While whizzing through the code trying to scrounge verified keyboard scan codes and flags, I found some some buried treasure in the form of an undocumented test routine.  It's not that exciting -- it just fills the current file with some sample text.

F76D             ; load the ROM test file into the current file
F76D             spewROMtestFile_F76D:
F76D BD F6 18        jsr     clearHomeLCD_F618 ; Clear LCD set cursor pos 0
F770 CE FB D5        ldx     #aAreYouSureYouWantToOverwrite ; "Are you sure you want to overwrite"
F773 BD F6 69        jsr     showText_F669   ; show nts text @ X
F776 BD F7 4E        jsr     setcpLine1_F74E ; set cursor Line 1
F779 CE FB F8        ldx     #aThisFileWithTheRomTestFile?YN ; "this file with the ROM test file? (y/n)"
F77C BD F6 69        jsr     showText_F669   ; show nts text @ X
F77F             waitKey_F77F:
F77F BD E5 A0        jsr     scanKbd_E5A0    ; do key scan and enqueue
F782 BD EB EE        jsr     dequeueKbdScanCode_EBEE ; pull scan code A (rowno|colno) from keyboard buffer; V set if empty, clear if valid
F785 29 F8           bvs     waitKey_F77F
F787 81 22           cmpa    #$22            ; 'y' scan code
F789 26 14           bne     leave_F79F
F78B BD EB 9B        jsr     clearThisFile_EB9B ; clear file by resetting pointers
F78E CE FB 44        ldx     #a1AlphasmartIsE ; "1 AlphaSmart is easy to use and rugged."...
F791             loop_F791:
F791 A6 00           ldaa    0,x
F793 27 0A           beq     leave_F79F
F795 08              inx
F796 3C              pshx
F797 BD F3 07        jsr     sub_F307
F79A 38              pulx
F79B 29 02           bvs     leave_F79F
F79D 20 F2           bra     loop_F791
F79F             leave_F79F:
F79F 39              rts

You get there from scan code 0x21 and with a flag byte_62 being set.  Since this is undocumented, I can't figure out what 0x21 is here, but it's still interesting because the implementation of spewROMtestFile_F76D should give me some further clues about file related structures.  In particular, the loop_F791 is just pulling a character from ROM until nul is found, and calling sub_F307 with it.  So that almost certainly is a 'append character to file' routine.  That will be interesting.

Also, long ago I had mentioned finding what looked like an ASCII table that might give a clue to key mapping, but I couldn't find references to it.  That turns out to be a red herring; those ASCII sequences are just part of the ROM test file.  So I'll fix up that stuff to reflect the new findings.

However, this has given me a new idea:  this product emulates a keyboard.  It does this to transfer files, but it also acts just like an ordinary keyboard when connected to the PC/Mac.  I don't know anything about Mac ADB, but I do have some experience with PS/2 from my TRS-80 emulator days.  So I think that maybe I can find the table of PS/2 scan codes and maybe work backwards from there to figure out the keyboard matrix better.  Food for thought....