^ Yeah sorry it's not a very good explanation.
Here's the order of events that lead to this point:
1. Pass test ROM's. These make sure the emulator is working right but don't offer any insight into start up behaviour.
2. Make a 2player run of Battletoads sync. With everything else being correct, this game syncs entirely based on an accurate start up state. At the time, this state was borrowed from FCEUX, which has one extra dead frame in the PPU and slgihtly different initial conditions.
3. Match the run that syncs to the start up state here:
https://wiki.nesdev.com/w/index.php/PPU_power_up_state
Surprisingly, this worked out quite well.
4. Make other test runs, they failed to sync in what should be the accurate start up state, the one in the current NESHawk release.
5. I checked against the old start up state and the behaviour matched the console tests.
So, something is wrong somewhere. I'm not sure if it's in the NESDev link, my implementation, or something else.
True's tests are pretty definitive that if I change the Vlbank flag at power on I should get one of the 2 desyncs he got. The goal now is to make that happen with a consistent start up state.