CREATE OPCODE SWEEP -- all accepted ops tested; none yields an addressable
class-3 resource.

slot 8 (create) dispatch, file 0x668E4:
  6696C DEC A8 ; JREQ 0x66912   op 1 -> 0x7EA78DA
  66970 DEC A8 ; JREQ 0x66912   op 2 -> 0x7EA78DA   (SAME routine as op 1)
  66974 SUBK 2 ; JREQ 0x66902   op 4 -> 0x7EA76CA
  66978 DEC    ; JREQ 0x66922   op 5 -> 0x7EA7B46
  6697C DEC    ; JREQ 0x66932   op 6 -> 0x7EA7DA8
  66980 JR 0x66942              anything else -> BadValue

Required lengths, read from each routine's own prologue:
  op 1/2 -> exactly 12 words   (0x678F8 SUBK 0xc)
  op 4   -> exactly  6 words   (0x676E2 SUBK 0x6 ; JREQ)
  op 5   -> exactly  7 words   (0x67B5E SUBK 0x7 ; JREQ)
  op 6   -> >= 6 words         (0x67DC0 SUBK 0x6 ; JRNC)

Measured (single instance, RESPTR breakpoint at 0x6CC0E as the create tell):

  op=1  [1,ID,64,64,...]           create OK   RESPTR 1   query ERR14   put ERR14
  op=2  [2,ID,64,64,...]           create OK   RESPTR 1   query REPLY   put ERR10/ERR8
  op=3  [3,...]                    ERR14 (BadIDChoice)   RESPTR 0
  op=4  [4,newID,existingID,0,0]   create OK   RESPTR 0   query ERR14   put ERR14
  op=5  [5,ID,64,64,1,1]           create OK   RESPTR 0   query ERR14   put ERR14
  op=6  [6,existingID,0,0,0]       OK          RESPTR 0   existing stays REPLY

Readings:
 * op 4 and op 5 return OK but allocate NOTHING that the create tell sees, and
   their ID is never addressable, so they are not creates -- both first act on
   an existing resource (op 4 starts with a lookup of payload word 2 via
   0x7EA6FA0 at 0x676FE; op 6 looks up payload word 1 via 0x7F174A4).
 * op 6 leaves the existing resource intact and queryable, so it is not a
   destroy either.
 * op 3 is rejected outright.
 * Only op 2 produces an addressable resource, and its class is 2.

Therefore the whole accepted create opcode space {1,2,4,5,6} has been tested and
none of it produces a class-3 resource that is registered by ID.  This closes
the "try another create opcode" route to the PUT_TILE lookup.