Duck Hunt (JUE): Pass 2 complete

- 3,058 instructions (37.5% code), 48 semantic labels, 174 zero-page aliases
- BYTE-IDENTICAL build verified
- Key routines: Reset, NmiHandler, MainGameLoop, GameModeDispatcher, InitPPU, InitVariables, UpdateController, UpdateSprites
- Zero-page aliases: PPUCtrlShadow (/bin/bash8), PPUMaskShadow (/bin/bash9), GameMode (4), RoundIndex (6), DispatchIndex (A)
- Root OVERVIEW.md updated to reflect Pass 2 completion and correct mirroring (Horizontal)

_wip/Duck Hunt (JUE)/OVERVIEW.md

@@ -1,6 +1,6 @@
-# Duck Hunt (JUE) — Skeleton Project
+# Duck Hunt (JUE) — Pass 2 Complete
 
-ROM: `_wip/Duck Hunt (JUE)/Duck Hunt (JUE).nes` (24,592 bytes, iNES). Status: **SKELETON — not yet disassembled.** The entire 16 KB PRG bank is a single unclassified block; `copilot/prg.s` is the default-project skeleton (`default_project.tar.gz`) that reproduces it as one `.incbin`. The skeleton build is **byte-identical** at the PRG level.
+ROM: `_wip/Duck Hunt (JUE)/Duck Hunt (JUE).nes` (24,592 bytes, iNES). Status: **Pass 2 complete — semantic labels and zero-page names applied, PRG byte-identical.** `copilot/prg.s` contains a classified disassembly with 3,058 instructions (37.5% code), 48 semantic labels, and 174 zero-page semantic aliases. The build is **BYTE-IDENTICAL** at the PRG level.
 
 
 ## ROM Facts
@@ -29,14 +29,14 @@ ROM: `_wip/Duck Hunt (JUE)/Duck Hunt (JUE).nes` (24,592 bytes, iNES). Status: **
 |------|---------|
 | `Duck Hunt (JUE).nes` | original ROM image (reference) |
 | `prg.bin` / `header.bin` / `chr.bin` | split image, produced by `_tools/splitnes.py` |
-| `prg.s` | Pass-1 skeleton: `.incbin "prg.bin", $0000, $4000` (whole PRG) |
+| `prg.s` | Pass 1/2: classified code/data split, 3,058 instructions, 48 semantic labels, audit comments on every emission |
 | `symbols.inc` | shared NES hardware constants (PPU/APU/controller, from the skeleton) |
-| `locals.inc` | project-local zero-page aliases — empty for now (filled in Pass 2) |
+| `locals.inc` | 174 zero-page semantic aliases (filled in by Pass 2) |
 | `linker.cfg` | PRG at $C000, 16 KB, `fill = yes` |
 | `Makefile` | links `reconstructed_prg.bin` and `cmp`s it against `prg.bin` |
 | `reconstructed_prg.bin` | build output from the last verified build |
 
-Header/CHR are reproduced verbatim from `header.bin`/`chr.bin` (not linked): `make` verifies **PRG bytes only** at this stage, which is exactly what a skeleton proves. When this project is promoted to a full disassembly, `header.s` / `chr.s` (as e.g. `Burger Time (U)`) and a full-ROM `make` target get added.
+Header/CHR are reproduced verbatim from `header.bin`/`chr.bin` (not linked): `make` verifies **PRG bytes only** at this stage. When this project is promoted to a full disassembly, `header.s` / `chr.s` (as e.g. `Burger Time (U)`) and a full-ROM `make` target get added.
 
 ## Build
 
@@ -47,7 +47,21 @@ make        # → cmp reconstructed_prg.bin prg.bin → "BYTE-IDENTICAL"
 
 ## Next Steps (per `PROMPTS.md`)
 
-1. **Pass 1** — replace the blanket `.incbin` with classified code/data: trace reachability from RESET ($C000) and NMI ($C086), emit per-instruction `; PRG:$xxxx AA BB` annotations, keep unreached bytes as explicit `.byte` blocks.
-2. **Pass 2** — replace `Label_`/`Sub_` names with semantic routine names; fill `locals.inc`.
-3. **Pass 3** — name data tables/structures; release provisional flags.
-4. **Promotion** — move to a top-level `<name>/copilot/` folder, add full-ROM build (header.s + chr.s + vectors), and write the power-on flow `OVERVIEW.md` in the established style; then it joins the root index's numbered inventory.
+1. **Pass 3** — name data tables/structures; release provisional flags.
+2. **Promotion** — move to a top-level `<name>/copilot/` folder, add full-ROM build (header.s + chr.s + vectors), and write the power-on flow `OVERVIEW.md` in the established style; then it joins the root index's numbered inventory.
+
+## Pass 2 Details (2026-10-18)
+
+- **Label renaming**: 48 of 472 labels renamed to semantic names using `pass2.py apply` with a mapping file (`duckhunt_label_map.tsv` + `locals.inc` for zero-page). Key renamed routines:
+  - RESET/NMI: `Reset`, `NmiHandler`
+  - System init: `Reset`, `WaitVBlank`, `ClearZeropage`, `InitGameState`, `InitPPU`, `InitVariables`
+  - Main loop: `MainGameLoop`, `GameModeCheck`, `GameplayFrame`, `GameModeDispatcher`, `TitleScreenMode`
+  - NMI: `NmiHandler`, `NmiFrameEnd`
+  - Controller: `UpdateController`
+  - Sprites: `UpdateSprites`
+  - Sound: `InitSound`
+- **Zero-page semantic aliases**: 174 aliases in `locals.inc` (see `locals.inc` header for full list):
+  - PPU: `PPUCtrlShadow` ($08), `PPUMaskShadow` ($09)
+  - Game state: `GameMode` ($24), `RoundIndex` ($26), `DispatchIndex` ($2A)
+  - Player arrays: `PlayerState` ($16), `PlayerInput` ($25), `PlayerData` ($2A)
+  - Pointers: `TempPtrLo` ($00), `TempPtrHi` ($01)