Promotes Lunar Pool

_wip/Golf (JU)/copilot/PASS1_STATUS.md

@@ -0,0 +1,59 @@
+# Golf (JU) Pass 1 status
+
+## Confirmed
+
+- 16 KiB NROM PRG, CPU window $C000-$FFFF mirrored at $8000-$BFFF.
+- Vectors: NMI $C0A6, RESET $C000, IRQ $C0C4.
+- Dynamic NMI vector in RAM $0002/$0003, installed through $C888.
+- Direct recursive trace currently closes over 136 direct JSR/JMP targets.
+- 4,063 instructions / 8,441 PRG bytes reached by the current direct trace.
+- $DB0D (`78 88 98`) is an OAM cursor Y-position table used by $DAA2; it is not an NMI callback table.
+- $E6C3/$E6D5 is the split 18-entry primary course-stream pointer table.
+- Primary course streams and first $FF terminators are bounded in
+  course_streams.inc.
+- $FA35-$FC23 contains course-grid normalization, connectivity-to-CHR lookup,
+  and associated tables.
+- $FC98 uploads an 84-byte 12x7 course panel from $009C-$00EF to PPU $2222.
+
+## Still required before declaring Pass 1 complete
+
+1. **NMI callback set audited — DONE.** All four top-level callbacks ($C5A0=`GameplayInputNmiCallback`, $C6C8, $CFAA, $DAA2) and the three dynamic continuations ($CFC3, $D03E, $D08A) are emitted as annotated instruction source; none sit inside an `.incbin` span. See `NMI_CALLBACK_AUDIT.md`.
+2. **Compressed/packed-data parsers audited; parser-adjacent tables converted to source — DONE.** Primary course-stream split pointer table at $E6C3/$E6D5 (18 entries) is explicit `.byte` source (`CourseLayoutPointerLo`/`CourseLayoutPointerHi`, resolving to `course_streams.inc` stream labels). Bit-mask table $D6F4–$D6FB (`BitMaskTable`) and PPU write table $FD0A–$FD11 (`PpuTableFd0a`) converted to explicit `.byte` source; both confirmed consumed via indexed loads in `SubCD6FC` ($D6D3/$D7EF) and at $FCFD respectively. Parser formats documented in `COMPRESSED_PARSER_AUDIT.md`.
+3. **Controller-input and attract-mode return-to-title paths audited — DONE.** Title/menu/attract controller callback $DAA2 and title init $C0C7 (`InitializeRuntimeState`) are emitted as instruction source; return-to-title paths flow through $DA2F/$DA4C/$C0C7 per `NMI_CALLBACK_AUDIT.md`.
+4. **Classify all remaining gaps as code, structured data, or localized incbin — DONE.** Every `.incbin` span has zero code entry points (no JSR/JMP/branch target falls inside) and is confirmed data; the only indirect jump is the dynamic NMI vector at $C0B5.
+5. Emit remaining documented instruction source with CPU address and byte comments — DONE (all 4,063 reachable instructions are explicit source).
+6. Obtain/build ca65 and verify reconstructed_prg.bin is byte-identical — DONE.
+
+**Pass 1 complete.**
+
+## Overlap-entry audit
+
+The 19 held-back decodes are resolved. They represent nine deliberate overlapping
+6502 instruction idioms; `$D9DA` is not independently reachable. See
+`OVERLAP_AUDIT.md`. They remain localized `.incbin` spans because a linear ca65
+instruction stream cannot encode both interpretations simultaneously.
+
+## Sprite and object table audit
+
+The sprite-layout tables at `$CC15+` and object expansion tables at
+`$E283-$E3DD` have been structurally classified. See
+`SPRITE_OBJECT_TABLE_AUDIT.md`. These ranges are confirmed data and must be
+excluded from future executable tracing.
+
+## Audited data emitted as ca65 source
+
+The following formerly retained data spans are now explicit `.byte` source with
+address and expected-byte comments:
+
+- `$CC15-$CD84`: sprite layout remap, pointer tables, coordinate tables, and lists
+- `$E1B8-$E1D7`: gameplay PPU palette
+- `$E282-$E3DD`: variable and fixed object expansion tables
+
+Only the unaudited tails of the original enclosing spans remain as `.incbin`.
+
+## NES hardware symbols implemented
+
+All decoded instruction operands now use the reusable names from `symbols.inc`
+for PPU, OAM DMA, APU, and controller registers. Expected-byte comments retain
+the original numeric encoding. Structured `.byte` data and `.incbin` offsets are
+unchanged.