After Googling this for an hour or two and not finding much, I have found something solid just minutes after posting my question!
From page 40 of TRS8BIT volume 09 issue 02 from June 2015 there is an article on a "FreHD Expansion Interface" which includes this paragraph:
If a WDC1771 Disc Controller is found then the LII ROM programs the
chip to retrieve the first 256 Bytes from Physical Drive 0, Track 0,
Sector 0, i.e. the Boot Block, this is executed and LDOS, TRSDOS,
NEWDOS etc. continue to boot
The information missing is where the code is loaded and executed. I suppose it could be position-independent code. I think that was possible on the Z80 if you restricted which instructions/addressing modes you used.
It's also possible this is not the full story and might only apply to the Model I.
Update: Using the above info, I looked at some JV1 format disk images and several contain identical bytes for this area except some at the end, presumably junk after the code. But the first three bytes do not seem to be code. Code seems to start at offset 0003h
with a DI
instruction to disable interrupts. Before this, all the ones I've looked at have 00 FE 11
which could be some sort of header or magic signature?
Update 2: Apparently the various DOSes in use on TRS-80s were only somewhat mutually compatible. Some used the byte at offset 0002h
to declare the track used for the directory, usually track 17 or 11h, but not always. Either the initial NOP
or it together with the following FE
compare instruction are referred to as a "recognition code", which seems to mean the same as "signature" or "magic word", but the ROMs did not seem to verify this. It must be used by some of the DOSes for some purposes, but not at power-on boot time.
... and here it is stated more clearly in this disassembly I just found, originally from the HACKER'S HANDBOOK FOR NEWDOS/80, page 42:
; Addr. Code Instruction Function
4200H 00 NOP ; No operation
4201H FE 11 CP 11H ; Recognition Code + 17 = Dir Sector
4203H F3 DI ; Disable Interrupts