further digging and basic emulator

build/rom_report_sources.txt

@@ -0,0 +1,32 @@
+H8/536 loc_3E54 Report Source Trace
+
+Queue function: H'3E54
+Report index of interest: 0x0007
+Direct callers: 5
+Direct static 0x0007 hits: 0
+Dynamic/unknown candidates: 3
+
+Conclusion: No direct loc_3E54 caller in this JSON statically loads report index 0x0007. 0x0007 remains an observed runtime/capture value unless another indirect or table-dispatch path is proven.
+
+Call sites:
+- H'15F6 in loc_15E0: R2.bit7=set, R3=0x0081 (constant); direct_0x0007=False
+  R2 evidence: H'15F1 MOV:E.B #H'80, R2
+  R3 evidence: H'15F3 MOV:I.W #H'0081, R3
+- H'1A11 in loc_19DB: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
+  R2 evidence: H'1A0D MOV:E.B #H'80, R2
+  R3 evidence: H'1A0F MOV:G.W R5, R3
+  table/context hints: H'1A09 current_value_table_candidate via @(-H'1800,R3)
+- H'1A79 in loc_1A35: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
+  R2 evidence: H'1A75 MOV:E.B #H'80, R2
+  R3 evidence: H'1A77 MOV:G.W R5, R3
+  table/context hints: H'1A71 current_value_table_candidate via @(-H'1800,R3)
+- H'26A8 in loc_2650: R2.bit7=unknown, R3=<dynamic> (unknown); direct_0x0007=False
+- H'4926 in loc_48FA: R2.bit7=set, R3=0x00F6 (constant); direct_0x0007=False
+  R2 evidence: H'4921 MOV:E.B #H'80, R2
+  R3 evidence: H'4923 MOV:I.W #H'00F6, R3
+
+Caveats:
+- This is a bounded local static trace, not an emulator run.
+- R3 values classified as dynamic/table-derived may still become 0x0007 at runtime.
+- Indirect dispatch, table handlers, interrupt interleavings, or callers absent from the JSON may still enqueue 0x0007.
+- The generic queue-to-TX path only emits queued entries; this tracer looks for direct report-index sources at loc_3E54 callers.