diff --git a/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md b/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
index 0d4b339d..2916a294 100644
--- a/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
+++ b/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md
@@ -137,6 +137,8 @@ Lead verifies every finding against the source before an edit (S2 precedent:
 ## 7. Open questions for the capture session (ask for exactly these two)
 
 1. `LScape::calc_draw_order` sequence at each of the four poses (far-to-near
-   land cell order) — chunk 3's oracle.
+   land cell order) — chunk 3's oracle. Captured by the walk template's `LC`/`SC`
+   lines (added 2026-09-03: `RenderDeviceD3D::DrawLandCell` 0x0059f120 /
+   `DrawSortCell` 0x0059f140, one line per call with the cell's `m_DID`).
 2. Per-frame `outside_view.view_count` and the device-stamp advance count at
    each pose — chunk 2's oracle for the re-arm gate.
diff --git a/tools/walk-oracle/oh/README.md b/tools/walk-oracle/oh/README.md
index 4fc88bf0..e80aa812 100644
--- a/tools/walk-oracle/oh/README.md
+++ b/tools/walk-oracle/oh/README.md
@@ -25,7 +25,7 @@ session.
 | File | Purpose |
 |---|---|
 | `oh-recon.cdb` | No breakpoints. `dt`/`x`/`uf`/`dd` dumps that confirm every offset the three capture scripts assume. Run this FIRST, once per session. |
-| `oh-capture-walk.cdb.template` | FW0's F/P/LS/BLD/DI/DC lines, byte-identical, plus new `EC`/`OC` lines (cell-shell and object-cell draw-stamp events). 5 frames. |
+| `oh-capture-walk.cdb.template` | FW0's F/P/LS/BLD/DI/DC lines, byte-identical, plus new `EC`/`OC` lines (cell-shell and object-cell draw-stamp events) and, added 2026-09-03 for S3 chunk 3, `LC`/`SC` lines: one per `RenderDeviceD3D::DrawLandCell` (`0x0059f120`) / `DrawSortCell` (`0x0059f140`) call with the land cell's `m_DID` — retail's far-to-near landscape draw order within `LS`. 5 frames. |
 | `oh-capture-parts.cdb.template` | F/P lines plus new `PD`/`DM` lines (per-part and per-mesh admission/GfxObj identity). The high-hit-rate script. 3 frames. |
 | `oh-capture-alpha-depth.cdb.template` | F/P lines plus new `AM`/`FL`/`PM`/`PC` lines (the two alpha FIFO lists and the persistent portal-mask depth counter). 5 frames. |
 | `oh-run-capture.ps1` | Runner: `-Script -Log -Frames`. Verifies the live acclient.exe pairs with `refs/acclient.pdb` (aborts on mismatch), substitutes `<LOG>`/`<FRAMES>`, launches `cdb -pn acclient.exe -cf <script>` in the background. |
diff --git a/tools/walk-oracle/oh/oh-capture-walk.cdb.template b/tools/walk-oracle/oh/oh-capture-walk.cdb.template
index 2e9d55ee..693bc160 100644
--- a/tools/walk-oracle/oh/oh-capture-walk.cdb.template
+++ b/tools/walk-oracle/oh/oh-capture-walk.cdb.template
@@ -69,6 +69,8 @@ bp 00506330 ".printf \"LS\\n\"; gc"
 bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc"
 bp 0059f170 ".printf \"EC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
 bp 005a0760 ".printf \"OC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
+bp 0059f120 ".printf \"LC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
+bp 0059f140 ".printf \"SC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
 g
 .echo ===DETACHING===
 qd