 107-function inventory.
+See the [Custom v3.01](/firmware/custom-v301/) page for full details.
 </TabItem>
 
 <TabItem label="v2.13 FW1">
@@ -117,50 +84,83 @@ The most feature-complete stock firmware, targeting the original I2C-connected S
 See the [FW2.13 Variants](/firmware/fw213-variants/) page for sub-variant comparison.
 </TabItem>
 
-<TabItem label="Custom v3.01">
+<TabItem label="Rev.2 v2.10">
 
-### Custom v3.01.0 <Badge text="Custom" variant="success" />
+### Rev.2 v2.10.04 <Badge text="Transitional" variant="caution" />
 
-Open-source replacement firmware built with SDCC + fx2lib. RAM-loaded for testing.
+Firmware for the Rev.2 hardware variant (PID `0x0202`). Architecturally sits between v2.06 and v2.13.
 
 | Property | Value |
 |----------|-------|
-| Version ID | `0x030100` |
-| Build date | 2026-02-12 |
-| Toolchain | SDCC + fx2lib |
-| Source | `firmware/skywalker1.c` (1351 lines) |
-| Binary size | ~3 KB |
-| Load method | RAM upload via `tools/fw_load.py` |
-| DiSEqC data pin | P0.7 (v2.06 assignment) |
+| Version ID | `0x020A04` |
+| Build date | 2010-03-12 |
+| Functions | 107 (most of any version) |
+| Binary size | 8,843 bytes (smallest) |
+| Stack pointer | `0x4F` |
+| Config byte IRAM | `0x4E` |
+| Descriptor base | `0x0E00` |
+| Init table address | `CODE:0B48` |
+| Vendor commands | 27 (`0x80`--`0x9A`) |
+| DiSEqC data pin | P0.4 |
 
-**Additions over stock:**
-- Seven new diagnostic commands (`0xB0`--`0xB6`)
-- Incremental debug boot modes (wValue `0x80`--`0x85` for BOOT_8PSK)
-- I2C timeout protection (6000-iteration countdown vs. infinite spin)
-- I2C bus scan for device discovery
-- Spectrum sweep and blind scan capabilities
-- Raw BCM4500 register access
+**Characteristics:**
+- Highest function count due to granular decomposition (10-30 byte helper functions)
+- Smallest binary despite having the most functions
+- Retained v2.06's INT0 USB re-enumeration behavior
+- Already adopted v2.13's descriptor base (`0x0E00`) and similar stack pointer
+- Contains `FUN_CODE_0800`: a massive 874-byte configuration dispatcher with embedded main loop
+- Lacks v2.13's demodulator polling, retry loops, and additional vendor commands (0x9B--0x9D out of range)
+- 0x99/0x9A present as prototype implementations
 
-See the [Custom v3.01](/firmware/custom-v301/) page for full details.
+See the [Rev.2 Analysis](/firmware/rev2-analysis/) page for the complete 107-function inventory.
+</TabItem>
+
+<TabItem label="v2.06">
+
+### v2.06.04 <Badge text="Stock" variant="note" />
+
+The original SkyWalker-1 firmware extracted from the device's onboard EEPROM.
+
+| Property | Value |
+|----------|-------|
+| Version ID | `0x020604` |
+| Build date | 2007-07-13 |
+| Functions | 61 |
+| Binary size | 9,472 bytes |
+| Stack pointer | `0x72` |
+| Config byte IRAM | `0x6D` |
+| Descriptor base | `0x1200` |
+| Init table address | `CODE:0B46` |
+| Vendor commands | 30 (`0x80`--`0x9D`) |
+| DiSEqC data pin | P0.7 |
+
+**Characteristics:**
+- Simplest firmware with the fewest functions
+- INT0 handler performs USB re-enumeration (CPUCS pulse)
+- No demodulator probe at boot
+- No retry loops or integrity verification
+- BCM4500 status polling reads 3 registers (0xA2, 0xA8, 0xA4) up to 6 times
+- Commands 0x99, 0x9A, 0x9C route to STALL
+- Command 0x9D reads descriptor byte and sets mode flag based on hardware revision (4, 5, or 6)
 </TabItem>
 </Tabs>
 
 ## Architectural Differences
 
-| Feature | v2.06 | Rev.2 v2.10 | v2.13 | Custom v3.01 |
-|---------|-------|-------------|-------|--------------|
-| Vendor commands | 30 | 27 | 30 | 30 stock + 7 custom |
-| INT0 handler | USB re-enum | USB re-enum | Demod polling | N/A (fx2lib ISR) |
-| Demod probe at boot | No | No | Yes (40 attempts) | Yes (with timeout) |
-| Retry loops | No | No | Yes (20-attempt) | Yes (with timeout) |
-| HW revision detect | No | Yes (descriptor walker) | Yes (flag `_1_3`) | No |
-| DiSEqC data pin | P0.7 | P0.4 | P0.0 | P0.7 |
-| Config byte IRAM addr | `0x6D` | `0x4E` | `0x4F` | C variable |
-| BCM4500 status poll | 3 registers | 3 registers | 1 register | 1 register |
-| I2C timeout | None | None | None | 6000-count |
-| Anti-tampering | No | No | Yes | No |
-| New commands | -- | 0x99/0x9A proto | 0x99, 0x9A, 0x9C | 0xB0--0xB6 |
-| 0x9D behavior | HW revision mode | N/A (out of range) | Conditional demod reset | N/A |
+| Feature | Custom v3.01 | v2.13 | Rev.2 v2.10 | v2.06 |
+|---------|--------------|-------|-------------|-------|
+| Vendor commands | 30 stock + 7 custom | 30 | 27 | 30 |
+| INT0 handler | N/A (fx2lib ISR) | Demod polling | USB re-enum | USB re-enum |
+| Demod probe at boot | Yes (with timeout) | Yes (40 attempts) | No | No |
+| Retry loops | Yes (with timeout) | Yes (20-attempt) | No | No |
+| HW revision detect | No | Yes (flag `_1_3`) | Yes (descriptor walker) | No |
+| DiSEqC data pin | P0.7 | P0.0 | P0.4 | P0.7 |
+| Config byte IRAM addr | C variable | `0x4F` | `0x4E` | `0x6D` |
+| BCM4500 status poll | 1 register | 1 register | 3 registers | 3 registers |
+| I2C timeout | 6000-count | None | None | None |
+| Anti-tampering | No | Yes | No | No |
+| New commands | 0xB0--0xB6 | 0x99, 0x9A, 0x9C | 0x99/0x9A proto | -- |
+| 0x9D behavior | N/A | Conditional demod reset | N/A (out of range) | HW revision mode |
 
 ## Kernel Version Constants