diff --git a/dwt/gui/README.md b/dwt/gui/README.md
new file mode 100644
index 0000000..97aa23b
--- /dev/null
+++ b/dwt/gui/README.md
@@ -0,0 +1,60 @@
+# dwt/gui — X window feasibility payload
+
+Investigation of the VT1200 GUI architecture and whether an rdebug payload can
+create its own window. Read `dwt/notes/GUI_APPS.md` first; this directory is the
+reproducible part.
+
+| file | what it is |
+|---|---|
+| `xhello.asm` | payload: ABI check (`strlen("0::0")==4`) then `XOpenDisplay`, root lookup, `XCreateSimpleWindow`, `XMapWindow`, `XSync` |
+| `build.sh` | TI SDK (GSPA/GSPLNK under DOSBox) wrapper; writes `build/`, scratch in `work/` |
+| `probe.lua` | frame snapshots + marker/PC telemetry (250-frame interval) |
+| `probe2.lua` | same, 25-frame interval, also reads the X server client watermark |
+| `probe3.lua` | breakpoint on the X server accept entry + telemetry |
+| `build/xhello.bin` | assembled payload, linked at bit `0x01840000` |
+| `run/mame.log` | last live run: `strlen=4`, `stage=2`, `display=0`, watermark `1` |
+| `run/gui_frame*.png` | post-injection frames (normal Terminal Manager, no new window) |
+
+## Build
+
+```sh
+./dwt/gui/build.sh dwt/gui/xhello.asm 01840000
+```
+
+## Run
+
+The payload needs the OS, i.e. `VT1200_SKIP_LEVEL1=1` (documented divergence),
+a BOOTP/TFTP server and the LANCE attached. MAME's network device is enabled by
+the **cfg file**, not the command line — without
+`` in
+`vt1200.cfg` the taptun provider is never opened (the tap stays `NO-CARRIER`).
+
+```sh
+RUN=$PWD/dwt/gui/run
+mkdir -p $RUN/cfg $RUN/nvram
+cp dwt/evidence/live-run2/cfg/vt1200.cfg $RUN/cfg/vt1200.cfg
+
+sudo python3 -u harness/serve.py 192.168.99.1 --bootp \
+ --bootp-iface tap-mess-1000-0 &
+
+VT1200_SKIP_LEVEL1=1 MSG_TRIGGER=$RUN/trigger MSG_DIR=$RUN \
+ /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+ -rompath harness/mame/roms -sound none -skip_gameinfo \
+ -networkprovider taptun -video none -nothrottle \
+ -cfg_directory $RUN/cfg -nvram_directory $RUN/nvram \
+ -debug -debugger none -autoboot_script $PWD/dwt/gui/probe2.lua \
+ -autoboot_delay 0
+
+# once port 771 answers:
+python3 dwt/visual/inject.py --host 192.168.99.2 \
+ --poke-file 0x01840000 --file dwt/gui/build/xhello.bin \
+ --jump 0x01840000 --jump-wait 20
+```
+
+Markers are 32-bit cells at bit `0x01850100` (display), `0x01850110` (root),
+`0x01850120` (window), `0x01850130` (sync), `0x01850140` (stage),
+`0x01850160` (strlen).
+
+The observed result is a **hang at stage 2** (`display=0`): `XOpenDisplay`
+blocks in Xlib's select wrapper and the X server's client watermark never moves.
+See the note for the verdict and the decisive next experiment.
diff --git a/dwt/gui/build.sh b/dwt/gui/build.sh
new file mode 100755
index 0000000..0a6f79a
--- /dev/null
+++ b/dwt/gui/build.sh
@@ -0,0 +1,75 @@
+#!/bin/sh
+# Build a VT1200 payload with the 1987 TI TMS34010 SDK (GSPA/GSPLNK under
+# DOSBox) -- the same flow as harness/hello-world/build.sh and
+# dwt/visual/build.sh, but with all scratch/output under dwt/gui/.
+#
+# dwt/gui/build.sh SOURCE.asm [ORIGIN_BITS]
+#
+# Output: dwt/gui/build/.bin, .map, .lst
+set -eu
+
+ROOT=$(cd "$(dirname "$0")/../.." && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
+SRC=${1:?usage: build.sh SOURCE.asm [ORIGIN_BITS]}
+ORIGIN=${2:-01840000}
+NAME=$(basename "$SRC" .asm)
+BASE=$(printf '%s' "$NAME" | tr 'a-z' 'A-Z')
+WORK="$DIR/work"
+OUT="$DIR/build"
+IMG="$ROOT/tools/tms34010-sdk/1987-05 TMS34010 SDK/1987-11-06 TMS34010 Simulator-C Tools-ASM Tools.img"
+DOSBOX_CONF="$ROOT/harness/sdk-scratch/dosbox-bench.conf"
+
+mkdir -p "$WORK" "$OUT"
+
+if [ ! -x "$WORK/GSPA.EXE" ]; then
+ mcopy -s -n -i "$IMG" "::/A2/*" "$WORK/"
+ mcopy -s -n -i "$IMG" "::/C2/*" "$WORK/"
+fi
+
+cp "$SRC" "$WORK/$BASE.ASM"
+
+case "$ORIGIN" in
+ [0-9]*) ;;
+ *) ORIGIN="0$ORIGIN" ;;
+esac
+
+printf '%s\n' \
+ '-a' \
+ "-o $BASE.out" \
+ "-m $BASE.map" \
+ "$BASE.obj" \
+ 'SECTIONS' \
+ '{' \
+ " .text ${ORIGIN}h: {}" \
+ '}' > "$WORK/$BASE.CMD"
+sed -i 's/$/\r/' "$WORK/$BASE.CMD"
+
+rm -f "$WORK/$BASE.OBJ" "$WORK/$BASE.OUT" "$WORK/$BASE.LST" \
+ "$WORK/$BASE.MAP" "$WORK/$BASE.HI" "$WORK/$BASE.LO"
+
+SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+timeout 180 dosbox -conf "$DOSBOX_CONF" -noprimaryconf -nolocalconf \
+ -c "mount c $WORK" -c "c:" \
+ -c "gspa $BASE $BASE.obj $BASE.lst -l" \
+ -c "gsplnk $BASE.cmd" \
+ -c "exit" -exit >/dev/null 2>&1
+
+if [ ! -f "$WORK/$BASE.OUT" ]; then
+ echo "build.sh: GSPLNK produced no $BASE.OUT" >&2
+ exit 1
+fi
+if [ ! -f "$WORK/$BASE.OBJ" ]; then
+ echo "build.sh: GSPA produced no $BASE.OBJ" >&2
+ grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2 || true
+ exit 1
+fi
+if grep -q '\*\*\*\*\*' "$WORK/$BASE.LST"; then
+ echo "build.sh: assembler diagnostics:" >&2
+ grep -n '\*\*\*\*\*' "$WORK/$BASE.LST" >&2
+ exit 1
+fi
+
+python3 "$ROOT/harness/hello-world/cofextract.py" "$WORK/$BASE.OUT" "$OUT/$NAME.bin"
+sed 's/\r$//' "$WORK/$BASE.MAP" > "$OUT/$NAME.map"
+cp "$WORK/$BASE.LST" "$OUT/$NAME.lst"
+echo "build.sh: $OUT/$NAME.bin ($(wc -c < "$OUT/$NAME.bin") bytes) at bit $ORIGIN"
diff --git a/dwt/gui/build/xhello.bin b/dwt/gui/build/xhello.bin
new file mode 100644
index 0000000..12e2e2a
Binary files /dev/null and b/dwt/gui/build/xhello.bin differ
diff --git a/dwt/gui/build/xhello.lst b/dwt/gui/build/xhello.lst
new file mode 100644
index 0000000..5946ecb
--- /dev/null
+++ b/dwt/gui/build/xhello.lst
@@ -0,0 +1,219 @@
+GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
+ (c) Copyright 1985, 1987, Texas Instruments Inc.
+
+ PAGE 1
+
+ 0001 ; xhello.asm -- open a *new* X connection from an rdebu
+ 0002 ; create/map a window on the live DWT X server.
+ 0003 ;
+ 0004 ; Calling convention (the one the firmware itself uses;
+ 0005 ; 07F57044 and the TM at 07E5D2B4):
+ 0006 ;
+ 0007 ; MOVE A14,-*SP,1 ; reserve the slot the ca
+ 0008 ; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument
+ 0009 ; ...
+ 0010 ; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argumen
+ 0011 ; CALLA target
+ 0012 ;
+ 0013 ; We point A14 at a private argument buffer instead of
+ 0014 ; we keep the entry SP/A14 in RAM so the payload return
+ 0015 ; leaves the stack in an unexpected state.
+ 0016 ;
+ 0017 ; Xlib entry points (Ghidra address -> bit address):
+ 0018 ; 7F384AE XOpenDisplay(name) -> 3F9C2570
+ 0019 ; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
+ 0020 ; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
+ 0021 ; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
+ 0022 ; 7F68B1A strlen(s) -> 3FB458D0
+ 0023 ;
+ 0024 ; Markers (32-bit cells, bit addresses):
+ 0025 ; 01850100 display pointer
+ 0026 ; 01850110 root window
+ 0027 ; 01850120 window id
+ 0028 ; 01850130 XSync return
+ 0029 ; 01850140 stage counter
+ 0030 ; 01850150 strlen("0::0") -- must be 4; if not, we s
+ 0031
+ 0032 00000000 .text
+ 0033 00000000 _start:
+ 0034 00000000 0550 setf 16, 0, 0
+ 0035 00000010 0740 setf 32, 0, 1
+ 0036 00000020 098F mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
+ 00000030 FF00
+ 0037
+ 0038 00000040 078F move sp, @01850420h, 1 ; entry SP
+ 00000050 01850420
+ 0039 00000070 078E move a14, @01850400h, 1 ; entry A14
+ 00000080 01850400
+ 0040
+ 0041 000000A0 09E0 movi 1, a0, L
+ 000000B0 00000001
+ 0042 000000D0 0780 move a0, @01850140h, 1 ; stage = 1
+ 000000E0 01850140
+ 0043
+ 0044 ; ---- convention check: strlen("0::0") == 4 ---------
+ 0045 00000100 A3CF move a14, -*sp, 1
+ 0046 00000110 09EE movi 01852000h, a14, L
+ 00000120 01852000
+ 0047 00000140 09E0 movi 3FACE948h, a0, L ; ROM "0::0"
+ 00000150 3FACE948
+ 0048 00000170 920E move a0, *a14+, 1 ; arg0
+ 0049 00000180 0D5F calla 3FB458D0h ; strlen
+ GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
+ (c) Copyright 1985, 1987, Texas Instruments Inc.
+
+ PAGE 2
+
+ 00000190 3FB458D0
+ 0050 000001B0 07AF move @01850420h, sp, 1
+ 000001C0 01850420
+ 0051 000001E0 07AE move @01850400h, a14, 1
+ 000001F0 01850400
+ 0052 00000210 0788 move a8, @01850160h, 1 ; MARK strlen
+ 00000220 01850160
+ 0053 00000240 09E0 movi 4, a0, L
+ 00000250 00000004
+ 0054 00000270 4808 cmp a0, a8
+ 0055 00000280 CB00 jrne done
+ 00000290 0093
+ 0056
+ 0057 000002A0 09E0 movi 2, a0, L
+ 000002B0 00000002
+ 0058 000002D0 0780 move a0, @01850140h, 1
+ 000002E0 01850140
+ 0059
+ 0060 ; ---- display = XOpenDisplay("0::0") ----------------
+ 0061 00000300 A3CF move a14, -*sp, 1
+ 0062 00000310 09EE movi 01852000h, a14, L
+ 00000320 01852000
+ 0063 00000340 09E0 movi 3FACE948h, a0, L
+ 00000350 3FACE948
+ 0064 00000370 920E move a0, *a14+, 1 ; arg0 = name
+ 0065 00000380 0D5F calla 3F9C2570h ; XOpenDisplay
+ 00000390 3F9C2570
+ 0066 000003B0 07AF move @01850420h, sp, 1
+ 000003C0 01850420
+ 0067 000003E0 07AE move @01850400h, a14, 1
+ 000003F0 01850400
+ 0068 00000410 0788 move a8, @01850100h, 1 ; MARK display
+ 00000420 01850100
+ 0069 00000440 4D08 move a8, a8
+ 0070 00000450 CA77 jreq done
+ 0071
+ 0072 00000460 09E0 movi 3, a0, L
+ 00000470 00000003
+ 0073 00000490 0780 move a0, @01850140h, 1
+ 000004A0 01850140
+ 0074
+ 0075 ; ---- root = *(*(display+0x480)+0x40) ---------------
+ 0076 000004C0 07A6 move @01850100h, a6, 1
+ 000004D0 01850100
+ 0077 000004F0 B6C9 move *a6(0480h), a9, 1
+ 00000500 0480
+ 0078 00000510 B729 move *a9(040h), a9, 1
+ 00000520 0040
+ 0079 00000530 0789 move a9, @01850110h, 1 ; MARK root
+ 00000540 01850110
+ 0080
+ 0081 ; ---- XCreateSimpleWindow(display,root,100,100,400,20
+ 0082 00000560 A3CF move a14, -*sp, 1
+ 0083 00000570 09EE movi 01852000h, a14, L
+ 00000580 01852000
+ 0084 000005A0 09E0 movi 0, a0, L
+ GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
+ (c) Copyright 1985, 1987, Texas Instruments Inc.
+
+ PAGE 3
+
+ 000005B0 00000000
+ 0085 000005D0 920E move a0, *a14+, 1 ; background = 0 (black)
+ 0086 000005E0 920E move a0, *a14+, 1 ; border = 0
+ 0087 000005F0 09E0 movi 2, a0, L
+ 00000600 00000002
+ 0088 00000620 920E move a0, *a14+, 1 ; border width
+ 0089 00000630 09E0 movi 200, a0, L
+ 00000640 000000C8
+ 0090 00000660 920E move a0, *a14+, 1 ; height
+ 0091 00000670 09E0 movi 400, a0, L
+ 00000680 00000190
+ 0092 000006A0 920E move a0, *a14+, 1 ; width
+ 0093 000006B0 09E0 movi 100, a0, L
+ 000006C0 00000064
+ 0094 000006E0 920E move a0, *a14+, 1 ; y
+ 0095 000006F0 920E move a0, *a14+, 1 ; x
+ 0096 00000700 932E move a9, *a14+, 1 ; parent
+ 0097 00000710 07A6 move @01850100h, a6, 1
+ 00000720 01850100
+ 0098 00000740 92CE move a6, *a14+, 1 ; display
+ 0099 00000750 0D5F calla 3FD41B90h ; XCreateSimpleWindow
+ 00000760 3FD41B90
+ 0100 00000780 07AF move @01850420h, sp, 1
+ 00000790 01850420
+ 0101 000007B0 07AE move @01850400h, a14, 1
+ 000007C0 01850400
+ 0102 000007E0 0788 move a8, @01850120h, 1 ; MARK window
+ 000007F0 01850120
+ 0103
+ 0104 00000810 09E0 movi 4, a0, L
+ 00000820 00000004
+ 0105 00000840 0780 move a0, @01850140h, 1
+ 00000850 01850140
+ 0106
+ 0107 ; ---- XMapWindow(display, window) -------------------
+ 0108 00000870 A3CF move a14, -*sp, 1
+ 0109 00000880 09EE movi 01852000h, a14, L
+ 00000890 01852000
+ 0110 000008B0 930E move a8, *a14+, 1 ; window
+ 0111 000008C0 07A6 move @01850100h, a6, 1
+ 000008D0 01850100
+ 0112 000008F0 92CE move a6, *a14+, 1 ; display
+ 0113 00000900 0D5F calla 3FD645B0h ; XMapWindow
+ 00000910 3FD645B0
+ 0114 00000930 07AF move @01850420h, sp, 1
+ 00000940 01850420
+ 0115 00000960 07AE move @01850400h, a14, 1
+ 00000970 01850400
+ 0116
+ 0117 00000990 09E0 movi 5, a0, L
+ 000009A0 00000005
+ 0118 000009C0 0780 move a0, @01850140h, 1
+ 000009D0 01850140
+ 0119
+ 0120 ; ---- XSync(display, 0) -----------------------------
+ 0121 000009F0 A3CF move a14, -*sp, 1
+ GSP COFF Assembler, Version 2.00, 87.300 Sun Oct 18 14:04:58 2026
+ (c) Copyright 1985, 1987, Texas Instruments Inc.
+
+ PAGE 4
+
+ 0122 00000A00 09EE movi 01852000h, a14, L
+ 00000A10 01852000
+ 0123 00000A30 09E0 movi 0, a0, L
+ 00000A40 00000000
+ 0124 00000A60 920E move a0, *a14+, 1 ; discard = 0
+ 0125 00000A70 07A6 move @01850100h, a6, 1
+ 00000A80 01850100
+ 0126 00000AA0 92CE move a6, *a14+, 1 ; display
+ 0127 00000AB0 0D5F calla 3FD9F6B0h ; XSync
+ 00000AC0 3FD9F6B0
+ 0128 00000AE0 07AF move @01850420h, sp, 1
+ 00000AF0 01850420
+ 0129 00000B10 07AE move @01850400h, a14, 1
+ 00000B20 01850400
+ 0130 00000B40 0788 move a8, @01850130h, 1 ; MARK sync
+ 00000B50 01850130
+ 0131
+ 0132 00000B70 09E0 movi 6, a0, L
+ 00000B80 00000006
+ 0133 00000BA0 0780 move a0, @01850140h, 1
+ 00000BB0 01850140
+ 0134
+ 0135 00000BD0 done:
+ 0136 00000BD0 09AF mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
+ 00000BE0 00FF
+ 0137 00000BF0 09E8 movi 0, a8, L
+ 00000C00 00000000
+ 0138 00000C20 0960 rets
+ 0139 .end
+
+ No Errors, No Warnings
diff --git a/dwt/gui/build/xhello.map b/dwt/gui/build/xhello.map
new file mode 100644
index 0000000..4652222
--- /dev/null
+++ b/dwt/gui/build/xhello.map
@@ -0,0 +1,34 @@
+*****************************************************
+GSP COFF Linker, Version 2.00, 87.300
+*****************************************************
+Sun Oct 18 14:04:58 2026
+
+OUTPUT FILE NAME:
+ENTRY POINT SYMBOL: 0
+
+
+SECTION ALLOCATION MAP
+
+ output attributes/
+section page origin length input sections
+-------- ---- ---------- ---------- ----------------
+.data 0 00000000 00000000
+
+.bss 0 00000000 00000000 UNINITIALIZED
+
+.text 0 01840000 00000C30
+ 01840000 00000C30 XHELLO.obj (.text)
+
+
+GLOBAL SYMBOLS
+
+address name address name
+-------- ---- -------- ----
+00000000 .bss 00000000 edata
+00000000 .data 00000000 .bss
+01840000 .text 00000000 end
+00000000 edata 00000000 .data
+00000000 end 01840000 .text
+01840C30 etext 01840C30 etext
+
+[6 symbols]
diff --git a/dwt/gui/probe.lua b/dwt/gui/probe.lua
new file mode 100644
index 0000000..05b21bf
--- /dev/null
+++ b/dwt/gui/probe.lua
@@ -0,0 +1,63 @@
+-- probe.lua -- frame snapshots + marker/PC telemetry for the GUI experiments.
+--
+-- MSG_TRIGGER= " " -> PNG snapshots
+-- MSG_DIR= where PNGs go
+--
+-- Also prints a marker line every 250 frames, so a wedged machine still leaves
+-- evidence of how far the injected payload got:
+-- 01850100 display 01850110 root 01850120 window
+-- 01850130 sync 01850140 stage 01850150 strlen
+local machine = manager.machine
+local dir = os.getenv("MSG_DIR") or "."
+local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
+local screen = nil
+for _, s in pairs(machine.screens) do screen = s; break end
+local cpu = machine.devices[':maincpu']
+local space = cpu.spaces['program']
+
+local frame = 0
+local job = nil
+
+local function consume_trigger()
+ local fh = io.open(trigger, "r")
+ if not fh then return end
+ local text = fh:read("*a") or ""
+ fh:close()
+ os.remove(trigger)
+ local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
+ if not prefix then
+ print("probe: bad trigger " .. text)
+ return
+ end
+ job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = frame }
+ print(string.format("probe: frame %d job %s x%d every %d", frame,
+ prefix, job.left, job.stride))
+end
+
+local function u32(addr)
+ local ok, v = pcall(function() return space:read_u32(addr) end)
+ if ok then return v end
+ return 0xdeadbeef
+end
+
+emu.register_frame_done(function()
+ frame = frame + 1
+ consume_trigger()
+ if job and frame >= job.next and screen then
+ local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, frame)
+ local ok, err = pcall(function() return screen:snapshot(out) end)
+ print(string.format("probe: frame %d %s ok=%s err=%s", frame,
+ out, tostring(ok), tostring(err)))
+ job.left = job.left - 1
+ job.next = frame + job.stride
+ if job.left <= 0 then job = nil end
+ end
+ if frame % 250 == 0 then
+ print(string.format("probe: frame %d PC=%08X disp=%08X root=%08X win=%08X sync=%08X stage=%d strlen=%d",
+ frame, cpu.state['PC'].value,
+ u32(0x01850100), u32(0x01850110), u32(0x01850120),
+ u32(0x01850130), u32(0x01850140), u32(0x01850150)))
+ end
+end, "vt1200-gui-probe")
+
+if machine.debugger then machine.debugger.execution_state = 'run' end
diff --git a/dwt/gui/probe2.lua b/dwt/gui/probe2.lua
new file mode 100644
index 0000000..004e3e9
--- /dev/null
+++ b/dwt/gui/probe2.lua
@@ -0,0 +1,47 @@
+-- probe2.lua -- marker + X-server client-table telemetry.
+local machine = manager.machine
+local dir = os.getenv("MSG_DIR") or "."
+local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
+local screen = nil
+for _, s in pairs(machine.screens) do screen = s; break end
+local cpu = machine.devices[':maincpu']
+local space = cpu.spaces['program']
+local frame = 0
+local job = nil
+
+local function consume_trigger()
+ local fh = io.open(trigger, "r")
+ if not fh then return end
+ local text = fh:read("*a") or ""
+ fh:close(); os.remove(trigger)
+ local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
+ if not prefix then return end
+ job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = frame }
+ print(string.format("probe2: frame %d job %s x%d every %d", frame, prefix, job.left, job.stride))
+end
+
+local function u32(a)
+ local ok, v = pcall(function() return space:read_u32(a) end)
+ if ok then return v end
+ return 0xdeadbeef
+end
+
+emu.register_frame_done(function()
+ frame = frame + 1
+ consume_trigger()
+ if job and frame >= job.next and screen then
+ local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, frame)
+ pcall(function() return screen:snapshot(out) end)
+ print(string.format("probe2: frame %d %s", frame, out))
+ job.left = job.left - 1
+ job.next = frame + job.stride
+ if job.left <= 0 then job = nil end
+ end
+ if frame % 25 == 0 then
+ print(string.format("probe2: f=%d PC=%08X st=%d disp=%08X win=%08X xclients=%d strlen=%d",
+ frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
+ u32(0x01850120), u32(0x1b8620), u32(0x01850160)))
+ end
+end, "vt1200-gui-probe2")
+
+if machine.debugger then machine.debugger.execution_state = 'run' end
diff --git a/dwt/gui/probe3.lua b/dwt/gui/probe3.lua
new file mode 100644
index 0000000..9a25d37
--- /dev/null
+++ b/dwt/gui/probe3.lua
@@ -0,0 +1,34 @@
+-- probe3.lua -- breakpoint on the X server connection-setup entry (Ghidra
+-- 07EB1700) plus marker telemetry. If the server accepts an injected client,
+-- an ACCEPT line appears; the boot's own clients prove the probe works.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local space = cpu.spaces['program']
+local frame = 0
+
+local function install()
+ local dbg = cpu.debug
+ if not dbg then print("probe3: no cpu.debug") return end
+ local ok, e = pcall(function()
+ dbg:bpset(0x3F58B800, "1", 'printf "probe3: ACCEPT pc=%08X\\n",pc; g')
+ end)
+ print("probe3: bpset accept=" .. tostring(ok) .. " " .. tostring(e))
+end
+
+local function u32(a)
+ local ok, v = pcall(function() return space:read_u32(a) end)
+ if ok then return v end
+ return 0xdeadbeef
+end
+
+emu.register_frame_done(function()
+ frame = frame + 1
+ if frame == 2 then install() end
+ if frame % 250 == 0 then
+ print(string.format("probe3: f=%d PC=%08X st=%d disp=%08X win=%08X wm=%d",
+ frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
+ u32(0x01850120), u32(0x1b8620)))
+ end
+end, "vt1200-gui-probe3")
+
+if machine.debugger then machine.debugger.execution_state = 'run' end
diff --git a/dwt/gui/run/gui_frame05752.png b/dwt/gui/run/gui_frame05752.png
new file mode 100644
index 0000000..f6966b4
Binary files /dev/null and b/dwt/gui/run/gui_frame05752.png differ
diff --git a/dwt/gui/run/gui_frame15571.png b/dwt/gui/run/gui_frame15571.png
new file mode 100644
index 0000000..f6966b4
Binary files /dev/null and b/dwt/gui/run/gui_frame15571.png differ
diff --git a/dwt/gui/run/gui_frame15601.png b/dwt/gui/run/gui_frame15601.png
new file mode 100644
index 0000000..f6966b4
Binary files /dev/null and b/dwt/gui/run/gui_frame15601.png differ
diff --git a/dwt/gui/run/mame.log b/dwt/gui/run/mame.log
new file mode 100644
index 0000000..722bacc
--- /dev/null
+++ b/dwt/gui/run/mame.log
@@ -0,0 +1,728 @@
+Warning: -video none doesn't make much sense without -seconds_to_run
+vt1200: screen_update#1 frame=0 clip_y=0..0 screen=1280x901
+vt1200: screen_update#2 frame=0 clip_y=1..900 screen=1280x901
+vt1200: scanline#1 line=1 enabled=1
+vt1200: guard#1 frame=0 dump_frame=-1 dump_ram=-1
+vt1200: screen_update#3 frame=1 clip_y=0..0 screen=1280x901
+vt1200: scanline#2 line=0 enabled=1
+vt1200: screen_update#4 frame=1 clip_y=1..1 screen=1280x901
+vt1200: scanline#3 line=1 enabled=1
+vt1200: scanline#4 line=2 enabled=1
+probe2: f=25 PC=3F7056E0 st=0 disp=00000000 win=00000000 xclients=0 strlen=0
+probe2: f=50 PC=3F7056E0 st=0 disp=00000000 win=00000000 xclients=0 strlen=0
+probe2: f=75 PC=3F701E60 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=100 PC=3FB44B00 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=125 PC=3F7462F0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=150 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=175 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=200 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=225 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=250 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=275 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=300 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=325 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=350 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=375 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=400 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=425 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=450 PC=3F33EF20 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=475 PC=3FB44DA0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=500 PC=3F351010 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=525 PC=3F22A460 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=550 PC=3F34F1B0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=575 PC=3F3510F0 st=1431655765 disp=55555555 win=55555555 xclients=0 strlen=1431655765
+probe2: f=600 PC=3FDA4970 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=625 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=650 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=675 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=700 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=725 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=750 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=775 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=800 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=825 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=850 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=875 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=900 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=925 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=950 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=975 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1000 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1025 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1050 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1075 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1100 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1125 PC=3F579870 st=1431655765 disp=55555555 win=55555555 xclients=1 strlen=1431655765
+probe2: f=1150 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1175 PC=3FCCC060 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1200 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1225 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1250 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1325 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1375 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1400 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1450 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1475 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1500 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1525 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1575 PC=3FD97B80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1600 PC=3FB3FA00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1625 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1650 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1675 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1750 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1775 PC=3FD970F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1800 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1850 PC=3FD97560 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1875 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1900 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1925 PC=3FCCBF10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1950 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=1975 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2000 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2025 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2050 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2075 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2125 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2250 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2275 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2300 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2325 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2350 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2375 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2400 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2425 PC=3FD971F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2450 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2475 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2500 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2525 PC=3FCCBF00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2550 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2575 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2625 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2725 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2775 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2800 PC=3FCCC060 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2850 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2900 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2925 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2950 PC=3FD97B60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=2975 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3000 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3025 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3050 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3100 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3150 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3175 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3200 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3300 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3325 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3350 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3375 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3400 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3450 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3475 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3500 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3525 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3600 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3625 PC=3FD97BA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3650 PC=3FB3FA00 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3675 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3700 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3725 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3775 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3800 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3825 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3850 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3875 PC=3FD973D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3900 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3950 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=3975 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4025 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4050 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4075 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4100 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4125 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4150 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4200 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4325 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4350 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4375 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4450 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4475 PC=3FD97BA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4525 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4575 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4600 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4650 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4675 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4725 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4800 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4825 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4850 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4875 PC=3FD97180 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4900 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4925 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=4975 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5025 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5050 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5100 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5125 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5150 PC=3FB3FA70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5200 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5225 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5250 PC=3FD97610 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5275 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5325 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5375 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5475 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5525 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5650 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5675 PC=3FCCC030 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5700 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5725 PC=3FD97310 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: frame 5752 job gui x1 every 0
+probe2: frame 5752 /home/arti/code/k-space/vt1200/dwt/gui/run/gui_frame05752.png
+probe2: f=5775 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5800 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5850 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5875 PC=3FD97590 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5925 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5950 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=5975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6025 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6050 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6125 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6150 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6200 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6225 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6275 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6300 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6350 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6375 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6400 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6425 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6500 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6525 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6575 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6600 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6700 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6750 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6775 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6825 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6850 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6875 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6900 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6925 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6950 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=6975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7000 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7025 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7050 PC=3FB3FA70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7100 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7150 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7175 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7200 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7225 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7250 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7275 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7300 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7325 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7350 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7375 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7450 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7550 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7575 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7600 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7650 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7675 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7700 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7725 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7750 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7775 PC=3FD97560 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7875 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7900 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7925 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=7975 PC=3FD975C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8025 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8050 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8100 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8125 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8175 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8200 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8225 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8250 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8275 PC=3FCCBEC0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8300 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8350 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8375 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8400 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8450 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8475 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8550 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8575 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8625 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8675 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8700 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8725 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8750 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8775 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8850 PC=3FD97220 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8875 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8900 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8925 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8950 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=8975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9000 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9025 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9100 PC=3FD971A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9150 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9175 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9250 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9275 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9350 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9475 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9525 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9550 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9625 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9675 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9700 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9725 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9750 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9775 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9800 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9825 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9900 PC=3FD97150 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9925 PC=3FB3FB10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9950 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=9975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10000 PC=3FD97610 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10025 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10100 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10125 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10150 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10175 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10200 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10225 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10250 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10275 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10300 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10325 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10400 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10425 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10450 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10475 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10575 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10600 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10625 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10650 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10675 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10700 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10725 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10750 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10775 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10800 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10825 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10875 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10900 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10925 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=10975 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11000 PC=3FD97230 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11025 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11050 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11075 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11100 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11125 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11175 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11225 PC=3FD97570 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11250 PC=3FD97430 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11300 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11325 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11375 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11400 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11425 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11450 PC=3FD972A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11475 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11500 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11525 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11550 PC=3FD972B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11600 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11625 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11650 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11675 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11700 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11725 PC=3FCCBEF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11750 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11800 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11825 PC=3FCCBE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11850 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11875 PC=3FD975E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11925 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11950 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=11975 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12000 PC=3FD973C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12025 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12050 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12075 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12100 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12125 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12175 PC=3FD97620 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12200 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12225 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12250 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12275 PC=3FD97350 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12300 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12375 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12400 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12425 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12475 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12500 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12525 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12575 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12625 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12675 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12700 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12725 PC=3FD971D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12750 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12775 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12800 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12825 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12875 PC=3FD97310 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12900 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=12975 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13025 PC=3FD97170 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13050 PC=3FCCBED0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13075 PC=3FD97410 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13100 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13150 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13175 PC=3FD97230 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13200 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13225 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13250 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13325 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13375 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13425 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13450 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13475 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13500 PC=3FB3FAA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13550 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13575 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13625 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13650 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13675 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13700 PC=3FD97B20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13725 PC=3FD97330 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13750 PC=3FD97370 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13775 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13800 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13825 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13850 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13875 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13900 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13925 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13950 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=13975 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14000 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14025 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14050 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14075 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14100 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14125 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14150 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14175 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14200 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14225 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14275 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14300 PC=3FD970D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14325 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14350 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14375 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14400 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14425 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14475 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14500 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14525 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14550 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14575 PC=3FCCBED0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14600 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14675 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14700 PC=3FD97BE0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14725 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14750 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14775 PC=3FD97AD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14800 PC=3FD97280 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14875 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14900 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=14975 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15000 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15025 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15050 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15075 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15100 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15125 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15150 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15175 PC=3FB3FA20 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15200 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15225 PC=3FD97540 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15250 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15275 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15300 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15325 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15350 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15375 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15400 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15425 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15450 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15475 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15500 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15525 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15550 PC=3FB3FE60 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15575 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15600 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15625 PC=3FD97110 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15650 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15675 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15700 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15725 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15750 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15775 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15800 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15825 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15850 PC=3FD970C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15875 PC=3FD97140 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15900 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15950 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=15975 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16000 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16025 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16050 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16075 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16100 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16125 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16150 PC=3FB3FE40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16175 PC=3FCCC0B0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16200 PC=3FD973A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16225 PC=3FD97440 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16250 PC=3FD972E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16275 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16300 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16325 PC=3FB3FA30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16350 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16375 PC=3FD97AF0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16400 PC=3FD97590 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16425 PC=3FD97300 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16450 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16475 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16500 PC=3FCCBF90 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16525 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16550 PC=3FD971E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16575 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16600 PC=3FCCBEA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16625 PC=3FD97B50 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16650 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16675 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16700 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16750 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16800 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16825 PC=3FCCC0F0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16850 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16875 PC=3FD975A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16900 PC=3F708700 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16925 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16950 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=16975 PC=3FCCBEB0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17000 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17025 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17050 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17075 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17100 PC=3FB3FB10 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17125 PC=3FD97460 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17150 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17175 PC=3FCCC0A0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17200 PC=3FD97340 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17225 PC=3FD97540 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17250 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17275 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17300 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17325 PC=3FB3FAA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17350 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17375 PC=3FB3FE80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17400 PC=3FD971C0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17425 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17450 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17475 PC=3F708730 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17500 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17525 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17550 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17575 PC=3FD97250 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17600 PC=3FB3FB30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17625 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17650 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17675 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17700 PC=3FCCBFA0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17725 PC=3FCCBF70 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17750 PC=3FD972E0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17775 PC=3FCCBF30 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17800 PC=3FCCBF80 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17825 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17850 PC=3FCCBFD0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17875 PC=3FCCC0D0 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
+probe2: f=17900 PC=3FCCBF40 st=2 disp=00000000 win=00000000 xclients=1 strlen=4
diff --git a/dwt/gui/run/serve.log b/dwt/gui/run/serve.log
new file mode 100644
index 0000000..efa981a
--- /dev/null
+++ b/dwt/gui/run/serve.log
@@ -0,0 +1,8 @@
+serving 29 names on ('192.168.99.1', 69)
+ names: 69, 69/baseline.pcf, 69/evil.pcf, 69/fonts.dir, 69/v1200a.pcf, ROM, X11/baseline.pcf, X11/evil.pcf, X11/fonts.dir, X11/v1200a.pcf, baseline.pcf, evil.pcf, font, font/baseline.pcf, font/evil.pcf, font/fonts.dir, font/v1200a.pcf, fonts, fonts.dir, fonts/baseline.pcf, fonts/evil.pcf, fonts/fonts.dir, fonts/v1200a.pcf, misc/baseline.pcf, misc/evil.pcf, misc/fonts.dir, misc/v1200a.pcf, real.pcf, rom
+bootp: L2 responder on tap-mess-1000-0: handing out 192.168.99.2, siaddr 192.168.99.1 (src mac c6:fc:cc:16:f5:66)
+bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
+bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
+bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
+bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
+bootp: request from 08:00:2b:16:4b:5a xid=f81fccff -> 192.168.99.2 (siaddr 192.168.99.1, tap tap-mess-1000-0)
diff --git a/dwt/gui/xhello.asm b/dwt/gui/xhello.asm
new file mode 100644
index 0000000..d02f1e0
--- /dev/null
+++ b/dwt/gui/xhello.asm
@@ -0,0 +1,139 @@
+; xhello.asm -- open a *new* X connection from an rdebug `jump` payload and
+; create/map a window on the live DWT X server.
+;
+; Calling convention (the one the firmware itself uses; see the WM at
+; 07F57044 and the TM at 07E5D2B4):
+;
+; MOVE A14,-*SP,1 ; reserve the slot the callee restores A14 from
+; MOVI argN,A0 / MOVE A0,*A14+,1 ; last argument first, upward via A14
+; ...
+; MOVI arg0,A0 / MOVE A0,*A14+,1 ; first argument last
+; CALLA target
+;
+; We point A14 at a private argument buffer instead of the dispatcher frame, and
+; we keep the entry SP/A14 in RAM so the payload returns even if a callee
+; leaves the stack in an unexpected state.
+;
+; Xlib entry points (Ghidra address -> bit address):
+; 7F384AE XOpenDisplay(name) -> 3F9C2570
+; 7FA8372 XCreateSimpleWindow(...) -> 3FD41B90
+; 7FAC8B6 XMapWindow(display,window) -> 3FD645B0
+; 7FB3ED6 XSync(display,discard) -> 3FD9F6B0
+; 7F68B1A strlen(s) -> 3FB458D0 (convention check)
+;
+; Markers (32-bit cells, bit addresses):
+; 01850100 display pointer
+; 01850110 root window
+; 01850120 window id
+; 01850130 XSync return
+; 01850140 stage counter
+; 01850150 strlen("0::0") -- must be 4; if not, we stop before touching Xlib
+
+ .text
+_start:
+ setf 16, 0, 0
+ setf 32, 0, 1
+ mmtm sp, a0,a1,a2,a3,a4,a5,a6,a7
+
+ move sp, @01850420h, 1 ; entry SP
+ move a14, @01850400h, 1 ; entry A14
+
+ movi 1, a0, L
+ move a0, @01850140h, 1 ; stage = 1
+
+ ; ---- convention check: strlen("0::0") == 4 --------------------
+ move a14, -*sp, 1
+ movi 01852000h, a14, L
+ movi 3FACE948h, a0, L ; ROM "0::0"
+ move a0, *a14+, 1 ; arg0
+ calla 3FB458D0h ; strlen
+ move @01850420h, sp, 1
+ move @01850400h, a14, 1
+ move a8, @01850160h, 1 ; MARK strlen
+ movi 4, a0, L
+ cmp a0, a8
+ jrne done
+
+ movi 2, a0, L
+ move a0, @01850140h, 1
+
+ ; ---- display = XOpenDisplay("0::0") ---------------------------
+ move a14, -*sp, 1
+ movi 01852000h, a14, L
+ movi 3FACE948h, a0, L
+ move a0, *a14+, 1 ; arg0 = name
+ calla 3F9C2570h ; XOpenDisplay
+ move @01850420h, sp, 1
+ move @01850400h, a14, 1
+ move a8, @01850100h, 1 ; MARK display
+ move a8, a8
+ jreq done
+
+ movi 3, a0, L
+ move a0, @01850140h, 1
+
+ ; ---- root = *(*(display+0x480)+0x40) --------------------------
+ move @01850100h, a6, 1
+ move *a6(0480h), a9, 1
+ move *a9(040h), a9, 1
+ move a9, @01850110h, 1 ; MARK root
+
+ ; ---- XCreateSimpleWindow(display,root,100,100,400,200,2,0,0) --
+ move a14, -*sp, 1
+ movi 01852000h, a14, L
+ movi 0, a0, L
+ move a0, *a14+, 1 ; background = 0 (black)
+ move a0, *a14+, 1 ; border = 0
+ movi 2, a0, L
+ move a0, *a14+, 1 ; border width
+ movi 200, a0, L
+ move a0, *a14+, 1 ; height
+ movi 400, a0, L
+ move a0, *a14+, 1 ; width
+ movi 100, a0, L
+ move a0, *a14+, 1 ; y
+ move a0, *a14+, 1 ; x
+ move a9, *a14+, 1 ; parent
+ move @01850100h, a6, 1
+ move a6, *a14+, 1 ; display
+ calla 3FD41B90h ; XCreateSimpleWindow
+ move @01850420h, sp, 1
+ move @01850400h, a14, 1
+ move a8, @01850120h, 1 ; MARK window
+
+ movi 4, a0, L
+ move a0, @01850140h, 1
+
+ ; ---- XMapWindow(display, window) ------------------------------
+ move a14, -*sp, 1
+ movi 01852000h, a14, L
+ move a8, *a14+, 1 ; window
+ move @01850100h, a6, 1
+ move a6, *a14+, 1 ; display
+ calla 3FD645B0h ; XMapWindow
+ move @01850420h, sp, 1
+ move @01850400h, a14, 1
+
+ movi 5, a0, L
+ move a0, @01850140h, 1
+
+ ; ---- XSync(display, 0) ----------------------------------------
+ move a14, -*sp, 1
+ movi 01852000h, a14, L
+ movi 0, a0, L
+ move a0, *a14+, 1 ; discard = 0
+ move @01850100h, a6, 1
+ move a6, *a14+, 1 ; display
+ calla 3FD9F6B0h ; XSync
+ move @01850420h, sp, 1
+ move @01850400h, a14, 1
+ move a8, @01850130h, 1 ; MARK sync
+
+ movi 6, a0, L
+ move a0, @01850140h, 1
+
+done:
+ mmfm sp, a0,a1,a2,a3,a4,a5,a6,a7
+ movi 0, a8, L
+ rets
+ .end
diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md
index 27f7109..407d1aa 100644
--- a/dwt/notes/CROSS.md
+++ b/dwt/notes/CROSS.md
@@ -343,3 +343,33 @@ and frames in `dwt/notes/DISPLAY_MESSAGE.md`.
---
+
+## 2026-10-18 14:10 EEST — GUI apps are X clients; a payload can call Xlib but not get a display
+
+Facts for anyone tempted to "just create a window" (details in
+`dwt/notes/GUI_APPS.md`):
+
+* The GUI is a **real X11 dix server in ROM** (process `SERVER`, entry bit
+ `0x3F362910`) plus Xlib in ROM. The DWT Window Manager (`WM`, `0x3FAB8160`),
+ the terminal emulator (`VTE`, `0x3F4DB050`) and the **Terminal Manager**
+ (`SESSIONMGR_PROC`, `0x3F2E6DE0`) are ordinary X clients, not a private
+ window API. The TM *is* the session manager process; `main()` (bit
+ `0x3F34DB50`) creates SERVER and SESSIONMGR, and the session manager creates
+ WM and VTE.
+* Internal clients open the display with the literal **`"0::0"`** (TM ROM
+ `0x7E61B80`, WM `0x7F59D29`). `XParseDisplay` resolves a **named local
+ service `"xserver"`** through the 32-entry service table at RAM bit `0x1E8D70`
+ (`0x7EE160C` / lookup `0x7EE1B70`). TCP 6000 is a separate, user/node
+ authorised listener.
+* Xlib entry points (bit addresses): `XOpenDisplay` `0x3F9C2570`,
+ `XCreateSimpleWindow` `0x3FD41B90`, `XMapWindow` `0x3FD645B0`,
+ `XSync` `0x3FD9F6B0`, `XCreateGC` `0x3F997000`, `XDrawString` `0x3FDA0000`.
+* **Live result:** a 390-byte payload (poke+jump, no breakpoints) called
+ `strlen("0::0")` successfully (returned 4) using the firmware ABI, then
+ `XOpenDisplay` **hung**: stage 2, display 0, X-server client watermark
+ unchanged, rdebug service dead afterwards. The CPU sits in Xlib's select
+ wrapper. So the ROM is callable, but the `"xserver"` service connect from the
+ injected process never reaches the server. Do not assume a self-contained X
+ client is "one call away".
+* Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the
+ realistic route for making the Terminal Manager draw something.
diff --git a/dwt/notes/GUI_APPS.md b/dwt/notes/GUI_APPS.md
new file mode 100644
index 0000000..8eabd0d
--- /dev/null
+++ b/dwt/notes/GUI_APPS.md
@@ -0,0 +1,328 @@
+# How the VT1200's GUI apps are built — and what a payload can do with that
+
+Status: **static architecture DONE; injection verdict measured, not assumed.**
+A payload *can* call ROM routines with the firmware calling convention (proved
+live: `strlen("0::0")` returned 4), but `XOpenDisplay` from the injected process
+**never completes**: the run stays at stage 2, the display pointer stays 0, the
+X server's client watermark does not move, and the rdebug service stops answering.
+Creating a *new* X window from a payload is therefore **hard**, not medium.
+
+All work is static (Ghidra on `vt1200_v22.bin`) plus one live experiment on a
+private NVRAM/cfg under the documented `VT1200_SKIP_LEVEL1=1` divergence. ROM
+untouched (`md5 b46a3e442ccb86134d2356bd70d22fd2`), no driver edits.
+
+Address convention used here: **Ghidra byte address** and **firmware bit address
+(= Ghidra × 8)**. Ghidra address = `0x7E40000 + ROM file offset`.
+
+---
+
+## 1. The model in one paragraph
+
+The terminal runs a small **process-per-application** OS on one TMS34010. RAM is
+shared and unprotected; processes are contexts (a PCB from `create_process`, a
+stack, a private file table at `*(0x1B3900)+0x100`). The graphics system is a
+**real X11 server in ROM** (`dix`, the DEC/Athena server: strings
+`Hello, this is the X server`, `CreateWellKnownSockets`,
+`Internal error in ConfigureWindow`, `BadWindow - parameter not a Window`). The
+GUI applications are **X clients built on Xlib, which is also in ROM**
+(`XConnectDisplay`, `Xlib: sequence lost`, `XCreateCursor`-class request
+builders). There is **no separate DWT window API**: the "DWT Window Manager" is
+an ordinary X client that speaks the X11 WM protocol plus DECwindows atoms
+(`DEC_WM_HINTS`, `WM_MOVED`, `DEC_WM_ICON_STATE`, `DEC_WM_TAKE_FOCUS`).
+
+Because RAM is shared, app *state* (the Messages list, window ids, cursors) is
+global and a routine in one process can update another app's data — that is why
+rdebug opcode 8 can write the Terminal Manager's Messages box without a
+connection of its own. The X protocol traffic, however, is done by each app's
+own process through its own connection (`Display *` in a global: TM `@0xB78E0`,
+WM `@0x27AA80`).
+
+## 2. Function table
+
+### 2.1 Processes / app lifecycle
+
+| what | Ghidra | bits | notes |
+|---|---|---|---|
+| `create_process(entry,name,stack,1,arg)` | `0x07EE0D48` | `0x3F706A40` | mallocs a 0x39-byte PCB, copies the name, allocates the stack, links it at `@0x1B3860` |
+| current-process pointer | — | `0x1B3900` | `+0x100` = user area (fd table) |
+| process list head | — | `0x1B3860` | |
+| `Main Program` (creates SERVER + SESSIONMGR) | `0x07E69B6A`…`0x07E69C1A` | `0x3F34DB50` | itself a created process (name `Main Program`) |
+| X server entry **SERVER** | `0x07E6C522` | `0x3F362910` | dix main; prints `Hello, this is the X server` |
+| Session Manager / Terminal Manager **SESSIONMGR_PROC** | `0x07E5CDBC` | `0x3F2E6DE0` | *is* the Terminal Manager (see §3) |
+| Window Manager **WM** | `0x07F5702C` | `0x3FAB8160` | DWT WM; prints `DWT Window Manager is here to stay` |
+| terminal emulator **VTE** | `0x07E9B60A` | `0x3F4DB050` | DECterm/VTE |
+
+`create_process` argument order (from the pushes at `0x7E69B72`): the first
+argument is the **entry point (bit address)**, the second the **name string**,
+the third the **stack size**, the fourth a constant `1`, the fifth a pointer/arg.
+Example (`main`, `0x07E69BE2`):
+
+```
+07E69BC8 MOVK 0x1,A9 ; arg3 = 1
+07E69BCC MOVI 0x4E20,A9 ; arg2 = 0x4E20 stack
+07E69BD2 MOVI 0x3F34E2E0,A8 ; arg1 = "SESSIONMGR_PROC"
+07E69BDA MOVI 0x3F2E6DE0,A9 ; arg0 = entry
+07E69BE2 CALLA 0x07EE0D48 ; create_process
+```
+
+### 2.2 Xlib (client side, all in ROM)
+
+The request-builder opcode is visible in each function (`MOVB 0xNN` into the
+request buffer), which is how these were named; the DB26 `XDrawString` and DB25
+`XCreateSimpleWindow` shapes were then checked against their argument blocks.
+
+| Xlib function | Ghidra | bits | shape seen |
+|---|---|---|---|
+| `XOpenDisplay(name)` | `0x07F384AE` | `0x3F9C2570` | mallocs 0x4D8, parses the name, connects |
+| `XParseDisplay` / service lookup | `0x07FA7538` | `0x3FD3A9C0` | splits `host:display.screen`, resolves `"xserver"` |
+| `XCreateSimpleWindow(d,p,x,y,w,h,bw,border,bg)` | `0x07FA8372` | `0x3FD41B90` | opcode 1, 9 args |
+| `XMapWindow(d,w)` | `0x07FAC8B6` | `0x3FD645B0` | opcode 8, 2 args |
+| `XMapSubwindows(d,w)` | `0x07FAC97E` | `0x3FD64BF0` | opcode 9 |
+| `XSelectInput(d,w,mask)` | `0x07FB2FAA` | `0x3FD97D50` | ChangeWindowAttributes, mask 0x800 |
+| `XChangeWindowAttributes` | `0x07FA70EE` | `0x3FD38770` | opcode 2 |
+| `XConfigureWindow` | `0x07FA74A2` | `0x3FD3A510` | opcode 12 |
+| `XInternAtom(d,name,only_if_exists)` | `0x07FABC84` | `0x3FD5E420` | opcode 16 |
+| `XChangeProperty` | `0x07FA6E66` | `0x3FD37330` | opcode 18 |
+| `XCreateGC(d,drawable,mask,values)` | `0x07F32E00` | `0x3F997000` | opcode 55; template copied from ROM `0x2317D0` |
+| `XChangeGC` | `0x07F333F0` | `0x3F999F80` | opcode 56 |
+| `XSetForeground(d,gc,pixel)` | `0x07FB334C` | `0x3FD99A60` | caches in GC, marks dirty |
+| `XSync(d,discard)` | `0x07FB3ED6` | `0x3FD9F6B0` | sends GetInputFocus (43), waits |
+| `XDrawString(d,drawable,gc,x,y,s,n)` | `0x07FB4000` | `0x3FDA0000` | opcode 74 (PolyText8) |
+| `XLoadFont(d,name)` | `0x07FA95D0` | `0x3FD4AE80` | opcode 45 (OpenFont) |
+| `XCopyArea` | `0x07FA7C44` | `0x3FD3E220` | opcode 62 |
+| internal PolyFillRectangle fast path | `0x07F33D1E` | `0x3F99E8F0` | opcode 70; not a public entry point |
+| `strlen` | `0x07F68B1A` | `0x3FB458D0` | used as the ABI check |
+
+### 2.3 X server internals that matter
+
+| what | Ghidra | bits |
+|---|---|---|
+| connection setup / accept entry | `0x07EB1700` | `0x3F58B800` |
+| auth reject logger (`0x07E7E8D0`) | `0x07E7E8D0` | `0x3F3F4680` |
+| client table (32 × 0x80) | RAM | `0x1B6600` |
+| client watermark | RAM | `0x1B8620` |
+| client bitmap (32 bits) | RAM | `0x1B86A0` |
+| well-known socket / service name | ROM `"xserver"` | `0x3F591F08` |
+
+The server's connection path reads the 12-byte X11 setup (`0xEBB1CE(conn,12,buf)`),
+checks the byte-order byte, then reads the auth name/data and looks the peer up
+in the user/node table. Failure goes to a routine that logs
+`Client is not authorized to access server` and closes.
+
+## 3. Terminal Manager: what it is and how it starts
+
+**The Terminal Manager is not a separate application.** It is the UI half of the
+process `main()` creates as `SESSIONMGR_PROC` (entry `0x3F2E6DE0`). The single
+function that begins at `0x7E5CDBC` runs straight through the display setup
+(`0x7E5D0F0`), the TM window creation (`0x7E5D2D0`), the WM launch
+(`0x7E5D760`) and the VTE launch (`0x7E5E676`). This is continuous code: the
+disassembly has no return between `0x7E5CDBC` and `0x7E5F7xx`.
+
+Startup, quoted:
+
+```
+07E5D1FA MOVI 0x3F30DC00,A8 ; "0::0" at ROM 0x7E61B80
+07E5D204 CALLA 0x07F384AE ; XOpenDisplay("0::0")
+07E5D20A MOVE A8,@0xB78E0 ; TM's Display * (global)
+07E5D212 JRNE 0x07E5D228
+07E5D216 MOVI 0x3F30DC28,A8 ; "DWTM Failed to open display\n"
+07E5D21E CALLA 0x07F6683C ; printf
+```
+
+The title string `Terminal Manager V2.2` is at ROM `0x7E61D8B`
+(bit `0x3F30EC58`) and is referenced from the same function (`0x7E5E928`).
+`Terminal Manager XIO error... restarting...` (`0x7E61B53`) confirms the TM is an
+**XIO/Xlib client**, not a private drawing API.
+
+The TM's first window is a 1×1 "WM protocol" window; the visible TM box is built
+with the widget toolkit (the code at `0x7E7F24A`, `0x7E8465A`, `0x7E873FE`,
+`0x7E94880`, … that calls `XCreateSimpleWindow` + `XMapWindow`).
+
+**Launched from:** `main()`, not a menu or an init list. A menu does exist for
+secondary apps — the `Create` menu (`Terminal Window on Host Port`, `TELNET
+Terminal Window…`, `PRINT`) calls `create_process` at `0x7E91BA0`/`0x7E91C26`.
+
+## 4. Minimum "hello window" call sequence
+
+From the TM's own code (`0x7E5D2B4`–`0x7E5D2D0`) and the WM's
+(`0x7F57044`–`0x7F5704E`). The calling convention is **not** "push on SP": the
+caller reserves one slot with `MOVE A14,-*SP,1`, pushes arguments **upward**
+with `MOVE arg,*A14+,1` (last argument first), and the callee restores A14/SP.
+
+```
+; root = *(*(display+0x480)+0x40) (TM 0x7E5D290..0x7E5D2AA)
+MOVE @0xB78E0,A11 ; display
+MOVE @0xB7F80,A9 ; default screen number
+SLL 0x9,A9 / SLL 0x7,A7 / ADD A7,A9 ; * 0x280 (screen struct)
+MOVE *A11(0x480),A7 / ADD A9,A7 ; screens[]
+MOVE *A7(0x40),A9 / MOVE A9,@0xB7960 ; root window
+
+; window = XCreateSimpleWindow(display, root, 0,0, 1,1, 0, 0, 1)
+MOVE A14,-*SP,1
+MOVK 1,A7 / MOVE A7,*A14+,1 ; background = 1
+SUB A7,A7 / MOVE A7,*A14+,1 ; border
+MOVE A7,*A14+,1 ; border width
+MOVK 1,A7 / MOVE A7,*A14+,1 ; height
+MOVE A7,*A14+,1 ; width
+SUB A7,A7 / MOVE A7,*A14+,1 ; y
+MOVE A7,*A14+,1 ; x
+MOVE A9,*A14+,1 ; parent = root
+MOVE A11,*A14+,1 ; display
+CALLA 0x07FA8372 ; -> window id
+```
+
+The full minimum is **4 Xlib calls**:
+
+1. `XOpenDisplay("0::0")` — `0x3F9C2570`
+2. `XCreateSimpleWindow(d, root, x, y, w, h, bw, border, background)` —
+ `0x3FD41B90`
+3. `XMapWindow(d, win)` — `0x3FD645B0`
+4. `XSync(d, 0)` — `0x3FD9F6B0` (flush + round trip)
+
+To draw text add `XLoadFont(d,"fixed")` (`0x3FD4AE80`), `XCreateGC`
+(`0x3F997000`) with `GCFont=0x4000`, `XSetForeground` (`0x3FD99A60`) and
+`XDrawString` (`0x3FDA0000`). No event loop is needed for a static window; the
+server keeps it after the client goes idle.
+
+Globals: only the `Display *` is per-app. There is **no global "current
+display" to initialise**; `XOpenDisplay` allocates and returns it. Window ids,
+GCs and fonts are server-side resources and are valid for any client.
+
+## 5. The injection experiment (run) and the verdict
+
+Payload: `dwt/gui/xhello.asm` → `dwt/gui/build/xhello.bin` (390 B), linked at bit
+`0x01840000`, built with the TI SDK flow (`dwt/gui/build.sh`). It first calls
+`strlen("0::0")` as an ABI check (must return 4; if not it returns without
+touching Xlib), then `XOpenDisplay`, root lookup, `XCreateSimpleWindow`,
+`XMapWindow`, `XSync`, storing a stage counter at bit `0x01850140` and the
+display/window at `0x01850100`/`0x01850120`.
+
+Run: `VT1200_SKIP_LEVEL1=1`, private `-nvram_directory`/`-cfg_directory`,
+`-networkprovider taptun`, BOOTP/TFTP from `harness/serve.py --bootp`,
+`-nothrottle`; frame/marker probe `dwt/gui/probe2.lua`. Injected with
+`dwt/visual/inject.py` (`poke` + `jump`, challenge answered by
+`dwt/challenge.respond`). The terminal booted to the Terminal Manager, answered
+rdebug, and the payload was poked and jumped with no breakpoints.
+
+Result:
+
+```
+strlen = 4 <- the firmware calling convention works
+stage = 2 <- reached the XOpenDisplay call
+display = 0 <- never returned
+window = 0
+xclient watermark = 1 (unchanged: no new client slot was taken)
+jump: NO RETURN within 20 s; the same connection then times out
+```
+
+The machine stays alive (frames advance, the TM keeps running) but the
+remote-debug process sits in Xlib's `select` wrapper (`0x3FD969F0`, waiting on
+the display fd) and the rdebug service stops answering. No window appeared in
+the frame dump (`dwt/gui/run/gui_frame15571.png` is the normal TM).
+
+**Verdict: HARD** for "a payload creates its own window through XOpenDisplay".
+The window API is ordinary Xlib — the missing piece is the **local transport
+handshake**: a connection opened from the injected process is never accepted by
+the server (client watermark does not move), so Xlib waits forever. The one
+thing that decides it is whether the `"xserver"` service connection can be
+established from a process other than the boot-time clients; that is not an API
+question and is not answered by the ROM alone.
+
+**MEDIUM** for a narrower goal: *influencing* an existing window. The shared-RAM
+UI path is proven — `rdebug` opcode 8 calls the TM's append routine
+`0x3F309350` and the text appears in the Messages pane with no connection of its
+own. Any payload can call the same TK/UI routines, but they mutate the owning
+app's data structures so that the *owner* does the X drawing.
+
+## 6. Internal IPC to the X server
+
+Both boot-time clients open the display with the literal string **`"0::0"`**
+(TM at ROM `0x7E61B80`, bit `0x3F30DC00`; WM at `0x7F59D29`, bit `0x3FACE948`).
+
+`XParseDisplay` (`0x7FA7538`) does **not** build a TCP address. It resolves a
+**named local service**:
+
+```
+07FA766C CALLA 0x07F65C68 ; kernel_lock (per-process critical flag)
+07FA7672 MOVI 0x3FD3DCA0,A8 ; "xserver"
+07FA767C CALLA 0x07EE160C ; service attach by name
+07FA7688 JREQ ... ; null -> unlock, sleep 100 ms, retry
+```
+
+`0x7EE160C` is a **service-table lookup/attach**; the lookup itself
+(`0x7EE1B70`) scans a **32-entry table at `0x1E8D70`** (4-byte entries) with
+`strcmp` against the name. The X server registers the same name on its side
+(`"xserver"` appears next to `CreateWellKnownSockets` at `0x7E6A4B0`, and next to
+the TCP accept `X Server's TCP Port` at `0x7E591F08`).
+
+So the internal route is: **named local service `xserver`**, reached by
+`XOpenDisplay("0::0")`, not TCP and not a Unix socket path. TCP port 6000 is a
+*separate* listener; it is gated by the user/node authorisation list
+(`Connection request from user %s on node %s rejected`, auth check
+`0x7E7E8D0`), which is why an external `xdpyinfo` gets
+`Client is not authorized to access server` while the local service clients do
+not.
+
+## 7. App inventory
+
+GUI (X clients):
+
+| process | entry (bits) | role |
+|---|---|---|
+| `SERVER` | `0x3F362910` | X11 dix server, well-known socket `xserver` + TCP 6000 |
+| `SESSIONMGR_PROC` | `0x3F2E6DE0` | Session Manager **and** Terminal Manager UI (Messages, Ethernet/IP/LAT, memory bar, Customize/Print Screen panels) |
+| `WM` | `0x3FAB8160` | DWT Window Manager: frames, title bars, icon box, DEC WM atoms |
+| `VTE` | `0x3F4DB050` | terminal emulator window (created on demand by the TM) |
+| `PRINT` | `0x3F3E2590` → `0x7E7C4B2` | print manager, launched from the `Print Screen`/`Create` menu |
+
+Non-GUI processes (same `create_process` mechanism, for completeness):
+`INETSERVER`, LAT server (`0x3F2BD3F0`), MOP server (`0x3FAED480`), LANCE server
+(`0x3F9DB9A0`), `TCPIP_FONTS` (`0x3F95EB10`), `resolver` (`0x3F5B7EF0`),
+`Telnet` (`0x3F6D2F90`), `Route` (`0x3F5BF380`), `rtvalidate` (`0x3F663360`),
+`VTE_listen` (`0x3F50F6A0`), `VTE_listen_shr` (`0x3F50F860`), `Bootp`
+(`0x3F57B710`), `Inetd` (`0x3F587C00`), `domain_name` (`0x3F5B9510`),
+`remote debug` (`0x3F59F320`), `TCP_UP` (`0x3F22F940`), `Terminate_tcp`
+(`0x3F22E7F0`), `Main Program` (`0x3F34DB50`), `DWTM`/`VTE` helpers.
+
+There is no file manager, editor, clock or cardfiler in this image; the only
+GUI apps are the five above, plus the TM's own modal/panel code in the
+`0x7E7xxxx`–`0x7E9xxxx` toolkit range.
+
+## 8. The experiment that would settle the transport question
+
+Run the same payload but **instrument the server side**: breakpoint the server
+accept entry `0x3F58B800` and the auth check `0x3F3F4680`, log hits to a file
+from a Lua frame hook (MAME's `printf` action did not reach stdout with
+`-debugger none` in this run, so use a `wpset`/`bpset` action that increments a
+RAM counter, or a Lua hook that samples `PC` every frame), then inject
+`xhello.bin`. Three outcomes:
+
+1. Accept never hit → the service connect from a non-boot process never reaches
+ the server; the next step is to call `0x7EE160C("xserver")` by hand under the
+ debugger and inspect its return value / the fd it installs.
+2. Accept hit, auth rejects → authorise the injected client (the same
+ user/node table the config UI edits), then the window should appear.
+3. Accept hit, auth passes, no reply → the setup packet is wrong; compare the
+ bytes Xlib writes from the WM's connection with ours.
+
+A second, independent route worth trying: `create_process` a fresh process whose
+entry is the payload (`create_process(0x01840000, "GUI", 0x2000, 1, 0)`), so the
+X connection is made by a normal new process rather than by the rdebug
+dispatcher. That isolates "wrong process context" from "wrong transport".
+
+Not run: the owner's MAME was not running, but the shared tap
+(`tap-mess-1000-0` / bridge `vt1200`) was used only after confirming no
+`mame0289/vt1200` process existed; a private NVRAM and cfg directory were used
+and the run was stopped afterwards. No second MAME was started while another was
+live.
+
+## 9. Evidence files
+
+| path | contents |
+|---|---|
+| `dwt/gui/xhello.asm` | the payload (ABI check + 4 Xlib calls) |
+| `dwt/gui/build.sh` | TI SDK build wrapper, output under `dwt/gui/` |
+| `dwt/gui/build/xhello.bin`, `.lst`, `.map` | assembled payload, listing, map |
+| `dwt/gui/probe.lua`, `probe2.lua`, `probe3.lua` | frame snapshots + marker/PC telemetry + accept breakpoint |
+| `dwt/gui/run/mame.log` | boot, markers (`strlen=4`, `stage=2`, `disp=0`, `xclients=1`) |
+| `dwt/gui/run/gui_frame15571.png` | post-injection frame: normal Terminal Manager, no new window |