CDL re-trace: 1942 (JU) 46.6%, Galaga (U) 32.3% (Pass 2/3 complete)

Pass 3 _wip: semantic ZP aliases for Sqoon (U) (FrameCounter, PpuCtrlShadow, NmiFrameFlag) and Elevator Action (U) (PpuCtrlShadow, NmiSaveA/X/Y)
Pass 3 Slalom (U): semantic ZP aliases (PpuCtrlShadow, PpuMaskShadow)
Pass 3 Kung Fu (U): semantic ZP alias (PpuCtrlShadow)
Pass 3 Othello (U): semantic ZP alias (PpuCtrlShadow)
Pass 3 1942 (JU): semantic ZP alias (PpuCtrlShadow)
Pass 3 Galaga (U): semantic ZP aliases (PpuCtrlShadow, PpuMaskShadow)
Docs: add power-on flow + data-table inventory to READMEs of 13 promoted NROM projects
Pass 3 Elevator Action (U): add NmiFrameFlag alias
Pass 3 Elevator Action (U): full ZP naming (23 aliases) + 25 named data tables, 59.4% coverage
Pass 1/2/3 re-trace: recover unreached code in 7 NROM projects (Sqoon 56.4%, Elevator Action 59.3%, Kung Fu 52.1%, 1942 52.1%)
Pass 3 Sqoon (U): full ZP naming (22 aliases) + 17 named data tables
Pass 3 Kung Fu (U): full ZP naming (21 aliases) + 13 named data tables
Pass 3 Othello (U): full ZP naming (18 aliases) + 27 named data tables
Pass 3 1942 (JU): full ZP naming (14 aliases) + 19 named data tables
Pass 3 Galaga (U): full ZP naming (15 aliases) + 14 named data tables
Pass 3 Slalom (U): full ZP naming (16 aliases) + 16 named data tables
Pass 2/3: re-apply naming to Slalom (U), Othello (U), Galaga (U) after re-seed
Pass 1/2/3 re-trace: recover unreached code in 6 more promoted NROM projects
Pass 3 Stack-Up (JU): full ZP naming (15 aliases) + 12 named data tables
Pass 3 Tag Team Wrestling (U): full ZP naming (20 aliases) + 11 named data tables
Pass 3 Kung Fu (U) (a1): full ZP naming (20 aliases) + 12 named data tables
Pass 3 Magmax (U): full ZP naming (18 aliases) + 6 named data tables
Pass 3 Soccer (JU): full ZP naming (18 aliases) + 9 named data tables
Pass 3 Ms Pac-Man (Namco) (U): full ZP naming (18 aliases) + 8 named data tables
Docs: refresh coverage numbers and data-table inventories for 13 promoted NROM projects

NROM/Kung Fu (U)/README.md

@@ -2,66 +2,71 @@
 
 ## Status
 
-**Pass 3.** Hardware-register operands use `symbols.inc` names
-(`apply_symbols.py`: 0 unexplained residue); zero-page slots keep their
-documented `ZpXX` names with ref counts in `locals.inc`; data tables remain
-classified with ROM provenance. `make` stays byte-identical.
-
-`make` assembles `header.s`, `prg.s`, `chr.s`, links them with `ld65` and compares the
-result against `rom.nes`:
-
-```
-Byte-identical ROM verified.
-```
+**Pass 3 complete; promoted.** `prg.s` is a traced disassembly with all
+address-derived labels replaced, all `jsr`/`jmp` operands symbolic, hardware
+registers named via `symbols.inc`, and `apply_symbols.py` reporting 0 residue.
+Code coverage: 17,068 / 32,768 bytes (52.1%).
+`make` assembles and verifies byte-identical to `rom.nes`.
 
 ## ROM
 
 | Property | Value |
 |----------|-------|
 | Format | iNES |
-| Mapper | 0 |
-| Board | NROM-256 |
+| Mapper | 0 (NROM) |
+| PRG | 32 KB |
+| CHR | 8 KB |
 | Mirroring | Vertical |
-| Four-screen VRAM | no |
-| Battery | no |
-| PRG | 32 KB (2 x 16 KB), mapped at CPU $8000-$FFFF |
-| CHR | 8 KB (1 x 8 KB) |
-| Trainer | none |
-| Footer | none |
 | NMI vector | $82D6 |
 | RESET vector | $8258 |
 | IRQ vector | $FFF0 |
-| ROM file | `Kung Fu (U).nes` |
-| SHA-256 | `ba57badd19db565481c5d9d7f86bfa0a919725a9661144d69925f501c9a0f4a1` |
 
-### Header notes
+## Power-on flow
 
-- none
+RESET enters at `$8258`:
 
-## Open work
+    sei                            ; CPU:$8258 PRG:0258  78
+    cld                            ; CPU:$8259 PRG:0259  D8
+    lda #$00                       ; CPU:$825A PRG:025A  A9 00
+    sta PPUCTRL                    ; CPU:$825C PRG:025C  8D 00 20
+    ldx #$FF                       ; CPU:$825F PRG:025F  A2 FF
+    txs                            ; CPU:$8261 PRG:0261  9A
+    lda PPUSTATUS                  ; CPU:$8262 PRG:0262  AD 02 20
+    asl a                          ; CPU:$8265 PRG:0265  0A
+    bcc Reset_OnCarryClear         ; CPU:$8266 PRG:0266  90 FA
+    lda PPUSTATUS                  ; CPU:$8268 PRG:0268  AD 02 20
+    asl a                          ; CPU:$826B PRG:026B  0A
+    bcc Reset_OnCarryClear2        ; CPU:$826C PRG:026C  90 FA
 
-- **Pass 1** - run `nesdis.py` over `prg.bin` to produce the code/data
-  split. The tracer reads the vectors from the last six bytes of the PRG
-  image, so the split seeds correctly.
-- **Pass 1** must emit the canonical audit comment
-  `; CPU:$C123 PRG:0123  AD 21 03` at column 35 for every instruction.
-- **Pass 2** - replace the address-derived `Label_XXXX` names and the raw
-  `$XXXX` call operands.
-- **Pass 3** - semantic zero-page aliases (applied only at the sites where
-  their role is proven) and named data tables.
-- **Promotion** to `NROM/<name>/` once Pass 3 is done, as `git mv`.
+NMI handler at `$82D6`:
 
-## Files
+    lda Zp10                       ; CPU:$82D6 PRG:02D6  A5 10
+    and #$7F                       ; CPU:$82D8 PRG:02D8  29 7F
+    sta PPUCTRL                    ; CPU:$82DA PRG:02DA  8D 00 20
+    sta Zp10                       ; CPU:$82DD PRG:02DD  85 10
+    lda #$00                       ; CPU:$82DF PRG:02DF  A9 00
+    sta PPUMASK                    ; CPU:$82E1 PRG:02E1  8D 01 20
+    lda #$00                       ; CPU:$82E4 PRG:02E4  A9 00
+    sta OAMADDR                    ; CPU:$82E6 PRG:02E6  8D 03 20
 
-| File | Purpose |
-|------|---------|
-| `prg.s` | Pass 0 PRG include (replaced by the Pass 1 disassembly) |
-| `header.s` | iNES header include |
-| `chr.s` | CHR include |
-| `prg.bin` | 32768 bytes (32 KB) PRG image |
-| `chr.bin` | 8192 bytes (8 KB) CHR image |
-| `rom.nes` | byte-identical copy of the original ROM |
-| `linker.cfg` | HEADER / PRG / CHR memory areas |
-| `symbols.inc` | NES hardware register names |
-| `locals.inc` | zero-page aliases (empty at Pass 0) |
-| `Makefile` | build and byte-identity check |
+## Data-table inventory (Pass 3)
+
+- `$8000-$8257` (600 bytes) - `LevelHandlerPointerTable`
+- `$841B-$8426` (12 bytes) - `LevelObjectDefinitionTable`
+- `$8C8A-$8DCE` (325 bytes) - `SpriteOamEntryTable`
+- `$9032-$9807` (2006 bytes) - `EnemyNameTextTable`
+- `$9810-$A481` (3186 bytes) - `EnemySpritePatternTable`
+- `$B6CD-$B713` (71 bytes) - `LevelObjectSpawnTable`
+- `$BB6F-$BDC3` (597 bytes) - `SpriteOamAttributeTable`
+- `$CDDD-$CFCB` (495 bytes) - `EnemyAnimationFrameTable`
+- `$D386-$D3C5` (64 bytes) - `LevelSceneryData`
+- `$DAE7-$DAE9` (3 bytes) - `LevelSceneryPadding`
+- `$DB48-$F830` (7401 bytes) - `LevelGraphicData`
+- `$F981-$F9B8` (56 bytes) - `EnemyMovementSpeedTable`
+- `$FA36-$FA89` (84 bytes) - `EnemyMovementDeltaTable`
+
+## Build
+
+```
+Byte-identical ROM verified.
+```