Started tracing out two likely looking address decoders (last post).
From there, I traced back up from the PROM chip this morning.
Slowly getting places. The idea being to be able to remove the PROM chip that the system boots from, stick in its place a debug board that can be hooked up to a PC, to feed instructions and diagnostics code from.
Who knows, might be able to get this to run CP/M relatively well.
Making a serial interface for it would be most excellent.