No frame advance or save states, but script-assisted off-map glitching. It's... Hard to see what's going on. I need to make several trips back and forth because, apparently, the game is reading a different tile to find out if I can put down a power line.
First, the quick pan using the A button puts the cursor in the non-glitch area. There are specific increments I can go to in order to put the cursor back into glitchmode, but I can't maintain the TAS-like building speed like in my WIP.
Second, I can't move the cursor to the right. Up, down, and left are possible, but moving the cursor to the right isn't possible. I can pan to the right, but it gets the cursor out of glitchmode... Except in those specific increments I talked about.
I'm a bit vague about those "specific increments," but at the moment, I'm not sure how to explain it. When I get a clearer idea, I'll try explaining it.
Without any script helping you watch my movie, you'll be rather surprised at finding perfectly dry power lines where there was once water, when I finally scroll back. With a script, you can actually tell what's happening while I'm glitching stuff!
Here's a script much like the one I used if you want to see what I was looking at:
local c= {}
c[0]= 0x808080FF -- Open land
c[1]= 0x000080FF -- Water
c[2]= 0x000080FF -- Water
c[3]= 0x00000080 -- ... I don't know...
for z= 0x0004,0x0013 do -- Shores!
    c[z]= 0x008080FF
end
for z= 0x0014,0x0026 do -- Forests!
    c[z]= 0x008000FF
end
local addrStrt=  0x7F0200 --Start of everything.
local CamX,CamY= 0x7E01BD,0x7E01BF -- Memory where camera position is stored
local CsrX,CsrY= 0x7E01EB,0x7E01ED -- Position of cursor by pixel
local IsBox=     0x7E0201          -- Is the cursor a box?
local CursorX, CursorY, CameraX, CameraY, BoxMode, TileLoc, TileVal
--*****************************************************************************
function RefreshScript()
--*****************************************************************************
    CursorX= math.floor(memory.readwordsigned(CsrX)/8)
    CursorY= math.floor(memory.readwordsigned(CsrY)/8)
    CameraX=            memory.readwordsigned(CamX)
    CameraY=            memory.readwordsigned(CamY)
    BoxMode= (memory.readbyte(IsBox) ~= 0)
    TileLoc= CameraX+CursorX + 120*(CameraY+CursorY)
    TileVal= memory.readword(addrStrt + TileLoc*2)
end
--*****************************************************************************
function DumpStats()
--*****************************************************************************
    gui.text(  1,  1,CursorX)
    gui.text(  1, 11,CursorY)
    gui.text(  1, 21,CameraX)
    gui.text(  1, 31,CameraY)
    gui.text(  1, 41,TileLoc)
    gui.text(  1, 51,string.format("%X",TileVal))
end
--*****************************************************************************
function TileOverlay()
--*****************************************************************************
    for i= 0, 31 do
        local ThisTileX= i+CameraX
        for j= 0, 27 do
            local Temp= j+CameraY
            Temp= Temp*120 + ThisTileX
            local color= false
            if (Temp >= 0) and (Temp < 12000) then
                local TileID= bit.band(memory.readword(addrStrt+Temp*2),0x0FFF)
                if c[TileID] then
                    color= c[TileID]
                else
                    color= 0xFFFFFF80
                end
            end
            if color then
                gui.box(i*8,j*8,i*8+7,j*8+7,color,color)
            end
        end
    end
end
--local LastLoc= 0
--local JoyPress= {}
--JoyPress["B"]= true
gui.opacity(0.5)
while true do
    RefreshScript()
    TileOverlay()
    if BoxMode then
        DumpStats()
        if (CursorX + CameraX) < 0 then
            gui.text(15,1,"Glitchmode",0xFF0000FF)
--            if (TileLoc ~= LastLoc) and ((TileVal == 1) or (TileVal == 2)) then
--                joypad.set(1,JoyPress)
--            end
        end
--        LastLoc= TileLoc
    end
    emu.frameadvance()
end