Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams

- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator
- Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000
- Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11)
- Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run)
  and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B'
- Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead
- Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy)
- Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md

Byte-identical ROM verified.

_wip/MUSCLE (U)/copilot/Makefile

@@ -1,10 +1,52 @@
-all: reconstructed_prg.bin verify
-prg.o: prg.s symbols.inc prg.bin
-	ca65 -g -o $@ prg.s
-reconstructed_prg.bin: prg.o linker.cfg
-	ld65 -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ prg.o
-verify: reconstructed_prg.bin prg.bin
-	cmp reconstructed_prg.bin prg.bin
-	@echo BYTE-IDENTICAL
+CA65 ?= ca65
+LD65 ?= ld65
+PYTHON ?= python3
+NESDIS ?= ../../../_tools/nesdis.py
+PASS2 ?= ../../../_tools/pass2.py
+
+all: reconstructed.nes verify
+
+prg.o: prg.s symbols.inc locals.inc
+	$(CA65) -g -o $@ $<
+
+header.o: header.s
+	$(CA65) -g -o $@ $<
+
+chr.o: chr.s
+	$(CA65) -g -o $@ $<
+
+reconstructed.nes: header.o prg.o chr.o linker.cfg
+	$(LD65) -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ header.o prg.o chr.o
+
+verify: reconstructed.nes
+	cmp reconstructed.nes rom.nes
+	@echo "Byte-identical ROM verified."
+
+# Regenerate prg.s from prg.bin. Every --table/--data/--extra-seed flag below is a
+# documented classification decision, not a convenience; see the header block of prg.s
+# and OVERVIEW.md.
+pass1:
+	$(PYTHON) $(NESDIS) --prg prg.bin --base 0x8000 --project "MUSCLE (U)" \
+	    --out prg.s --locals locals.inc --auto-seed \
+	    --table 0x9237:40,0xAC35:3,0x9F2B:16 \
+	    --data 0xACBD:12 \
+	    --extra-seed 0x8644,0x8653,0x9CAD,0xABF7
+
+# Pass 2: replace the derived Label_XXXX names with the semantic routine names and
+# their branch-role suffixes, then apply the zero-page names and rebuild locals.inc.
+pass2: pass1
+	$(PYTHON) $(PASS2) derive prg.s routine_names.tsv label_names.tsv
+	$(PYTHON) $(PASS2) apply prg.s label_names.tsv
+	$(PYTHON) $(PASS2) apply prg.s zero_page_ranges.tsv
+	$(PYTHON) $(PASS2) apply prg.s zero_page_names.tsv
+	$(PYTHON) $(PASS2) reflow prg.s
+	$(PYTHON) $(PASS2) describe prg.s routine_purposes.tsv
+	$(PYTHON) $(PASS2) structure prg.s data_regions.tsv
+	$(PYTHON) $(PASS2) locals prg.s zero_page_names.tsv locals.inc zero_page_ranges.tsv
+
+regen: pass2
+
 clean:
-	rm -f prg.o reconstructed_prg.bin reconstructed.map reconstructed.lbl
+	rm -f *.o reconstructed.nes reconstructed_prg.bin reconstructed.map reconstructed.lbl
+
+.PHONY: all verify clean regen pass1 pass2