diff --git a/docs/hardware-plan.md b/docs/hardware-plan.md
index 6234389..0f6e15f 100644
--- a/docs/hardware-plan.md
+++ b/docs/hardware-plan.md
@@ -1,8 +1,8 @@
 # Hardware Plan — flexible MIDI router (v1)
 
-Status: draft 2026-08-21. Custom all-in-one PCB, desktop, USB-powered, 0-10 V
-CV via onboard boost, 3.5 mm TRS MIDI, 4× stereo CV, 64×32 OLED + tact buttons
-(no encoder, low profile).
+Status: draft 2026-08-21. Custom all-in-one PCB, desktop, USB-powered, **bipolar
+±10 V CV** via onboard ±12 V rails, 3.5 mm TRS MIDI, 4× stereo CV, 64×32 OLED +
+tact buttons (no encoder, low profile).
 
 **MCU target:** develop/test on **RP2040** (Pico W dev board — the firmware
 already runs on it), product on **RP2350**. The RM2 radio module is compatible
@@ -29,9 +29,9 @@ USB-C 5V ──┬── 3.3 V buck ── RP2040 + W25Q16 flash + RM2 module (C
            │                   ├── I2C1 ───── 64×32 SSD1306 OLED
            │                   └── GPIOs ──── 4× tact buttons (UI)
            │
-           └── 12 V boost ── CV op-amp rails (+12 V) ── 4× stereo TRS (8 CV/gate)
+           └── ±12 V rails (boost + inverter) ── CV op-amps ── 4× stereo TRS (8 CV/gate)
                   │
-   4.096 V ref ── DAC ── op-amp gain ×2.44 ── 0-10 V ── 1 k series + TVS ── TRS tip/ring
+   4.096 V ref ── DAC (0-4.096 V) ── op-amp gain ×4.88, offset −10 V ── ±10 V ── 1 k + bidir TVS ── TRS tip/ring
 ```
 
 ## 2. RP2040 pin map
@@ -59,30 +59,62 @@ No conflicts; GP14/15 (USB) and GP23-25/29 (CYW43) kept clear of everything else
 ## 3. Power tree (USB-only, with CV boost)
 
 - USB-C 5 V → polyfuse + ESD → **VBUS_5V**.
-- VBUS_5V → **3.3 V buck** (RT6150 / TPS62A01) → RP2040, CYW43, flash, DAC VDD,
-  OLED, pull-ups. Budget ~400 mA peak (CYW43 BT/WiFi TX spikes).
-- VBUS_5V → **12 V boost** (MT3608 / TPS61088, ~80 mA) → +12 V CV op-amp rail,
-  LC-filtered (pitch noise).
-- **4.096 V reference** (REF3040 / LM4040-4.096) for the DAC — NOT the 3.3 V
-  rail (too noisy for 1 V/oct pitch).
+- VBUS_5V → **3.3 V buck** (RT6150B-33GQW) → RP2040, RM2, flash, DAC VDD,
+  OLED, pull-ups.
+- VBUS_5V → **+12 V boost** (TPS61088 + LC filter) → +12 V CV op-amp rail.
+- VBUS_5V → **−12 V inverter** (TPS63700 + LC filter) → −12 V CV op-amp rail.
+  Both rails feed the bipolar CV op-amps. Low current (~20 mA each), LC-filtered.
+- **4.096 V reference** (REF3040AIDBZ) for the DAC, and a **2.048 V mid-ref**
+  (buffered divider or REF2040) for the bipolar offset — NOT the 3.3 V rail
+  (too noisy for 1 V/oct pitch).
 
-Rationale: USB-only power (single cable, no external PSU) while still delivering
-0-10 V CV via a small boost. The boost + LC filter + dedicated Vref keeps pitch
-clean. If 0-5 V (5 octaves) is acceptable, drop the boost and use RRO op-amps
-on 5 V (simpler, fewer parts, but half the CV range).
+**Power budget (BLE-only):** we use Bluetooth only, never WiFi TX. The cyw43
+driver must load the WiFi firmware to bring up BT (BT-only init isn't supported
+yet), but WiFi never transmits → power stays at BLE levels, not WiFi-TX levels.
 
-## 4. CV analog section (4 stereo = 8 channels)
+| Rail / consumer        | Typical   | Peak     |
+|------------------------|-----------|----------|
+| RM2 (BLE TX, no WiFi TX)| ~30 mA @3.3 V | ~80 mA |
+| RP2040 / RP2350        | ~30 mA    | ~50 mA   |
+| DAC8568                | ~2 mA     | ~2 mA    |
+| OPA4192 ×2 (quiescent) | ~9 mA @±12 V | ~9 mA |
+| OLED SSD1306           | ~20 mA    | ~40 mA   |
+| ±12 V rails load (op-amps + DAC out) | ~20 mA @12 V → ~50 mA @5 V (×2 converters, ~85% eff) | ~60 mA @5 V |
+| MIDI out LED (brief)   | —         | ~15 mA @3.3 V |
+| **Total from 5 V**     | **~180-230 mA** | **~330-380 mA** |
 
-- **DAC:** 8-channel 16-bit SPI (DAC8568 or AD5668), Vref = 4.096 V → 0-4.096 V out.
-  16-bit over 0-10 V ≈ 0.15 mV/step ≈ 0.002 semitone — plenty for 1 V/oct pitch.
-- **Scaling:** non-inverting op-amp, gain ×2.44 → 0-10 V from the 4.096 V DAC
-  span, rail = +12 V. Needs rail-to-rail-output (TL074 is NOT RRO and can't do
-  0-10 V on a single +12 V rail). Use **OPA4192** (quad RRO) ×2 for 8 channels,
-  or TLV9154.
+Fits USB 2.0 (500 mA) with headroom; USB-C default (900 mA) is comfortable.
+If WiFi TX were ever enabled, RM2 spikes to ~350 mA and the total approaches
+~650 mA — stay BLE-only or require a USB-C 1.5 A/3 A source.
+
+Rationale: USB-only power (single cable, no external PSU) while delivering
+bipolar ±10 V CV via two small low-current rails. The LC filters + dedicated
+Vref keep pitch clean.
+
+## 4. CV analog section (4 stereo = 8 channels, bipolar ±10 V)
+
+- **DAC:** 8-channel 16-bit SPI (DAC8568IAPW), Vref = 4.096 V → 0-4.096 V out.
+  16-bit over ±10 V (20 V span) ≈ 0.3 mV/step ≈ 0.003 semitone at 1 V/oct —
+  plenty for pitch.
+- **Bipolar scaling:** each channel maps 0-4.096 V → −10 V…+10 V. Difference
+  amp: `Vout = 4.88·(Vdac − 2.048)` where 2.048 V is the mid-reference
+  (buffered divider from the 4.096 V ref, or REF2040). At Vdac=0 → −10 V,
+  Vdac=2.048 → 0 V, Vdac=4.096 → +10 V. Per-channel gain/offset trimpot for
+  pitch calibration (0.2 % ref → ~±20 mV untrimmed ≈ 0.02 semitone — trimmable
+  to <1 mV).
+- **Op-amps:** OPA4192IPWR (quad, RRO, 25 µV offset) ×2 on the ±12 V rails.
+  RRO needed to reach ±10 V cleanly on ±12 V (TL074 clips at ±~10.5 V — too
+  close; OPA4192 swings to ±11.9 V).
 - **Per-channel model:** every CV channel is an independent
-  `(midi_channel, function)` sink (pitch/gate/velocity/CC). Gate = DAC channel
-  driven to 0 or 10 V (keeps the routing uniform; no separate gate GPIOs).
-- **Output protection:** 1 kΩ series + TVS per output to TRS tip/ring.
+  `(midi_channel, function, polarity)` sink. The output stage is always
+  bipolar-capable (±10 V); the function decides the mapping:
+  - pitch → 0…+10 V (note/12, standard unipolar-positive on a bipolar output)
+  - gate → 0/+10 V (or 0/+5 V)
+  - velocity → 0…+10 V (vel/127·10)
+  - CC (unipolar) → 0…+10 V; CC (bipolar) → −10…+10 V (cc/127·20 − 10)
+  Gate = a DAC channel driven to 0/+10 V (keeps routing uniform).
+- **Output protection:** 1 kΩ series + **bidirectional TVS** per output (outputs
+  swing negative) to TRS tip/ring.
 
 ## 5. MIDI TRS (3.5 mm) — 2 jacks (in + out), TRS-A wiring
 
@@ -116,30 +148,45 @@ Host PCB responsibilities (from the RM2 datasheet):
 - **Antenna keepout area** must remain free of metal per the datasheet for
   the module's PCB antenna to perform.
 
-## 8. BOM sketch
+## 8. BOM (concrete parts)
 
-- RP2040 (dev) / **RP2350A** (product) MCU, W25Q16JV-equivalent flash,
-  **RM2 radio module (RMC20452T, CYW43439 + PCB antenna, pre-certified)**.
-- DAC8568IAPW (8-ch 16-bit SPI, TSSOP-16) — or AD5668.
-- OPA4192IPW ×2 (quad RRO op-amp, TSSOP-14).
-- REF3040AIDBZ (4.096 V ref, SOT-23).
-- 6N138 optocoupler (MIDI in).
-- USB-C receptacle; 6× 3.5 mm TRS jacks (2 MIDI + 4 CV stereo).
-- 3.3 V buck (RT6150/TPS62A01), 12 V boost (MT3608/TPS61088).
-- SSD1306 64×32 OLED; 4× low-profile SMD tact switches.
-- SWD 2×3 header (Picoprobe for first-flash).
-- Passives, polyfuse, TVS array.
+| Ref | Part | Package | Notes |
+|-----|------|---------|-------|
+| MCU | RP2040 (dev) / RP2350A (product) | QFN-56 / QFN-60 | dual target via embassy-rp features |
+| Flash | W25Q32JVSSIQ | SOIC-8 | 32 Mb (4 MB) — Rust firmware + blobs ~870 KB UF2, headroom for router code |
+| Radio | RM2 module RMC20452T | 16.5×14.5 mm, 21-pad | CYW43439 + PCB antenna, pre-certified |
+| DAC | DAC8568IAPW | TSSOP-16 | 8-ch 16-bit SPI, external Vref mode (AD5668BRUZ-1 alt) |
+| Op-amp | OPA4192IPWR ×2 | TSSOP-14 | quad RRO, 25 µV offset, on ±12 V rails — pitch-accurate |
+| Vref | REF3040AIDBZ | SOT-23 | 4.096 V DAC ref, 0.2%, 30 ppm/°C |
+| Mid-ref | REF2040AIDBZ (or buffered divider) | SOT-23 | 2.048 V bipolar offset reference |
+| Calib | 8× trimpot (e.g. 3296W) | THT/SMD | per-channel gain/offset trim |
+| MIDI opto | 6N138 | DIP-8 / SMD | MIDI in isolation |
+| 3.3 V reg | RT6150B-33GQW | QFN | buck-boost, 800 mA, Pico-proven (TPS62A01 alt) |
+| +12 V boost | TPS61088 | QFN | 5→12 V, low-noise + LC filter |
+| −12 V inverter | TPS63700 | SOT-23-6 / QFN | 5→−12 V, low-noise + LC filter (LM2611 alt) |
+| Display | SSD1306 64×32 OLED | 0.42" I2C | — |
+| Jacks | 6× 3.5 mm TRS | SMD | 2 MIDI + 4 CV stereo |
+| USB | USB-C receptacle | SMD | 5 V data + power |
+| UI | 4× low-profile tact | SMD | Up/Down/Select/Back (no encoder) |
+| Debug | 2×3 SWD header | THT | Picoprobe first-flash |
+| — | polyfuse, bidirectional TVS array, passives | — | bipolar output protection + rail protection |
 
 ## 9. Risks / open items
 
-1. **0-10 V CV noise from the boost** — LC filter + dedicated 4.096 V Vref.
-2. **Custom RP2040 bring-up** — needs a SWD header + Picoprobe; USB bootloader
+1. **Bipolar ±10 V offset/gain calibration** — the 2.048 V mid-ref and ×4.88
+   gain set the 0 V center and ±10 V span; 0.2 % ref → ~±20 mV untrimmed
+   (≈0.02 semitone). Per-channel trimpots trim gain + offset to <1 mV; or
+   calibrate in firmware (measure + store correction) to avoid trimpots.
+2. **±12 V rail noise on pitch** — two switching converters (+12 V boost,
+   −12 V inverter); LC filter both rails + 4.096 V/2.048 V refs are the pitch
+   reference, not the rails, so op-amp PSRR + filtering keeps it clean.
+3. **Custom RP2040 bring-up** — needs a SWD header + Picoprobe; USB bootloader
    only works after first flash.
-3. **64×32 OLED UI** — tight; menu must be paginated and minimal.
-4. **Boost current budget** — RM2 TX spikes + 8 CV op-amps on a single USB
-   5 V/500 mA (USB 2.0) port is tight; specify USB-C 5 V/900 mA-3 A, or limit
-   CV op-amp current.
-5. **RM2 antenna keepout** — follow the datasheet keepout; the one layout
+4. **64×32 OLED UI** — tight; menu must be paginated and minimal.
+5. **Boost current budget** — RM2 TX spikes + 8 CV op-amps + two converters on
+   a single USB 5 V/500 mA port is tight; BLE-only keeps it ~330-380 mA peak
+   (fits), but specify USB-C 5 V/900 mA for headroom.
+6. **RM2 antenna keepout** — follow the datasheet keepout; the one layout
    constraint the radio imposes.
 
 ## 10. Build order (hardware)
@@ -147,8 +194,8 @@ Host PCB responsibilities (from the RM2 datasheet):
 1. Schematic (this doc is the spec).
 2. RM2 module footprint + antenna keepout.
 3. RP2040 + flash + USB + SWD.
-4. Power (3.3 V buck, 12 V boost, Vref).
-5. CV analog (DAC + op-amps + protection + TRS).
+4. Power (3.3 V buck, +12 V boost, −12 V inverter, 4.096 V + 2.048 V refs).
+5. CV analog (DAC + difference-amp + offset + trim + bidir protection + TRS).
 6. MIDI TRS circuit.
 7. OLED + buttons.
 8. Keypad header (the Pimoroni keypad connects via a header or is integrated).