H8/536 loc_3E54 Report Source Trace

Queue function: H'3E54
Report index of interest: 0x0007
Direct callers: 5
Direct static 0x0007 hits: 0
Dynamic/unknown candidates: 3

Conclusion: No direct loc_3E54 caller in this JSON statically loads report index 0x0007. 0x0007 remains an observed runtime/capture value unless another indirect or table-dispatch path is proven.

Call sites:
- H'15F6 in loc_15E0: R2.bit7=set, R3=0x0081 (constant); direct_0x0007=False
  R2 evidence: H'15F1 MOV:E.B #H'80, R2
  R3 evidence: H'15F3 MOV:I.W #H'0081, R3
- H'1A11 in loc_19DB: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
  R2 evidence: H'1A0D MOV:E.B #H'80, R2
  R3 evidence: H'1A0F MOV:G.W R5, R3
  table/context hints: H'1A09 current_value_table_candidate via @(-H'1800,R3)
- H'1A79 in loc_1A35: R2.bit7=set, R3=<dynamic> (dynamic/table-derived); direct_0x0007=False
  R2 evidence: H'1A75 MOV:E.B #H'80, R2
  R3 evidence: H'1A77 MOV:G.W R5, R3
  table/context hints: H'1A71 current_value_table_candidate via @(-H'1800,R3)
- H'26A8 in loc_2650: R2.bit7=unknown, R3=<dynamic> (unknown); direct_0x0007=False
- H'4926 in loc_48FA: R2.bit7=set, R3=0x00F6 (constant); direct_0x0007=False
  R2 evidence: H'4921 MOV:E.B #H'80, R2
  R3 evidence: H'4923 MOV:I.W #H'00F6, R3

Caveats:
- This is a bounded local static trace, not an emulator run.
- R3 values classified as dynamic/table-derived may still become 0x0007 at runtime.
- Indirect dispatch, table handlers, interrupt interleavings, or callers absent from the JSON may still enqueue 0x0007.
- The generic queue-to-TX path only emits queued entries; this tracer looks for direct report-index sources at loc_3E54 callers.