# Raid on Bungeling Bay (U) — Game Flow from Power-On

This document describes the execution flow of the disassembled Raid on Bungeling Bay (U) PRG bank (16 KB, mapped at CPU **$C000–$FFFF**), starting from power-on. It is based entirely on `prg.s` in the repository. The rebuild is verified **byte-identical to the whole ROM** (`reconstructed.nes` = `rom.nes`, header and CHR included).

---

## 1. Reset Vector — CPU $FFFC → $C000

**`Reset`** ($C000) → **`Label_C6E3`** ($C6E3)

The RESET vector points to $C000, which contains a single `jmp $C6E3`. The actual reset routine begins at **$C6E3**:

| Step | Code | Purpose |
|------|------|---------|
| 1 | `lda #$10` / `sta $2000` / `sta ZpC2` | PPUCTRL = $10 (NMI off, sprite $0000, BG $0000) + shadow in ZpC2 |
| 2–5 | `Label_C6EA`: `inc ZpEA` / `lda $2002` / `bpl` | Wait for VBlank (poll PPUSTATUS bit 7), increment ZpEA |
| 6–7 | `ldx #$FF` / `txs` | Initialize stack pointer to $01FF |
| 8 | `inx` / `txa` | X=0, A=0 |
| 9–13 | `Label_C6F6`: `sta Zp00,x` / `inx` / `cpx #$EA` / `bne` | Clear $0000–$00E9 (234 bytes) |
| 14 | `jsr $C98E` | Initialize game systems |
| 15–18 | `lda $026D` / `ora $0273` / `cmp #$23` / `beq Label_C719` | Check signature at $026D/$0273; if $23, warm start |
| 19–22 | `lda #$23` / `ldx #$0B` / `Label_C70E`: `sta $0268,x` / `dex` / `bpl` / `lda #$25` / `sta $026F` | Cold start: write $23 to $0268–$0273, $25 to $026F |
| 23–26 | `Label_C719`: `ldx #$FF` / `txs` / `jsr $C98E` / `lda #$01` / `ldx #$06` | Warm start: re-init stack, systems, set A=1, X=6 |
| 27+ | Falls through to main loop | Continue initialization |

**Warm-start signature:** Two bytes at $026D/$0273. If their OR equals $23, the game treats it as a warm start (skips full clear, re-initializes stack and systems).

---

## 2. Main Loop

After reset initialization, the main loop runs continuously, synchronized with NMI via ZpC4 flag. The loop calls various gameplay subroutines for helicopter control, enemy AI, base building, etc.

---

## 3. Interrupt Vectors — CPU $FFFA–$FFFF

Located at PRG offset $3FFA (end of 16 KB bank):

| Vector | Address | Handler |
|--------|---------|---------|
| NMI | $C04C | `NmiHandler` |
| RESET | $C000 | `Reset` (jumps to $C6E3) |
| IRQ | $C2C0 | `IrqHandler` |

---

## 4. NMI / Frame Heartbeat — `NmiHandler` ($C04C)

The NMI fires once per frame and implements a state machine based on **ZpC4** ($C4):

```
NmiHandler ($C04C):
    pha / txa / pha / tya / pha           ; preserve A,X,Y
    lda ZpC4 ($C4)
    bne Label_C05F                        ; ZpC4≠0: Path B
    lda #$00 / sta $2003 (OAMADDR)
    lda #$07 / sta $4014 (OAMDMA)         ; sprite DMA from $0700
    ... (Path A: minimal)
Label_C05F:                               ; Path B: full frame update
    lda $0200 / ldx #$00 / stx $0200      ; read/clear $0200
    lsr a / bcs Label_C0C1                ; bit 0
    lsr a / bcs Label_C0A8                ; bit 1
    lsr a / bcs Label_C0A6                ; bit 2
    lsr a / bcs Label_C0A6                ; bit 3 (same as bit 2)
    lda ZpC4 / bne Label_C0A3             ; if ZpC4 still set
    lda Zp55 ($55) / beq Label_C09A       ; check Zp55
    dec Zp55 / lsr a / bcs Label_C0A0     ; decrement, check bit
    lda #$3F / sta $2006 / ldx #$00 / stx $2006 / ldx #$10 / lda #$14
Label_C08E:
    jsr $C006 / dex / bne Label_C08E      ; write 16 bytes to PPUDATA ($3F00)
    jsr $C4E4 / jmp $C17A
Label_C09A:
    lda ZpD6 ($D6) / cmp #$02 / bne Label_C0A3
Label_C0A0:
    ... (palette/sprite updates)
Label_C0A3:
    ... (gameplay updates)
Label_C0A6:
    ... (sprite updates)
Label_C0A8:
    ... (enemy updates)
Label_C0C1:
    ... (collision/game logic)
```

**Two NMI Paths:**
- **Path A (ZpC4=0):** Minimal — only OAM DMA from $0700
- **Path B (ZpC4≠0):** Full — reads $0200 as state bitmap, dispatches to handlers for bits 0–3:
  - Bit 0 → `Label_C0C1` (collision/game logic)
  - Bit 1 → `Label_C0A8` (enemy updates)
  - Bit 2/3 → `Label_C0A6` (sprite updates)
  - If ZpC4 still set → `Label_C0A3` (gameplay)
  - Zp55 check → `Label_C09A` (timer-based)
  - ZpD6=2 → `Label_C0A0` (palette)

**Key ZP Flags:**
- `ZpC4` ($C4): NMI path selector (0=minimal, ≠0=full)
- `Zp55` ($55): Frame sub-counter/timer
- `ZpD6` ($D6): Game state (2 = palette update)
- `ZpEA` ($EA): VBlank wait counter
- `ZpC2` ($C2): PPUCTRL shadow

---

## 5. Key Subsystems

### 5.1 PPU Helper — `$C006` / `$C003`
- `$C006`: Write A to PPUDATA ($2007), RTS
- `$C003`: `lda $0200,x` (read from $0200+X)

### 5.2 Sprite/OAM System
- OAM DMA from $0700 (Path A) or $0200 (Path B)
- Sprite updates at `Label_C0A6`, `Label_C0A8`

### 5.3 Palette Updates — `$C08E` / `$C4E4`
- When Zp55 expires or ZpD6=2: writes 16 bytes to PPU $3F00 (palette)
- Data from $0200+ area

### 5.4 Gameplay Logic
- `$C0C1`: Collision detection, helicopter physics
- `$C0A8`: Enemy/factory AI
- `$C0A6`: Sprite animation
- `$C17A`: Base/building logic
- `$C98E`: System initialization (called at reset and warm start)

### 5.5 Indirect Dispatch (multiple)
Multiple `jmp (zp)` not followed statically:
- `jmp ($001B)` at $E7A3
- `jmp ($0017)` at $E79D
- `jmp ($0019)` at $E7A0
- `jmp ($0001)` at $E2EC

Target addresses in ZP set by callers; require runtime tracing.

---

## 6. Memory Map (Key Zero Page / RAM)

| Address | Name | Use |
|---------|------|-----|
| $00 | `PtrLo` | RAM clear pointer / general pointer low (alias `Zp00`) |
| $01 | `PtrHi` / `IndDispatch01` | RAM clear page counter; also the `jmp (ptr)` target for the Sub_8764 computed dispatch at $E2EC |
| $1B | `IndDispatch1B` | Indirect dispatch ($001B) |
| $17 | `IndDispatch17` | Indirect dispatch ($0017) |
| $19 | `IndDispatch19` | Indirect dispatch ($0019) |
| $55 | `FrameSubCounter` | Frame sub-counter/timer |
| $C2 | `PpuCtrlShadow` | PPUCTRL shadow |
| $C4 | `NmiPathSelector` | NMI path selector (0=minimal, ≠0=full) |
| $D6 | `GameState` | Game state (2 = palette) |
| $EA | `PrngPeriodCounter` | PRNG phase counter — incremented and wrapped at $77 by the PRNG update routine at $C412 (also bumped by the reset vblank-wait loop at $C6EA) |
| $EB | `PrngSeedB` | PRNG seed byte — decremented and reloaded with $75 by $C412 |
| $EC | `PrngState` | PRNG state byte — xored and stored back at $C43D |
| $0200 | State bitmap | Read in NMI Path B (bits 0–3 dispatch) |
| $0268–$0273 | Warm-start signature | $23 bytes for warm start detection |
| $026D/$0273 | Signature check | OR'd together, compared to $23 |
| $026F | `Zp6F` | Gameplay parameter ($25 init) |
| $0700 | OAM source (Path A) | Sprite DMA from $0700 when ZpC4=0 |

---

## 7. Summary of Execution Flow

```
Power On / Reset
    │
    ▼
Reset ($C000) ────► jmp $C6E3
    │
    ▼
Label_C6E3 ($C6E3) ──► PPUCTRL=$10, wait VBlank, stack=$FF
    │
    ├─ Clear $0000–$00E9 (234 bytes)
    ├─ jsr $C98E (system init)
    ├─ Check $026D/$0273 signature:
    │     ├─ OR = $23: Warm start
    │     │    ldx #$FF / txs / jsr $C98E / A=1, X=6
    │     └─ Else: Cold start
    │          Write $23 to $0268–$0273, $25 to $026F
    │
    ▼
Main Loop (VBlank synchronized via ZpC4)
    │
    ▼ (NMI fires once per frame)

NMI ($C04C)
    ├─ Preserve A,X,Y
    ├─ lda ZpC4
    │     ├─ =0 (Path A): OAM DMA from $0700, minimal
    │     └─ ≠0 (Path B):
    │          lda $0200 / stx $0200 (read/clear state bitmap)
    │          lsr ×4 → dispatch on bits 0–3:
    │               bit 0: Label_C0C1 (collision/logic)
    │               bit 1: Label_C0A8 (enemies)
    │               bit 2/3: Label_C0A6 (sprites)
    │          ZpC4 still set → Label_C0A3 (gameplay)
    │          Zp55=0 → Label_C09A (timer)
    │               dec Zp55, check bit → Label_C0A0 (palette)
    │          ZpD6=2 → Label_C0A0 (palette)
    │          Palette: $3F00, 16 bytes via $C006
    │
    └─ Restore, rti
```

---

## Pass 3 data-table inventory

Every data block in the PRG is listed below.  The block boundaries are the
tracer's (`; ---- data $XXXX-$YYYY` markers in `prg.s`); where a block holds
more than one structure the sub-labels in `prg.s` mark the split.

Raid on Bungeling Bay (U) is Konami's 1985 helicopter raid: you cross a map
destroying the five enemy factories, each guarded by five targets, while a
fuel gauge and a radar screen keep you informed.  Most of the data below is
therefore CHR tile indices (the game draws its screens from tiles rather
than from graphics), per-target parameter records and small text strings.

| Address | Size | Name | Structure | Read by |
|---------|------|------|-----------|---------|
| `$C00A-$C031` | 40 | `RadarScreenTileTable` | four small tile-index tables: `$C00A-$C021` is the 24-tile status row (`$30`,`$21`,`$30`,`$17`,`$0F`,`$37`,...); `$C022-$C025` holds one tile per game state (`$19`,`$10`,`$1F`,`$1C`); `$C026-$C02D` holds the eight counter digits (`$1C`,`$14`,`$19`,`$1B`,`$13`,`$17`,`$0F`,`$15`); `$C02E-$C031` holds four tiles (`$07`,`$17`,`$17`,`$17`) | `lda $C00A,x` at `$C4D6` writes the 24 status tiles to VRAM through ``WriteByteToPpu``; `lda $C022,x` at `$C4C9` picks the tile for the current `GameState`; `lda $C026,y` at `$D6E0` picks a counter digit; `lda $C02E,x` at `$C4BC` picks one of the four tiles |
| `$C35C-$C3E1` | 134 | `SoundEffectPeriodTable` + `EnemySpriteDefinitionTable` | `$C35C-$C37B` is 16 little-endian 16-bit APU pulse-1 timer periods (`$06AE`,`$064E`,`$05F3`,`$059E`,`$054D`,`$0501`,`$04B9`,`$0475`, ... - the same descending ladder the other Konami titles use). `$C37C-$C3E1` holds the per-enemy sprite and sound parameters | periods: `lda $C35C,x` at `$C347` and `lda $C35D,x` at `$C342`. sprite data: `lda $C374,x` at `$C1D1`, `lda $C3AC,x` at `$C1FA` (tile), `lda $C3B4,x` at `$C1FF` (attribute), `lda $C3BB,x` at `$C25D` (position), `lda $C3CC,x` at `$C2A7` and `$C529` (the sound period that is loaded into `APUNOISEPERIOD` at `$C2AC`) |
| `$C625-$C67C` | 88 | `SpritePositionOffsetTable` | four parallel 20-byte tables of small offsets - `$C625` (OAM Y), `$C629` (tile), `$C62D` (attribute) and `$C63D` (OAM X) | `adc $C625,y` at `$C61E` -> `$0703,x`, `adc $C629,y` at `$C600` -> `$0700,x`, `adc $C62D,y` at `$C614` -> `$0702,x`, `adc $C63D,y` at `$C60A` -> `$0701,x`; each offset is added to a base held in `Zp49`, `Zp4A`, `Zp4B` and `Zp4D` |
| `$C6AA-$C6E2` | 57 | `RadarScreenAddressTable` | 19 records of three bytes - (VRAM address high, VRAM address low, byte count): `$206A`/12, `$208A`/12, `$20C8`/16, `$20E8`/16, `$212D`/6, ... - the layout of the radar and status screens | `lda $C6AA,y` at `$C744` and `$C74B` are written to `PPUADDR` to address the screen area, and `lda $C6AA,y` at `$C776` returns the first byte of a record to ``GetRadarScreenAddress`` |
| `$C77A-$C77C` | 3 | *(unreferenced - unreachable code)* | the single instruction `JSR $C53F` | **no instruction operand lands in this block.** Unreached code, ROM offset `$077A` |
| `$C8F0-$C8FA` | 11 | `GameOverText` | ASCII `"game"`, the control pair `$7F $7F`, ASCII `"over"`, `$00` - the game's end-of-game message | **no instruction in this dump reads it.** Unreferenced data, ROM offset `$08F0` |
| `$C96F-$C98D` | 31 | `RoundMessageText` | a run of NUL-terminated words with control bytes between them: `"round"` `$DB` `"factory"` `$D9` `"left"` `$FA` `"score"` `$BB` `"top"` `$7F` `$7F` `"p"` `$00` - the six words the radar/status screen needs | **no instruction in this dump reads it.** Unreferenced data, ROM offset `$096F` |
| `$CAD4-$CAE5` | 18 | `BaseTargetParameterTable` | three parallel six-byte tables: `$CAD4` (`$83`,`$85`,`$07`,`$63`,`$C9`,`$4B`), `$CADA` (`$03`,`$42`,`$44`,`$46`,`$86`,`$41`) and `$CAE0` (`$04`,`$0C`,`$13`,`$16`,...) - the position and type of the five targets guarding one factory | `lda $CAD4,x` at `$CAB7` -> `$04DE,x`, `lda $CADA,x` at `$CAC2` -> `$0322,x`, `lda $CAE0,x` at `$CACD` -> `$054D,x` |
| `$CB7F-$CCBB` | 317 | `EnemyTargetParameterTable` | a set of parallel arrays indexed by enemy number, six bytes apart: the type at `$CB7F`, the tile at `$CB85`, the attribute at `$CB8B`, the position at `$CB91`, the score at `$CB97`, and then the six per-target fields at `$CBDB` (target tile), `$CBE1` (target attribute), `$CBE7` (score), `$CBED` (fuel), `$CBF3` (flag), `$CBF9` (flag), `$CBFF` (count) | `lda $CB7F,x` at `$CAF7`, `lda $CB85,x` at `$CAF2`, `lda $CB8B,x` at `$CB0D`, `lda $CB91,x` at `$CB08`, `lda $CB97,x` at `$CB13`, `cmp $CBDB,x` at `$CA14`, `lda $CBDB,x` at `$CA2D`, `lda $CBE1,x` at `$CA33`, `lda $CBE7,x` at `$CA39`, `lda $CBED,x` at `$CA3F`, `lda $CBF3,x` at `$CA45`, `lda $CBF9,x` at `$CA4B`, `lda $CBFF,x` at `$CA6B` |
| `$CCEA-$CD25` | 60 | `SpriteDefinitionTable` | six parallel ten-byte tables - one per sprite slot: `$CCEA` (sprite type), `$CCF4` (tile), `$CCFE` (attribute), `$CD08` (X), `$CD12` (Y), `$CD1C` (frame) | `lda $CCEA,x` at `$CCC2`, `lda $CCF4,x` at `$CCC8`, `lda $CCFE,x` at `$CCCE`, `lda $CD08,x` at `$CCD4`, `lda $CD12,x` at `$CCDA`, `lda $CD1C,x` at `$CCE0` - the values are copied into the per-sprite RAM slots `$028B`, `$0369`, `$02FA`, `$03D8`, `$0447` and `$04B6` |
| `$CE08-$CE1D` | 22 | `SpriteOamShadowTable` | 22 bytes copied straight into the zero-page sprite shadow at `ZpA5` | `lda $CE08,x` at `$CD79` with X counting up to `$15` |
| `$CE96-$CED2` | 61 | `SpriteOffsetTable` | `$CEC9-$CECD` and `$CECE-$CED2` are two five-byte offset tables; the bytes before them are not read | `lda $CEC9,x` at `$CE36` -> `Zp4E` and `lda $CECE,x` at `$CE3B` -> `Zp4F` |
| `$CFF4-$CFFE` | 11 | `CompleteText` | the control pair `$7F $7F`, ASCII `"complete"`, `$00` - the message shown when a factory is destroyed | **no instruction in this dump reads it.** Unreferenced data, ROM offset `$0FF4` |
| `$D115-$D124` | 16 | `FuelGaugeText` | the text `" U"` + `$00`, then the sprite data `$62`,`$B8`,`$64`,`$00`,`$6C`,`$D0`,`$44`,`$00`,`$62`,`$D0`,`$86`,`$00`,`$86` - the fuel-gauge lettering and the sprites that make up the gauge | `lda $D115,x` at `$D0AE` copies all sixteen bytes into `$07C8-$07D7`; `lda $D119,x` at `$D075` copies five of them into `$07F4-$07F8` |
| `$D1F8-$D1FF` | 8 | `SproutTileTable` | 8 bytes (`$00`,`$00`,`$32`,`$1E`,`$0A`,`$28`,`$00`,`$14`) | `lda $D1F8,x` at `$D1C3` |
| `$D245-$D24B` | 7 | `MaskBitTable` | 7 mask bytes (`$1F`,`$1F`,`$1F`,`$3F`,`$7F`,`$7F`,`$FF`) | `lda $D245,x` at `$D262` |
| `$D3FE-$D421` | 36 | `MovementAngleTable` | two parallel 18-byte tables of small values: `$D3FE` (`$00`,`$85`,`$83`,`$00`,`$03`,`$05`,`$07`,`$08`,`$07`,`$05`,`$03`,`$00`,`$83`,`$85`,`$87`,`$88`,`$86`,`$84`) and `$D410` - the direction an object moves in, as a packed angle | `lda $D3FE,y` at `$D3C3` and `$D3D9`, `lda $D410,y` at `$D3CF` and `$D3EB`; the high bit is then forced into the accumulator (`ora #$80` at `$D3E0`/`$D3F2`) to select the direction |
| `$D4AD-$D4BE` | 18 | `MovementDeltaTable` | 18 single-byte values (`$FF`,`$16`,`$14`,`$12`,`$14`,`$16`,`$12`,`$0E`,`$12`,`$16`,`$16`,`$14`,`$16`,`$16`,`$12`,`$0E`,...) | `lda $D4AD,x` at `$D496` -> `Zp0B`/`Zp0A`, the speed the object is moved by |
| `$D53D-$D560` | 36 | `EnemySpeedTable` | two parallel 18-byte tables: `$D53D` (`$FF`,`$04`,`$03`,`$00`,`$83`,`$84`,`$86`,`$88`,`$86`,`$84`,`$83`,`$00`,`$03`,`$04`,`$06`,`$08`,...) and `$D54F` - the speed at which each enemy closes on its target | `lda $D53D,x` at `$D4CC` and `lda $D54F,x` at `$D4D7` |
| `$D5BD-$D5C8` | 12 | `FuelThresholdTable` | three little-endian 16-bit thresholds - `$D5BD`/`$D5BE` = `$0032`, `$D5C0`/`$D5C1` = `$01A2`, `$D5C2`/`$D5C3` = `$0000`, `$D5C4`/`$D5C5` = `$000C`, `$D5C6`/`$D5C7` = `$8007` - the fuel levels at which the gauge changes | `adc $D5BD,x` at `$D57F`, `lda $D5C0,x` at `$D584`, `cmp $D5C3,x` at `$D59A`, `cmp $D5C6,x` at `$D5A4`, `sbc $D5C6,x` at `$D5AD` and `sbc $D5C3,x` at `$D5B6` |
| `$D676-$D68D` | 24 | `RadarBlipOffsetTable` | two parallel 12-byte tables of small offsets: `$D676` (`$18`,`$18`,`$18`,`$28`,`$10`,`$10`,`$20`,`$30`,`$18`,`$28`,`$10`,`$20`) and `$D682` (`$0E`,`$0E`,`$0E`,`$0A`,...) | `lda $D676,x` at `$D65E` and `lda $D682,x` at `$D658` |
| `$D8B7-$D8D9` | 35 | `EnemySpriteOffsetTable` | five parallel seven-byte tables: `$D8B7`, `$D8BE`, `$D8C5`, `$D8CC` and `$D8D3` - the five offsets that place one enemy's parts on the radar blip | `cmp $D8B7,y` at `$D891`, `lda $D8BE,y` at `$D89B`, `lda $D8C5,y` at `$D873`, `lda $D8CC,y` at `$D87D`, `lda $D8D3,y` at `$D878` |
| `$D933-$D941` | 15 | `TargetTileTable` | 15 tile indices (`$D2`,`$D7`,`$D3`,`$D3`,`$C2`,`$C7`,`$D3`,`$D2`,`$D2`,`$D6`,`$C3`,`$C3`,`$C2`,`$C6`,`$C3`) - the tiles the five targets of a factory are drawn from | `lda $D933,x` at `$D911` |
| `$DA75-$DBA7` | 307 | `LevelLayoutData` | the level's own data: the radar map rows and the factory layouts, in the same tile-index encoding as the rest of the PRG | `lda $DADD,x` at `$C72A`, `lda $DA8D,y` at `$DA2E`, `lda $DA99,y` at `$DA34`, `lda $DB49,y` at `$DBCC`, `lda $DB8B,y` at `$DBD0`, `lda $DB6E,y` at `$DBD5` |
| `$DC5B-$DC80` | 38 | `EnemyCountTable` | three parallel tables: `$DC5B` (12 bytes, `$A0`,`$A1`,`$A1`,`$A2`,`$A3`,`$A3`,`$A4`,`$A5`,`$A5`,`$A6`,`$A7`,`$A7`), `$DC67` (13 bytes) and `$DC74` (12 bytes) - how many enemies of each kind the level contains and when they appear | `lda $DC5B,y` at `$DC45`, `lda $DC67,y` at `$DC50`, `lda $DC74,y` at `$DC55` |
| `$DEFC-$E01F` | 292 | `LevelSpriteData` | the per-level sprite definitions: rows of tile indices and attribute bytes that the game copies into the sprite buffer | `lda $DEFC,y` at `$DCB6` and `$DC7D`, `lda $DF0D,y` at `$DCBF` and `$DEDA`, `lda $DFE4,y` at `$DEC3`, `lda $DFA8,y` at `$DEC8` |
| `$E146-$E156` | 17 | `SproutTileTable2` | 17 tile indices (`$00`,`$00`,`$01`,`$02`,`$03`,`$06`,`$05`,`$04`,`$03`,`$00`,`$0B`,`$0A`,`$09`,`$06`,`$07`,`$08`,...) | `lda $E146,x` at `$E126` |
| `$E1EC-$E205` | 26 | `EnemyTileIndexTable` | two parallel 13-byte tables: `$E1EC` (`$00`,`$04`,`$07`,`$08`,`$07`,`$04`,`$00`,`$84`,`$87`,`$88`,`$87`,`$84`,`$00`) and `$E1F9` (`$86`,`$85`,`$83`,...) - the tiles and attributes of the enemy sprites | `lda $E1EC,y` at `$E1DD` and `lda $E1F9,y` at `$E1E2` |
| `$E238-$E250` | 25 | *(unreferenced - unreachable code)* | 6502 code: `LDA $A5`, `LDX $A5`, `ASL $6A`, `BCS`, `INC $FE`, `LDA $043C`, `LDA $043C`, `CMP #$84`, `BNE`, `JSR` | **no instruction operand lands in this block.** Unreached code, ROM offset `$2238` |
| `$E2EF-$E300` | 18 | `EnemyRoutinePointerTable` | 9 little-endian 16-bit code addresses: `$E320`,`$E24B`,`$E38B`,`$E320`,`$E37B`,`$E31D`,`$E320`,`$E3CE`,`$E323` - the routine each enemy type is driven by | `lda $E2EF,x` at `$E2E0` and `lda $E2F0,y` at `$E2E5`; the README of the project records the four-entry walk at `$E2EF` |
| `$E31D-$E31F` | 3 | *(unreferenced - unreachable code)* | the instruction `JSR $E220` | **no instruction operand lands in this block.** Unreached code, ROM offset `$231D` |
| `$E35B-$E3B4` | 90 | *(unreferenced - unreachable code)* | 6502 code: `DEC $2C`, `BEQ`, `LDA $0444`, `STA $0349`, `LDX $2B`, `LDA #$08` | **no instruction operand lands in this block.** Unreached code, ROM offset `$235B` |
| `$E3CE-$E411` | 68 | *(unreferenced - unreachable code)* | 6502 code: `LDA $A5`, `AND #$03`, `BEQ`, `LDA $0443`, `CMP #$83`, `BCS`, `INC $0443` | **no instruction operand lands in this block.** Unreached code, ROM offset `$23CE` |
| `$E566-$E586` | 33 | `TargetTileIndexTable` | a run of tile indices in groups of five separated by `$00` (`$00`,`$04`,`$08`,`$04`,`$00`, `$84`,`$88`,`$84`,`$00`,`$86`,`$83`,`$00`,`$03`,`$06`,`$03`,`$00`, ...) - the tiles each target is drawn with | `lda $E578,y` at `$E546` |
| `$E6CD-$E6E4` | 24 | `DirectionBitMaskTable` | the eight single-bit masks `$01`,`$02`,`$04`,`$08`,`$10`,`$20`,`$40`,`$80` twice over - one set for each of the two joystick directions | `and $E6CD,x` at `$D730`, `$D74C`, `$D755` and `$D7A5`; `lda $E6CD,y` at `$E08E`; `and $E6CD,y` at `$E589` |
| `$E821-$E82C` | 12 | `TargetSpawnTable` | three four-byte records: `($03`,`$BB`,`$76`,`$25)`, `($F3`,`$F2`,`$F3`,`$F3`) and `($08`,`$04`,`$02`,`$01`)` | `lda $E821,x` at `$E806`, `lda $E825,x` at `$E80B`, `lda $E829,x` at `$E810` |
| `$E90F-$E922` | 20 | *(unreferenced - unreachable code)* | 6502 code: `STA $30`, `INC $F8`, `ORA $0C`, `BEQ`, `STA $30`, `BNE`, `INC $E7`, `DEC $C0` | **no instruction operand lands in this block.** Unreached code, ROM offset `$290F` |
| `$EBCC-$EC9D` | 210 | *(unreferenced - unreachable code)* | 6502 code: `INC $EB`, `INC $EF`, `INC $C5`, `LDA $0D`, `LDA $CD`,`ADC #$03`,`JMP $EC0E` | **no instruction operand lands in this block.** Unreached code, ROM offset `$3BCC` |
| `$ED1E-$ED60` | 67 | *(unreferenced - unreachable code)* | 6502 code: `LDY #$07`, `LDA $0065,y`, `STA $0310,x`, `JMP $EC9E`, `CMP #$15`,`BCC`,`CMP #$0B` | **no instruction operand lands in this block.** Unreached code, ROM offset `$3D1E` |
| `$EE5C-$EE65` | 10 | *(unreferenced - unreachable code)* | 6502 code: `ORA #$07`, `ORA #$0D`, `CMP #$80`, `BCS`, `LSR $30`, `INC $F8` | **no instruction operand lands in this block.** Unreached code, ROM offset `$3E5C` |
| `$EEB4-$EEBB` | 8 | *(unreferenced - unreachable code)* | 6502 code: `LDA $32`, `LDY $A4`, `LDA #$01`, `ORA #$0C`,`CMP #$80`,`BCS` | **no instruction operand lands in this block.** Unreached code, ROM offset `$3EB4` |
| `$EF27-$EF30` | 10 | `FuelGaugeTable` | 10 bytes (`$80`,`$80`,`$A0`,`$B0`,`$80`,`$30`,`$20`,`$04`,`$30`,`$30`) - the pattern the fuel bar is drawn with | `lda $EF27,y` at `$EF19` and `lda $EF2C,y` at `$EF1D` |
| `$F1A0-$F1E6` | 71 | `PlayerMovementDeltaTable` | six parallel twelve-byte tables of small deltas - `$F1A0` (`$0B`,`$0A`,`$09`,`$08`,`$07`,`$06`,`$05`,`$04`,`$03`,`$02`,`$01`,`$00`), `$F1AC`, `$F1B0`, `$F1B4`, `$F1C0`, `$F1C8` - the per-frame movement of the helicopter and the other objects | `lda $F1B4,x` at `$F018`, `$F067` and `$F085`, `lda $F1C0,x` at `$F03C`, `lda $F1B0,x` at `$F095`, `lda $F1C8,x` at `$F0A7` |
| `$F2BB-$FFFF` | 3,397 | *(unreferenced - unreachable code)* | a long 6502 routine (`LDX $5A`, `LDY $58`, `JSR $F1E5`, `STX $5A`, `STX $5C`, ...) that runs to the end of the PRG, with the three CPU vectors in its last six bytes (NMI `$C04C`, RESET `$C000`, IRQ `$C2C0`) | **no instruction operand lands in this block.** Unreached code, ROM offset `$32BB` |

## 8. Naming, Pass 3 State, and Promotion (updated 2026-10-20)

**Promoted 2026-10-20** — whole-ROM byte-identical on the first promoted build
(`header.s`/`chr.s` + HEADER/PRG/CHR `linker.cfg` added; `make` composes
`reconstructed.nes` and `cmp`s it against `rom.nes`).

**Naming state** (per `PROMPTS.md`):
- 616 global label definitions: **0 `SubC<addr>` entry points remain** — all
  223 of the address-derived `jsr`/`jmp` entry names have been replaced with
  semantic names (see
  [Address-derived entry points (residue)](#address-derived-entry-points-residue)),
  leaving 361 semantic/branch names (`Reset`, `NmiHandler`, `TransmitByte`,
  `Sub_8764_OnCarrySet_E2D8`-style conditional-flow labels, table names).
- Live prg.s has **no `Label_CXXXX` residue** and **no raw `$XXXX`
  jsr/jmp/branch operands**. The four indirect-dispatch sites use the
  `IndDispatchXX` aliases; `jmp (Zp01)` at $E2EC became `jmp (IndDispatch01)`
  on 2026-10-20.
- `locals.inc`: 177 equates — 166 neutral `ZpXX` (roles genuinely undetermined)
  plus 11 semantic aliases (`PtrLo`, `PtrHi`, `IndDispatch01`/`17`/`19`/`1B`,
  `FrameSubCounter`, `PpuCtrlShadow`, `NmiPathSelector`, `GameState`,
  `PrngPeriodCounter`, `PrngSeedB`, `PrngState`).
- `apply_symbols.py` reports 0 substitutions available: all zero-page operands
  are already normalized (1,178 `ZpXX` references in `prg.s`).

**Naming correction (2026-10-20, with the `[a2]` dump):** `$EA` was named
`VBlankWaitCounter` until the sibling dump was finished. The evidence says
otherwise: the routine at `$C412` is the game's pseudo-random generator — it
runs the classic 6502 scrambler (`eor` / `asl` / `php` / `lsr` / `plp` / `rol`,
twice) over `$EB` and `$EC` and folds `$EA` in twice, and its callers ask for
random bytes (`$CDF4`/`$CDF9` call it twice in a row and mask the second result
with `#$07`). `$C412` is called from thirteen gameplay sites, not once per
frame, so `$EA` is the scrambler's phase counter, not a frame timer. Renamed
`PrngPeriodCounter`, and `$EB`/`$EC` were named `PrngSeedB` / `PrngState` at the
same time. The same correction was applied to the `[a2]` dump.

Two `sta` operands at `$E895`/`$E8D0` were also corrected: they read
`a:IndDispatch17,y`, which claimed the dispatch pointer's name for what is
really an absolute store to RAM `$0017` (the two-byte copy loop at `$E890`).
They now read `a:Zp17,y`, matching the file's `a:` = absolute convention, and
`Zp18` was added for the adjacent store to `$0018`.

**Data tables:** all 44 data blocks in the PRG are interpreted in the
[Pass 3 data-table inventory](#pass-3-data-table-inventory) above - 33 of
them carry a name (67 labels in all) and the 11 that carry none are blocks
whose bytes are 6502 code the tracer could not reach.  Several *named*
blocks are read by no instruction either (the text strings at `$C8F0`,
`$C96F` and `$CFF4` among them) and their rows say so.

**Residue (documented):** 380 raw absolute operand uses against 91 distinct
RAM addresses in $0000–$07FF ($02xx entity/page buffers, $0268–$0273
warm-start signature, $0700 OAM mirror). These have no `locals.inc` names yet;
their roles are only partially traced, so they remain numeric rather than
guessable — same residue class accepted in `Pinball (JU)` (408 uses) and
`Ice Climber (U)` (508 uses). 44 explicit `; ---- data $XXXX-$YYYY` regions and
387 `.byte` lines carry ROM provenance.

**Indirect dispatch** (not followed statically — pointers built at runtime):
- `jmp (IndDispatch17)` at $E79D
- `jmp (IndDispatch19)` at $E7A0
- `jmp (IndDispatch1B)` at $E7A3
- `jmp (IndDispatch01)` at $E2EC (table-walk at $E2EF, four $E3xx entries)

Build verification: `make` in this folder produces `reconstructed.nes`,
compared whole-ROM against `rom.nes` — **byte-identical**.

## Address-derived entry points (residue)

`PROMPTS.md` asks every `jsr`/`jmp` entry point to carry a semantic name and
accepts the address-derived `SubCXXXX` form **only where the dump does not
reveal a better one**.  This dump started with **223** address-derived entry
points; **all 223 now carry a semantic name and none remain address-derived.**

The names come from the game's own vocabulary, taken from the Pass 3
data-table inventory above: the helicopter, the five enemy factories and the
five targets guarding each, the radar screen with its sweep and its blips,
the fuel gauge, and the enemy sprites.  For example:

| Address | Name | Evidence |
|---------|------|----------|
| `$C412` | `UpdatePseudoRandomNumber` | the classic 6502 scrambler over `$EB`/`$EC`, asked for random bytes by thirteen gameplay sites (already documented in §8) |
| `$C48E` | `UploadPaletteToPpu` | writes 16 bytes to `$3F00` |
| `$C5A1` | `DrawSpritePart` | the core of the sprite writer, called from ten sites |
| `$C770` | `GetRadarScreenAddress` | reads `RadarScreenAddressTable` (`$C6AA`) |
| `$C85A` | `ConvertBcdToBinary` | the score digits are stored as BCD |
| `$C921` | `WriteScoreDigit` | writes one score digit through the PPU data port |
| `$CA04` | `InitTargetScan` | starts the scan over the 25 `BaseTargetParameterTable` targets |
| `$D561` | `UpdateFuelGauge` | reads `FuelThresholdTable` (`$D5BD`) |
| `$D8A7` | `CheckSpawnState` | the gate the enemy spawner checks |
| `$E79D` | `DispatchEnemyRoutine17` | the `jmp (IndDispatch17)` site the README lists in §5.5 |
| `$E806` | `LoadTargetSpawnRecord` | reads `TargetSpawnTable` (`$E821`) |

Three routines of the base dump have no counterpart here: `$C67D`
(`ReadPpuData`), `$C770` (`GetRadarScreenAddress`) and `$C77D`
(`DrawRadarScreen`) sit in the block this revision fills with the
"game over" / "complete" text instead of the radar-screen code, so the
tracer never split them here.

The remaining residue in this project is the raw-operand class already
recorded in §8 ("Residue (documented)") — 380 raw absolute operand uses
against 91 distinct RAM addresses — not the entry-point names.

## Power-on flow analysis

Derived from the disassembly by `_tools/derive_poweron.py`; the call graph is walked from the reset entry.

**RESET** is at `$C000` (`Reset`).  The CPU comes here out of reset with the PPU and APU in their power-on state and the zero page and RAM uninitialised.

The reset path calls:

| Address | Routine |
|---------|---------|
| `$C6E3` | `ResetEntry` |
| `$C6EA` | `Sub_8764_OnNonnegative_C6EA` (falls through) |
| `$C6F6` | `Sub_8764_OnNonzero_C6F6` (falls through) |
| `$C98E` | `ClearGameRam` |
| `$C70E` | `Sub_8764_OnNonnegative_C70E` (falls through) |

**NMI** is at `$C04C` (`NmiHandler`).  It is the per-frame handler; what it calls:

| Address | Routine |
|---------|---------|

**IRQ** is at `$C2C0` (`IrqHandler`) - a different address from RESET.