Anyway, I've run into a curious thing... at boot and then repeating every few minutes, I get reads happening (I believe from FFFF down to F000, but I don't have a probe on the entire address bus) every 20ms (so presumably part of video scanout?). Whatever's reading does not seem to care what data it gets from me (yay), but it means some ideas I had to allow the Z80 to treat an address as a FIFO port, reading a series of bytes will break if the ROM is going to periodically read from it too.
So any ideas what causes this and if it's in any way avoidable?
I'm using decode logic that treats A12..A15 == 0xF && nMREQ == 0 && nRD == 0 as a read access.
I believe nRFSH is asserted instead for refresh accesses, so it's not that.
Some bringup/debug photos: