# Millipede (U) — Game Flow from Power-On

This document describes the execution flow of the disassembled Millipede (U) PRG bank (16 KB, mapped at CPU **$C000–$FFFF**), starting from power-on. It is based entirely on `copilot/prg.s` in the repository. The rebuild is verified **byte-identical** to the original `prg.bin` at the PRG level.

---

## 1. Reset Vector — CPU $FFFC → $C735

**`Reset`** ($C735–$C7B3)

On power-on or reset, the 6502 jumps to **$C735** (non-$C000 entry, Donkey Kong Jr. style). The reset routine performs cold-start hardware initialization:

| Step | Code | Purpose |
|------|------|---------|
| 1–2 | `sei` / `cld` | Disable interrupts, clear decimal mode |
| 3–4 | `lda #$00` / `sta $2000` | PPUCTRL = 0 (NMI off, sprite $0000, BG $0000) |
| 5–6 | `ldx #$FF` / `txs` | Initialize stack pointer to $01FF |
| 7–11 | `Label_C73F`: poll `$2002` via `and #$80` / `beq` | Wait for VBlank (bit 7 of PPUSTATUS) |
| 12–13 | `ldy #$06` / `sty Zp01` / `ldy #$00` / `sty Zp00` | Zp00/Zp01 = $0600 (RAM clear pointer) |
| 14 | `tya` | A = 0 |
| 15–19 | `Label_C74F`: `sta (Zp00),y` / `dey` / `bne` / `dec Zp01` / `bpl` | Clear $0000–$05FF (6 pages) |
| 20 | `jsr $C76A` | Initialize object state at $03D0–$03F8 |
| 21 | `lda Zp10` / `ora #$80` / `sta $2000` / `sta Zp10` | PPUCTRL |= $80 (NMI on) + shadow in Zp10 |
| 22 | `Label_C764`: `jsr $F09B` / `jmp $C764` | Infinite loop: audio init? (waits for NMI) |

**`$C76A` (Label_C76A)** — Object initialization:
```
    ldx #$29 / lda #$24
Label_C76E:
    sta $03D0,x   ; clear $03D0–$03F9 (42 bytes)
    dex / bne Label_C76E
    ldx #$00
Label_C776:
    lda $C271,x / sta $03DF,x   ; copy 6 bytes from $C271 to $03DF
    inx / cpx #$06 / bne Label_C776
    lda #$2C / sta $03D0
    lda #$2D / sta $03E6
    lda #$24 / sta $03E9
    lda #$16 / sta $03F2
    lda #$D0 / sta $03F5–$03F8
    lda #$00 / sta $4011 (APUDMCDIRECT)
    lda #$06 / sta $2001 (PPUMASK: show BG)
    jsr $C7E6 / jsr $C7CA
    jmp $C7B6
```

**`$C7B6` (Label_C7B6)** — Clear score/timer:
```
    lda #$00 / sta $0330 / sta $0331
```

Then enters main loop at **`$C7BE`**.

---

## 2. Main Loop — `$C7BE` onward

```
Label_C7BE:
    jsr $C7E0
    lda Zp10 / and #$E7 / sta Zp10     ; clear bits 3,4,5 of PPUCTRL shadow
    ... (main game loop continues)
```

The main loop runs continuously, synchronized with NMI via Zp10/Zp11 flags.

---

## 3. Interrupt Vectors — CPU $FFFA–$FFFF

Located at PRG offset $3FFA (end of 16 KB bank):

| Vector | Address | Handler |
|--------|---------|---------|
| NMI | $C7F1 | `NmiHandler` |
| RESET | $C735 | `Reset` |
| IRQ | $FFF0 | Unused (lands in vector-page padding) |

---

## 4. NMI / Frame Heartbeat — `NmiHandler` ($C7F1)

The NMI fires once per frame and drives the frame pacing:

```
NmiHandler ($C7F1):
    lda #$00 / sta $4016                   ; controller strobe
    lda Zp10 ($10) / and #$7F / sta $2000 / sta Zp10  ; PPUCTRL &= ~$80 (NMI off during frame)
    lda Zp11 ($11) / eor #$1A / sta $2001           ; PPUMASK ^= $1A (toggle bits)
    jsr $EF4A                              ; sprite/OAM update
    jsr $EF36                              ; PPU/scroll update
    lda $0396 / bne Label_C819             ; check state
    lda $0397 / bne Label_C819
    jsr $F085                              ; attract mode audio
Label_C819:
    jsr $F9A0                              ; gameplay audio
    jsr $F0BC                              ; sound effects
    lda Zp43 ($43)
    bne Label_C827
    lda #$FF / sta Zp43                    ; init Zp43 = $FF
Label_C827:
    lda Zp60 ($60)                         ; game state
    beq Label_C843                         ; 0: title/attract
    cmp #$01 / beq Label_C849              ; 1: gameplay
    cmp #$02 / beq Label_C83D              ; 2: bonus/stage clear
    jsr $D3F1 / lda #$00 / sta Zp77 / jmp $C84C  ; 3+: other
Label_C83D:
    jsr $CCD7 / jmp $C84C                  ; state 2
Label_C843:
    jsr $C865 / jmp $C84C                  ; state 0
Label_C849:
    jsr $CA31                              ; state 1
Label_C84C:
    ... (common NMI exit)
```

**NMI State Machine (Zp60 / $60):**
- **0 (Title/Attract):** `$C865` — attract mode logic
- **1 (Gameplay):** `$CA31` — main gameplay update
- **2 (Bonus/Transition):** `$CCD7` — stage clear, bonus
- **3+ (Other):** `$D3F1` — game over, high score, etc.

**Key NMI Operations:**
1. Controller strobe (`$4016`)
2. PPUCTRL/PPUMASK update (Zp10/Zp11 shadows)
3. Sprite/OAM update (`$EF4A`)
4. PPU/Scroll update (`$EF36`)
5. Audio engine (`$F9A0` gameplay, `$F085` attract, `$F0BC` SFX)
6. Game state dispatch via Zp60

---

## 5. Key Subsystems

### 5.1 Sprite/OAM System — `$EF4A` / `$EF36`
- `$EF4A`: Builds OAM at $0200 from object arrays
- `$EF36`: PPU scroll/register updates

### 5.2 Audio Engine
- **Attract:** `$F085` (called when $0396/$0397 set)
- **Gameplay:** `$F9A0` (music), `$F0BC` (sound effects)
- APU registers at $4000–$4013

### 5.3 Gameplay Logic — `$CA31` / `$CCD7` / `$D3F1` / `$C865`
- `$CA31`: Main gameplay (player, millipede, enemies, collision)
- `$CCD7`: Stage clear / bonus round
- `$D3F1`: Game over / high score
- `$C865`: Attract mode demo

### 5.4 Object State — $03D0+ region
- `$03D0–$03F8`: Initialized at reset from $C271 table
- `$0330–$0331`: Score/timer
- `$0396–$0397`: Attract mode flags
- `$03F5–$03F8`: Player position/state

### 5.5 Indirect Dispatch — `$EF15` (`jmp ($0002)`)
`jmp ($0002)` at $EF15 — target address in ZP $0002/$0003, set by caller. Not followed statically.

---

## 6. Memory Map (Key Zero Page / RAM)

| Address | Name | Use |
|---------|------|-----|
| $00–$01 | `Zp00`/`Zp01` | 16-bit pointer (RAM clear) |
| $02–$03 | `Zp02`/`Zp03` | Indirect dispatch pointer (`jmp ($0002)`) |
| $10 | `Zp10` | PPUCTRL shadow (bit 7 = NMI enable) |
| $11 | `Zp11` | PPUMASK shadow (toggled via EOR #$1A) |
| $43 | `Zp43` | Audio state (init $FF) |
| $60 | `Zp60` | Game state (0=attract, 1=play, 2=bonus, 3+=other) |
| $77 | `Zp77` | Gameplay sub-state |
| $0330–$0331 | Score/Timer | Cleared at $C7B6 |
| $0396–$0397 | Attract flags | Checked in NMI for audio path |
| $03D0–$03F8 | Object init state | Copied from $C271 at reset |
| $03DF–$03E4 | Object params | 6 bytes from $C271 |
| $03F5–$03F8 | Player state | Initialized to $D0 |
| $4011 | APUDMCDIRECT | DMC direct load (silenced at reset) |
| $4016 | JOY1 | Controller strobe (NMI) |

---

## 7. Data Tables

Every data block in the PRG is listed in the **Pass 3 data-table inventory**
(section 10).  The short version:

| Table | Address | Description |
|-------|---------|-------------|
| Gameplay data region | $C000–$C734 (`GameplayDataTables`) | the game's static data tables — masks, spawn parameters, HUD template, sound destinations |
| Object init data | $C271 (`ObjectInitParameterTable`) | 6 bytes copied to $03DF at reset |
| Direction bit masks | $C04A (`DirectionBitMaskTable`) | 8 single-bit masks, 01 02 04 08 10 20 40 80 |
| HUD sprite template | $C27B (`HudSpriteTemplate`) | 13 pairs of (CHR tile, OAM attribute), copied to $0330 |
| Sound destinations | $C295 (`SoundSequenceDestAddressTable`) | 16-bit RAM destination addresses, one per effect |
| Music / effect data | $F24F (`MusicSequenceData`) | the sound engine's note and sequence data |
| Sound channel table | $FE61 (`SoundChannelTable`) | one note base and four parameters per channel |
| Vector page | $FFFA–$FFFF | NMI $C7F1, RESET $C735, IRQ $FFF0 |

**Note:** the region $C000–$C734 (1845 bytes) is classified as `.byte` data but is
heavily referenced by code (93+ references from `lda $Cxxx,x`, `bit $Cxxx`
instructions).  It is not a level map: it is a bundle of small, independent
tables that the tracer could not separate.  Section 10 splits it into the
groups that do have a consumer and records the rest.

---

## 8. Summary of Execution Flow

```
Power On / Reset
    │
    ▼
Reset ($C735) ────► sei/cld, PPUCTRL=0, stack=$FF
    │
    ├─ Wait VBlank (poll $2002 bit 7)
    │
    ├─ Clear $0000–$05FF (6 pages via Zp00/Zp01)
    │
    ├─ jsr $C76A:
    │     Clear $03D0–$03F9
    │     Copy $C271→$03DF (6 bytes)
    │     Init $03D0=$2C, $03E6=$2D, $03E9=$24, $03F2=$16
    │     $03F5–$03F8 = $D0
    │     APUDMCDIRECT=0, PPUMASK=$06
    │     jsr $C7E6, $C7CA
    │
    ├─ PPUCTRL |= $80 (NMI on) → Zp10
    │
    ▼
Label_C764: jsr $F09B / jmp $C764  (wait for first NMI)
    │
    ▼ (NMI fires)

NMI ($C7F1) [once per frame]
    ├─ Controller strobe ($4016)
    ├─ Zp10 &= $7F → PPUCTRL (NMI off during frame)
    ├─ Zp11 ^= $1A → PPUMASK (toggle bits 1,3,4)
    ├─ jsr $EF4A (sprite/OAM update)
    ├─ jsr $EF36 (PPU/scroll update)
    ├─ Check $0396/$0397 → attract audio ($F085) if set
    ├─ jsr $F9A0 (gameplay audio)
    ├─ jsr $F0BC (sound effects)
    ├─ Zp43 init ($FF) if zero
    ├─ Dispatch on Zp60 ($60):
    │     0: jsr $C865 (attract) → $C84C
    │     1: jsr $CA31 (gameplay) → $C84C
    │     2: jsr $CCD7 (bonus) → $C84C
    │     3+: jsr $D3F1 → $C84C
    └─ $C84C: common exit → rti

Main Loop ($C7BE+)
    ├─ jsr $C7E0
    ├─ Zp10 &= $E7 (clear bits 3,4,5)
    ├─ Game logic (player, millipede, enemies)
    ├─ Collision detection
    ├─ Level progression
    └─ Loop (VBlank synchronized via Zp10/Zp11)
```

---

## 9. Naming and Residue

**Pass 1 complete** — 14,744 lines, canonical audit comments, 74.6% code. All 839 address-derived `Label_` definitions have been renamed: 12 semantic routine names (Reset, NmiHandler, MainLoop, GameplayUpdate, AttractMode, AttractAudio, GameOver, StageClear, InitObjects, ClearScore, SoundEffects, GameplayAudio) + 225 `SubC<addr>` entry points + 577 `tracer-generated branch targets*` internal branch targets. No `Label_` remains.

**Pass 2 complete** — every `jsr`/`jmp` target is a named routine with a semantic name; internal branch targets use `<Routine>_<Flag>` style names.

**Entry-point naming (2026-10-21)** — the 225 `SubC<addr>` entry points that
still carried an address-derived name were re-read against the code that
calls them and against the data tables they consume, and each was given a
name that says what the ROM shows it is for.  The 600 internal branch-target
children (`SubC<addr>_Loop`, `SubC<addr>_OnZero`, …) were re-based onto their
parent's new name, and the 561 labels whose tracer-generated name still ended
in a target address (`<Parent>_<Flag>_<ADDR>`) had that tail removed.
**0 address-derived `jsr`/`jmp` targets remain**, and
`grep -nE "^(SubC|Sub)_?[0-9A-F]{4}" prg.s` returns nothing.
Only labels and the comments that name them changed — not one instruction
byte — and the whole-ROM `cmp` still reports *Byte-identical ROM verified.*

| Area | Evidence in the dump | Names given |
|---|---|---|
| Game start | `InitObjects` copies the six bytes of `ObjectInitParameterTable` into the object block at `$03DF` and seeds the millipede/spider/mushroom/bee slots at `$03D0`, `$03E6`, `$03E9`, `$03F2`, `$03F5` | `InitObjects`, `StartNewGame`, `BeginGameplay`, `StartStage`, `SelectGameMode`, `SelectGameSlot`, `SwapPlayerSlot`, `ClearOamBuffer`, `SetOamSpriteY`, `ResetOamBufferTwo` |
| Millipede | the segment records are walked 8 bytes at a time from the `$03D0` block; `ZpC0`/`ZpC3` hold each segment's position and `$C066`/`$C091` supply the step and the tile | `UpdateMillipedeSegment`, `SaveMillipedeSegment`, `MoveMillipedeSegment`, `UpdateMillipedePointer`, `DrawMillipedeSegment`, `DrawMillipedeHead`, `DrawMillipedeBody`, `SetMillipedeHeadTile`, `ClearMillipedeSlot`, `IsMillipedeActive`, `SelectMillipedeSlot` |
| Enemies | the spider sits at `$03E6`, the mushrooms at `$0263`/`$0267`/`$026B` and the bee at `$0270`/`$0271`; `$C140`/`$C0E1`/`$C118` are the per-slot spawn tables | `SpawnSpider`, `SpawnSecondSpider`, `DrawSpiderSprite`, `DrawMushroomSprite`, `WriteMushroomTile`, `CheckMushroomCollision`, `DrawBeeSprite`, `DrawBeeSpriteTwo`, `IsEnemySlotFree`, `IsThirdEnemySlotFree`, `IsFourthEnemySlotFree`, `StartEnemySpawnTimer`, `StartBeeSpawnTimer`, `UpdateEnemyState`, `WriteEnemyPosition`… |
| Object slots | `$039E`/`$0398`/`$039A` hold the per-slot counters, and `DirectionBitMaskTable` (`$C04A`) supplies the eight single-bit direction masks that are OR-ed into the slot flag byte | `AdvanceObjectTimer`, `UpdateObjectDirection`, `UpdateObjectDirectionBits`, `GetObjectDirection`, `AdvanceObjectDirection`, `SetObjectDirectionBit`, `SetObjectDirectionBitTwo`, `CheckObjectDirection`, `CheckObjectDirectionTwo`, `CheckObjectDirectionThree`, `ApplyDirectionMask`, `FindFreeObjectSlot`, `ScanObjectSlots`, `ResetObjectSlots`, `ResetObjectState` |
| Screen script | `$CED65` walks a byte-coded script: `$FF` ends it, otherwise each record carries a VRAM address and a tile; the bytes are pushed to `PPUDATA` | `RunScreenScript`, `ReadScreenScriptRecord`, `WriteScriptTile`, `CopyScreenScriptData`, `CopyScriptRecord`, `CopyScriptRecordTwo`, `ClearNametableTiles`, `FlushVramWriteQueue`, `QueueVramByteWrite`, `QueueHudTileBytes`, `AdvanceVramQueueIndex`, `FlushVramQueueWhenFull` |
| HUD | `HudSpriteTemplate` (`$C27B`) is thirteen (tile, attribute) pairs copied to `$0330`; `OamSpriteYTable` (`$C277`) gives the four sprite rows | `UpdateHudTile`, `UpdateHudTileData`, `WriteHudTileByte`, `WriteHudTileIndex`, `LoadHudTileIndex`, `WriteHudTileValue`, `ComputeTileIndex` |
| Sound | `$CF80D`-area code writes the APU registers; `NoteIncrementTable` (`$FCCA`) steps the pulse high byte and `$F94A` holds the noise periods | `PlaySoundEffect`-family names: `InitSoundEffect`…`InitSoundEffectFour`, `UpdateSoundEffectStep`, `UpdateSoundEffectChannel`, `UpdateSoundEffectQueue`, `UpdateSoundChannelState`, `UpdateSoundChannelMask`, `ComputeNotePeriod`, `RotateNoteIndex`, `GetNoisePeriodFromTable`, `SetPulse1Timer`, `SetPulse2Timer`, `SetTriangleTimer`, `SetNoiseTimer`, `SetDmcTimer` |

**Residue: none.**  Every `jsr`/`jmp` target in `prg.s` carries a semantic
name.  Where the ROM does not reveal a role, the routine was given a name
that states what its instructions do rather than a guess at a game concept
(for example `NegateValue` for the `eor #$FF / clc / adc #$01` idiom, and
`AdvanceSlotIndex` for the `clc / adc #$08 / dex` loop).

**Pass 3 complete** — 8 semantic zero-page aliases (PtrLo/Hi, Ptr2Lo/Hi, PpuCtrlShadow, PpuMaskShadow, AudioState, GameState, GameplaySubState); hardware register operands substituted via `apply_symbols.py`; data tables interpreted and named: `GameplayDataTables` ($C000–$C734), `DirectionBitMaskTable` ($C04A), `ObjectInitParameterTable` ($C271), `OamSpriteYTable` ($C277), `HudSpriteTemplate` ($C27B), `SoundSequenceDestAddressTable` ($C295), `MusicSequenceData` ($F24F–$F984), `PulseTimerSelectTable` ($FA1A), `SoundEffectNoteTable` ($FB43), `NoteIncrementTable` ($FCCA), `SoundChannelTable` ($FE61–$FFFF). Remaining zero-page slots retain neutral `ZpXX` names where role is not unique.

**Indirect dispatch** (not followed statically): `jmp ($0002)` at $EF15.

**Large data region** — $C000–$C734 (1845 bytes) classified as data but referenced by 93+ code instructions (`lda $Cxxx,x`, `bit $Cxxx`). It is a bundle of small independent tables, not one level map; the inventory in section 10 splits it into the groups that have a consumer and records the rest.

**Promotion outstanding** — Add `header.s`/`chr.s` + HEADER/PRG/CHR `linker.cfg`, switch `make` to whole-ROM `cmp`, move `_tools` paths from `../../../_tools/` to `../../_tools/`.

Build verification: `make` in `copilot/` produces `reconstructed_prg.bin`, compared against `prg.bin` (PRG byte-identical).

---

## 10. Pass 3 data-table inventory

Every data block the tracer emitted in this PRG is listed here — 11 blocks in
all.  A block that an instruction reads is named and its structure recorded; a
block nothing reads is recorded as unreferenced data with its ROM provenance;
a block whose bytes decode as instructions is recorded as code the tracer
could not reach.

| Address | Size | Name | Structure | Read by |
|---------|------|------|-----------|---------|
| $C000–$C734 | 1845 B | `GameplayDataTables` | A bundle of small, independent tables — the tracer could not separate them. The groups with a consumer are: **$C04A–$C051** eight single-bit masks (`01 02 04 08 10 20 40 80`); **$C271–$C276** six object-initialisation bytes (`19 15 0A 22 0E 1B`); **$C277–$C27A** four OAM Y positions (`4F 5F 6F 7F`); **$C27B–$C294** thirteen (tile, attribute) sprite pairs; **$C295–$C2D8** 16-bit little-endian RAM destination addresses, one per sound effect; **$C39F–$C3A0** 16-bit little-endian constants. The remaining ~1.6 KB are single-byte tables read one byte at a time (`$C052`, `$C064`, `$C066`, `$C06A`, `$C06E`, `$C07E`, `$C08E`, `$C091`, `$C094`, `$C0B4`, `$C0C4`–`$C0D1`, `$C0E1`, `$C0F1`, `$C101`, `$C111`, `$C118`, `$C128`, `$C138`, `$C13C`, `$C140`, `$C150`, `$C160`, `$C19C`, `$C1B5`, `$C1CE`, `$C1E9`, `$C227`, `$C237`, `$C254`, `$C2D9`, `$C367`, `$C38B`, `$C38F`, `$C3A0`, `$C3BF`, `$C3D6`, `$C3F1`, `$C545`, `$C6D5`, `$C6F5`, `$C715`); their record size and units are not established, so they are listed rather than named. | 93 instructions, e.g. `lda $C271,x` at $C776, `bit $C04E` at $C91A, `bit $C04D` at $C91F, `lda $C277,x` at $C93D, `lda $C27B,x` at $CAB1, `lda $C39F,x` at $CB16, `lda $C3A0,x` at $CB1C, `lda $C237,x` at $CD56, `lda $C254,x` at $CD5F, `lda $C6F5,x` at $CF3D, `lda $C715,x` at $CF47, `lda $C295,x` at $CF90 |
| $C04A–$C051 | 8 B | `DirectionBitMaskTable` | Eight single-bit masks, `01 02 04 08 10 20 40 80`, one per direction / slot number. The code ORs, ANDs and EORs a mask into a per-slot flag byte. | `lda $C04A,x` at $D6D1, $D991, $E186, $E1BD, $E222, $E4EA and $ED59; `bit $C04D` at $C91F and `bit $C04E` at $C91A read masks $08 and $10 as constants |
| $C271–$C276 | 6 B | `ObjectInitParameterTable` | Six bytes, `19 15 0A 22 0E 1B`, copied verbatim into the object state block at $03DF when the game starts. | `lda $C271,x` / `sta $03DF,x` at $C776/$C779, X = 0..5 |
| $C277–$C27A | 4 B | `OamSpriteYTable` | Four OAM Y positions, `4F 5F 6F 7F` (79, 95, 111, 127), one per sprite slot; the value becomes the Y byte of the first OAM entry. | `lda $C277,x` / `sta $0200` at $C93D/$C940, X = `Zp61` & 3 |
| $C27B–$C294 | 26 B | `HudSpriteTemplate` | Thirteen two-byte records, each (CHR tile index, OAM attribute byte): `18 22`, `38 C8`, `E7 22`, `39 C8`, `E8 22`, `3A C8`, `E8 22`, `3B C8`, `E8 22`, `3C C8`, `E8 22`, `3D C8`, `E8 00`. Copied to $0330–$0349. | `lda $C27B,x` / `sta $0330,x` at $CAB1/$CAB4, X = 0..$19 |
| $C295–$C2D8 | 68 B | `SoundSequenceDestAddressTable` | 34 little-endian 16-bit **RAM** destination addresses, one per sound effect (the first entries are $0400, $0500, $2411, $4311, …). The sound engine copies a $FE-byte sequence from $F3B9 into the address this table selects. | `lda $C295,x` / `sta Ptr2Lo` at $CF90 and `lda $C296,x` / `sta Ptr2Hi` at $CF95, X = 2×`Zp64`; the copy is `lda $F3B9,y` / `sta ((Ptr2Lo),y)` at $CF9C |
| $D14F–$D159 | 11 B | (unnamed) | The bytes `A9 48 85 0F A9 0C 85 0A 4C 9C D1` decode as `LDA #$48 / STA $0F / LDA #$0C / STA $0A / JMP $D19C` — a second copy of the tail of the routine at $D129. Code the tracer could not reach, not a table. | nothing in this dump enters it |
| $F157–$F15A | 4 B | (unnamed) | Four bytes with no established structure; no instruction in this dump addresses them. | unreferenced data (ROM provenance: immediately after the $F0BC sound-effect routine) |
| $F24F–$F984 | 1846 B | `MusicSequenceData` | The sound engine's music and effect data: the note-period pairs the pulse channels read and the byte streams they play. The bytes also decode as a run of instructions, which is expected — a note stream is not code. | `lda $F3B9,y` at $CF9C, `lda $F901,y` at $F9D4, `lda $F900,y` at $F9DC, `lda $F94A,y` at $FA16, `lda $F961,y` at $FD8F and $FDC6, `lda $F973,y` at $FDE4 |
| $F997–$F99F | 9 B | (unnamed) | Nine bytes, every one of them $FF — padding between two routines. | unreferenced data |
| $F9CE–$F9D0 | 3 B | (unnamed) | The bytes `20 BE F9`, which decode as `jsr $F9BE` — the tail of the routine that starts at $F9CA, whose entry the tracer never proved. Code, not data. | nothing in this dump enters it |
| $F9FC–$F9FD | 2 B | (unnamed) | Two bytes (`98 4A`) at the head of a routine the tracer could not reach. | unreferenced data |
| $FA1A–$FA1E | 5 B | `PulseTimerSelectTable` | Five bytes, `52 54 56 58 5A`, that select which APU pulse-timer value a voice uses. The index is the sound state divided by two. | `lda $FA1A,y` at $FAA5, Y = `ZpF3` ÷ 2 |
| $FB43–$FB4A | 8 B | `SoundEffectNoteTable` | Four two-byte records of (note index, duration): `$22/$05`, `$22/$05`, `$38/$05`, `$1A/$0A`. The note goes to the pulse channel, the duration is the step count. | `lda $FB46,y` at $FB9C (duration) and `lda $FB45,y` at $FBA1 (note), Y = 2× the effect step counter |
| $FCCA–$FCDA | 17 B | `NoteIncrementTable` | Seventeen values that step through `91 92 93 94 95 96 97 98 99 9A 98 96 94`; the byte chosen becomes the high half of a pulse timer. | `lda $FCCA,y` at $FC8E, Y = `ZpF5` ÷ 2 |
| $FE61–$FFFF | 415 B | `SoundChannelTable` | The sound engine's per-channel table. $FE61 holds one note-base offset per channel (`04 09 0E 13 …`); the same byte is reused as the index of a five-byte parameter record at $FE62–$FE65, whose four bytes go to the channel's parameter slots. The hardware vectors (NMI $C7F1, RESET $C735, IRQ $FFF0) sit at the end of the block. | `lda $FE61,y` at $FD4F and $FD53, `lda $FE62,y` at $FD59, `lda $FE63,y` at $FD5E, `lda $FE64,y` at $FD63, `lda $FE65,y` at $FD69 |

**How the structures were derived.**  The mask table, the HUD template, the
object-init parameters, the OAM Y table and the sound-channel table are all
fixed-length records whose length and content follow directly from the
consuming loop (`lda base,x` / `sta dest,x` with a known bound).  The sound
engine's tables follow the same pattern as the sibling sound engines in
`NROM/Mario Bros (JU)` and `NROM/Hogan's Alley (JU)`, which share the code at
`$F7xx`–`$FDxx`; the note-base byte is used twice — once as the note offset
and once as the record index — which is what fixes the record size at five
bytes.  The two-byte sound-effect note table follows from the `asl a` that
doubles the step counter before the lookup.  The `$C000–$C734` bundle is
subdivided by the addresses the instructions actually name; the single-byte
tables inside it are recorded with their reader rather than named, because
nothing in the dump fixes their record size or units.

## Power-on flow analysis

Derived from the disassembly by `_tools/derive_poweron.py`; the call graph is walked from the reset entry.

**RESET** is at `$C735` (`Reset`).  The CPU comes here out of reset with the PPU and APU in their power-on state and the zero page and RAM uninitialised.

The reset path calls:

| Address | Routine |
|---------|---------|
| `$C73F` | `the vblank wait loop` (falls through) |
| `$C74F` | `the zero-page clear loop` (falls through) |
| `$C76A` | `InitObjects` |
| `$C764` | `MainLoop` (falls through) |
| `$C76E` | `the sprite-clear loop` (falls through) |
| `$F09B` | `UpdateControllerShiftRegister` |
| `$C764` | `MainLoop` |

**NMI** is at `$C7F1` (`NmiHandler`).  It is the per-frame handler; what it calls:

| Address | Routine |
|---------|---------|
| `$EF4A` | `UpdateSprites` |
| `$EF36` | `UpdatePPU` |
| `$F085` | `AttractAudio` |

**IRQ** is at `$FFF0` (`$FFF0`) - a different address from RESET.