Well, if the ROM containing the system software physically is resident in the removable cartridge or in the console itself does not change much.
I don't think there was any system software as such. Each cartridge will contain the game plus all the support code it needs, and the reset vector just ...

As I understand it, the 6507 has a 16-bit internal address space and PC like a real 6502, it just lacks some of the address pins. So the ROM cartridge probably has aliases at 8k intervals all the way up to e000-ffff. In which case it
sort of makes sense to say that by convention you're going to ...

The PS/2 clock can be driven from either end too, so if the data line needs a
pull-up odds are the clock will too. The reason for this is that if the host wants
to send commands to the keyboard it signals this by pulling the clock low for
(at least) 100 microseconds, then releasing it and waiting ...

Ah, I'd misunderstood what you meant by ;BUT PF1 ONLY GETS $AA
sorry about the noise.

The test case is confusing because $AA is both one of the values stored and
part of the address. In general it's worth putting together such tests so that
each number can come from only one possible place in the code. So here, if you change
lda #%10101010
sta Screen_PF1
to
lda #%01010101
sta ...