diff --git a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
index 6290bb7..96ef9bd 100644
--- a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
+++ b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
@@ -184,6 +184,33 @@ dump more words; (2) implement the sweep ops (0x21/0x25 pair = bit-serial
 add/carry per IGCOPS.C MEMpluseqMEM semantics) + run the whole per-tile program
 in igc_exec; (3) bars.
 
+## GOLDMINE: PXPL5SUP/ADDR + PXPL5SUP/DUMP (found 2026-07-17 late)
+
+**ADDR** = a literal fragment of the missing igc_opco.h — exact bases:
+`I_MCWRITE=0x20000|(a&0x1ff)<<8, I_MCREAD=(a&0x1ff)<<8, MEMintoENAB=0x300,
+ENABandeqMEM=0x500, ENABandeqMEMBAR=0x800, SEDGE=0x400a00, CRYintoMEM=0xb300,
+ENABintoMEM=0xb500, MEMoreqENAB=0xb700, MEMandeqENAB=0xb900, OVFIX=0x8000e600,
+ENABxoreqMEM=0x10a00, MEMEDGE=0x413c00, SEDGEBAR=0x413f00` (+ P_* second-word
+forms: bare (addr&0xff)).
+
+**DUMP** = pxpl5tst run log that PRINTS the op table with names:
+`SETENABS=0x100, CLRENABS=0x200, TREEltZERO_L3=0x3ae94200,
+TREEgeZERO_L3=0x3ae80d00, MEMltTREE_L3=0x44ea2120(texz)/0x...61(zbuf),
+TREEintoMEM_L0(zbuf)=0x438a4320, TREEintoMEM_L3: diff=0x3daa4352 spec=0x3daa435a
+texu=0x41aa4362 texv=0x41aa4372 texz=0x41aa4382` — plus TWO complete live
+triangle packets word-by-word (edges {0x3ae94200,A,B,C}×3 with real coefficients,
+z-test 4W, z-write 1W, diff/spec/texu/texv/texz planes 4W each, SCAintoMEM
+0x0910f734+1.0). SUPCODES = the emission-sequence listing.
+
+**RETROACTIVE UNIFICATION:** the old tri_recover stride-0x10 groups' "scale
+≈0.00178" IS 0x3ae94200 read as a float — those DRAM groups were always
+{TREEltZERO_L3, A, B, C} edge instructions. The direct-float DPL3 packet format
+(already in igc_exec.py) is what per-triangle payloads use; the fixed
+33/41/69-word blocks are the eof/background program (bars). Remaining unnamed:
+the eof-block ops 0xfa/0x7c/0x1f/0xf2/0x97/0x05/0x49/0x30/0x75/0xdb (builder =
+one linear fn 0xf041ee30-0xf041f7b0, per-word pcs logged in builder_trace2.log —
+disasm each site to name them).
+
 ## NEXT (the miner)
 Write `eofs_mine.py`: parse EOF.S per function; track `st.l`/`fst.l` stores
 through the coeff pointer; recover, in order, each emitted word (int literals