From f3d26ad6879e734798fcfbb8519764384a053d0b Mon Sep 17 00:00:00 2001
From: SDD <sdd@local>
Date: Sun, 18 Oct 2026 17:49:13 +0300
Subject: [PATCH] dwt: trace the bottom diagnostics message box to @0xCB640 and
 the RAM message table

---
 .../mame-msgbox-allpassed-frame3000.png       | Bin 0 -> 5079 bytes
 .../mame-msgbox-ether24-frame1200.png         | Bin 0 -> 4796 bytes
 dwt/evidence/real-unit-msgbox-allpassed.png   | Bin 0 -> 8113 bytes
 dwt/notes/MESSAGEBOX.md                       | 369 ++++++++++++++++++
 dwt/notes/REAL_UNIT.md                        |  22 ++
 5 files changed, 391 insertions(+)
 create mode 100644 dwt/evidence/mame-msgbox-allpassed-frame3000.png
 create mode 100644 dwt/evidence/mame-msgbox-ether24-frame1200.png
 create mode 100644 dwt/evidence/real-unit-msgbox-allpassed.png
 create mode 100644 dwt/notes/MESSAGEBOX.md

diff --git a/dwt/evidence/mame-msgbox-allpassed-frame3000.png b/dwt/evidence/mame-msgbox-allpassed-frame3000.png
new file mode 100644
index 0000000000000000000000000000000000000000..ec9845c68c001fc9a318c89de751c7b74498f63d
GIT binary patch
literal 5079
zcmd^DcTkhtw$CB(p%4V&C<#S43eq(M=`9pN0Ra&ZkP@Vc^xnZ3iog*N1f@wt0i`3o
zNdnTV6p26}fb?F4K;Xr5-+A-io4Ir6{(WcG?6uea_S*Z~>-&9c{bon&>uNGFa4>*C
zAg0^5)D1u&I%*dj@f)=TaU(n#sfyR;mcbnmDDWx>^duYvB2$N+EP_Bja1dx21p>*v
z27%b!GwSXtP#@4d)Yeo7{YH#odr!6Ky>H*SNx#g%dhRNsOJUiHI>hgN)5P1>+S^Xf
z#?y|fKnOTON=zIsCN5(renU<|QVt;{0*A}N;j7Y`WB<p&#m&~yKH#4_WIjH%r#cA!
z&ko*>E_Pnt)-LY<-$zDH68?`(j9)qmgFvkHx7Ae){m0gbdd{2<f$bi$x;eBLzPMBi
ziauc>4wt5@jmDWe-wr>|%=8ps`Ih&_NgmI#crlJOr!3s=rjw68#D7hOp)}aq%*&Az
ztGF&iu;`#^yi40K4f>vhb`{gGWCfl+V<@Y<%F#FO7nvy5nJqJO1aaV?T;lsQb8DMj
zg2(eDL1O*9Sgru+tTsJ>!K2_%$p2F3hze}p$a>kaeUZUz;ioX|GZw)^Qk(w$AF(tg
zyTJoHc`o3v(k%~t^v>yy*Vat}IE-^2x33LHVkYl<n4OVlMUpa^;{us`Xg|?PH^6j;
zFA-AFt^#%F$rO_5+RP7ru`lSY7%AD8vcxr<h#F7B>e}5^TFb6Q;<@8W%8pf_#3JqE
zR4*0UK=al#$m(a64Ro}b9b%B8SyqjE^3(qFloWjT2=klXqTit!58>oB-^B!6?;$IC
zY7duON*`$QbiMsE3;ldXNl-ZM;w+xjbgXu5LVGjo#7k)c{px1ND^kuWgXh^m@q?&@
z>-g&Vusxm2J!sFfeGzh-gU7*7(35ZI7nB%wScA2DqU7Pb+MDhB$6U<ycoK~wM@2Ii
zl-!t_vEySc1$9O(z9RWeV}(9c%m=f_#hyPnm1hCYL%n$+m*I;@s5)u@4S$Bif~^Nm
zaZeWHH{V1&$)m7BQn01tz-Nxl3Z~<vCwVR;#^3bDaX-PApy4Y2LKJiWy`%j)_GEn3
z)bO-|w(aId2qPatMleHuU?6VkxMzwD7F@P)CIr?0VpdTg8e+M31^#noXlCje<ntS;
z5Qg^%|Kor#n$yfK(vm$kb9_gMw~lt|=fOSgn)oLISDFfpNMZW0;4SOAi;h6?#G{kn
z_6!O|)r(9=N~H_;wh9-AdXG{rI091YUnpHA4`_9{H?BzdlUsM^J^fibn69a}QY?m?
zj|+|Cv(9^%I+;E=o9@?!Fe{$Xv;|IQtjGGU>b;ySG`e4`xey6t2NL0;YS6iy!So2c
z#3^~ySn&;OXEVxe_!IDb)mb>;s*|QNSJ*<co+eKP1D}K-58pm*(DaX+Vmt2P@$P+d
zb>84Z;$XUHKS#+8Figa~+je#NXj@t=cIwY8ZXri@FEN@<NLL;#=(5$<iq4)EFHfT9
z8wsC<vOko?is19K#R3z^%x*dY7fj}2Sf{Y#m?c`VgsVx%USH|%_$&tDeq(1-ladoU
zdA;z^o5&Qb?*hbBaLSBsh^n-0V{}o9m#kdRA0)Lcb=v|qPM&Ae5c=K0{OmkU_Gg`B
z?)!kltn4s_Tjjkt{Je0AjVrJnLgUCZ8N_A6ai~T3ej*?FA#StsF<Sia#w_$tc5@7-
zPwR90s^2(WBCJO;L$eGLd^G%cNqxyss19Z#a(%c!PUHt!DvSPmo<QLVO}c%A?H|%C
zMbG0y0z4`PJuk3vOq{e7x#+oQ7`-MZDSx9FvOj3L$6nM%OqZP=I>B;}pMRuynANMN
zNN2Fld}1{2w(K70p_9#V%Xahiremm@-9QOW?<0hK!T(hk)(suijs1MoF721u3+7+r
zlEYN?B1Oc$<R433j+aS8hve2+t@~d{f=!G~$d8+~G%{~|d+K#g&A%OO3lvnE)h6h~
zlBL<ZhR$1?=4@D)2#fw6A#+4_&MHH2!emBOcr)?IT5YHR3m|UOKm+hhn&K8uW%D<(
zGAHW~$<<a0yv28M#%}wo4Ug80Kr#~Ki+x}REqp`WZF_y|V_FUaa;N(-oF+}>=F48j
z9tJ?M&RKCde%HsQxVris5`pox4=I8@+BDDwI53FPd`59mu$Yaj=cgp3941-kn>S7G
zREq!7r_!lLye-zF9@e3p6|~W)OLLa#TUV>90lRU-@f_#*+J~A3>@t3rS`qGL4cUIa
zHkQt@M)XIRd^P*hHEACinX7j*TWkiZk<bar*fI>AFOj4Iu6K18Pt*GIn}*XHaJ|bW
zW7~2vc-7pGNMaXlvUeKev~2pk0yK4KwmXd-Rx6gwxN<hMufE*3w<mg`s+lHjenwUL
zAxulGrhG6z8Kb{ePT%d%Q+@jV;>KS7tpX#ijw-@VId4_#GKQiuhlCn(K@HEnM-cYY
z<ua7B5wCY_wj|Fmk$-=EMPgA8tEguWUuekx(NOxngawdVPf}#IFL;2CWHF2_FDuis
zhp#l0cu2T!{1owJJy<-Sig&IIbNnt`^84Nr`h|^p#Pbm*1m?Te{<Z1@)*<b&PVs#H
zni>s<(!?3W0Nf5ce~A4=5x#l@>H}uaz<JamRWYLn4u}EMRx>G0_FML)U5DV<uyw$9
zH-EwsU8#h?B!Ta`c4}@}5TPBx@rxUV?<X(%9oL;Iq2G_s#7)V5MYtadPFE449L<;h
zpdNtKz`aeu2gv_8!XV%iz=8|Z(6V(H@R|N>UHe9tjc(8-mdJC+wv24HVO<aydr+V6
zlehvBVzMs)-wnxaipt4eDz}L)qa6{xI?hvQTdP#~d=AETy>(8XZjd|ay}#=%P8-qd
zw%n$?Z}E?sY9>X%jJ5ur8KMaTBuVXHIU#V=;MNZ)Q8-ur>a<mKSCCC1HgEQ0;IVUt
zU_uw^2TtEm{c`*3H~p>mR?2T@BgrmXRk3b@G)vX3#%VWLs6aszc&Kj-{{Z!W4Iz7^
zWO+YWZ8r^Fwqe~aKYo9N3C)<xo8Z}<6IEUkkLGbWyv_7$(lGW{H~#jqOt;>nfvoc5
zFXIo%f42l4zB6A=un&15!t|G<Futxt*&#PM_NoH&u@jku9+IsN!4+lkY&;z8eT0du
zZ`lA4UC2)ql>+iaD!qn_cWsAK4eDYnV=G+@vW}us+iz9tpFfkK;h?dTt38c?Qsj)j
zA`tp*Vre~m4DW+3HH2QP69xCji@~cNexj4Q$#!dB!GzrIG@_N8__6zD^}MKZCSO7y
z_WZ1o*bc8mn=9fTFxe1tk2x7n*c?dJnos{qCgwCxrMA{<xAMnO|3BLWd0%Rh+ZCb)
zsH*^ago#1JKQzQJC*kKQR>U2Rbibz~J`3+MT~9{wSwgp&G$xP_fcXieleNe|Am5iy
zES%iGKD>l0mOnq8`(hZEi4S;%zW0jK)v|ZN-_zt%)>oAG`&J@yKD8DZdT;6!IrGQ$
zWSCWMFDUPZ+8r5_k}px=(pM|l>~e=w{%HA`SKHKgA%#@&9#zR}V24?rO9xeVsmP~B
zM>?S%eO=Zsrc#Oh&p8n{Q3e=P<bloB%4CW26oa{vmR}s%1GVwUJT$OfSkCX*A~dKq
z#yCD#tl(nS&abU_r;k2l(dx#HWRBl7U4Lug6LP0`rUFtpy3k<t{j=CF4AmcxIp~s{
zHl9<OYe$ROWMoWw(-50;H>#JLUjO$RL5E&owJXepgZgB{AB5Ks(Fc)|2B=EUuN<c7
zw_g?QZOLxjuX3YfwbV<LCuOZk!heiEY+kv2e3q{vw=)Yj!UQ#BoG@XkRcUsTr<|==
zP;-Uvj<WOQI!#bap7fEF7`xDh0EOX8qmm&#VD!(VT^jSiEyU?FN0m)JeLz;76_BUo
zp``T5tDa_UM>R|sZXstd+S*25wk#kBU;+m%jP>Xr*DBI5sR7@9p4;stP3(O95k02*
z?l5pB4(Aopc;%zIYY?ejqcK75WGzQ9XgPwR39@{)&2j+o{Qc3dNj#2YE6(js<+{8!
zdv2$xP2}M{hEQ0B?x*0J-OhaJB?7LD720VjJtb>rdZ3l~;E>rH3wm^92e`6{Y?i6p
z=QlNCn@@=aj<a96*)Qb8ck!D*#}8DLn})<Nfr+WfI+c^biXIP8ZTXMJ!ZXKQ-Tifd
zzE<gC57*UmyS=DHVu3AUZ+<0O9&8olGIO$d4_(J;vYdkdSP)@r=Urs!ZlyPI-bB#{
zkq#xEwDx!4R38Sv^M0zlC)ieH;!~>pK@R@6L=9t;wd7Cv27RT(wjD)MCIwV3y?B-_
zF*K4b+gQ5d5_tl>kve(o5TeSC2~0<}u=F<hhDH{Z<<W$Q6AIaMss+M(cO#27*bh7;
z25gNef7G9rass`<67H6O6rmvsSAf_wHfr*7^1~_vy{a<-De-)5^lfZm89W<dc2mdz
z{nnUmtYfYmrBi3i(ht(6<3Q=+|4^c=e4XJ1g(kiWm%cqfGETOrwOf}H-WtN%ExTgP
zN86Opo>5bhkKnM59@YC0DV}DGF4kS?C#wuU_)eQI9r;k9Ce(Q)0A6c_Rk-YtMV~jZ
zfS)PGxjV<kSDaW8E*6~Ir%wi3>wBQ|Wm$j=^uWJmxR;0%o9^}uH%{=CI{|CzJEKcQ
zNUz(#m<zbx-d$vK%YyBW1z`5e8qj_DYCgMMPNXk4v0U_mgt8D{QdXv;->bL9unOfF
zKh1-}(AdU)!id69@7WZGhQak~YD9^H7hYL!%MM`+^RN535u*Y>+E0rs>bv!SLPEVY
zfwZOXLdH-kSKzaWX!fkHhxqjKN@w6E3MYdZwR&ErMpzk*6YV|(0Rf%0LI!a}-y?>e
zhAx76{@7oOKS~Y|dK?}6;)10gSDJRjm(3rkzJ9Rf?W%*Vs+NYeVCT~tgf*9~S>%dc
z{I5E}y~><_?xTvl#@K$M*IUR(m2T{6IT2}qsX#MHCk*qtklLn#MV~PZ0!oj8$Whc<
ze+G_)vyf6-Ud{awGZUqYdYwgo`mGlDef;5wtoisuD;jFx7a?OVO+}b!77pjIt3?=7
z{u_(;cr#V9s8oks5o4_{&H^Og7l#M~&Dd?>NR?Kk8OEile1yvpcFSoXifV<@CUWfl
z!2%e8!Q%cWyl53DmogH?3q&!qK%e1vlfi{EypXmOsuhkW)cwREAsXjOW5D9jTCXQY
zT;cf1IWR3yrhL%!sxj0K+0Hk0G8ly7{iXZ<($7n%t{vi?JPq`KmwCgqB1?N~7dmRC
zh7g5I;7VGRb)+r~=G?Wp(DGN+E16NVEnTbjfxl?keM6T8Y^2}ih8q4uGTot~quoW<
zxEZ2UEQ84<BZLfhXvMPF)HK&Q%n@y53(1UV{^$af0b|^F$rm$XjGl&ftoWJHMYf=7
zLj@-KF-JNwkadY^cujwJ3n`RZm}J6%^f1n(^3J-A2?c8-^;^c`nfQ4{!3+WO#zeN}
z(s80H{sA?hjWtkZ*zBBVS-;>;PL^&WEh|R@-hNi#&;DAxH)f}vKMkpc(TUf5e%Z<!
zEIT5cD^Vkr(|+$oj=add_h@f`3gj4mn>%?Bz8f8`Q{?Vp;p?f@d&?aT3gJL(Y<Y`#
zsLF|%h%(7){xV+ybo^nftj_quFyQZe9o2*Si_!lg@CTyFDpNGkkhWt4ffqp-apXJ*
z#SKN{i**HndO7$R%zwC`Ih>Eczn_BaFkR^WLuY;2P17tUDw_(#gs8fFqey+=TCApW
z>n7@0GcTkWb&JU?@<Uygp>$ZwnN<ACGE(mM?b+Q>v<gfI)=<kg*W}!Udjc7wd-pPW
z_f4#V-($fxdwU@A@-%{an~~;g&~2<i8_Vnv&;gOk;5T^@{ZUKGuR!VLV;D3+rN9c<
ze{6QuELEppXX@F0R1dZ@)95%YrPjE!b@yOKvcL$11nhWAY;_;QECaMhXN^uqp1Z?d
zq8Udv?jyizdD)JXW!%6(tvk$F>7_*W8g0E;oc}L|_?Yx|iidj8vFB6Nto!$=aB6M?
v8+Z9<js!V(gI+R`75^m`-bzAK4wXIQX^zaVUvZ;eeSvP@)KxE5MLqp58Nf>T

literal 0
HcmV?d00001

diff --git a/dwt/evidence/mame-msgbox-ether24-frame1200.png b/dwt/evidence/mame-msgbox-ether24-frame1200.png
new file mode 100644
index 0000000000000000000000000000000000000000..83d4f6c4283aede639c5a0b73c8f848a0a22dac6
GIT binary patch
literal 4796
zcmd^DXH-+$wvGt|kU%I31O#&EQZ#@<KoGDXNL9KZgpwfAB{U(?5WNamP<o_9K|zZ2
zUP9>71wlFpB1KB*J>2--J7?VY<GgqO-!Z<i=bm$|Z|}L+oa@_r>~K@#YaGV~j{^Vz
z4t>2VHvs@<#wqCWF~$)ftaOi^Vc^bsH;n**`%(bF!$$zX9wYQ{4gl~+000Xp06;wf
z0O0pYs=T4W7yvpMT)P4|HWtB~&hS{U`bJk-7LN09$_ZYV)?knTlGv-(SQkeuTHW~`
znqdG+2qhH-MTCMP(p>SJ`Z;BFB^5aYLLGr<<q;G4Uj$EY7dK4s-xDfKNbeW~nZNFU
zb@N2~VI4hv{+_dZs|p7IaFg|~=$Ho$FO3~}3vJ_CeAT+r1$i5n+5f=>H$1DnIP;`G
zLJcd?_EalJ2BV$%V7Pl-b@bTCq^t$Mft>WMe&~y1-@?-XGb|tcDIV<khs-**dcb}e
z;2910;b(2t@K*-)+FUojtN(g8joVVYS-AOJtf_myq3UX$DvwQ+<Zk%BMr&1Cs~OZ=
zN%NwKsX9Uc0wz*X|6=?We@aq7w>m$^rM{X%FLxu8gbv!{2(I_L_D=>?&5osLdBApZ
zJD~^1lMYu>S51f_JHN;*rQ=~21w9^wn<Z8KAqt!w*Bru=m)rS9J-SiVYmNOZmC4pn
z4{vt+ub+%YzXDGQ$hq-mY_gAWR^#@@R*D1Vwt(IXx@DjT^Yq2pCD;b={9&Oe!ShUk
z6tK!W|FACT{W<OhdTx1*cIrzEJrj+Ze93}KsS{mextPDHrvFu%V7m?jQkDtXI#3U1
z_JN5lW+Y-7H?GX2lBfcq_f25JYM77cS{R~mP$Wwz`}l#0RvGF7_yIpnVTU;6P<;Y=
zk31NrOyI0myYR~y6|zlKUSSDlr$6ilUqH}oX`-V;Fy%S$A-hK(nfFIsooJ^^bvJvV
z&I1sL!c5_mHp0I@|MQoR{j<8G2?FA&HU;F!MZmMv!-0pKk93&!gjtCTAY4iw)sHVU
zWx%$_A#BtWwsSi*13f9aqoDwD*bKe}u3cKMgG1{7Z%q0s1?dcR*JMIU58iRkqQ!_0
z(&VFBQ3)Yd<hQ~j`zaJjrJY;dY<qPnyo{o8!>Y5z5bN#i2M*y7`|Cpyz>km=wf9oA
ziA;$79j3}eP#(yMm4@q{@DDoVqd7HNoo7D?lqKeA8d+R=Ue_Nec%)szrEt&Q&Aflq
z$kkcCa~~2i<jWWmg!XH#M@kW*UH4ic_CX3ICBpVhq`1$)AL%znJ{=a{e9p0!km;Ya
z^e9)(*~Tb-2bM_H!jbOvg%>>*id|bcZ0(pQJiSpO-!f(C`_V_7U*sU3;*(V%Ve+HC
zhP#EWXnx+s39+O*F0}u>KlPc08=oG=bX0HDcWa@-okYhDo>DO~%Ry`Q*vX8dY%D|4
zxLd8eupZ6JwF(#KkUxooP2a-;6#68hI>_a3d|Qenjo$R6+Vi=)lVBq>FQKWidRb@t
zN!@CZI|)u86<wwm&Gv!ENdcy)ZXs8%SFjU-Uze?|nO@A9P$nGaRQD^C-((GdQe%V&
z8Wzx``R!7;^H4s&_46i65)-{V;5%O;b*^$Std#ZZMt9Rs<rTG2SX<050!5(+k$s4j
zLyTHGDQ;PkgZ1FK)Rt}#dqb+9>X?@6>RNt<eV3xtGDd?~U^j*uwEfZ2ad;zJTZx!R
z3Y6m`c&9kXB`GAGy;2I4Yudd#gsL!{7&wIQ&*k)`I-AMIx1zyfu?1hcKRu5jol$&C
zO`aGX^8JR1t?;bgas9O-7`iWRG48Q&P1*INFtqZ^Z9-Qh#iM$}5<as!nOeqZp$z_6
zi9*5^u*3I=pH}8z3ugQkw5i1;FjfamXlW-GY>%jNCNGIgE{UiUV{^5on|4V%$`V~j
zK>|+2;Y>hvqYJn!aC^LVAj{!NU`Ru7#vhm#f(y7k_PS!c-s(cURixP;%gD#x_P5(Q
zXVoY{Zk64)k~ul-mf=xdlXvyYtOvLV4HzAM!UxYYkdY4dYIpfFH5qQncEiy<sQJBj
z$cf2*|2{XS7m=WES*!;EVX&*e@UB*#@0I85g8fQFtdng|Zv-18aS^hklc3L(of}B=
zOG`40vS)ker~(y=qPPi`)=Y66T~Dr%ojVN;u{?UN`RN&+XM5=WRQb`V<(K1*Vm<f2
zvYyjQ4E~jC3}oZ5jM%lSpES<d8QP4p9{m2pqHn{iNzA99{4O@Y(S9)!&C)_Fyo|}8
z;rB-(rC%jaJDb|TA<KzPb6<c}UbIZYZPjuC{pM@3;<2TmDo>hObJlzDQ+9!4lNs_=
z%Xf!21GFf=z*?QU&9cL>sw4JOUP7TAqv-*cC+=Lx9|4ON&HS<S<bLH?_ev#o#xB$a
zcPD-6$)$rKe$frHR~UoE_S*8L5S_)y8Acwx1cZzlLPl5*{a@)&uAvcWPV4=w9J0qd
zqG0B{b6u}t9YI<aYxsPZ93JpM+~;MMzL_QMNWZL3n-M#4<%F%2Z{;V0XzM30u!U|t
z>p)eGQi`WeSgkjIt)t0Zd0bLrq(q#*d7p~yki?uQ_DeIj_3=&aLY;Pt&~E1=+!~RN
z&5cj!L8XfzSD0UXVdfF6cE!sBYa|DHVU>(NM)!qIC8T}@UD*3LszZpqs6^xiarbeT
zO))nJ_E7XUE}Z<h-6VW8dK9JIi}P*iPP!vle($x9Lk{Y0Sx74+i!I3?gx5g+0v`mK
zGJ!`XbJ&T!28NzJlbh1=R%WN)X;<QW4{hlQ>QS_$#{Cz|TW{~i{_uYo1MZt4JoU|>
zJdqUt7@4;E1=-INEewt8{h*ls90QxqYiTrP?oE!C=<IOwj46=k_je&Y0*fCW;PY5J
z&`#lsh1!>h+o$MX9<gd9M@Z_<$0aN$H6A3zj|-yJ#7`PnI`cbUA((@u!N%8uWHyc~
z7baTYb5_?mp+`A8zB(lop}mJIh!*2$TqS$JU$DH77XV9wUPkMje7P3A9BHA^W`Z-m
zM3>Q;UnNIe+dch~C6*DoZ~SiR2L2{dR%Ax{eCE^*`iSPESqX;cFe0Ix`SS+8KD9qM
z^7@g?(XiBfZ36uUy`=M@D3nLgoKIkJTE~ef3v@J9r<KF7%0lDfho#%~0g3UYT2KjP
zB=?M$W`5hQc)fPzv`#j@&H?HYLvU#!8t)1bO>){=ucy?6^mon9uCJdUU|Wb&2^8#7
z=;siDWSi%aXPDbjKO$Z9`>v9o+7>4oozM%^3Oc&ya+S#*mh9@$k6HJ4Efuwh&!+`$
zw@KEdTQz;K-7ZblVeGV?2ol=p!Mm4*EFF9VsE8&4h(@Sm@8_pKP`i2Cy6vze*}=N)
z><y+~m_$gmvk5#==PCgy5@YXl3VIz}Pu}2ZAiKaJ*Uu_Ku7km&lWm_L3Q6EaN?zBY
zgd{@GP)OSK-=Z^*L&|l2TQ-SMqi9lH-AW|L+s98~63pf>@=>ZMnWLOqN2%RG)->O4
z0&jr7*+g-sD`m=ZecOu?7Kr&<puuISdl-Rzdgt1Wl#EYplRut}kGOhaOvoXRh4z7F
zk9jSK-d;Jv#f=dV!SKD(VbM%9Cu^}hx3wnH^c6MH>~rH#Tc`qz4Qd%t1w6aG$tgXZ
zm`o70?zda(uu>KGm?&DZfSsFqR+BYf!sI-Qb+?+_KEK2>vgy82t=*jEaG16`hRd@u
zMf=E73nh&vHt6NG<;pz@cW#MQ)ykQc$$t0nUk`IzW;b_52%Wk8MYaA}Zgs`<`-jUG
zWmbL7VpaC$G3uvFQC`?}+ryuBWe`C&O#DXSwoCn5^NY@z1!Mib=CL2f#LH=7K2oK@
z-RE*^2yGCl!RgnZtZa~W#v@fA%684_%v&5mS2Mpyffya=7v9@?|9rf2tP|b}wR=#3
z4Rx87rbqz&Rtq}oZTu#31@@hWsH^0~x<7HsjA*PhbI5N}F@K`_L(-jvC?;Rs`t@<c
z*!8Wi2PqS*xy|IxXUz|Urom7l1)xHtDt_rexU_4FSypi{bGpN)rK0^A$^8`Hj*fT_
z20eY+7C+2E3@GJB$^qRyN}tzNiP0Q~f)0GV$%4dyGx!Mf<<$a0!On_n%iaX?oN1DI
zK{e8?(kx|<W=!`Dgy?#D<C^%+sTg;z+0EtGMT^l0$n!zgm@?7fkgn_If>@6<5t)Hu
zbqUi`v~L`@44ITJd^<^e{>EpJ{m1zJ5|eR+_L~Atg6s;5s{K%{sNpF-nJ&GBZDRE1
zKJ_4_4z(C*a_&g(zh4r6iZd(mHRvy;{<oZ<p25ut8H~`9okWp4cr0kT`{R;!h(1%L
z0;me(bAh&N!RvXMN&UCi^PE2(Bi09QH<9M;lZTaPbx87vLM?A8_?AH`SKhEU{48FL
zs_7gYlUH8!jYDHT_Row}xzccE9dnDqD^m&MCzVv2n?@#LKCv`U?)!=L7#o=s+6}T7
z^FEuoCzp$7yR;1<#qlR3stB6sgb#};Z%3}_q97z@?m3siwEGS(h5})4^yB&nigPDA
zFExH2(rCZEc52w5VyCAOm2EH+80>HmI^n3bHeOmQw76Bf6HH!DRss2H$XsCTbm5ys
zubAQ`|CPr|>0sf=!tPv_*MjLBIsG7gj$W`AeTF4z5bilyq>J+5u%r*NL-MI@sX^C9
zj;XX#mYBi2cv@cdw}(y+@)ug%9dabNz>-h8$Rlg*>IqzLsRJ+5{Soeuz$ck|Vdf|F
z?wEf0S3UVtUUI2%4nrQs=Qz^OXTqZf$PwB%iN_g2s?x(xw0gla_k>y?&a~&`GsjA(
z6)+sTSkJTXh^V~xNLve{t2zwbXhO}g8Z1Uqdq%nA2BE|nxofN&(?PTc-X;5q7n7qy
zH`lj7I5p|r1qx&GOj7z*6F2a;e|w)mPvZA36@9wyG+#IEZ=VB4z-J{`jE{pIX{}%j
z`QM`VJ4sP-q5>s{$R?aID=#Cc;jJ5hGW{QfIp$j{sDvyTARwgRqM_`DFvp&cq@%tc
zd0~#GO!#q+aFC-<&0YEj8x$N8p@586+sOku=i8td^DT<z#|+^RFda{eV*3a6vXlTA
znurq6kpI1iJ*eq2#m>m1_?k%RoK>#RJbf?^J7WF5r;G0ChKiZe%14(%2w3p*1E)p1
zukw8BILj|~d!L!~;cuydgV@EK&2Trx2Bpr&KqL5j9ZaK`<+xoA3(4HT(A5Xm`&9C>
zfnRoXI^zP2E?$##A0tB~&b5kY9u)l`+2o7DX1>4d1PFGVHHKd8%%1ALz8b!3BXy;)
zagg7j%XgSR8}^rMD>0TPvtj-{L(gewSz;S79HMIh%i)GCE)+vTM`q_6QC1ne#M{CG
zk97XS;lNRP0DgV+uvlll&Ra%BMtG;tiJ?j@<0#SiHyr)o_aF<Q7*2CfQ*|z|BNrHS
zw}-Qw`WaeN)-4OG)v!9!Zt7%eBfp}J$7P@PvfhNo^cn$iN=QH1M5JwE9_PjRqH!VP
z^z!}g-{Curun>#B>{%~?fsptF*3fKyvI#hYN8Xl)FzoM4$BX?+!Pc^ps2=6mt9dcl
z1`^D5%ChG5@faO(>f&qrPZyy%D(oBWs4&el^LvqXvEe9KQuP~y7~O&F*tMxqLv>$0
z_*PTl?~erzjV-V(o@kjiOvaM$GM*@l<2s8-2r=tg+|#vJDw+4wIkH6lzuHsl1R-q)
aqPIZUW1gv#zKs7n0R5}RS3X@rh5ZxKiNFy6

literal 0
HcmV?d00001

diff --git a/dwt/evidence/real-unit-msgbox-allpassed.png b/dwt/evidence/real-unit-msgbox-allpassed.png
new file mode 100644
index 0000000000000000000000000000000000000000..efc6115d7b6e4231d78f46a500ca65ee462db38c
GIT binary patch
literal 8113
zcmd5>2UJtpy51+DNg2cj76{5!QKTp;NK14ORFtSFpi*KBIEtXO0D;7@pn~K&s5B{x
z%3vWVDkvp!ET|wwMCpkjJrIhJK-$|U>b+BZ_r7;^t@qYSPWCzH-+TZ6_xGJs8=W0B
zRA;CH05sOFvEK}UA{;6J6?g?H!W-!T;3#YDS8ky+^fjNl(E9fN>PHe8KGMcxLf742
z0P@qWr#F183oqv;xe>0N+(QnjUae}L=j04t@fwf=nre?P-A>XKr1{;X*08|xty2i*
z)<M8}Yj1HkUv_m$ezbziB>0F5vN~7vZ;j~~(?ph<Bao`l7uYKKlH-82BVBEo*y&nQ
zy&bkLY|@@GFn)i!x%F!;ZVggoVSZ4yH1fFty+))^UG6-Ey<_m2cTK5S)Oqf@Kx9E8
z&sQbQu<t(<9d0#g{kRVq{{yKLVTtf>k&6-2D2wUsS{ZG4^Troiq>%Ci*1j48c8_04
z%(HT5ZMM5Mfq^8~Kfu)4sd?BaS%#-4)l0Em^H-MhJP;4s^27?Clq6kCdT+~z*eY_z
zIU$*h@g;{`1>w)x<v9YvC6Js1KNB*N&>zqFbiQrUE^^2RP%?bpBZ)kZP9`gBkjhc%
z{egF1IwUe6n43Go=Z-d*S#vA2GLljyDgh<5`UhL`%-hxAZM#ZtC_nV4wzjDRg{pGr
zPz6g49$A_fh(kIARAoo{Q?=77a<YIN8f3-?kBPl}G!Cl5%8}kCwZ$Z|6dr=)`crWr
zOT^AJAfR*gkT{WrV!*gEycwQ_JZp;NwzwVMn_Ry(4y2=O)z`-XWzGa+Iyq$AfIT9a
z3^^{-BH<6A3yU4;l>#Ch%yOhxsQ8iHY%xI&zUGBPS|piXE)>XGrbU`DWh12EInuKu
zIPXxgWGZGFdXhi|Ig3=|!;sffJcfGv5FE_6#C(i|d(|2cILf~0g48ji2TNY92d~QG
zbl9OCFPG*SC|8xE_Yj1y{_xg7D=Or|*YLyp8NKOgqXW10g+O5<0U+Oe`Suk)vGA>o
zq?1G99vG`}jS%&`$>o0AfMS)xM1*QW?@OH^i1o7&9N68SGLfx~trPoagN8Uv-55Vl
zFi&A4=sSj7OzRXz+{ug@t?1hUIBFybtKeYhJUWJw3S0%IP5tYE;=n3IEb{NW3P$ay
z9F13|o&v2AO5adrRP%AuvEuzacbN!I5S|APquy>?7ANu_c>tN6xfknIvx#ey=%VM%
zN2N?*@xx0C{mJ!shr#1G*2=J*mqo#uwDV7_iN&RXw6~-2nzPsy@%k7;dZR9KtwoD#
zWRa+;U^Yi~=V;6_YUybwt7Wa6_FIK+veWM34F(-inV}3$nk-Lm@X?v$(1@q7Z|Pxq
zddTu<0wdxDqtW{V@#=b9twOF4Q@eO8UoxUa>YR9^WF>K`5z94r1&-Am^djr=9g)VO
z6BBYY1w%})sOIO}x5=hoW0cX_wF^reZj{wa@<ODm*C))5_=Od*S1kjCPueq)J>)Qh
z;myEab~d;sTUxd|t734=jw3CeFYX~ciPu(8h#M++-rWwC<La!#b)%?zXr2!*zDi#f
zjK3wthO({$)eQfm)2TDpd(!JuB4#KB^yeIiOqtb`?MWHhCGEW?b`PR<D<g~IT+&rZ
zqUe*yrKZvu&!YMpW+@B+qWg&6K!mt=A^{N(Sgi61-LgA~@a6%wP9gVUd;VNQ{5@L*
zcOJ)#-X8fr0aMp>%2Ss;zA(ue!^77VETQl7$QLh}WlFCN+%lE|^`Eaol9sm$Rm_a%
zT`5*8>iBVYP@)B;A()bxszD0uR^GWFO(AS9eQ?~9+uqibfUykJb_a?Zft#IDVk;I|
zl)iB~4eJ?Z_y)hdh<3Jrr~9zyvZLxjEDdt^Vs`6;3+Iv8O(!D+E!GKnk~~#?jF1W%
z`3qAcr%~RU1hiBc#+~i)VHn_NT~9ZTTtLr`a(G}xJ-{Hx#MFo!y0l9)bH&LcTQ}QD
zJe2Yx^-Z_>-!SnJna&F*mL?FHK_w`ZrGR#L$uVM!lEI14B>YID-EeR;=V{=1+%RQy
z?L?oWT5L^)fl`ahCmE6x=7_k?U-abNRCa=tP@!x{-=S1hKK&Au=M}_4u?jWyg~)oc
zGA*OZ__G&HAxtK~mm7c<jFT`WwWx7(wuedMXQu#FZUWX)6sUe<&Jx+wG+8-i>^J+!
zmhsX3C$J<)iIkfUdQBp;ert^}8ljOxdt+YPZpxmJ0aQuBzFRIH+Vk|r+CB5_UwB&^
z(l(r~KI_%FWnpzmjzh3(mamst&IHn-Ny&q~KgF8dbz3)$fD}1{#+u-3kJj4k?pLmj
zFfG}{qE=BsnfczU{V{v5)aNw>V{}H=uFfnEmaQ^^yKt}SVQ+eEo<pw8Z>e-|e%OiC
zNd+N9Co64sb<EzSw5Gc~Q-4H7ep88YjCxjmhfY)+7+h*E**sf~sqU3J7T7)a9hucy
zzQE%K{$S^-cg$xyp?7KvmnU}UWOqG@M|e%QJjcTI!cxfIfrq<|DwNHFF_sSrXz)1Y
zb0p8L&6A>)elYm*@TxhrMn2_{WXYNjubmj`C9Q`+j75mI<cSu_ry@%;H`4FSxwpm1
z_Vy!(V;Qnl28FcL6Y2F~CijP{J~a3oso@46xjfc(t-6e+0;go8D=eN2U7mmz3CPkf
zLv|+A=l-8nGGNAWq(ffG@Qd+<{QP0)+5$Y!qi+o9@>gyeTweFzl4~p|Tj!zc*^Fxp
zjN;sHMl42rk|FX_*zw9{w8cjbDR_#|X_U)g)N8%|)~t6-{7cku1_}@!i~G9Gw4T`&
zbq>`qcP++}DrQpmwuv(##2bO;Otxd$iAt#}Gsq^;gobj=c4^tHJ0zz*?teYU{|}=4
zPO7gD*~S>(j^ove0}qiPm7S$48UhtiSur{&hrZexq$_BMa0iZ_7rU?4P#fN1bjCP^
zk!svRq$r&k7z0M}4wL=zfWx5XK@O%M7$j&8r>SQgUDddVzDXM2m=6wWvs*_ZUMA!j
z<F8O&q%S(ea03e~G3l&o-WlLpc?>E7CAqrja@f7}j%86+rYc*gw+y|Mf0Xe0fP?)Y
zDGvg10f}|)azM)Y+&GMTk>TGl$%Sl80l$z<R5FXGZ9EPZW<Ut~MQi`wb=QcDDG1Uo
z7$+%0Ph;!i)tVl3TG?P?=VQChS06YE?4p!l^a)7uKNdGW)vxj3D;u?o7E6{@Y7jNI
zMt82_Nr0<=plBMKC^fuzbUDPhsJ{{;>bGrl0mH*2xQ*5HpFNG}8#J3QK$U!UY5Pyv
z67_S$9zIl@DED(DR@+%3eoZS_97Q}Za&<k>V!w-;R-jsaA}LAIonMPTHED#{9_&AJ
z%+WsVx3^CP?fx-6R@t2SPoM(kTTfqgD5j;q!&Y`aO}ME@T%=*{ZK#yB)FaA!G_#`m
zSx$J0vL-YgB4v5v(3a8Sl&DS*Vf)(Mr{m{}Bfa=eM8_@lVZ$zmu63^jDV%xNV=PX4
zNJ^}J-Bi@zo|QXRwnP;*vU*IN_4&w7_iWjv#a4Tx1Z^>#0%4P(-L=4Vj~?xtz|tmk
zMnfyG2?d>%-TBhTK15C7n{B_=aP!YtV01Rf#u>V<^T&pC(6v@zbp}H~OyCEmDrvhq
zNuYP=e5C~gG_qzEo8oa<5WKV=m4J<zlvb78@mvi|U8M6Bt5dQFgjZxD?uwNA#Y>+f
ze8E8SK&|FWV})Fsy;2`+qN}1AE2}7o`|zV3N67#>PX!-)lcjt`)myfW+hMn_^W0e9
zwxJuKA~lXBm~^pyt=L7fC_v)wHMnu-N2yAm_N)>j>OjnonE@3s{&1gnl5HeLSQ3l^
z@v{?A_sKxVAo;%?>dm7&pOViMZ7S$9Z#ySMBUEhs>;pJL))Nb8Y7*tD1%s)RyrC;M
zAVKTIAI=F;fx6BKolluU+6TaDZi!1PEC9TO5Cns)C)%h32jbOuC<%)X99F>l4J=Lh
zIy4T#n^FzyFuXW3;Pcl1@0dpAYUX2u)=}lsKzJqo&&*M$X{p3Sl$Sy4OjUm*4_^Ps
zj=xKkzZ(viLCmP~nT+53(x-pIboWK|ogx%BsF!{`)ByjS&{2hi;$)14$i7%G7^=%|
zeH2$po2bHlhAxrygtHF}x8Wg)A4(!eHl&0Bkf#2x!7c*R1axQ{`C>b$$k27-X64+9
zOO1Cxl+f}0#Yr3}0#lU7)*D^|W9$4M%|!b^um5vYb%a9LSot4=!F_4yk!D5sd$&w6
zmxme?XgH5aJe^(^B0`@UDGu=Q-e_pPYouf*v(87ubfGJVhb}V@S!zArbU|^T7Fb=+
zJ&K$9FcMlwGMIzL;gfKw31~G7ZS5p{2#X(Ic&CC!yMJr3{~>{wDV^^TE9&fLwu_4Q
zz}>`_^g;h_S<LO_TGdV+{^pYpiQ;+vzl@kV+ppKQaCjHF$8SMS2r6CE#|zVYu{wns
zB>oW3oL>C5IJ_h3cKGlzvGuGm5vvg|EoMgUkII<(Gz%{c7sZN{$$as45E}R*IdQ5i
z-bFFDz@vWluH?AtJlf)R)*^IOszAl;^tq<qcSXz2=XZ=3yDZCN$hy)GO<{Aq@A$x4
z!Gi&uaaGd&u(+DS*2ZDiXL_j5Sz_yOuV;AIL!6)+^!NW#8%lLCrPs5LwH}^IOZMFX
z4HxzZc1ps6gp}r|J;nDZn5z*HvAq7yEbDj<v-#cJ{d!|DR{nn1^PJrfp7i$UAskE_
z12)Ja9FAAKOoMTIsIm<Agy>CC51=I+5PH;j0GBO-&b)lyU>6KF13^gaL9lxw`&Vi5
zH3lTh^_xe>m+WCGn%Pb#$O{W5UP-5YvVML1nFY)IH}naZtFMgKzvx-<Rw(x5zKQS}
zDNVRpl-!AR_s;0v#_id6eO!9S=Lp2}-?-AhBB-3q?umWApVN{?$rjf)jN4X=tY%(}
z%oz8KU@G3}7J0EwW(#KMOM1fx-gPW2BR)^{E}iL_55daP<aQlcSIH{2@>~@b=*ua2
zaptbnv&<#fPgY`#NwjjS%3~$>S|tb0L5nNyC~}kI#;ItG!ATg5Aql^BZ@`6~c`q^r
zw`4`37@ec$2aOe(#T6;>&($kVPGv1X=L}+WDwWM{sgTs|yg;<<2Qs#<FsHXy-Ylf6
zkp?YY1Sj0n*u|8BY|DF|Bf*=0@}e4_wz$Gn%#FOrAFGTopg&IV>Pd~bEx5d<=Etbo
zU{BA|9dhp79;(gijRSc$<yU^C{L0sR<2Aj7svCpVMMk}_S44bLP^+{>izLN6KXqE^
z7tjn{I9xq9a%j#-I?r8;t)my|rB81*Com(_b01XrV00Sg%VO#@8pc6f+S2Z3cD@=3
zKbc?54@C|zhodfcwk|+zY$g>)l1^-C<R~ZJhn<*iU?YovYd_`V4E-ChGbyfcgYPGy
z!K9JD%ha^Z2%Yowit}GR{e7f>@c%JV%=uKI{;T<au5P~<EvD=KqR)YhtLL97VWo?N
zJ}@XiSEaVOery=gx-H(ee|JdXL?cWW2X;d+%+G<n`=xg8{mbdnVl>WiA==e?r>6QB
z%KWC^8Y3Fn@uh;1_iZe}85TL@m<|oMS!{v=z}=sJxsf*a>>ckzqVud<IQCuPzS_o@
z0v{yy+-qLveOllk?G%I;BRmU6oq{TfqdFw~_I9n-Cg$DN{TrH{Hh>>d&YBGA0_()b
z+im-Qn-)rJBs!^iUk_E#*=G_3`(cXYk`o%0rm%V2YVSoKtoN+7+P<G5JRR{S80?-+
zAFFx#)F4sL&OF4!(j&&kuGh}5|71?APr3MQedGsmS^*l|g|5Kmr?l`sTiqSXor8u=
z+?v-1s;oHUo9*78<-|L0J(5XzyB+05T;X@Hkm+KRIdqEyJz*ju4hFc=fVF5~m3Nze
zad+AjcGWu3=<xd9sEXAv615>8%>|<)kF8L??>dcEq774q=Y3j!UaW1!#@VRJg(OMk
zImL4nVV_iy6B;Q8yrNN1ynM4_P#cA3X(8R9Mdk|kCI0-Es_Ap0lAGTgI;_mgN9`a?
z48<y~<9(99%L_1A8KYdogQY*V#Pa%iBNX>b{Vb<~7qr6uYs6#f66WuG_;&3zv~l{=
zr|Q$QFFXBn4Y=+9`X+SRpSr`Z_fda&3JW1JQR15haW){xn<_MiA1s4t&ZB=u=u3Xj
zfadTezoUvl^*|c+j;}u(<p6OBC<Mv6ee^1Lu=W+;rVtcRv9#FUO%8IAnPD>}vg;ws
z<Ux2f*6;|bKuSAi9lA8|vY?BcxDw^EaGHi($s5!Pm<kRbX>#R9&Y>4tzps$sk33J$
zUh$eXO+Gi#5eW@F1B(*XjL7bZW+Cp3?4z6T)8Mj(^!uBT-HcLKt#+B|=}!-~0)acb
z@shVZriu0-yZuY)HRdduAS}h_s9gEW)wohsOWRTHY)KRv_>j9A>B{x(ZS>NT?ad{S
zgb}QdRynY;#IA()@RtT1r!-LSf5hD?aLrB0%fX7PX0YYrXmV>f3WWm`w1_m4Rb757
z41wGvjQgykPurre9%S|7tvBXhA2(?bX=>Zs3)DhOc73eeunXcYyag`cwa2?$q>K^G
zGp;M0vWE?}1~=YGfBe#5A*vYRa4CqkjoBi5Lk(MawgU%GK)X}X5X<#XQ;Zu|{*aQk
zdbGS$61QK9y_!8nMLR$CZg@1;d3Q}Ph|x6ZFSf%p*j$rWag<ot-ppqf+CCAO2JQu!
zvI*G|@lE<ByX3l(84UTVe0Y*UomLRulNmP6^12T#rIMJc>Fag+X5<eIu#*1wu7?`d
z4Z=UWP`QPe;s|+<E597;%DpdOHF#AqXsM4;(We9S^64rce#7PSV&AaB_v8ky^$+>J
zg{AL<&G+I4O7cZ%-y+m^!sfeiqoV(PjOY7c^S!wFzjdsFqefK+v;%j*K)VzM%0J~0
zHc`PWNfLmD+ds6Mf67t%kl;&>(#HrJj0gB`!_RzJ&r=ds%8Qi4<1c|-&RL(F1f3{x
zkCD5)j#>#UY=t`{?P$7Zn{qx%AG#<9gg*|l)XC4^AQKCF`;@36p}4um?evgsyZ7sR
zvQKHt1Y0LP-Qic;xh0xfyJMKRrr2~Ynl+<t(3~9Ud5g<`5N@u`H^d~;F0IKH+MqcE
zHiOMWyShyV)&mzCyP~Lhb4A8O)(=)A5iFLx+`8vOAY&6HJtxdI_?sBH+9)L^6QAQv
z<#`YE8`Ar%tr(KpeGx^)l+F1QNTM(oZ&+(hVdIo@sU*|zO820&r^ftAKG8qd%zocD
zq3w;$d>h-sMJQYSi_hoGN0}(<_j_|s|0@-Iv_?jfwgWsf_{S;p?}z`>KN0`)e;d;V
ZaO;;NdIZB1^v`*)cD1v8&MMN+{{=&*^W^{l

literal 0
HcmV?d00001

diff --git a/dwt/notes/MESSAGEBOX.md b/dwt/notes/MESSAGEBOX.md
new file mode 100644
index 0000000..a89946e
--- /dev/null
+++ b/dwt/notes/MESSAGEBOX.md
@@ -0,0 +1,369 @@
+# The bottom diagnostics message box — window, text source, and the Session→Quit re-show
+
+Status: **DONE**, with one honest emulator caveat (the MAME skip-level1 restart
+does not bring the Terminal Manager back; the last step is static code + the
+real unit's observed box, not an end-to-end MAME reproduction).
+
+Address convention: **Ghidra = `0x07E40000 + ROM file offset`**, firmware **bit
+address = Ghidra × 8**. The TMS34010 program space is bit-addressed, so every
+firmware address below is a **bit** address unless it is explicitly a Ghidra
+address.
+
+---
+
+## 1. Which window is the bottom box?
+
+It is a **separate top-level X window owned by the Terminal Manager
+(`SESSIONMGR_PROC`)**, not a child of the TM window and not a status bar drawn by
+the window manager.
+
+Creation code: `FUN_rom_07e94880` (Ghidra `0x07E94880`, bit `0x3F4A4400`).
+
+```
+07E9492A MOVE *A11(0x40),*A14+,0x1   ; parent = screen->root
+07E9492E MOVE A7,*A14+,0x1           ; display
+07E94930 CALLA 0x07FA8372            ; XCreateSimpleWindow(d, root, ...)
+07E94936 MOVE A8,@0xB7C60            ; <-- box window id
+07E9494E CALLA 0x07FB2FAA            ; XSelectInput(d, win, 0x8000)
+07E94976 CALLA 0x07FA70EE            ; XChangeWindowAttributes(d, win, 0x200, attrs)
+```
+
+The window is mapped at the end of the builder, `0x07E949FA CALLA 0x07FAC9EC`
+(`XMapWindow(d, @0xB7C60)`).
+
+The parent really is the root window: `0x07E948AC` loads `@0xB78E0` (the TM's
+`Display *`, see `GUI_APPS.md`), walks `display->screens[]` (`+0x480`, `+0x440`)
+and takes `screen->root` (`+0x40`) before the `XCreateSimpleWindow` call.
+
+Live on the real unit (`peek`, read-only, two samples 2 s apart):
+
+```
+peek 0xB7C60 4  ->  2d 00 10 00   = 0x0010002d
+```
+
+`0x0010002d` is an X resource id (client base `0x00100000`), i.e. a real server
+window, not a sentinel. The screenshot
+`dwt/evidence/real-unit-msgbox-allpassed.png` shows the separate wide box at the
+bottom, with its own border and no title bar.
+
+**Owner/process:** the TM's process entry is `0x07E5CDBC` (bit `0x3F2E6DE0`,
+`SESSIONMGR_PROC`); the box id and all its state are in that process's globals.
+
+## 2. Where the text comes from
+
+### 2.1 The message table
+
+The strings are in ROM in a table of **22 records, 20 bytes each**, at Ghidra
+`0x07FE5552` (bit `0x3FF2AA90`):
+
+```
+record = 8 zero bytes + [English ptr][French ptr][German ptr]   (20 bytes)
+```
+
+The pointer for record `r`, language `L` is at
+`0x3FF2AA90 + r*0xA0 + 0x40 + L*0x20` (the `+0x40` skips the 8-byte header;
+`0x20` bits = 4 bytes per language pointer).
+
+| record | mask bit | English text |
+|---|---|---|
+| 0 | 7 | `NVR Checksum Error - 14` |
+| 1 | 8 | `Video RAM Error - 22` |
+| 2 | 9 | `MAIN Memory Error - 13` |
+| 3 | 10 | `Host Port Error - 15` |
+| 4 | 11 | `Printer Port Error - 16` |
+| 5 | 12 | `Keyboard Port Error - 18` |
+| 6 | 13 | `Mouse Port Error - 19` |
+| 7 | 14 | `Keyboard Error - 27` |
+| 8 | **15** | **`Ethernet Port Error - 24`** |
+| 9 | 16 | `Mouse Error - 26` |
+| 10 | 17 | `Video Error - 25` |
+| 11 | 18 | `Ethernet ROM Error - 23` |
+| 12 | 19 | `Timer 1 Error - 17` |
+| 13 | 20 | `Timer 2 Error - 21` |
+| 14 | 21 | `Optional RAM Simm 1 Error - 13` |
+| 15 | 22 | `Optional RAM Simm 2 Error - 13` |
+| 16 | 23 | `Optional RAM Simm 3 Error - 13` |
+| 17 | — | `UNEXPECTED DIAGNOSTIC ERROR RECEIVED` (table entry; not selected by the box builder's bit branches) |
+| 18 | mask == 0 | **`All Diagnostics Passed`** |
+| 19 | bits 0–3 | `ROM Checksum Error - 12` |
+| 20 | — | `Memory Path Error - xx` (table entry; not selected by the box builder) |
+| 21 | bit 28 | `Image Board Error - 43` |
+
+Record 18's English pointer is `0x3F4AB9A0` (Ghidra `0x07E95734`), the exact
+string in the box. Record 8's is `0x3F4AB090` (Ghidra `0x07E95612`).
+
+### 2.2 The selection code
+
+The builder is `FUN_rom_07e94986` (bit `0x3F4A4C30`), called from the TM's
+session-start path at `0x07E5E6BC`. It calls `FUN_rom_07e94a08`
+(bit `0x3F4A5040`) to turn the status mask into a list of message pointers:
+
+```
+07E94A16 MOVE @0xCB640,A11,0x1        ; <-- STATUS MASK
+07E94A1C JREQ 0x07E94E4C              ; mask == 0 -> "All Diagnostics Passed"
+...
+07E94A3A MOVE @0x19FF10,A7,0x0        ; language index
+07E94A40 SLL 0x5,A7                   ; *32 bits = *4 bytes
+07E94A4C ADDI 0x19E3D0,A7             ; record 0 + 8 (pointer field)
+07E94A52 MOVE *A7(0x0),*A9(0x40),0x1  ; message ptr -> list entry +8
+```
+
+Destination list arithmetic (`0x07E94A28`–`0x07E94A32`):
+
+```
+SLL 0x7,A9                 ; count * 128
+SLL 0x5,A7                 ; count * 32
+ADD A7,A9                  ; count * 160 bits = count * 20 bytes
+ADDI 0x19F150,A9           ; list base
+```
+
+So the live list is a **20-byte record per error** at bit **`0x19F150`**, with
+the string pointer at **entry + 0x40 bits (8 bytes)**; the builder appends a
+null-pointer terminator. The "All passed" branch uses record 18's pointer
+(`0x19EF10`); the error branches use record 0..16's pointers
+(`0x19E3D0` … `0x19EDD0`), record 19 for bits 0–3 (`0x19EFB0`), and record 21
+for bit 28 (`0x19F0F0`).
+
+The table is also present as a **RAM copy**, byte-for-byte:
+`0x19E390` = record header 0 (bit address), `0x19E3D0` = record 0's English
+pointer. (Verified by comparing the dump at frame 3000 with ROM
+`0x7FE5552`/`0x7FE555A`; the RAM copy begins at byte `0x33C72` in a RAM dump,
+i.e. bit `0x19E390`.)
+
+Live on the real unit:
+
+```
+peek 0x19F190 4  ->  a0 b9 4a 3f   = 0x3F4AB9A0
+peek 0x19F230 4  ->  00 00 00 00   (null terminator)
+peek 0x19E3D0 4  ->  f0 aa 4a 3f   = record 0 (NVR)
+peek 0x19E8D0 4  ->  90 b0 4a 3f   = record 8 (Ethernet Port - 24)
+peek 0x19EF10 4  ->  a0 b9 4a 3f   = record 18 (All Passed)
+peek 0x3F4AB9A0 24 -> b'All Diagnostics Passed\x00A'
+```
+
+### 2.3 The status variable and its writer
+
+**Status variable: the 32-bit failure mask at bit `0xCB640`.**
+
+Read by the box builder at `0x07E94A16`. Accumulated by the diagnostics test
+result handler `FUN_rom_07e7bcf6`:
+
+```
+07E7BD7C MOVE @0xCB640,A11,0x1
+07E7BD82 OR A11,A9                 ; A9 = one result bit (1 << test number)
+07E7BD84 MOVE A9,@0xCB640,0x1      ; <-- OR the failure bit into the mask
+```
+
+The same routine prints the corresponding table entry at
+`0x07E7BDA8 ADDI 0x19E390,A11` (record base) and `0x07E7BDB2 CALLA printf`, so
+the mask and the printed diagnostic report use the same table.
+
+Cleared by the two wrappers:
+
+```
+07E7C212 SUB A11,A11
+07E7C214 MOVE A11,@0xCB640,0x1     ; FUN_07e7c20a
+...
+07E7C276 MOVE A11,@0xCB640,0x1     ; FUN_07e7c26a
+```
+
+`FUN_07e7c20a` is called from the boot diagnostics block
+`0x07EAF184 CALLA 0x07E7C20A`; `FUN_07e7c26a` from the trap/error path
+`0x07EAF526 CALLA 0x07E7C26A`. No other instruction writes `0xCB640`.
+
+Live on the real unit (two samples):
+
+```
+peek 0xCB640 4  ->  00 00 00 00   (0 -> All Diagnostics Passed)
+```
+
+## 3. Why Session→Quit re-shows the box
+
+The box is **not a boot-only alert**. It is created in the TM's session-start
+path and re-reads the persistent mask every time that path runs:
+
+```
+07E5E676 CALLA 0x07EE0D48      ; create_process(VTE, ...) -- start the session
+07E5E6B6 CALLA 0x07FAC9EC      ; XMapWindow(session window)
+07E5E6BC CALLA 0x07E94986      ; <-- build list + create box window + draw + map
+```
+
+`0x07E5E6BC` is unconditional: every session start reaches it.
+
+The Session/Quit action sets the TM quit flag `@0xB70E0`:
+
+```
+07E891D8 MOVE @0xAECDF,A11,0x0     ; confirmation required?
+07E891DE JRNE 0x07E891EC
+07E891E0 MOVK 0x1,A11
+07E891E2 MOVE A11,@0xB70E0,0x1     ; <-- quit flag
+```
+
+(The confirmation path `FUN_07e895e2` sets the same flag at `0x07E895F8`.)
+
+The TM event loop then exits:
+
+```
+07E5E6DC MOVE @0xB70E0,A11,0x1
+07E5E6E2 JRNE 0x07E5F762
+...
+07E5F762 CALLA 0x07E5CD00          ; close display / sleep / restart
+```
+
+`0x07E5CD00` ends with `0x07E5CD90 CALLA 0x07EAF18A` — the kernel/OS restart
+entry. That entry is **after** the diagnostics call, and the restart sets
+`A10 = 1` so the boot block's `0x07EAF182 JRNE 0x07EAF198` skips
+`0x07EAF184 CALLA 0x07E7C20A`:
+
+```
+07EAF180 MOVE A10,A10
+07EAF182 JRNE 0x07EAF198          ; skip diagnostics on restart
+07EAF184 CALLA 0x07E7C20A         ; boot diagnostics (initial boot only)
+...
+07EAF192 MOVI 0x1,A10
+```
+
+Therefore Session→Quit **does not re-run the diagnostics check and does not
+clear `@0xCB640`**. It restarts the OS, the restarted `SESSIONMGR_PROC` runs
+the same session-start code, and `0x07E5E6BC` recreates the box from the mask
+that was already in RAM. On the real unit the mask is `0` (`All Diagnostics
+Passed`), so the same box comes back.
+
+On a plain Expose the TM does not rebuild the list; it only repaints it
+(`0x07E5FAB8` checks that the event window is `@0xB7C60`, then calls the draw
+routine `0x07E94EB0`). That is why the box stays put across ordinary repaints,
+but the *re-creation* after Quit is the session-start builder.
+
+## 4. Live read format
+
+The box text is **not** stored as ASCII in RAM. The readable state is:
+
+| what | bit address | format |
+|---|---|---|
+| status mask | **`0xCB640`** | 32-bit little-endian; `0` = All Passed; bit 15 (`0x8000`) = Ethernet Port Error - 24; bit 8 = Video RAM Error - 22; … |
+| message list | **`0x19F150`** | 20 bytes/entry; string pointer at entry **+0x40 bits (+8 bytes)**; entry *i* pointer at `0x19F150 + i*0xA0 + 0x40`; null pointer terminates |
+| language | **`0x19FF10`** | 16-bit field; 0 = English (source: 2-bit field at `@0xAEC E8`, copied at `0x07E94990`–`0x07E94998`) |
+| RAM table copy | **`0x19E390`** | 22 × 20-byte records, same layout as ROM `0x3FF2AA90` |
+| box window id | **`0xB7C60`** | 32-bit X resource id |
+
+Example live reads (`dwt/exploit.py`-style `peek`, read-only):
+
+```
+peek 0xCB640 4    -> 00 00 00 00       mask = 0
+peek 0x19F190 4   -> a0 b9 4a 3f       list[0] = 0x3F4AB9A0
+peek 0x3F4AB9A0 24-> "All Diagnostics Passed"
+peek 0xB7C60 4    -> 2d 00 10 00       window 0x0010002d
+```
+
+`0x19F190` is `0x19F150 + 0x40`; no count is stored globally — the builder
+returns it in `A8`, and the draw routine walks the list until the null pointer.
+
+## 5. What `DIAGNOSTIC MAILBOX` actually is
+
+`DIAGNOSTIC MAILBOX` is a **debug dump of a separate diagnostics structure**,
+not the bottom box's source.
+
+* The format string is `0x3FAD4890` (Ghidra `0x07F5A912`), only referenced from
+  the dump routine `FUN_rom_07f5a026` (`0x07F5A026`).
+* It reads the pointer **`@0x27C190`** and prints `@+0x00, +0x20, … +0x100` as
+  `test_type`, `test_mode`, `test_result`, `error_ext0..6`, `diag_hld`,
+  `memory_bss`, `test_cnt`, `test_f_cnt`, `memory_lth`, `video_dydx`,
+  `num_of_lnks`, and a memory-error link table.
+* **No code ever arms it.** The only instruction that writes `0x27C190` writes
+  zero:
+
+  ```
+  07F5A38E SUB A9,A9
+  07F5A394 MOVE A9,@0x27C190,0x1     ; clears the pointer
+  ```
+
+  A separate routine (`0x07F59FC8`) fills a fixed buffer at `@0x27C1F0`, but the
+  dump pointer is never pointed at it. On the real unit:
+
+  ```
+  peek 0x27C190 4 -> 00 00 00 00
+  ```
+
+So the mailbox is a dead/debug report dump; the bottom box never reads it. The
+old candidate `0x16F0` (level-1 dispatcher slot) is likewise not referenced by
+`0x07E94986`/`0x07E94A08`.
+
+## 6. Evidence
+
+### Real unit (read-only; 2026-10-18)
+
+| check | value |
+|---|---|
+| `@0xCB640` | `0x00000000` (twice, 2 s apart) |
+| `@0xB7C60` | `0x0010002d` (twice) |
+| `@0x19F190` | `0x3F4AB9A0` (twice) |
+| `@0x19F230` | `0` (sentinel) |
+| `@0x19FF10` (16-bit) | `0` (English) |
+| `@0x19E3D0` / `@0x19E8D0` / `@0x19EF10` | `0x3F4AAAF0` / `0x3F4AB090` / `0x3F4AB9A0` |
+| `@0x27C190` | `0` |
+| string at `0x3F4AB9A0` | `All Diagnostics Passed` |
+| screenshot | `dwt/evidence/real-unit-msgbox-allpassed.png` |
+
+### MAME (skip-level1, RAM poke only — ROM untouched)
+
+* Breakpoint on the builder entry `0x3F4A4C30` fires at **frame 569** with
+  `d@0xCB640 = 0`.
+* Write `@0xCB640 = 0x8000` at frame 568, continue to frame 1200:
+  `list[0] = 0x3F4AB090`, and the frame shows **`Ethernet Port Error - 24`**
+  (`dwt/evidence/mame-msgbox-ether24-frame1200.png`).
+* Write `@0xCB640 = 0x1` -> `list[0] = 0x3F4ABB20` (`ROM Checksum Error - 12`).
+* Write `@0xCB640 = 0x10000000` -> `list[0] = 0x3F4ABC98`
+  (`Image Board Error - 43`).
+* Write the quit flag `@0xB70E0 = 1` at frame 1200: `0x3F578C50`
+  (`0x07EAF18A`, OS restart) is reached at frame 3054 with `@0xCB640` still
+  `0x8000`; the boot diagnostics breakpoint `0x3F3E1050` does **not** fire
+  again. (In the skip-level1 emulator the restarted X server comes back at the
+  root weave but the TM does not recreate its window within 8500 frames — see
+  caveat.)
+* Control frame with mask 0: `dwt/evidence/mame-msgbox-allpassed-frame3000.png`.
+
+## 7. Caveats
+
+* The **MAME skip-level1 restart** reproduces the OS restart and the mask
+  persistence, but not the TM's return. The real unit does return to the TM with
+  the box (the owner's observation and
+  `dwt/evidence/real-unit-msgbox-allpassed.png`). The final rebuild step is
+  therefore static (`0x07E5E6BC` is unconditional in the session-start path) plus
+  the real-unit observation, not an end-to-end emulator trace.
+* The exact "Session → Quit" menu item may be the `Abort X Session` item or the
+  `Quit Control` button; both are session-ending actions. The quit flag
+  `@0xB70E0` and the `0x07E5CD00 → 0x07EAF18A` restart are the path proven here.
+  A Quit that only closes the VTE window would leave the box window untouched and
+  the Expose redraw (`0x07E5FAB8 → 0x07E94EB0`) would repaint the same list; the
+  end result (same text from the same mask) is identical.
+* The box can hold **several** messages: the builder appends one record per set
+  mask bit and terminates with a null pointer. The window height is derived from
+  the count in `0x07E94880`.
+* `UNEXPECTED DIAGNOSTIC ERROR RECEIVED` and `Memory Path Error - xx` are table
+  entries but are not selected by the box builder's current bit branches; they
+  are used by the diagnostics reporter.
+
+## 8. Reproduce the MAME checks
+
+```sh
+# box builder location / mask at build time
+VT1200_SKIP_LEVEL1=1 BOX_FRAMES=600 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+  -rompath harness/mame/roms -video none -sound none -nothrottle -skip_gameinfo \
+  -cfg_directory .vt1200-scratch/msgbox/cfg \
+  -nvram_directory .vt1200-scratch/msgbox/nvram \
+  -debug -debugger none -debuglog \
+  -autoboot_script .vt1200-scratch/msgbox/probe_box.lua -autoboot_delay 0 \
+  -seconds_to_run 30
+# grep BOXBUILD debug.log  ->  BOXBUILD fr=569 ... mask=00000000
+
+# force a failing bit just before the build
+MASK_VAL=0x8000 BOX_FRAMES=1250 VT1200_DUMP_FRAME=1200 \
+VT1200_DUMP_DIR=$PWD/.vt1200-scratch/msgbox VT1200_SKIP_LEVEL1=1 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 ... \
+  -autoboot_script .vt1200-scratch/msgbox/probe_box_mask.lua ...
+# frame 1200 shows "Ethernet Port Error - 24"; RAM @0x19F190 = 0x3F4AB090
+```
+
+The probe scripts live in `.vt1200-scratch/msgbox/` (scratch, not source of
+truth). The ROM is untouched: `md5 b46a3e442ccb86134d2356bd70d22fd2`.
diff --git a/dwt/notes/REAL_UNIT.md b/dwt/notes/REAL_UNIT.md
index 6b749c8..7b955cb 100644
--- a/dwt/notes/REAL_UNIT.md
+++ b/dwt/notes/REAL_UNIT.md
@@ -388,3 +388,25 @@ The build name must be <= 8 characters: `tftpc_real` silently fails (no
 
 Evidence: `dwt/loader/evidence/real-unit-xtext/` (loads, markers, server logs,
 screenshots, emulator runs, `xtext_probe.lua`).
+
+### Bottom diagnostics box: live state (2026-10-18, read-only)
+
+The separate bottom X window is owned by the Terminal Manager; its window id is
+the global at bit `0xB7C60`. The text is selected from the status mask at bit
+`0xCB640` and a pointer list at bit `0x19F150` (20-byte entries, string pointer
+at +8 bytes). Live reads, two samples 2 s apart:
+
+```
+peek 0xCB640 4   -> 00 00 00 00      mask 0 -> "All Diagnostics Passed"
+peek 0xB7C60 4   -> 2d 00 10 00      box window 0x0010002d
+peek 0x19F190 4  -> a0 b9 4a 3f      list[0] -> 0x3F4AB9A0
+peek 0x19F230 4  -> 00 00 00 00      null terminator
+peek 0x19FF10 2  -> 00 00            language 0 (English)
+peek 0x19E8D0 4  -> 90 b0 4a 3f      record 8: "Ethernet Port Error - 24"
+peek 0x27C190 4  -> 00 00 00 00      DIAGNOSTIC MAILBOX pointer is NULL
+peek 0x3F4AB9A0  -> "All Diagnostics Passed"
+```
+
+The mask bit mapping (bit 15 = Ethernet Port Error - 24, bit 8 = Video RAM
+Error - 22, ...) was verified dynamically in MAME by setting `@0xCB640` before
+the builder at frame 569. Full trace: `dwt/notes/MESSAGEBOX.md`.