diff --git a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
index 08cbaa07..802601ee 100644
--- a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
+++ b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
@@ -295,3 +295,15 @@ Remaining to full purity: name the texz seed op + extract the real ramp table.
   store address lives in the TXDN engine descriptors, not the IGC program.
   => acceptance 2 needs a TXDN hardware model (DMA texture fetch -> io port ->
   the dn* unpack programs) — a real subsystem, the next mountain.
+
+## Texture-store hunt (2026-07-19)
+- NEGATIVE x2: neither the 'set_texmap_texels' wire commands nor action-26
+  produce bulk DRAM copy-writes — payloads are consumed IN PLACE.
+- Action-26 handler identified (dispatch @0xf040cf5c -> handler @0xf040ca30):
+  FIND_REMOTE lookup + malloc + list-link = an OBJECT-ATTACHED data upload.
+  The texture store is the OBJECT GRAPH (handle -> malloc'd chunk chain ->
+  wire payload data), not a flat region. Route to texels for rendering:
+  follow the registry (hash @0x1f660) from the texmap handle -> chunks; or
+  bind textures from the WIRE side (the capture's own payloads, keyed by the
+  create/act-42 handle pairs) + the per-tile texid config (the SEND(16)
+  block's 0x39/0xec scalar-region writes select the bound texture).