dwt: first real-unit contact -- TCP 771 and the computed challenge work; ROM peek matches v2.2; screenshot over peek

dwt/notes/REAL_UNIT.md

@@ -0,0 +1,47 @@
+# First contact with the real VT1200
+
+Date: 2026-10-18. Terminal at **100.103.100.103** (static IP, no BOOTP),
+reached from host `100.103.255.254` on `enp197s0f3u1`.
+
+**Read-only throughout this note — no `poke`, no `jump`.**
+
+## Results
+
+| check | result |
+|---|---|
+| TCP 771 | **open** |
+| opcode 7 | challenge (flag `0x7F`) sent, computed reply accepted, `Done\n\0` |
+| `peek 0x3F200000` (8 B) | `e9 7a e2 f5 aa aa 55 55` — **matches `vt1200_v22.bin`** |
+| `peek 0xAECE0` (1 B) | `bd` — message classes 0,1,2 admitted (emulator: `05`) |
+| `peek 0x1E8BA0` (4 B) | `0x018BF1B0` bits = **3,251,638 bytes** free in the heap |
+| screenshot over `peek` | `dwt/evidence/real-unit-canvas.png` |
+
+The screenshot shows the live Terminal Manager V2.2: Ethernet
+`08-00-2B-16-4B-5A`, IP `100.103.100.103`, LAT `LAT_08002B164B5A`, and five
+`Debug connection from IP host 100.103.255.254` lines in Messages — one per
+connection made here. That is the read primitive working on real hardware.
+
+## Two differences from the emulator, worth knowing
+
+1. **The real unit challenges opcode 7.** The emulator only challenges opcodes
+   ≥ 2. A plain liveness check therefore exercises the challenge too, and its
+   success is additional evidence that `dwt/challenge.py` matches the shipped
+   image.
+2. **Message filter is `0xBD`, not `0x05`.** Levels 0, 1 and 2 are admitted on
+   the real unit; the emulator only admitted 0 and 3.
+
+## Geometry
+
+The raw VRAM canvas is **1024×1024**, captured correctly. The visible screen is
+1280×1024, with the canvas at x=192; `dwt/screenshot.py --screen` uses the
+emulator's 1280×901/offset-192×36 defaults and will misplace the bottom on the
+real unit. The raw canvas is the authoritative artifact; for a faithful screen
+image use `--screen-width 1280 --screen-height 1024 --offset-x 192 --offset-y 0`
+once the vertical origin is measured.
+
+## Next
+
+The remaining unproven step on this unit is the write path: `poke`/`jump` and
+then the COFF loader + `create_process`. The loader already refuses a target
+outside a free-list block (status 8), so a first attempt with `marker.coff`
+will tell us whether the linked ranges are free before anything runs.