joystick: is keyboard address fully decoded?
	no, only A0, A11 and A12 are decoded, just like the keyboard.

cartridge: can be mapped as 4/8/16 kB ?
	a cartridge is handled like a rearside attached rom: it may or may not assert /ROMCS.
	the ZXC4 cartridge can only page in chunks of 16K.

QS char board:
	which address range(s) does it override?
		it always reads from $8400 - $87FF.

	does it override the cartridge rom?
		therefore they cannot clash.

	where is the attribute byte read from in colour mode 0? (colourized characters)
		probably always $C000 - $C3FF:
		A0..A9 come from lcntr and char_code, no bits from the refresh address involved.

	where is the attribute byte read from in colour mode 1? (specci-like attributes)
		this is not affected by the QS board. the attr file position depends on the screen$ file position only.