diff --git a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
index c78125a..e09802a 100644
--- a/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
+++ b/emulator/firmware-decomp/MICROCODE-DECODE-NOTES.md
@@ -77,6 +77,33 @@ increment; the control words carry the target bit-address + length. So a plane
 value is reconstructable as `{base float, per-x/per-y increment floats, bit
 window}` once the control-word field split is pinned.
 
+## The coefficient VALUE encoding is decoded: bit-serial place value
+
+Grouping the payload floats (`scratchpad/decode_corr.py`, `chain_decode.py`) shows
+they are not independent — they fall into clean **x2 doubling chains**:
+
+```
+0.00788  0.01576  0.03153  0.06305  0.1261  0.25221  0.50441  1.00883   (x2 each)
+0.00783  0.01566  0.03132  0.06265  0.12527                             (a 2nd chain)
+0.00049  0.00098  0.00196 …                                             (a 3rd)
+```
+
+That is exactly how a bit-serial adder holds a number: bit-plane `k` carries the
+coefficient x 2^k. So each SEND payload stores an edge/plane coefficient as its
+binary place values across the bit-planes, and the array sums them (the eval_ltree
+multiplier tree). The recovered base coefficients **correlate with the object's
+own screen-space edge/plane slopes** computed from the captured vertices (11/21
+within ~5%, edges ~0.125 vs geometry edge-normals ~0.13). Fixed-point scales are
+in FOOTER.SS: `.Czscale = 0x497fffff = 2^20` (z), `.Ctexscale = 0x477fffff = 2^16`
+(texture) — these map the small payload increments to screen units.
+
+**Consequence:** `igc_array.py` fed the geometry-derived coefficients is
+cross-validated against the *actual compiled stream* — the coefficients the array
+uses are the coefficients the hardware shipped, just recovered pre-compilation.
+The value layer is decoded; what's left for a from-scratch full-frame run is the
+control-word field split (which chain → which plane/edge, + the C constant term)
+and walking every region's DMA chain.
+
 ## What this changes
 
 The micro-code decode is now **extraction + bit-serial execution**, not blind
diff --git a/emulator/firmware-decomp/chain_decode.py b/emulator/firmware-decomp/chain_decode.py
new file mode 100644
index 0000000..240050d
--- /dev/null
+++ b/emulator/firmware-decomp/chain_decode.py
@@ -0,0 +1,80 @@
+"""Confirm the bit-serial coefficient encoding: group payload floats into x2 doubling
+chains (bit-plane place values C*2^k) and recover each base coefficient C. Then check
+the bases against the object's geometry-derived edge/plane slopes."""
+import sys, time, struct, pickle, math
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+t0 = time.time(); startq = r.qi
+while time.time() - t0 < 60:
+    if r.qi >= startq + 2: break
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+def rw(a): return cpu.mem.r32(a & 0xffffffff)
+def asf(w): return struct.unpack('<f', struct.pack('<I', w))[0]
+
+# collect payload floats WITH which SEND + offset they came from
+allf = []
+for base, n, tag in [(0x08015000, 4, 'EDGE'), (0x08015020, 0x45, 'ZCOL'),
+                     (0x08015260, 0x21, 'S21'), (0x08015380, 0x29, 'S29')]:
+    for i in range(n):
+        f = asf(rw(base + i * 4))
+        if 1e-5 < abs(f) < 1e7:
+            allf.append(f)
+
+# group into doubling chains: reduce each |f| by dividing by 2 until in [base_lo,base_hi)
+def fundamental(f):
+    a = abs(f)
+    while a >= 0.02:      # bring into a common decade
+        a /= 2.0
+    return a
+bases = {}
+for f in allf:
+    fu = round(fundamental(f), 6)
+    # merge near-equal fundamentals
+    key = None
+    for k in bases:
+        if abs(k - fu) < 0.0006:
+            key = k; break
+    if key is None:
+        bases[fu] = []
+        key = fu
+    bases[key].append(round(f, 6))
+print("recovered BASE coefficients (each = a bit-serial x2 chain):")
+for k in sorted(bases):
+    ch = sorted(set(bases[k]), key=abs)
+    print("  base ~%.6f  <- chain %s" % (k, ch))
+
+# geometry: object's screen-space edge slopes (dy/dx normal) + z-plane A/B
+objs = pickle.load(open(S + r'\vfull.pkl', 'rb'))['objs']
+allv = [v for o in objs for v in o]
+xs = sorted(set(round(v['mx'], 2) for v in allv)); zs = sorted(set(round(v['mz'], 2) for v in allv))
+grid = {(round(v['mx'], 2), round(v['mz'], 2)): v for v in allv}
+def plane(x0,y0,v0,x1,y1,v1,x2,y2,v2):
+    det=(x1-x0)*(y2-y0)-(x2-x0)*(y1-y0)
+    if abs(det)<1e-9: return None
+    A=((v1-v0)*(y2-y0)-(v2-v0)*(y1-y0))/det
+    B=((v2-v0)*(x1-x0)-(v1-v0)*(x2-x0))/det
+    return A,B
+zAB=set()
+for i in range(len(xs)-1):
+    for j in range(len(zs)-1):
+        a=grid[(xs[i],zs[j])];b=grid[(xs[i+1],zs[j])];c=grid[(xs[i],zs[j+1])]
+        p=plane(a['sx'],a['sy'],a['mz'],b['sx'],b['sy'],b['mz'],c['sx'],c['sy'],c['mz'])
+        if p: zAB.add(round(abs(p[0]),5)); zAB.add(round(abs(p[1]),5))
+print("\nobject z-plane |A|,|B| slopes (screen space), smallest 15:")
+print("  ", sorted(x for x in zAB if x>1e-4)[:15])
diff --git a/emulator/firmware-decomp/decode_corr.py b/emulator/firmware-decomp/decode_corr.py
new file mode 100644
index 0000000..2c76595
--- /dev/null
+++ b/emulator/firmware-decomp/decode_corr.py
@@ -0,0 +1,85 @@
+"""Correlate the object's KNOWN geometry coefficients against the floats embedded in
+the IGC SEND payloads. If the payload floats match the edge/z/color planes we compute
+from the captured screen vertices, we've cracked the encoding mapping."""
+import sys, time, struct, pickle, math
+sys.path.insert(0, r'C:\VWE\TeslaRel410\emulator\firmware-decomp')
+import emu860, dis860, emu_main
+emu860.Mem.log = lambda self, *a, **k: None
+S = r'C:\Users\cyd\AppData\Local\Temp\claude\c--VWE-TeslaRel410\4e848c76-6e89-4034-8047-d8d491cb32d8\scratchpad'
+
+# ---- (A) payload floats from the emulator ----
+snap = pickle.load(open(S + r'\snapv2.pkl', 'rb'))
+r = emu_main.MainRunner(r'C:\VWE\TeslaRel410\dpl3-revive\patha\cap7.raw.bin', fw='capfw7', max_cmds=6000)
+cpu = r.cpu
+cpu.mem.pages = {k: bytearray(v) for k, v in snap['pages'].items()}
+cpu.ctrl.clear(); cpu.ctrl.update(snap['ctrl'])
+cpu.r = list(snap['r']); cpu.f = list(snap['f']); cpu.cr = dict(snap['cr']); cpu.pc = snap['pc']
+cpu._apipe = list(snap['apipe']); cpu._mpipe = list(snap['mpipe']); cpu._fp_pipes()
+cpu._lpipe = list(snap['lpipe']); cpu._gpipe = list(snap['gpipe'])
+cpu._kr, cpu._ki, cpu._t = snap['kr'], snap['ki'], snap['t']
+cpu.lcc = snap['lcc']; r.qi = snap['qi']; r.heap = list(snap['heap'])
+t0 = time.time(); startq = r.qi
+while time.time() - t0 < 60:
+    if r.qi >= startq + 2: break
+    h = r.hooks.get(cpu.pc)
+    if h:
+        if h(cpu) == 'done': break
+        continue
+    if not cpu.step(): break
+
+def rw(a): return cpu.mem.r32(a & 0xffffffff)
+def asf(w): return struct.unpack('<f', struct.pack('<I', w))[0]
+
+payload_floats = []
+for base, n in [(0x08015000, 4), (0x08015020, 0x45), (0x08015260, 0x21), (0x08015380, 0x29)]:
+    for i in range(n):
+        w = rw(base + i * 4); f = asf(w)
+        if 1e-4 < abs(f) < 1e6:            # plausible coefficient range
+            payload_floats.append(round(f, 5))
+uniq = sorted(set(payload_floats), key=abs)
+print("PAYLOAD floats (%d, %d unique): " % (len(payload_floats), len(uniq)))
+print("  ", uniq)
+
+# ---- (B) geometry-derived coefficients from the captured object ----
+objs = pickle.load(open(S + r'\vfull.pkl', 'rb'))['objs']
+allv = [v for o in objs for v in o]
+xs = sorted(set(round(v['mx'], 2) for v in allv)); zs = sorted(set(round(v['mz'], 2) for v in allv))
+grid = {(round(v['mx'], 2), round(v['mz'], 2)): v for v in allv}
+
+def plane(x0, y0, v0, x1, y1, v1, x2, y2, v2):
+    det = (x1-x0)*(y2-y0) - (x2-x0)*(y1-y0)
+    if abs(det) < 1e-9: return None
+    A = ((v1-v0)*(y2-y0) - (v2-v0)*(y1-y0))/det
+    B = ((v2-v0)*(x1-x0) - (v1-v0)*(x2-x0))/det
+    C = v0 - A*x0 - B*y0
+    return A, B, C
+
+# for each grid quad, compute edge slopes + z-plane (screen space) coefficients
+edgeAB = []; zplanes = []
+for i in range(len(xs)-1):
+    for j in range(len(zs)-1):
+        a = grid[(xs[i], zs[j])]; b = grid[(xs[i+1], zs[j])]; c = grid[(xs[i], zs[j+1])]
+        tri = [a, b, c]
+        for k in range(3):
+            p, q = tri[k], tri[(k+1) % 3]
+            dx = q['sx'] - p['sx']; dy = q['sy'] - p['sy']
+            L = math.hypot(dx, dy) or 1
+            edgeAB.append((round(-dy/L, 5), round(dx/L, 5)))     # normalised edge normal
+        zc = plane(a['sx'], a['sy'], a['mz'], b['sx'], b['sy'], b['mz'], c['sx'], c['sy'], c['mz'])
+        if zc: zplanes.append(tuple(round(v, 5) for v in zc))
+edge_vals = sorted(set(v for e in edgeAB for v in e), key=abs)
+zA = sorted(set(z[0] for z in zplanes), key=abs)
+print("\nGEOMETRY edge normal components (%d unique):" % len(edge_vals))
+print("  ", edge_vals[:40])
+print("\nGEOMETRY z-plane A (dz/dx) values (%d):" % len(zA))
+print("  ", zA[:20])
+
+# ---- (C) look for matches ----
+print("\nMATCHES (payload float ~= a geometry coefficient, tol 5%):")
+geo_all = set(edge_vals) | set(zA) | set(z[1] for z in zplanes)
+hits = 0
+for pf in uniq:
+    for gv in geo_all:
+        if gv != 0 and abs(pf - gv) < 0.05 * max(abs(pf), abs(gv)) + 1e-4:
+            print("  payload %.5f  ~  geometry %.5f" % (pf, gv)); hits += 1; break
+print("total matches:", hits, "/", len(uniq))
diff --git a/emulator/firmware-decomp/render-readout.html b/emulator/firmware-decomp/render-readout.html
index b372c9b..dc200fb 100644
--- a/emulator/firmware-decomp/render-readout.html
+++ b/emulator/firmware-decomp/render-readout.html
@@ -262,6 +262,14 @@
 +01c  <span class="ad">00000022</span>   <span class="cm">; bit-plane 0x22 …</span></pre>
       </div>
     </div>
+    <p class="sub" style="margin-top:14px">Pull the floats out of those payloads and they
+    line up into clean <b>×2 chains</b> —
+    <span class="mono">0.0079 · 0.016 · 0.032 · 0.063 · 0.126 · 0.252 · 0.504 · 1.009</span> —
+    a coefficient stored as its binary place values <span class="mono">C·2ᵏ</span>, one per
+    bit-plane, exactly how a bit-serial adder holds a number. The recovered bases match the
+    object's own edge and z slopes computed from the captured vertices — so the coefficients
+    feeding the array simulator (§05) are <b>cross-validated against the compiled stream the
+    hardware actually shipped</b>.</p>
   </section>
 
   <section>