I found the datasheet for the MSM6502 (stupid OKI, reusing "6502") and the good news is it has no less than FOUR test pins. looks like 2 in, and maybe 2 out. The docs don't say a whole lot about it, but it does have a complete opcode listing with hex values so there is that.
It's a later sheet (1986) so it cuts out most of the more interesting parts, but I think there's enough there to go on.
Connecting to the QFPs is a pain because you have to make custom adapters- there's no ZIF sockets for most of these non-standard sized chips unfortunately.
