harness: VRAM transparent logging proxy; video RAM test is a walking-bit test and still fails

harness/mame/BRINGUP_LOG.md

@@ -823,10 +823,45 @@ generator, not merely on memory existing.
 **Next:** find the verification — where the test compares what it drew against what it reads
 back. That comparison is what fails and reports error 22 at bit `0x040000C0`.
 
+## The video RAM test characterised — and it still fails (2026-10-16, latest)
+
+A transparent, word-oriented logging proxy over the start of video memory
+(`VT1200_VRAMLOG=<path>`) reveals exactly what the test does:
+
+```
+W 0000 0001 pc=3F201BB0     <- walking-1 pattern: 0x0001 0x0002 0x0004 0x0008 0x0010 ...
+R 0000 0001 pc=3F201C20     <- read back, same values
+```
+
+So the level-1 video RAM test is a **classic data-bus walking-bit test**: 8,208 pattern
+writes, 8,208 read-backs, across 4,096 offsets — write the pattern, read it back, compare.
+
+That also explains the other traffic: `pc=3F204A20` writes 16,384 zeros (the POST clear of
+video memory) and `pc=3FDF97A0` writes 8,192 — the character-drawing path.
+
+**But the test still fails.** With video memory mapped as `.ram()`, and again with the
+word-oriented transparent proxy serving it — both of which round-trip the pattern correctly —
+the firmware still reports `LEVEL1/2 ERROR -> VIDEO MEMORY - 22` with `a11=0x0040000C`.
+
+So the memory now **round-trips correctly and the test still fails**, which rules out the
+simplest explanations (absent memory, wrong address, wrong size, bit-vs-word storage). The
+remaining candidates:
+
+* the test walks banks up to `a11=0x0200000C` (bit `0x200000C0`), which is **outside** the
+  mapped range `0x04000000`-`0x1fffffff` — the last bank would be unmapped;
+* the reported `0x0040000C` may be a bank base in a unit I have not pinned, rather than the
+  offset that failed;
+* the test may require the *drawn* content (the character path) to verify, not only raw
+  pattern round-tripping.
+
+**Honest status: level 1 is NOT passing.** Video memory is located, correctly mapped and now
+proven to round-trip a walking-bit pattern; the test's remaining requirement is not yet met.
+
 ---
 
 ## Next steps
 
-1. Find the VERIFY step of the video RAM test (what it compares after drawing).
-2. That comparison is what fails; it likely needs the character generator / font data.
-3. Re-run the console check (cap.lua) after each change.
+1. Map video memory across the FULL extent the bank walk reaches (bit 0x200000C0 and
+   beyond) -- the last bank is currently unmapped.
+2. Pin the unit of the reported address (0x0040000C): bank base vs failing offset.
+3. Re-run the console check (cap.lua) after each change; it reports the failing address.

harness/mame/vt1200.cpp

@@ -189,6 +189,14 @@ private:
 	// last-wins it fires and CTRL does not.
 	u8  calw8_r(offs_t off); void calw8_w(offs_t off, u8 data);
 
+	// VT1200_VRAMLOG=<path>
+	// Transparent logging proxy over the start of video memory, to compare what
+	// the level-1 video RAM test writes against what it reads back.
+	FILE *m_vramlog = nullptr;
+	std::vector<u16> m_vramlog_ram;
+	u16  vramlog_r(offs_t off);
+	void vramlog_w(offs_t off, u16 data);
+
 	// VT1200_LOG_UNMAPPED=<path>
 	// A catch-all mapping over the whole address space, registered FIRST so every
 	// real region added afterwards takes precedence.  Anything the firmware
@@ -297,6 +305,14 @@ void vt1200_state::machine_start()
 			fprintf(m_cal_log, "# tag kind addr pc -- address-unit / precedence calibration\n");
 	}
 
+	if (const char *p = getenv("VT1200_VRAMLOG"))
+	{
+		m_vramlog = fopen(p, "w");
+		m_vramlog_ram.assign(0x10000, 0);
+		if (m_vramlog)
+			fprintf(m_vramlog, "# kind off value pc -- video-memory accesses\n");
+	}
+
 	logerror("vt1200: board model=%s busy_ticks=%s busy_w2=%s busy_w3=%s dma_ticks=%s switch=%s log=%s render=%d dump=%ld\n",
 			getenv("VT1200_BOARD_MODEL") ? getenv("VT1200_BOARD_MODEL") : "off",
 			getenv("VT1200_BOARD_BUSY_TICKS") ? getenv("VT1200_BOARD_BUSY_TICKS") : "0",
@@ -351,6 +367,30 @@ void vt1200_state::calram200_w(offs_t off, u16 data) { log_probe("RAM-0x02000000
 u8 vt1200_state::calw8_r(offs_t off) { log_probe("W8-MISMATCH", 'R', (u32)off, 0x00000000); return 0; }
 void vt1200_state::calw8_w(offs_t off, u8 data) { log_probe("W8-MISMATCH", 'W', (u32)off, 0x00000000); }
 
+u16 vt1200_state::vramlog_r(offs_t off)
+{
+	const u32 o = (u32)off & 0xffff;
+	const u16 v = (o < m_vramlog_ram.size()) ? m_vramlog_ram[o] : 0;
+	if (m_vramlog)
+	{
+		fprintf(m_vramlog, "R %04X %04X pc=%08X\n", o, v, (unsigned)m_maincpu->state_int(TMS34010_PC));
+		fflush(m_vramlog);
+	}
+	return v;
+}
+
+void vt1200_state::vramlog_w(offs_t off, u16 data)
+{
+	const u32 o = (u32)off & 0xffff;
+	if (o < m_vramlog_ram.size())
+		m_vramlog_ram[o] = data;
+	if (m_vramlog)
+	{
+		fprintf(m_vramlog, "W %04X %04X pc=%08X\n", o, data, (unsigned)m_maincpu->state_int(TMS34010_PC));
+		fflush(m_vramlog);
+	}
+}
+
 void vt1200_state::machine_reset()
 {
 	if (m_log)
@@ -419,6 +459,13 @@ void vt1200_state::program_map(address_map &map)
 	if (getenv("VT1200_VRAM"))
 		map(0x04000000, 0x1fffffff).ram().share("vram");
 
+	// Transparent logging proxy over the first 64 KiB of video memory, registered
+	// last so it wins over the .ram() above.  off = (bitaddr - base) >> 4, so this
+	// covers bit 0x04000000..0x040FFFFF, which includes the address the level-1
+	// test reports failing at (bit 0x040000C0).
+	if (getenv("VT1200_VRAMLOG"))
+		map(0x04000000, 0x0400ffff).rw(FUNC(vt1200_state::vramlog_r), FUNC(vt1200_state::vramlog_w));
+
 
 	// Main RAM: 4 MiB (1 MiB onboard + 3 x 1 MiB SIMMs on the real machine).
 	// The TMS34010 is bit-addressed, so 4 MiB of bytes == 0x2000000 address