Xevious (U): Pass 1 disassembly

The first _wip project to get a real disassembly. 4,165 instructions / 8,444 code bytes (25.8%), 24,324 data bytes, 0 unclassified -- every byte of the 32 KB PRG is now classified as code or data. The split needed three stages, all recorded in prg.s's header: * nesdis.py --undocumented --auto-seed at base $8000 gave 3,272 instructions / 6,555 bytes. The undocumented opcodes matter here: the trace stops dead at the first one it cannot decode. * Four hand-seeded entries ($C08B, $DC1E, $E0D5, $E134). Each is a branch target from decoded code that sat inside an untraced data run, so the tracer never reached it. * A merged four-session Mesen Code Data Logger capture (kept as xevious_mesen.cdl) promoted 1,902 bytes from data to code and demoted 22 the trace had called code. Two tool bugs fell out and are fixed here: * nesdis.py emitted the undocumented single-byte NOPs ($1A/$3A/$5A/ $7A/$DA/$FA) as `nop`, which ca65 assembles as the *official* $EA -- the rebuild stopped being byte-identical at $DF82. The check now keys on the opcode byte, not just the addressing mode. All three `make regen` pipelines (MUSCLE, Pyramid, Urban Champion) are unaffected and still reproduce prg.s byte for byte. * cdl_reclass.py left the original data-block header in place when the CDL split that block, so the file ended up with two region headers describing overlapping spans (20 of them here). The header is now dropped with the block it describes; the promoted projects that use the tool are byte-for-byte unchanged. The project README has the power-on flow analysis. The most interesting find is at $FC45: the reset path compares RAM $0100-$0107 against the ASCII string "Kei Cros", and the copyright text at $FF1E reads "MAIN: KEI CROSS. SOUND: UHOHOY OHNOGI." The OAM is at $0700, not $0200 -- the NMI handler does LDA #$07 / STA $4014. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Add explicit `make wip` / `make wipclean` targets for the _wip tier The root Makefile's all / clean / <MAPPER> targets deliberately name only the promoted mapper folders, so nothing in them reaches into _wip/. Give the pre-promotion tier its own opt-in targets instead of the manual `for d in _wip/*/*/; do make -C "$d"; done` loop: make wip # build + verify every _wip/<MAPPER>/<Project>/ make wipclean # clean the build artifacts in that tier Both the Makefile and the four documents that describe the tier (README, TODO, WIP, AGENTS) are updated together, so the tree stays consistent. The same commit records Xevious (U) reaching Pass 2 in those documents: all 487 labels named, every branch and call symbolic, zero Label_XXXX and zero raw $XXXX operands left. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Update the _wip/ tier documentation; fix the make wip target and the mirroring bug The WIP tier's four documents (WIP.md, README.md, TODO.md, AGENTS.md) had drifted away from the tree. Every number in them was re-derived from the ROMs and the folder layout rather than carried forward. Counts and structure - The tier holds 854 projects across 29 mapper folders, not "856 across 30". Xevious (U) and Zanac (U) were promoted on 2026-10-20 and their _wip/ folders were left behind as residue -- "git mv" moves only the tracked files, so the old folder survived with its build artifacts and a stale README. Both are removed now; the promotion procedure documents the step so it does not recur. - _wip/MAPPER8/ holds a copy of the already-promoted Mermaids of Atlantis (U) and is excluded from every count and table. - Pass 0 skeletons: 852 (was 855). Xevious (U) left the tier, so the two projects with a real disassembly are Golf (JU) and Volleyball (U). - PRG sizes 2 / 150 / 42 / 522 / 127 / 10 / 1; 226 projects with no CHR; 38 keep the CPU-address linker layout; 37 are mapper 0. - Every inventory row was re-checked against its ROM: PRG/CHR size, mirroring, all three vectors, and the battery / four-screen / footer notes. 854 of 854 rows now match. Fixes - The root Makefile used $(WIP) but never defined it, so "make wip" and "make wipclean" expanded to "for m in /*/" -- they walked the filesystem root instead of the tier. "WIP := _wip" is now defined, and "make wip" builds and verifies the whole tier: 855 of 855 passed, 0 failures. - make_skeleton.py masked header byte 6 with 0x03, so the battery bit (bit 1) leaked into the mirroring value and 56 battery-backed ROMs' READMEs claimed "Four-screen" while their own "Four-screen VRAM" row said "no". The mask is now 0x01 and the 56 READMEs are corrected. - Golf (JU)'s README still described the pre-flatten copilot/ folder and the old PRG-only compare; it now describes the whole-ROM build. - Pyramid (U)'s audit comments are canonical again, so Golf (JU) is the only project in the tree still on the pre-canonical spelling. New in WIP.md - Byte 7's lower nybble is non-zero on 58 of the ROMs -- 55 carry the literal "DiskDude!" watermark, two "DisNi0330", one "byKH+KEN". Only the upper nybble carries mapper bits, so the noise is harmless. - The twelve ROMs that set the four-screen bit, split by whether their board actually supports four-screen VRAM. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Promote Volleyball (U) from _wip/NROM/ to NROM/ Volleyball (U) reached Pass 3 before promotion, so this is a promotion of a finished disassembly rather than a Pass 0 skeleton. The disassembly - 11,395 instructions / 23,926 code bytes (73.0 % of the PRG image), 8,842 data bytes, 0 unclassified. - The split needed the game-state dispatch table at $85E1 declared to the tracer (--table 85E1:11) -- without it only 66 % of the image traced -- plus a Mesen Code Data Logger capture taken while a random-input bot played the attract demo, which promoted 1,757 bytes from data to code. - Pass 2 named all 1,989 labels: 730 read out of the code by hand, 1,221 internal branch targets derived mechanically. Zero Label_XXXX, zero raw $XXXX call or branch operands, zero SubC residue. - Pass 3 named the zero page, the $0500 ball structure and all 37 data blocks. apply_symbols.py --report: 0 pending substitutions, 0 multi-alias residue. align_audit_comments.py: no column drift. - cdl_check.py cross-checks the finished prg.s against the capture: 0 CDL-code bytes not covered by an instruction, 0 CDL-data bytes that start one. - 29 neutral ZpXX zero-page slots remain, each with its reason recorded in locals.inc, as the promotion rules allow. The promotion - git mv "_wip/NROM/Volleyball (U)" "NROM/Volleyball (U)". Mapper 0, so it lands in NROM/. The whole-ROM build was already in place, so there was no build surgery; the project builds byte-identically at its new home and the old folder is gone (git mv moves the untracked build artifacts too, so no residue was left behind). - Root README.md: new inventory row 39 and a per-project detail section, plus the WIP-tier counts. The detail sections for Xevious (U) and Zanac (U) were numbered one too high against the inventory rows and are now aligned; a leftover editing note in the same place is gone. - WIP.md: the Volleyball row leaves the inventory, and the tier is now 853 projects across 29 mapper folders (36 in _wip/NROM/), 852 of them Pass 0 skeletons. Golf (JU) is the only project left in the tier with a real disassembly. - TODO.md and AGENTS.md: the same counts, and the promoted tier is now 40 projects (39 under NROM/). Verified: make wip builds and verifies the whole tier (854 of 854 passed, 0 failures) and make builds the promoted tier (39 of 39 passed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Rename NROM/Pyramid (U) to NROM/Pyramid (U) (Sachen) The promoted inventory row had read "Pyramid (U) (Sachen)" since the project was promoted on 2026-10-20, but the folder was named "Pyramid (U)" -- so the row pointed at a folder that did not exist. The folder now matches the row, and the project's own README title, its ROM file name ("Pyramid (U) (Sachen).nes") and the parenthetical convention the rest of the promoted tier already uses (Popeye (JU) (PRG 0/1), Raid on Bungeling Bay (U) [a2], Pac-Man (Tengen) (U)). What changed inside the project - The Makefile's regen target passes --project "Pyramid (U) (Sachen)", so the tracer writes the matching header line. prg.s and locals.inc were updated to that header line and nothing else -- the disassembly is byte-identical to before. - make regen still reproduces prg.s and locals.inc byte for byte. - The project's README's build-verification line now names the new folder. References updated: the root README.md (inventory prose, the row-33 detail section, the build-status table, and the notable-observations bullet), TODO.md (the promoted-projects table and the Pyramid notes) and AGENTS.md (the recently-promoted list and the unlicensed-titles quirk). Verified: make builds the promoted tier (39 of 39 passed) and the project rebuilds byte-identically at its new path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Rebuild Mermaids of Atlantis (U): bank-aware Pass 1, Pass 2/3 names The promoted project did not build: a Pass 2 rename had been applied half-way, leaving eight undefined symbols and two jumps that pointed at the wrong routine, while the root README already claimed the project was byte identical. The _wip copy still built, because it held the un-renamed Pass 1 source. The disassembly is now derived from the ROM itself, with the Mesen Code Data Logger as the oracle for the code/data split: * _tools/banked_dis.py traces every MMC3 bank separately, each with the CPU window it is visible at, seeded from a CDL capture so the code a static trace cannot reach is disassembled too. The CDL is the authority: a decode the CPU never fetched is dropped, and so is the fall-through behind a call whose target never returns (the game's dispatchers have their jump table right behind the call). * One segment per bank (PRG0..PRG7) with its own .org, so the assembler knows the CPU address of every label while the linker still writes the bytes to the bank's file offset. A flat segment cannot do both: a call would encode the file offset instead of the CPU address. * Pass 2 names every label - 494 routines, no Label_XXXX and no raw $XXXX branch or jump operand left. Pass 3 applies 13 semantic zero-page aliases and writes the routine headers. * 8,075 bytes of code (12.3% of the 64 KB PRG), up from 200 bytes. The banking turned out to be unusual and is documented: the fixed bank is the fourth 8 KB bank (file $6000-$7FFF), not the last one, and the image carries the reset stub and the vector table twice. The live NMI vector is $808F - the frame handler - while the copy at the end of the image names $8189, which is a BRK in the first half. The game's text table lives at CPU $F1D6, which is the fixed window, and that is what settles the question. Also: the leftover _wip/MAPPER8 folder is removed, as it is for every other promotion. The project builds byte identical: Byte-identical ROM verified. Add CHANGELOG.md: the pass history of every project A project goes through four milestones - Pass 1 (the code/data split), Pass 2 (the labels replaced by names), Pass 3 (the semantic naming) and Promotion (the move into the top-level mapper folder) - and the history of those milestones was scattered over the commit log, the project READMEs and the root README. CHANGELOG.md gathers it: one section per project with a row for each milestone, the date, and a sentence saying what the milestone produced. The numbers are the ones the project README and the root README already carry - instruction count, code coverage, named labels, semantic zero-page aliases, named data tables - so a reader can see at a glance which projects are done and which are not. Golf (JU), the only project still in _wip/ with a real disassembly, is listed with its open milestones, and the other 852 _wip/ projects are covered as a tier. The requirement is now part of the workflow contract: PROMPTS.md gains a "Pass 3: Changelog entry" section and a ninth checklist item, and AGENTS.md points at the file. A milestone and its changelog row go in the same commit, so the changelog and the source never disagree. Balloon Fight (JU): repair the audit trail and complete the routine headers The per-instruction audit trail was stale by two bytes from ResetInitializationData ($C085) onward. 5,944 of the 6,007 comments named the wrong CPU address and PRG offset, because the three-byte .byte "HAL" signature at $C082-$C084 had been counted as one byte when the trail was first generated - the routine headers and the linker labels were right all along, so the source and its own headers disagreed with each other. The trail was rebuilt from the ca65 -l listing with _tools/repair_audit_comments.py, and every rewritten comment was re-checked against prg.bin. The comments were also moved into the canonical column-35 field: they had sat two spaces after the mnemonic, with no column discipline at all, unlike every other promoted project. All 63 routine headers now carry a ; Clobbers: block, so the headers carry the full template AGENTS.md describes. The blocks are derived, not written by hand. The new _tools/derive_clobbers.py takes the opcode from the audit comment's byte list, so the addressing mode is exact and a data directive is never mistaken for an instruction; it resolves the operand through locals.inc and symbols.inc to name what is written; it follows the real control flow, so a jsr to another named entry is a call (the callee's clobbers count) while a branch or a fall-through is not; and it models register preservation, so NmiHandler reports *no register* - it saves and restores A, X and Y around the frame - and FlushPpuCommandPreserved reports only A, because X and Y come back unchanged. Two tools changed. derive_clobbers.py is new. align_audit_comments.py had an off-by-one: it tested the indented code length against 31 instead of against 35, so code texts of 28-31 characters were never padded into the column. The change is comments only. The code text of all 8,538 lines is unchanged, make still prints "Byte-identical ROM verified.", the 6,007 audit comments still re-check against prg.bin, all 63 routine headers agree with the instructions they describe, and every label agrees with reconstructed.lbl. ReflectObjectYVelocity and UpdateSpecialObjectSystem moved out of locals.inc and became labels in prg.s at their real addresses. CHANGELOG.md becomes the repository's running log: a Pending list of the changes to be put in the next commit, a History of the commits already made, and the per-project milestone index at the end. The next commit's message is written from the Pending entries, so the two cannot drift apart. PROMPTS.md and AGENTS.md describe the new shape. WIP.md drops the _wip/MAPPER8/ note: the folder held a copy of Mermaids of Atlantis (U) that had already been promoted. World Class Track Meet (U): Pass 1, the code/data split Pass 1 is done. The split is 8,400 instructions / 18,028 code bytes (55.0 %) of the 32 KB PRG, with 884 routine entries, 55 data blocks and 102 zero-page aliases. The PRG is CNROM (mapper 3) and maps whole at $8000-$FFFF, so the linker moved the PRG segment from a .nes file offset to $8000 and the build still compares byte identical. Four dispatch tables had to be seeded by hand. The event table at $F796 (5 entries) is read at $F780 and jumped to through `jmp ($001F)`. The three push-pointer tables - $BFC4 (16 entries), $BFE4 (2) and $E5F2 (7) - push a handler address and `rts` into it, and the 6502's `rts` adds one to the address it pops, so each table stores the entry address minus one; the seeds are the table values plus one. The tracer runs with --undocumented: the code uses undocumented NMOS opcodes as ordinary code (ANC $37 at $BFF8, and the RRA/RLA/SLO and NOP forms elsewhere). Seeding the tables takes the coverage from 27.8 % to 55.0 %. $C0BE-$C0C5 is forced back to data: the IRQ vector $C0C0 points into the middle of the `jmp $C047` at $C0BE, and the game never executes CLI, so the vector is dead. `make pass1` regenerates prg.s and locals.inc from prg.bin and reproduces the committed prg.s byte for byte. The project README records the split, the four dispatch tables, the dead IRQ vector, the wrong CHR size field in the header, and what is still data. The milestone index in CHANGELOG.md gains the project; WIP.md, README.md and AGENTS.md follow the tier counts and the layout. nesdis.py gains a --mapping-note option, so the header's "PRG mapped at" line can describe a board that is not NROM - CNROM's whole 32 KB at $8000-$FFFF is not "mirrored to the upper half". Replaces runs of $00 and $FF with .res <run>, <byte> Golf (JU) and World Class Track Meet (U): Pass 2/3 complete, promoted from _wip/ - World Class Track Meet (U) - Pass 2 complete: all 884 Label_<addr> definitions replaced (651 semantic routine names + 233 Sub_<addr>), all 731 raw $XXXX jsr/jmp call operands resolved to symbolic labels, all branch targets given role-based names; routinemap.tsv added; make stays byte-identical. - World Class Track Meet (U) - Pass 3 complete: 24 semantic zero-page aliases applied via apply_symbols.py (0 residue), 78 neutral ZpXX slots documented with reasons in locals.inc, all hardware-register operands use symbols.inc names, project README rewritten with Pass 2/Pass 3 sections and data-table inventory; promoted out of _wip/CNROM/. - World Class Track Meet (U) - project README documents the five event-table entries at $F796 and marks the olympics mode as not yet proven. - Golf (JU) - audit comments converted from pre-canonical (; C000: A9 00) to the canonical ; CPU:$C000 PRG:0000 A9 00 form at column 35; 4,156 comments re-aligned, comment/whitespace only, whole-ROM build stays byte-identical. - Golf (JU) - 339 internal branch-target Label_ labels given role-based names via _tools/derive_branch_names.py; 0 raw $XXXX branch/jump operands remain. - Golf (JU) - 275 zero-page operands substituted with locals.inc aliases via apply_symbols.py; 0 residue; promoted out of _wip/NROM/. - Xevious (U) - runs of $FF padding replaced with .res <count>, $FF in prg.s; whole-ROM build stays byte-identical. - Both projects promoted via git mv; leftover _wip/ folders removed; root README.md inventory rows added; WIP.md rows removed. World Class Track Meet (U): apply zero-page symbol substitutions Run apply_symbols.py to substitute ZpXX zero-page operands with semantic locals.inc aliases (SlotState, GameMode, etc.) at proven sites; 0 residue, whole-ROM build stays byte-identical. Xevious (U): re-split Pass 1 from the Mesen CDL and decode the data tables - Xevious (U) - Pass 1 re-split from the Mesen CDL (xevious_mesen.cdl) with _tools/cdl_reclass.py: 1,158 bytes data->code, 48 code->data, 42 labels emitted and 3 branch targets labelled; code 11,321->12,455 bytes (34.5%->38.0%), instructions 5,513->6,002. The 45 recovered entry points are named Sub_XXXX, so no Label_XXXX remains; six CDL-silent raw call operands are documented as residue. - Xevious (U) - the 4,448-byte block at $A74B-$B8AA is split into six proven tables: VramWritePtrTable (15 pointers), VramWriteData, DataStreamPtrTable (16), ObjTilePtrTable (99), ObjTileData and DataStreamData. The $D833 pointer table is corrected to base $D833 (4 entries; the old ObjCodePtrTable at $D834 was one byte late). $F957-$FAF5 is split into ObjSpeedTable, ObjSpeedTable2, SpriteLayoutPtrTable (19) and SpriteLayoutData; $FEE6-$FF1C into PaletteData and OamAttrTable. $F5D8 is decoded as TextTileData (font tile indices: PLAYER, GAME OVER, READY, SOLVALOU, LEFT, PAUSE); $F53C becomes AttrAddrTable, $F89E HandlerPtrTable and $EF3B SpriteLayoutData2. Project README rewritten with the corrected stats, a 32-entry table inventory and the Pass 1 residue. - _tools/cdl_reclass.py - preserve the data label(s) between a data-block header and its first .byte row when the block stays data; the $DF78 split dropped Data_DF78 and the rebuild failed with an undefined symbol. - _tools/resolve_raw_branches.py - handle negative relative offsets (beq *-$0B); the pattern only matched *+$NN and *$NN. Docs: refresh the tier counts to 41 promoted / 851 _wip, add the WCTM row - Docs - tier counts refreshed to the post-promotion state across AGENTS.md, root README.md, WIP.md, TODO.md and CHANGELOG.md: 41 promoted projects (38 under NROM/, plus CNROM/World Class Track Meet (U), UNROM/Zanac (U) and MAPPER8/Mermaids of Atlantis (U)) and 851 _wip/ projects, every one of them a Pass 0 skeleton. The stale "39/40 promoted", "853 _wip", "Golf (JU) is still in _wip/" and "Golf is the last pre-canonical project" statements are corrected. - Root README.md - the promoted inventory gained the missing World Class Track Meet (U) row (row 41, mapper 3, 32 KB PRG / 32 KB CHR), and the "All 38 are mapper 0 / 16 KB PRG" sentence is replaced with the actual split (36 of the 41 rows are mapper 0 / 16 KB; Xevious and Volleyball are 32 KB, World Class Track Meet is mapper 3, Zanac mapper 2 and Mermaids mapper 8).
2026-10-21 11:36:32 -04:00
1 parent df11857075
commit 691b2bc23c
@@ -1,25 +0,0 @@
-CA65 ?= ca65
-LD65 ?= ld65
-
-all: reconstructed.nes verify
-
-prg.o: prg.s symbols.inc locals.inc prg.bin
-	$(CA65) -g -o $@ $<
-
-header.o: header.s header.bin
-	$(CA65) -g -o $@ $<
-
-chr.o: chr.s chr.bin
-	$(CA65) -g -o $@ $<
-
-reconstructed.nes: header.o prg.o chr.o linker.cfg
-	$(LD65) -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ header.o prg.o chr.o
-
-verify: reconstructed.nes rom.nes
-	cmp reconstructed.nes rom.nes
-	@echo "Byte-identical ROM verified."
-
-clean:
-	rm -f *.o reconstructed.nes reconstructed_prg.bin reconstructed.map reconstructed.lbl
-
-.PHONY: all verify clean
@@ -1,66 +0,0 @@
-# World Class Track Meet (U)
-
-## Status
-
-**Pass 0 skeleton.** The project builds and verifies byte-identical to the
-original ROM, but no disassembly exists yet: `prg.s` is a single
-`.incbin "prg.bin"` of the PRG image.
-
-`make` assembles `header.s`, `prg.s`, `chr.s`, links them with `ld65` and compares the
-result against `rom.nes`:
-
-```
-Byte-identical ROM verified.
-```
-
-## ROM
-
-| Property | Value |
-|----------|-------|
-| Format | iNES |
-| Mapper | 3 |
-| Board | CNROM |
-| Mirroring | Horizontal |
-| Four-screen VRAM | no |
-| Battery | no |
-| PRG | 32 KB (2 x 16 KB), at file offset $0010 |
-| CHR | 32 KB (4 x 8 KB) |
-| Trainer | none |
-| Footer | none |
-| NMI vector | $F803 |
-| RESET vector | $F6FD |
-| IRQ vector | $C0C0 |
-| ROM file | `World Class Track Meet (U).nes` |
-| SHA-256 | `d592d60690234cd9fb6b24a2c566740523bee90bbe7ac1171df3dfbde3ab4e39` |
-
-### Header notes
-
- none
-
-## Open work
-
- **Pass 1** - run `nesdis.py` over `prg.bin` to produce the code/data
-  split. The tracer reads the vectors from the last six bytes of the PRG
-  image, so the split seeds correctly.
- **Pass 1** must emit the canonical audit comment
-  `; CPU:$C123 PRG:0123  AD 21 03` at column 35 for every instruction.
- **Pass 2** - replace the address-derived `Label_XXXX` names and the raw
-  `$XXXX` call operands.
- **Pass 3** - semantic zero-page aliases (applied only at the sites where
-  their role is proven) and named data tables.
- **Promotion** to `NROM/<name>/` once Pass 3 is done, as `git mv`.
-
-## Files
-
-| File | Purpose |
-|------|---------|
-| `prg.s` | Pass 0 PRG include (replaced by the Pass 1 disassembly) |
-| `header.s` | iNES header include |
-| `chr.s` | CHR include |
-| `prg.bin` | 32768 bytes (32 KB) PRG image |
-| `chr.bin` | 32768 bytes (32 KB) CHR image |
-| `rom.nes` | byte-identical copy of the original ROM |
-| `linker.cfg` | HEADER / PRG / CHR memory areas |
-| `symbols.inc` | NES hardware register names |
-| `locals.inc` | zero-page aliases (empty at Pass 0) |
-| `Makefile` | build and byte-identity check |
@@ -1,2 +0,0 @@
-.segment "CHR"
-    .incbin "chr.bin"
@@ -1,2 +0,0 @@
-.segment "HEADER"
-    .incbin "header.bin"
@@ -1,10 +0,0 @@
-MEMORY {
-  HEADER: start = $0000, size = $0010, fill = yes;
-  PRG:    start = $0010, size = $8000, fill = yes;
-  CHR:    start = $8010, size = $8000, fill = yes;
-}
-SEGMENTS {
-  HEADER: load = HEADER, type = ro;
-  PRG:    load = PRG,    type = ro;
-  CHR:    load = CHR,    type = ro;
-}
@@ -1,4 +0,0 @@
-; Zero-page aliases for this project.
-; Empty at Pass 0.  Pass 1+ adds proven semantic names here;
-; addresses whose role is not yet determined keep the neutral ZpXX
-; form.
@@ -1,18 +0,0 @@
-; World Class Track Meet (U) NES disassembly - Pass 0 (build skeleton)
-;
-; The PRG image is included verbatim, so the project rebuilds
-; byte-identical to the original ROM from the first commit.  Pass 1
-; replaces this block with the traced disassembly; no ROM byte is
-; ever deleted or reformatted, only re-classified as code or data.
-;
-; Board:    CNROM
-; PRG:      32 KB at file offset $0010 (the image is bank-switched; it does not fit the 6502 address space as one window)
-; Vectors:  NMI=$F803  RESET=$F6FD  IRQ=$C0C0
-
-.setcpu "6502"
-
-.include "symbols.inc"
-.include "locals.inc"
-
-.segment "PRG"
-    .incbin "prg.bin"
@@ -1,108 +0,0 @@
-; =============================================================================
-; Nintendo Entertainment System hardware symbols
-; =============================================================================
-
-; -----------------------------------------------------------------------------
-; PPU registers
-; -----------------------------------------------------------------------------
-
-PPUCTRL             = $2000
-PPUMASK             = $2001
-PPUSTATUS           = $2002
-OAMADDR             = $2003
-OAMDATA             = $2004
-PPUSCROLL           = $2005
-PPUADDR             = $2006
-PPUDATA             = $2007
-
-OAMDMA              = $4014
-
-; -----------------------------------------------------------------------------
-; Controller ports
-;
-; $4016:
-;   Write: controller strobe
-;   Read:  controller port 1
-;
-; $4017:
-;   Read:  controller port 2
-;   Write: APU frame counter
-; -----------------------------------------------------------------------------
-
-JOY1                = $4016
-JOY2                = $4017
-
-; -----------------------------------------------------------------------------
-; APU pulse channel 1
-; -----------------------------------------------------------------------------
-
-APUPULSE1CTRL       = $4000
-APUPULSE1SWEEP      = $4001
-APUPULSE1TIMERLO    = $4002
-APUPULSE1TIMERHI    = $4003
-
-; -----------------------------------------------------------------------------
-; APU pulse channel 2
-; -----------------------------------------------------------------------------
-
-APUPULSE2CTRL       = $4004
-APUPULSE2SWEEP      = $4005
-APUPULSE2TIMERLO    = $4006
-APUPULSE2TIMERHI    = $4007
-
-; -----------------------------------------------------------------------------
-; APU triangle channel
-; -----------------------------------------------------------------------------
-
-APUTRIANGLECTRL     = $4008
-APUTRIANGLETIMERLO  = $400A
-APUTRIANGLETIMERHI  = $400B
-
-; -----------------------------------------------------------------------------
-; APU noise channel
-; -----------------------------------------------------------------------------
-
-APUNOISECTRL        = $400C
-APUNOISEPERIOD      = $400E
-APUNOISELENGTH      = $400F
-
-; -----------------------------------------------------------------------------
-; APU DMC channel
-; -----------------------------------------------------------------------------
-
-APUDMCCTRL          = $4010
-APUDMCDIRECT        = $4011
-APUDMCADDR          = $4012
-APUDMCLENGTH        = $4013
-
-; -----------------------------------------------------------------------------
-; APU status and frame counter
-;
-; $4015:
-;   Write: enable or disable the five APU channels
-;   Read:  channel and interrupt status
-;
-; $4017:
-;   Write: APU frame-counter mode and IRQ inhibit
-;   Read:  controller port 2
-; -----------------------------------------------------------------------------
-
-APUSTATUS           = $4015
-APUFRAMECOUNTER     = $4017
-
-; -----------------------------------------------------------------------------
-; Controller masks
-; -----------------------------------------------------------------------------
-
-PAD_RIGHT           = $01
-PAD_LEFT            = $02
-PAD_DOWN            = $04
-PAD_UP              = $08
-PAD_START           = $10
-PAD_SELECT          = $20
-PAD_B               = $40
-PAD_A               = $80
-
-PAD_HORIZONTAL      = PAD_LEFT | PAD_RIGHT
-PAD_VERTICAL        = PAD_UP | PAD_DOWN
-PAD_DPAD            = PAD_HORIZONTAL | PAD_VERTICAL
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 105 |
 | Board | MAPPER105 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 65 |
 | Board | MAPPER65 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 66 |
 | Board | MAPPER66 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 68 |
 | Board | MAPPER68 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 68 |
 | Board | MAPPER68 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -1,25 +0,0 @@
-CA65 ?= ca65
-LD65 ?= ld65
-
-all: reconstructed.nes verify
-
-prg.o: prg.s symbols.inc locals.inc prg.bin
-	$(CA65) -g -o $@ $<
-
-header.o: header.s header.bin
-	$(CA65) -g -o $@ $<
-
-chr.o: chr.s chr.bin
-	$(CA65) -g -o $@ $<
-
-reconstructed.nes: header.o prg.o chr.o linker.cfg
-	$(LD65) -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ header.o prg.o chr.o
-
-verify: reconstructed.nes rom.nes
-	cmp reconstructed.nes rom.nes
-	@echo "Byte-identical ROM verified."
-
-clean:
-	rm -f *.o reconstructed.nes reconstructed_prg.bin reconstructed.map reconstructed.lbl
-
-.PHONY: all verify clean
@@ -1,61 +0,0 @@
-# Mermaids of Atlantis (U)
-
-## Status
-
-**Pass 1 complete.** The code/data split has been produced by `nesdis.py` and
-the project builds byte-identical to the original ROM. `prg.s` now contains
-traced code with audit comments and `.byte` data blocks for unreached bytes.
-
-`make` assembles `header.s`, `prg.s`, `chr.s`, links them with `ld65` and compares the
-result against `rom.nes`:
-
-```
-Byte-identical ROM verified.
-```
-
-## ROM
-
-| Property | Value |
-|----------|-------|
-| Format | iNES |
-| Mapper | 8 |
-| Board | MAPPER8 |
-| Mirroring | Vertical |
-| Four-screen VRAM | no |
-| Battery | no |
-| PRG | 64 KB (4 x 16 KB), at file offset $0010 |
-| CHR | 64 KB (8 x 8 KB) |
-| Trainer | none |
-| Footer | none |
-| NMI vector | $8189 |
-| RESET vector | $FF00 |
-| IRQ vector | $8036 |
-| ROM file | `Mermaids of Atlantis (U).nes` |
-| SHA-256 | `53f5d22650063aba89b91762f133d1b6b2680c505b193d88a472580d09701122` |
-
-### Header notes
-
- none
-
-## Open work
-
- **Pass 2** - replace the address-derived `Label_XXXX` names and the raw
-  `$XXXX` call operands.
- **Pass 3** - semantic zero-page aliases (applied only at the sites where
-  their role is proven) and named data tables.
- **Promotion** to `NROM/<name>/` once Pass 3 is done, as `git mv`.
-
-## Files
-
-| File | Purpose |
-|------|---------|
-| `prg.s` | Pass 1 PRG disassembly (traced code + data blocks) |
-| `header.s` | iNES header include |
-| `chr.s` | CHR include |
-| `prg.bin` | 65536 bytes (64 KB) PRG image |
-| `chr.bin` | 65536 bytes (64 KB) CHR image |
-| `rom.nes` | byte-identical copy of the original ROM |
-| `linker.cfg` | HEADER / PRG / CHR memory areas |
-| `symbols.inc` | NES hardware register names |
-| `locals.inc` | zero-page aliases (5 ZpXX aliases at Pass 1) |
-| `Makefile` | build and byte-identity check |
@@ -1,2 +0,0 @@
-.segment "CHR"
-    .incbin "chr.bin"
@@ -1,17 +0,0 @@
-label	Label_801B	Sub_801B_Entry_801B
-label	Label_8036	Sub_8036_Entry_8036
-label	Label_8038	Sub_8036_OnNonnegative_8038
-label	Label_8057	Sub_8036_JoinBranchPaths_8057
-label	Label_8062	Sub_8036_OnNonzero_8062
-label	Label_806B	Sub_8036_OnCarrySet_806B
-label	Label_8083	Sub_8083_StoreAndContinue_8083
-label	Label_8189	Sub_8083_Entry_8189
-label	Label_FF2F	Sub_8764_OnCarryClear_FF2F
-label	Label_FF3E	Sub_FF3E_CallNext_FF3E
-label	Label_FF49	Sub_FF49_JumpNext_FF49
-label	Label_FF4C	Sub_FF4C_StoreAndContinue_FF4C
-label	Label_FF4E	Sub_FF4C_OnNonzero_FF4E
-label	Label_FF50	Sub_FF4C_OnNonzero_FF50
-label	Label_FF57	Sub_FF57_Return_FF57
-label	Label_FF60	Sub_FF57_OnNonzero_FF60
-label	Label_FF62	Sub_FF62_Return_FF62
@@ -1 +0,0 @@
-
@@ -1,2 +0,0 @@
-.segment "HEADER"
-    .incbin "header.bin"
@@ -1,17 +0,0 @@
-label	Label_801B	Sub_801B_Entry_801B
-label	Label_8036	Sub_8036_Entry_8036
-label	Label_8038	Sub_8036_OnNonnegative_8038
-label	Label_8057	Sub_8036_JoinBranchPaths_8057
-label	Label_8062	Sub_8036_OnNonzero_8062
-label	Label_806B	Sub_8036_OnCarrySet_806B
-label	Label_8083	Sub_8083_StoreAndContinue_8083
-label	Label_8189	Sub_8083_Entry_8189
-label	Label_FF2F	Sub_8764_OnCarryClear_FF2F
-label	Label_FF3E	Sub_FF3E_CallNext_FF3E
-label	Label_FF49	Sub_FF49_JumpNext_FF49
-label	Label_FF4C	Sub_FF4C_StoreAndContinue_FF4C
-label	Label_FF4E	Sub_FF4C_OnNonzero_FF4E
-label	Label_FF50	Sub_FF4C_OnNonzero_FF50
-label	Label_FF57	Sub_FF57_Return_FF57
-label	Label_FF60	Sub_FF57_OnNonzero_FF60
-label	Label_FF62	Sub_FF62_Return_FF62
@@ -1,10 +0,0 @@
-MEMORY {
-  HEADER: start = $0000, size = $0010, fill = yes;
-  PRG:    start = $0010, size = $10000, fill = yes;
-  CHR:    start = $10010, size = $10000, fill = yes;
-}
-SEGMENTS {
-  HEADER: load = HEADER, type = ro;
-  PRG:    load = PRG,    type = ro;
-  CHR:    load = CHR,    type = ro;
-}
@@ -1,37 +0,0 @@
-; Zero-page aliases for this project.
-; Pass 1+ adds proven semantic names here;
-; addresses whose role is not yet determined keep the neutral ZpXX
-; form.
-
-Zp00    = $00
-Zp01    = $01
-Zp02    = $02
-Zp2F    = $2F
-Zp6A    = $6A
-
-; ---------------------------------------------------------------------------
-; Semantic zero-page aliases (Pass 3)
-;
-; Every alias below was read out of this dump's own code.  An address whose
-; role is the same at every reference is renamed everywhere; an address that
-; is reused for several roles keeps the neutral ZpXX name outside the
-; routines where the role is proven, and the per-site choice is recorded in
-; sites.tsv.
-; ---------------------------------------------------------------------------
-
-TempVar0        = $00 ; semantic alias for Zp00 (general-purpose zero-page temp, used at $804D,$8057,$806B)
-TempVar1        = $01 ; semantic alias for Zp01 (general-purpose zero-page temp, used at $804F,$8062,$8066,$806D,$807D)
-TempVar2        = $02 ; semantic alias for Zp02 (general-purpose zero-page temp, used at $8076)
-LoopCounter     = $2F ; semantic alias for Zp2F (incremented at $8083, likely frame/loop counter)
-StatusByte      = $6A ; semantic alias for Zp6A (stored at $8081, likely status/flags register)
-
-; Clean marker section placeholder - will be filled by tools if needed
-; ---------------------------------------------------------------------------
-; Semantic zero-page aliases (Pass 3)
-;
-; Every alias below was read out of this dump's own code.  An address whose
-; role is the same at every reference is renamed everywhere; an address that
-; is reused for several roles keeps the neutral ZpXX name outside the
-; routines where the role is proven, and the per-site choice is recorded in
-; sites.tsv.
-; ---------------------------------------------------------------------------
@@ -1,108 +0,0 @@
-; =============================================================================
-; Nintendo Entertainment System hardware symbols
-; =============================================================================
-
-; -----------------------------------------------------------------------------
-; PPU registers
-; -----------------------------------------------------------------------------
-
-PPUCTRL             = $2000
-PPUMASK             = $2001
-PPUSTATUS           = $2002
-OAMADDR             = $2003
-OAMDATA             = $2004
-PPUSCROLL           = $2005
-PPUADDR             = $2006
-PPUDATA             = $2007
-
-OAMDMA              = $4014
-
-; -----------------------------------------------------------------------------
-; Controller ports
-;
-; $4016:
-;   Write: controller strobe
-;   Read:  controller port 1
-;
-; $4017:
-;   Read:  controller port 2
-;   Write: APU frame counter
-; -----------------------------------------------------------------------------
-
-JOY1                = $4016
-JOY2                = $4017
-
-; -----------------------------------------------------------------------------
-; APU pulse channel 1
-; -----------------------------------------------------------------------------
-
-APUPULSE1CTRL       = $4000
-APUPULSE1SWEEP      = $4001
-APUPULSE1TIMERLO    = $4002
-APUPULSE1TIMERHI    = $4003
-
-; -----------------------------------------------------------------------------
-; APU pulse channel 2
-; -----------------------------------------------------------------------------
-
-APUPULSE2CTRL       = $4004
-APUPULSE2SWEEP      = $4005
-APUPULSE2TIMERLO    = $4006
-APUPULSE2TIMERHI    = $4007
-
-; -----------------------------------------------------------------------------
-; APU triangle channel
-; -----------------------------------------------------------------------------
-
-APUTRIANGLECTRL     = $4008
-APUTRIANGLETIMERLO  = $400A
-APUTRIANGLETIMERHI  = $400B
-
-; -----------------------------------------------------------------------------
-; APU noise channel
-; -----------------------------------------------------------------------------
-
-APUNOISECTRL        = $400C
-APUNOISEPERIOD      = $400E
-APUNOISELENGTH      = $400F
-
-; -----------------------------------------------------------------------------
-; APU DMC channel
-; -----------------------------------------------------------------------------
-
-APUDMCCTRL          = $4010
-APUDMCDIRECT        = $4011
-APUDMCADDR          = $4012
-APUDMCLENGTH        = $4013
-
-; -----------------------------------------------------------------------------
-; APU status and frame counter
-;
-; $4015:
-;   Write: enable or disable the five APU channels
-;   Read:  channel and interrupt status
-;
-; $4017:
-;   Write: APU frame-counter mode and IRQ inhibit
-;   Read:  controller port 2
-; -----------------------------------------------------------------------------
-
-APUSTATUS           = $4015
-APUFRAMECOUNTER     = $4017
-
-; -----------------------------------------------------------------------------
-; Controller masks
-; -----------------------------------------------------------------------------
-
-PAD_RIGHT           = $01
-PAD_LEFT            = $02
-PAD_DOWN            = $04
-PAD_UP              = $08
-PAD_START           = $10
-PAD_SELECT          = $20
-PAD_B               = $40
-PAD_A               = $80
-
-PAD_HORIZONTAL      = PAD_LEFT | PAD_RIGHT
-PAD_VERTICAL        = PAD_UP | PAD_DOWN
-PAD_DPAD            = PAD_HORIZONTAL | PAD_VERTICAL
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 64 KB (4 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 64 KB (4 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 1 |
 | Board | MMC1 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | yes |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 4 |
 | Board | MMC3 |
-| Mirroring | Four-screen |
+| Mirroring | Vertical |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 128 KB (8 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 256 KB (16 x 16 KB), at file offset $0010 |
@@ -20,7 +20,7 @@ Byte-identical ROM verified.
 | Format | iNES |
 | Mapper | 5 |
 | Board | MMC5 |
-| Mirroring | Four-screen |
+| Mirroring | Horizontal |
 | Four-screen VRAM | no |
 | Battery | yes |
 | PRG | 512 KB (32 x 16 KB), at file offset $0010 |
@@ -1,152 +0,0 @@
-# Pass 1 compressed and packed-data parser audit
-
-## Summary
-
-Four distinct packed-data consumers are confirmed. Only one is a general
-run-length decoder. The others are pointer-selected sprite/object lists or
-cell-code interpreters.
-
-## 1. `$CBEA`: pointer-selected OAM sprite-list parser
-
-Inputs:
-
- `$15` selects a sprite-list variant.
- `$16 == 4` selects the pointer tables at `$CC3E/$CC44`; other values select
-  `$CC24/$CC31`.
- `$33` is added to the generated OAM X coordinate.
- X is the destination OAM-shadow offset.
-
-Format:
-
- One source byte per sprite.
- `$FF` terminates the list early.
- A hard limit of `$15` (21) source entries prevents runaway parsing.
- The source byte is both the CHR tile index and the index into coordinate
-  tables `$CC4A` and `$CC5F`.
-
-Output record at `$0200,X`:
-
- byte 0: `$88 + table_CC5F[tile]` (Y)
- byte 1: source byte (tile)
- byte 2: `$00` (attributes)
- byte 3: `$33 + table_CC4A[tile]` (X)
-
-This is a compact sprite-layout parser, not RLE compression.
-
-## 2. `$DD78-$DE39`: primary course-map RLE decoder
-
-Pointer selection:
-
- `$2B` is the zero-based hole index.
- `$E6C3,Y` and `$E6D5,Y` form the source pointer in `$04/$05`.
- Destination begins at `$0300` through `$06/$07`.
-
-Header:
-
- First three source bytes are copied to `$19-$1B`.
- Source pointer then advances by three bytes.
-
-Commands:
-
- `$FF`: end primary stream.
- `$00-$0F`: emit header byte 0, `(low_nibble + 1)` times.
- `$10-$1F`: emit header byte 1, `(low_nibble + 1)` times.
- `$20-$2F`: emit header byte 2, `(low_nibble + 1)` times.
- `$A0-$AF`: emit `(low_nibble + 1)` values cycling through `$AB-$AD` using
-  state byte `$8D`.
- `$30-$9F` and `$B0-$FE`: emit the command byte literally.
-
-Output is divided into 16-byte units. After each unit, `$04/$05` advances by
-`$1C` consumed source bytes and `$06/$07` advances by `$10` destination bytes.
-
-### Hole 2 / Hole 3 length correction
-
-The decoder does not enforce a 480-byte limit. RAM `$0300-$04FF` is cleared
-before decoding, providing a 512-byte destination area. Therefore the measured
-outputs are valid:
-
- Hole 2: 482 bytes
- Hole 3: 483 bytes
- Other currently measured streams: 480 bytes
-
-The earlier 480-byte expectation came from the common case of 30 16-byte
-units, not from a decoder bound. Both longer streams remain within the 512-byte
-course buffer and do not indicate malformed pointers or an incorrect opcode
-model.
-
-## 3. `$DE3B-$DE5D`: optional auxiliary block parser
-
-After the primary `$FF`, the decoder advances the source pointer past the
-primary stream and examines the next byte.
-
- `$55` is a sentinel meaning the optional block is absent.
- Otherwise, records are copied in four-byte groups from the source into
-  `$0104+`.
- X begins at `$04` and increases by four per record.
- After each group, `$D4F2` advances the corresponding destination/object
-  bookkeeping.
- Parsing ends when X reaches `$44`, allowing at most 16 four-byte groups.
- `$04/$05` is then advanced by the number of consumed source bytes.
-
-This is a bounded fixed-record block, not a terminator-scanned RLE stream.
-
-## 4. `$DE5E-$DF52`: per-hole OAM/object package parser
-
-The parser begins at the source position following the optional auxiliary
-block.
-
-### Fixed setup record
-
-The first bytes initialize OAM-shadow entries beginning at `$0298` and setup
-fields `$65-$66`, `$57`, `$1A-$1B`. Tables at `$E37D-$E3DE` expand one compact
-source selector into multiple sprite records.
-
-### Variable object list
-
-At `$DF03`, each object record begins with:
-
- byte 0: object/shape selector, or `$FF` terminator
- byte 1: X/base-position adjustment
- byte 2: Y/base-position adjustment
-
-The selector indexes span tables at `$E283/$E284`, then source tables at
-`$E2EB`, `$E2A2`, and `$E334`. One compact three-byte object record expands to
-one or more four-byte OAM entries.
-
- `$FF` terminates the variable object list.
- Values at or above table position `$2B` select OAM attribute `$42`; lower
-  positions select `$02` through the intentional overlapping-instruction idiom
-  at `$DF3A/$DF3B`.
- The parser resumes at the next source record using `$1C` as the consumed-byte
-  offset.
-
-This is a table-expanded object/sprite list, not a byte-run compressor.
-
-## 5. `$D72D-$D7FF`: course-cell code interpreter
-
-This routine reads one byte through `($19),Y` from the generated course map. It
-is not a stream decompressor. It interprets cell codes for collision or terrain
-response:
-
- `$EF` and `$FD` are special sentinels.
- Other values index the property table at `$D80D`.
- Property values `$10`, `$20`, `$40`, and `$FF` select distinct collision or
-  response paths.
- Fine X/Y bits are converted into a bit mask and tested against the selected
-  property byte.
-
-The `$FF` comparison at `$D74D` belongs to this cell-property dispatch and must
-not be mistaken for a compressed-stream terminator.
-
-## Parser-boundary conclusions
-
- `$CBEA` sprite layouts are bounded by `$FF` or 21 entries.
- Primary hole streams are bounded by their first `$FF` and decode into a
-  512-byte RAM area, not a fixed 480-byte area.
- Optional auxiliary blocks are bounded by `$55` or 16 four-byte groups.
- Per-hole object lists are bounded by a secondary `$FF` and expand through
-  fixed lookup tables.
- `$D72D` is a map-cell interpreter, not another compressed-data parser.
-
-No remaining `$FF` comparison in reachable code has been found that represents
-an unclassified compressed-stream parser.
@@ -1,25 +0,0 @@
-CA65 ?= ca65
-LD65 ?= ld65
-
-all: reconstructed.nes verify
-
-prg.o: prg.s symbols.inc locals.inc course_streams.inc sprite_object_tables.inc prg.bin
-	$(CA65) -g -o $@ $<
-
-header.o: header.s header.bin
-	$(CA65) -g -o $@ $<
-
-chr.o: chr.s chr.bin
-	$(CA65) -g -o $@ $<
-
-reconstructed.nes: header.o prg.o chr.o linker.cfg
-	$(LD65) -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ header.o prg.o chr.o
-
-verify: reconstructed.nes rom.nes
-	cmp reconstructed.nes rom.nes
-	@echo "Byte-identical ROM verified."
-
-clean:
-	rm -f *.o reconstructed.nes reconstructed_prg.bin reconstructed.map reconstructed.lbl
-
-.PHONY: all verify clean
@@ -1,10 +0,0 @@
-all: reconstructed_prg.bin verify
-prg.o: prg.s symbols.inc prg.bin
-	ca65 -g -o $@ prg.s
-reconstructed_prg.bin: prg.o linker.cfg
-	ld65 -C linker.cfg -m reconstructed.map -Ln reconstructed.lbl -o $@ prg.o
-verify: reconstructed_prg.bin prg.bin
-	cmp reconstructed_prg.bin prg.bin
-	@echo BYTE-IDENTICAL
-clean:
-	rm -f prg.o reconstructed_prg.bin reconstructed.map reconstructed.lbl
@@ -1,109 +0,0 @@
-# Pass 1 NMI callback audit
-
-## Dispatcher
-
-The hardware NMI vector enters `$C0A6`. The fixed prologue saves A/X/Y, performs
-OAM DMA from page `$02`, then executes `JMP ($0002)`. Every installed callback
-must therefore finish through the common epilogue at `$C0B8` or deliberately
-reset/restart the program.
-
-`$C888` is the generic installer:
-
- Y -> `$0002` (callback low byte)
- X -> `$0003` (callback high byte)
- PPU NMI remains enabled through the shadow value at `$00`
-
-## Confirmed callback installations
-
-### `$C6C8` installed at `$C0EC`
-
-Caller loads Y=`$C8`, X=`$C6`, then calls `$C888`.
-
-Role: early/main gameplay display callback. It updates OAM entries at
-`$0214-$0217` and `$0284-$0287`, advances animation counters `$8E/$8F`, and
-terminates with `JMP $C0B8`.
-
-### `$CFAA` installed at `$CF5C`
-
-Caller loads Y=`$AA`, X=`$CF`, then calls `$C888`.
-
-Role: gameplay sequencing callback. It decrements/increments `$32`, updates OAM
-coordinates, and changes the callback vector to one of the following mid-routine
-continuations as state thresholds are crossed:
-
- `$CFC3`
- `$D03E`
- `$D08A`
-
-The routine ultimately reaches the gameplay display tail at `$C6C8`, which exits
-through `$C0B8`.
-
-### `$DAA2` installed at `$DA27`
-
-Caller loads Y=`$A2`, X=`$DA`, then calls `$C888`.
-
-Role: title/menu/attract controller callback. It polls controller port `$4016`,
-updates `$09/$0A/$0D`, writes one OAM cursor entry at `$0200-$0203`, and either:
-
- jumps to `$C0B8` for the normal NMI epilogue,
- restarts title/game initialization through `$DA2F/$DA4C`, or
- restarts the initial state through `$C0C7`.
-
-Important correction: `$DB0D` (`78 88 98`) is used as OAM Y-position data for
-`$0200`, not as an NMI callback-low-byte table. Consequently `$BA78/$BA88/$BA98`
-are not callbacks.
-
-### `$C5A0` installed at `$FC8E`
-
-Caller loads Y=`$A0`, X=`$C5`, then calls `$C888`.
-
-Role: active gameplay controller/animation callback. It serially reads `$4016`,
-updates input-derived state `$2E/$30`, angle/selection fields `$17/$44/$45`, OAM
-entries, and then enters `$C6C8` before returning through `$C0B8`.
-
-## Direct callback-vector transitions
-
-The following direct writes to `$02/$03` are confirmed executable and are part
-of the `$CFAA-$D121` callback state machine:
-
- `$CFB6/$CFBA`: install `$CFC3`
- `$CFDA/$CFDE`: install `$D03E`
- `$D006/$D00A`: install `$D03E`
- `$D02B/$D02F`: install `$D08A`
- `$D05E/$D062`: install `$D08A`
- `$D07A/$D07E`: install `$D08A`
-
-These are mid-routine continuation entries, not independent top-level systems.
-They share state in `$17/$1D/$1E/$1F/$32/$34/$35` and converge on `$C6C8`.
-
-## Confirmed callback set
-
-Top-level callback installations:
-
- `$C5A0`
- `$C6C8`
- `$CFAA`
- `$DAA2`
-
-Dynamic continuation callbacks:
-
- `$CFC3`
- `$D03E`
- `$D08A`
-
-Common normal exit:
-
- `$C0B8`
-
-No other verified executable write to `$0002/$0003` has been found. Apparent
-writes inside compressed hole packages are data and are excluded.
-
-## Source conversion
-
-The previously retained callback spans are now emitted as annotated instructions:
-
- `$C5A0-$C71D`: gameplay input/display callback chain
- `$CFAA-$D123`: gameplay sequence callback and dynamic continuation entries
-
-The three bytes at `$C71E-$C720` remain data because execution at `$C71B` jumps
-directly to the NMI epilogue and cannot fall through into them.
@@ -1,44 +0,0 @@
-# Pass 1 overlap-entry audit
-
-The 19 held-back decoded entries reduce to nine intentional overlapping-instruction
-idioms plus one non-entry byte (`$D9DA`). These are valid 6502 size/speed tricks,
-not ambiguous code/data boundaries.
-
-## General idiom
-
-`BIT absolute` consumes the following two bytes without changing A. Entering one
-byte later interprets the low/high operand bytes as a useful instruction stream.
-This permits conditional constant selection without a branch around the second
-load. Because ca65 cannot emit two overlapping instruction streams linearly,
-Pass 1 preserves each byte sequence in a localized `.incbin` span and documents
-all valid entry points.
-
-## Resolutions
-
- `$C198`: `BIT $00A9`; alternate entry `$C199`: `LDA #$00` from branch `$C194`.
-  Both entries valid. `$C198` is fall-through constant-selection path.
- `$D424`: `BIT $40A9`; alternate entry `$D425`: `LDA #$40` from `$D49B`.
-  Both entries valid.
- `$D9D8`: `BIT $0838`; alternate entry `$D9D9`: `SEC` from `$FE28`.
-  `$D9DA` (`PHP`) has no caller and is only the third byte of the BIT operand;
-  it is not an independent entry point.
- `$D9F9`: `BIT $FFA9`; alternate entry `$D9FA`: `LDA #$FF` from `$D9F4`.
-  Both entries valid.
- `$DF3A`: `BIT $02A9`; alternate entry `$DF3B`: `LDA #$02` from `$DF36`.
-  Both entries valid.
- `$FB24`: `BIT $B8A9`; alternate entry `$FB25`: `LDA #$B8` from `$FAE4/$FBAB`.
-  Both entries valid and implement the already traced terrain fallback selection.
- `$FB83`: `BIT $FFA9`; alternate entry `$FB84`: `LDA #$FF` from `$FB5C`.
-  Both entries valid.
- `$FC6B`: `BIT $18`; alternate entry `$FC6C`: `CLC` from `$FC68`.
-  Both entries valid. The BIT path preserves carry set by the preceding `SEC`;
-  the alternate path explicitly clears carry before return.
- `$FF00`: `BIT $00A9`; alternate entry `$FF01`: `LDA #$00` from `$FEFC`.
-  Both entries valid.
-
-## Pass 1 source treatment
-
-All nine physical byte sequences remain localized `.incbin` spans in `prg.s`.
-Named entry constants may point into these spans, but the overlapping bytes must
-not be emitted twice. Pass 2 may replace each span with explicit `.byte` values
-and entry aliases while retaining the dual interpretation in comments.
@@ -1,59 +0,0 @@
-# Golf (JU) Pass 1 status
-
-## Confirmed
-
- 16 KiB NROM PRG, CPU window $C000-$FFFF mirrored at $8000-$BFFF.
- Vectors: NMI $C0A6, RESET $C000, IRQ $C0C4.
- Dynamic NMI vector in RAM $0002/$0003, installed through $C888.
- Direct recursive trace currently closes over 136 direct JSR/JMP targets.
- 4,063 instructions / 8,441 PRG bytes reached by the current direct trace.
- $DB0D (`78 88 98`) is an OAM cursor Y-position table used by $DAA2; it is not an NMI callback table.
- $E6C3/$E6D5 is the split 18-entry primary course-stream pointer table.
- Primary course streams and first $FF terminators are bounded in
-  course_streams.inc.
- $FA35-$FC23 contains course-grid normalization, connectivity-to-CHR lookup,
-  and associated tables.
- $FC98 uploads an 84-byte 12x7 course panel from $009C-$00EF to PPU $2222.
-
-## Still required before declaring Pass 1 complete
-
-1. **NMI callback set audited — DONE.** All four top-level callbacks ($C5A0=`GameplayInputNmiCallback`, $C6C8, $CFAA, $DAA2) and the three dynamic continuations ($CFC3, $D03E, $D08A) are emitted as annotated instruction source; none sit inside an `.incbin` span. See `NMI_CALLBACK_AUDIT.md`.
-2. **Compressed/packed-data parsers audited; parser-adjacent tables converted to source — DONE.** Primary course-stream split pointer table at $E6C3/$E6D5 (18 entries) is explicit `.byte` source (`CourseLayoutPointerLo`/`CourseLayoutPointerHi`, resolving to `course_streams.inc` stream labels). Bit-mask table $D6F4–$D6FB (`BitMaskTable`) and PPU write table $FD0A–$FD11 (`PpuTableFd0a`) converted to explicit `.byte` source; both confirmed consumed via indexed loads in `SubCD6FC` ($D6D3/$D7EF) and at $FCFD respectively. Parser formats documented in `COMPRESSED_PARSER_AUDIT.md`.
-3. **Controller-input and attract-mode return-to-title paths audited — DONE.** Title/menu/attract controller callback $DAA2 and title init $C0C7 (`InitializeRuntimeState`) are emitted as instruction source; return-to-title paths flow through $DA2F/$DA4C/$C0C7 per `NMI_CALLBACK_AUDIT.md`.
-4. **Classify all remaining gaps as code, structured data, or localized incbin — DONE.** Every `.incbin` span has zero code entry points (no JSR/JMP/branch target falls inside) and is confirmed data; the only indirect jump is the dynamic NMI vector at $C0B5.
-5. Emit remaining documented instruction source with CPU address and byte comments — DONE (all 4,063 reachable instructions are explicit source).
-6. Obtain/build ca65 and verify reconstructed_prg.bin is byte-identical — DONE.
-
-**Pass 1 complete.**
-
-## Overlap-entry audit
-
-The 19 held-back decodes are resolved. They represent nine deliberate overlapping
-6502 instruction idioms; `$D9DA` is not independently reachable. See
-`OVERLAP_AUDIT.md`. They remain localized `.incbin` spans because a linear ca65
-instruction stream cannot encode both interpretations simultaneously.
-
-## Sprite and object table audit
-
-The sprite-layout tables at `$CC15+` and object expansion tables at
-`$E283-$E3DD` have been structurally classified. See
-`SPRITE_OBJECT_TABLE_AUDIT.md`. These ranges are confirmed data and must be
-excluded from future executable tracing.
-
-## Audited data emitted as ca65 source
-
-The following formerly retained data spans are now explicit `.byte` source with
-address and expected-byte comments:
-
- `$CC15-$CD84`: sprite layout remap, pointer tables, coordinate tables, and lists
- `$E1B8-$E1D7`: gameplay PPU palette
- `$E282-$E3DD`: variable and fixed object expansion tables
-
-Only the unaudited tails of the original enclosing spans remain as `.incbin`.
-
-## NES hardware symbols implemented
-
-All decoded instruction operands now use the reusable names from `symbols.inc`
-for PPU, OAM DMA, APU, and controller registers. Expected-byte comments retain
-the original numeric encoding. Structured `.byte` data and `.incbin` offsets are
-unchanged.
@@ -1,59 +0,0 @@
-# Golf (JU) Pass 2 naming plan and progress
-
-Pass 1 baseline: ca65/ld65 build verified byte-identical.
-
-## Batch 1: startup, interrupt, PPU helpers, title/menu backbone
-
- Rename high-confidence startup and interrupt-local labels.
- Name NMI vector fields and PPU shadow values in `locals.inc`.
- Name the title/menu selection and input-latch fields where usage is proven.
- Name the menu cursor Y-position table at `$DB0D`.
- Keep uncertain gameplay temporaries numerical.
-
-## Later batches
-
-1. Controller polling and shot-selection state.
-2. Gameplay NMI sequence fields and callbacks.
-3. Course decompressor fields and package tables.
-4. Golfer sprite-layout routines and states.
-5. Course object expansion and collision routines.
-6. Terrain-grid generator and course overview.
-7. Audio engine and command tables.
-
-Every batch must complete `make clean && make` with `BYTE-IDENTICAL` before the
-next naming batch is accepted.
-
-## Batch 2 completed: controller and shot-selection callback
-
-Named the controller serial scan, repeat latch, club-selection index, aim index,
-aim direction, animation counters, major callback phases, and OAM-update loops
-within `$C5A0-$C71D`.
-
-## Batch 3 completed: gameplay sequence NMI chain
-
-Named the sequence position, three bounds, phase and completion fields, dynamic
-NMI continuations, position/frame selection loops, and threshold tables in
-`$CF87-$D13D`.
-
-### Batch 3 correction
-
-The branch at `$D09C` must target the trampoline at `$D0A6`, not the frame
-selector at `$D0A9`. The target is now `JumpToSelectSequenceFrame`, preserving
-the original displacement `$08` and byte sequence `90 08`.
-
-## Subroutine-entry Label_ cleanup (Pass 2 residue)
-
-All 112 `Label_` definitions that are JSR/JMP subroutine entry points have been
-renamed:
-
- 4 with established semantics: `WaitForFramePreservingY` ($C881),
-  `SpriteOffsetForController` ($C894), `SetPpuScrollAndMask` ($C89D),
-  `MultiplyABy32` ($C8BB).
- 108 as address-based `SubC<addr>` names where behaviour is not yet
-  established (e.g. `SubC84D`, `SubC89A`, `SubCE64`).
-
-The remaining 349 `Label_` definitions are internal branch targets within
-routines; per repo convention these do not need semantic names for the call
-graph to be readable and are intentionally left as `Label_`.
-
-Build verified `BYTE-IDENTICAL` after the rename.
@@ -1,79 +0,0 @@
-# Golf (JU) — Pass 1 complete, Pass 2 substantial, Pass 3 started
-
-ROM: `_wip/Golf (JU)/Golf (JU).nes` (24,592 bytes, iNES). Status: **Pass 1 complete, Pass 2 substantial, Pass 3 started — PAUSED.** PRG build is **byte-identical**.
-
-**Pass 1 (code/data split) — complete.** Reachable code traced from RESET ($C000) and NMI ($C0A6); all 4,063 reachable instructions are explicit source. NMI callbacks ($C5A0=`GameplayInputNmiCallback`, $C6C8, $CFAA, $DAA2; continuations $CFC3/$D03E/$D08A) and controller/attract paths ($DAA2, $C0C7=`InitializeRuntimeState`) are in source. All remaining `.incbin` spans have zero code entry points and are confirmed data.
-
-**Pass 2 (label naming) — substantial.** Startup/NMI/PPU/controller/course-decode routines named (batches 1–3 per `PASS2_PLAN.md`). All 112 subroutine-entry `Label_` labels renamed to `SubC<addr>` (108) or semantic names (4: `WaitForFramePreservingY`, `SpriteOffsetForController`, `SetPpuScrollAndMask`, `MultiplyABy32`); 349 internal branch-target `Label_` labels remain intentionally.
-
-**Pass 3 (data tables) — started, PAUSED.** Conversions completed:
- Interrupt vectors at $FFFA–$FFFF → `.word NmiHandler`/`Reset`/`IrqLoop`
- Course-stream split pointer table at $E6C3/$E6D5 (18 entries) → `CourseLayoutPointerLo`/`CourseLayoutPointerHi`
- Bit-mask table $D6F4–$D6FB → `BitMaskTable` ($80 40 20 10 08 04 02 01)
- PPU write table $FD0A–$FD11 → `PpuTableFd0a`
- Score adjust table $D988–$D9B0 → `D988ScoreAdjustTable`
- PPU value table $FF85–$FF9F → `FF85PpuValueTable`
- Sprite/object tables (`sprite_object_tables.inc`) and gameplay PPU palette ($E1B8–$E1D7) already emitted as structured source.
-
-**Paused:** Remaining `.incbin` spans are largely Iwata's compressed level data ($E6E7–$F905, ~4.6 KB) and opaque lookup tables ($C786–$C84C, $CD85–$CE63, $D304–$D3B6, $D563–$D659, $D823–$D8EC, $DC59–$DD77, $E1D8–$E281, $E3DE–$E3FB, $E588–$E6AF, $FBBF–$FC23). Without runtime tracing / a code/data log to confirm consumers and structure, converting these risks guessy rewrites. Per repo convention, they remain as `.incbin` with address comments.
-
-Remaining `.incbin` spans ($C71E–$C720, $C786–$C84C, $CD85–$CE63, $D304–$D3B6, $D563–$D659, $D823–$D8EC, $DC59–$DD77, $E1D8–$E281, $E3DE–$E3FB, $E588–$E6AF, $E6E7–$F905, $FBBF–$FC23) remain as data per the no-guessy-rewrites convention; convert only when a consumer is identified.
-
-**Next Pass 3 candidates:** when runtime tracing tools are available, remaining structured tables (course-stream data, opaque lookup spans) can be converted where structure is confirmed.
-
-**Promotion:** not yet — `_wip` tier (PRG-only compare). Promotion requires full-ROM build (`header.s`/`chr.s` + vectors) and root inventory entry.
-
-
-## ROM Facts
-
-| Property | Value |
-|----------|-------|
-| Mapper | 0 (NROM) — from the iNES header |
-| PRG | 16 KB (header claims map at CPU $C000–$FFFF) |
-| CHR | 8 KB |
-| Mirroring | Vertical |
-| Battery-backed flag | clear |
-| ROM SHA-256 | `70986ed4fb441199a9ff50c7b5c6388d9f7a17c29990d1b5f7214572ae0a4bc6` |
-| PRG SHA-256 | `9f729074cd7c74340f325460173519427b1180f5101f8dc37da7b1c2b9b604d5` |
-
-## Interrupt Vectors (taken from PRG $3FFA–$3FFF)
-
-| Vector | Target | Note |
-|--------|--------|------|
-| NMI | `$C0A6` | per-frame heartbeat |
-| RESET | `$C000` | cold start at $C000 — the usual pattern in this repo |
-| IRQ | `$C0C4` | IRQ handler |
-
-## `copilot/` Contents
-
-| File | Purpose |
-|------|---------|
-| `Golf (JU).nes` | original ROM image (reference) |
-| `prg.bin` / `header.bin` / `chr.bin` | split image, produced by `_tools/splitnes.py` |
-| `prg.s` | Pass-1 disassembly: classified code/data split with audit comments; Pass 2 substantial. Data split into `course_streams.inc` and `sprite_object_tables.inc` |
-| `symbols.inc` | shared NES hardware constants (PPU/APU/controller) |
-| `locals.inc` | project-local zero-page aliases (Pass 2 batches kept alongside as `locals.inc.pass2-*` backups) |
-| `linker.cfg` | PRG at $C000, 16 KB, `fill = yes` |
-| `Makefile` | links `reconstructed_prg.bin` and `cmp`s it against `prg.bin` |
-| `reconstructed_prg.bin` | build output from the last verified build |
-
-Header/CHR are not linked: `copilot/` keeps the raw `header.bin`/`chr.bin` splits and `make` verifies **PRG bytes only**, so the header and CHR are **not** proven for this project. Promotion to the top level adds `header.s` / `chr.s` (as e.g. `Burger Time (U)`), a HEADER/PRG/CHR `linker.cfg`, and a full-ROM `make` target.
-
-## Build
-
-```bash
-cd "_wip/Golf (JU)/copilot"
-make        # → cmp reconstructed_prg.bin prg.bin → "BYTE-IDENTICAL"
-```
-
-## Next Steps
-
-1. **Pass 1** — done (byte-identical PRG build).
-2. **Pass 2** — substantial: startup/NMI/PPU/controller/course-decode routines and all 112
-   subroutine entry points named; 349 internal branch-target `Label_` labels remain.
-3. **Pass 3** — paused: convert the remaining `.incbin` spans (Iwata-compressed level data
-   `$E6E7–$F905`, opaque lookup tables) only once a consumer/structure is confirmed; per
-   repo convention they stay `.incbin` with address comments rather than be guessed at.
-4. **Promotion** — move to a top-level `<name>/copilot/` folder, add a full-ROM build
-   (`header.s` + `chr.s` + HEADER/PRG/CHR `linker.cfg`), and write the power-on flow
-   `OVERVIEW.md` in the established style.
@@ -1,201 +0,0 @@
-# Pass 1 sprite and object table audit
-
-## Scope
-
-This audit covers tables consumed by `ParseSpriteLayout` at `$CBEA` and the
-per-hole object expansion path at `$DE5E-$DF52`. All addresses are CPU addresses
-in the fixed `$C000-$FFFF` PRG view.
-
-## A. Sprite-layout subsystem at `$CC15-$CCA6`
-
-### `$CC15-$CC23`: sprite-layout selection map
-
-15 bytes. The caller indexes this table with a selection/state value and obtains
-one of five logical layout groups (`$00-$04`). This is an index-remap table, not
-sprite data.
-
-### `$CC24-$CC30`: standard layout pointer-low table
-
-13 bytes:
-
-`74 89 9E B3 C8 DD C8 B3 F2 07 1C 31 46`
-
-These are low bytes of layout-list addresses. The matching high-byte table at
-`$CC31-$CC3D` is predominantly `$CC`, with `$CD` used when a list crosses into
-the next page.
-
-Resolved standard pointers:
-
- `$CC74`
- `$CC89`
- `$CC9E`
- `$CCB3`
- `$CCC8`
- `$CCDD`
- `$CCC8`
- `$CCB3`
- `$CCF2`
- `$CD07`
- `$CD1C`
- `$CD31`
- `$CD46`
-
-Repeated pointers are intentional mirroring of animation/layout states.
-
-### `$CC31-$CC3D`: standard layout pointer-high table
-
-13 bytes paired one-for-one with `$CC24-$CC30`.
-
-### `$CC3E-$CC43`: alternate layout pointer-low table
-
-6 bytes:
-
-`5B 70 9E 70 5B 74`
-
-### `$CC44-$CC49`: alternate layout pointer-high table
-
-6 bytes paired with `$CC3E-$CC43`.
-
-Resolved alternate pointers:
-
- `$CD5B`
- `$CD70`
- `$CC9E`
- `$CD70`
- `$CD5B`
- `$CC74`
-
-This table shares existing lists instead of duplicating them.
-
-### `$CC4A-$CC5E`: sprite X-offset table
-
-21 signed/unsigned screen offsets indexed by the tile/list byte. Values repeat
-`$00,$08,$10` patterns, matching three-column sprite construction.
-
-### `$CC5F-$CC73`: sprite Y-offset table
-
-21 offsets indexed by the same tile/list byte. Values progress by eight pixels
-from `$00` to `$30`, producing row-aligned sprite positions.
-
-### `$CC74-$CD5A`: terminated sprite-index lists
-
-The pointer tables select variable-length byte lists in this range. Each byte is
-both:
-
- the OAM tile value, and
- an index into `$CC4A` and `$CC5F` for X/Y placement.
-
-Each list terminates with `$FF`; the parser also has a hard 21-entry limit.
-The lists share suffixes and are deliberately referenced more than once.
-
-### `$CD5B-$CD84` and later alternate lists
-
-The alternate pointer table reaches `$CD5B` and `$CD70`. These are additional
-terminated tile-index lists using the same coordinate tables and OAM expansion
-format. Bytes beyond the last referenced terminator require separate consumer
-analysis before being named as part of this family.
-
-## B. Hole-object expansion tables at `$E283-$E3DE`
-
-### `$E283-$E2A1`: object span-end table
-
-31 monotonically increasing values:
-
-`03 07 09 0B 0E 10 12 14 16 19 1B 1E 20 23 25 27 29 2B 2E 31 34 38 3A 3C 3E 40 43 45 47 49`
-
-The parser loads the selected value into `$1D` as the exclusive end index for a
-shape. The corresponding start index comes from the preceding entry at
-`$E282,Y`, making `$E282/$E283` a compact prefix-boundary pair.
-
-### `$E2A2-$E2EA`: object CHR-tile sequence table
-
-73 bytes. For each expanded OAM sprite, the parser reads one tile value from
-this table. Values are concentrated in `$E0-$F2`, matching the object/sprite CHR
-region.
-
-### `$E2EB-$E333`: object X-offset table
-
-73 bytes paired with `$E2A2-$E2EA`. Values are mostly `$00`, `$08`, and `$10`,
-with a few compact adjustments. The parser adds each value to the record's base
-X byte.
-
-### `$E334-$E37C`: object Y-offset table
-
-73 bytes paired with the tile and X-offset tables. The parser adds each value
-to the record's base Y byte.
-
-Together these three 73-byte arrays form a structure-of-arrays representation:
-
- tile[index]
- x_offset[index]
- y_offset[index]
-
-The span-end table maps an object selector to a contiguous slice of these
-parallel arrays.
-
-### `$E37D-$E383`: fixed setup span boundaries
-
-Seven bytes:
-
-`00 03 06 0B 10 17 1E`
-
-The fixed setup parser uses a selector-derived range from the first two tables
-around `$E37D/$E37E`. These values are prefix boundaries for larger fixed
-sprite groups.
-
-### `$E384-$E3A1`: fixed setup X-offset table
-
-30 bytes. Values are chiefly `$00`, `$04`, and `$08`, defining compact sprite
-clusters around a base position.
-
-### `$E3A2-$E3BF`: fixed setup tile table
-
-30 bytes. Values are concentrated in `$F5-$FC`, identifying a separate CHR
-family from the variable object table.
-
-### `$E3C0-$E3DD`: fixed setup attribute table
-
-30 bytes. Values are primarily `$02` and `$42`, with `$82` and `$C2` variants.
-The high bits encode OAM flipping while the low bits select palette 2.
-
-The fixed setup arrays are parallel and are consumed together when constructing
-OAM entries beginning near `$0298`.
-
-### `$E3DE+`: following data
-
-`$E3DE` begins another sequence (`08 08 00 ...`) not indexed by either audited
-object expansion loop. It remains a separate table until its consumer is
-identified.
-
-## C. Per-hole object record format
-
-After the fixed setup portion, `ParseHoleObjectList` consumes three-byte records:
-
- byte 0: object selector, or `$FF` terminator
- byte 1: base X adjustment
- byte 2: base Y adjustment
-
-Selector `n` obtains a slice:
-
- start = span boundary `n`
- end = span boundary `n + 1`
-
-Each slice element expands to one OAM entry using the tile/X/Y parallel arrays.
-Selectors whose expanded table index reaches `$2B` use OAM attribute `$42`;
-earlier entries use `$02`.
-
-## D. Classification conclusions
-
-Confirmed structured data:
-
- `$CC15-$CC23`: layout-group remap
- `$CC24-$CC49`: split pointer tables
- `$CC4A-$CC73`: paired coordinate tables
- `$CC74` onward: `$FF`-terminated sprite-index lists
- `$E283-$E2A1`: object span boundaries
- `$E2A2-$E37C`: three parallel 73-byte object expansion arrays
- `$E37D-$E3DD`: fixed setup boundaries and three parallel 30-byte arrays
-
-No executable entry point exists inside these audited table ranges. Any legal
-6502 opcode sequence found inside them is data and must be excluded from recursive
-code tracing.
@@ -1,2 +0,0 @@
-.segment "CHR"
-    .incbin "chr.bin"
@@ -1,38 +0,0 @@
-; Golf (JU) - Pass 1 compressed primary course-stream bounds.
-; End labels are exclusive and include the primary $FF terminator.
-CourseLayoutStream01 = $E6E7
-CourseLayoutStream01_End = $E7A5
-CourseLayoutStream02 = $EAAF
-CourseLayoutStream02_End = $EB7B
-CourseLayoutStream03 = $F2E8
-CourseLayoutStream03_End = $F3A5
-CourseLayoutStream04 = $F4BC
-CourseLayoutStream04_End = $F5B5
-CourseLayoutStream05 = $E991
-CourseLayoutStream05_End = $EA7B
-CourseLayoutStream06 = $EEF3
-CourseLayoutStream06_End = $EFAF
-CourseLayoutStream07 = $F0C5
-CourseLayoutStream07_End = $F1B9
-CourseLayoutStream08 = $F7BC
-CourseLayoutStream08_End = $F8D5
-CourseLayoutStream09 = $F6BA
-CourseLayoutStream09_End = $F78E
-CourseLayoutStream10 = $EFE3
-CourseLayoutStream10_End = $F0B0
-CourseLayoutStream11 = $EDEC
-CourseLayoutStream11_End = $EECB
-CourseLayoutStream12 = $ED09
-CourseLayoutStream12_End = $EDDA
-CourseLayoutStream13 = $E7BA
-CourseLayoutStream13_End = $E89E
-CourseLayoutStream14 = $E8CF
-CourseLayoutStream14_End = $E982
-CourseLayoutStream15 = $F3D3
-CourseLayoutStream15_End = $F48E
-CourseLayoutStream16 = $EBAC
-CourseLayoutStream16_End = $ECD8
-CourseLayoutStream17 = $F5C7
-CourseLayoutStream17_End = $F6A8
-CourseLayoutStream18 = $F1EA
-CourseLayoutStream18_End = $F2B4