I've worked out two more envelope parameters. Parameter 112 is some kind of linearity control for the attack phase for the amp envelope. A value of 127 makes it (hearing-wise) linear; the attack rises smoothly like you would expect. A value of 0 makes it highly exponential; the envelope barely rises until near the end of the attack time, where it "turns the corner" and rises very abruptly to the peak value; it's almost like having a delay followed by a very short attack. The default value is 127, which it returns to anytime you move either the attack knob or the decay knob on the panel.
Parameter 113 sets the amount of time the envelope holds at the attack peak before the decay phase begins. The range appears to be 0-99, with 0 being the minimum. It returns to 0 when you move the decay knob on the panel.