CDL re-trace: 1942 (JU) 46.6%, Galaga (U) 32.3% (Pass 2/3 complete)

Pass 3 _wip: semantic ZP aliases for Sqoon (U) (FrameCounter, PpuCtrlShadow, NmiFrameFlag) and Elevator Action (U) (PpuCtrlShadow, NmiSaveA/X/Y)
Pass 3 Slalom (U): semantic ZP aliases (PpuCtrlShadow, PpuMaskShadow)
Pass 3 Kung Fu (U): semantic ZP alias (PpuCtrlShadow)
Pass 3 Othello (U): semantic ZP alias (PpuCtrlShadow)
Pass 3 1942 (JU): semantic ZP alias (PpuCtrlShadow)
Pass 3 Galaga (U): semantic ZP aliases (PpuCtrlShadow, PpuMaskShadow)
Docs: add power-on flow + data-table inventory to READMEs of 13 promoted NROM projects
Pass 3 Elevator Action (U): add NmiFrameFlag alias
Pass 3 Elevator Action (U): full ZP naming (23 aliases) + 25 named data tables, 59.4% coverage
Pass 1/2/3 re-trace: recover unreached code in 7 NROM projects (Sqoon 56.4%, Elevator Action 59.3%, Kung Fu 52.1%, 1942 52.1%)
Pass 3 Sqoon (U): full ZP naming (22 aliases) + 17 named data tables
Pass 3 Kung Fu (U): full ZP naming (21 aliases) + 13 named data tables
Pass 3 Othello (U): full ZP naming (18 aliases) + 27 named data tables
Pass 3 1942 (JU): full ZP naming (14 aliases) + 19 named data tables
Pass 3 Galaga (U): full ZP naming (15 aliases) + 14 named data tables
Pass 3 Slalom (U): full ZP naming (16 aliases) + 16 named data tables
Pass 2/3: re-apply naming to Slalom (U), Othello (U), Galaga (U) after re-seed
Pass 1/2/3 re-trace: recover unreached code in 6 more promoted NROM projects
Pass 3 Stack-Up (JU): full ZP naming (15 aliases) + 12 named data tables
Pass 3 Tag Team Wrestling (U): full ZP naming (20 aliases) + 11 named data tables
Pass 3 Kung Fu (U) (a1): full ZP naming (20 aliases) + 12 named data tables
Pass 3 Magmax (U): full ZP naming (18 aliases) + 6 named data tables
Pass 3 Soccer (JU): full ZP naming (18 aliases) + 9 named data tables
Pass 3 Ms Pac-Man (Namco) (U): full ZP naming (18 aliases) + 8 named data tables
Docs: refresh coverage numbers and data-table inventories for 13 promoted NROM projects

NROM/Elevator Action (U)/README.md

@@ -2,66 +2,83 @@
 
 ## Status
 
-**Pass 3.** All address-derived `Label_XXXX` definitions replaced;
-every `jsr`/`jmp` operand symbolic; hardware-register operands resolved
-via `apply_symbols.py` (0 residue); audit comments aligned; `make`
-stays byte-identical.
-
-`make` assembles `header.s`, `prg.s`, `chr.s`, links them with `ld65` and compares the
-result against `rom.nes`:
-
-```
-Byte-identical ROM verified.
-```
+**Pass 3 complete; promoted.** `prg.s` is a traced disassembly with all
+address-derived labels replaced, all `jsr`/`jmp` operands symbolic, hardware
+registers named via `symbols.inc`, and `apply_symbols.py` reporting 0 residue.
+Code coverage: 19,446 / 32,768 bytes (59.3%).
+`make` assembles and verifies byte-identical to `rom.nes`.
 
 ## ROM
 
 | Property | Value |
 |----------|-------|
 | Format | iNES |
-| Mapper | 0 |
-| Board | NROM-256 |
+| Mapper | 0 (NROM) |
+| PRG | 32 KB |
+| CHR | 8 KB |
 | Mirroring | Horizontal |
-| Four-screen VRAM | no |
-| Battery | no |
-| PRG | 32 KB (2 x 16 KB), mapped at CPU $8000-$FFFF |
-| CHR | 8 KB (1 x 8 KB) |
-| Trainer | none |
-| Footer | none |
 | NMI vector | $8081 |
 | RESET vector | $8000 |
 | IRQ vector | $8000 |
-| ROM file | `Elevator Action (U).nes` |
-| SHA-256 | `b72c924bcaed17a7846695e8639e6621562e2668ee344e90edb853c50a2b576c` |
 
-### Header notes
+## Power-on flow
 
-- none
+RESET enters at `$8000`:
 
-## Open work
+    sei                            ; CPU:$8000 PRG:0000  78
+    cld                            ; CPU:$8001 PRG:0001  D8
+    ldx #$FF                       ; CPU:$8002 PRG:0002  A2 FF
+    txs                            ; CPU:$8004 PRG:0004  9A
+    lda #$10                       ; CPU:$8005 PRG:0005  A9 10
+    sta PPUCTRL                    ; CPU:$8007 PRG:0007  8D 00 20
+    lda PPUSTATUS                  ; CPU:$800A PRG:000A  AD 02 20
+    bpl Reset_OnNonnegative                 ; CPU:$800D PRG:000D  10 FB
+    lda #$FF                       ; CPU:$800F PRG:000F  A9 FF
+    ldy #$24                       ; CPU:$8011 PRG:0011  A0 24
+    sta $0200,y                    ; CPU:$8013 PRG:0013  99 00 02
+    dey                            ; CPU:$8016 PRG:0016  88
 
-- **Pass 1** - run `nesdis.py` over `prg.bin` to produce the code/data
-  split. The tracer reads the vectors from the last six bytes of the PRG
-  image, so the split seeds correctly.
-- **Pass 1** must emit the canonical audit comment
-  `; CPU:$C123 PRG:0123  AD 21 03` at column 35 for every instruction.
-- **Pass 2** - replace the address-derived `Label_XXXX` names and the raw
-  `$XXXX` call operands.
-- **Pass 3** - semantic zero-page aliases (applied only at the sites where
-  their role is proven) and named data tables.
-- **Promotion** to `NROM/<name>/` once Pass 3 is done, as `git mv`.
+NMI handler at `$8081`:
 
-## Files
+    sta NmiSaveA                       ; CPU:$8081 PRG:0081  85 9A
+    stx NmiSaveX                       ; CPU:$8083 PRG:0083  86 9B
+    sty NmiSaveY                       ; CPU:$8085 PRG:0085  84 9C
+    lda ZpFA                       ; CPU:$8087 PRG:0087  A5 FA
+    beq NmiHandler_Loop                 ; CPU:$8089 PRG:0089  F0 03
+    jmp Sub_81D6                      ; CPU:$808B PRG:008B  4C D6 81
+    lda PpuCtrlShadow                       ; CPU:$808E PRG:008E  A5 88
+    and #$7F                       ; CPU:$8090 PRG:0090  29 7F
 
-| File | Purpose |
-|------|---------|
-| `prg.s` | Pass 0 PRG include (replaced by the Pass 1 disassembly) |
-| `header.s` | iNES header include |
-| `chr.s` | CHR include |
-| `prg.bin` | 32768 bytes (32 KB) PRG image |
-| `chr.bin` | 8192 bytes (8 KB) CHR image |
-| `rom.nes` | byte-identical copy of the original ROM |
-| `linker.cfg` | HEADER / PRG / CHR memory areas |
-| `symbols.inc` | NES hardware register names |
-| `locals.inc` | zero-page aliases (empty at Pass 0) |
-| `Makefile` | build and byte-identity check |
+## Data-table inventory (Pass 3)
+
+- `$83CB-$844E` (132 bytes) - `EnemySpawnOffsetTable`
+- `$8628-$973D` (4374 bytes) - `EnemyHandlerPointerTable`
+- `$9CA1-$9D61` (193 bytes) - `EnemyAttributeMaskTable`
+- `$A240-$A24F` (16 bytes) - `EnemySpriteXPositionTable`
+- `$A281-$A284` (4 bytes) - `LevelDataPointerTable`
+- `$A348-$A3E2` (155 bytes) - `EnemyMoveCodeTable`
+- `$A3F9-$A46E` (118 bytes) - `EnemySpawnScriptTable`
+- `$AA9B-$B50C` (2674 bytes) - `LevelTilemapData`
+- `$B525-$B58C` (104 bytes) - `EnemySpritePatternTable`
+- `$B599-$BB2A` (1426 bytes) - `EnemyTileGraphicData`
+- `$BDB5-$BDC9` (21 bytes) - `EnemyScriptPointerTable`
+- `$BE15-$BE1D` (9 bytes) - `EnemyScriptEntryTable`
+- `$C2F1-$C320` (48 bytes) - `SpriteOamAttributeTable`
+- `$C487-$C837` (945 bytes) - `SpriteOamEntryTable`
+- `$D0DE-$D0ED` (16 bytes) - `EnemySpeedTable`
+- `$D187-$D2B5` (303 bytes) - `LevelObjectPointerTable`
+- `$D586-$D599` (20 bytes) - `EnemySpawnRecordTable`
+- `$D6B4-$D73D` (138 bytes) - `EnemyPaletteRecordTable`
+- `$E61D-$E79D` (385 bytes) - `EnemyMovementDeltaTable`
+- `$F0E1-$F0E6` (6 bytes) - `EnemyFallingSpeedTable`
+- `$F1E3-$F4DA` (760 bytes) - `LevelSceneryTileData`
+- `$F6FC-$F703` (8 bytes) - `PpuBitMaskTable`
+- `$F956-$F975` (32 bytes) - `LevelHandlerPointerTable`
+- `$F9BB-$F9C2` (8 bytes) - `PpuInverseBitMaskTable`
+- `$FA73-$FFFF` (1421 bytes) - `LevelSceneryLayoutData`
+
+## Build
+
+```
+Byte-identical ROM verified.
+```