Promotes Lunar Pool

2026-10-18 16:47:03 -04:00
1 parent 837007843d
commit 62866563ba
@@ -0,0 +1,268 @@
+# Lunar Pool (U)
+
+ROM: `Lunar Pool (U).nes` (24,592 bytes, iNES). Status: **PASSES 1-3 COMPLETE; PROMOTED TO THE TOP LEVEL 2026-10-18** — 5,300 instructions / **11,077 code bytes (67.6%)** / 5,301 data bytes / the 6 vector bytes as `.word`, byte accounting exact (11,077 + 5,301 + 6 = 16,384), and **BYTE-IDENTICAL for the whole ROM** (header + PRG + CHR) via `cmp reconstructed.nes rom.nes`. Pass 2 named all **705** labels — `Label_<addr>` is gone — and Pass 3 named 33 data structures and finished the zero-page audit (38 semantic aliases, 66 deliberately neutral `ZpXX`, ten former phantom aliases deleted). The ~354 bytes the CDL could not settle stay `.byte` on purpose; they are itemised under *Known remaining gaps*.
+
+
+## ROM Facts
+
+| Property | Value |
+|----------|-------|
+| Mapper | 0 (NROM) — from the iNES header |
+| PRG | 16 KB (header claims map at CPU $C000–$FFFF) |
+| CHR | 8 KB |
+| Mirroring | Vertical |
+| Battery-backed flag | clear |
+| ROM SHA-256 | `6da37fd34e8f4eb3df34e9f446726a193db77d0e0bba32aa328ef225993fc8a1` |
+| PRG SHA-256 | `43a2f54cd48b38fc1e4a33051e019528e9789a774ace773fa7549c33dc9492c9` |
+
+## Interrupt Vectors (taken from PRG $3FFA–$3FFF)
+
+| Vector | Target | Note |
+|--------|--------|------|
+| NMI | `$FF65` | per-frame heartbeat |
+| RESET | `$E80C` | non-$C000 entry — the tracer has to seed it explicitly (`--extra-seed 0xE80C`) |
+| IRQ | `$FF64` | a bare `rti` sitting immediately before the NMI handler, so IRQs are effectively ignored |
+
+## Pass Status
+
+| Pass | Status | Description |
+|------|--------|-------------|
+| Pass 0 | Superseded | `prg.s` was a 12-line `.incbin` of the whole PRG — no disassembly at all |
+| Pass 1 | **Complete** | Static code/data split, then reclassified against a Mesen Code Data Logger capture (see below). As Pass 1 delivered it: 5,285 instructions / **11,041 bytes emitted as instructions (67.4%)** / 5,343 bytes emitted as data (`.byte`, plus the six vector bytes as `.word`); 11,041 + 5,343 = 16,384 exactly. Labels: 640 `Label_<addr>` plus `Reset`/`NmiHandler`/`IrqHandler`. |
+| Pass 2 | **Complete** | NES hardware constants in `symbols.inc`; zero-page aliases in `locals.inc`; and **all 705 labels named — `Label_<addr>` is gone from the file**. 17 dispatch targets that carried no label at all (`UpdateObjects_Render_Sound` `$C05C`, `SetupRound` `$EB60`, `PrintStageNumber` `$E21A`, `SetPpuAddr` `$F989`, …) were given labels and routine headers. Naming rule used: PascalCase for `jsr`/`jmp` targets and logical block heads, `<Block>_<Role>` (`_Loop`, `_Next`, `_Alt`, `_Done`, `_Skip`, `_Return`, `_Store`, …) for targets *inside* a routine; `jsr`/`jmp` operands stay raw numeric — this file's convention, as in `Joypad Test Cartridge (U)` — while branch operands are symbolic. (Earlier revisions claimed 218 entries renamed, 195 of them `SubC<addr>`; no `SubC` label ever existed — `git log -S SubC` finds no commit that added one.) |
+| Pass 3 | **Complete** | Zero-page audit: **38 semantic aliases** (object core, VRAM write queue, VRAM read-back, PPU helpers) and **66 neutral `ZpXX`** whose roles are documented as deliberately unproven in `locals.inc`. Data structures: **33 tables/blocks named** (table below). Vectors are `.word NmiHandler, Reset, IrqHandler`. What is still unnamed is the residue listed under *Known remaining gaps* — it stays `.byte` on purpose. |
+
+## Pass 3 — the named data structures
+
+33 tables and blocks were named. The code in this ROM bases several tables one entry
+early (`lda $C478,y`, `lda $D4F8,y`, `lda $E9B9,x`), so entry 0 is dead and the label
+sits on the first *live* entry; that is noted per table in `prg.s`.
+
+| Address | Label | What it is |
+|---------|-------|-----------|
+| `$C000` | `ResetStub` | Unreachable three-byte `jmp Reset` — the reset vector points at `$E80C` directly |
+| `$C0C0` | `ObjectOpcodeHandlerTable` | 19 words: object-script opcodes `$80`-`$92` → handler address − 1 |
+| `$C3B4` | `SoundChannelMask` | `01 02 04 08 FE FD FB F7` — APU channel mask/enable bytes |
+| `$C47A` | `ObjectStatePointerTable` | 84 words: per-object state pointers, indexed by `(obj_ptr_lo + $0519,x) * 2` |
+| `$C522` | `SpawnObjectTable` | 16 words: spawn-record pointers for ids 1-15 (id 0 dead), picked from the `$0060-$0067` queue |
+| `$C543` | `StateTimerTable` | Per-state timers `1,2,3,4,6,8,12,16,24,32,48,64,96,128,192,0`, indexed by script opcode − `$DF` |
+| `$C552` | `AnimationPointerTable` | Frame-sequence pointers |
+| `$C559` | `SpriteAnimationTable` | Per-sprite animation descriptors used by the draw path |
+| `$CF40` | `VsCommandList` | Inline `RunCommandList` script issued when loading a VS-COMP scene |
+| `$D057` | `DrawCellRun_TileTable` | Corner tiles `$3C $69 $C3 $96` selected by row bits in `DrawCellRun` |
+| `$D4FA` | `LayoutScriptTable` | 30 words: per-stage layout-script pointers |
+| `$D559` | `LayoutData` | 2,757 bytes of per-stage layout records |
+| `$E862` | `BootSignatureText` | `"JEMINI DAZO!!"` plus the warm-boot signature compared against the RAM copy at `$0440-$044F`; the title attribute row at `$E870-$E87F` overlaps its tail |
+| `$E9A3` | `TitleColorCycleTable` | 22 colour codes cycled into the `$0085-$0087` palette shadow each frame |
+| `$E9B9` | `StartGameAttributeRow` | 16 attribute bytes copied to the `$0140-$014F` shadow when a game starts |
+| `$EA00` | `TitleCommandList` | Inline `RunCommandList` script for the title screen |
+| `$EC2A` | `StageAttributeTable` | 16 per-stage attribute bytes copied to the attribute shadow |
+| `$ED3F` | `SpritePaletteTable` | 4 × 4 sprite palettes, copied to the `$0090-$009F` palette shadow by `Reset_LoadSpritePalettes` |
+| `$EEE9` | `BallAppearTiles` | Tiles for the ball-appear step animation (indexed by the step at `$0340`) |
+| `$EF2A` | `BallSinkTiles` | Tiles for the ball-sink step animation |
+| `$F098` | `TileCollisionTable` | 27 words: collision flags per tile |
+| `$F5E4` | `EndingCommandList` | Inline `RunCommandList` script for the ending screen |
+| `$F762` | `AimPhaseTable0` | Three parallel 8-byte colour sequences shimmered into the `$008B`/`$008F`/`$0092` palette shadow while aiming |
+| `$F786` | `StrPlayer1`, `StrShot`, `StrPlayer2`, `StrGameOver`, `StrPlayer3`, `StrHiScore`, `StrPerfect` | The seven `jsr $CBDC` inline strings ($F786-$F861) |
+| `$FAC9` | `PaletteColorTable` | 12 rows of 4 colour codes → PPU palette entries (`MapColorCodeToPalette`) |
+| `$FECE` | `SineTable` | 64 entries read by `GetSine` |
+| `$FF90` | `PaddingFf` | 106 bytes of `$FF` filler between the last table and the vectors |
+
+
+
+The Pass 1 split came from a static trace only, and a static trace cannot see code that
+is reached through computed dispatch, nor can it tell inline string data from an
+instruction that happens to decode from the same bytes. Both errors were present.
+
+Ground truth came from the emulator: Mesen's Code Data Logger marks every byte the CPU
+**fetched as an opcode** (Code) and every byte it **read as data** (Data). Playing the
+ROM through title → 1P → game over → VS COMP marked 10,028 PRG bytes Code (61.2%) and
+1,534 Data; that is the classification oracle for every byte it observed. Where the CDL
+is silent the previous classification is kept, never guessed.
+
+| | code bytes | data bytes |
+|---|---|---|
+| As originally emitted by Pass 1 | 9,403 | 6,981 |
+| After the CDL reclassification | **11,041** | **5,343** |
+
+1,738 bytes that Pass 1 had emitted as `.byte` are executed code and are now
+instructions; 100 bytes it had emitted as instructions are read as data and are now
+`.byte`.
+
+The result reconciles with the CDL exactly, with no disagreement in either direction:
+
+| emitted as | CDL says Code | CDL says Data | CDL never saw it |
+|---|---:|---:|---:|
+| instructions | 10,028 | **0** | 1,013 |
+| data (`.byte`/`.word`) | **0** | 1,534 | 3,809 |
+
+Every byte the CDL observed is therefore classified the way the CPU used it. The 1,013
+instruction bytes the CDL never saw are Pass 1 static code plus the two inference steps
+below; the 3,809 unseen data bytes are the residue — 45 of them carry an undocumented
+opcode's disassembly in the audit comment (Pass 1 read them as code statically, but the
+CDL never watched the session fetch them, and ca65 V2.19 cannot encode those opcodes
+anyway, so they stay `.byte` with the disassembly recorded).
+
+As an independent structural check, all 1,183 control-flow targets in the file — 633
+`jsr`/`jmp` operands and 550 branch targets — land exactly on an instruction boundary;
+none points into an operand or a `.byte` run.
+
+The rewrite is reproducible with `_tools/cdl_reclass.py` (dry run by default). Capture a
+CDL from the Mesen MCP with
+`mesen_cdl_file(action:'save', memoryType:'NesPrgRom', filepath:'lunar.cdl')` — the
+capture is cumulative, so it does not reset — then:
+
+```bash
+python3 _tools/cdl_reclass.py --dir "copilot" --cdl lunar.cdl \
+  --override 0xC0C0-0xC0E5:D \
+  --override 0xF81A-0xF825:C --override 0xF826-0xF82E:D --override 0xF82F-0xF83A:C \
+  --override 0xF83B-0xF846:D --override 0xF847-0xF84B:C --override 0xF84C-0xF857:C \
+  --override 0xF858-0xF861:D --override 0xF862-0xF866:C
+```
+
+Its output differs from this `prg.s` only in this provenance header, the `.word` vector
+split, and three `jsr Label_CAA3` → `jsr $CAA3` operand spellings (this file spells
+`jsr`/`jmp` operands as raw addresses and branch operands as `Label_<addr>`). Always run
+`make` afterwards.
+
+Two inference steps were needed beyond the CDL because the capture never reached the
+hi-score screen. They are marked as inference, not ground truth:
+
+* `$C0C0–$C0E5` is a 19-entry little-endian 16-bit pointer table (read as
+  `lda $C0C0,y` / `lda $C0C1,y`). Pass 1 had decoded it as a `cmp (ZpXX,x)` chain; the
+  CDL only observed the few entries the current game state walked. Code resumes at
+  `$C0E6` (`tax`), which is a real branch target from `$C101`.
+* `$F81A` (hi-score) and `$F84C` ("perfect") are text routines. They are never reached
+  in normal play until a hi-score is beaten, so the CDL is silent; their inline-string
+  structure is inferred from the CDL-confirmed twins `$F77A` and `$F7E8`.
+
+### The inline-string dispatcher (this is not a jump gate)
+
+`$CBDC` (and its variant `$CBC9`, which also clears the PPU destination first) is a
+**print-inline-string-and-return-after-it** helper:
+
+```
+$CBDC  pla / sta ptr_lo        ; pop the caller's return address = the string address
+$CBDF  pla / sta ptr_hi
+$CBE2  jsr $CB5A               ; prepare the PPU destination
+$CBE5  ldy #$00
+$CBE7  lda (ptr_lo),y          ; next character
+$CBE9  beq $CBF4               ; $00 terminates
+$CBEB  jsr $CC29               ; emit it (advances ptr_lo/hi)
+$CBEE  jsr $CB5A
+$CBF1  jmp $CBE5
+$CBF4  lda ptr_hi / pha        ; push the address of the byte after the $00 ...
+$CBF7  lda ptr_lo / pha
+$CBFA  rts                     ; ... and rts to it
+```
+
+So every `jsr $CBDC` in the image is immediately followed by a `$00`-terminated string
+that begins with the control byte `$81` (`$81` also acts as the word separator), and
+execution resumes after the terminator:
+
+| site | bytes | text |
+|------|-------|------|
+| `$F786` | `$81player$81$00` | player |
+| `$F79B` | `$81shot$81$00` | shot |
+| `$F7F4` | `$81player$81$00` | player |
+| `$F809` | `$81game$81over$81$00` | game over |
+| `$F826` | `$81player$81$00` | player |
+| `$F83B` | ``$81hi`score__$00`` | hi`score__ |
+| `$F858` | `$81perfect_$00` | perfect_ |
+
+**Earlier revisions of this document claimed a `jmp ($7961)` RAM-pointer dispatch at
+`$F788`/`$F7F6`/`$F828`. That was a flat-tracer phantom.** The bytes after `jsr $CBDC`
+are the strings above; the decoder happened to start an instruction two bytes into
+`player`, reading `$6C $61 $79` as `jmp ($7961)` — the operand is the middle of the word
+"player". Nothing in the ROM ever writes `$7961`/`$7962`, and `$6000–$7FFF` is unmapped
+on NROM, so such a jump could not work. The three sites are gone from the classification;
+no instruction in the corrected file is an indirect `jmp`.
+
+The genuine computed dispatch that remains is small and resolved. `$CBE5` re-reads its
+string pointer through `ptr_lo`/`ptr_hi` and re-enters its loop with it — plain code.
+`$F193` does the reverse: it pushes `Zp17`/`Zp16` and `rts`es, so a caller sets that pair
+and the `rts` transfers control to it; the pattern is named in `locals.inc` and every
+target is inside CDL-covered code.
+
+### Code the CDL proved but Pass 1 missed (largest runs)
+
+| Range | Bytes | What it is |
+|-------|------:|-----------|
+| `$EA00–$EBAF` | 432 | VS-COMP / select-screen logic (`$EB16` is still unreached and stays data) |
+| `$EBF3–$ED4E` | 348 | menu/round state machine |
+| `$CE35–$CF9A` | 358 | collision/entity maths |
+| `$D4FA–$E01D` | 2,852 | `$D4FA` 30-entry pointer table (`$D4FA–$D535`), the 35-byte code helper at `$D536–$D558`, then variable-length records from `$D559` |
+| `$F897–$F98F` | 249 | high-score / attract handling |
+| `$C0F2–$C18C` | 155 | object update chain (branches back to `$C0E6`) |
+| `$D325–$D391`, `$D2A0–$D2D3`, `$D1BB–$D209` | 240 | further record/table walkers |
+
+### Tracer fixes required during Pass 1
+
+Three undocumented opcodes were missing from `_tools/nesdis.py` and were added, with the
+`--undocumented` switch (default off, so existing `make regen` pipelines stay byte-stable):
+
+* `$72` — `RRA abs` (the `RRA` family had `$63`/`$67`/`$6F`/`$73`/`$77`/`$7B`/`$7F` but not `$72`).
+* `$42` — `NOP #imm` (the family had `$80`/`$82`/`$89`/`$C2`/`$E2` but not `$42`).
+* `$FA` — `NOP abs,X` (the family had `$1C`/`$3C`/`$5C`/`$7C`/`$DC`/`$FC` but not `$FA`).
+
+One emitter fix: ca65 silently rewrites an operand whose high byte is `$00` into the
+shorter zero-page form (`sta $00FF,x` becomes `sta $FF,x`, emitting `$95` instead of
+`$9D`). `render()` now emits the `a:` prefix for ABS/ABSX/ABSY/IND operands with a high
+byte of `$00`, forcing the absolute form so the bytes match the ROM. `operand_value()`
+strips the prefix when parsing.
+
+## Known remaining gaps
+
+* The static tracer reported two overlaps (`$C3BB` — resolved with `--data 0xC3BB:1` —
+  and `$F0EF`) and three rejected mis-aligned stubs. The residue that remains is the
+  CDL's: 5,343 bytes (32.6%) are still emitted as data (`.byte`, plus the six vector
+  bytes as `.word`).
+* Unreached in the CDL session, therefore still unclassified: the hi-score entry screen
+  (`$F81A`+ / `$F84C`+ are inferred by symmetry, above), the 2-player-only branches, and
+  `$EB16` (a poll loop behind `beq` at `$EB11`, emitted as a raw `beq *+$05`).
+* `locals.inc` carries 104 aliases: **38 semantic** (see the Pass 3 notes at the foot of
+  the file) and 66 neutral `ZpXX`. Ten further aliases were deleted by the
+  reclassification: they were phantoms — `$49`/`$84`/`$8A`/`$AA`/`$C0` came from the
+  mis-decoded `$C0C0` table, and `$3B`/`$65`/`$67`/`$72`/`$81` were ASCII characters of
+  the inline strings read as operands.
+
+## `copilot/` Contents
+
+| File | Purpose |
+|------|---------|
+| `Lunar Pool (U).nes` | original ROM image (reference) |
+| `prg.bin` / `header.bin` / `chr.bin` | split image, produced by `_tools/splitnes.py` |
+| `prg.s` | disassembly: 5,285 instructions with per-instruction address/byte audit comments, unclassified bytes kept as `.byte`/`.word` |
+| `symbols.inc` | shared NES hardware constants (PPU/APU/controller, from the skeleton) |
+| `locals.inc` | project-local zero-page aliases — 38 semantic, 66 neutral `ZpXX`; Pass 3 evidence notes at the foot of the file |
+| `linker.cfg` | PRG at $C000, 16 KB, `fill = yes` |
+| `Makefile` | links `reconstructed_prg.bin` and `cmp`s it against `prg.bin` |
+| `reconstructed_prg.bin` | build output from the last verified build |
+
+Header/CHR are reproduced verbatim from `header.bin`/`chr.bin` (not linked): `make`
+verifies **PRG bytes only** at this stage, which is exactly what a skeleton proves. When
+this project is promoted to a full disassembly, `header.s` / `chr.s` (as e.g.
+`Burger Time (U)`) and a full-ROM `make` target get added.
+
+## Build
+
+```bash
+cd "_wip/Lunar Pool (U)/copilot"
+make        # → cmp reconstructed_prg.bin prg.bin → "BYTE-IDENTICAL"
+```
+
+## Next Steps (per `PROMPTS.md`)
+
+1. **Pass 1** — complete. The split is CDL-verified; the remaining `.byte` runs are either
+   data (string/table/record bytes) or CDL-unreached code (above).
+2. **Pass 2** — partial: the hardware constants and the zero-page aliases are named. The
+   remaining Pass 2 work is routine-label renaming — all 640 entries are address-derived
+   `Label_<addr>`, and `git log -S SubC` shows this was never done for this project.
+3. **Pass 3** — in progress. Zero-page audit complete (38 semantic + 66 neutral), and the
+   `$FFFA–$FFFF` vectors are now `.word NmiHandler, Reset, IrqHandler`.
+   Remaining: name the data tables and structures — the `$D4FA` 30-entry pointer table and
+   the variable-length records at `$D559+`, the `$C0C0` entry-point table, the
+   `$C47A–$CA20` block.
+4. **Promotion** — move to a top-level `<name>/copilot/` folder, add a full-ROM build
+   (header.s + chr.s + vectors), and write the power-on flow `OVERVIEW.md` in the
+   established style; then it joins the root index's numbered inventory.
@@ -0,0 +1,25 @@
+CA65 ?= ca65
+LD65 ?= ld65
+
+all: reconstructed.nes verify
+
+prg.o: prg.s symbols.inc locals.inc
+	$(CA65) -g -o $@ $<
+
+header.o: header.s header.bin
+	$(CA65) -g -o $@ $<
+
+chr.o: chr.s chr.bin
+	$(CA65) -g -o $@ $<
+
+reconstructed.nes: header.o prg.o chr.o linker.cfg
+	$(LD65) -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ header.o prg.o chr.o
+
+verify: reconstructed.nes rom.nes
+	cmp reconstructed.nes rom.nes
+	@echo "Byte-identical ROM verified."
+
+clean:
+	rm -f *.o reconstructed.nes reconstructed.map reconstructed.lbl
+
+.PHONY: all verify clean
@@ -0,0 +1,2 @@
+.segment "CHR"
+    .incbin "chr.bin"
@@ -0,0 +1,2 @@
+.segment "HEADER"
+    .incbin "header.bin"
@@ -0,0 +1,10 @@
+MEMORY {
+  HEADER: start = $0000, size = $0010, file = %O, fill = yes;
+  PRG:    start = $C000, size = $4000, file = %O, fill = yes;
+  CHR:    start = $0000, size = $2000, file = %O, fill = yes;
+}
+SEGMENTS {
+  HEADER: load = HEADER, type = ro;
+  PRG:    load = PRG,    type = ro;
+  CHR:    load = CHR,    type = ro;
+}
@@ -0,0 +1,209 @@
+; Lunar Pool (U) application-specific RAM aliases
+; Generated from every direct zero-page operand in reachable code.
+; ref counts are reads+writes; `used at` lists up to four distinct CPU addresses.
+; A reference is an operand-position mention in the disassembled instruction stream,
+; including the "-- <disasm>" comment of a .byte line that stands in for an
+; undocumented opcode.  sta/stx/sty write; inc/dec/asl/lsr/rol/ror and the
+; undocumented read-modify-write set slo/rla/sre/rra/dcp/isc read and write;
+; everything else reads.  The counts were refreshed after the Pass 3
+; reclassification below, so they describe the current prg.s, not the Pass 1 trace.
+; ZpXX names indicate storage with a role not yet unique enough for a behavioral name.
+; Pass 2 named the entries whose role was already unambiguous.
+; Pass 3 re-traced every remaining ZpXX and named the ones whose behaviour is provable
+; from the instruction contexts that touch them; the rest stay neutral on purpose.
+; See the Pass 3 notes at the bottom of this file for the evidence and the residue.
+
+timer_lo                    = $00 ; 28 refs; reads=16 writes=12; used at $CB45, CB49, CB52, CB61, +21 more
+timer_hi                    = $01 ; 32 refs; reads=17 writes=15; used at $CA79, CB4D, CB50, CB66, +26 more
+Zp02                    = $02 ; 6 refs; reads=4 writes=2; used at $E295, E844, EAFA, EB0D, +1 more
+Zp03                    = $03 ; 8 refs; reads=4 writes=4; used at $E8E6, E9FB, EE48, EE4A, +1 more
+Zp04                    = $04 ; 3 refs; reads=2 writes=1; used at $F68F, F725
+Zp05                    = $05 ; 12 refs; reads=6 writes=6; used at $E8EB, EE3C, F211, F2AF, +5 more
+Zp06                    = $06 ; 3 refs; reads=1 writes=2; used at $EE32, F2E5
+Zp07                    = $07 ; 22 refs; reads=16 writes=6; used at $EE55, EE57, EEC7, EF04, +16 more
+Zp08                    = $08 ; 7 refs; reads=5 writes=2; used at $F032, F236, F287, F2BC, +2 more
+Zp09                    = $09 ; 3 refs; reads=1 writes=2; used at $CFC4, D2BC, D2E7
+Zp0C                    = $0C ; 4 refs; reads=2 writes=2; used at $E29A, E300, E309
+Zp0D                    = $0D ; 7 refs; reads=4 writes=3; used at $E240, E302, E314, E8F0, +1 more
+Zp0E                    = $0E ; 5 refs; reads=3 writes=2; used at $E245, E31A, EBFD, F5EE
+Zp0F                    = $0F ; 1 refs; reads=0 writes=1; used at $E8A1
+Zp10                    = $10 ; 3 refs; reads=1 writes=2; used at $E3FF, E655, FBC8
+Zp11                    = $11 ; 4 refs; reads=2 writes=2; used at $E405, E659, E6F8, FBCA
+Zp12                    = $12 ; 4 refs; reads=3 writes=1; used at $E666, F2A0, FBCC, FC8E
+Zp13                    = $13 ; 6 refs; reads=5 writes=1; used at $E66A, E6FC, E70F, F2A4, +2 more
+Zp15                    = $15 ; 2 refs; reads=1 writes=1; used at $F5F0
+Zp16                    = $16 ; 4 refs; reads=2 writes=2; used at $F080, F14E, F196, F29D
+Zp17                    = $17 ; 4 refs; reads=2 writes=2; used at $F084, F152, F193, F2A2
+Zp18                    = $18 ; 4 refs; reads=2 writes=2; used at $E698, E6CA, FC79, FCB3
+Zp19                    = $19 ; 4 refs; reads=2 writes=2; used at $E696, E6ED, FC7B, FCB7
+Zp1A                    = $1A ; 2 refs; reads=1 writes=1; used at $FC99, FCCA
+Zp1B                    = $1B ; 2 refs; reads=1 writes=1; used at $FC9B, FCCE
+Zp1C                    = $1C ; 8 refs; reads=4 writes=4; used at $E61E, E662, EF5A, F1E2, +4 more
+Zp1D                    = $1D ; 8 refs; reads=5 writes=3; used at $EF62, EF8A, EFDF, F1E7, +4 more
+Zp1E                    = $1E ; 9 refs; reads=5 writes=4; used at $E625, E673, EF6C, F1EC, +5 more
+Zp1F                    = $1F ; 9 refs; reads=6 writes=3; used at $EF74, EF84, EFD9, F1F1, +5 more
+Zp20                    = $20 ; 5 refs; reads=4 writes=1; used at $FBAD, FBEC, FC3A, FC7D, +1 more
+Zp21                    = $21 ; 5 refs; reads=4 writes=1; used at $FBA8, FBF0, FC3E, FC81, +1 more
+Zp22                    = $22 ; 5 refs; reads=4 writes=1; used at $FBBE, FC18, FC51, FC9D, +1 more
+Zp23                    = $23 ; 5 refs; reads=4 writes=1; used at $FBB9, FC1C, FC55, FCA1, +1 more
+Zp24                    = $24 ; 26 refs; reads=10 writes=16; used at $E3D6, E3EF, E6AB, E6BC, +20 more
+Zp25                    = $25 ; 23 refs; reads=11 writes=12; used at $E3D4, E3F5, E6A9, E6C1, +18 more
+Zp26                    = $26 ; 20 refs; reads=11 writes=9; used at $E3C4, E443, E51A, E59F, +15 more
+Zp27                    = $27 ; 5 refs; reads=1 writes=4; used at $E3DD, E448, E51F, E5A4, +1 more
+Zp28                    = $28 ; 8 refs; reads=6 writes=2; used at $E3CE, E67A, E68E, E694, +4 more
+Zp29                    = $29 ; 5 refs; reads=3 writes=2; used at $E3E7, E683, E6AD, F268, +1 more
+Zp2A                    = $2A ; 5 refs; reads=2 writes=3; used at $E31F, E34D, E373, E3BB, +1 more
+Zp2B                    = $2B ; 4 refs; reads=2 writes=2; used at $E360, E53E, E55D, E57D
+Zp2C                    = $2C ; 9 refs; reads=2 writes=7; used at $E3C1, E43E, E50E, E515, +4 more
+Zp2D                    = $2D ; 9 refs; reads=2 writes=7; used at $E3DA, E43B, E502, E509, +4 more
+Zp2E                    = $2E ; 10 refs; reads=5 writes=5; used at $E487, E4B2, E4D5, E4DE, +6 more
+Zp2F                    = $2F ; 6 refs; reads=2 writes=4; used at $E485, E4BB, E4FB, E529, +2 more
+Zp30                    = $30 ; 4 refs; reads=2 writes=2; used at $E39D, E555, E55B, E57B
+Zp31                    = $31 ; 8 refs; reads=4 writes=4; used at $E384, E527, E540, E550, +4 more
+Zp32                    = $32 ; 23 refs; reads=17 writes=6; used at $E413, E417, E457, E46C, +16 more
+Zp33                    = $33 ; 17 refs; reads=12 writes=5; used at $E415, E41B, E429, E455, +10 more
+Zp34                    = $34 ; 17 refs; reads=11 writes=6; used at $E71F, E721, E74F, E763, +11 more
+Zp35                    = $35 ; 14 refs; reads=7 writes=7; used at $E4E0, E4E4, E55F, E56A, +6 more
+Zp36                    = $36 ; 2 refs; reads=1 writes=1; used at $E5F8, E617
+Zp37                    = $37 ; 5 refs; reads=2 writes=3; used at $EBC1, F321, F41B, F41D
+Zp5F                    = $5F ; 6 refs; reads=3 writes=3; used at $C3C0, E85D, E8A6, F2EF, +1 more
+spawn_queue                    = $60 ; 4 refs; reads=2 writes=2; used at $C00E, C019, C3E0, C3E6
+Zp61                    = $61 ; 2 refs; reads=1 writes=1; used at $F521
+game_flag                    = $68 ; 3 refs; reads=1 writes=2; used at $C003, C3F7, CE37
+obj_script_lo                    = $69 ; 17 refs; reads=13 writes=4; used at $C085, C096, C0BD, C0E9, +12 more
+obj_script_hi                    = $6A ; 6 refs; reads=2 writes=4; used at $C08A, C0EB, C1E7, C401, +1 more
+obj_ptr_lo                    = $6B ; 35 refs; reads=20 writes=15; used at $C0F8, C13D, C141, C146, +30 more
+obj_ptr_hi                    = $6C ; 12 refs; reads=4 writes=8; used at $C199, C1AD, C209, C217, +7 more
+obj_index                    = $6D ; 17 refs; reads=14 writes=3; used at $C00C, C015, C02C, C02E, +12 more
+Zp6E                    = $6E ; 5 refs; reads=2 writes=3; used at $C231, C283, C39F, C404, +1 more
+Zp6F                    = $6F ; 19 refs; reads=9 writes=10; used at $C024, C150, C156, C15E, +14 more
+Zp70                    = $70 ; 1 refs; reads=1 writes=0; used at $C072
+Zp74                    = $74 ; 2 refs; reads=1 writes=1; used at $EBF1
+Zp7F                    = $7F ; 2 refs; reads=0 writes=2; used at $E832, FA93
+; --- palette shadow $0080-$009F ------------------------------------------------
+; The 32 bytes FlushPaletteToPpu writes to PPU $3F00-$3F1F at the end of every NMI.
+; $0080-$008F are the four background palettes and $0090-$009F the four sprite
+; palettes; Reset_LoadSpritePalettes fills the sprite half from the ROM table at
+; $ED3F.  The ZpXX entries below are the individual slots that reachable code
+; touches directly (the title colour cycle writes $85-$87, the aiming display
+; writes $8B/$8F/$92).
+palette_shadow              = $80
+sprite_palette_shadow       = $90
+Zp85                    = $85 ; 1 refs; reads=0 writes=1; used at $E9A0
+Zp86                    = $86 ; 1 refs; reads=0 writes=1; used at $E995
+Zp87                    = $87 ; 1 refs; reads=0 writes=1; used at $E98A
+Zp89                    = $89 ; 1 refs; reads=0 writes=1; used at $E963
+Zp8B                    = $8B ; 1 refs; reads=0 writes=1; used at $EDE2
+Zp8F                    = $8F ; 2 refs; reads=0 writes=2; used at $E84B, EDDD
+Zp92                    = $92 ; 2 refs; reads=0 writes=2; used at $EABF, EDD8
+vram_buf                    = $A0 ; 1 refs; reads=0 writes=1; used at $CC50
+ZpA5                    = $A5 ; 1 refs; reads=1 writes=0; used at $F0CF
+vram_slot_len                    = $D0 ; 5 refs; reads=3 writes=2; used at $CC05, CC36, CC4B, CC7F
+vram_slot_ofs                    = $D1 ; 2 refs; reads=0 writes=2; used at $CC19, CC47
+vram_slot_addr_lo                    = $D2 ; 1 refs; reads=0 writes=1; used at $CC3C
+vram_slot_addr_hi                    = $D3 ; 1 refs; reads=0 writes=1; used at $CC40
+vram_read_len                    = $E8 ; 4 refs; reads=2 writes=2; used at $CCC5, CCE2, F7BA, F7BC
+vram_read_addr_lo                    = $E9 ; 4 refs; reads=3 writes=1; used at $CCCF, F7AB, F7C2, F7D0
+vram_read_addr_hi                    = $EA ; 4 refs; reads=3 writes=1; used at $CCCA, F7A9, F7C0, F7CE
+vram_read_dst_lo                    = $EB ; 2 refs; reads=0 writes=2; used at $CCDC, F7B6
+vram_read_dst_hi                    = $EC ; 1 refs; reads=0 writes=1; used at $F7B2
+vram_slot_idx                    = $ED ; 3 refs; reads=1 writes=2; used at $CC12, CC34, CC8A
+vram_queue_len                    = $EE ; 9 refs; reads=6 writes=3; used at $CBFD, CC17, CC2E, CC45, +4 more
+vram_update_checksum                    = $EF ; 5 refs; reads=3 writes=2; used at $CAB4, CAB6, CDBB, CDC9, +1 more
+ppu_ctrl_shadow                    = $F0 ; 14 refs; reads=9 writes=5; used at $CA38, CA3F, CA48, CA4C, +8 more
+ppu_mask_shadow                    = $F1 ; 7 refs; reads=4 writes=3; used at $CA24, CA2B, CA2E, CA32, +3 more
+nt_base_hi                    = $F2 ; 6 refs; reads=3 writes=3; used at $CA68, CA7F, CA88, CB19, +2 more
+nt_base_lo                    = $F3 ; 5 refs; reads=2 writes=3; used at $CA6C, CA83, CA8C, CD4B, +1 more
+ppu_addr_save_lo                    = $F4 ; 2 refs; reads=1 writes=1; used at $CC20, CC3A
+ppu_addr_save_hi                    = $F5 ; 2 refs; reads=1 writes=1; used at $CC24, CC3E
+ppu_addr_temp_lo                    = $F6 ; 68 refs; reads=35 writes=33; used at $CAFB, CAFD, CB01, CB05, +52 more
+ppu_addr_temp_hi                    = $F7 ; 42 refs; reads=20 writes=22; used at $CAF9, CAFF, CB03, CB07, +29 more
+ppu_src_lo                    = $F8 ; 55 refs; reads=28 writes=27; used at $CE4E, CE7A, CEB4, CEE7, +46 more
+ppu_src_hi                    = $F9 ; 41 refs; reads=20 writes=21; used at $CE4C, CE7E, CEB8, CEE5, +36 more
+ptr_lo                    = $FA ; 68 refs; reads=24 writes=44; used at $CB71, CB87, CB95, CB9B, +61 more
+ptr_hi                    = $FB ; 67 refs; reads=25 writes=42; used at $CB9D, CBA3, CBCD, CBD5, +58 more
+ppu_addr_lo                    = $FC ; 153 refs; reads=63 writes=90; used at $CAA8, CB97, CB99, CBAB, +129 more
+ppu_addr_hi                    = $FD ; 111 refs; reads=45 writes=66; used at $CAA3, CB9F, CBA1, CBA9, +94 more
+ppu_addr_src_lo                    = $FE ; 40 refs; reads=23 writes=17; used at $CDD8, CE19, CE83, CECB, +36 more
+ppu_addr_src_hi                    = $FF ; 22 refs; reads=9 writes=13; used at $CDD6, CE14, CE86, CEC8, +18 more
+
+; =================================================================================
+; Pass 3 notes - zero-page audit (rebuild re-verified byte-identical after the pass)
+;
+; Named in Pass 3 (20 entries; the proof is the instruction context on each line):
+;
+;   Object core ($C000-$C4FF)
+;     obj_index       $6D  current object slot 0..4; indexes the $0500/$0514/$056E
+;                           per-object arrays and is saved/restored around jsr $C404.
+;     obj_script_lo   $69  per-object behaviour-script pointer.  Copied from the
+;     obj_script_hi   $6A  $0528/$052D pointer tables, read with (..),y to fetch the
+;                           next script byte, advanced by $C3FC/$C401, saved per object
+;                           in $0546/$054B.
+;     spawn_queue     $60  8-slot FIFO of entity-type spawn requests: filled by $C3DA
+;                           (`lda #imm / jsr $C3DA`), drained by the $C00C loop which
+;                           hands each entry to $C404 and clears the slot.
+;
+;   VRAM write queue ($CBFD-$CC91)
+;     vram_buf           $A0  staging buffer base; queued bytes land in vram_buf,x where
+;                              x is the running queue length.
+;     vram_queue_len     $EE  bytes currently staged, 0..$30.  $CC49 increments it per
+;                              byte, $CC7B/$CCC3 reset it, and the guards at $CBFD/$CC2E
+;                              spin while it equals $30 (buffer full).
+;     vram_slot_idx      $ED  descriptor slot being filled (stride 4), set at $CC12/$CC8A.
+;     vram_slot_len      $D0  per-slot byte count        )
+;     vram_slot_ofs      $D1  buffer offset for the slot ) four-byte descriptor at $D0+slot,
+;     vram_slot_addr_lo  $D2  VRAM destination low        ) consumed by the drain at $CC91
+;     vram_slot_addr_hi  $D3  VRAM destination high       ) (PPUADDR hi then lo, then copy).
+;
+;   VRAM read-back ($CCBA-$CCE5, $F7A7)
+;     vram_read_len      $E8  transfer length; nonzero while a read is pending, and the
+;                              busy flag the callers spin on at $F7BC.
+;     vram_read_addr_lo  $E9  PPU source address, written to PPUADDR second (low byte).
+;     vram_read_addr_hi  $EA  PPU source address, written to PPUADDR first (high byte).
+;     vram_read_dst_lo   $EB  destination pointer for the copied bytes ($0420 in $F7A7).
+;     vram_read_dst_hi   $EC
+;
+;   PPU helpers
+;     nt_base_hi         $F2  screen/nametable base address, $2000 or $2440 depending on
+;     nt_base_lo         $F3  the select tested at $CA77; added to row offsets at
+;                              $CB19/$CD4B and used to fetch tiles at $CD94/$CD9D/$CDAC.
+;     ppu_addr_save_lo   $F4  running PPU write address, captured from ppu_addr_lo/hi when
+;     ppu_addr_save_hi   $F5  a slot opens ($CC20/$CC24) and copied into the descriptor at
+;                              $CC3A/$CC3E; advanced by the $CB61 counter.
+;
+; Left neutral on purpose - role not provable from static context:
+;   * $10-$37, $61, $7F, $A5 (the $E3xx-$E98x
+;     and $EFxx-$FBxx engines): scratch operands of the collision/scoring/entity maths.
+;     They are written and consumed inside single routines and reused across routines,
+;     so any behavioural name would be a guess.  Examples: $2C/$2D hold a computed pair
+;     only between $E3C1 and $E43B; $16/$17 serves as a push/rts jump vector at $F193 yet
+;     is compared as a 16-bit value at $F29D.
+;   * $02-$0F, $5F, $6E, $6F, $70, $74, $09: layout/name-table bytes and further
+;     single-routine temporaries with no repeating, self-describing pattern.
+;
+; Named in Pass 3 by the table audit: $85-$8F and $92 are not general scratch.  They
+; are slots of the $0080-$009F palette shadow that FlushPaletteToPpu sends to $3F00-$3F1F
+; every NMI - $85/$86/$87 come from the title colour cycle, $8B/$8F/$92 from the three
+; aiming-display colour sequences at $F762/$F76A/$F772.  See palette_shadow above.
+;
+; Removed by the Pass 3 reclassification (the aliases are gone from the list above).
+; These ten addresses had NO real reference: every one of them was produced by the
+; flat tracer decoding data as code, and the bytes it "operated on" are the characters
+; of the inline text strings and the values of the lookup tables.
+;   * $49, $84, $8A, $AA, $C0: the 16-bit pointer table at $C0C0-$C0E5, decoded as a
+;     `cmp (ZpXX,x)` chain.  $C0C0-$C0E5 is now .byte and $C0E6 resumes as `tax`.
+;   * $3B, $65, $67, $72: ASCII ";" "e" "g" "r" read as operands inside the $F7xx and
+;     $EBxx text/table data ($F85C ror Zp65, $F85A adc Zp72, ...).
+;   * $81: the string delimiter $81 of "$81player$81$00", read as `sta (Zp81,x)`.
+;
+; Existing Pass 1/2 names this audit found imprecise.  Not renamed again (to avoid
+; churn), recorded here instead:
+;   * timer_lo/timer_hi ($00/$01): not a 16-bit counter pair in practice.  The counter
+;     routines at $CB39-$CB61 are generic - their stubs pick the target with X =
+;     $F8/$FA/$FC/$FE, so index 0 is never a target.  $00 is a frame/sub-phase counter
+;     tested with and #$01/#$04/#$08/#$10; $01 is a status/flag byte (and #$7F/#$90/#$F7,
+;     ora #$08/#$20/#$30).
+;   * ppu_addr_temp_lo/hi ($F6/$F7): a general 16-bit accumulator used by the
+;     $FD8B-$FDE6 shift/add multiply and many address builders, not a PPU address.
+;   * obj_ptr_lo/hi ($6B/$6C): a scratch 16-bit pointer (also used at $C22F/$C3DA), not
+;     exclusively an object pointer.
@@ -0,0 +1,705 @@
+al 00FF90 .PaddingFf
+al 00FF65 .NmiHandler
+al 00FF64 .IrqHandler
+al 00FF5B .WaitFrames_Loop
+al 00FF56 .WaitFrames
+al 00FF50 .RotateCoord270
+al 00FF43 .RotateVector270
+al 00FF3D .RotateCoord180
+al 00FF2B .RotateVector180
+al 00FF25 .RotateCoord90
+al 00FF18 .RotateVector90
+al 00FF11 .GetCosine_Lookup
+al 00FF0E .GetCosine
+al 00FECE .SineTable
+al 00FECD .GetSine_Done
+al 00FEBD .GetSine_Lookup
+al 00FEC5 .GetSine_Ninety
+al 00FEA8 .GetSine
+al 00FE95 .SquareRoot16_Next
+al 00FE8E .SquareRoot16_Subtract
+al 00FE6A .SquareRoot16_Loop
+al 00FE5A .SquareRoot16
+al 00FE4A .SignExtendFixed
+al 00FE49 .NegatePtr_Done
+al 00FE37 .NegatePtr
+al 00FE36 .NegatePpuAddr_Done
+al 00FE24 .NegatePpuAddr
+al 00FE17 .SignedDivide16_Negate
+al 00FE1A .SignedDivide16_Return
+al 00FE1F .SignedDivide16_CheckDivisor
+al 00FE0E .SignedDivide16_Divide
+al 00FE06 .SignedDivide16_DivisorDone
+al 00FDFE .SignedDivide16
+al 00FDFA .Divide16_Borrow
+al 00FDE0 .Divide16_Loop
+al 00FDD8 .Divide16
+al 00FDD4 .MultiplyByte16_NextPair
+al 00FDBF .MultiplyByte16_NextBit
+al 00FDAA .MultiplyByte16_Loop
+al 00FDA8 .MultiplyByte16
+al 00FD98 .Multiply16_LowByte
+al 00FD8B .Multiply16
+al 00FD85 .ProjectCoordinate_High
+al 00FD88 .ProjectCoordinate_Done
+al 00FD60 .ProjectCoordinate
+al 00FD32 .ProjectObjectPosition_Store
+al 00FD2D .ProjectObjectPosition_Skip
+al 00FC6C .ProjectObjectPosition
+al 00FBD1 .ComputeBallVelocity_Moving
+al 00FBC2 .ComputeBallVelocity
+al 00FBA5 .ResolveBallCollision_Rotate
+al 00FBC1 .ResolveBallCollision_Done
+al 00FB99 .ResolveBallCollision
+al 00FB90 .CollisionAngleLimitTable
+al 00FB87 .ComputeCollisionAngle_Quadrant2
+al 00FB8D .ComputeCollisionAngle_Quadrant3
+al 00FB7A .ComputeCollisionAngle_Quadrant1
+al 00FB69 .ComputeCollisionAngle_ApplySigns
+al 00FB4C .ComputeCollisionAngle_Mirror
+al 00FB38 .ComputeCollisionAngle_Reject
+al 00FB39 .ComputeCollisionAngle_Steep
+al 00FB55 .ComputeCollisionAngle_Shallow
+al 00FB2C .ComputeCollisionAngle
+al 00FAF9 .ComputeFieldCellAddress
+al 00FAC9 .PaletteColorTable
+al 00FAB1 .MapColorCodeToPalette_Disabled
+al 00FAB4 .MapColorCodeToPalette_High
+al 00FA99 .MapColorCodeToPalette
+al 00FA8D .BuildPaletteFromShadeTable_Loop
+al 00FA8B .BuildPaletteFromShadeTable
+al 00FA7F .FadeInPalette_Loop
+al 00FA7D .FadeInPalette
+al 00FA6F .FadeOutPalette_Loop
+al 00FA6D .FadeOutPalette
+al 00FA5F .CopyScoreToHighScore_Loop
+al 00FA56 .CopyScoreToHighScore
+al 00FA4A .GetPlayerScoreIndex
+al 00FA40 .CompareScoreToHighScore_Next
+al 00FA34 .CompareScoreToHighScore_Loop
+al 00FA2B .CompareScoreToHighScore
+al 00FA1F .AddScoreDigit_Overflow
+al 00FA26 .ScoreRoutine_Return
+al 00FA07 .AddScoreDigit_Loop
+al 00F9F9 .AddScoreDigit
+al 00F9E4 .CountUpScore_WaitFrame
+al 00F9D9 .CountUpScore_PointLoop
+al 00F9D6 .CountUpScore_MultiplierLoop
+al 00F9CE .CountUpScore
+al 00F9BD .IncrementTurnBallCount_CheckBonus
+al 00F9B0 .IncrementTurnBallCount
+al 00F9AD .IncrementPlayerBallCount_Redraw
+al 00F9A0 .IncrementPlayerBallCount
+al 00F998 .SetBallSpriteTile
+al 00F990 .SetBallSpriteAttributes
+al 00F989 .SetPpuAddr
+al 00F988 .StampBallMarker_Abort
+al 00F908 .StampBallMarker_BottomRight
+al 00F8EE .StampBallMarker_BottomLeft
+al 00F8D4 .StampBallMarker_TopRight
+al 00F924 .StampBallMarker_IfEmpty
+al 00F8AB .StampBallMarker_CheckColumn
+al 00F8BB .StampBallMarker_TopLeft
+al 00F89B .StampBallMarker_Done
+al 00F89C .StampBallMarker_CheckRow
+al 00F897 .StampBallMarker
+al 00F88A .SaveHighScore_Loop
+al 00F87F .SaveHighScore
+al 00F872 .LoadHighScore_Loop
+al 00F867 .LoadHighScore
+al 00F858 .StrPerfect
+al 00F84C .ShowPerfectText
+al 00F83B .StrHiScore
+al 00F826 .StrPlayer3
+al 00F81A .ShowPlayerHiScoreText
+al 00F809 .StrGameOver
+al 00F7F4 .StrPlayer2
+al 00F7E8 .ShowPlayerGameOverText
+al 00F7DD .RestoreVramOverlay_Loop
+al 00F7CB .RestoreVramOverlay
+al 00F7BC .BeginVramOverlay_Wait
+al 00F7A7 .BeginVramOverlay
+al 00F79B .StrShot
+al 00F786 .StrPlayer1
+al 00F77A .ShowPlayerShotText
+al 00F762 .AimPhaseTable0
+al 00F73F .DrawBlinkingBallSprite_Visible
+al 00F728 .DrawBlinkingBallSprite
+al 00F725 .BuildBallSprites_Done
+al 00F71A .BuildBallSprites_Next
+al 00F6CF .BuildBallSprites_Draw2x2
+al 00F6C1 .BuildBallSprites_CheckSpecial
+al 00F69D .BuildBallSprites_Loop
+al 00F683 .BuildBallSprites
+al 00F67D .WaitForObjectSlot_Spin
+al 00F674 .WaitForObjectSlot
+al 00F66B .FillAttributeTable_Loop
+al 00F669 .FillAttributeTable
+al 00F654 .FillNametable
+al 00F5E4 .EndingCommandList
+al 00F5D6 .ShowEndingScreen_ClearRow2
+al 00F5C6 .ShowEndingScreen_ClearRow1
+al 00F585 .ShowEndingScreen_RestorePlayer
+al 00F574 .ShowEndingScreen_SwapPlayer
+al 00F56C .ShowEndingScreen
+al 00F557 .ShowGameOverScreen_CheckInput
+al 00F54C .ShowGameOverScreen_WaitLoop
+al 00F542 .ShowGameOverScreen_QueueSpawn
+al 00F540 .ShowGameOverScreen_SpawnAlt
+al 00F4B1 .TurnEnd_NextPlayer
+al 00F4DF .TurnEnd_StartTurn
+al 00F49B .TurnEnd_SaveCounts
+al 00F4F6 .ShowGameOverScreen
+al 00F487 .TurnEnd_PlayerOut_CheckCountdown
+al 00F476 .TurnEnd_PlayerOut
+al 00F457 .TurnEnd_TableCleared_Continue
+al 00F44D .TurnEnd_TableCleared_DecCount
+al 00F435 .TurnEnd_TableCleared
+al 00F41B .TurnEnd_CheckTable
+al 00F413 .RoundFinish_NoPotPenalty
+al 00F410 .StartNextRound_ShowEnding
+al 00F406 .StartNextRound_AllStagesDone
+al 00F3E4 .StartNextRound_Store
+al 00F3D2 .StartNextRound
+al 00F3AD .RoundFinish_Wait
+al 00F3BB .RoundFinish_Tail
+al 00F387 .RoundFinish_Clear
+al 00F36E .RoundFinish_Score_Loop
+al 00F377 .RoundFinish_Advance
+al 00F365 .RoundFinish_Score
+al 00F344 .RoundFinish_Collect_Store
+al 00F33D .RoundFinish_Collect_Empty
+al 00F341 .RoundFinish_Collect_X
+al 00F327 .RoundFinish_Collect_Loop
+al 00F31F .RoundFinish_Collect
+al 00F312 .RoundFinish
+al 00F30F .BallUpdateEnd_Next
+al 00F302 .BallUpdateEnd_Idle
+al 00F2EC .BallUpdateEnd
+al 00F2E5 .BallCollisionScan_Repeat
+al 00F2DB .BallCollisionScan_NextOuter
+al 00F2CB .BallCollisionScan_NextInner
+al 00F270 .BallCollisionScan_DY
+al 00F25B .BallCollisionScan_DX
+al 00F241 .BallCollisionScan_Next
+al 00F244 .BallCollisionScan_Test
+al 00F238 .BallCollisionScan_Inner
+al 00F233 .BallCollisionScan_Pair
+al 00F225 .BallCollisionScan_Loop
+al 00F221 .BallCollisionScan
+al 00F218 .BallFrameEnd
+al 00F211 .BallPhysicsNextStep
+al 00F206 .BallSlotAdvance
+al 00F1F6 .BallDecelerate
+al 00F1E2 .BallCommitPosition
+al 00F1D3 .BallRememberTile
+al 00F1B9 .BallBounceCommit_TestC0
+al 00F1AF .BallBounceCommit_Test80
+al 00F1BC .BallBounceCommit_Store
+al 00F19A .BallBounceCommit
+al 00F16A .BallReflectVector
+al 00F193 .BallBounceExit
+al 00F149 .BallFlipXVelocity
+al 00F13F .BallReflectX_Do
+al 00F148 .BallReflectX_Done
+al 00F125 .BallReflectX
+al 00F0EF .BallTileHandler8_Exit
+al 00F0DF .BallTileHandler8
+al 00F0DC .BallTileHandler5_Reflect
+al 00F0CE .BallTileHandler5
+al 00F098 .TileCollisionTable
+al 00F07B .BallBounce_TestC0
+al 00F071 .BallBounce_Test80
+al 00F07E .BallBounce_JumpTable
+al 00F04D .BallBounce
+al 00F031 .SinkRemainingBalls_Next
+al 00F019 .SinkRemainingBalls_Loop
+al 00F017 .SinkRemainingBalls
+al 00F037 .BallPocketed_CueBall
+al 00EFF5 .BallPocketed
+al 00F045 .BallMove_TestTile
+al 00EFD9 .BallMove_SubTile
+al 00EFD5 .BallMove_StoreTile
+al 00EFB4 .BallMove_OffTable
+al 00EFB8 .BallMove_ReadTile
+al 00EF84 .BallMove_CheckTile
+al 00EF53 .BallMove_Advance
+al 00EF50 .BallMove_Stopped
+al 00EF3A .BallMove_Step
+al 00EF31 .BallMove
+al 00EF2A .BallSinkTiles
+al 00EF27 .BallSinkAnim_Done
+al 00EEF0 .BallSinkAnim
+al 00EEE9 .BallAppearTiles
+al 00EEE0 .BallAppearAnim_Next
+al 00EEE6 .BallAppearAnim_Done
+al 00EEB9 .BallAppearAnim
+al 00EE80 .BallLaunch
+al 00EE76 .BallSlotUpdate_Next
+al 00EE79 .BallSlotUpdate_State1
+al 00EE6F .BallSlotUpdate_Case
+al 00EE57 .BallSlotUpdate
+al 00EE53 .BallPhysicsStep_Skip
+al 00EE3E .BallPhysicsStep
+al 00EE3A .BallPhysicsPass
+al 00EE2C .BallPhysicsBegin_Alt
+al 00EE30 .BallPhysicsBegin
+al 00EDBA .PlayPhaseLoop
+al 00EDB7 .InitBallSlots_BeginPlay
+al 00ED8B .InitBallSlots_Next
+al 00ED86 .InitBallSlots_MarkActive
+al 00ED5D .InitBallSlots_Loop
+al 00ED3F .SpritePaletteTable
+al 00ED4F .InitBallSlots
+al 00ED16 .LoadStageScene_StartPlay
+al 00ECF2 .LoadStageScene_LoadLayout_Next
+al 00ECE7 .LoadStageScene_LoadLayout_Loop
+al 00ECD5 .LoadStageScene_LoadLayout_Clear
+al 00ECD3 .LoadStageScene_LoadLayout
+al 00ECA2 .LoadStageScene_VaryTiles_Write
+al 00ECAE .LoadStageScene_VaryTiles_Next
+al 00EC87 .LoadStageScene_VaryTiles
+al 00EC63 .LoadStageScene_PlaceBalls
+al 00EC3C .LoadStageScene_CopyAttrs
+al 00EC3A .LoadStageScene
+al 00EC2A .StageAttributeTable
+al 00EBB0 .DrawStageBanner
+al 00EB7A .ClearRoundState
+al 00EB60 .SetupRound
+al 00EB06 .AimLoop_UpdatePower
+al 00EAFF .AimLoop_DecreasePower
+al 00EAEF .AimLoop_StoreStage
+al 00EAE9 .AimLoop_ClampStage
+al 00EAF5 .AimLoop_IncreasePower
+al 00EADE .AimLoop_AdjustStage
+al 00EB0D .AimLoop_FireCheck
+al 00EA9F .AimLoop_UpdatePlayers
+al 00EAB1 .AimLoop_Update
+al 00EA86 .AimLoop_CyclePlayers
+al 00EA7B .AimLoop_CheckSelect
+al 00EA75 .AimLoop_NoStart
+al 00EA51 .AimLoop
+al 00EA00 .TitleCommandList
+al 00E9CC .StartGame_CopyAttrs
+al 00E9CA .StartGame
+al 00E9B9 .StartGameAttributeRow
+al 00E9A3 .TitleColorCycleTable
+al 00E980 .UpdateTitleColors_Store
+al 00E974 .UpdateTitleColors
+al 00E971 .TitleScreenLoop_Next
+al 00E95D .TitleScreenLoop_SetPalette
+al 00E947 .TitleScreenLoop_Animate
+al 00E928 .TitleScreenLoop_WaitFrame
+al 00E923 .TitleScreenLoop
+al 00E8FF .EnterTitleScreen_CopyAttrs
+al 00E8B3 .EnterTitleScreen
+al 00E88F .Reset_InitPlayerRecords
+al 00E882 .Reset_CopySignature
+al 00E862 .BootSignatureText
+al 00E880 .Reset_ColdInit
+al 00E852 .Reset_CheckSignature
+al 00E848 .Reset_LoadSpritePalettes
+al 00E830 .Reset_ClearShadowTables
+al 00E81E .Reset_WaitVblank2
+al 00E817 .Reset_WaitVblank
+al 00E80C .Reset
+al 00E802 .CheckTileCollision_Next
+al 00E7C0 .CheckTileCollision_Probe
+al 00E7B5 .CheckTileCollision_Loop
+al 00E7B1 .CheckTileCollision
+al 00E78B .FindPocketInPath_DiffAbs
+al 00E7A6 .FindPocketInPath_Next
+al 00E771 .FindPocketInPath_Loop
+al 00E76D .FindPocketInPath
+al 00E748 .FindBlockingBall_DiffAbs
+al 00E763 .FindBlockingBall_Next
+al 00E721 .FindBlockingBall_Loop
+al 00E71D .FindBlockingBall
+al 00E71B .ComputeAngleFromDelta_Quad1
+al 00E71C .ComputeAngleFromDelta_Done
+al 00E706 .ComputeAngleFromDelta_Quad2
+al 00E70F .ComputeAngleFromDelta_PosX
+al 00E6F7 .ComputeAngleFromDelta_Adjust
+al 00E6F8 .ComputeAngleFromDelta_Quadrant
+al 00E6E4 .ComputeAngleFromDelta_TableUp
+al 00E6ED .ComputeAngleFromDelta_Found
+al 00E6D9 .ComputeAngleFromDelta_TableLoop
+al 00E6D0 .ComputeAngleFromDelta_Divide
+al 00E696 .ComputeAngleFromDelta_RatioSetup
+al 00E68C .ComputeAngleFromDelta_Ratio
+al 00E683 .ComputeAngleFromDelta_ZeroY
+al 00E67A .ComputeAngleFromDelta
+al 00E63E .ComputePotAimPoint_Scale
+al 00E60B .ComputePotAimPoint
+al 00E60A .ScoreShotLineup_Done
+al 00E5F2 .ScoreShotLineup_Record
+al 00E5DF .ScoreShotLineup_Tolerance
+al 00E5E7 .ScoreShotLineup_Accept
+al 00E5FE .ScoreShotLineup_Next
+al 00E598 .ScoreShotLineup_AfterAbs
+al 00E586 .ScoreShotLineup_Loop
+al 00E582 .ScoreShotLineup
+al 00E572 .PlanBestShot_VaryAngle
+al 00E570 .PlanBestShot_VaryFar
+al 00E564 .PlanBestShot_VaryLoop
+al 00E57B .PlanBestShot_SetShot
+al 00E550 .PlanBestShot_StorePower
+al 00E54A .PlanBestShot_ClampPowerLow
+al 00E53E .PlanBestShot_PowerBucket
+al 00E517 .PlanBestShot_AimAtPoint
+al 00E50B .PlanBestShot_TargetPointX
+al 00E4F9 .PlanBestShot_TargetPointY
+al 00E4DC .PlanBestShot_FallbackAccept
+al 00E4E6 .PlanBestShot_FallbackNext
+al 00E4C1 .PlanBestShot_FallbackLoop
+al 00E4B9 .PlanBestShot_Fallback
+al 00E4AA .PlanBestShot_Next
+al 00E48D .PlanBestShot_Evaluate
+al 00E473 .PlanBestShot_StoreBall
+al 00E43B .PlanBestShot_Measure
+al 00E47B .PlanBestShot_AdvanceBall
+al 00E429 .PlanBestShot_BallPoint
+al 00E417 .PlanBestShot_ScanLoop
+al 00E415 .PlanBestShot_ScanStart
+al 00E40E .PlanBestShot
+al 00E405 .ComputeDeltaVector_StoreHigh
+al 00E3FB .ComputeDeltaVector_Square
+al 00E3E7 .ComputeDeltaVector_AbsY
+al 00E3CE .ComputeDeltaVector_AbsX
+al 00E3BF .ComputeDeltaVector
+al 00E3BE .UpdateCpuAim_Steer_Done
+al 00E3B1 .UpdateCpuAim_Steer_SetButtons
+al 00E3AB .UpdateCpuAim_Steer_TurnLeft
+al 00E3AF .UpdateCpuAim_Steer_AngleMatch
+al 00E39C .UpdateCpuAim_Steer_LengthKey
+al 00E392 .UpdateCpuAim_Steer_LengthDown
+al 00E39A .UpdateCpuAim_Steer_LengthMatch
+al 00E381 .UpdateCpuAim_Steer
+al 00E37C .UpdateCpuAim_Check
+al 00E370 .UpdateCpuAim
+al 00E367 .TestShootButton_Ready
+al 00E364 .TestShootButton_Fail
+al 00E34A .TestShootButton
+al 00E349 .ReadPlayerButtons_Done
+al 00E341 .ReadPlayerButtons_ReturnToCaller
+al 00E333 .ReadPlayerButtons_CheckPlayer
+al 00E322 .ReadPlayerButtons
+al 00E31D .ResetAimPhase
+al 00E318 .ByteToDecimal3_Units
+al 00E30F .ByteToDecimal3_Tens
+al 00E30D .ByteToDecimal3_AfterHundreds
+al 00E304 .ByteToDecimal3_Hundreds
+al 00E2FE .ByteToDecimal3
+al 00E2DB .DrawTurnMarker_Store
+al 00E2D7 .DrawTurnMarker_Alt
+al 00E2C8 .DrawTurnMarker
+al 00E2BB .DrawShotIcons_Store
+al 00E2B2 .DrawShotIcons_Loop
+al 00E2A2 .DrawShotIcons
+al 00E286 .PrintMenuPower
+al 00E275 .PrintBallCount_Blank
+al 00E270 .PrintBallCount_Value
+al 00E25C .PrintBallCount
+al 00E24F .PrintRate
+al 00E240 .PrintTwoDigitValue_Units
+al 00E22F .PrintTwoDigitValue
+al 00E22D .PrintTwoDigitValue_Stage
+al 00E225 .PrintStageNumberTop
+al 00E21A .PrintStageNumber
+al 00E215 .PrintHiScore_Source
+al 00E20D .PrintHiScoreHud
+al 00E202 .PrintHiScoreMenu
+al 00E1F2 .PrintMenuPlayerScore
+al 00E1ED .PrintPlayer2Score_Source
+al 00E1BB .PrintScoreDigits_Loop
+al 00E1AE .PrintScoreDigits
+al 00E1AC .PrintPlayer1Score_Source
+al 00E1E5 .PrintPlayer2Score
+al 00E1A4 .PrintPlayer1Score
+al 00E19D .PrintCurrentPlayerScore
+al 00E194 .UpdateAimInput_PowerBar_Next
+al 00E17C .UpdateAimInput_PowerBar_Fill
+al 00E171 .UpdateAimInput_PowerBar_Loop
+al 00E162 .UpdateAimInput_PowerBar
+al 00E15D .UpdateAimInput_ClampTop
+al 00E147 .UpdateAimInput_RescaleY
+al 00E145 .UpdateAimInput_ClampBottom
+al 00E14E .UpdateAimInput_NegY
+al 00E118 .UpdateAimInput_TraceY
+al 00E113 .UpdateAimInput_ClampLeft
+al 00E0E7 .UpdateAimInput_Rescale
+al 00E0E3 .UpdateAimInput_RescaleX
+al 00E0FE .UpdateAimInput_StoreEndX
+al 00E0E1 .UpdateAimInput_ClampRight
+al 00E104 .UpdateAimInput_NegX
+al 00E0BA .UpdateAimInput_Trace
+al 00E0B1 .UpdateAimInput_StoreLength
+al 00E0A4 .UpdateAimInput_LengthDown
+al 00E089 .UpdateAimInput_PowerMeterBounce
+al 00E094 .UpdateAimInput_LengthUp
+al 00E079 .UpdateAimInput_PowerMeterDown
+al 00E055 .UpdateAimInput_AimRight
+al 00E062 .UpdateAimInput_PowerMeter
+al 00E048 .UpdateAimInput_AimLeft
+al 00E040 .UpdateAimInput_RepeatDelay
+al 00E02F .UpdateAimInput_RepeatStart
+al 00E01E .UpdateAimInput
+al 00D559 .LayoutData
+al 00D536 .ComputeStageLayoutAddress
+al 00D4FA .LayoutScriptTable
+al 00D4ED .SelectLayoutScript_Index
+al 00D4E4 .SelectLayoutScript
+al 00D4CC .ReadStageLayoutId
+al 00D4C4 .ClassifyLayoutTile_Bits
+al 00D4BD .ClassifyLayoutTile_Mid
+al 00D4B6 .ClassifyLayoutTile_High
+al 00D4AF .ClassifyLayoutTile
+al 00D4AD .GetConnectionIndex_Result
+al 00D48F .GetConnectionIndex
+al 00D488 .PlaceLayoutTile_Neighbour_Clear
+al 00D487 .PlaceLayoutTile_Neighbour_Skip
+al 00D45E .PlaceLayoutTile_Neighbour_Compose
+al 00D444 .PlaceLayoutTile_Neighbour_Pick
+al 00D449 .PlaceLayoutTile_Neighbour_Blend
+al 00D45D .PlaceLayoutTile_Neighbour_Return
+al 00D41F .PlaceLayoutTile_Neighbour
+al 00D405 .PlaceLayoutTile_Cell
+al 00D400 .PlaceLayoutTile_Row
+al 00D3E5 .PlaceLayoutTile_Simple
+al 00D41E .PlaceLayoutTile_Done
+al 00D3D3 .PlaceLayoutTile
+al 00D3CB .DrawPocketCorner_RemapC7
+al 00D3BF .DrawPocketCorner_RemapC6
+al 00D3B3 .DrawPocketCorner_RemapC5
+al 00D3A0 .DrawPocketCorner_Remap
+al 00D39F .DrawPocketCorner_Return
+al 00D392 .DrawPocketCorner
+al 00D384 .DefinePockets_Next
+al 00D325 .DefinePockets
+al 00D31B .DrawCellGrid_NextColumn
+al 00D317 .DrawCellGrid_TileNext
+al 00D30D .DrawCellGrid_TileCell
+al 00D2DF .DrawCellGrid_AttrLoop
+al 00D300 .DrawCellGrid_TileRow
+al 00D2D4 .DrawCellGrid
+al 00D2A0 .RunCellCommandList
+al 00D29C .RemapTileIndex_Found
+al 00D291 .RemapTileIndex_Loop
+al 00D28F .RemapTileIndex
+al 00D22C .FixIsolatedCells_Fix
+al 00D222 .FixIsolatedCells_Next
+al 00D212 .FixIsolatedCells_Loop
+al 00D20A .FixIsolatedCells
+al 00D1FB .UploadFieldMap_Store
+al 00D1F5 .UploadFieldMap_Found
+al 00D1EB .UploadFieldMap_HighNibbleSearch
+al 00D1E8 .UploadFieldMap_HighNibble
+al 00D1DA .UploadFieldMap_LowNibble
+al 00D1CC .UploadFieldMap_Loop
+al 00D1BB .UploadFieldMap
+al 00D1BA .PlaceFieldTile_Done
+al 00D197 .PlaceFieldTile_NorthEdge
+al 00D174 .PlaceFieldTile_WestEdge
+al 00D151 .PlaceFieldTile_SouthEdge
+al 00D129 .PlaceFieldTile_KeepTile
+al 00D12C .PlaceFieldTile_Store
+al 00D0F3 .PlaceFieldTile
+al 00D0E4 .DrawCellRun_Vertical
+al 00D0D5 .DrawCellRun_Horizontal
+al 00D073 .DrawCellRun_Block2x2
+al 00D088 .DrawCellRun_Corner2x2
+al 00D057 .DrawCellRun_TileTable
+al 00D0C3 .DrawCellRun_DiagonalAlt
+al 00D0B1 .DrawCellRun_Diagonal
+al 00D047 .DrawCellRun_SetTile
+al 00D03D .DrawCellRun_PickTile
+al 00D05B .DrawCellRun_TileFromBit
+al 00D02D .DrawCellRun_Kind40
+al 00D026 .DrawCellRun_Kind20
+al 00D017 .DrawCellRun
+al 00D00D .RunSceneScript_Advance
+al 00D004 .RunSceneScript_Next
+al 00CFE5 .RunSceneScript
+al 00CFDE .RunCommandList_Done
+al 00CFA6 .RunCommandList_Loop
+al 00CF9B .RunCommandList
+al 00CF87 .LoadScene_Done
+al 00CF70 .LoadScene_CheckVsMode
+al 00CF40 .VsCommandList
+al 00CF15 .DrawLayoutRows_Cell
+al 00CF10 .DrawLayoutRows
+al 00CEEE .ClearFieldMap
+al 00CE9E .UploadFieldRows
+al 00CE55 .FillFieldEmpty
+al 00CE35 .LoadScene
+al 00CE25 .WritePpuDataAtTemp
+al 00CE14 .ReadPpuDataAtSrc
+al 00CDF4 .PrintTextToNametable_Char
+al 00CDE4 .PrintTextToNametable_RowStart
+al 00CE09 .PrintTextToNametable_NextRow
+al 00CDDA .PrintTextToNametable_Row
+al 00CDD3 .PrintTextToNametable
+al 00CDB9 .MixChecksum
+al 00CDAE .UploadAttributeShadow_Loop
+al 00CD9D .UploadAttributeShadow
+al 00CD73 .SetAttributeCell_Align
+al 00CD7E .SetAttributeCell_Store
+al 00CD65 .SetAttributeCell
+al 00CD5F .GetAttributeCell_Read
+al 00CD58 .GetAttributeCell_Column
+al 00CD3C .GetAttributeCell
+al 00CD1C .ReadControllers_Loop
+al 00CD0E .ReadControllers
+al 00CCF3 .FlushPaletteToPpu_Loop
+al 00CCD9 .DrainVramQueue_ReadLoop
+al 00CCE5 .FlushPaletteToPpu
+al 00CCA9 .DrainVramQueue_CopyLoop
+al 00CCBA .DrainVramQueue_NextSlot
+al 00CC91 .DrainVramQueue_Slot
+al 00CC8F .DrainVramQueue
+al 00CC7D .ResetVramQueue_Loop
+al 00CC7B .ResetVramQueue
+al 00CC49 .QueueVramByte_Store
+al 00CC5E .QueueVramByte_NewSlot
+al 00CC2E .QueueVramByte_WaitSpace
+al 00CC29 .QueueVramByte
+al 00CC12 .BeginVramWrite_Alloc
+al 00CC05 .BeginVramWrite_FindSlot
+al 00CBFD .BeginVramWrite_WaitSpace
+al 00CBFB .BeginVramWrite
+al 00CBF4 .PrintInlineString_Done
+al 00CBE5 .PrintInlineString_Loop
+al 00CBDC .PrintInlineString
+al 00CBC9 .PrintInlineStringToVram
+al 00CBC8 .WriteStringToPpuData_Done
+al 00CBB9 .WriteStringToPpuData
+al 00CBB2 .FillOamOffscreen_Loop
+al 00CBAE .FillOamOffscreen
+al 00CBA9 .SetPpuAddrFromXY
+al 00CB92 .SwapPpuAddrAndPtr
+al 00CB82 .CopyFromVram_Loop
+al 00CB7F .CopyFromVram
+al 00CB6F .CopyToVram_Loop
+al 00CB69 .CopyToVram
+al 00CB66 .IncCount16_Hi
+al 00CB61 .IncCount16
+al 00CB5F .IncPpuAddr
+al 00CB5A .IncPtr
+al 00CB4F .DecCount16_Return
+al 00CB50 .DecCount16_Borrow
+al 00CB45 .DecCount16
+al 00CB39 .DecPpuSrcCount
+al 00CB30 .FillVramByte_Loop
+al 00CB2B .FillVramByte
+al 00CB25 .TriggerOamDma
+al 00CB1D .SetPpuCtrlAndMask
+al 00CAF7 .ComputeTileAddress
+al 00CABD .WritePpuData
+al 00CAB9 .ReadPpuData
+al 00CAAE .ReadVramByte
+al 00CAA3 .WritePpuAddr
+al 00CA8F .SetNtBaseFromA
+al 00CA86 .UpdateNtBaseFromPpuCtrl_Base0
+al 00CA77 .UpdateNtBaseFromPpuCtrl
+al 00CA6F .SetNtSelectBit
+al 00CA60 .SetNtBase2000
+al 00CA52 .WritePpuCtrlAndResetScroll
+al 00CA48 .EnableNmi
+al 00CA42 .EnableNmiAndRendering
+al 00CA3C .WritePpuCtrl
+al 00CA38 .DisableNmi
+al 00CA2E .EnableRendering
+al 00CA21 .DisableRendering
+al 00C559 .SpriteAnimationTable
+al 00C552 .AnimationPointerTable
+al 00C543 .StateTimerTable
+al 00C522 .SpawnObjectTable
+al 00C47A .ObjectStatePointerTable
+al 00C475 .SpawnObject_NextSlot
+al 00C445 .SpawnObject_CopyField
+al 00C471 .SpawnObject_EndRecord
+al 00C429 .SpawnObject_SlotLoop
+al 00C415 .SpawnObject_Return
+al 00C416 .SpawnObject_Create
+al 00C409 .SpawnObject_JumpTable
+al 00C404 .SpawnObject
+al 00C401 .AdvanceScriptPtr_HiCarry
+al 00C3FC .AdvanceScriptPtr
+al 00C3F5 .ResetGameState
+al 00C3F0 .QueueSpawnRequest_Done
+al 00C3EB .QueueSpawnRequest_NextSlot
+al 00C3E0 .QueueSpawnRequest_FindSlot
+al 00C3DA .QueueSpawnRequest
+al 00C3C7 .ClearGameState_LoopArrays
+al 00C3BE .ClearGameState_LoopByte
+al 00C3BC .ClearGameState
+al 00C3B4 .SoundChannelMask
+al 00C3AE .UpdateObjectSound_CheckVolume
+al 00C392 .UpdateObjectSound_EnableChannel
+al 00C38A .UpdateObjectSound_UseVolume
+al 00C39F .UpdateObjectSound_Sustain
+al 00C331 .UpdateObjectSound_Return
+al 00C332 .UpdateObjectSound_Emit
+al 00C321 .UpdateObjectSound_Silence
+al 00C32A .UpdateObjectSound_Check
+al 00C314 .UpdateObjectSound
+al 00C304 .AdvanceAnimFrame_ReadCount
+al 00C2FE .AdvanceAnimFrame_Restart
+al 00C2EC .AdvanceAnimFrame_Relative
+al 00C306 .AdvanceAnimFrame_Commit
+al 00C2CB .AdvanceAnimFrame_Next
+al 00C2CA .AdvanceAnimFrame_Return
+al 00C2BB .AdvanceAnimFrame
+al 00C2B8 .DecodeAnimOffset_Literal
+al 00C2AD .DecodeAnimOffset_Restart
+al 00C29E .DecodeAnimOffset_Relative
+al 00C294 .DecodeAnimOffset_Back
+al 00C28D .DecodeAnimOffset
+al 00C275 .BuildObjectSprite_ClampY
+al 00C286 .BuildObjectSprite_NoAnim
+al 00C22F .BuildObjectSprite
+al 00C21C .SetObjPtr_FromStateTable
+al 00C20C .SetObjPtr_NonZero
+al 00C205 .SetObjPtr
+al 00C200 .AdvanceScriptPtrKeepA
+al 00C1DA .EnterObjectState
+al 00C1D5 .SetObjectState_Store
+al 00C1D1 .SetObjectState_Table
+al 00C1C0 .SetObjectState_Resolve
+al 00C1A2 .ObjOp_LowOpcode
+al 00C18D .SetStateFromOpcode
+al 00C18B .ObjOp8F_StateFromScriptPtr
+al 00C185 .ObjOp8A_SpawnFromScript
+al 00C175 .ObjOp8E_SkipTwoBytes
+al 00C16F .ObjOp86_SetFlags
+al 00C166 .ObjOp89_StoreNibble
+al 00C15E .ObjOp89_ClampNibble
+al 00C14A .ObjOp89_SetFlagsNibble
+al 00C13D .ComputeRecordIndex
+al 00C12B .ObjOp8C_SetRecordByte
+al 00C125 .ObjOp84_StoreSpeed
+al 00C11F .ObjOp_AddSpeed
+al 00C119 .ObjOp87_SetAnimSelector
+al 00C113 .ObjOp83_SetSoundParam
+al 00C109 .ObjOp82_StopScript
+al 00C0F2 .ObjOp81_Loop
+al 00C0E6 .ObjOp80_SetScriptPtr
+al 00C0C0 .ObjectOpcodeHandlerTable
+al 00C0A9 .DispatchObjectScript_Table
+al 00C0A1 .DispatchObjectScript_High
+al 00C092 .DispatchObjectScript
+al 00C08F .NextScriptOpcode
+al 00C082 .ResumeObjectScript
+al 00C07C .FlushSoundRegisters_Next
+al 00C072 .FlushSoundRegisters_Loop
+al 00C06A .FlushSoundRegisters
+al 00C05C .UpdateObjects_Render_Sound
+al 00C054 .UpdateObjects_Render
+al 00C05F .UpdateObjects_Next
+al 00C02E .UpdateObjects
+al 00C024 .ClearObjectWork_Loop
+al 00C01B .DrainSpawnQueue_Next
+al 00C00C .DrainSpawnQueue_Loop
+al 00C00A .DrainSpawnQueue
+al 00C003 .RunObjectFrame
+al 00C000 .ResetStub
@@ -0,0 +1,32 @@
+Modules list:
+-------------
+header.o:
+    HEADER            Offs=000000  Size=000010  Align=00001  Fill=0000
+prg.o:
+    PRG               Offs=000000  Size=004000  Align=00001  Fill=0000
+chr.o:
+    CHR               Offs=000000  Size=002000  Align=00001  Fill=0000
+
+
+Segment list:
+-------------
+Name                   Start     End    Size  Align
+----------------------------------------------------
+CHR                   000000  001FFF  002000  00001
+HEADER                000000  00000F  000010  00001
+PRG                   00C000  00FFFF  004000  00001
+
+
+Exports list by name:
+---------------------
+
+
+
+Exports list by value:
+----------------------
+
+
+
+Imports list:
+-------------
+
@@ -0,0 +1 @@
+../Lunar Pool (U).nes
@@ -0,0 +1,108 @@
+; =============================================================================
+; Nintendo Entertainment System hardware symbols
+; =============================================================================
+
+; -----------------------------------------------------------------------------
+; PPU registers
+; -----------------------------------------------------------------------------
+
+PPUCTRL             = $2000
+PPUMASK             = $2001
+PPUSTATUS           = $2002
+OAMADDR             = $2003
+OAMDATA             = $2004
+PPUSCROLL           = $2005
+PPUADDR             = $2006
+PPUDATA             = $2007
+
+OAMDMA              = $4014
+
+; -----------------------------------------------------------------------------
+; Controller ports
+;
+; $4016:
+;   Write: controller strobe
+;   Read:  controller port 1
+;
+; $4017:
+;   Read:  controller port 2
+;   Write: APU frame counter
+; -----------------------------------------------------------------------------
+
+JOY1                = $4016
+JOY2                = $4017
+
+; -----------------------------------------------------------------------------
+; APU pulse channel 1
+; -----------------------------------------------------------------------------
+
+APUPULSE1CTRL       = $4000
+APUPULSE1SWEEP      = $4001
+APUPULSE1TIMERLO    = $4002
+APUPULSE1TIMERHI    = $4003
+
+; -----------------------------------------------------------------------------
+; APU pulse channel 2
+; -----------------------------------------------------------------------------
+
+APUPULSE2CTRL       = $4004
+APUPULSE2SWEEP      = $4005
+APUPULSE2TIMERLO    = $4006
+APUPULSE2TIMERHI    = $4007
+
+; -----------------------------------------------------------------------------
+; APU triangle channel
+; -----------------------------------------------------------------------------
+
+APUTRIANGLECTRL     = $4008
+APUTRIANGLETIMERLO  = $400A
+APUTRIANGLETIMERHI  = $400B
+
+; -----------------------------------------------------------------------------
+; APU noise channel
+; -----------------------------------------------------------------------------
+
+APUNOISECTRL        = $400C
+APUNOISEPERIOD      = $400E
+APUNOISELENGTH      = $400F
+
+; -----------------------------------------------------------------------------
+; APU DMC channel
+; -----------------------------------------------------------------------------
+
+APUDMCCTRL          = $4010
+APUDMCDIRECT        = $4011
+APUDMCADDR          = $4012
+APUDMCLENGTH        = $4013
+
+; -----------------------------------------------------------------------------
+; APU status and frame counter
+;
+; $4015:
+;   Write: enable or disable the five APU channels
+;   Read:  channel and interrupt status
+;
+; $4017:
+;   Write: APU frame-counter mode and IRQ inhibit
+;   Read:  controller port 2
+; -----------------------------------------------------------------------------
+
+APUSTATUS           = $4015
+APUFRAMECOUNTER     = $4017
+
+; -----------------------------------------------------------------------------
+; Controller masks
+; -----------------------------------------------------------------------------
+
+PAD_RIGHT           = $01
+PAD_LEFT            = $02
+PAD_DOWN            = $04
+PAD_UP              = $08
+PAD_START           = $10
+PAD_SELECT          = $20
+PAD_B               = $40
+PAD_A               = $80
+
+PAD_HORIZONTAL      = PAD_LEFT | PAD_RIGHT
+PAD_VERTICAL        = PAD_UP | PAD_DOWN
+PAD_DPAD            = PAD_HORIZONTAL | PAD_VERTICAL