The doc mentions "test code" at $1FE0-1FFF, which is the top of the ROM address space for the '10. Reset jumps to $0000, but maybe certain inputs cause a jump to the test code instead?
I scanned the docs for hints (the TMS1xxx data sheets mention things like "don't drive K1-K4 within 6 clocks of reset", or "expect R0 to output unexpectedly when device is reset"), but didn't notice any.
I did get confused about the D/A options; in one place it says the '10 only has options 2 and 3, but the pin assignments show DA2, which is option 1. The Battleship PCB looks like it uses the option 1 4-transistor amplifier.
