Requesting interrupts before the controller was initialized... That caused some curious behavior on cold boot!
Floppy controller doesn't have an internal drive spindle motor timeout so that needs to be baby-sat in code.
Ultimately, the disk magnetic flux format was determined, the data arrangement was decoded and the 8080 code was disassembled from the original AES operating system (which is not cp/m as thought, but a multi-tasking os that is really quite clever given the hardware) but picking that apart allowed the basic memory layout, internal i/o to be reverse engineered for video output, disk access, keyboard handling etc., which meant that then the entire machine can be emulated as it is a known architecture; within that emulation a BIOS can be written and a bootloader that kicks out of the AES boot ROM (the first 512 bytes of RAM are mapped to the boot ROM on cold boot, which loads from disk the first code on the disk to a known memory location- that bootloader code can then run, disable the boot ROM and copy the required BIOS code for CP/M to the low memory and then boot up into CP/M from the floppy.
It's a very raw hardware, with no inbuilt protection or error checking. That's all handled in software, and with 32k of RAM it is hard to catch all that; the disk format with odd bytes per sector means it doesn't jive too well with the way CP/M expects the sector format so there's a lot of lost space on a CP/M formatted disk.
Is what it is though, and the fact the first disk image created halfway around the globe on an emulated copy of the hardware booted first time is frankly amazing.