0 Fork 0

Files

T

tmerritt 691b2bc23c Xevious (U): Pass 1 disassembly

The first _wip project to get a real disassembly.  4,165 instructions /
8,444 code bytes (25.8%), 24,324 data bytes, 0 unclassified -- every byte
of the 32 KB PRG is now classified as code or data.

The split needed three stages, all recorded in prg.s's header:

  * nesdis.py --undocumented --auto-seed at base $8000 gave 3,272
    instructions / 6,555 bytes.  The undocumented opcodes matter here: the
    trace stops dead at the first one it cannot decode.
  * Four hand-seeded entries ($C08B, $DC1E, $E0D5, $E134).  Each is a
    branch target from decoded code that sat inside an untraced data run,
    so the tracer never reached it.
  * A merged four-session Mesen Code Data Logger capture (kept as
    xevious_mesen.cdl) promoted 1,902 bytes from data to code and
    demoted 22 the trace had called code.

Two tool bugs fell out and are fixed here:

  * nesdis.py emitted the undocumented single-byte NOPs ($1A/$3A/$5A/
    $7A/$DA/$FA) as `nop`, which ca65 assembles as the *official* $EA --
    the rebuild stopped being byte-identical at $DF82.  The check now
    keys on the opcode byte, not just the addressing mode.  All three
    `make regen` pipelines (MUSCLE, Pyramid, Urban Champion) are
    unaffected and still reproduce prg.s byte for byte.

  * cdl_reclass.py left the original data-block header in place when the
    CDL split that block, so the file ended up with two region headers
    describing overlapping spans (20 of them here).  The header is now
    dropped with the block it describes; the promoted projects that use
    the tool are byte-for-byte unchanged.

The project README has the power-on flow analysis.  The most interesting
find is at $FC45: the reset path compares RAM $0100-$0107 against the
ASCII string "Kei Cros", and the copyright text at $FF1E reads
"MAIN: KEI CROSS.  SOUND: UHOHOY OHNOGI."  The OAM is at $0700, not
$0200 -- the NMI handler does LDA #$07 / STA $4014.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add explicit `make wip` / `make wipclean` targets for the _wip tier

The root Makefile's all / clean / <MAPPER> targets deliberately name only
the promoted mapper folders, so nothing in them reaches into _wip/.  Give
the pre-promotion tier its own opt-in targets instead of the manual
`for d in _wip/*/*/; do make -C "$d"; done` loop:

  make wip          # build + verify every _wip/<MAPPER>/<Project>/
  make wipclean     # clean the build artifacts in that tier

Both the Makefile and the four documents that describe the tier (README,
TODO, WIP, AGENTS) are updated together, so the tree stays consistent.

The same commit records Xevious (U) reaching Pass 2 in those documents:
all 487 labels named, every branch and call symbolic, zero Label_XXXX and
zero raw $XXXX operands left.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update the _wip/ tier documentation; fix the make wip target and the mirroring bug

The WIP tier's four documents (WIP.md, README.md, TODO.md, AGENTS.md) had
drifted away from the tree.  Every number in them was re-derived from the
ROMs and the folder layout rather than carried forward.

Counts and structure
  - The tier holds 854 projects across 29 mapper folders, not "856 across
    30".  Xevious (U) and Zanac (U) were promoted on 2026-10-20 and their
    _wip/ folders were left behind as residue -- "git mv" moves only the
    tracked files, so the old folder survived with its build artifacts and a
    stale README.  Both are removed now; the promotion procedure documents
    the step so it does not recur.
  - _wip/MAPPER8/ holds a copy of the already-promoted Mermaids of
    Atlantis (U) and is excluded from every count and table.
  - Pass 0 skeletons: 852 (was 855).  Xevious (U) left the tier, so the
    two projects with a real disassembly are Golf (JU) and Volleyball (U).
  - PRG sizes 2 / 150 / 42 / 522 / 127 / 10 / 1; 226 projects with no CHR;
    38 keep the CPU-address linker layout; 37 are mapper 0.
  - Every inventory row was re-checked against its ROM: PRG/CHR size,
    mirroring, all three vectors, and the battery / four-screen / footer
    notes.  854 of 854 rows now match.

Fixes
  - The root Makefile used $(WIP) but never defined it, so "make wip" and
    "make wipclean" expanded to "for m in /*/" -- they walked the
    filesystem root instead of the tier.  "WIP := _wip" is now defined, and
    "make wip" builds and verifies the whole tier: 855 of 855 passed, 0
    failures.
  - make_skeleton.py masked header byte 6 with 0x03, so the battery bit
    (bit 1) leaked into the mirroring value and 56 battery-backed ROMs'
    READMEs claimed "Four-screen" while their own "Four-screen VRAM" row
    said "no".  The mask is now 0x01 and the 56 READMEs are corrected.
  - Golf (JU)'s README still described the pre-flatten copilot/ folder and
    the old PRG-only compare; it now describes the whole-ROM build.
  - Pyramid (U)'s audit comments are canonical again, so Golf (JU) is the
    only project in the tree still on the pre-canonical spelling.

New in WIP.md
  - Byte 7's lower nybble is non-zero on 58 of the ROMs -- 55 carry the
    literal "DiskDude!" watermark, two "DisNi0330", one "byKH+KEN".  Only
    the upper nybble carries mapper bits, so the noise is harmless.
  - The twelve ROMs that set the four-screen bit, split by whether their
    board actually supports four-screen VRAM.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote Volleyball (U) from _wip/NROM/ to NROM/

Volleyball (U) reached Pass 3 before promotion, so this is a promotion of a
finished disassembly rather than a Pass 0 skeleton.

The disassembly
  - 11,395 instructions / 23,926 code bytes (73.0 % of the PRG image),
    8,842 data bytes, 0 unclassified.
  - The split needed the game-state dispatch table at $85E1 declared to the
    tracer (--table 85E1:11) -- without it only 66 % of the image traced --
    plus a Mesen Code Data Logger capture taken while a random-input bot
    played the attract demo, which promoted 1,757 bytes from data to code.
  - Pass 2 named all 1,989 labels: 730 read out of the code by hand, 1,221
    internal branch targets derived mechanically.  Zero Label_XXXX, zero raw
    $XXXX call or branch operands, zero SubC residue.
  - Pass 3 named the zero page, the $0500 ball structure and all 37 data
    blocks.  apply_symbols.py --report: 0 pending substitutions, 0
    multi-alias residue.  align_audit_comments.py: no column drift.
  - cdl_check.py cross-checks the finished prg.s against the capture: 0
    CDL-code bytes not covered by an instruction, 0 CDL-data bytes that
    start one.
  - 29 neutral ZpXX zero-page slots remain, each with its reason recorded
    in locals.inc, as the promotion rules allow.

The promotion
  - git mv "_wip/NROM/Volleyball (U)" "NROM/Volleyball (U)".  Mapper 0, so
    it lands in NROM/.  The whole-ROM build was already in place, so there
    was no build surgery; the project builds byte-identically at its new
    home and the old folder is gone (git mv moves the untracked build
    artifacts too, so no residue was left behind).
  - Root README.md: new inventory row 39 and a per-project detail section,
    plus the WIP-tier counts.  The detail sections for Xevious (U) and
    Zanac (U) were numbered one too high against the inventory rows and
    are now aligned; a leftover editing note in the same place is gone.
  - WIP.md: the Volleyball row leaves the inventory, and the tier is now
    853 projects across 29 mapper folders (36 in _wip/NROM/), 852 of them
    Pass 0 skeletons.  Golf (JU) is the only project left in the tier with
    a real disassembly.
  - TODO.md and AGENTS.md: the same counts, and the promoted tier is now
    40 projects (39 under NROM/).

Verified: make wip builds and verifies the whole tier (854 of 854 passed,
0 failures) and make builds the promoted tier (39 of 39 passed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Rename NROM/Pyramid (U) to NROM/Pyramid (U) (Sachen)

The promoted inventory row had read "Pyramid (U) (Sachen)" since the
project was promoted on 2026-10-20, but the folder was named "Pyramid (U)" --
so the row pointed at a folder that did not exist.  The folder now matches
the row, and the project's own README title, its ROM file name
("Pyramid (U) (Sachen).nes") and the parenthetical convention the rest of
the promoted tier already uses (Popeye (JU) (PRG 0/1), Raid on Bungeling
Bay (U) [a2], Pac-Man (Tengen) (U)).

What changed inside the project
  - The Makefile's regen target passes --project "Pyramid (U) (Sachen)", so
    the tracer writes the matching header line.  prg.s and locals.inc were
    updated to that header line and nothing else -- the disassembly is
    byte-identical to before.
  - make regen still reproduces prg.s and locals.inc byte for byte.
  - The project's README's build-verification line now names the new folder.

References updated: the root README.md (inventory prose, the row-33 detail
section, the build-status table, and the notable-observations bullet),
TODO.md (the promoted-projects table and the Pyramid notes) and AGENTS.md
(the recently-promoted list and the unlicensed-titles quirk).

Verified: make builds the promoted tier (39 of 39 passed) and the project
rebuilds byte-identically at its new path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Rebuild Mermaids of Atlantis (U): bank-aware Pass 1, Pass 2/3 names

The promoted project did not build: a Pass 2 rename had been applied
half-way, leaving eight undefined symbols and two jumps that pointed at
the wrong routine, while the root README already claimed the project was
byte identical.  The _wip copy still built, because it held the un-renamed
Pass 1 source.

The disassembly is now derived from the ROM itself, with the Mesen Code
Data Logger as the oracle for the code/data split:

* _tools/banked_dis.py traces every MMC3 bank separately, each with the CPU
  window it is visible at, seeded from a CDL capture so the code a static
  trace cannot reach is disassembled too.  The CDL is the authority: a
  decode the CPU never fetched is dropped, and so is the fall-through
  behind a call whose target never returns (the game's dispatchers have
  their jump table right behind the call).
* One segment per bank (PRG0..PRG7) with its own .org, so the assembler
  knows the CPU address of every label while the linker still writes the
  bytes to the bank's file offset.  A flat segment cannot do both: a call
  would encode the file offset instead of the CPU address.
* Pass 2 names every label - 494 routines, no Label_XXXX and no raw
  $XXXX branch or jump operand left.  Pass 3 applies 13 semantic zero-page
  aliases and writes the routine headers.
* 8,075 bytes of code (12.3% of the 64 KB PRG), up from 200 bytes.

The banking turned out to be unusual and is documented: the fixed bank is
the fourth 8 KB bank (file $6000-$7FFF), not the last one, and the image
carries the reset stub and the vector table twice.  The live NMI vector
is $808F - the frame handler - while the copy at the end of the image
names $8189, which is a BRK in the first half.  The game's text table
lives at CPU $F1D6, which is the fixed window, and that is what settles
the question.

Also: the leftover _wip/MAPPER8 folder is removed, as it is for every
other promotion.

The project builds byte identical:

    Byte-identical ROM verified.

Add CHANGELOG.md: the pass history of every project

A project goes through four milestones - Pass 1 (the code/data split),
Pass 2 (the labels replaced by names), Pass 3 (the semantic naming) and
Promotion (the move into the top-level mapper folder) - and the history
of those milestones was scattered over the commit log, the project
READMEs and the root README.

CHANGELOG.md gathers it: one section per project with a row for each
milestone, the date, and a sentence saying what the milestone produced.
The numbers are the ones the project README and the root README already
carry - instruction count, code coverage, named labels, semantic
zero-page aliases, named data tables - so a reader can see at a glance
which projects are done and which are not.  Golf (JU), the only project
still in _wip/ with a real disassembly, is listed with its open
milestones, and the other 852 _wip/ projects are covered as a tier.

The requirement is now part of the workflow contract: PROMPTS.md gains a
"Pass 3: Changelog entry" section and a ninth checklist item, and
AGENTS.md points at the file.  A milestone and its changelog row go in
the same commit, so the changelog and the source never disagree.

Balloon Fight (JU): repair the audit trail and complete the routine headers

The per-instruction audit trail was stale by two bytes from
ResetInitializationData ($C085) onward.  5,944 of the 6,007 comments named
the wrong CPU address and PRG offset, because the three-byte .byte "HAL"
signature at $C082-$C084 had been counted as one byte when the trail was
first generated - the routine headers and the linker labels were right all
along, so the source and its own headers disagreed with each other.  The
trail was rebuilt from the ca65 -l listing with
_tools/repair_audit_comments.py, and every rewritten comment was re-checked
against prg.bin.  The comments were also moved into the canonical column-35
field: they had sat two spaces after the mnemonic, with no column discipline
at all, unlike every other promoted project.

All 63 routine headers now carry a ; Clobbers: block, so the headers carry
the full template AGENTS.md describes.  The blocks are derived, not written by
hand.  The new _tools/derive_clobbers.py takes the opcode from the audit
comment's byte list, so the addressing mode is exact and a data directive is
never mistaken for an instruction; it resolves the operand through
locals.inc and symbols.inc to name what is written; it follows the real
control flow, so a jsr to another named entry is a call (the callee's
clobbers count) while a branch or a fall-through is not; and it models
register preservation, so NmiHandler reports *no register* - it saves and
restores A, X and Y around the frame - and FlushPpuCommandPreserved reports
only A, because X and Y come back unchanged.

Two tools changed.  derive_clobbers.py is new.  align_audit_comments.py had
an off-by-one: it tested the indented code length against 31 instead of
against 35, so code texts of 28-31 characters were never padded into the
column.

The change is comments only.  The code text of all 8,538 lines is unchanged,
make still prints "Byte-identical ROM verified.", the 6,007 audit comments
still re-check against prg.bin, all 63 routine headers agree with the
instructions they describe, and every label agrees with reconstructed.lbl.
ReflectObjectYVelocity and UpdateSpecialObjectSystem moved out of locals.inc
and became labels in prg.s at their real addresses.

CHANGELOG.md becomes the repository's running log: a Pending list of the
changes to be put in the next commit, a History of the commits already made,
and the per-project milestone index at the end.  The next commit's message is
written from the Pending entries, so the two cannot drift apart.  PROMPTS.md
and AGENTS.md describe the new shape.  WIP.md drops the _wip/MAPPER8/ note:
the folder held a copy of Mermaids of Atlantis (U) that had already been
promoted.

World Class Track Meet (U): Pass 1, the code/data split

Pass 1 is done.  The split is 8,400 instructions / 18,028 code bytes (55.0 %)
of the 32 KB PRG, with 884 routine entries, 55 data blocks and 102 zero-page
aliases.  The PRG is CNROM (mapper 3) and maps whole at $8000-$FFFF, so the
linker moved the PRG segment from a .nes file offset to $8000 and the build
still compares byte identical.

Four dispatch tables had to be seeded by hand.  The event table at $F796 (5
entries) is read at $F780 and jumped to through `jmp ($001F)`.  The three
push-pointer tables - $BFC4 (16 entries), $BFE4 (2) and $E5F2 (7) - push a
handler address and `rts` into it, and the 6502's `rts` adds one to the
address it pops, so each table stores the entry address minus one; the seeds
are the table values plus one.  The tracer runs with --undocumented: the code
uses undocumented NMOS opcodes as ordinary code (ANC $37 at $BFF8, and the
RRA/RLA/SLO and NOP forms elsewhere).  Seeding the tables takes the coverage
from 27.8 % to 55.0 %.

$C0BE-$C0C5 is forced back to data: the IRQ vector $C0C0 points into the
middle of the `jmp $C047` at $C0BE, and the game never executes CLI, so the
vector is dead.  `make pass1` regenerates prg.s and locals.inc from prg.bin
and reproduces the committed prg.s byte for byte.

The project README records the split, the four dispatch tables, the dead IRQ
vector, the wrong CHR size field in the header, and what is still data.  The
milestone index in CHANGELOG.md gains the project; WIP.md, README.md and
AGENTS.md follow the tier counts and the layout.

nesdis.py gains a --mapping-note option, so the header's "PRG mapped at" line
can describe a board that is not NROM - CNROM's whole 32 KB at $8000-$FFFF is
not "mirrored to the upper half".

Replaces runs of $00 and $FF with .res <run>, <byte>

Golf (JU) and World Class Track Meet (U): Pass 2/3 complete, promoted from _wip/

- World Class Track Meet (U) - Pass 2 complete: all 884 Label_<addr>
  definitions replaced (651 semantic routine names + 233 Sub_<addr>), all 731
  raw $XXXX jsr/jmp call operands resolved to symbolic labels, all branch
  targets given role-based names; routinemap.tsv added; make stays
  byte-identical.
- World Class Track Meet (U) - Pass 3 complete: 24 semantic zero-page
  aliases applied via apply_symbols.py (0 residue), 78 neutral ZpXX slots
  documented with reasons in locals.inc, all hardware-register operands use
  symbols.inc names, project README rewritten with Pass 2/Pass 3 sections and
  data-table inventory; promoted out of _wip/CNROM/.
- World Class Track Meet (U) - project README documents the five event-table
  entries at $F796 and marks the olympics mode as not yet proven.
- Golf (JU) - audit comments converted from pre-canonical (; C000: A9 00)
  to the canonical ; CPU:$C000 PRG:0000  A9 00 form at column 35; 4,156
  comments re-aligned, comment/whitespace only, whole-ROM build stays
  byte-identical.
- Golf (JU) - 339 internal branch-target Label_ labels given role-based names
  via _tools/derive_branch_names.py; 0 raw $XXXX branch/jump operands remain.
- Golf (JU) - 275 zero-page operands substituted with locals.inc aliases via
  apply_symbols.py; 0 residue; promoted out of _wip/NROM/.
- Xevious (U) - runs of $FF padding replaced with .res <count>, $FF in prg.s;
  whole-ROM build stays byte-identical.
- Both projects promoted via git mv; leftover _wip/ folders removed; root
  README.md inventory rows added; WIP.md rows removed.

World Class Track Meet (U): apply zero-page symbol substitutions

Run apply_symbols.py to substitute ZpXX zero-page operands with
semantic locals.inc aliases (SlotState, GameMode, etc.) at proven
sites; 0 residue, whole-ROM build stays byte-identical.

Xevious (U): re-split Pass 1 from the Mesen CDL and decode the data tables

- Xevious (U) - Pass 1 re-split from the Mesen CDL (xevious_mesen.cdl) with
  _tools/cdl_reclass.py: 1,158 bytes data->code, 48 code->data, 42 labels
  emitted and 3 branch targets labelled; code 11,321->12,455 bytes
  (34.5%->38.0%), instructions 5,513->6,002. The 45 recovered entry points
  are named Sub_XXXX, so no Label_XXXX remains; six CDL-silent raw call
  operands are documented as residue.
- Xevious (U) - the 4,448-byte block at $A74B-$B8AA is split into six proven
  tables: VramWritePtrTable (15 pointers), VramWriteData, DataStreamPtrTable
  (16), ObjTilePtrTable (99), ObjTileData and DataStreamData. The $D833
  pointer table is corrected to base $D833 (4 entries; the old ObjCodePtrTable
  at $D834 was one byte late). $F957-$FAF5 is split into ObjSpeedTable,
  ObjSpeedTable2, SpriteLayoutPtrTable (19) and SpriteLayoutData;
  $FEE6-$FF1C into PaletteData and OamAttrTable. $F5D8 is decoded as
  TextTileData (font tile indices: PLAYER, GAME OVER, READY, SOLVALOU, LEFT,
  PAUSE); $F53C becomes AttrAddrTable, $F89E HandlerPtrTable and $EF3B
  SpriteLayoutData2. Project README rewritten with the corrected stats, a
  32-entry table inventory and the Pass 1 residue.
- _tools/cdl_reclass.py - preserve the data label(s) between a data-block
  header and its first .byte row when the block stays data; the $DF78 split
  dropped Data_DF78 and the rebuild failed with an undefined symbol.
- _tools/resolve_raw_branches.py - handle negative relative offsets
  (beq *-$0B); the pattern only matched *+$NN and *$NN.

Docs: refresh the tier counts to 41 promoted / 851 _wip, add the WCTM row

- Docs - tier counts refreshed to the post-promotion state across AGENTS.md,
  root README.md, WIP.md, TODO.md and CHANGELOG.md: 41 promoted projects
  (38 under NROM/, plus CNROM/World Class Track Meet (U), UNROM/Zanac (U) and
  MAPPER8/Mermaids of Atlantis (U)) and 851 _wip/ projects, every one of them
  a Pass 0 skeleton. The stale "39/40 promoted", "853 _wip", "Golf (JU) is
  still in _wip/" and "Golf is the last pre-canonical project" statements are
  corrected.
- Root README.md - the promoted inventory gained the missing World Class Track
  Meet (U) row (row 41, mapper 3, 32 KB PRG / 32 KB CHR), and the "All 38 are
  mapper 0 / 16 KB PRG" sentence is replaced with the actual split (36 of the
  41 rows are mapper 0 / 16 KB; Xevious and Volleyball are 32 KB, World Class
  Track Meet is mapper 3, Zanac mapper 2 and Mermaids mapper 8).

2026-10-21 11:36:32 -04:00

20 KiB

Raw Blame History

AGENTS.md

What this repo is

Forty-one AI-generated disassemblies of NES ROMs, organized by mapper. All 41 are promoted into the top-level mapper directories and all verify byte-identical for the whole ROM (most recently Golf (JU) and World Class Track Meet (U) on 2026-10-21); 851 more live under _wip/ (29 mapper folders: NROM, MMC1, UNROM, CNROM, MMC3, MMC5 and 23 more), all verifying byte-identical for the whole ROM as of 2026-10-21 (make wip: 851 of 851 built, 0 failures). All 41 promoted projects carry real disassemblies (Pass 1 or beyond); all 851 _wip/ projects are Pass 0 skeletons (prg.s is a single .incbin "prg.bin"). The contract (stated in PROMPTS.md and verified by make in every project folder) is byte-identical rebuilds: reconstructed.nes must match the original ROM exactly. Not for distribution (README.md).

Layout

Projects live in a folder under their mapper directory: NROM/, AOROM/, CNROM/, MMC1/, MMC3/, MMC5/, UNROM/, MAPPER8/. The 41 promoted projects are 38 under NROM/, plus CNROM/World Class Track Meet (U) (mapper 3), UNROM/Zanac (U) (mapper 2) and MAPPER8/Mermaids of Atlantis (U) (mapper 8); Xevious (U) and Volleyball (U) are mapper 0 but have a 32 KB PRG, so NROM/ also holds the only two mapper-0 projects that are not 16 KB. AOROM, MMC1, MMC3 and MMC5 are empty placeholders (2026-10-21). The pre-promotion tier mirrors the same structure at _wip/<MAPPER>/ (currently 29 folders: _wip/NROM/, _wip/MMC1/, _wip/UNROM/, _wip/CNROM/, _wip/MMC3/, _wip/MMC5/ and _wip/MAPPER<NN>/ for every other mapper). AGENTS.md files written before 2026-10-20 say "top-level folder"; that location is now <MAPPER>/<Project>/.
Each project folder is flat — there is no copilot/ subfolder (flattened 2026-10-20; commit history, root README.md and TODO.md predate the flatten and still say copilot/... — mentally strip the prefix). Every file sits in the project folder: prg.s, header.s, chr.s, linker.cfg, symbols.inc, locals.inc, Makefile, the prg.bin/header.bin/chr.bin splits, a built rom.nes copy/symlink of the original ROM, and a per-project README.md (power-on flow analysis — the file was called OVERVIEW.md before 2026-10-20). Bomberman (U)'s legacy main.s pre-standardization duplicate was removed 2026-10-20 (recoverable in git history) — every project's build source is prg.s. A few projects lack prg.bin (carve the PRG out of rom.nes instead).
Root Makefile builds and verifies every project under all eight mapper directories: make (all), make clean, or make <MAPPER> for one tier, e.g. make MMC3. It loops with quoted sub-make invocations because project names contain spaces and parentheses, which break make-target names. It is non-parallel; each project's own Makefile verifies byte-identity before "Byte-identical ROM verified." is printed. The _wip/ pre-promotion tier is reached only through the separate make wip / make wipclean targets — all, clean and <MAPPER> never touch it. WIP := _wip at the top of the root Makefile is what makes those two targets work: an empty $(WIP) expands the loop to for m in /*/, which walks the filesystem root instead of the tier.
Root CHANGELOG.md is the repository's running log of every change, across all the projects. It has three parts: a Pending list at the top - the changes to be put in the next git commit - a History of the commits already made, and the milestone index at the end, which is the per-project pass history (one section per project with a row for each of the four milestones: Pass 1 the code/data split, Pass 2 the labels replaced by names, Pass 3 the semantic naming, Promotion the move into the top-level mapper folder). As work lands, a line goes into Pending; the next git commit's message is written from those entries, and they then move to History under the commit they went in with. A milestone and its milestone-index row go in the same commit - the requirement is in PROMPTS.md ("Pass 3: Changelog entry"), and the checklist item is part of the promotion requirements.
Root README.md is the index for the promoted tier: vectors, build fixes, and summary for the 41 promoted projects (38 under NROM/, plus CNROM/World Class Track Meet (U), UNROM/Zanac (U) and MAPPER8/Mermaids of Atlantis (U)). Keep it in sync when a project changes — its DK Jr. entries drifted badly before being corrected, and its vector column later turned out to have five rows wrong from copy-paste duplication. The pre-promotion tier (851 projects under _wip/) is indexed in WIP.md, which carries its layout, its quirks and its open work.
TODO.md is the handoff: open work per project, plus the gotchas that cost real time. Read it before starting anything non-trivial.
PROMPTS.md is the workflow contract. default_project.tar.gz is the empty-project skeleton (flat: prg.s, symbols.inc, linker.cfg, Makefile, locals.inc). The master ROM store used to be _ROMS/; it was dissolved on 2026-10-20 and every ROM now lives in its own project folder under _wip/<MAPPER>/<Project>/, so the ROM and its skeleton are side by side.
_tools/: nesdis.py (Pass 1 tracer), banked_dis.py (Pass 1 tracer for a banked PRG — one segment per MMC3 bank, seeded from a Mesen CDL capture), pass2.py and bytecode_dis.py (Pass 2/3 emitters), apply_symbols.py (substitutes symbols.inc/locals.inc names into prg.s operands), trace_stage_payload.py (py65-based runtime tracer), cdl_reclass.py (Mesen-CDL-driven code/data split fix), verify_pass1.py (rebuild + re-trace check across the top-level projects), audit_comment_tool.py (adds canonical audit comments using tracer as ground truth), repair_audit_comments.py (repairs damaged audit trails — shifted/?? comments — from the ca65 listing, validated against prg.bin), apply_pass2_map.py (applies an address→name Pass 2 map), derive_branch_names.py (derives the internal branch-target names), describe_routines.py (fills in the routine header blocks from the routine names), apply_zp_aliases.py (per-site zero-page alias substitution), name_data_region.py (names a data block, splitting the .byte row when needed), resolve_raw_branches.py (turns bXX *+$NN operands into labels), align_audit_comments.py (restores the canonical column-35 audit comment), derive_clobbers.py (derives the ; Clobbers: block of every routine header — registers, flags and memory, with register preservation modelled), make_skeleton.py (creates a byte-identical Pass 0 build skeleton for a project folder — splits the ROM, writes the ca65 sources, the linker config, the Makefile and the project README; refuses to overwrite an existing prg.s without --force), splitnes.py, chr2gif.py.

Commands

make                            # repo root: build + verify every project (all mapper dirs)
make wip                        # repo root: build + verify every project under _wip/
cd "NROM/<Project>" && make     # one project: builds reconstructed.nes, then cmp vs rom.nes
python3 _tools/verify_pass1.py  # rebuilds + re-traces the top-level projects

make's default target includes the byte-identity cmp — a build that doesn't print "Byte-identical ROM verified." is a failure. Requires ca65/ld65 on PATH.

There are two build tiers, and the difference is real. Promoted projects (top-level NROM/ etc.) compare the whole ROM against rom.nes in the project folder. Since 2026-10-20 the _wip/ projects do the same — they carry header.s/chr.s, a HEADER/PRG/CHR linker.cfg and a rom.nes, and make compares the whole ROM. The real difference between the tiers is now content, not plumbing: a _wip/ project may still be a Pass 0 skeleton (prg.s is a single .incbin "prg.bin"), so it is not promotable until it carries a real disassembly.

The root Makefile deliberately does not cover _wip/ under all, clean or the per-mapper targets — those only ever touch the promoted tier. The pre-promotion tier has its own explicit targets:

make wip          # build + verify every _wip/<MAPPER>/<Project>/
make wipclean     # clean the build artifacts in that tier

(Equivalently, for d in _wip/*/*/; do make -C "$d"; done still works.)

Promoting a project out of `_wip/`

git mv "_wip/<MAPPER>/<name>" "<MAPPER>/<name>" — everything is already flat, so nothing needs to move inside the folder.
The whole-ROM build is already in place (header.s/chr.s, the HEADER/PRG/CHR linker.cfg and rom.nes), so there is no Makefile or linker work left to do — promotion is git mv plus the disassembly work. This was still a manual step before 2026-10-20; Lunar Pool (U) (2026-10-18) and Donkey Kong (JU) (2026-10-19) are the worked examples, and DK (JU) also fixed a header-byte mirroring error in its project README.md (Vertical → Horizontal from byte 6 = $00).
_tools/ paths: ../../_tools/ from a promoted project (<MAPPER>/<name>/), but ../../../_tools/ from a _wip/ project (_wip/<MAPPER>/<name>/ is three levels deep, not two). _tools/apply_pass2_map.py and _tools/derive_branch_names.py take a --bank-prefix / bank-prefix argument for labels of banks that share a CPU window.
Verify make, then make regen if a regen pipeline exists.
Add it to the root README.md inventory and remove its row from WIP.md.
Delete the old _wip/ folder. git mv moves only the tracked files, so the old folder survives with its untracked build artifacts (*.o, reconstructed.nes, reconstructed.lbl, reconstructed.map) and sometimes a stale README.md. A leftover folder counts as a project in every tier tally while having no source to build — Xevious (U) and Zanac (U) both left one behind on 2026-10-20, and both were cleaned up on 2026-10-21.

Irreversible conventions (do not "clean up" past these)

Every instruction carries a trailing audit comment with its CPU address, PRG offset and exact emitted bytes. The canonical format is ; CPU:$C123 PRG:0123 AD 21 03 — all 41 promoted projects now use this exact format (standardized 2026-10-19; the last pre-canonical project, Golf (JU), was converted at its Pass 2/3 and promotion on 2026-10-21, so no project in the tree uses the old ; C007: AD 02 20 spelling for its audit trail). This is the byte-identity audit trail — preserve it even while renaming labels or restructuring files. The earlier gap (6 variants, 1,013 uncommented lines in Excitebike) was closed 2026-10-19 via _tools/audit_comment_tool.py; Excitebike's shifted/?? damage was re-anchored 2026-10-20 via _tools/repair_audit_comments.py (listing-based, self-validating against prg.bin).
The audit comment starts at column 35: nesdis.py pads each instruction to 31 characters before the ; . A Pass 3 substitution that lengthens an operand pushes the comment right, so re-align after substitutions with _tools/align_audit_comments.py (whitespace-only — it cannot change the bytes).
Unreached/unresolved bytes stay as data (Label_/Data/ .byte or .incbin blocks with ROM provenance), never deleted or reformatted.
Routine headers follow the template in prg.s: global + local description, parameters, returns, clobbers.
Two separate symbol files: symbols.inc = NES hardware constants only; locals.inc = zero-page and forward references. Unresolved zero-page bytes keep neutral ZpXX names rather than speculative names. Proven semantic names may sit beside the generated ZpXX entries as aliases.
Pass discipline: Pass 1 = code/data split (stop for review), Pass 2 = label replacement, Pass 3 = semantic naming of data tables/structures. Do not skip straight to guessy rewrites. When a pass is only partly achievable, record the residue and why rather than inventing names.
make regen (where it exists, e.g. MUSCLE) must keep reproducing prg.s byte-for-byte on the standard library alone. Re-check it after any nesdis.py change.

Hard-won quirks (details in root `README.md` per-project "Build fix")

The _wip/ tier is mostly a banked mapper with a PRG image larger than the 6502's address space. Only 2 of its 851 projects have a 16 KB PRG; 149 have 32 KB, 522 have 128 KB and one (Action 52 (U) [!]) has 1.5 MB. Those projects link their MEMORY areas at .nes file offsets (HEADER at $0000, PRG at $0010, CHR after it) rather than at CPU addresses, which is both the only option and the honest model for a banked mapper. The 38 older _wip/ projects keep the CPU-address layout ($C000/$4000 or $8000/$8000) because their PRG really is one contiguous window. See "Two linker layouts" in WIP.md.
The mapper comes from the iNES header: byte 6's upper nybble is mapper bits 0-3, byte 7's upper nybble is mapper bits 4-7. _wip/ uses the repo's board vocabulary where it exists (NROM, MMC1, UNROM, CNROM, MMC3, MMC5) and MAPPER<NN> for every other mapper.
ld65 writes the output file in MEMORY declaration order, not address order. The areas must be declared in the order the bytes appear in the .nes file: HEADER, PRG, CHR, TRAILER.
A banked PRG needs one MEMORY area per bank, and one segment per bank. Mermaids of Atlantis (U) (mapper 8, 64 KB PRG) declares PRG0..PRG7 at the eight file offsets and gives each segment its own .org for the CPU window the bank is visible at. The bytes land at the right file offset (the image is byte identical) and the assembler knows the CPU address of every label, so jsr SomeRoutine assembles to the right operand. A flat segment cannot do both: its addresses are file offsets, and a call would encode the file offset instead of the CPU address. Labels of a bank that shares its CPU window with another bank need a prefix (Bank4_..Bank7_); _tools/apply_pass2_map.py and _tools/derive_branch_names.py take a --bank-prefix / bank-prefix argument for that.
The MMC3's fixed bank is not always the last 8 KB of the PRG. On real hardware $E000-$FFFF is the last bank, but a 64 KB MMC3 image can be built so the game expects another one: in Mermaids of Atlantis (U) the fixed bank is the fourth 8 KB bank (file $6000-$7FFF) - the text table the code reads at $F1D6 is there, and the image repeats the reset stub and the vectors at the end so it also boots on a mapper that fixes the last bank. The dump's own code settles the question: the NMI vector in the fixed bank names a handler that exists, and the copy at the end of the image names one that does not.
Memory area sizes are hexadecimal. size = $127 is 295 bytes, not 127.
226 _wip/ projects have no CHR at all (the mapper supplies CHR RAM), so they have no chr.bin and no CHR area. Six have trailing bytes the header does not account for, reproduced by a TRAILER: size = $007F area — and the two Wall Street Kid dumps have 64 KB of trailing graphics data whose header size fields are simply wrong.
Header byte 6 bit 0 is the mirroring bit and nothing else is. 0 = Horizontal, 1 = Vertical — the convention README.md states and every per-project README uses. Bit 1 is the battery flag, bit 2 the trainer flag and bit 3 four-screen VRAM; each has its own row. Folding the battery bit into the mirroring value is a bug that once made 56 battery-backed _wip/ READMEs claim Four-screen.

Also: Pass 3 naming expectations for promotion are in PROMPTS.md — every branch/jump target must carry a ROM-specific semantic name (no Label_CXXXX, no raw $XXXX operands), and comment/audit alignment is re-done after substitutions.

The flat disassembler mislabels bne as bpl; fixes use bne *-$XX to reproduce the original bytes (Clu Clu Land, Defender 2, Excitebike).
Zero pages are reused across modes; aliases may be required in locals.inc (e.g. RandomStateAlt = $E4 beside RandomState0 = $54).
Donkey Kong Jr. is architecturally different: reset entry is $C66E, the reset path idles forever in an LFSR loop, and the entire frame state machine runs inside NMI. Its DeferredTaskHandlerTable entry 0 deliberately mirrors the IRQ vector word at $BFFE.
IRQ vectors often point at unused/data targets in these games — verify before assuming a handler is broken.
Unlicensed titles break static-trace assumptions: Pyramid (U) (Sachen) pokes a mapper unlock at $4100 (beyond the register space) despite a mapper-0 header, and dispatches through jmp ($0002) built from RAM — trace via its two queue tables ($C3A6, $CCD5), and do NOT fall-through-seed gaps that follow rts/jmp/brk (that misclassifies data as code).
ROM filenames contain spaces and parentheses (e.g. M.U.S.C.L.E. (U).nes); builds incbin a space-free rom.nes in the project folder. Keep that copy/symlink working and don't rename it. Note that a name with spaces/parens is also what makes FCEUX hang headless — symlink it to a clean name and run under Xvfb.
.gitignore contains ROMS/* but the actual directory is _ROMS — the pattern matches nothing, so ROM binaries stay tracked. Check before committing large blobs.

Tracer and toolchain gotchas (2026-10-17)

Full detail and reasoning in TODO.md. These are the ones that silently corrupt results rather than failing loudly.

Undocumented opcodes silently truncate a trace. A tracer that knows only the 151 official opcodes halts on the first one used as ordinary code. Joypad Test Cartridge died at $C09E on DCP $3C20 ($CF) and filed 3,256 bytes of real code as .byte. nesdis.py --undocumented decodes all 105 (default off, so existing make regen pipelines stay byte-stable).
ca65 V2.19 implements none of the undocumented opcodes, so they cannot be written as mnemonics. nesdis.py emits them as explicit .byte with the disassembly in the comment — that keeps them in the code region, so both the split and the audit trail survive. ca65 is also happy to accept plain nop, which is official (0xEA).
Vectors are not in the iNES header. They are the three little-endian words at the end of the 16 KB PRG ($FFFA–$FFFF in the $C000 mirror). Header bytes 0–9 carry only sizes, mirroring and mapper. Parsing them from header.bin as if they were header fields yields garbage.
RESET and IRQ are usually the same address. The semantic-name map must not overwrite on collision, or the primary entry gets renamed to IrqHandler. Use setdefault in RESET/NMI/IRQ priority order.
Control-flow targets must win over fall-through. A fall-through decode whose operand spans an address that another path branches to is the wrong decode — no assembler branches mid-instruction. Mario Bros had a bne at $C4BA targeting $C528 swallowed by a NOP #$A5 at $C527.
Branch targets inside a surviving instruction must be pruned from the target set, or the emitter's linear walk consumes those bytes as an operand, the label is referenced but never defined, and the file does not assemble at all.
A plain vector trace reaches only ~15% of a real game. Almost everything sits behind computed dispatch. Look for jmp ($xx), and for dispatchers that pop the table address with pla — that form cannot be followed from the dispatcher because the pointer is only knowable in the caller's frame (Mario Bros $CD9E). Probing a suspected data region linearly with nesdis.py --probe is cheap and settles whether it is code; --auto-seed plus a couple of --extra-seed addresses took Mario Bros from 14.6% to 72.2%.
When emulating to trace, NMI must fire once per frame, not per $2002 read. The main loop polls $2002 to sync on vblank, and each read clears bit 7, re-arming NMI within the same scanline. Guarding on the vblank flag alone gave 40,900 NMIs across 3,000 frames and flattened coverage at 26%.
Controller input goes on joy1 = $4016 with a real latch/shift register. The poll routine's lda $4016,X with X=1 lands on $4017, but only bits 0–1 are compared, so driving $4017 consumes nothing and changes no coverage at all.
ca65 -l listings contain no source line numbers — they emit <offset>r <n> <bytes> <source text>. You cannot key listing entries back to source lines, and the listing prints rr rr for relocatable words, so byte values must come from prg.bin.
py65 is not a build dependency. Unpack on demand (pip download --no-deps py65, then unzip into a lib dir; PY65LIB env var points at it). /tmp is volatile — a reboot wiped it mid-session. Anything reusable belongs in _tools/.

20 KiB Raw Blame History Unescape Escape