# Golf (JU) Pass 1 status

## Confirmed

- 16 KiB NROM PRG, CPU window $C000-$FFFF mirrored at $8000-$BFFF.
- Vectors: NMI $C0A6, RESET $C000, IRQ $C0C4.
- Dynamic NMI vector in RAM $0002/$0003, installed through $C888.
- Direct recursive trace currently closes over 136 direct JSR/JMP targets.
- 4,063 instructions / 8,441 PRG bytes reached by the current direct trace.
- $DB0D (`78 88 98`) is an OAM cursor Y-position table used by $DAA2; it is not an NMI callback table.
- $E6C3/$E6D5 is the split 18-entry primary course-stream pointer table.
- Primary course streams and first $FF terminators are bounded in
  course_streams.inc.
- $FA35-$FC23 contains course-grid normalization, connectivity-to-CHR lookup,
  and associated tables.
- $FC98 uploads an 84-byte 12x7 course panel from $009C-$00EF to PPU $2222.

## Still required before declaring Pass 1 complete

1. **NMI callback set audited — DONE.** All four top-level callbacks ($C5A0=`GameplayInputNmiCallback`, $C6C8, $CFAA, $DAA2) and the three dynamic continuations ($CFC3, $D03E, $D08A) are emitted as annotated instruction source; none sit inside an `.incbin` span. See `NMI_CALLBACK_AUDIT.md`.
2. **Compressed/packed-data parsers audited; parser-adjacent tables converted to source — DONE.** Primary course-stream split pointer table at $E6C3/$E6D5 (18 entries) is explicit `.byte` source (`CourseLayoutPointerLo`/`CourseLayoutPointerHi`, resolving to `course_streams.inc` stream labels). Bit-mask table $D6F4–$D6FB (`BitMaskTable`) and PPU write table $FD0A–$FD11 (`PpuTableFd0a`) converted to explicit `.byte` source; both confirmed consumed via indexed loads in `SubCD6FC` ($D6D3/$D7EF) and at $FCFD respectively. Parser formats documented in `COMPRESSED_PARSER_AUDIT.md`.
3. **Controller-input and attract-mode return-to-title paths audited — DONE.** Title/menu/attract controller callback $DAA2 and title init $C0C7 (`InitializeRuntimeState`) are emitted as instruction source; return-to-title paths flow through $DA2F/$DA4C/$C0C7 per `NMI_CALLBACK_AUDIT.md`.
4. **Classify all remaining gaps as code, structured data, or localized incbin — DONE.** Every `.incbin` span has zero code entry points (no JSR/JMP/branch target falls inside) and is confirmed data; the only indirect jump is the dynamic NMI vector at $C0B5.
5. Emit remaining documented instruction source with CPU address and byte comments — DONE (all 4,063 reachable instructions are explicit source).
6. Obtain/build ca65 and verify reconstructed_prg.bin is byte-identical — DONE.

**Pass 1 complete.**

## Overlap-entry audit

The 19 held-back decodes are resolved. They represent nine deliberate overlapping
6502 instruction idioms; `$D9DA` is not independently reachable. See
`OVERLAP_AUDIT.md`. They remain localized `.incbin` spans because a linear ca65
instruction stream cannot encode both interpretations simultaneously.

## Sprite and object table audit

The sprite-layout tables at `$CC15+` and object expansion tables at
`$E283-$E3DD` have been structurally classified. See
`SPRITE_OBJECT_TABLE_AUDIT.md`. These ranges are confirmed data and must be
excluded from future executable tracing.

## Audited data emitted as ca65 source

The following formerly retained data spans are now explicit `.byte` source with
address and expected-byte comments:

- `$CC15-$CD84`: sprite layout remap, pointer tables, coordinate tables, and lists
- `$E1B8-$E1D7`: gameplay PPU palette
- `$E282-$E3DD`: variable and fixed object expansion tables

Only the unaudited tails of the original enclosing spans remain as `.incbin`.

## NES hardware symbols implemented

All decoded instruction operands now use the reusable names from `symbols.inc`
for PPU, OAM DMA, APU, and controller registers. Expected-byte comments retain
the original numeric encoding. Structured `.byte` data and `.incbin` offsets are
unchanged.