# Pass 1 sprite and object table audit

## Scope

This audit covers tables consumed by `ParseSpriteLayout` at `$CBEA` and the
per-hole object expansion path at `$DE5E-$DF52`. All addresses are CPU addresses
in the fixed `$C000-$FFFF` PRG view.

## A. Sprite-layout subsystem at `$CC15-$CCA6`

### `$CC15-$CC23`: sprite-layout selection map

15 bytes. The caller indexes this table with a selection/state value and obtains
one of five logical layout groups (`$00-$04`). This is an index-remap table, not
sprite data.

### `$CC24-$CC30`: standard layout pointer-low table

13 bytes:

`74 89 9E B3 C8 DD C8 B3 F2 07 1C 31 46`

These are low bytes of layout-list addresses. The matching high-byte table at
`$CC31-$CC3D` is predominantly `$CC`, with `$CD` used when a list crosses into
the next page.

Resolved standard pointers:

- `$CC74`
- `$CC89`
- `$CC9E`
- `$CCB3`
- `$CCC8`
- `$CCDD`
- `$CCC8`
- `$CCB3`
- `$CCF2`
- `$CD07`
- `$CD1C`
- `$CD31`
- `$CD46`

Repeated pointers are intentional mirroring of animation/layout states.

### `$CC31-$CC3D`: standard layout pointer-high table

13 bytes paired one-for-one with `$CC24-$CC30`.

### `$CC3E-$CC43`: alternate layout pointer-low table

6 bytes:

`5B 70 9E 70 5B 74`

### `$CC44-$CC49`: alternate layout pointer-high table

6 bytes paired with `$CC3E-$CC43`.

Resolved alternate pointers:

- `$CD5B`
- `$CD70`
- `$CC9E`
- `$CD70`
- `$CD5B`
- `$CC74`

This table shares existing lists instead of duplicating them.

### `$CC4A-$CC5E`: sprite X-offset table

21 signed/unsigned screen offsets indexed by the tile/list byte. Values repeat
`$00,$08,$10` patterns, matching three-column sprite construction.

### `$CC5F-$CC73`: sprite Y-offset table

21 offsets indexed by the same tile/list byte. Values progress by eight pixels
from `$00` to `$30`, producing row-aligned sprite positions.

### `$CC74-$CD5A`: terminated sprite-index lists

The pointer tables select variable-length byte lists in this range. Each byte is
both:

- the OAM tile value, and
- an index into `$CC4A` and `$CC5F` for X/Y placement.

Each list terminates with `$FF`; the parser also has a hard 21-entry limit.
The lists share suffixes and are deliberately referenced more than once.

### `$CD5B-$CD84` and later alternate lists

The alternate pointer table reaches `$CD5B` and `$CD70`. These are additional
terminated tile-index lists using the same coordinate tables and OAM expansion
format. Bytes beyond the last referenced terminator require separate consumer
analysis before being named as part of this family.

## B. Hole-object expansion tables at `$E283-$E3DE`

### `$E283-$E2A1`: object span-end table

31 monotonically increasing values:

`03 07 09 0B 0E 10 12 14 16 19 1B 1E 20 23 25 27 29 2B 2E 31 34 38 3A 3C 3E 40 43 45 47 49`

The parser loads the selected value into `$1D` as the exclusive end index for a
shape. The corresponding start index comes from the preceding entry at
`$E282,Y`, making `$E282/$E283` a compact prefix-boundary pair.

### `$E2A2-$E2EA`: object CHR-tile sequence table

73 bytes. For each expanded OAM sprite, the parser reads one tile value from
this table. Values are concentrated in `$E0-$F2`, matching the object/sprite CHR
region.

### `$E2EB-$E333`: object X-offset table

73 bytes paired with `$E2A2-$E2EA`. Values are mostly `$00`, `$08`, and `$10`,
with a few compact adjustments. The parser adds each value to the record's base
X byte.

### `$E334-$E37C`: object Y-offset table

73 bytes paired with the tile and X-offset tables. The parser adds each value
to the record's base Y byte.

Together these three 73-byte arrays form a structure-of-arrays representation:

- tile[index]
- x_offset[index]
- y_offset[index]

The span-end table maps an object selector to a contiguous slice of these
parallel arrays.

### `$E37D-$E383`: fixed setup span boundaries

Seven bytes:

`00 03 06 0B 10 17 1E`

The fixed setup parser uses a selector-derived range from the first two tables
around `$E37D/$E37E`. These values are prefix boundaries for larger fixed
sprite groups.

### `$E384-$E3A1`: fixed setup X-offset table

30 bytes. Values are chiefly `$00`, `$04`, and `$08`, defining compact sprite
clusters around a base position.

### `$E3A2-$E3BF`: fixed setup tile table

30 bytes. Values are concentrated in `$F5-$FC`, identifying a separate CHR
family from the variable object table.

### `$E3C0-$E3DD`: fixed setup attribute table

30 bytes. Values are primarily `$02` and `$42`, with `$82` and `$C2` variants.
The high bits encode OAM flipping while the low bits select palette 2.

The fixed setup arrays are parallel and are consumed together when constructing
OAM entries beginning near `$0298`.

### `$E3DE+`: following data

`$E3DE` begins another sequence (`08 08 00 ...`) not indexed by either audited
object expansion loop. It remains a separate table until its consumer is
identified.

## C. Per-hole object record format

After the fixed setup portion, `ParseHoleObjectList` consumes three-byte records:

- byte 0: object selector, or `$FF` terminator
- byte 1: base X adjustment
- byte 2: base Y adjustment

Selector `n` obtains a slice:

- start = span boundary `n`
- end = span boundary `n + 1`

Each slice element expands to one OAM entry using the tile/X/Y parallel arrays.
Selectors whose expanded table index reaches `$2B` use OAM attribute `$42`;
earlier entries use `$02`.

## D. Classification conclusions

Confirmed structured data:

- `$CC15-$CC23`: layout-group remap
- `$CC24-$CC49`: split pointer tables
- `$CC4A-$CC73`: paired coordinate tables
- `$CC74` onward: `$FF`-terminated sprite-index lists
- `$E283-$E2A1`: object span boundaries
- `$E2A2-$E37C`: three parallel 73-byte object expansion arrays
- `$E37D-$E3DD`: fixed setup boundaries and three parallel 30-byte arrays

No executable entry point exists inside these audited table ranges. Any legal
6502 opcode sequence found inside them is data and must be excluded from recursive
code tracing.