Time to cast a wider net, but I'm not a fan of the "throw 58 hashtags at it to see what sticks" shotgun approach, so I'll just ask the handful of #PERQ nuts still around to look to their left, look to their right, and point out the person who might have the PNX sources or documentation I seek. (If it's neither of them, maybe it's YOU! Go get that dusty old box of 8" floppies from the back of that shelf and bust out the Catweasel.)
Because surely someone, somewhere, remembers SERC, the 1980s, Chilton, RAL, ICL Dalkieth, PNX, etc. -- and squirreled away some docs, or diskettes, or even a whole PERQ with *some* information about the "C-Codes" instruction set and virtual C machine architecture of PNX. NMOC? Bletchley Park? Beuller? Anyone? There can't possibly still be concerns about throwing a copy of the sources over the transom 40 years on for research and preservation.
In the meantime, reverse engineering the kernel's microcode debugger is arduous and painstaking. Here's where we're at after a floppy or hard disk boot: both halt in a similar manner, somewhere at or before attempting to tekload the updated Z80 firmware. I'll get there, eventually, through sheer doggedness. But PNX kernel hackers of yore, lurking in #vintagecomputing, long free of ICL's closed-source bloody-mindedness, chime in anytime. :-)