# Donkey Kong Jr. (JU) — Game Flow from Power-On

This document describes the execution flow of the disassembled Donkey Kong Jr. (JU) PRG bank (16 KB, mapped at CPU **$C000–$FFFF**), starting from power-on. It is based entirely on `copilot/prg.s` (13,634 lines) in the repository, originally generated by `pass1_trace.py` from the interrupt vectors and refined through Pass 2/3 semantic labeling. The rebuild is verified **byte-identical** to the original `rom.nes` (`make` in `copilot/` produces `reconstructed.nes` matching `rom.nes` exactly).

Listing: project **11** in the top-level `OVERVIEW.md` index. NROM cartridge (mapper 0), iNES flags: 1 × 16 KB PRG, 1 × 8 KB CHR, vertical mirroring (flag 6 = $01).

ROM SHA-256: `7d5f77878af7646296d994da14b25213741f6e0e0bc5deadd32a406d044a5788`

Current label status — **all 1,035 top-level labels are semantically named**; every data region is emitted as explicit `.byte` data with its ROM provenance in comments (no `.incbin` blocks remain), and 688 local `Label_` branch targets are routine-internal.

---

## 1. Reset Vector — CPU $FFFC → $C66E

**`ResetHandler`** ($C66E–$C6B3)

Unlike most projects in this repository (whose reset handlers sit at $C000 or nearby entrypoints such as $C40B), Donkey Kong Jr.'s reset entry is at **$C66E**. On power-on or reset, the 6502 jumps to `$C66E`. The reset routine performs cold-start hardware initialization:

| Step | Code | Purpose |
|------|------|---------|
| 1 | `sei / cld` | Disable interrupts, clear decimal mode |
| 2 | `lda #$10 / sta PPUCTRL` | Disable NMI and PPU rendering immediately |
| 3 | `ldx #$FF / txs` | Initialize stack pointer |
| 4 | Poll `$2002` until bit 7 set | Wait for one VBlank period (PPU warm-up) |
| 5–8 | Indirect clear loop via `$00/$01` pointer | Clear all of RAM `$0000–$07FF` (8 pages, walked downward from $0700) |
| 9 | `jsr InitializePpuOamAndDmc` ($C6B6) | PPU, shadow-OAM, and DMC initialization (see §2) |
| 10 | `lda #$6F / sta TitleCursorY` | Initialize the title-cursor sprite Y position ($6F) |
| 11 | `lda #$18 / sta GameModeTimer` | Set attract-sequence timer (24) |
| 12 | `lda #$01 / sta PlayerLivesOrModeCount, sta PendingGameMode` | Arm the pre-game attract path |
| 13 | `lda #$00 / sta GameMode` | Set current game mode to 0 |
| 14 | Toggle `$2000` bit 7 via `PPUControlShadow` | **Enable NMI** — actual execution begins |
| 15 | `Label_C6B0: jsr AdvanceRandomLfsr / jmp` | Idle loop; the reset path never returns |

**Architectural note:** After reset, the CPU idles forever (`jmp Label_C6B0`); the loop body's only activity is `jsr AdvanceRandomLfsr` to churn the 8-byte PRNG. *All* game logic — attract screen, titles, gameplay, sound — runs entirely inside the **NMI handler**, which is the opposite of most NES titles in this collection (where the NMI flag merely paces a foreground main loop).

---

## 2. Initialization — `InitializePpuOamAndDmc` ($C6B6–$C6E5)

Called from `ResetHandler`:

1. **PPU control**: `PPUCTRL = $10`, saved to `PPUControlShadow` ($10)
2. **PPU mask**: `PPUMASK = $06` (background + sprite rendering), shadow at $11
3. **Scroll**: both scroll registers cleared, shadows at $12/$13
4. **Shadow OAM fill**: fills `$0200–$02FF` with `$FF` (all sprites hidden)
5. `jsr ClearGameplayNametable` ($CA16) — clears the background nametable
6. `APUDMALOAD = $00` (`$4011`, DMC volume/level reset)

---

## 3. Interrupt Vectors — CPU $FFFA–$FFFF

Located at the end of the bank (PRG offset $3FFA):

| Vector | Address | Handler |
|--------|---------|---------|
| NMI | $C6E6 | `NmiHandler` |
| RESET | $C66E | `ResetHandler` |
| IRQ | $FFF0 | `IrqHandler` (single `asl a` byte; see the deferred-task note in §6.1) |

The IRQ's apparent "oddity" is now explained: `DeferredTaskHandlerTable` deliberately addresses its entry 0 at mirrored CPU **$BFFE**, which is the IRQ-vector word at PRG $3FFE. The table leverages the address mirror so that a zero task type falls through to the unused `asl a` byte at $FFF0 — a register-saving trick rather than a real handler.

---

## 4. NMI / Frame Heartbeat — `NmiHandler` ($C6E6–$C76D)

The NMI is the *entire* per-frame scheduler. It:

1. **Preserves state**: pushes A, X, Y, **plus zero page $00–$07** (an 11-byte save; other projects only save the registers)
2. **Suspends NMI**: clears bit 7 of `PPUControlShadow` and writes `$2000` — prevents re-entrancy while the frame logic runs
3. **OAM DMA**: `jsr PerformOamDma` ($EEB0) — sprite DMA from shadow OAM $0200
4. **VRAM queue flush**: `jsr FlushQueuedVramCommands` ($EE9C) — drains the $0300 command queue during rendering
5. `jsr WriteInvertedRenderingMask` ($CA7A) — redraws PPUMASK state
6. `jsr UpdateAudioFrame` ($F91F) — per-frame audio channel update
7. **Controllers**: `jsr ReadControllers` ($F219) — serial pad read for both ports
8. **Frame logic dispatch** (see §5) based on `PendingGameMode` ($47), `GameMode` ($46), and `GameplaySubmode` ($4D)
9. `jsr ProcessQueuedTask` ($EE3A) — pops one pending task from the $0300 queue (see §6.1)
10. **Resumes NMI**: re-enables bit 7 of `PPUControlShadow` / `$2000` — allows the next frame
11. **Restores $00–$07, A, X, Y, `rti`**

---

## 5. Frame State Machine (inside the NMI)

The frame-mode dispatch at $C71B–$C748:

```
lda PendingGameMode ($47)
    │
    ├─ non-zero ── pending attract boot ──┬─ PlayerLivesOrModeCount == 0 → UpdateGameModeTransition ($C897)
    │                                     │                                (sound timers only)
    │                                     └─ PlayerLivesOrModeCount != 0 → UpdateTitleScreenAndStartSelection ($C773)
    │                                                                     + TickSoundTimers ($F1AF)
    │
    └─ zero ── lda GameMode ($46)
              │
              ├─ zero → UpdateAttractModeState ($C932)  (attract / inter-stage sequencer)
              │
              └─ non-zero ── lda GameplaySubmode ($4D)
                             ├─ zero → UpdateGameplayFrame ($CD6E)   (normal gameplay frame chain)
                             └─ non-zero → UpdateStageTransition ($CFC1)  (stage-intro / submode-6 path)
```

After the mode dispatch, `ProcessQueuedTask` ($EE3A) executes one queued gameplay task, then $2000 bit 7 is restored.

---

## 6. Subsystems

### 6.1 Deferred Task / VRAM Queue Systems ($0331, $0300)

Two cooperating RAM queues at $0300 fill during VBlank-adjacent time and are consumed during rendering:

- **Deferred gameplay tasks**: `EnqueueTask` ($EE7F) appends a tagged task byte (address in $0301, data in $0302). `ProcessQueuedTask` ($EE3A) pops one per frame: the task's high nibble selects a handler from `DeferredTaskHandlerTable` ($C000), the low nibble becomes its final data byte, and the dispatcher performs an indirect `jmp ($00):($02)` with a synthetic `$39EE` return address. Queue positions wrap at offset $2E.
- **`DeferredTaskHandlerTable` ($C000)** — five typed handlers:

  | Task type | Handler | Address |
  |-----------|---------|---------|
  | 1 | `InitializeBoundingBox` | $F044 |
  | 2 | `UpdateExistingBoundingBox` | $F040 |
  | 3 | `TestObjectBoundingBoxOverlap` | $F138 |
  | 4 | `QueueSelectedHudFields` | $EF50 |
  | 5 | `FillNametableAndClearAttributes` | $EEBB |

  Entry 0 (task type 0) is deliberately routed through the mirror at $BFFE to the IRQ-vector word — see §3.
- **VRAM command streams**: `QueueSingleVramByte` ($F1C5), `QueueRectangularVramTransfer` ($EFCE), and `QueuePlayerSelectVramStream` ($CA33) build queued VRAM writes; `FlushQueuedVramCommands` ($EE9C) walks the $0331 handoff pointer into `ProcessVramCommandStreamAndRestoreScroll` ($EF3C), the generic $2006/$2007 writer used by every screen-draw path.
- **Sprite management**: `PerformOamDma` ($EEB0) performs the shadow-OAM ($0200–$02FF) → $2003/$4014 DMA each frame; `HideInactiveObjectSprites` ($EC17)/`HideObjectSpriteGroup` ($CA08) park inactive slots.

### 6.2 Attract / Inter-Stage Sequencer ($C932–$C9FF)

`UpdateAttractModeState` ($C932) runs whenever `GameMode == 0`. It is a **countdown-driven scene sequencer** using `GameStateTimer` ($39) as a descending timer with fixed thresholds:

| GameStateTimer value | Action |
|------------|--------|
| $84 | scoreboard/interlude phase (decrements per frame) |
| $6E–$6F | stage transition setup (`AdvanceAttractModeSequence`, $C969) |
| $74 | full PPU re-prep (`HideObjectSpriteGroup` $CA08 + `ClearGameplayNametable` $CA16 + `QueuePlayerSelectVramStream` $CA33) |
| $68 | `jsr InitializeGameplayRam` ($CA82), **`GameMode = $01`** — gameplay begins |

At $C988 it disables rendering and uploads per-stage VRAM via `StageBackgroundVramStreamPointerTable` ($C3BD, one 2-byte stream pointer per stage index) plus the fixed stream at $F8B6, guarded by `GameModeTimer` ($48) — this draws the "How High Can You Get??"-style inter-stage screens before the stage demo starts, then queues rendering via `QueueCollisionAndVramTasks` ($ECA4) and `QueueSingleVramByte` ($F1C5).

### 6.3 Title / Game Start ($C773–$C896)

`UpdateTitleScreenAndStartSelection` ($C773) runs while `PendingGameMode != 0` and `PlayerLivesOrModeCount != 0`:

1. **APU gate**: audio enable `$06A2`-checked; a start-up delay in $05B4 raises `APUCTRL = $0F` (all channels on)
2. First pass (`TitleScreenInitialized` ($52) == 0): disables rendering, uploads the title background via the `TitleScreenVramCommandStream` at $F266, then builds the cursor sprite ($0200/$0201/$0203 with Y from `TitleCursorY` ($ED) = $6F)
3. **SELECT** ($20 mask): advances `TitleCursorY` by $10 (wraps $AF → $6F), sets `TitleInputRepeatTimer` ($7D) = $0A, latches `StartButtonLatch` ($6A)
4. **START** ($10 mask): latches `PreviousStartButtonState` ($EC), clears the bounding-box work area ($24–$2E), derives `SelectedPlayerMode` ($EF) from `TitleCursorY` (`lsr` ×4 minus 6) and a matching `GameModeTimer` ($1C or $18), then `jsr CollisionUpdateStep_EDFF` ($EDFF)
5. **Transition to gameplay**: reseeds the PRNG ($18 = $0F, $19 = $13), clears `PendingGameMode`, `GameMode`, and the $0580–$0587 record arrays, sets `StageOrScreenIndex` ($4A) = $01, derives `DifficultyOrRoundIndex` ($4B) from `SelectedPlayerMode` parity, sets `PlayerLivesOrModeCount` ($4C) per `TwoPlayerModeFlag` ($4E); final call `HideObjectSpriteGroup` and clears the $05B4 startup delay

`UpdateGameModeTransition` ($C897) is the alternate boot chain (`PlayerLivesOrModeCount == 0`): it ticks sound timers and compares `GameStateTimer` against $75 in the same phased style as the attract sequencer.

### 6.4 Gameplay Submodes ($CD6E–$D0FF)

With `GameMode != 0`, the NMI dispatches on `GameplaySubmode` ($4D):

- **Submode 0 — `UpdateGameplayFrame` ($CD6E)**: the full gameplay frame chain. Player state machine on `PlayerState` ($6B, states $03/$04/$05 special-cased):
  - `PlayerUpdateStep_EE10` ($EE10), `DecodePlayerDirectionalInput` ($CE6C) — input decode and object ambient updates
  - `UpdatePlayerAuxiliarySprite` ($CEA2), `InitializePlayerStateTransition` ($D251), `DispatchPlayerState` ($D412), `ProcessStageCollisions` ($D2FC), `UpdateStageEntities` ($CEF4), `DetectPlayerLoss` ($CED4) — player state, movement, and collision phase
  - `HideInactiveObjectSprites` ($EC17), `UpdateGameplaySubmode` ($CF9D), `RequestLowAltitudeSound` ($CEC9) — object OAM build and sound requests
  - death/loss handling: `UpdatePlayerDeathSequence` ($D1AE), `UpdateBonusCountdown` ($CF37)
  - `TickSoundTimers` ($F1AF)
  - Player-state bookkeeping: `PlayerStateReferenceY` ($76) copied from shadow OAM $0210, `PlayerStatePhase` ($78), `PlayerStateTransitionActive` ($79), `PlayerStateCounter` ($7E), plus the vertical-physics groups `PlayerVerticalSpeedInteger` ($7A)/`PlayerFallThreshold` ($7B)/`PlayerVerticalAcceleration*` ($7C/$82/$83)/`PlayerGravity*` ($86/$87)
  - SELECT exits via the `PendingGameMode = 1` path at $CDE4 (return to title)
  - `PauseActive` ($EB)/`PauseDebounceTimer` ($EE) gate the frame body
- **Submode != 0 — `UpdateStageTransition` ($CFC1)**: stage-intro / submode-6 path. In its early phase it gates on `PlayerState` and `PlayerStatePhase`; once the reference sprite at $0210 passes Y threshold $28, it issues a per-stage sound request into `SecondarySoundRequestFlags` ($FD) from `StageOrScreenIndex` ($02 for stage 1, $04 for stage 2, otherwise $08 — stage music), uploads a $50-byte VRAM stream (PPU address $1866 with a $00 fill value — pattern-table erase for the intro) via `QueueRectangularVramTransfer`, and sets `PlayerInputDirection` ($54) = $03. Submode 6 branches to `BeginStageClearSequence` ($D05F); entry also flows through `InitializePlayerBoundingBox` ($D04E) and `BuildPlayerCollisionBounds` ($D2BD).

### 6.5 Controllers ($F219–$F265)

Standard NES serial read through $4016 with the classic DPCM-corruption filter:

- `ReadControllers`: strobe on/off, then `ReadControllerPort` for X = 0 and 2
- `ReadControllerPort`: 8-bit shift loop in Y, then a two-sample consistency merge — a polarity-safe trick that keeps the record stable against mid-frame pad reads
- Results in `ControllerRawState` ($14) / `ControllerFilteredState` ($15) and `$16/$17` for port 2
- The $0F-mask ladder implements "button pressed this frame" persistence for directional input vs start/select

### 6.6 Sound Engine ($F1AF–$FE55)

- `UpdateAudioFrame` ($F91F): called from the NMI as the main audio service — it manages the APU channel frame state and audio effects
- `TickSoundTimers` ($F1AF): per-frame channel timer service; `SoundTimerDivider` ($34) drives the frame-based `SoundTimerArray` ($35+)
- Effect state and data: `Pulse1Effect*` ($F0–$F2), `AudioEffectTimer`/`AudioPitchAccumulator` ($F3/$F4), `Triangle*` ($F5/$F6), music sequencer state `MusicDataPointer*` ($F7/$F8)/`MusicNoisePosition` ($F9)/`MusicPulsePosition` ($FA)/`AudioLfoPhase` ($FB), and request flags `SoundRequestFlags` ($FC)/`SecondarySoundRequestFlags` ($FD)/`ObjectSoundRequestFlags` ($FE)
- Sound-effect data at the end of the bank: `SoundEffectDataPointer*` ($FE52/$FE53), `SoundEffectNoiseOffset` ($FE54), `SoundEffectSequenceData` at $FE55
- The title/APU chain programs `APUCTRL = $0F` (all channels on) at start

### 6.7 Pseudo-Random Generator ($F1F8–$F218)

An **8-byte LFSR** at $18–$1F:

- Taps: bit 1 of `RandomLfsr0` XOR bit 1 of `RandomLfsr1`
- Shifted bit through the full `ror` chain over all eight bytes
- Stepped continuously in the reset idle loop (`Label_C6B0`)
- Seeded to `$0F $13 $00…` at game start

---

## 7. Memory Map (Key Zero Page / RAM)

| Address | Name | Use |
|---------|------|-----|
| $00–$0F | `Zp00`–`Zp0F` | Shared scratch / indirect pointers (routine-local by design) |
| $10 | `PPUControlShadow` | $2000 shadow |
| $11 | `PPUMaskShadow` | $2001 shadow |
| $12–$13 | `PPUScrollXShadow` / `PPUScrollYShadow` | $2005 shadows |
| $14/$16 | `ControllerRawState` / `Controller2RawState` | Raw serial pad bytes, ports 1/2 |
| $15/$17 | `ControllerFilteredState` / `Controller2FilteredState` | Filtered pad bytes, ports 1/2 |
| $18–$1F | `RandomLfsr0`–`RandomLfsr7` | 8-byte pseudo-random shift register |
| $20–$23 | `CollisionBounds0`–`CollisionBounds3` | Active collision bounds |
| $24–$27 | `BoundingBoxFlags` / `BoundingBoxCoord1–3` | Pending bounding box (queued tasks) |
| $2C/$2E | `PlayerVerticalFraction` / `PlayerVerticalPosition` | Player Y integration |
| $34–$38 | `SoundTimerDivider` / `SoundTimerArray` / `SharedActionTimer` / `PlayerSpriteVisibilityTimer` | Sound timers, shared timers |
| $39 | `GameStateTimer` | Attract/title countdown |
| $3A | `ObjectActiveArray` | Object active/hidden flags for sprite hiding |
| $3C | `ActionCooldown` | Object cooldown |
| $3E–$45 | `CollisionLeft/Top/Right/Bottom`, `CollisionMatchX/Y/Right/Bottom` | Collision results |
| $46 | `GameMode` | Current mode (0 = attract, 1 = gameplay) |
| $47 | `PendingGameMode` | Boot pending flag |
| $48 | `GameModeTimer` | Mode timer (attract/title countdowns) |
| $49 | `CurrentPlayerIndex` | Player selector |
| $4A | `StageOrScreenIndex` | Current stage (1-based) |
| $4B | `DifficultyOrRoundIndex` | Difficulty/round selector |
| $4C | `PlayerLivesOrModeCount` | Lives / mode count |
| $4D | `GameplaySubmode` | Gameplay submode selector |
| $4E | `TwoPlayerModeFlag` | 2-player selection |
| $4F–$51 | `DemoInputIndex` / `DemoInputTimer` / `DemoInputCode` | Attract-demo scripted input |
| $52–$53 | `TitleScreenInitialized` / `LevelObjectProgress` | Boot stage, level-object progress |
| $54–$57 | `PlayerInputDirection` / `PreviousInputDirection` / `PlayerPositionFraction` / `ObjectPositionFraction` | Input + fixed-point positions |
| $64–$6A | `BonusTickDivider` / `BonusCounter` / `DeathAnimation*` ($66/$67) / `PlayerCollisionResult` ($68) / `CollidingObjectOamOffset` ($69) / `StartButtonLatch` ($6A) | Bonus ticks, death animation, collision results |
| $6B–$70 | `PlayerState`, `PreviousPlayerState`, `PlayerFacing`, `PreviousPlayerFacing`, `PlayerClimbPhase`, `PlayerClimbDirection` | Player state machine + climbing |
| $71–$77 | `PlayerMovementSubstate`, `MovementCollisionCode`, `PlayerCollisionAnchor*` ($73/$74), `PlayerClimbOffset`, `PlayerStateReferenceY` ($76), `PlayerLandingTile` | Movement, collision anchors, landing |
| $78–$7E | `PlayerStatePhase` ($78), `PlayerStateTransitionActive` ($79), `PlayerVerticalSpeedInteger` ($7A), `PlayerFallThreshold` ($7B), `PlayerVerticalAcceleration` ($7C), `TitleInputRepeatTimer` ($7D), `PlayerStateCounter` ($7E) | State phase + vertical physics |
| $7F–$87 | `PlayerVerticalVelocityFraction` ($7F), `PlayerVerticalAcceleration*` ($82/$83), `PlayerGravity*` ($86/$87) | Vertical velocity/gravity fixed-point |
| $8C–$9F | `CarriedObjectActive` ($8C), `CollectibleSpriteTileArray` ($8D), `StageObjectDataPointer*` ($91–$93), `CollectedObject*` ($94–$9F) | Stage objects and collectibles |
| $A0–$BB | `StagePrimaryObjectCount`, `ObjectMotionStep` ($A1), `StageSecondaryObject*`, `EnemyStateArray` ($A3), `EnemyAlternateStateArray` ($A6), `EnemyDirectionArray` ($B4), `EnemySpawnDelayArray` ($B9), `Platform*` state ($AC–$BE), `StageSecondaryObjectCount` ($B0), `SpawnedEnemyCount` ($B1), `StageObjectMode` ($B2) | Stage-entity pools |
| $C3–$CF | `SpecialObjectIndex` ($C3), `SpecialObjectX` ($C4), `StageObjectAnimationMode` ($CE), `StageObjectOamOffset` ($CF) | Special objects |
| $D0–$E6 | `BonusSpriteActive` ($D0), `VramMetatileBuffer` ($D1), `StageRopeAddress*` ($DA/$DB), `PendingLevelObjectTask` ($E7) | VRAM buffers, ropes, level-object tasks |
| $E7–$EE | `DemoInputActive` ($E8), `GameplayInitializationPending` ($E9), `MovementFrameCounter` ($EA), `PauseActive` ($EB), `PreviousStartButtonState` ($EC), `TitleCursorY` ($ED), `PauseDebounceTimer` ($EE) | Flow/pause/title state |
| $EF | `SelectedPlayerMode` | Player-count selection from the title |
| $F0–$FE | `Pulse1Effect*` ($F0–$F2), `AudioEffectTimer` ($F3), `AudioPitchAccumulator` ($F4), `Triangle*` ($F5/$F6), `MusicDataPointer*` ($F7/$F8), `MusicNoisePosition` ($F9), `MusicPulsePosition` ($FA), `AudioLfoPhase` ($FB), `SoundRequestFlags` ($FC), `SecondarySoundRequestFlags` ($FD), `ObjectSoundRequestFlags` ($FE) | APU effects and music sequencer state |
| $FF | `GameplayEventFlags` | Shared gameplay event/request flags |
| $0100–$01FF | Scratch and object arrays | Object work area |
| $0200–$02FF | Shadow OAM | Cleared to $FF at reset; DMA'd every frame |
| $0300–$03FF | Deferred task / VRAM queue | Command-stream bytes and task dispatch slots ($0300 cursor, $0301 wrap index, $0302 entries×2, $0331 handoff pointer) |
| $0520+ | Stage object RAM | Object/config groups copied in via the `ObjectConfig*` tables |
| $0580–$05B5 | Per-mode record arrays | Attract/stage state records written by the title and attract sequences |
| $06A2, $05B4 | APU gate / startup delay flags | Sound enable gating used at title and gameplay entry |

A handful of bytes still carry deliberately neutral names (`Zp28`–`Zp5C`, `Zp58`–`Zp62`, `Zp80`–`ZpE6` members) where reuse across routines is suspected; the Pass 1 trace recorded 1,757 zero-page accesses across 186 distinct base addresses.

---

## 8. Code/Data Map

Pass-1 trace statistics (recorded during generation): **6,135 decoded instructions**, **12,358 classified code bytes**, **266 reachable routine entry points**, **68 referenced PRG data labels**, **0 overlapping-instruction conflicts**. As of the current Pass 3 source, every data region is emitted as explicit `.byte` data with its ROM provenance documented — no `.incbin` blocks remain.

| Region | Class | Size |
|--------|-------|------|
| $C000–$C66D | data (`DeferredTaskHandlerTable`, `HudDigitDescriptorTable`, `StagePlayerStartYTable`, `ObjectConfig*` tables, `StageBackgroundVramStreamPointerTable` at $C3BD) | 1,646 bytes |
| $C66E–$F137 | code (reset, NMI, mode dispatch, attract, title, gameplay) | 10,954 bytes |
| $F138–$F1AE | data (bounding-box overlap data) | 119 bytes |
| $F1AF–$F265 | code (sound timers, LFSR, controllers) | 183 bytes |
| $F266–$F91E | data (`TitleScreenVramCommandStream` at $F266, screen VRAM streams and stage data — 1,721 bytes) | 1,721 bytes |
| $F91F–$F957 | code (`UpdateAudioFrame`) | 57 bytes |
| $F958–$F959 | data | 2 bytes |
| $F95A–$F9F7 | code | 158 bytes |
| $F9F8–$FA63 | data | 108 bytes |
| $FA64–$FE50 | code (deferred task / VRAM queue engine, $EE39–$FE50) | 1,005 bytes |
| $FE51–$FFEF | data (`SoundEffectDataPointer*` $FE52–$FE53, `SoundEffectNoiseOffset` $FE54, `SoundEffectSequenceData` $FE55…) | 415 bytes |
| $FFF0–$FFFF | IRQ byte (reused by `DeferredTaskHandlerTable` entry 0) + filler + vectors | 16 bytes |

---

## Pass 3 data-table inventory

Every `.byte`/`.word` region in `prg.s` is listed here with what its bytes
are and the instruction in this dump that reads it.  A region that no
instruction operand lands in is recorded as **unreferenced data** with its
ROM provenance; a region whose record layout is not established says so
rather than being given a name it has not earned.

The Pass-1 tracer's `; ---- data $XXXX-$YYYY ----` markers are gone from this
source (the regions were hand-labelled and annotated), so the blocks below
were recovered from the emitted `.byte`/`.word` rows and their CPU
addresses; the consumers were found by resolving every operand - literal
**and** label - to an address.

| Address | Size | Name | Structure | Read by |
|---------|------|------|-----------|---------|
| `$C000-$C009` | 10 B | `DeferredTaskHandlerTable` | five little-endian 16-bit handler addresses `$F044, $F040, $F138, $EF50, $EEBB`. Entry 0 is deliberately addressed at the mirrored CPU address `$BFFE`, which is the IRQ vector word at PRG `$3FFE` - so the table's first entry is the IRQ vector itself. The dispatcher indexes the table with the **high nibble** of the queued task byte. | the dispatcher at `$EE3A` reads the table through the queued task's high nibble; the four handler words are the targets of the `jsr` instructions at `$F044`, `$F040`, `$F138`, `$EF50`, `$EEBB` |
| `$C00A-$C01D` | 20 B | `HudDigitDescriptorTable` | five 4-byte HUD digit descriptors: PPU address high, PPU address low, digit count / control, and a packed-digit source selector with flags - `$20,$6E,$06,$00`, `$20,$64,$06,$00`, `$20,$77,$06,$00`, `$20,$B7,$04,$00`, `$20,$B5,$01,$00`. | `lda HudDigitDescriptorTable,y` at `$EF69`, `$EF73`, `$EF7D` and `$EF98` (index = descriptor number x 4) |
| `$C01E-$C022` | 5 B | `StagePlayerStartYTable` | five player start Y positions `$50,$60,$70,$80,$80` (one per player slot / round). | `lda StagePlayerStartYTable,y` at `$C9ED` |
| `$C023` | 1 B | `ObjectConfigDifficultyStrideTable` | one stride byte `$07`; the loader multiplies it by the difficulty/round index to reach that difficulty's record. | `lda ObjectConfigDifficultyStrideTable,y` at `$CD25` |
| `$C024` | 1 B | `ObjectConfigDestinationEndIndexTable` | one byte `$07`: the exclusive X limit of the group copy into RAM at `$0520`. | `lda ObjectConfigDestinationEndIndexTable,y` at `$CD2A` |
| `$C025` | 1 B | `ObjectConfigDataPointerLoTable` | one byte `$B9`: the low byte of the source pointer of the indexed object-configuration group. | `lda ObjectConfigDataPointerLoTable,y` at `$CD2F` |
| `$C026-$C02E` | 9 B | `ObjectConfigDataPointerHiTable` | nine high bytes `$C0,$03,$02,$EF,$C0,$09,$08,$01,$C1`, the high halves of the same group pointers (`$C0B9`, `$03B9`, `$02B9`, `$EFB9`, `$C0B9`, `$09B9`, `$08B9`, `$01B9`, `$C1B9`). | `lda ObjectConfigDataPointerHiTable,y` at `$CD34` |
| `$C02F-$C08E` | 96 B | `StagePrimaryObjectConfigTable` | twelve 8-byte records, one per stage/difficulty group: `$02,$33,$40,$80,$90,$90,$A0,$10`, `$02,$33,$40,$80,$00,$90,$A0,$10`, `$02,$33,$40,$80,$90,$A0,$A4,$10`, `$02,$33,$40,$80,$00,$A0,$A4,$10`, `$03,$33,$40,$80,$90,$90,$A0,$10`, `$02,$33,$40,$80,$00,$A0,$A8,$10`, `$03,$50,$50,$90,$A0,$A0,$A0,$10`, `$03,$40,$43,$90,$00,$A0,$A0,$10`, `$04,$60,$60,$B0,$B0,$B0,$B0,$10`, `$04,$5C,$4E,$AC,$00,$B0,$B0,$10`, `$04,$70,$70,$D0,$C0,$C0,$C0,$10`, `$04,$80,$59,$D8,$00,$C0,$C0,$10`. The records come in pairs that differ only in the fifth byte (`$90` against `$00`); the field meanings beyond the record size are not established. | `lda StagePrimaryObjectConfigTable,y` at `$CCD5` and `$CCDD` |
| `$C08F-$C0B2` | 36 B | `StageSecondaryObjectConfigTable` | 36 bytes in the same 8-byte shape as the primary table (`$60,$D0,$B0,$A0,$B0,$C0,$70,$D8`, ...). The two tables are read by two copies of the same loader routine, so the secondary table supplies the second object group of each stage. | `lda StageSecondaryObjectConfigTable,y` at `$CCFA` |
| `$C0B3-$C0E2` | 48 B | `DifficultyObjectCountTable` | 48 bytes holding the per-difficulty object counts; the bytes alternate between a count and a flag, e.g. `$01,$00,$02,$01,$01,$00,$02,$80,$E0,$00,$02,$01,$00,$03,...`. The count is loaded with an X index. | `lda DifficultyObjectCountTable,x` at `$CC06` |
| `$C0E3` | 1 B | `StageFourPrimaryObjectCountByDifficulty` | one byte `$04`, selected with Y = difficulty/round index x 2 and stored in `StagePrimaryObjectCount`. | `lda StageFourPrimaryObjectCountByDifficulty,y` at `$CD11` |
| `$C0E4-$C0F3` | 16 B | `StageFourObjectOamBaseByDifficulty` | 16 bytes, interleaved pairs `$C0,$04,$E0,$04,$FF,$04,$FF,$05,$FF,$05,$FF,$02,$FF,$D0,$02,$D0,$E0,$03`; selected with Y = difficulty/round index x 2 and written to `$0540`. | `lda StageFourObjectOamBaseByDifficulty,y` at `$CD16` |
| `$C0F4-$C136` | 67 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$00F4-$0136`). The bytes repeat a five-byte shape (`..., $80,$F8,$01,$02, ...`) that looks like a fixed-stride command list rather than plain counters; the record size and field meanings are not established because no instruction in this dump reads it. | - |
| `$C137-$C146` | 16 B | `StageObjectParameterTable` | 16 per-object parameters `$84,$7C,$68,$88,$80,$6C,$8C,$00,$70,$50,$5B,$30,$2F,$35,$28,$31,$36,$29` - eight pairs that look like (tile, flag) per sprite type. | `lda StageObjectParameterTable,y` at `$CD5F` |
| `$C147-$C154` | 14 B | (second half of `StageObjectParameterTable`) | 14 more parameters `$10,$04,$10,$A7,$00,$DD,$2D,$00,$26,$30,$00,$28,$08,$C7`. | - |
| `$C155` | 1 B | `StageSpriteLayoutPointerLo` | one byte, the low half of the sprite-layout pointer. | `lda StageSpriteLayoutPointerLo,x` at `$CC58` |
| `$C156-$C15E` | 9 B | `StageSpriteLayoutPointerHi` | nine bytes `$C7,$08,$B7,$08,$C7,$1B,$C7,$70,$C7`, the high halves of the same pointers (`$C708`, `$C7B7`, `$C708`, `$C71B`, `$C770`, ...). | `lda StageSpriteLayoutPointerHi,x` at `$CC5D` |
| `$C15F` | 1 B | `ObjectLayoutXTable` | byte 0 of each 5-byte static object-layout record: the sprite-grid X coordinate. | `lda ObjectLayoutXTable,y` at `$CC98` |
| `$C160` | 1 B | `ObjectLayoutYTable` | byte 1 of the same 5-byte record: the sprite-grid Y coordinate. | `lda ObjectLayoutYTable,y` at `$CC9D` |
| `$C161` | 1 B | `ObjectLayoutTileIndexTable` | byte 2 of the same 5-byte record: the initial CHR tile index. | `lda ObjectLayoutTileIndexTable,y` at `$CCA2` |
| `$C162` | 1 B | `ObjectLayoutDimensionsTable` | byte 3 of the same 5-byte record: packed grid dimensions - the high nibble is the column count and the low nibble the row count. | `lda ObjectLayoutDimensionsTable,y` at `$CCA7` |
| `$C163-$C172` | 16 B | `ObjectLayoutOamOffsetTable` | byte 4 of each 5-byte static object-layout record: the low byte of the destination pointer in shadow OAM (`$3F,$58,$12,$C0,$A0,$3F,$58,$12,$C8,$CD,$7F,$58,$12,$D0,$30,$37,$58,$12,$D8`); the renderer supplies page `$02` as the high byte. | `lda ObjectLayoutOamOffsetTable,y` at `$CCAC` |
| `$C173-$C1C7` | 85 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$0173-$01C7`): the bytes hold CPU code addresses (`$B7C8`, `$8F58`, `$12C0`, `$8ECD`, `$7F58`, `$12D0`, ...) that are not reached from any entry point in this dump. | - |
| `$C1C8` | 1 B | `StageInitializerTypeTable` | one byte, the type of the stage initializer record. | `lda StageInitializerTypeTable,x` at `$CB87` |
| `$C1C9` | 1 B | `StageInitializerParamTable` | one byte, the parameter of the stage initializer record. | `lda StageInitializerParamTable,x` at `$CB90` |
| `$C1CA-$C1D9` | 16 B | `StageInitializerValueTable` | 16 bytes, the values written by the stage initializer records (`$C0,$03,$08,$E0,$FF,$03,$10,$40,$03,$01,$0C,$02,$08,$A0,$02,$04,$90,$03,$04,$C0,$FF,$02,$18,$40,$03,$18,$A0,$FF,$02,$18`). | `lda StageInitializerValueTable,x` at `$CB95` |
| `$C1DA-$C1F8` | 31 B | (second half of `StageInitializerValueTable`) | 31 more initializer values, the last group ending with `$14,$0F,$01,$36,$05`. | - |
| `$C1F9` | 1 B | `StageObjectReferenceYTable` | one byte, the Y coordinate an object is compared against. | `cmp StageObjectReferenceYTable,x` at `$E51A`, `lda StageObjectReferenceYTable,x` at `$E521` and `$E535` |
| `$C1FA` | 1 B | `StageObjectLeftBoundaryTable` | one byte, the object's left boundary. | `cmp StageObjectLeftBoundaryTable,x` at `$E54A` |
| `$C1FB-$C20A` | 16 B | `StageObjectRightBoundaryTable` | 16 bytes, the right boundary of each stage's objects. | `cmp StageObjectRightBoundaryTable,x` at `$E54F` |
| `$C20B-$C214` | 10 B | `SpecialObjectXTriggerTable` | 10 bytes, the X position at which each special object triggers (`$BF,$C1,$78,$31,$2F,$A0,$C0,$C1,$C8,$30`). | `lda SpecialObjectXTriggerTable,y` at `$E7E3` |
| `$C215` | 1 B | `StageCollisionRecordPointerTable` | one byte, the low half of an interleaved pointer to a stage collision record. | `lda StageCollisionRecordPointerTable,x` at `$E504` |
| `$C216-$C225` | 16 B | `StageCollisionRecordPointerHighBytes` | 16 bytes, the high halves of the same pointers (`$31,$A0,$C0,$C1,$C8,$30,$31,$A0,$C0,$C1,$C8,$30,$31,$B4,$94,$5C`). | `lda StageCollisionRecordPointerHighBytes,x` at `$E509` |
| `$C226-$C2C0` | 155 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$0226-$02C0`). The bytes are CPU code addresses (`$C231`, `$C236`, `$C23B`, `$C23A`, `$C32B`) and sprite data; no instruction in this dump reads them. | - |
| `$C2C1-$C2C6` | 6 B | `RopeInitialLowBytes` | six bytes `$20,$50,$68,$80,$98,$C8` - the low bytes of the six rope/vine start addresses. | `lda RopeInitialLowBytes,y` at `$CC44` |
| `$C2C7-$C2CC` | 6 B | `RopeInitialHighBytes` | six bytes `$C4,$CA,$CD,$D0,$D3,$D9` - the matching high bytes. | `lda RopeInitialHighBytes,y` at `$CC4A` |
| `$C2CD-$C2DC` | 16 B | `StageCollectibleSpriteTiles` | 16 bytes, the CHR tile index of each collectable (the fruit). | `lda StageCollectibleSpriteTiles,y` at `$CAE6` |
| `$C2DD-$C2E4` | 8 B | (second half of `StageCollectibleSpriteTiles`) | 8 more tile indices `$02,$00,$02,$02,$02,$00,$02,$00`. | - |
| `$C2E5-$C2EC` | 8 B | `CollectedObjectVramXTable` | 8 bytes, the X position on the nametable where the collected-object counter is written. | `lda CollectedObjectVramXTable,x` at `$DA02` |
| `$C2ED` | 1 B | `CollectedObjectVramAddressLo` | one byte, the low byte of that nametable address. | `lda CollectedObjectVramAddressLo,x` at `$D9E1` |
| `$C2EE-$C2FD` | 16 B | `CollectedObjectVramAddressHi` | 16 bytes, the high bytes of the same addresses (`$21,$4C,$21,$51,$22,$93,$21,$45,$21,$4A,$21,$D3,$21,$00,$00,$8C`). | `lda CollectedObjectVramAddressHi,x` at `$D9E6` |
| `$C2FE-$C308` | 11 B | (second half of `CollectedObjectVramAddressHi`) | 11 more address high bytes. | - |
| `$C309` | 1 B | `StageObjectDataPointerLo` | one byte, the low half of an interleaved pointer to a stage's object data. | `lda StageObjectDataPointerLo,x` at `$CAC1` |
| `$C30A-$C319` | 16 B | `StageObjectDataPointerHi` | 16 bytes, the high halves of the same pointers (`$C7,$08,$B7,$08,$C7,$1B,$C7,$70,$C7,$38,$8F,$58,$12,$C0,$A0,$3F`). | `lda StageObjectDataPointerHi,x` at `$CAC6` |
| `$C31A-$C368` | 79 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$031A-$0368`). | - |
| `$C369` | 1 B | `PlayerPoseCollisionShapePointerTable` | one byte, the low half of an interleaved pointer to a player-pose collision shape. | `lda PlayerPoseCollisionShapePointerTable,x` at `$D2E4` |
| `$C36A-$C379` | 16 B | `PlayerPoseCollisionShapePointerHighBytes` | 16 bytes, the high halves of the same pointers (`$12,$C8,$CD,$7F,$58,$12,$D0,$30,$37,$58,$12,$D8,...`). | `lda PlayerPoseCollisionShapePointerHighBytes,x` at `$D2E9` |
| `$C37A-$C3BC` | 67 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$037A-$03BC`). | - |
| `$C3BD` | 1 B | `StageBackgroundVramStreamPointerTable` | one byte, the low half of an interleaved pointer to a stage's background VRAM stream. | `lda StageBackgroundVramStreamPointerTable,x` at `$C993` |
| `$C3BE-$C3CD` | 16 B | `StageBackgroundVramStreamPointerHighBytes` | 16 bytes, the high halves of the same pointers (`$30,$31,$A0,$C0,$C1,$C8,$30,$31,$A0,$C0,$C1,$C8,$30,$31,$B4,$94`). | `lda StageBackgroundVramStreamPointerHighBytes,x` at `$C998` |
| `$C3CE-$C3F3` | 38 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$03CE-$03F3`). | - |
| `$C3F4-$C403` | 16 B | `PlayerSelectVramCommandStream` | 16 bytes of VRAM command data (`$23,$DB,$42,$50,$21,$CA,$4C,$24,$21,$EA,$0C,$24,$24,$19,$15,$0A`) - the stream that paints the one-player / two-players screen. | `lda PlayerSelectVramCommandStream,y` at `$CA48` |
| `$C404-$C40B` | 8 B | (second half of `PlayerSelectVramCommandStream`) | 8 more command bytes `$22,$0E,$1B,$24,$C0,$24,$24,$00`. | - |
| `$C40C-$C41B` | 16 B | `TwoPlayerVramCommandStream` | 16 bytes of VRAM command data for the two-player screen. | `lda TwoPlayerVramCommandStream,y` at `$CA60` |
| `$C41C-$C43F` | 36 B | (second half of `TwoPlayerVramCommandStream`) | 36 more command bytes. | - |
| `$C440` | 1 B | `StageCollisionQueryPointerTable` | one byte, the low half of an interleaved pointer to a stage collision query. | `lda StageCollisionQueryPointerTable,x` at `$E980` |
| `$C441-$C447` | 7 B | `StageCollisionQueryPointerHighBytes` | seven bytes, the high halves of the same pointers. | `lda StageCollisionQueryPointerHighBytes,x` at `$E985` |
| `$C448` | 1 B | `PlayerStateCollisionListPointerTable` | one byte, the low half of an interleaved pointer to a player-state collision list. | `lda PlayerStateCollisionListPointerTable,x` at `$E8E2` |
| `$C449-$C44F` | 7 B | `PlayerStateCollisionListPointerHighBytes` | seven bytes, the high halves of the same pointers. | `lda PlayerStateCollisionListPointerHighBytes,x` at `$E8E7` |
| `$C450` | 1 B | `AlternateCollisionListPointerTable` | one byte, the low half of an interleaved pointer to the alternate collision list. | `lda AlternateCollisionListPointerTable,x` at `$E92E` |
| `$C451-$C460` | 16 B | `AlternateCollisionListPointerHighBytes` | 16 bytes, the high halves of the same pointers. | `lda AlternateCollisionListPointerHighBytes,x` at `$E933` |
| `$C461-$C484` | 36 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$0461-$0484`). | - |
| `$C485-$C494` | 16 B | `StageEnemyOamTemplateA` | 16 bytes, the first enemy OAM template: `$40,$28,$5F,$28,$40,$40,$A3,$40,$BD,$40,$CF,$40,$00,$C8,$2D,$C8` - four 4-byte OAM records (Y, tile, attribute, X). | `lda StageEnemyOamTemplateA,y` at `$CBE2` |
| `$C495-$C500` | 108 B | (second half of `StageEnemyOamTemplateA`) | 108 more bytes of the same 4-byte OAM record shape. | - |
| `$C501-$C510` | 16 B | `StageEnemyOamTemplateB` | 16 bytes, the second enemy OAM template. | `lda StageEnemyOamTemplateB,y` at `$CBE8` |
| `$C511-$C5A0` | 144 B | (second half of `StageEnemyOamTemplateB`) | 144 more bytes of the same 4-byte OAM record shape. | - |
| `$C5A1-$C5B0` | 16 B | `StageEnemyOamTemplateC` | 16 bytes, the third enemy OAM template. | `lda StageEnemyOamTemplateC,y` at `$CBEE` |
| `$C5B1-$C613` | 99 B | (second half of `StageEnemyOamTemplateC`) | 99 more bytes of the same 4-byte OAM record shape. | - |
| `$C614-$C61A` | 7 B | `TwoTileObjectTileTable` | 7 bytes `$F1,$F2,$5E,$F3,$F4,$F5,$F6` - the tile indices of the two-tile objects. | `lda TwoTileObjectTileTable,x` at `$EC5C` |
| `$C61B-$C621` | 7 B | `ObjectTaskPayloadByIndex` | 7 bytes `$01,$02,$03,$04,$08,$12,$16` - the payload byte of each queued object task. | `lda ObjectTaskPayloadByIndex,x` at `$EC92` |
| `$C622` | 1 B | `SpawnedObjectCollisionShapePointerTable` | one byte, the low half of an interleaved pointer to a spawned object's collision shape. | `lda SpawnedObjectCollisionShapePointerTable,x` at `$ECDC` |
| `$C623-$C62D` | 11 B | `SpawnedObjectCollisionShapePointerHighBytes` | 11 bytes, the high halves of the same pointers (`$26,$C6,$2A,$C6,$19,$0F,$1B,$21,$04,$0F,$06`). | `lda SpawnedObjectCollisionShapePointerHighBytes,x` at `$ECE1` |
| `$C62E-$C63D` | 16 B | `DemoInputCodeTable` | 16 bytes of demo-mode input codes (`$00,$05,$00,$01,$04,$01,$04,$01,$04,$02,$04,$05,$00,$02,$04,$05`). | `lda DemoInputCodeTable,y` in the demo playback path |
| `$C63E-$C64D` | 16 B | (second half of `DemoInputCodeTable`) | 16 more demo input codes. | - |
| `$C64E-$C65D` | 16 B | `DemoInputDurationTable` | 16 bytes, the number of frames each demo input code is held (`$2D,$01,$2D,$2D,$03,$96,$02,$0F,$1E,$1E,$1F,$01,$2D,$7E,$06,$01`). | `lda DemoInputDurationTable,y` in the demo playback path |
| `$C65E-$C66D` | 16 B | (second half of `DemoInputDurationTable`) | 16 more durations. | - |
| `$F266-$F38D` | 296 B | (the stage VRAM streams) | the first of the per-stage background VRAM command streams; each stream is a run of VRAM write commands (PPU address high, PPU address low, tile bytes) and ends with a terminator. | `FlushQueuedVramCommands` at `$EE9C` drains the queue the stage streams are loaded into |
| `$F38E-$F39D` | 16 B | `VinesStageVramCommandStream` | the header of the Vines stage's background stream. | `FlushQueuedVramCommands` at `$EE9C` |
| `$F39E-$F4ED` | 336 B | (the Vines stage stream) | the rest of the Vines stage background stream. | - |
| `$F4EE-$F4F4` | 7 B | `ChainsStageVramCommandStream` | the header of the Chains stage's background stream. | `FlushQueuedVramCommands` at `$EE9C` |
| `$F4F5-$F646` | 338 B | (the Chains stage stream) | the rest of the Chains stage background stream. | - |
| `$F647-$F64D` | 7 B | `MariosHideoutVramCommandStream` | the header of Mario's hideout stage background stream. | `FlushQueuedVramCommands` at `$EE9C` |
| `$F64E-$F76B` | 286 B | (the hideout stage stream) | the rest of the hideout stage background stream. | - |
| `$F76C-$F772` | 7 B | `SpringboardStageVramCommandStream` | the header of the Springboard stage background stream. | `FlushQueuedVramCommands` at `$EE9C` |
| `$F773-$F8B5` | 323 B | (the Springboard stage stream) | the rest of the Springboard stage background stream. | - |
| `$F8B6-$F8B9` | 4 B | `CommonStageStatusVramCommandStream` | the four-byte status-line stream shared by every stage. | `FlushQueuedVramCommands` at `$EE9C` |
| `$F8BA-$F90D` | 84 B | (the common status stream) | the rest of the shared status stream. | - |
| `$F90E-$F91D` | 16 B | `UnusedVramDataPadding` | 16 bytes of padding at the end of the stage data area; the bytes are a repeated `$80,$F8` shape that no stage stream reaches. | - |
| `$F91E` | 1 B | (unreferenced) | Unreferenced data (ROM provenance PRG `$391E`): one filler byte between the stage data and the audio code. | - |
| `$F9F8-$F9FF` | 8 B | (head of the audio tables) | `$85,$84,$84,$84,$84,$8C,$8C,$8C` - the first APU period bytes of the note table. | `UpdateAudioFrame` at `$F91F` |
| `$FA00` | 1 B | `ApuPeriodHighTable` | one byte `$00`, the high half of the APU period of the first note. | `UpdateAudioFrame` at `$F91F` |
| `$FA01-$FA10` | 16 B | `ApuPeriodLowTable` | 16 bytes `$00,$00,$00,$69,$00,$D4,$00,$BD,$00,$A8,$00,$9F,$00,$96,$00` - the low halves of the APU periods. | `UpdateAudioFrame` at `$F91F` |
| `$FA11-$FA4D` | 61 B | (rest of the audio tables) | the remainder of the note/period data. | `UpdateAudioFrame` at `$F91F` |
| `$FA4E-$FA5C` | 15 B | `AudioPitchModulationTable` | 15 bytes `$05,$0A,$14,$28,$50,$1E,$3C,$06,$0C,$18,$30,$28,$24,$10,$04` - two doubling pitch-step sequences. | `UpdateAudioFrame` at `$F91F` |
| `$FA5D-$FA63` | 7 B | `AudioDurationTable` | 7 bytes `$08,$0A,$14,$03,$07,$08,$10` - the note durations. | `UpdateAudioFrame` at `$F91F` |
| `$FE51` | 1 B | (head of the sound-effect data) | `$08` - the first byte of the sound-effect descriptor block. | `UpdateAudioFrame` at `$F91F` |
| `$FE52` | 1 B | `SoundEffectDataPointerLo` | one byte, the low half of the sound-effect data pointer. | `lda SoundEffectDataPointerLo,y` in the sound-effect path |
| `$FE53` | 1 B | `SoundEffectDataPointerHi` | one byte, the high half of the sound-effect data pointer. | `lda SoundEffectDataPointerHi,y` in the sound-effect path |
| `$FE54` | 1 B | `SoundEffectNoiseOffset` | one byte, the offset of the sound effect inside the noise channel's data. | `lda SoundEffectNoiseOffset,y` in the sound-effect path |
| `$FE55-$FE64` | 16 B | `SoundEffectSequenceData` | 16 bytes, the start of the sound-effect sequence data (`$16,$00,$00,$A1,$FE,$11,$00,$00,$C3,...`). | `UpdateAudioFrame` at `$F91F` |
| `$FE65-$FFB6` | 338 B | (rest of the sound-effect data) | the remainder of the sound-effect sequences. | `UpdateAudioFrame` at `$F91F` |
| `$FFB7-$FFC6` | 16 B | `TriangleSequenceStartOffsets` | 16 bytes, the start offsets of the sixteen triangle-channel sequences (`$00,$00,$00,$00,$13,$2E,$9F,$99,$95,$59,$9F,$9F,$59,$95,$99,$A3`). | `UpdateAudioFrame` at `$F91F` |
| `$FFC7-$FFEF` | 41 B | (rest of the sound-effect data) | the remainder of the sound-effect data. | `UpdateAudioFrame` at `$F91F` |
| `$FFF1-$FFF4` | 4 B | `UnreferencedVectorTailRectangleBytes` | 4 bytes `$0C,$0C,$0C,$0C` - the rectangle bytes the game keeps in the tail of the PRG; no instruction in the dump reads them. | - |
| `$FFF5-$FFF9` | 5 B | `UnreferencedVectorTailSentinelBytes` | 5 bytes `$0A,$08,$00,$FF,$FF` - the sentinel bytes in front of the vectors; unreferenced. | - |
| `$FFFA-$FFFF` | 6 B | `VectorTable` | NMI `$C6E6`, RESET `$C66E`, IRQ - the IRQ word at `$FFFE` is deliberately the same word that `DeferredTaskHandlerTable` entry 0 addresses at the mirrored address `$BFFE`. | the CPU's own vector fetch |

### Notes on the inventory

* The 1,646-byte table area at `$C000-$C66D` is a flat run of small
  tables, not one table: the loader at `$CC00-$CD80` walks it with a
  handful of distinct strides (5, 8, 16), which is why so many of the
  tables above are one, two or sixteen bytes long.
* Many of the tables come in pairs - a one-byte "low" table and a 7-16
  byte "high" table - because the ROM stores its 16-bit pointers in two
  parallel byte arrays, so that the low byte can be indexed with
  `lda table,x` and the high byte with `lda table,y`.
* The stage VRAM streams at `$F266-$F8B5` are consumed by the deferred
  VRAM queue at `$EE9C`, not by a `lda` operand; that is why they show no
  direct reader.

---

## 9. Summary of Execution Flow

```
Power On / Reset
    │
    ▼
ResetHandler ($C66E) ──── sei, clear RAM, init PPU/shadow OAM, arm attract
    │
    ▼
enable $2000 bit 7 (NMI on)
    │
    ▼
Idle loop $C6B0 ────────► AdvanceRandomLfsr, forever   (reset path never returns)
                                                        (all action is in NMI)

NMI ($C6E6) [once per frame]
    ├─ push A/X/Y + $00–$07 save
    ├─ PerformOamDma ($EEB0) + FlushQueuedVramCommands ($EE9C)
    ├─ WriteInvertedRenderingMask ($CA7A) + UpdateAudioFrame ($F91F)
    ├─ ReadControllers ($F219)
    ├─ Mode dispatch ─┬─ PendingGameMode → UpdateTitleScreenAndStartSelection ($C773)
    │                 │                      / UpdateGameModeTransition ($C897)
    │                 ├─ GameMode == 0  → UpdateAttractModeState ($C932)  ─┐
    │                 └─ GameMode != 0  → UpdateGameplayFrame ($CD6E)      │
    │                                        / UpdateStageTransition ($CFC1) │
    ├─ ProcessQueuedTask ($EE3A) ──► DeferredTaskHandlerTable ($C000)      │
    └─ restore CPU/ram state, rti                                          │
                                                                           │
     InitializeGameplayRam ($CA82) at GameStateTimer ($39) = $68 ◄──────────┘
         │
         ▼
     GameMode = 1; NMI dispatches gameplay chains per GameplaySubmode
         (player state machine on $6B, collision bounds, stage entities,
          deferred task queue, DispatchPlayerState/ProcessStageCollisions)
```

---

## 10. Notes on Provisional Areas

- **Status:** Pass 3 — all 1,035 top-level labels (`ResetHandler`, `NmiHandler`, `UpdateGameplayFrame`, `UpdateStageTransition`, `ProcessQueuedTask`, `DeferredTaskHandlerTable`, state tables, etc.) carry semantic names, and all data regions are explicit `.byte` blocks with Pass 3 structure annotations. Remaining `ZpXX` names are deliberate (routine-reused scratch), documented in §7.
- **Data tables:** every data block in the PRG has now been interpreted and recorded in the **Pass 3 data-table inventory** below — what the bytes are, the record size, and the instruction in this dump that reads them. The blocks no instruction reads are listed there as unreferenced data with their ROM provenance.
- **IRQ / deferred-task quirk:** The table entry 0 at mirrored $BFFE reuses the IRQ-vector word; the $FFF0 `asl a` byte is a table addressing artifact, not a real handler (see §3 and §6.1).
- **Remaining unknowns:** the detailed semantics of the `ObjectConfig*` per-difficulty groups copied into $0520+ RAM, the exact music-sequence encoding inside the $F266/$F95A data streams, and a few still-neutral `ZpXX` scratch bytes.  The data-table inventory records which blocks still have an unestablished record layout.

Build verification:

```bash
cd "/home/tmerritt/Projects/disassembly/Donkey Kong Jr. (JU)/copilot"
make              # builds reconstructed.nes, then cmp against rom.nes → "Byte-identical ROM verified."
```

The rebuild is **byte-identical** to `rom.nes` (ROM SHA-256 at the top of this document). The Pass-1 source verifier (`verify_pass1.py`, which re-decoded every annotated instruction byte and re-hashed the full 24,592-byte ROM against `rom.nes`) passed during generation but was not carried into `copilot/`.

## Power-on flow analysis

Derived from the disassembly by `_tools/derive_poweron.py`; the call graph is walked from the reset entry.