ROOT-CAUSE MECHANISM LOCATED

METHODOLOGY CORRECTION: F140's "all #$E0 loads" enumeration was TRUNCATED by grep pagination (head_limit 60) and missed $FE6F — re-verify enumerations are exhaustive before negative conclusions. THE MECHANISM: every JSR in the emitted sub_00FE16 carries the unwind guard if (trampoline_target) return; if (rts_target != expected) return;.

Raw traces, ROM material, local paths, and personal data are not part of this public record.