diff --git a/docs/modules.md b/docs/modules.md
index 4a418f8..0dc769e 100644
--- a/docs/modules.md
+++ b/docs/modules.md
@@ -34,15 +34,16 @@ All via the SMI bridge + command handler (transports.md carries the codes and th
 - **Standard PCS 3.32/3.33** — block lock, latched errored-block/BER counters, clear-on-read: the noise-stress error proxy.
 - **Retrain** — IEEE AN restart `7.0 |= bit9`, relinks in ~6 s.
 
-Documented in the handler table, not yet exercised (full transcription: `bcm84891l-mdio-commands.md`), in probe-priority order:
-- **GET_EEE_MODE 0x8008** — per-speed EEE mode (disabled / native / AutogrEEEn fixed / variable; 10G in DATA1 bits [1:0]). Probe first: the ODM's reference bring-up *advertises 10GBASE-T EEE* (`7.60 = 0x0008`, see `bcm84891l-sfp-registers.md`), and module-to-module LPI would corrupt loss and latency numbers. `SET_EEE_MODE 0x8009` can force it off (AN restart to apply).
-- **SET/GET_EEE_STATISTICS 0x801A/0x801B** — arm after link-up, then read TX(local)/RX(remote) LPI event counters or time durations. Direct evidence of whether EEE is actually happening on the wire, independent of what's advertised.
-- **Fast-retrain enables 0x800A/0x800B** — the datasheet titles these EMI_MODE but both descriptions read "SW Fast Retrain enable" (per-speed, DATA1=10G/DATA2=5G/DATA3=2.5G). Fast retrains mask marginal-cable events as sub-ms hiccups; knowing (and possibly controlling) the enable state matters when attributing loss bursts.
-- **CMD_GET_PAIR_SWAP 0x8000** — forced and current MDI pair mapping, 2 bits per pair: wiring/crossover verification.
-- **GET_LIMITED_REACH_MODE 0x8006** — DATA3 = "currently linked in limited-reach mode": the only handler-visible consequence of the DSP's internal cable-length estimate, a single short/long bit, and only meaningful when LR mode is enabled (a config change — measure-only by default).
-- **GET_SUB_LF_RF_STATUS 0x800D** — whether copper-TX local/remote fault codes pass through or are replaced with IDLE toward the line (SET/CLEAR 0x8011/0x8010): affects whether the far end can see faults at all.
-- **Host-interface health**: GET_XFI_TX_FILTERS 0x802B (FIR taps for the current speed), GET_XFI_POLARITY 0x802D, GET_USXGMII 0x8027 (DATA5 = MAC/PHY frequency unlock flag).
-- Pause-frame mode (0x801F/0x8020) turns out to be scoped to 2.5/5G idle-stuffing under 10G XFI WAP mode — inert in plain 10G operation.
+Probed on the bench unit (full command transcription: `bcm84891l-mdio-commands.md`); all GETs PASS; observed states:
+- **EEE / AutogrEEEn — force off at bringup, and trust the wire over the handler.** `GET_EEE_MODE` (0x8008) once returned DATA1 = 0x0047 — decoding as 10G AutogrEEEn *variable latency* plus 5G/1G native EEE, Broadcom's local-only power saving that never shows in the IEEE advertisement registers (7.60/7.61 read 0 throughout) — then read 0x0000 later with no SET in between: either live-then-cleared or an unreliable return (caveat below). Mitigation applied and verified: `SET_EEE_MODE` (0x8009) with explicit all-off params `(0, 0, 0x7A12, 0x480, 0)` + AN restart → mode reads 0, link and SNR healthy. cabletest should apply this defensively at startup. Wire-truth check: arm `SET_EEE_STATISTICS` (0x801A) after link-up, read `GET_EEE_STATISTICS` (0x801B) — zero LPI events/time observed on the idle link; repeat under traffic.
+- **Fast retrain: enabled** on 10G/5G/2.5G (0x800A → 1/1/1); IEEE 1.147 = 0x0019, retrain count bits zero since link-up. Keep it enabled and treat the 1.147 count as a per-run quality metric — a marginal cable that fast-retrains instead of dropping still shows up in the count.
+- **Pair map: identity** (`GET_PAIR_SWAP` 0x8000 → DATA2 = 0x00E4 = A/B/C/D straight through) — MDI wiring verification works.
+- **Faults pass through** (`GET_SUB_LF_RF_STATUS` 0x800D → 0; SET/CLEAR at 0x8011/0x8010 could mask them as IDLE — leave off).
+- **Host interface clean**: XFI polarity normal, TX FIR = main tap only (0x3C), KR/SyncE/USXGMII/WOL all disabled, MAC/PHY frequency locked, jumbo enabled at 9K, temp warnings off.
+- **1588 disabled** (0x8004 → 0); **limited-reach mode disabled** (0x8006 → 0), so its DATA3 linked-in-LR bit — the only handler-visible trace of the DSP length estimate — is unavailable without a config change.
+- Pause-frame mode (0x801F/0x8020) is scoped to 2.5/5G idle-stuffing under 10G XFI WAP mode — inert in plain 10G operation.
+
+**Firmware-reliability caveat.** Several documented DATA1 returns on this ODM firmware are untrustworthy: die-temperature-like values (0x43/0x44/0x46/0x47) appear in DATA1 of commands that should return modes, and repeat reads of the same GET disagree. Corroborate anything load-bearing through IEEE registers (7.60/7.61 for EEE advertisement) or wire behavior (EEE statistics under traffic), and write every DATA register explicitly before any SET (the handler never clears them).
 
 **No cable length.** The handler catalog is complete (§1.25.1.1–45: pair swap through WOL) and contains no ECD, length, or skew command. Cable length, opens/shorts, pair skew, and polarity live in the separate ECD register mechanism whose chapter FS hasn't sent. The 1588 engine is the same story: the PHY is IEEE 1588-2008 v2-compliant with a one-command enable (0x8004/0x8005) but its operation registers are undocumented — in-PHY timestamping would measure path delay at the MDI, taking PHY-pipeline latency out of the length equation entirely (open-questions.md §2). Until either chapter lands, FS-side length comes only from the NIC timestamp path — in contrast to the Aquantia oracle, whose `1E.C884` length register is fully documented.