diff --git a/emulator/NET-NOTES.md b/emulator/NET-NOTES.md
index 05714a8..717c528 100644
--- a/emulator/NET-NOTES.md
+++ b/emulator/NET-NOTES.md
@@ -157,6 +157,47 @@ capture the console→pod egg exchange off the wire (hands us milestone 3).
 Sequence: real 6100 first (seeds image + capture) → SheepShaver as the
 archival console built from that image.
 
+## Console software EXTRACTED + protocol port FOUND (2026-07-04)
+
+The user unstuffed `410consoleArchive.sit` (via infinitemac.org) to
+`4_10extractedConsole/`. Contents: **`Console 4.10`** (the app), per-site
+config, fonts, logs. This means the dead 6100 is NOT a blocker — we have
+the console software directly; run it in SheepShaver (no disk image
+needed; fresh Mac OS 7.6.1/8.1 + MacTCP set to 200.0.0.1).
+
+- **App is PowerPC** — data fork magic `Joy!peffpwpc` (PEF/PowerPC),
+  Metrowerks CodeWarrior 1993-95; 3.4MB resource fork. Confirms
+  SheepShaver (needs standard shared libs: InterfaceLib/MathLib, present
+  in any 7.5+ install).
+- **`Console.ini`** is the master config: `[NetworkEndpoint::Cockpit::*]`
+  sections define every pod. **THE TCP PORT IS 1501** (`defaultPort` /
+  `localHostPort`) — this answers the milestone-3 "listen port unknown"
+  question. Console connects to each pod IP:1501; pod LISTENS on 1501.
+
+Cockpit endpoint roster (base Console.ini) — our emulated pod = **"Puck"
+200.0.0.113**:
+| cockpit | IP | hostType |
+|---|---|---|
+| Frequent Flyer | 200.0.0.11 (sic) | 0 |
+| Privateer | 200.0.0.112 | 0 |
+| **Puck** | **200.0.0.113** | 0 |
+| Carpe Diem | 200.0.0.114 | 0 |
+| Man O' War | 200.0.0.115 | 0 |
+| Divine Wind | 200.0.0.116 | 0 |
+| Icarus | 200.0.0.117 | 0 |
+| Gypsy | 200.0.0.118 | 0 |
+| Alpha Mission Review | 200.0.0.119 | 2 |
+| Alpha Camera | 200.0.0.120 | 2 |
+
+hostType 0 = playable cockpit, 2 = special (mission-review / camera ship).
+`ini Folder/` holds real per-venue configs (DBAtlanta/Chicago/Houston/
+Toronto/LaZerPark/... — the actual VWE centers), same .11x/1501 scheme.
+
+Revised topology: SheepShaver console @200.0.0.1 → TCP 200.0.0.113:1501 →
+pod "Puck". Remaining protocol unknown is just the on-stream message
+framing (NetworkPacketHeader + ReceiveEggFileMessage) — capture it once
+the console connects, or read it from network.hpp.
+
 ## Open questions / notes
 - Exact TCP listen port(s) — not in the source grep; get from NETNUB.EXE
   or a capture at milestone 3.