harness: correct board-model docs (four windows, real callback trap, guessed DMA timing)

harness/mame/BRINGUP_LOG.md

@@ -12,14 +12,14 @@ handshake the firmware waits on and modelling it correctly.
 
 | env var | effect |
 |---|---|
-| `VT1200_BOARD_LOG=<path>` | log every distinct (addr, PC) access to the three undecoded board windows |
+| `VT1200_BOARD_LOG=<path>` | log every distinct (addr, PC) access to the four undecoded board windows |
 | `VT1200_BOARD_MAP=<a=v;...>` | per-address fixed return values, e.g. `0x06200001=1` |
 | `VT1200_BOARD_DEFAULT=<v>` | value for addresses with no override |
 | `VT1200_BOARD_MODEL=handshake` | write-back registers **plus a self-clearing busy bit** |
 | `VT1200_BOARD_BUSY_TICKS=<n>` | busy-bit tick count for `VT1200_BOARD_MODEL=handshake` (the busy bit is fixed to bit 0 of the `+0x10` STATUS register) |
 | `VT1200_BOARD_BUSY_W2=<n>` | busy ticks for window `0x06200000` only; applied after `BUSY_TICKS`, so it overrides it for that window |
 | `VT1200_BOARD_BUSY_W3=<n>` | busy ticks for window `0x06400000` only; likewise |
-| `VT1200_BOARD_DMA_TICKS=<n>` | completion time (ticks) of a command written to the `0x05900000` DMA command port; 0 leaves the pair as a plain latch |
+| `VT1200_BOARD_DMA_TICKS=<n>` | completion time (ticks) of a command written to the `0x05900000` DMA command port (guessed; unverified); 0 leaves the pair as a plain latch |
 | `VT1200_BOARD_SWITCH=<addr>:<mask>:<value>` | monitor switch: bits 4-6 of `0x0640000D` read as `<value>` (raw bits, or a position 0-7) |
 | `VT1200_BOARD_RAM=1` | windows behave as plain read/write RAM |
 | `VT1200_NO_RENDER=1` | restore the old blank-everything video behaviour |
@@ -166,8 +166,13 @@ Our callback draws nothing, so the active area stays zero.
 
 ### Two traps hit while chasing this (recorded so they are not repeated)
 
-1. **`-video none` never calls `screen_update`**, so the scanline callback never runs
-   and `VT1200_DUMP_FRAME` silently does nothing. Force rendering with `-aviwrite`.
+1. **A disabled display silences the scanline callback.** `tms340x0_ind16` skips
+   the callback when the display is off (DPYCTL bit 15 clear); without the callback
+   `tick()` would not run and the busy machines would not clear (and
+   `VT1200_DUMP_FRAME` would write nothing). With the display enabled the callback
+   *does* fire under `-video none`, and `VT1200_DUMP_FRAME` does write a PPM — so
+   `-video none` alone is not the trap. Force rendering with `-aviwrite` only if you
+   also need `screen_update`.
 2. **`logerror` needs `-log`** (writes `error.log`); `-debuglog` only captures
    *debugger console* output (e.g. the `printf` inside a `bpset` action).
 3. **Put frame/RAM dumps in the *scanline* callback, not `screen_update`.** MAME

harness/mame/vt1200.cpp

@@ -16,12 +16,13 @@
         0x3f200000), mirrored into the three upper 1 GiB quadrants so that
         the reset-vector page at logical bit 0xffffffe0 resolves to the last
         four bytes of the image (file offset 0x1bfffc).
-      * OPTIONALLY (see below) the three undecoded board windows.
+      * OPTIONALLY (see below) the four undecoded board windows.
 
-    What is NOT modelled: LANCE Ethernet, the DUARTs, and the board system
-    logic at bit 0x5800000 / 0x6200000 / 0x6400000.  Because of that the
-    terminal does not boot to the X server; the firmware parks in early POST
-    waiting on a hardware-ready poll.
+    What is NOT modelled beyond the opt-in register model documented below:
+    LANCE Ethernet, the DUARTs, and the board system logic at bit 0x5800000 /
+    0x5900000 / 0x6200000 / 0x6400000.  Because of that the terminal does not
+    boot to the X server; the firmware parks in early POST waiting on a
+    hardware-ready poll.
 
     ---------------------------------------------------------------------
     Board-window experiments (all opt-in; with no env vars set the windows

harness/mame/vt1200_board.cpp

@@ -2,7 +2,7 @@
 
 bool vt1200_board::is_switch_port(uint32_t addr) const
 {
-	// The monitor-selection switch lives in bits 4-6 of winner 3's +0xD0
+	// The monitor-selection switch lives in bits 4-6 of window 3's +0xD0
 	// register (harness offset 0x0d).
 	return addr == (VT1200_WIN3 + VT1200_OFF_SWITCH);
 }