dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs

Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients
(SERVER, SESSIONMGR/Terminal Manager, WM, VTE).  Internal clients use the
local service "xserver" via the display string "0::0"; TCP 6000 is a
separate authorised listener.  Function table and the 4-call hello-window
sequence are in dwt/notes/GUI_APPS.md.

Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then
called XOpenDisplay; it never returns (stage 2, display 0, X-server client
watermark unchanged) and the rdebug service dies.  Verdict: hard for a
self-contained window; shared-RAM UI mutation (opcode 8) is the working
route.

dwt/gui/probe3.lua

@@ -0,0 +1,34 @@
+-- probe3.lua -- breakpoint on the X server connection-setup entry (Ghidra
+-- 07EB1700) plus marker telemetry.  If the server accepts an injected client,
+-- an ACCEPT line appears; the boot's own clients prove the probe works.
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local space = cpu.spaces['program']
+local frame = 0
+
+local function install()
+    local dbg = cpu.debug
+    if not dbg then print("probe3: no cpu.debug") return end
+    local ok, e = pcall(function()
+        dbg:bpset(0x3F58B800, "1", 'printf "probe3: ACCEPT pc=%08X\\n",pc; g')
+    end)
+    print("probe3: bpset accept=" .. tostring(ok) .. " " .. tostring(e))
+end
+
+local function u32(a)
+    local ok, v = pcall(function() return space:read_u32(a) end)
+    if ok then return v end
+    return 0xdeadbeef
+end
+
+emu.register_frame_done(function()
+    frame = frame + 1
+    if frame == 2 then install() end
+    if frame % 250 == 0 then
+        print(string.format("probe3: f=%d PC=%08X st=%d disp=%08X win=%08X wm=%d",
+            frame, cpu.state['PC'].value, u32(0x01850140), u32(0x01850100),
+            u32(0x01850120), u32(0x1b8620)))
+    end
+end, "vt1200-gui-probe3")
+
+if machine.debugger then machine.debugger.execution_state = 'run' end