How does the ZX81 ULA generate a full ROM read address?

Question

On the ZX81, when the ULA that functions as the video chip is generating display output, it takes the character cell byte (that the CPU was tricked into fetching as an opcode) and combines it with an internal 3-bit counter, to generate an address to access the font in ROM and fetch a byte of bitmap.

The font is 64 characters, 512 bytes, so it should be necessary to generate nine bits of address, and sure enough, looking at the pinout https://www.sinclairzxworld.com/viewtopic.php?t=1249

We can see pins marked A0-8 (with ' marks that presumably indicate these pins generate addresses rather than reading addresses generated by the CPU?).

But hang on. The ROM is 8K. That's 13 bits of address. It's true that the upper 4 bits are constant, because the font never moves, but they still have to be placed on the address bus, or there would be no guarantee that the generated 9-bit address was referring to the correct 512-byte section of the ROM. (I'm assuming the top 3 bits of the 16-bit address don't matter once ROMCS is enabled.)

How does the ULA generate a full 13-bit address for this?

Answer 1

(Community Wiki because mcleod_ideafix’s answer was correct despite being deleted)

The pixel fetch is a subversion of the refresh cycle; the ZX81 has the necessary analogue electronics in place to create an equivalent of the Spectrum’s floating bus for the low nine address pins so when the ULA drives its nine address pins, it overwrites the low nine bits of the refresh address as observed from the ROM. Therefore the other seven bits come from the Z80’s I register, that being what the Z80 loads during refresh.

Bonus: if the ROM doesn’t respond to the address but RAM does, whatever comes from RAM will be used as pixels. This is the basis of ‘high-resolution’ modes on compatible RAM expansions.