@@ -90,10 +90,14 @@ one and move their funds.
 
 Origo exists to make that class of bug structurally impossible rather than
 merely unlikely. There is no RNG-to-seed code path for a misconfigured build
-flag to misroute in the first place: a mnemonic is a pure function of a
-canonical transcript the human recorded by hand — dice, coins or cards —
-reduced with SHA256, and, as stated just above, the device RNG plays no part
-in it. A firmware regression that silently swapped the entropy source behind
+flag to misroute in the first place: a mnemonic is a pure function of what the
+human recorded by hand — dice, coins or cards — and, as stated just above, the
+device RNG plays no part in it. Two derivations turn that record into words,
+both deterministic and neither touching the RNG: the transcript reduced with
+SHA256, which every source uses, and — for coins only — the flips packed
+straight into the entropy without a hash, which is the one path a reader can
+check against a printed wordlist with no device at all. Both are described
+below. A firmware regression that silently swapped the entropy source behind
 a device owner's back, the same shape of bug that cost Coldcard users tens of
 millions of dollars, has nothing to act on here: stub the RNG out entirely
 and Origo generates the identical mnemonic.
@@ -133,6 +137,10 @@ count 12-word cards uses.
 
 ### From transcript to mnemonic
 
+This is what every source does, and what `Coin flips` does under **Flip and
+hash**. The alternative for coins, which skips the hash so the arithmetic can
+be checked by hand, is [described below](#flipping-words-directly).
+
 Turning that transcript into words is three mechanical steps, always in this
 order, and nothing else touches them: no RNG, no timestamp, no per-device
 salt.
@@ -170,6 +178,43 @@ Neither path ever reads the device RNG. The entropy quality bar described
 next grades what has already been typed; it cannot add or remove a single bit
 from what gets hashed.
 
+### Flipping words directly
+
+`Coin flips` offers that same unhashed arithmetic as a second method, **Flip
+each word**, reached by flipping the words rather than typing them. It exists
+because coins are the one source a person can convert to BIP39 words by hand,
+and hashing throws that away: re-entering a transcript elsewhere reproduces the
+mnemonic, but nobody checks on paper that word 7 is the word their coin
+produced, because checking it means computing SHA256 of a 128-character string.
+
+The wordlist is exactly 2048 long, so eleven flips name one word — every word
+reachable, none favoured, no rejection sampling and no modulo skew. Heads is 1,
+tails is 0, most significant bit first:
+
+```
+00000000000  ->  0001  ->  abandon
+01100110011  ->  0820  ->  grid
+11111111111  ->  2048  ->  zoo
+```
+
+Eleven such words are 121 bits, so seven loose flips finish the 128 a 12-word
+mnemonic needs and BIP39's checksum supplies the twelfth word; 24 words is
+twenty-three words and three loose flips for 256. The flip count is identical
+to the hashed method's — 128 or 256 — so neither method asks for more coin
+tosses than the other, and neither has more entropy behind it.
+
+The final word is the one step a wordlist alone cannot do, since part of it is
+the checksum. That is the same arithmetic `Complete checksum` above performs,
+reached from a different direction.
+
+There is no quality bar on this path, deliberately: eleven flips are eleven
+bits by construction, nothing is being estimated, and a gate could only
+second-guess the reader's coin. The hashed method keeps its bar unchanged.
+
+`tools/origo_verify.py complete` checks the result — convert each group of
+eleven flips against a printed wordlist, then hand it those words and the loose
+flips.
+
 ### The quality bar
 
 Every source's run opens on a screen naming how many rolls, flips or cards it
@@ -654,10 +699,17 @@ BIP39, BIP32, BIP84, BIP86 and Bech32/Bech32m. Examples:
 ```sh
 python3 tools/origo_verify.py generate d20 --words 12 1 2 3 ...
 python3 tools/origo_verify.py complete "abandon ... abandon" 0000000
+python3 tools/origo_verify.py coin-words 0110011001101100110011...   # 128 flips
 python3 tools/origo_verify.py inspect "abandon ... about" --index 0
 python3 tools/origo_verify.py inspect "abandon ... about" --index 0 --change
 ```
 
+`coin-words` reproduces the Flip-each-word method from the flips alone,
+printing each group of eleven with the word it names before the finished
+mnemonic — so the device's screens can be checked one at a time, or the whole
+run at once. It is the same arithmetic `complete` performs, entered from the
+coins rather than from words already converted by hand.
+
 `inspect` prints the checksum verdict, one-based word numbers, the Compact
 SeedQR payload, master fingerprint, both account xpubs, the exact payload of
 both account key QR codes, both addresses and both output descriptors, so
 
@@ -38,6 +38,80 @@ static const char mnemonic24[]
 static const char bad_checksum_mnemonic[]
     = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon";
 
+/* Eleven flips name one word, most significant bit first, and the words they
+ * name are handed to seedtool_complete_checksum - the same call the typed-word
+ * flow makes. The screen that shows the reader "these eleven flips are word
+ * 0819" is only telling the truth if that index survives into the finished
+ * mnemonic unchanged, so that is what is checked, for every one of the 2048
+ * words rather than for a chosen few.
+ *
+ * The all-zero case is pinned to the published vectors the rest of this file
+ * already uses: eleven words of index 0 plus seven zero bits are 128 zero
+ * entropy bits, and twenty-three plus three zero bits are 256 - `mnemonic` and
+ * `mnemonic24`. That is the one case where the whole chain, checksum included,
+ * is fixed by something outside this project. */
+static bool coin_words_build_the_entropy(const size_t words, const uint16_t index, char* out, const size_t out_len)
+{
+    const size_t word_count = words == 12 ? 11 : 23;
+    const size_t tail_count = words == 12 ? 7 : 3;
+    char prefix[SEEDTOOL_MAX_MNEMONIC_LEN + 1] = { 0 };
+    uint8_t tail[7] = { 0 };
+    size_t used = 0;
+    for (size_t i = 0; i < word_count; ++i) {
+        const char* const word = seedtool_word(index);
+        const size_t len = strlen(word);
+        if (used + len + (i ? 1 : 0) >= sizeof(prefix)) {
+            return false;
+        }
+        if (i) {
+            prefix[used++] = ' ';
+        }
+        memcpy(prefix + used, word, len);
+        used += len;
+        prefix[used] = '\0';
+    }
+    return seedtool_complete_checksum(prefix, tail, tail_count, out, out_len) == SEEDTOOL_OK;
+}
+
+static bool coin_word_encoding_is_sound(void)
+{
+    char completed[SEEDTOOL_MAX_MNEMONIC_LEN + 1];
+
+    /* Zero flips, both lengths, against the published vectors. */
+    if (!coin_words_build_the_entropy(12, 0, completed, sizeof(completed)) || strcmp(completed, mnemonic) != 0) {
+        return false;
+    }
+    if (!coin_words_build_the_entropy(24, 0, completed, sizeof(completed)) || strcmp(completed, mnemonic24) != 0) {
+        return false;
+    }
+
+    /* Every word survives the trip, at both lengths: whatever the reader was
+     * shown on the confirmation screen is what the finished mnemonic spells. */
+    for (uint16_t index = 0; index < SEEDTOOL_WORDLIST_LEN; ++index) {
+        const size_t lengths[] = { 12, 24 };
+        for (size_t l = 0; l < 2; ++l) {
+            const size_t word_count = lengths[l] == 12 ? 11 : 23;
+            uint16_t numbers[24];
+            size_t count = 0;
+            if (!coin_words_build_the_entropy(lengths[l], index, completed, sizeof(completed))
+                || seedtool_mnemonic_word_numbers(completed, numbers, 24, &count) != SEEDTOOL_OK
+                || count != lengths[l]) {
+                return false;
+            }
+            for (size_t i = 0; i < word_count; ++i) {
+                if (numbers[i] != index + 1) {
+                    return false;
+                }
+            }
+        }
+    }
+
+    /* An eleven-bit index is the whole wordlist and nothing past it: the top
+     * index must be reachable, and the encoding must not overflow into a
+     * twelfth bit. */
+    return SEEDTOOL_WORDLIST_LEN == (1u << 11);
+}
+
 /* `count` words, all "abandon" when `spread` is zero and a spread of the
  * wordlist otherwise.
  *
@@ -433,6 +507,7 @@ static bool word_numbers_round_trip_is_sound(void)
 static const char* const menu_labels[] = { "Master fingerprint", "Native SegWit (BIP84)", "Taproot (BIP86)",
     "Account key", "Addresses", "Account key format", "xpub", "zpub", "Erase and restart", "New Seed", "From entropy",
     "Restore Seed", "Complete checksum", "About", "Settings", "11 words + 7 coins", "23 words + 3 coins",
+    "Coin method", "Flip each word", "Flip and hash",
     "No passphrase", "Enter passphrase", "D6 dice", "D20 dice", "Coin flips", "Cards", "Back", "12 words",
     "24 words", "[delete]", "[back]", "Type the letters", "Enter word numbers", "Plain text", "Backup",
     "Stackbit 1248", "Compact SeedQR", "Simple grid", "Physical layout" };
@@ -448,6 +523,37 @@ static bool labels_fit_a_row(void)
     return true;
 }
 
+/* The coin-word screens are not choice lists, but they are stacked text at a
+ * fixed y: draw_centered wraps a line too wide for the display rather than
+ * cutting it, and the wrapped remainder would land on top of the line below.
+ * The word's number and the word itself are on one of those lines, so the
+ * check runs over all 2048 rather than over a chosen few.
+ *
+ * seedtool_render_fit_row measures against the choice list's text column,
+ * which is narrower than the full width these screens centre in - a
+ * conservative bound, and the one measurement this file can reach. */
+static bool coin_word_screens_fit(void)
+{
+    static const char* const fixed[] = { "Word 11 of 23", "Final bits", "Flip word 11 again?",
+        "These flips are lost", "11111111111", "Heads (up)   Tails (down)" };
+    for (size_t i = 0; i < sizeof(fixed) / sizeof(fixed[0]); ++i) {
+        if (seedtool_render_fit_row(fixed[i]) != strlen(fixed[i])) {
+            return false;
+        }
+    }
+    for (uint16_t index = 0; index < SEEDTOOL_WORDLIST_LEN; ++index) {
+        char subject[32];
+        (void)snprintf(subject, sizeof(subject), "%04u  %s", (unsigned)index + 1u, seedtool_word(index));
+        if (seedtool_render_fit_row(subject) != strlen(subject)) {
+            return false;
+        }
+        if (seedtool_render_fit_row(seedtool_word(index)) != strlen(seedtool_word(index))) {
+            return false;
+        }
+    }
+    return true;
+}
+
 /* Scrolling is only navigation if the selection is always on screen and the end
  * of a list looks like the end of it. Both hold for every list the firmware can
  * build, from any previous scroll position, so both are checked exhaustively. */
@@ -1577,6 +1683,14 @@ static int self_test(void)
         fputs("Origo word number round-trip self-test failed\n", stderr);
         return 1;
     }
+    if (!coin_word_encoding_is_sound()) {
+        fputs("Origo coin word encoding self-test failed\n", stderr);
+        return 1;
+    }
+    if (!coin_word_screens_fit()) {
+        fputs("Origo coin word screen fit self-test failed\n", stderr);
+        return 1;
+    }
     if (!final_word_filter_is_exact()) {
         fputs("Origo final word filter self-test failed\n", stderr);
         return 1;