diff --git a/harness/mame/fontwork/custom_serve.py b/harness/mame/fontwork/custom_serve.py
new file mode 100644
index 0000000..ac81c6d
--- /dev/null
+++ b/harness/mame/fontwork/custom_serve.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""fontwork server: serve ONE chosen file for every requested name.
+
+Used to test whether the terminal's TFTP abort is a size/capacity effect: the
+same name ('69') is served as the 680-byte baseline or as a small file, and we
+watch whether the transfer completes.  Uses the project's own TFTPServer class.
+
+    python3 custom_serve.py <file-to-serve> [bind-ip]
+"""
+import os
+import sys
+import time
+
+ROOT = "/home/arti/code/k-space/vt1200"
+sys.path.insert(0, os.path.join(ROOT, "tools"))
+import fontgen  # noqa: E402
+
+src = sys.argv[1]
+host = sys.argv[2] if len(sys.argv) > 2 else "192.168.99.1"
+with open(src, "rb") as fh:
+    blob = fh.read()
+print(f"serving {src} ({len(blob)} bytes) as EVERY name on {host}:69", flush=True)
+
+srv = fontgen.TFTPServer((host, 69), {}, timeout=60.0, retries=10,
+                         resolver=lambda name: blob).start()
+try:
+    while True:
+        time.sleep(0.5)
+        while srv.log:
+            ts, name, addr = srv.log.pop(0)
+            stamp = time.strftime("%H:%M:%S", time.localtime(ts))
+            print(f"{stamp}  {addr[0]}:{addr[1]} requested {name!r}", flush=True)
+except KeyboardInterrupt:
+    pass
+finally:
+    srv.stop()
diff --git a/harness/mame/fontwork/custom_serve3.py b/harness/mame/fontwork/custom_serve3.py
new file mode 100644
index 0000000..bdf94c1
--- /dev/null
+++ b/harness/mame/fontwork/custom_serve3.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""fontwork index-then-font server.
+
+Serves a small (<512-byte, one-block) directory index for the font path, which
+names 'evil.pcf', and serves the crafted font for that name.  This isolates the
+font fetch from the one-block index fetch so we can see whether a completed
+multi-block font transfer parses.
+
+    python3 custom_serve3.py [bind-ip] [index-name]
+"""
+import os
+import sys
+import time
+
+ROOT = "/home/arti/code/k-space/vt1200"
+sys.path.insert(0, os.path.join(ROOT, "tools"))
+import fontgen  # noqa: E402
+
+host = sys.argv[1] if len(sys.argv) > 1 else "192.168.99.1"
+index_name = sys.argv[2] if len(sys.argv) > 2 else "evil.pcf"
+with open(os.path.join(ROOT, "reference/fonts/evil-real.pcf"), "rb") as fh:
+    evil = fh.read()
+index = (index_name + "\n").encode()
+print(f"index={index!r} ({len(index)} bytes); font {index_name} = {len(evil)} bytes", flush=True)
+
+
+def resolve(name):
+    if name == "69" or name.endswith("fonts.dir") or name.endswith("/"):
+        return index
+    if index_name in name or "evil" in name:
+        return evil
+    return index
+
+
+srv = fontgen.TFTPServer((host, 69), {}, timeout=60.0, retries=10,
+                         resolver=resolve).start()
+try:
+    while True:
+        time.sleep(0.5)
+        while srv.log:
+            ts, name, addr = srv.log.pop(0)
+            stamp = time.strftime("%H:%M:%S", time.localtime(ts))
+            print(f"{stamp}  {addr[0]}:{addr[1]} requested {name!r}", flush=True)
+except KeyboardInterrupt:
+    pass
+finally:
+    srv.stop()
diff --git a/harness/mame/fontwork/custom_serve4.py b/harness/mame/fontwork/custom_serve4.py
new file mode 100644
index 0000000..6eab3a2
--- /dev/null
+++ b/harness/mame/fontwork/custom_serve4.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""fontwork index-then-font server (v4).
+
+Serves the project's real fonts.dir verbatim for the font path and for
+'<path>/fonts.dir', and serves the crafted multi-block font for the font name
+listed in that index (and for anything else that looks like a file).  This is
+the closest reproduction of the owner's intended flow with a valid, one-block
+index, so we can see whether the crafted font's own transfer completes.
+"""
+import os
+import sys
+import time
+
+ROOT = "/home/arti/code/k-space/vt1200"
+sys.path.insert(0, os.path.join(ROOT, "tools"))
+import fontgen  # noqa: E402
+
+host = sys.argv[1] if len(sys.argv) > 1 else "192.168.99.1"
+with open(os.path.join(ROOT, "reference/fonts/fonts.dir"), "rb") as fh:
+    fonts_dir = fh.read()
+with open(os.path.join(ROOT, "reference/fonts/evil-real.pcf"), "rb") as fh:
+    evil = fh.read()
+print(f"fonts.dir={fonts_dir!r}; font -> evil-real.pcf ({len(evil)} bytes)", flush=True)
+
+
+def resolve(name):
+    if name.endswith("fonts.dir") or name == "69":
+        return fonts_dir
+    return evil
+
+
+srv = fontgen.TFTPServer((host, 69), {}, timeout=60.0, retries=10,
+                         resolver=resolve).start()
+try:
+    while True:
+        time.sleep(0.5)
+        while srv.log:
+            ts, name, addr = srv.log.pop(0)
+            stamp = time.strftime("%H:%M:%S", time.localtime(ts))
+            print(f"{stamp}  {addr[0]}:{addr[1]} requested {name!r}", flush=True)
+except KeyboardInterrupt:
+    pass
+finally:
+    srv.stop()
diff --git a/harness/mame/fontwork/custom_serve5.py b/harness/mame/fontwork/custom_serve5.py
new file mode 100644
index 0000000..098fa71
--- /dev/null
+++ b/harness/mame/fontwork/custom_serve5.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""fontwork: drive the font reader with the crafted 25 KB font.
+
+Serves baseline.pcf for the path/index names (so the terminal, reading the
+first bytes of the path object as a name, asks for the PCF-magic name) and the
+crafted 25,860-byte font for everything else.  That makes the terminal's own
+font reader fetch a many-block file, which is the transfer the crash work needs.
+"""
+import os
+import sys
+import time
+
+ROOT = "/home/arti/code/k-space/vt1200"
+sys.path.insert(0, os.path.join(ROOT, "tools"))
+import fontgen  # noqa: E402
+
+host = sys.argv[1] if len(sys.argv) > 1 else "192.168.99.1"
+with open(os.path.join(ROOT, "reference/fonts/baseline.pcf"), "rb") as fh:
+    base = fh.read()
+with open(os.path.join(ROOT, "reference/fonts/evil-real.pcf"), "rb") as fh:
+    evil = fh.read()
+print(f"path={len(base)}B baseline; font name -> {len(evil)}B evil-real.pcf", flush=True)
+
+
+def resolve(name):
+    if name == "69" or name.endswith("fonts.dir"):
+        return base
+    return evil
+
+
+srv = fontgen.TFTPServer((host, 69), {}, timeout=60.0, retries=10,
+                         resolver=resolve).start()
+try:
+    while True:
+        time.sleep(0.5)
+        while srv.log:
+            ts, name, addr = srv.log.pop(0)
+            stamp = time.strftime("%H:%M:%S", time.localtime(ts))
+            print(f"{stamp}  {addr[0]}:{addr[1]} requested {name!r}", flush=True)
+except KeyboardInterrupt:
+    pass
+finally:
+    srv.stop()
diff --git a/harness/mame/fontwork/custom_serve_ram.log b/harness/mame/fontwork/custom_serve_ram.log
new file mode 100644
index 0000000..a5fcb53
--- /dev/null
+++ b/harness/mame/fontwork/custom_serve_ram.log
@@ -0,0 +1,7 @@
+path=680B baseline; font name -> 25860B evil-real.pcf
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
+22:00:11  192.168.99.2:1025 requested '69'
+22:00:11  192.168.99.2:1026 requested '69/fonts.dir'
+22:00:11  192.168.99.2:1027 requested '\x01fcp'
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
diff --git a/harness/mame/fontwork/netns_up.sh b/harness/mame/fontwork/netns_up.sh
new file mode 100755
index 0000000..4d780f9
--- /dev/null
+++ b/harness/mame/fontwork/netns_up.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Isolated test network: a persistent tap inside a netns, so our MAME can run
+# without holding the owner's `tap-mess-1000-0`.  The MAME process runs as root
+# inside the namespace, so its taptun asks for `tap-mess-0-0` (uid 0).
+set -euo pipefail
+NS=vt1test
+sudo -n ip netns del "$NS" 2>/dev/null || true
+sudo -n ip netns add "$NS"
+sudo -n ip netns exec "$NS" ip link set lo up
+sudo -n ip netns exec "$NS" ip tuntap add dev tap-mess-0-0 mode tap
+sudo -n ip netns exec "$NS" ip addr add 192.168.99.1/24 dev tap-mess-0-0
+sudo -n ip netns exec "$NS" ip link set tap-mess-0-0 up || true
+echo "netns $NS ready:"
+sudo -n ip netns exec "$NS" ip -br addr
diff --git a/harness/mame/fontwork/run_custom.sh b/harness/mame/fontwork/run_custom.sh
new file mode 100755
index 0000000..faa9054
--- /dev/null
+++ b/harness/mame/fontwork/run_custom.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Serve ONE chosen file for every TFTP name inside the isolated netns and boot
+# the terminal, capturing the wire.  Usage:
+#   run_custom.sh <file> [seconds]
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+FILE="$1"
+SECS="${2:-30}"
+TAG="$(basename "$FILE")"
+
+sudo -n ip netns exec "$NS" pkill -f 'custom_serve.py' 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -f 'harness/serve.py' 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sleep 0.3
+
+# fresh NVR copy per test (the OS rewrites settings during boot)
+rm -rf "$WORK/nvram-$TAG"
+mkdir -p "$WORK/nvram-$TAG/vt1200"
+cp "$WORK/nvram_pristine.bin" "$WORK/nvram-$TAG/vt1200/nvram"
+
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve.py" "$FILE" 192.168.99.1 \
+    >"$WORK/custom_serve.log" 2>&1 &
+SRV=$!
+sleep 1.2
+
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 \
+    'udp port 69' -w "$WORK/custom_$TAG.pcap" 2>/dev/null &
+sleep 0.3
+
+timeout $((SECS+8)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram-$TAG" -networkprovider taptun \
+    -seconds_to_run "$SECS" >"$WORK/mame_$TAG.log" 2>&1 || true
+
+sudo -n ip netns exec "$NS" pkill -f 'custom_serve.py' 2>/dev/null || true
+wait $SRV 2>/dev/null || true
+sleep 2; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== $TAG server log ==="
+cat "$WORK/custom_serve.log"
+echo "=== $TAG pcap ==="
+sudo -n tcpdump -r "$WORK/custom_$TAG.pcap" -n 2>/dev/null | tail -25
diff --git a/harness/mame/fontwork/run_probe.sh b/harness/mame/fontwork/run_probe.sh
new file mode 100755
index 0000000..35013f3
--- /dev/null
+++ b/harness/mame/fontwork/run_probe.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Probe run: same isolated netns test, but with the debugger and fontprobe.lua so
+# the tftp_read capacity check reports live register values into debug.log.
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-20}"; shift || true
+
+sudo -n ip netns exec "$NS" pkill -f 'harness/serve.py' 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sleep 0.3
+
+sudo -n ip netns exec "$NS" python3 -u "$ROOT/harness/serve.py" 192.168.99.1 --bootp \
+    >"$WORK/serve.log" 2>&1 &
+SRV=$!
+sleep 1.5
+
+cd "$ROOT"
+timeout $((SECS+15)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram" -networkprovider taptun \
+    -debug -debugger none -debuglog \
+    -autoboot_script "$ROOT/harness/mame/fontprobe.lua" -autoboot_delay 0 \
+    -seconds_to_run "$SECS" "$@" >"$WORK/mame_probe.log" 2>&1 || true
+
+sudo -n ip netns exec "$NS" pkill -f 'harness/serve.py' 2>/dev/null || true
+wait $SRV 2>/dev/null || true
+echo "=== debug.log: tftp_read ==="
+grep -E 'TFTP-READ-ENTRY|CHK |BUFSIZE-ERR|SEND-ERROR-3|GOT-ERROR-PKT' "$WORK/../debug.log" 2>/dev/null | head -60 || true
+echo "=== serve.log ==="
+grep -vE 'screen_update|scanline|guard#' "$WORK/serve.log" | tail -10
diff --git a/harness/mame/fontwork/run_probe5.sh b/harness/mame/fontwork/run_probe5.sh
new file mode 100755
index 0000000..24d0f6a
--- /dev/null
+++ b/harness/mame/fontwork/run_probe5.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-30}"
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-c3" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-c3/vt1200"; cp "$WORK/nvram_pristine.bin" "$WORK/nvram-c3/vt1200/nvram"
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve5.py" 192.168.99.1 >"$WORK/serve5.log" 2>&1 &
+SRV=$!; sleep 1.2
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 'udp port 69' -w "$WORK/serve5.pcap" 2>/dev/null &
+sleep 0.3
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+  -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" -nvram_directory "$WORK/nvram-c3" -networkprovider taptun \
+  -debug -debugger none -debuglog -autoboot_script "$ROOT/harness/mame/fontprobe.lua" -autoboot_delay 0 \
+  -seconds_to_run "$SECS" >"$WORK/mame_trace3.log" 2>&1 || true
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 1; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== server ==="; cat "$WORK/serve5.log"
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -140
+echo "=== pcap tail ==="; sudo -n tcpdump -r "$WORK/serve5.pcap" -n 2>/dev/null | tail -30
diff --git a/harness/mame/fontwork/run_ramdump.sh b/harness/mame/fontwork/run_ramdump.sh
new file mode 100755
index 0000000..215495c
--- /dev/null
+++ b/harness/mame/fontwork/run_ramdump.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One-off: boot with the baseline-as-every-name server and dump main RAM at
+# frames 390/391/392 so the TFTP client's own globals and buffers can be read
+# directly from the dump.
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+FILE="${1:-$ROOT/reference/fonts/baseline.pcf}"
+SECS="${2:-25}"
+
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-ram3" "$WORK/ram3"
+mkdir -p "$WORK/nvram-ram3/vt1200" "$WORK/ram3"
+cp "$WORK/nvram_pristine.bin" "$WORK/nvram-ram3/vt1200/nvram"
+
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve5.py" 192.168.99.1 \
+    >"$WORK/custom_serve_ram.log" 2>&1 &
+SRV=$!
+sleep 1.2
+
+timeout $((SECS+10)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    VT1200_DUMP_RAM_FRAMES=394,395,396 VT1200_DUMP_DIR="$WORK/ram3" \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram-ram3" -networkprovider taptun \
+    -seconds_to_run "$SECS" >"$WORK/mame_ram.log" 2>&1 || true
+
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+ls -la "$WORK/ram/"
+grep -E 'dumped' "$WORK/mame_ram.log" || true
+echo "--- server log ---"; cat "$WORK/custom_serve_ram.log"
diff --git a/harness/mame/fontwork/run_test.sh b/harness/mame/fontwork/run_test.sh
new file mode 100755
index 0000000..147ced8
--- /dev/null
+++ b/harness/mame/fontwork/run_test.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Run an isolated VT1200 fetch test: our own TFTP+BOOTP server and our own MAME,
+# both inside netns vt1test on its private tap.  Captures the wire.
+#
+#   harness/mame/fontwork/run_test.sh [seconds] [extra MAME args...]
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-40}"; shift || true
+
+sudo -n ip netns exec "$NS" pkill -f 'harness/serve.py' 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sleep 0.3
+
+sudo -n ip netns exec "$NS" python3 -u "$ROOT/harness/serve.py" 192.168.99.1 --bootp \
+    >"$WORK/serve.log" 2>&1 &
+SRV=$!
+sleep 1.5
+
+sudo -n ip netns exec "$NS" timeout $((SECS+8)) tcpdump -i tap-mess-0-0 -n -s0 \
+    'udp port 69 or udp port 67 or udp port 68' -w "$WORK/run.pcap" 2>"$WORK/tcpdump.err" &
+sleep 0.5
+
+cd "$ROOT"
+timeout $((SECS+10)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram" -networkprovider taptun \
+    -seconds_to_run "$SECS" "$@" >"$WORK/mame.log" 2>&1 || true
+
+sleep 1
+sudo -n ip netns exec "$NS" pkill -f 'harness/serve.py' 2>/dev/null || true
+wait $SRV 2>/dev/null || true
+echo "=== serve.log (tail) ==="
+grep -vE 'screen_update|scanline|guard#' "$WORK/serve.log" | tail -40
+echo "=== pcap summary ==="
+sudo -n tcpdump -r "$WORK/run.pcap" -n 2>/dev/null | tail -40
diff --git a/harness/mame/fontwork/run_trace.sh b/harness/mame/fontwork/run_trace.sh
new file mode 100755
index 0000000..068c2fa
--- /dev/null
+++ b/harness/mame/fontwork/run_trace.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Boot with fonttrace.lua + the chosen custom server and collect debug.log.
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+FILE="${1:-$ROOT/reference/fonts/baseline.pcf}"
+SECS="${2:-20}"; TAG="$(basename "$FILE")"
+
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-$TAG" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-$TAG/vt1200"
+cp "$WORK/nvram_pristine.bin" "$WORK/nvram-$TAG/vt1200/nvram"
+
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve.py" "$FILE" 192.168.99.1 \
+    >"$WORK/custom_serve_$TAG.log" 2>&1 &
+SRV=$!
+sleep 1.2
+
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram-$TAG" -networkprovider taptun \
+    -debug -debugger none -debuglog \
+    -autoboot_script "$ROOT/harness/mame/fonttrace.lua" -autoboot_delay 0 \
+    -seconds_to_run "$SECS" >"$WORK/mame_trace.log" 2>&1 || true
+
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+echo "=== server ==="; cat "$WORK/custom_serve_$TAG.log"
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKREAD|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -80
diff --git a/harness/mame/fontwork/run_trace3.sh b/harness/mame/fontwork/run_trace3.sh
new file mode 100755
index 0000000..813e5be
--- /dev/null
+++ b/harness/mame/fontwork/run_trace3.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-30}"
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-c3" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-c3/vt1200"; cp "$WORK/nvram_pristine.bin" "$WORK/nvram-c3/vt1200/nvram"
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve3.py" 192.168.99.1 >"$WORK/serve3.log" 2>&1 &
+SRV=$!; sleep 1.2
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 'udp port 69' -w "$WORK/serve3.pcap" 2>/dev/null &
+sleep 0.3
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+  -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" -nvram_directory "$WORK/nvram-c3" -networkprovider taptun \
+  -debug -debugger none -debuglog -autoboot_script "$ROOT/harness/mame/fonttrace.lua" -autoboot_delay 0 \
+  -seconds_to_run "$SECS" >"$WORK/mame_trace3.log" 2>&1 || true
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 1; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== server ==="; cat "$WORK/serve3.log"
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -140
+echo "=== pcap tail ==="; sudo -n tcpdump -r "$WORK/serve3.pcap" -n 2>/dev/null | tail -30
diff --git a/harness/mame/fontwork/run_trace4.sh b/harness/mame/fontwork/run_trace4.sh
new file mode 100755
index 0000000..7503616
--- /dev/null
+++ b/harness/mame/fontwork/run_trace4.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-30}"
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-c3" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-c3/vt1200"; cp "$WORK/nvram_pristine.bin" "$WORK/nvram-c3/vt1200/nvram"
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve4.py" 192.168.99.1 >"$WORK/serve4.log" 2>&1 &
+SRV=$!; sleep 1.2
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 'udp port 69' -w "$WORK/serve4.pcap" 2>/dev/null &
+sleep 0.3
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+  -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" -nvram_directory "$WORK/nvram-c3" -networkprovider taptun \
+  -debug -debugger none -debuglog -autoboot_script "$ROOT/harness/mame/fonttrace.lua" -autoboot_delay 0 \
+  -seconds_to_run "$SECS" >"$WORK/mame_trace3.log" 2>&1 || true
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 1; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== server ==="; cat "$WORK/serve4.log"
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -140
+echo "=== pcap tail ==="; sudo -n tcpdump -r "$WORK/serve4.pcap" -n 2>/dev/null | tail -30
diff --git a/harness/mame/fontwork/run_trace5.sh b/harness/mame/fontwork/run_trace5.sh
new file mode 100755
index 0000000..f5c44a1
--- /dev/null
+++ b/harness/mame/fontwork/run_trace5.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-30}"
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-c3" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-c3/vt1200"; cp "$WORK/nvram_pristine.bin" "$WORK/nvram-c3/vt1200/nvram"
+sudo -n ip netns exec "$NS" python3 -u "$WORK/custom_serve5.py" 192.168.99.1 >"$WORK/serve5.log" 2>&1 &
+SRV=$!; sleep 1.2
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 'udp port 69' -w "$WORK/serve5.pcap" 2>/dev/null &
+sleep 0.3
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+  /home/arti/code/k-space/mame0289/vt1200 vt1200 -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+  -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" -nvram_directory "$WORK/nvram-c3" -networkprovider taptun \
+  -debug -debugger none -debuglog -autoboot_script "$ROOT/harness/mame/fonttrace.lua" -autoboot_delay 0 \
+  -seconds_to_run "$SECS" >"$WORK/mame_trace3.log" 2>&1 || true
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 1; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== server ==="; cat "$WORK/serve5.log"
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -140
+echo "=== pcap tail ==="; sudo -n tcpdump -r "$WORK/serve5.pcap" -n 2>/dev/null | tail -30
diff --git a/harness/mame/fontwork/run_trace_serve.sh b/harness/mame/fontwork/run_trace_serve.sh
new file mode 100755
index 0000000..4cb4a66
--- /dev/null
+++ b/harness/mame/fontwork/run_trace_serve.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# The owner's exact server (harness/serve.py) + fonttrace.lua, in the isolated
+# namespace.  Capture + trace + server log in one run.
+set -euo pipefail
+NS=vt1test
+ROOT=/home/arti/code/k-space/vt1200
+WORK=$ROOT/harness/mame/fontwork
+SECS="${1:-25}"
+
+sudo -n ip netns exec "$NS" pkill -x vt1200 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 0.3
+rm -rf "$WORK/nvram-serve" "$ROOT/debug.log"
+mkdir -p "$WORK/nvram-serve/vt1200"
+cp "$WORK/nvram_pristine.bin" "$WORK/nvram-serve/vt1200/nvram"
+
+sudo -n ip netns exec "$NS" python3 -u "$ROOT/harness/serve.py" 192.168.99.1 --bootp \
+    >"$WORK/serve_real.log" 2>&1 &
+SRV=$!
+sleep 1.2
+sudo -n ip netns exec "$NS" timeout $((SECS+6)) tcpdump -i tap-mess-0-0 -n -s0 \
+    'udp port 69' -w "$WORK/serve_real.pcap" 2>/dev/null &
+sleep 0.3
+
+cd "$ROOT"
+timeout $((SECS+12)) sudo -n ip netns exec "$NS" env -u DISPLAY \
+    SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy \
+    XDG_RUNTIME_DIR="$WORK" VT1200_SKIP_LEVEL1=1 \
+    /home/arti/code/k-space/mame0289/vt1200 vt1200 \
+    -rompath "$ROOT/harness/mame/roms" -video none -sound none -nothrottle \
+    -skip_gameinfo -cfg_directory "$ROOT/harness/mame/cfg-net" \
+    -nvram_directory "$WORK/nvram-serve" -networkprovider taptun \
+    -debug -debugger none -debuglog \
+    -autoboot_script "$ROOT/harness/mame/fonttrace.lua" -autoboot_delay 0 \
+    -seconds_to_run "$SECS" >"$WORK/mame_trace_serve.log" 2>&1 || true
+
+kill $SRV 2>/dev/null || true
+sudo -n ip netns exec "$NS" pkill -x python3 2>/dev/null || true
+sleep 1; sudo -n pkill -x tcpdump 2>/dev/null || true
+echo "=== server ==="; grep -vE 'screen_update|scanline|guard#' "$WORK/serve_real.log" | tail -20
+echo "=== trace ==="; grep -E 'TFTP-ENTRY|EXPECTED|RECV|OPCODE|BLKREAD|BLKCHK|ACK|COPY|READ-RET|OPEN-OK|CLOSE' "$ROOT/debug.log" | head -120
+echo "=== pcap (tail) ==="; sudo -n tcpdump -r "$WORK/serve_real.pcap" -n 2>/dev/null | tail -30
diff --git a/harness/mame/fontwork/serve5.log b/harness/mame/fontwork/serve5.log
new file mode 100644
index 0000000..8e7a4fb
--- /dev/null
+++ b/harness/mame/fontwork/serve5.log
@@ -0,0 +1,7 @@
+path=680B baseline; font name -> 25860B evil-real.pcf
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
+22:00:37  192.168.99.2:1025 requested '69'
+22:00:37  192.168.99.2:1026 requested '69/fonts.dir'
+22:00:37  192.168.99.2:1027 requested '\x01fcp'
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
diff --git a/harness/mame/fontwork/serve_real.log b/harness/mame/fontwork/serve_real.log
new file mode 100644
index 0000000..c98ac58
--- /dev/null
+++ b/harness/mame/fontwork/serve_real.log
@@ -0,0 +1,7 @@
+serving 29 names on ('192.168.99.1', 69)
+  names: 69, 69/baseline.pcf, 69/evil.pcf, 69/fonts.dir, 69/v1200a.pcf, ROM, X11/baseline.pcf, X11/evil.pcf, X11/fonts.dir, X11/v1200a.pcf, baseline.pcf, evil.pcf, font, font/baseline.pcf, font/evil.pcf, font/fonts.dir, font/v1200a.pcf, fonts, fonts.dir, fonts/baseline.pcf, fonts/evil.pcf, fonts/fonts.dir, fonts/v1200a.pcf, misc/baseline.pcf, misc/evil.pcf, misc/fonts.dir, misc/v1200a.pcf, real.pcf, rom
+bootp: L2 responder on tap-mess-0-0: handing out 192.168.99.2, siaddr 192.168.99.1 (src mac 36:e6:4e:de:3c:a6)
+tftp: client aborted transfer: '\x00\x03Disk full or allocation exceeded'
+21:48:57  192.168.99.2:1025 requested '69'
+21:48:57  192.168.99.2:1026 requested '69/fonts.dir'
+21:48:57  192.168.99.2:1027 requested '69/fonts.dir'