Not only was that theory correct, but ALL bank-switched ROMs track a single bank switch state, and toggle on every 1060 instruction, regardless of from what ROM address the 1060 is fetched. This is unlike the bank-switching on the HP-41C, where every 4K address block that supports bank switching tracks its own independent bank switch status.
Now the 34C, 38E, and 38C limp along somewhat. Most basic math functions on the 34C are working correctly. The 38E and 38C aren’t working quite as well. In a 38C trace from a cold start (“Pr Error”) through two presses of the “1″ key, I can see some differences. I’ll have to study the traces to figure out what instruction(s) I’ve implemented incorrectly. It may be the same bug that’s keeping the logarithmic and exponential functions of the 25 from working correctly.
I hope the bank switching on the 19C, 67, 92, 95C, and 97 works the same way, as that will save me a lot of effort.
[later] The trace shows a branch on no carry instruction not branching in the simulator though it does on the calculator. The instructions leading up to the branch instruction do in fact set up conditions such that the branch should not be taken, which means that there’s something going wrong earlier leaving incorrect state somewhere. This will be hard to track down, so I’ll take some more traces of various operations and hope that some of them show a discrepancy closer to the actual problem.