This is a follow up post explaining the results of my oscilloscope investigation and my theories about how the TS2068 works.
The TS# signal is low most of the time, only going high to allow the SCLD to access the VRAM for drawing the screen. This means most of the time the line driver U5 and bus transceiver U9 are enabled. They're disabled for the SCLD video accesses. These accesses take the form of 16 square wave pulses in succession, then a period with no pulses (TS# low) in the time taken for 12 pulses, for each of the 192 lines on the screen, then no pulses at all for the next 70 lines.
The 2 ROMs and 3 banks of DRAM are selected by signals coming from the SCLD (ROMCS#, EXROM#, CAS1#, CAS2#, CAS3#) so that only one is selected at once, whether to accept a value from the data bus (for a CPU write cycle) or to put a value onto the data bus (for a CPU read cycle). For the CPU to read the video memory, the direction of bus transceiver U9 has to be changed so that data can pass from the SCLD/VRAM data bus onto the CPU data bus. There is an extra read signal coming from the SCLD, also called RD# according to the schematic in the Technical Manual, which drives the direction input on the bus transceiver. This read signal is asserted in the range $4000 - $7FFF. Outside that range the bus transceiver drives in the opposite direction (CPU data bus onto SCLD/VRAM bus).
This scheme falls down when other devices assert the data bus in the range $4000 - $7FFF. Although CAS1# won't be asserted (so that the video memory won't drive a specific value onto the SCLD/VRAM data bus), the bus transceiver U9 will still try to assert the CPU data bus with whatever is on the SCLD/VRAM data bus. The fix used by the Timex engineers was to deassert TS# when accessing cartridge memory or bus expansion memory. This ensures that both U5 and U9 are disabled.
The fix takes the form of a 74LS00 chip U21 and some diode/resistor logic on a mini printed circuit board mounted above the vias for U5. U5 is actually mounted on the mini PCB along with U21 and the board connects to the main PCB through the vias for U5. The SCLD signal TS# connects directly to the mini PCB along with MREQ#, ROSCS# and BE#, and the modified version of TS# is used to drive U5 on the mini PCB and U9 on the main PCB.
Looking at the modified version of TS# on an oscilloscope, the regular groups of 16 pulses coming from the SCLD TS# have a wide voltage swing (from ground to +5V), suggesting the SCLD is built using CMOS logic. The pulses coming from U21 have a lower voltage swing (from ground to a bit less than +5V), because U21 is built using TTL. The modified TS# signal drives two TTL logic devices which will accept both forms of logic high.
The fix doesn't apply when the CPU is accessing EXROM in the range $4000 - $7FFF, so U9 will still try to assert whatever is on the SCLD/VRAM data bus onto the CPU data bus. The EXROM chip will also try to assert the CPU data bus and you have a bus conflict - the value on the data bus can't be guaranteed.