dwt: GUI/X architecture note; Xlib callable but XOpenDisplay hangs

Static: the VT1200 GUI is an X11 dix server in ROM plus Xlib clients
(SERVER, SESSIONMGR/Terminal Manager, WM, VTE).  Internal clients use the
local service "xserver" via the display string "0::0"; TCP 6000 is a
separate authorised listener.  Function table and the 4-call hello-window
sequence are in dwt/notes/GUI_APPS.md.

Dynamic: a poke+jump payload proved the firmware ABI (strlen=4) and then
called XOpenDisplay; it never returns (stage 2, display 0, X-server client
watermark unchanged) and the rdebug service dies.  Verdict: hard for a
self-contained window; shared-RAM UI mutation (opcode 8) is the working
route.

dwt/notes/CROSS.md

@@ -343,3 +343,33 @@ and frames in `dwt/notes/DISPLAY_MESSAGE.md`.
 
 ---
 
+
+## 2026-10-18 14:10 EEST — GUI apps are X clients; a payload can call Xlib but not get a display
+
+Facts for anyone tempted to "just create a window" (details in
+`dwt/notes/GUI_APPS.md`):
+
+* The GUI is a **real X11 dix server in ROM** (process `SERVER`, entry bit
+  `0x3F362910`) plus Xlib in ROM. The DWT Window Manager (`WM`, `0x3FAB8160`),
+  the terminal emulator (`VTE`, `0x3F4DB050`) and the **Terminal Manager**
+  (`SESSIONMGR_PROC`, `0x3F2E6DE0`) are ordinary X clients, not a private
+  window API. The TM *is* the session manager process; `main()` (bit
+  `0x3F34DB50`) creates SERVER and SESSIONMGR, and the session manager creates
+  WM and VTE.
+* Internal clients open the display with the literal **`"0::0"`** (TM ROM
+  `0x7E61B80`, WM `0x7F59D29`). `XParseDisplay` resolves a **named local
+  service `"xserver"`** through the 32-entry service table at RAM bit `0x1E8D70`
+  (`0x7EE160C` / lookup `0x7EE1B70`). TCP 6000 is a separate, user/node
+  authorised listener.
+* Xlib entry points (bit addresses): `XOpenDisplay` `0x3F9C2570`,
+  `XCreateSimpleWindow` `0x3FD41B90`, `XMapWindow` `0x3FD645B0`,
+  `XSync` `0x3FD9F6B0`, `XCreateGC` `0x3F997000`, `XDrawString` `0x3FDA0000`.
+* **Live result:** a 390-byte payload (poke+jump, no breakpoints) called
+  `strlen("0::0")` successfully (returned 4) using the firmware ABI, then
+  `XOpenDisplay` **hung**: stage 2, display 0, X-server client watermark
+  unchanged, rdebug service dead afterwards. The CPU sits in Xlib's select
+  wrapper. So the ROM is callable, but the `"xserver"` service connect from the
+  injected process never reaches the server. Do not assume a self-contained X
+  client is "one call away".
+* Shared-RAM UI mutation still works (opcode 8 / `0x3F309350`), and that is the
+  realistic route for making the Terminal Manager draw something.