diff --git a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
index 802601ee..3c251bf3 100644
--- a/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
+++ b/emulator/firmware-decomp/IGC-ENCODING-DERIVATION.md
@@ -307,3 +307,18 @@ Remaining to full purity: name the texz seed op + extract the real ramp table.
   bind textures from the WIRE side (the capture's own payloads, keyed by the
   create/act-42 handle pairs) + the per-tile texid config (the SEND(16)
   block's 0x39/0xec scalar-region writes select the bound texture).
+
+## TXDN hunt, morning session 2 (2026-07-19)
+- Full-memory verbatim scan at fxtest cmd 13000: action-26 payload bytes found
+  ONLY in the firmware low .data segment (0x7cb2/0xb3fe, byte-unaligned), and
+  those regions are IDENTICAL in cap7 -> the wire's a26 content DUPLICATES
+  static firmware tables (host .egg built from the same source tree), i.e. a26
+  = table/state uploads, and neither it nor the texmap float blocks persist
+  verbatim as bulk texels anywhere in memory at frame time.
+- Conclusion: texel data for the effects is TRANSFORMED on receipt (packed/
+  planarized by the handlers). The faithful route to acceptance 2 = trace ONE
+  texmap upload through its handler (watch the transform output address), or
+  model the TXDN io-port stream by instrumenting the DMA engine's TXDN path in
+  the emulator (the dn* unpack programs then define the texel wire format).
+- Registry census at cmd 13000: 1186 live objects (405 type-9 + 405 type-10
+  pairs = effect+texmap, 159 type-11, 48 type-8, ...).