dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs

Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients
(SERVER, SESSIONMGR/Terminal Manager, WM, VTE).  Internal clients use the
local service "xserver" via the display string "0::0"; TCP 6000 is a
separate authorised listener.  Function table and the 4-call hello-window
sequence are in dwt/notes/GUI_APPS.md.

Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then
called XOpenDisplay; it never returns (stage 2, display 0, X-server client
watermark unchanged) and the rdebug service dies.  Verdict: hard for a
self-contained window; shared-RAM UI mutation (opcode 8) is the working
route.

dwt/gui/probe2.lua

@@ -0,0 +1,47 @@
+-- probe2.lua -- marker + X-server client-table telemetry.
+local machine = manager.machine
+local dir = os.getenv("MSG_DIR") or "."
+local trigger = os.getenv("MSG_TRIGGER") or (dir .. "/trigger")
+local screen = nil
+for _, s in pairs(machine.screens) do screen = s; break end
+local cpu = machine.devices[':maincpu']
+local space = cpu.spaces['program']
+local frame = 0
+local job = nil
+
+local function consume_trigger()
+    local fh = io.open(trigger, "r")
+    if not fh then return end
+    local text = fh:read("*a") or ""
+    fh:close(); os.remove(trigger)
+    local prefix, count, stride = text:match("(%S+)%s+(%d+)%s+(%d+)")
+    if not prefix then return end
+    job = { prefix = prefix, left = tonumber(count), stride = tonumber(stride), next = frame }
+    print(string.format("probe2: frame %d job %s x%d every %d", frame, prefix, job.left, job.stride))
+end
+
+local function u32(a)
+    local ok, v = pcall(function() return space:read_u32(a) end)
+    if ok then return v end
+    return 0xdeadbeef
+end
+
+emu.register_frame_done(function()
+    frame = frame + 1
+    consume_trigger()
+    if job and frame >= job.next and screen then
+        local out = string.format("%s/%s_frame%05d.png", dir, job.prefix, frame)
+        pcall(function() return screen:snapshot(out) end)
+        print(string.format("probe2: frame %d %s", frame, out))
+        job.left = job.left - 1
+        job.next = frame + job.stride
+        if job.left <= 0 then job = nil end
+    end
+    if frame % 25 == 0 then
+        print(string.format("probe2: f=%d PC=%08X st=%d disp=%08X win=%08X xclients=%d strlen=%d",
+            frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
+            u32(0x01850120), u32(0x1b8620), u32(0x01850160)))
+    end
+end, "vt1200-gui-probe2")
+
+if machine.debugger then machine.debugger.execution_state = 'run' end