any rom access with the magic byte would trigger the IO bit.
Yes, I was gonna ask you if you'd anticipated the challenge of avoiding spurious triggering. BTW I like how you and c0pperdragon seem inclined to think outside the box!
And maybe there's a solution to the challenge, but without SYNC you'd have to
detect some other condition or behavior that acts as a message saying, "Yes, this is the cue to say that occurrences of the magic byte (ie, undefined opcode)
aren't spurious and should be recognized."
After playing with that notion for a while, it struck me that, for something as simple as a Bitbang Serial Output, recognizing the magic byte is actually overkill. It would be sufficient to simply detect some other condition or behavior!
Given that they respond to program activity, address lines are to some extent under our control. But to set an address line high or low and have it
stay high or low means the program's activity would be very drastically constrained.
For example, it seems A12 will be unused, so you could use A12 as your Bitbang Serial Output, and set it and keep it high by jumping to an address that contains a one in that bit position. But the code at that location couldn't access zero page, because that'd cause A12 to go low for one or two cycles then return high.
So... instead of simply looking at an address line's present state, would it be better to look at a few samples of its recent history? A moment ago I said it'd be normal for A12 to go low for one or two cycles, and we know that's a very common event. But for A12 (or any other address line) to go
high then return to its original state after
three cycles seems like a rather
uncommon event (although it could be produced at will).
And I seem to have hit on a nice, simple circuit to detect that event and remember its occurrence.

But the details are too half-baked for me to share tonight!
-- Jeff