Thanks to Rich and Grant for the information they promptly posted.
This led me to put the supposed boot PROM in the right-most slot in the
ROM board, and try booting.
I got nowhere. Thought I'd try single stepping a bit, and noted that
With the boot PROM is in this socket, it always reads back 11111111 for
all addresses within the 256-byte address space. If I move the PROM to
one of the lower-addressed sockets (further to the left end of the
board), the PROM data shows up properly in that PROM socket's address
space.
So, what I think I've got going on is that either the 74157 address
decoder has bad outputs for chip enable on the highest-addressed ROM, or
the discrete-transistor-based Vgg power switching drivers that control
the -9V supply (based on diode-AND-gated pairs of outputs from the
74157) to the upper two PROMs is bad. This Vgg switching based on
"turning on" banks of two PROMS at a time is a power-saving measure.
Time to break out the scope and start looking around.
Both Rich and Grant pointed out that the ROM actually copies most of
itself into RAM beginning at 0x4C00, and then branches to the
RAM-resident code. I'd overlooked this in my hand disassembly, as I was
mostly looking to find the references to the IN and OUT instructions
that talked to the floppy controller, as well as branch addresses, which
was confusing in the context of the code executing directly out of the
PROM. Looking more carefully at what I dumped out of the PROM (when it
was located in a socket on the ROM board where I can actually read it),
it's clear that it does a copy of a chunk of the PROM image, executing
this copy code out of the PROM, into RAM beginning at 0x4C00, then
branches to 0x4C00 after the copy is completed, to actually do the boot
from disk executing the boot code in RAM.
I'll keep the list posted as to progress.
-Rick