docs: session summary for the CRT-attribute and KeyPressed rungs

CALC-COMPILE.md's "Session state" still described the first session (HEAD
14dbcdb, nine rungs, ladder at 10350, 71/71 at 12083).  Bring it up to
date with the measured rung table: the nine later tags, their commits and
the exact ladder row each one left, through `ERR 41 12901` at `IBMCh`'s
var parameter.

Also record the verified baseline from the run just made: 73/73 compile,
ladder 1/1 at 12901, terminal config 4/4, 64 .COMs linked, 62/62 executed
under both qemu and Exec86, non-vacuity 92/92.

The next-session plan now leads with the real next rung: var parameters
by reference, together with the shadowing rule in DupTest.  Fixing
DupTest alone would let CALC past IBMCh with a silent miscompile, so the
plan says they must go together.

CALC-COMPILE.md

@@ -394,13 +394,14 @@ ladder order (each stage removes the blocker the previous one exposed).
 
 ### Session state — where to resume
 
-Last touched 2026-10-19. **Nine stages are landed in one session** (Stages 1-4,
-sets increment 1, enums, record types, array declarations, element/field access,
-and file types). The ladder row has moved repeatedly, from the first typed
-constant at 7791 to **10350, inside `CALC.INC`** — the compiler now accepts all
-of `CALC.PAS`'s own declarations and is compiling the include's body.
-
-The nine commits and their tags, in order (each is one rung with its own
+Last touched 2026-10-20. **Seventeen rungs are landed across two sessions**
+(Stages 1-4, sets, enums, record types, array declarations, element/field
+access, file types, the calling convention and string value parameters,
+`Length`, the CRT identifiers, `Kbd`, and `KeyPressed`). The ladder row has
+moved from the first typed constant at 7791 to **12901, inside `CALC.INC`'s
+`procedure IBMCh(var Ch: Char)`**.
+
+The rung commits and their tags, in order (each is one rung with its own
 fixture, red proof, and — where the harness allows — execution under qemu and
 Exec86):
 
@@ -415,9 +416,20 @@ Exec86):
 | `123193d` | `v-TP3-CALC-ARRAYS` | `ERR 102 9202` |
 | `2a31b35` | `v-TP3-CALC-ELEMACCESS` | `ERR 102 9202` (element access) |
 | `14dbcdb` | `v-TP3-CALC-FILES` | **`ERR 102 10350`** (inside `CALC.INC`) |
-
-- **HEAD** `14dbcdb` (`v-TP3-CALC-FILES`). Nothing pushed; `origin/master` is
-  behind by nine commits.
+| `018bf0c` | `v-TP3-CALC-PARAMSLOTS` | `ERR 102 10350` (slot sizes; the rung does not move yet) |
+| `6b86175` | `v-TP3-CALC-PARAMLIST` | `ERR 102 10350` (call sites size each argument) |
+| `2b90a8d` | `v-TP3-CALC-STRPARAM` | `ERR 41 10405` (`Length(S)`) |
+| `45baf26` | `v-TP3-CALC-LENGTH` | `ERR 41 10753` (`ClrScr`) |
+| `14ce590` | `v-TP3-CALC-CRT` | `ERR 41 10927` (`Read(Kbd, Ch)`) |
+| `4c165e1` | `v-TP3-CALC-KBD` | `ERR 102 12083` (`NormVideo`) |
+| `89c6ca6` | `v-TP3-CALC-CRT2` | `ERR 41 12672` (`KeyPressed`) |
+| `033eb8e` | `v-TP3-CALC-KEYPRESSED` | **`ERR 41 12901`** (`IBMCh`'s `var` parameter) |
+
+- **Code HEAD** `033eb8e` (`v-TP3-CALC-KEYPRESSED`); this commit only updates
+  this document.  Nothing pushed; `origin/master` is behind by ten code
+  commits.  Two non-ladder commits in the same period are the terminal-config
+  work (`v-TP3-TERMCFG`) and the editor key map (`v-TP3-EDITORKEYS`); they do
+  not move the ladder and are documented in `TERMINAL.md`.
 - **The measuring device:** `tests/fixtures/calc_ladder.tsv` +
   `tests/calc_ladder.sh`, wired into `run_all.sh` as `CALC ladder`. The row may
   only move forward; every move is recorded in the tsv next to the blocker.
@@ -515,10 +527,11 @@ Exec86):
   before anything was measured. Worth knowing: the mutation's whole shape is
   byte-for-byte the same for INTEGER locals, so the compile matrix would have
   been green and only `t40_readln` (and later CALC) would have noticed.
-- **Verified baseline, run on this commit:** `./tests/run_all.sh` →
-  **OVERALL: ALL PASS**, compile matrix **71/71**, CALC ladder **1/1** at
-  `ERR 102 12083`, 62 `.COM` linked and 60 executed under both qemu and Exec86
-  (`t64_arrays` is compile-only: its image is past the 8 KB boot-sector read).
+- **Verified baseline, run on the code HEAD above:** `./tests/run_all.sh` →
+  **OVERALL: ALL PASS**, compile matrix **73/73**, CALC ladder **1/1** at
+  `ERR 41 12901`, terminal config **4/4**, 64 `.COM` linked and **62 executed
+  under both qemu and Exec86** (`t64_arrays` is compile-only: its image is past
+  the 8 KB boot-sector read).  `tests/nonvacuity.sh`: **92 ok, 0 failed**.
 - **`tests/nonvacuity.sh`:** re-run after this commit's cases (the set
   membership bit among them); see the commit message for the count. It is not in
   the default `run_all.sh` and must be run **manually** after touching any check.
@@ -554,11 +567,12 @@ Exec86):
 
 ### Next session — the concrete plan
 
-The ladder is at `ERR 102 10350`, **inside `CALC.INC`**.  Everything below is
-ordered by what the ladder will hit next, not by the original stage numbers
-(which the measurements have already reordered twice).  Each item is the same
-shape as this session's nine: one focused change, one fixture that is red before
-and green after, an execution proof where the image fits, and a commit.
+The ladder is at `ERR 41 12901`, **`procedure IBMCh(var Ch: Char)`**.  Everything
+below is ordered by what the ladder will hit next, not by the original stage
+numbers (the measurements have reordered them repeatedly).  Each item is the
+same shape as the rungs already landed: one focused change, one fixture that is
+red before and green after, an execution proof where the image fits, and a
+commit.
 
 1. **String VALUE parameters — DONE** (the rung moved 10350 → 10405; the
    blocker is now `Length(S)`, a builtin).  TP3 puts a value parameter's whole
@@ -583,16 +597,23 @@ and green after, an execution proof where the image fits, and a commit.
    first range's count.  Constant indices and `.field` are already done.
 5. **Pointers and the heap** (`^T`, `New`, `Dispose`, `Buffer^[i]`), 4-byte
    (offset then segment); the heap must hold `Pages` (16,281 bytes).
-6. **`var` parameters by reference** (SEG then OFFSET; 2 bytes per value
-   parameter, 4 per `var`), and **remove the silent by-value acceptance**.
+6. **`var` parameters by reference — THE NEXT RUNG (12901).**  Today `var` is
+   parsed and then **silently recorded as a value parameter**, which is the §7
+   failure mode and must be replaced, not extended.  Push an address (a 2-byte
+   slot) from the caller, load/store through `[BP+off]` in the callee, and fix
+   `DupTest` in the same increment so an inner declaration may shadow an outer
+   name (duplicates at the SAME level stay errors).  Fixing `DupTest` alone
+   would let CALC past `IBMCh` with a silent miscompile: `IBMCh(Ch)` must
+   update the caller's `Ch`.
 7. **6-byte `real`** — literals, `+ - * /` and the six comparisons,
    `and`/`or` on results, integer conversions, `Str`/`Val` with widths and
    decimals, and `ln`/`exp`/`abs`/`sqrt`/`sqr`/`sin`/`cos`/`arctan`/`int`.
 8. **The string builtins** (`length`, `copy`, `delete`, `insert`, `str`, `val`)
    and named string constants.
-9. **The CRT identifiers** (`GotoXY`, `LowVideo`/`NormVideo`, `ClrEol`,
-   `ClrScr`, `KeyPressed`, `Delay`, `Read (Kbd, Ch)`) — needed for CALC to
-   *resolve*; a running CALC needs them right, which is a later question.
+9. **The CRT identifiers — DONE** (`ClrScr`/`GotoXY`/`ClrEol`,
+   `LowVideo`/`NormVideo`, `Delay`, `Read (Kbd, Ch)`, `KeyPressed`), with
+   `INT 10h` in Exec86 and `AH=0Bh` in Exec86 and bootcom.  A running CALC
+   still needs the attribute to reach ordinary text, which is a later question.
 10. **Recursion, `forward`, nesting** — `Fact` (direct self-recursion) and
     `Expression`/`Factor` (mutual via `forward`, the definition repeating only
     the name).