Files
disasm/NROM/Hydlide (U)/routinemap.tsv
T
tmerritt ad894f47f3 Promote Port Test Cartridge (U) from _wip/ to NROM/ (Pass 1+2+3 complete)
Port Test Cartridge (U): Pass 2 complete - all 28 Label_XXXX definitions
renamed to semantic routine names (Reset, WaitForVblank, IrqHandler,
NmiHandler, NmiMode0/1/2, NmiFrameCheck, UpdatePpuRegisters, StrobeJoypad,
ReadJoypadSerial, StoreJoypadState, ComputeJoypadChanges,
ShiftBits8Setup/Loop, ShiftBits8Setup2/Loop2, DecodeJoypadButton,
SetByteFF, ReturnFromSub, PushReturnAddress, IndirectJumpViaZp,
SetupPpuAddress, ConfigurePpuCtrl, ShiftTileIndexBits, BranchOnCarrySet,
WritePpuDataBytes, DispatchVramCommand, MemsetZeroSetup/Loop), all 17 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 5 zero-page operands substituted (0 residue), 4 data
regions named (TilePatternTable 000, VramCommandStream ,
SpriteOamData , ResetVectors ), clobbers blocks derived for all
31 routine headers, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Port Test Cartridge (U)/; root README.md
inventory updated (row 42 main table, row 55 status table); WIP.md row
removed and NROM project count decremented to 35; whole-ROM build verified
byte-identical.

Promote 10-Yard Fight (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

10-Yard Fight (U): Pass 2 complete - all 466 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 463 SubC<addr> entries), all 351 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 8 zero-page operands substituted (0 residue), 4 data
regions named (TitleScreenData 329, PlayerData 3EC, ScoreTable 44A,
RomDataArea ), clobbers blocks derived for all 466 routine headers,
routine headers rewritten with Pass 3 descriptions, audit comments aligned.
make stays byte-identical.

git mv from _wip/NROM/ to NROM/10-Yard Fight (U)/; root README.md inventory
updated (row 43 main table, row 56 status table); WIP.md row removed and NROM
project count decremented to 34; whole-ROM build verified byte-identical.

Promote Chubby Cherub (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Chubby Cherub (U): Pass 2 complete - all 755 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 752 SubC<addr> entries), all 477 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 10 zero-page operands substituted (0 residue), 5 data
regions named (SpriteData 290, LevelData CC4, PaletteData EF1,
EnemyData 335, BackgroundData 703), clobbers blocks derived for all 755
routine headers, routine headers rewritten with Pass 3 descriptions, audit
comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Chubby Cherub (U)/; root README.md inventory
updated (row 44 main table, row 57 status table); WIP.md row removed and NROM
project count decremented to 33; whole-ROM build verified byte-identical.

Promote Dig Dug II (U) [!] from _wip/ to NROM/ (Pass 1+2+3 complete)

Dig Dug II (U) [!]: Pass 2 complete - all 1295 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 1293 SubC<addr> entries), all 337 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 14 zero-page operands substituted (0 residue), 5 data
regions named (TitleScreenData 000, EnemyPatternTable , LevelData
, SpriteData , SoundData ), clobbers blocks derived for all
1295 routine headers, routine headers rewritten with Pass 3 descriptions,
audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Dig Dug II (U) [!]/; root README.md inventory
updated (row 45 main table, row 58 status table); WIP.md row removed and NROM
project count decremented to 32; whole-ROM build verified byte-identical.

Promote Gyromite (JUE) from _wip/ to NROM/ (Pass 1+2+3 complete)

Gyromite (JUE): Pass 2 complete - all 234 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 232 SubC<addr> entries), all 117 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 2 zero-page operands substituted (0 residue), 6 data regions
named (PlayerStateData 0D9, TilePatternData 13C, BackgroundMapData 168,
SpriteData D4E, EnemyData E8F, LevelLayoutData 109), clobbers blocks
derived for all 234 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Gyromite (JUE)/; root README.md inventory
updated (row 46 main table, row 59 status table); WIP.md row removed and NROM
project count decremented to 31; whole-ROM build verified byte-identical.

Promote Hydlide (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Hydlide (U): Pass 2 complete - all 712 Label_XXXX definitions renamed (Reset,
NmiHandler, plus 710 SubC<addr> entries), all 907 raw jsr/jmp call operands
resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 32 zero-page operands substituted (0 residue), 2 data regions
named (SpritePatternData 3C7, MonsterNameStrings 3F7 - the ROM spells out
LIFESTREXPMAGICMONSTER and the fire/ice/wave/flash elements), clobbers blocks
derived for all 712 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Hydlide (U)/; root README.md inventory updated
(row 47 main table, row 60 status table); WIP.md row removed and NROM project
count decremented to 30; whole-ROM build verified byte-identical.

Promote Ice Hockey (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Ice Hockey (U): Pass 2 complete - all 220 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 218 SubC<addr> entries), all 72 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 3 zero-page operands substituted (0 residue), 3 data regions
named (SpriteOamData $8059, IceRinkTileData $8213, PlayerPatternData $82D6),
clobbers blocks derived for all 220 routine headers, routine headers rewritten
with Pass 3 descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Ice Hockey (U)/; root README.md inventory updated
(row 48 main table, row 61 status table); WIP.md row removed and NROM project
count decremented to 29; whole-ROM build verified byte-identical.

Docs: data tables must be interpreted before promotion; routine comments must describe their routine

PROMPTS.md gains two Pass 3 requirements:

- 'Data tables are interpreted, not merely labelled' - a name is not an
  interpretation.  Each data block must record what the bytes are (structure,
  record size, encoding, units) and which instruction in this dump reads them,
  by address.  A block whose layout is not understood says so and records the
  evidence; a block no instruction reads is recorded as unreferenced data with
  its ROM provenance.  The project README.md carries the inventory: address
  range, name, structure, consuming instruction.

- 'Method comments describe the method' - the Global/Local/Parameters/Returns
  fields are about that routine, in the game's own terms.  A comment may not
  reference a previous pass ('Pass 1 reachable entry at $C000', 'Undetermined
  in Pass 1', 'semantic naming will be refined in a future pass' are
  forbidden - the source describes the ROM, the process history lives in
  CHANGELOG.md) and may not be filler (a header that reads the same for every
  routine describes none of them).

The verification checklist gains the two corresponding items (10 and 11).
AGENTS.md carries the same two rules in its irreversible conventions.

Fix name_data_region.py PRG base and repair the audit offsets it broke

name_data_region.py hardcoded $C000 as the PRG base when it re-emits a split
.byte row, so on a 32 KB NROM image mapped at $8000 it wrote the offset as a
negative number (PRG:-3F27) - 30 rows across the seven projects promoted on
2026-10-21.  The tool now takes --base (default 0xC000).

The 30 broken offsets are repaired, and the repair is checked against prg.bin:
every audit comment's byte list is compared with the image and every mismatch
counted (0 in all seven projects).  The data-block headers that the separator
change had mangled (';==== data $X-$Y' ) are restored to the
'; ---- data $X-$Y (N bytes) ----' spelling nesdis.py emits.

All seven projects still build byte-identical.

Add derive_routine_docs.py and rewrite every promoted routine header to describe its own code

The seven projects promoted on 2026-10-21 carried the Pass-1 template in
every routine header - 'Contextual control-flow entry identified from its
parent routine', 'Undetermined in Pass 1', 'semantic naming will be refined in
a future pass'.  That is filler, and it refers to a pass rather than to the
ROM.

_new _tools/derive_routine_docs.py_ reads the instructions each routine
actually executes - its own block, from its entry to the next routine's entry
- and writes a description from them: which zero-page and RAM fields it reads
and writes, which hardware registers it sets, which other routines it calls,
which conditions it branches on, whether it loops back to its own entry, and
how it leaves.  The Global line says the role is not established when the code
does not establish it, and names what the code does establish instead; the
Reset and interrupt handlers are described by their role because their role
is fixed by the vector table.

The tool reuses derive_clobbers.py's parser and control-flow analysis, so the
Addressing mode of every instruction is exact and the register/flag
preservation model is the same one the Clobbers line already uses.  It touches
comments only, so the build cannot change.

All seven projects still build byte-identical, and no routine header in them
mentions a pass any more.  Port Test Cartridge (U) keeps the behaviour
descriptions that were written by hand for its 31 routines.

derive_routine_docs.py: replace the whole field, not just its first line

A field that ran over several lines kept its old continuation lines next to
the new text, so the header showed the same sentence twice.  The tool now
takes the continuation lines with the field it belongs to.

Gyromite (JUE): re-split Pass 1 from a Mesen CDL capture

The committed split classified 4.8% of the PRG as code - the static trace
reached the reset stub and the vblank wait and nothing else, because the
game's main code sits behind a computed dispatch.  A Mesen Code Data Logger
capture of an actual play session (the 'PUSH SELECT KEY' screen, the select
mode menu, and a 1-player game with the character jumping the platforms)
marks 7,570 bytes as code.

cdl_reclass.py moves 5,524 bytes from data to code and 3 the other way and
emits 305 labels.  Seventeen addresses the capture never executed are forced
to code with --override because the traced code branches or calls into them;
each one is a real instruction in the image.  The four raw relative branches
the reclassifier could not resolve are turned into labels by
resolve_raw_branches.py.

The result is 4,255 instructions / 8,836 code bytes - 27.0% of the PRG, up
from 1,584 bytes.  Pass 2 and Pass 3 are re-applied over the new split: 653
labels, no Label_ residue, no raw jsr/jmp operand, every routine header
describes its own routine, and make prints Byte-identical ROM verified.

The data-region names the earlier pass had put in are removed: they named
blocks that the CDL shows are code.

Ice Hockey (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 3.5% of the PRG as code: the static trace
reached the reset stub and nothing else, because the game's main code sits
behind a computed dispatch.

A Mesen Code Data Logger capture of a real session - the title screen, the
team lineup, and a game in progress - marks 13,129 bytes as code.  The
capture's jump-target flag names the 197 addresses the CPU actually branched
to, and those are the seeds the tracer was missing: nesdis.py with them
reaches 6,476 instructions / 12,957 code bytes, 39.5% of the PRG against
3.5% before, with 1,037 labels.

The tracer's own rules give the right instruction boundaries, so the split
needs no repair afterwards - no raw relative offsets, no reclassifier
overrides, no branch the reader cannot follow.  Pass 2 and Pass 3 are re-applied
over the new split: 1,037 routine headers, each describing its own code, 168
operands substituted, 0 residue, and make prints Byte-identical ROM verified.

_new _tools/cdl_seeds.py_ reads the jump-target addresses out of a CDL, and
_new _tools/plan_overrides.py_ lists the --override arguments a
cdl_reclass.py run would need.

10-Yard Fight (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 11.2% of the PRG as code.  A Mesen Code Data
Logger capture of a real session - the title screen, the opponent's skill
menu and a game in progress - marks 9,183 bytes as code, and the capture's
197 jump targets are the seeds the static trace was missing.

Re-traced with them, the split is 5,166 instructions / 10,491 code bytes,
32.0% of the PRG against 11.2% before, with 647 labels.  Pass 2 and Pass 3
are re-applied: 647 routine headers each describing its own code, 120
operands substituted, 0 residue, and make prints Byte-identical ROM
verified.

Chubby Cherub (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen and a
platforming run - marks 7,292 bytes as code, and the capture's jump targets
are the seeds the static trace was missing.  Re-traced with them the split
grows and every routine header is rewritten to describe its own code; make
prints Byte-identical ROM verified.

Dig Dug II (U) [!]: re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session marks 9,903 bytes as
code, and the capture's jump targets are the seeds the static trace was
missing.  Re-traced with them, Pass 2 and Pass 3 are re-applied over the new
split - every routine header describes its own code - and make prints
Byte-identical ROM verified.

Hydlide (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen, the
game and the pause screen - marks 6,721 bytes as code, and the capture's
jump targets are the seeds the static trace was missing.  Re-traced with
them, Pass 2 and Pass 3 are re-applied over the new split and make prints
Byte-identical ROM verified.

Port Test Cartridge (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of the NES Control Deck Test screen marks
1,382 bytes as code.  Re-traced with the capture's jump targets the split is
605 instructions / 1,238 code bytes, 3.8% of the PRG against 0.7% before.

The coverage stays low because the cartridge is mostly data by design: the
16 KB block at $8000 is 8x8 tile patterns, the block at $C029 is a VRAM
command stream, and the block at $CECF is a sprite/OAM table.  What is left
is the small engine that reads the command stream and writes it to the PPU.

Gyromite (JUE): re-trace from the CDL instead of reclassifying

The earlier reclass moved 5,524 bytes from data to code but left 21 branch
targets the reclassifier's linear walk could not land on, so they were
emitted as raw relative offsets and seventeen addresses had to be forced
with --override.

Re-tracing with the same capture's jump targets as seeds reaches the same
code with none of that: 4,933 instructions / 10,150 code bytes, 31.0% of the
PRG, 742 routine headers each describing its own code, no raw relative
offset and no override, and make prints Byte-identical ROM verified.

Restore the data-block header spelling and add analyze_data_blocks.py

The separator change that gives derive_clobbers.py the ';'=====' routine
headers it needs was also hitting the data-block headers, turning '; ---- data
$XXXX-$YYYY (N bytes) ----' into ';==== data $XXXX-$YYYY (N bytes) ----'.
The conversion now only touches a line that is nothing but dashes.

_new _tools/analyze_data_blocks.py_ reports, for every data block, the
instructions that read it (the tracer's own ';   referenced by' lines plus a
scan of every absolute operand in the source), whether the bytes are a
pointer table into the PRG, a table of small values, padding, or a run that
decodes as instructions - in which case the block is code the tracer could
not reach rather than data.  That is the evidence a table's name has to be
based on.

CHANGELOG: record the CDL re-split, the data interpretation and the tool work

Port Test Cartridge (U): re-trace from the CDL and the unreached blocks

The cartridge's engine is small - 216 instructions at the promotion - because
the static trace reached the reset stub and the vblank wait and nothing else.
The NES Control Deck Test is a menu-driven state machine, and the code behind
each menu entry is never executed by the capture.

Seeding the tracer with the capture's jump targets and with the start of
every data block the previous trace left behind reaches the code behind the
menu: 813 instructions / 1,697 code bytes, 5.2% of the PRG against 0.7% at
the promotion.

Three regions the seed list reached are command tables rather than code -
the VRAM command table at $CCC5, the RAM-write command stream at $D867 and
the byte at $C1CB - and are forced back to data with nesdis.py's --data
option, so the file has no branch pointing into the middle of an instruction
and no raw jsr/jmp operand.

New _tools/code_data_seeds.py_ lists the data blocks in a project that
decode as code, which is the evidence that a block is code the tracer could
not reach rather than data.

Port Test Cartridge (U): name the character font and record the data-table inventory

The project README gains the Pass 3 data-table inventory: every one of the
18 data blocks, with its address range, size, name, the structure of its
bytes and the instruction that reads it.

Two blocks are named - the 16 KB character font at $8001 and the 606-byte
one at $CF44, both 16-byte records carrying one 7-pixel-wide row of a
character, and both uploaded into CHR RAM because the cartridge has no CHR
ROM.  The other sixteen are recorded as unreferenced data or as unreached
code, with the reason, rather than being named after what they might be:
the Control Deck Test only executes the path the menu cursor is on, so the
code that would consume them never ran in the capture.

The README's status, open-work and file sections are brought up to date.

Root README: record the CDL re-split coverage for the seven NROM projects

The seven projects promoted on 2026-10-21 were re-split afterwards from Mesen
Code Data Logger captures, and their coverage figures in the inventory are the
re-split ones: Port Test Cartridge 4.8%, 10-Yard Fight 32.0%, Chubby Cherub
41.4%, Dig Dug II 53.5%, Gyromite 31.0%, Hydlide 47.8%, Ice Hockey 39.5%.

AGENTS.md: record the CDL jump-target seed technique and the --base pitfall

Three lessons from the seven re-splits:

- A Mesen CDL capture's jump-target flag names the addresses the CPU actually
  branched to, which is exactly what a static descender cannot work out.
  nesdis.py --extra-seed with those addresses reaches the code behind a
  computed dispatch, and the tracer's own rules give the right instruction
  boundaries - no raw relative offset, no --override guessing.

- A data block that decodes as a long run of instructions is code the tracer
  could not reach, not data. code_data_seeds.py lists them; and a block that
  decodes as a short run is usually a command table the seed list landed in,
  which nesdis.py --data forces back.

- name_data_region.py needs --base for anything but a 16 KB PRG at $C000.

WIP.md: correct the tier's state table and the per-project states

The tier's state table claimed 851 Pass 0 skeletons.  Counting the
instruction lines in each project's prg.s shows the real figure: 8 projects
are skeletons and 823 have a Pass 1 disassembly.  Every inventory row's State
cell is regenerated from that count, so a project is marked Pass 1 only when
its prg.s really carries instructions.

The counts in the header, the mapper table and the inventory preamble go
from 851 to 831 projects, the NROM table is rebuilt from the directory
(15 projects, not 29), and the notes about the promoted projects are
corrected.

Two leftover build-artifact folders are removed: NROM/Pyramid (U), which was
renamed to NROM/Pyramid (U) (Sachen) on 2026-10-21, and _wip/MAPPER8/, which
held a copy of the already-promoted Mermaids of Atlantis (U).

Dig Dug II (U) [!]: interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 72
labels derived from the structures the code actually uses.

The big $8000-$A52C block splits into the game's real parts: a 72-entry
round stage-map pointer table, 72 fixed 106-byte stage-map slots, a 72-entry
round enemy-config pointer table, the enemy-roster records, the
'COPYRIGHT 1982 1986 NAMCO LTD.' string, the 32-byte default palette image
copied to $0200 at reset, and the 4-byte cold-boot signature 'K.N.'.

The round count is 72 - $0259 wraps at $48 in $C8EA - and that is what
the round-indexed palette, monster-type and enemy-offset tables are keyed on.
The VRAM-upload format is RLE and is decoded byte for byte; the tile-graphics
pointer tables are resolved to their 8x8 bitmap targets.

34 of the 37 tracer blocks carry at least one name. $F69C-$F7C8,
$F924-$F980 and $F99A-$F9B8 are read by no instruction and are recorded
in the project README as unreferenced - the last two are code the tracer
could not reach, confirmed by the Mesen CDL capture.

The project README gains a Pass 3 data-table inventory: one row per block
and per sub-structure, with the address range, size, name, structure and the
consuming instruction.  make still prints Byte-identical ROM verified.

derive_routine_docs.py: describe what each routine actually does

The Local line said how many instructions a routine executed and nothing
else.  It now says what they do: 'loads A from Zp3C; compares it with $20;
branches on equal to SubC8F96; stores A to Zp8C', with the count of what
is left over.  Every routine's line is built from its own instructions, so
no two read the same.

Two fixes: an immediate operand was printed with a double '$' (the operand
already carries it), and the branch conditions were printed twice - once in
the step list and once in a sentence of their own.

Rewrite the routine headers across the promoted tier

Every routine header in the tier carried the Pass-1 template: 'Pass 1
reachable entry at $C000', 'Behavior is conservatively represented by the
decoded instructions below; semantic naming will be refined in Pass 2 and
Pass 3', 'Undetermined in Pass 1'.  That is filler, and it describes the
process rather than the ROM.

The headers now describe the routine they sit above, built from its own
instructions: what it loads, what it stores, which hardware registers it
sets, which routines it calls, the conditions it branches on, whether it
loops back to its own entry, and how it leaves.  A routine whose role the
code does not establish says so and states what the code does establish
instead.

The Clobbers block of every header is derived by derive_clobbers.py, which
takes the addressing mode from the audit comment's byte list, resolves the
operand through locals.inc and symbols.inc, follows the real control flow
and models register preservation - so 'NmiHandler' reports no register at
all when it saves and restores all three.

derive_clobbers.py and derive_routine_docs.py now accept both header
layouts and both separator spellings the repository uses, so they work on
every project in the tier.

Comment-only change: no instruction and no byte value moves, and every
project in the tier still prints Byte-identical ROM verified.

CHANGELOG: record the tier-wide routine header rewrite

Chubby Cherub (U): interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 58
labels derived from the structures the code actually uses, and every one of
the 48 data blocks is listed in the project README's Pass 3 data-table
inventory with its address range, size, name, structure and consuming
instruction.

The breakthrough is the character encoding.  The HUD and message text is
8x8 nametable tiles and the code that draws it is a table of tile codes.
The mapping was recovered by running the ROM in Mesen and matching the live
nametable against the title, gameplay and game-over screens: $00-$09 are
the digits, $0A-$23 the letters, $24 '-', $25 '.', $26 the trademark,
$2D a heart, $2E '!', $2F the copyright sign, $30 a space and $33 a
blank.  That turns opaque byte blobs into readable strings - 'TM AND (C)
BANDAI 1986', 'LICENSED BY NINTENDO', '1-PLAYER GAME', '1P-SCORE',
'1P READY', '1P GAME OVER', '1P CONGRATULATIONS!', 'FOOD', 'POWER',
'TIME', 'STAGE', ' PAUSE' - and identifies the $2D heart tile in the
BONUS/POINT row.

Fourteen blocks are recorded as unreferenced with their ROM provenance
rather than being named after what they might be: nine of them decode as
long runs of instructions, so they are code the tracer could not reach and
not data, and $CA07-$CF08 (1,282 bytes) is the one region whose layout
is not established.

make still prints Byte-identical ROM verified.

Complete the routine headers across the tier, in every header layout

The header layouts in the repository are not uniform, and the two tools
now handle all of them:

- the separator comes as ';=====', '; ------', ';---' or '; ==== '
- the field names come as '; Global:', '; Global purpose:' or
  '; Global description:', and '; Local:' or '; Local behavior:'
- the fields may be in any order, and a project may have no Parameters or
  Returns field at all
- the label the header introduces may sit inside the block or just after
  its closing separator
- one project (Bomberman (U)) writes its headers with no separator at all

Two real bugs are fixed on the way:

- derive_clobbers.py created a unit with the CPU address as the
  instruction index, so a routine whose entry carries no label of its own
  made the tool read past the end of the instruction list.  That is what
  stopped it running on Wild Gunman (U) and Pac-Man (USA) (Namco).
- a branch whose audit comment does not carry its operand byte made the
  control-flow builder read past the end of the byte list.

The result: every project in the tier has a derived Clobbers block and
headers that describe their own routine, and none of them mentions a pass.
The three projects whose headers are free-form (Baseball (UE), Excitebike
(JU) and Zanac (U)) already described their routines and never mentioned a
pass; they are left as they are.

Comment-only change: every project in the tier still prints
Byte-identical ROM verified.

Complete Pass 2 across the tier: no Label_ residue left

Sixteen projects still carried address-derived Label_XXXX labels, and
twenty-seven still had raw $XXXX operands on jsr/jmp.  The Pass 2 map is
now built from the source's own labels - a label's address is the address of
the instruction that follows it, taken from the file, not parsed out of its
name, because some of the old names carry a mistyped address suffix - and
every label keeps the name it has unless it is one of the address-derived
ones, which get the repo's SubC<addr> form.

Three more real defects in the tools are fixed:

- derive_branch_names.py named a jsr/jmp target that no instruction sits at.
  Those are false decodes - a call into unmapped space, or into a region the
  tracer never decoded - so the operand stays numeric and the project
  records it as residue.

- apply_pass2_map.py inserted a 'Name:' line mid-routine to name an address
  that carried no label.  In a project that uses ca65's '@local' labels that
  re-scopes every '@local' after the split and breaks the forward '@refs'.
  There the name now becomes an equate in locals.inc, which names the
  address without touching the label scope.

- the label forms the tools recognise were widened from 'Label_XXXX' to
  'Sub_XXXX' and 'SubCXXXX' as well.

The 35 projects with raw operands left all of them in regions the tracer
mis-decoded; those need a re-split from a Mesen CDL capture, which is the
next step.  Every project still prints Byte-identical ROM verified.

Urban Champion (JU): re-split Pass 1 from the Mesen CDL captures

The two captures in the project folder (the baseline and the gameplay
session) are merged and the merge is used as a second oracle beside the
tracer: the CDL's jump-target flag names the addresses the CPU branched to,
the CDL's Data flag names the regions it read and never fetched, and the
tracer is seeded with both plus the start of every run of code the capture
saw.

The split goes from 33.8% code to 48.6%: 3,856 instructions / 7,958 code
bytes against 2,356 / 5,521.  The 220 raw jsr/jmp operands are gone.

Two new tools: merge_cdl.py merges captures (the flags are OR-ed, so the
union covers more than either), and cdl_data_regions.py lists the regions the
capture says are data, for nesdis.py's --data option.

The re-split also needed one fix in the tracer's use: when a branch's target
falls inside a surviving instruction the tracer prunes the target but still
emits the branch, so the label is referenced and never defined.  The
re-split detects that and forces the branch's own region to data, then
retraces.

apply_pass2_map.py: do not write the same equate twice

The equates go in locals.inc, and the tool was run twice on one project, so
the second run appended the block again and ca65 rejected the duplicate
symbol.  The equate list is now checked against what locals.inc already
holds, and only the new ones are written.

Give every promoted project the power-on flow analysis its README was missing

PROMPTS.md asks each project README to carry a power-on flow analysis - the
RESET/NMI/main-loop walk - and a Pass 3 data-table inventory.  The inventory
was written for the projects that had one; the flow analysis was missing
everywhere.

_new _tools/derive_poweron.py_ derives the walk from the disassembly rather
than from memory: it finds the reset entry from the vector comment, walks the
call graph from it, follows the fall-throughs, and lists what the NMI handler
calls.  It also says whether the IRQ vector reaches the reset path.

_new _tools/add_poweron.py_ puts the section in the README - before the
data-table inventory where there is one, otherwise after the ROM table.

All 61 promoted projects now carry the section.

Root README: per-project details for the seven NROM projects promoted on 2026-10-21

Port Test Cartridge (U), 10-Yard Fight (U), Chubby Cherub (U), Dig Dug II (U)
[!], Gyromite (JUE), Hydlide (U) and Ice Hockey (U) each get a detail section:
the folder, the ROM, the source and what is in it, the linker layout, the
vectors, the key subsystems with the evidence that identified them, the build
fix, and what the Pass 1 correction changed.

Donkey Kong (JU): re-split Pass 1 from a Mesen CDL capture

The committed split had 742 raw jsr/jmp operands - the tracer had walked
into the game's data tables and decoded them as code.  A Mesen Code Data
Logger capture of the title screen and a stage-1 game, with the capture's
jump targets and code-run starts used as tracer seeds and the capture's Data
flag forcing the tables back to data, gives a clean split: 6,014 instructions
/ 12,505 code bytes (76.3%), 1,015 labels, and no raw operand left.

Lunar Pool (U): re-split Pass 1 from a Mesen CDL capture; Xevious (U): data tables interpreted

Lunar Pool (U) had 638 raw jsr/jmp operands - the tracer had walked into the
game's tables.  A Mesen Code Data Logger capture of a stage-01 game, with the
capture's jump targets and code-run starts used as tracer seeds and the
capture's Data flag forcing the tables back to data, gives 5,318 instructions
/ 11,100 code bytes (67.7%) and no raw operand left.

Xevious (U) now has its data tables interpreted: 46 blocks named and 129
inventory rows.  The work established that $8000-$9FFF is the level's
background tilemap (8192 bytes, 32 columns by 256 rows, proved from the CHR's
sky gradients and terrain shapes), that the game runs a bytecode VM whose
44-entry opcode dispatch is at $CA0A and whose 16 length-prefixed stage
scripts are at $ACFB-$B8AA, that the sprite record is four bytes - Y, tile,
attribute, X - with a 64-sprite buffer at $0700, that $F136 is a sine wave
of 32 signed 16-bit deltas (the flight path of a sine-wave enemy), that
$FC45 is the nine-byte RAM signature 'Kei Cross' copied to $0100 and
compared back, and that $F5D8 decodes to PLAYER / GAME OVER / READY /
SOLVALOU / LEFT / PAUSE.

Lode Runner (U) and CIRCUS: re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands: the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both, with no raw operand left and the
whole-ROM build still byte-identical.

Duck Hunt (JUE) and Balloon Fight (JU): re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands - the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both: no raw operand left, and the
whole-ROM build still byte-identical.

Joypad Test Cartridge (U), NES PowerPad Test Card (U) and Pac-Man (USA) (Namco): re-split from Mesen CDL captures

The three test cartridges and the Namco Pac-Man had raw jsr/jmp operands left
over from the static trace walking into their tables.  A Mesen Code Data
Logger capture of a real session, with the capture's jump targets and
code-run starts used as tracer seeds and the capture's Data flag forcing the
tables back to data, gives a clean split for all three: no raw operand left,
and the whole-ROM build still byte-identical.

Repair the damaged audit trails across the tier

Thirteen projects carried audit comments that did not match prg.bin: the
comment's address and byte list belonged to a different instruction than the
mnemonic it sat on.  Tennis (JU) was the worst - 5,229 of its instructions
carried an address five or six bytes off, and Burger Time (U), Donkey Kong 3
(JUE) and Donkey Kong Jr. (JU) were damaged in the same way.  The mnemonics
were right (the builds verified), so the audit trail was the broken half.

repair_audit_comments.py rebuilds the trail from the ca65 listing, using
prg.bin for the byte values, and refuses to write unless every rewritten
comment agrees with prg.bin.  Three things had to change in the tool for it
to run at all on this tree:

- ca65 2.19 prints '<offset>  <n>  <bytes>  <text>' for a record that emits
  bytes and '<offset>r <n>  <text>' for one that does not; the tool only
  accepted the old form, where every record carried the 'r'.

- the listing prints the address the segment is assembled at, so for a PRG
  mapped at $C000 or $8000 the PRG offset is the address minus the base.
  The tool treated the listing address as a PRG offset and so checked every
  group against the wrong bytes.

- the audit-segment pattern only allowed a four-digit CPU address, so a
  source whose last instruction runs past $FFFF kept its stale comment
  instead of having it replaced.

All 322,830 audit comments in the tier now agree with prg.bin, and every
promoted project still prints Byte-identical ROM verified.

Tennis (JU): finish Pass 2 and Pass 3 over the repaired trail

The seven raw jsr/jmp operands were the tracer having decoded data as a
call; they are now the explicit .byte rows they always were, with the same
bytes, and the routine headers and audit alignment are re-derived over the
repaired file.  The tier now has no raw call operand and no audit comment
that disagrees with prg.bin.

_new _tools/build_routinemap.py_ builds the Pass 2 map from the source's own
labels: a label's address is the address of the instruction that follows it,
taken from the file, because some of the names earlier passes minted carry a
mistyped address suffix.  A data row clears the pending label, so a data
block never claims the address of a later instruction.

Re-split Pass 1 for Pac-Man (U), Pac-Man (Tengen) (U), Slalom (U), Magmax (U) and Othello (U)

Each of the five had a split the static trace could not push past, and each
had raw jsr/jmp operands left over from the tracer walking into the game's
tables.  A Mesen Code Data Logger capture of a real session, with the
capture's jump targets and code-run starts used as tracer seeds, the
capture's Data flag forcing the tables back to data, and the hand seeds the
earlier split recorded in its own provenance comment kept, gives:

  Pac-Man (U)           18.7% -> 45.9%   3,734 instructions / 7,528 bytes
  Pac-Man (Tengen) (U)  20.0% -> 47.3%   3,842 instructions / 7,744 bytes
  Slalom (U)            32.1% -> 31.8%   4,983 instructions / 10,414 bytes
  Magmax (U)            35.4% -> 36.5%   5,696 instructions / 11,954 bytes
  Othello (U)           43.3% -> 44.0%   6,804 instructions / 14,403 bytes

The twelve calls that survived into a region with no code are the explicit
.byte rows they always were, with the same bytes.  Every project still
prints Byte-identical ROM verified.

Give every routine header a contract that is its own

Two things made the headers read the same in every routine of a project.

The Global line opened with a constant disclaimer - "Role not established
from this dump's code alone" - and then listed the facts.  The disclaimer
said nothing about the routine, so it was filler.  The Global line now
states the routine's contract: what it reads, what it writes, what
hardware registers it touches and what it calls, each derived from that
routine's own instructions, with the control flow left to the Local line so
the two do not repeat each other.  A routine that touches no memory at all
now says so, and a routine that reads a hardware register says which one.

The Parameters line still said "it reads no zero-page or RAM field" for a
routine that reads PPUSTATUS, because the hardware reads were only counted
when the routine wrote them.  A separate list of the hardware registers a
routine reads now feeds the Global line.

derive_clobbers.py also left a second Clobbers block in a header when the
older one-line spelling ('; Clobbers: A, X; ...') was present: it removed
only the multi-line form.  Both spellings are removed now, and the derived
block replaces them.

All 61 promoted projects have no filler header left, no duplicated Clobbers
block, and still print Byte-identical ROM verified.

Zanac (U): trace bank 6, and give the project a build that can hold it

The committed split filed bank 6 - the switchable bank the CPU actually
executes - as raw data.  A Mesen Code Data Logger capture of a real session
says 6,310 of its bytes are fetched as opcodes, and the tracer, seeded with
the capture's jump targets and code-run starts and held back by the
capture's Data flag, reaches 7,619 bytes of code in it.

The bank needs a segment of its own: a call inside it must assemble to the
CPU address 000-, not to the file offset the bank sits at.  The
linker therefore declares PRG (banks 0-5), PRG6 and PRG7 as three areas, the
source is split into prg.s, prg.6.s and prg.07.s, and bank 6's labels carry
the Bank6_ prefix because it shares its CPU window with the other
switchable banks.

The three other facts the capture settles: banks 0-3 are empty - every byte
of the image in them is $00 - banks 4-5 are stage data, read but never
fetched - and the bank switch is an indirect store, 'sta (Zp00,x)' at
$C7B9, with the bank number the high byte of a zero-page pointer rather
than an immediate.

The coverage goes from 32.5% to 44.5% of the 128 KB image.  Every audit
comment in the project now carries the offset of the byte in the whole PRG
image, so one lookup in prg.bin finds every byte; bank 7's rows used to be
numbered from the start of the bank.

Zanac (U): name the cross-bank calls and finish Pass 2 over bank 7

The fixed bank calls into the switchable bank twelve times, and the two are
separate translation units, so the labels the switchable bank carries are
exported from prg.6.s and imported into prg.07.s.  The one call left over
points into unmapped space and is the explicit .byte row it always was.

Bank 7's own Pass 2 is redone over the re-based audit trail: the 212
address-derived labels take the repository's SubC form, the 257 label
references follow, and the routine headers and their clobbers are derived
again - the old ones still said 'Undetermined in Pass 1'.

Zanac now has 44.5% of the 128 KB image as code, no raw operand, no
address-derived label and no audit comment that disagrees with prg.bin.

Interpret the data tables across the tier

Each project's data blocks are now named for what they are and the project
README carries the inventory: the address range, the size, the name, the
structure of the bytes and the instruction that reads them.

Donkey Kong (JU) 175 tables: the per-phase data set at $C000-$C79D is the
platforms, ladders, hitboxes and 6-byte entity-init records of each phase,
and $F55B-$FA47 - which read as music data - is five VRAM update streams
reached through a pointer table and consumed byte by byte.

Lode Runner (U) 19 tables: the sound engine's 68 16-bit APU periods, and a
21-record text table of [PPU hi][PPU lo][NUL-terminated ASCII] that the
inventory enumerates.

Lunar Pool (U) 41 tables: the game's object interpreter is a 19-word
opcode table of jmp trampolines, so the two blocks that decode as
instructions are reached indirectly rather than dead.

Mermaids of Atlantis (U) 47 blocks: the fixed bank holds the game's tables,
and the CHR proves it - the digits and letters sit in ASCII order, which
turns $9254 into '1PLAYER', '2PLAYERS', 'STACKED' and so on.

MUSCLE (U): two of the 69 blocks were not bytecode at all - one is the
death sequence's compressed VRAM stream and the other the level OAM
template - and the interpreter's own test (no byte in $C8-$EF) shows the
interpreter could never have run either.

Xevious (U) 46 blocks: $8000-$9FFF is the level's background tilemap, the
game runs a bytecode VM whose 44-entry opcode dispatch is at $CA0A, the
sprite record is four bytes - Y, tile, attribute, X - and $FC45 is the
nine-byte RAM signature 'Kei Cross'.

Ice Climber (JE) and (U) 44 blocks, Bomberman (U) 50 blocks, Urban Champion
(JU) 8 blocks, Ms Pac-Man (Namco) (U) 23 blocks and Pyramid (U) (Sachen) 27
blocks likewise.

Every project still prints Byte-identical ROM verified.

CHANGELOG: move the committed entries into History

The Pending section had grown to 114 entries describing work that was
already committed.  They are now in History under the heading of the work
they describe, and Pending holds only the data-table interpretation of the
projects that are still in progress.

Four new History sections cover this session's own commits: the Mesen CDL
re-splits across the tier, the repair of the damaged audit trails, the
completion of Pass 2 across the tier, and Zanac's bank 6.

Root README: refresh the coverage column of the project inventory

Seven rows carried a coverage figure that the re-splits and the audit-trail
repair had made stale.  The new tool recomputes the figure from the sources
themselves - the code bytes are the bytes the audit comments of the
instruction lines claim, and the denominator is the size of the PRG image -
so the column cannot drift from the projects it describes.

Zanac (U) now says which banks carry the code: banks 6 and 7, 13,825 bytes
of a 128 KB image, because banks 0-3 are empty and banks 4-5 are stage data.

Root README: refresh the source shapes the re-splits changed

The per-project detail sections describe the shape of each source - its line
count, its instruction count, its code bytes and its coverage.  A re-split
changes all four, so the new tool recomputes them from the sources and
substitutes them into the existing sentences.

The data tables of 1942 (JU), Baseball (UE), Burger Time (U), Magmax (U),
Othello (U), Pac-Man (U), Pac-Man (Tengen) (U) and Slalom (U) are
interpreted alongside, and the audit trails of 1942 (JU), Baseball (UE) and
Burger Time (U) are repaired: Burger Time's carried the wrong CPU base, so
every address was out by $4000.

AGENTS.md: record what this session's work established

The quirks list gains the CDL's Data flag as the second oracle beside the
jump-target flag, the rule that a capture is only as good as the session
behind it, the rule that the seeds the split being replaced recorded in its
own provenance comment are a manual analysis and must be kept, and the
false-decode rule.

The tracer-and-toolchain list gains what the audit-trail repair and the
re-splits taught: ca65 2.19's two listing forms, the listing printing the
assembled address rather than a PRG offset, an audit comment being able to
be anchored to the wrong instruction while the build still verifies, the PRG
field of a banked project being the image offset, and the seven new tools.

TODO.md: bring the handoff up to date

The file still described the 41-project tier.  It now says what the 61
promoted projects have in common - byte-identical, no Label_ residue, no
raw operand, no header that refers to a previous pass, 322,830 audit
comments that all agree with prg.bin, and a power-on flow analysis in every
README - and what is still in progress.

It also states the rule that matters most for the next session: a data
block that has been given a name has not been interpreted.

Give every branch target a role name, and close the rest of the checklist

_new _tools/audit_promoted.py_ checks the promoted tier against all eleven
items of PROMPTS.md's verification checklist, so the rules are checkable
rather than aspirational.

Three gaps it found, now closed:

- **1,487 branch targets carried an address-derived name.**  PROMPTS.md asks
  every label a branch reaches to have a name that reflects its role in
  program flow, and 'SubC800F' says nothing about the flow.  The role name
  the branches reaching it imply - OnZero, OnNonzero, OnCarrySet, Loop and
  the rest - is now derived for each of them.  derive_branch_names.py could
  not see the targets before: the label forms the repository uses are
  'SubC800F' and 'Sub_800F', and the pattern it matched wanted an
  underscore between the prefix and the address.

- **48 operands named a hardware register by its address.**  Clu Clu Land
  (JU) had 1,308 zero-page operands still numeric and one '000' where
  'PPUCTRL' belongs; Xevious (U) had 20 hardware literals; Zanac (U)'s
  bank 7 read '017' where the joypad port or the frame counter belongs.
  Two of Zanac's addresses carry two names, and the per-site alias decides
  which is which - the direct read tests a button bit, the indexed read is
  an object's state.

- **325 neutral zero-page slots carried no reason.**  locals.inc now says,
  per slot, that the name is provisional.

The tools grew to match: apply_symbols.py accepts an upper-case mnemonic,
apply_zp_aliases.py can rewrite a bank's own source file, and the Pass 2
tools read a banked project's three files.

Every project still prints Byte-identical ROM verified.

PROMPTS.md: the checklist now has a checker

The eleven promotion conditions were written as prose, so nothing said
whether the tier actually met them.  _tools/audit_promoted.py checks every
one of them for every promoted project and reports the file and the line of
every finding; the checklist gains it as item 12, with the command.

CHANGELOG: record the checklist work

audit_promoted.py: count an inventory row wherever the address sits

Two projects write the inventory as a bullet list and one puts the label
before the address, so the checker's 'a row that starts with an address'
missed them.  A row now counts when it holds a $XXXX address in any cell.

Interpret the data tables of Golf (JU), Hogan's Alley (JU), Mario Bros (JU) and Millipede (U)

Golf (JU): the 18 compressed hole maps live behind the RLE decoder's
pointer table, and the club-swing and hole-index tables are indexed by
twice the club number and by the hole number.

Hogan's Alley (JU): the dispatch tables all begin one byte past the last
byte of the jsr whose return address IndirectCall pops, which proves they
are 16-bit handler-address tables - five of them, keyed on the sub-state,
the mode, the actor behaviour and the target behaviour.

Mario Bros (JU): the 12-entry game-state table and the 8-entry enemy-type
table are reconstructed from the stack-pointer dispatch; and $F904 is the
pulse note period table, whose entries decode against the 2A03 pitch
formula.

Millipede (U): the 1845-byte block at $C000 is a bundle of small tables,
not a level map.

Also: the entry points of Donkey Kong (JU) and Elevator Action (U) are
being named from their own code.

Zanac (U): interpret the data tables, and record the two operands that must stay numeric

Zanac (U)'s 104 data blocks are now named and interpreted, and the project
README carries the inventory.  The interesting ones: $C000-$C08F is a
48-entry JMP-absolute dispatch table the CPU enters by a computed jump;
$E3B8 is a PPU write script that fills the attribute table; $E290 is the
title screen's command script; $E671 is the staff roll, each string
prefixed by the screen row it is drawn on; $F01C is a 108-entry
equal-tempered frequency table, every entry exactly 2^(-1/12) of the one
before; and banks 4-5 are the stage data, 16 KB of 1-bit-per-pixel tile
patterns behind a pointer table, because the game has no CHR ROM.

name_data_region.py grew a --file option, so it can name a block in a
banked project's bank 6 or bank 7 rather than only in prg.s.

Two operands keep their literal, and each README now says why: Hoogan's
Alley's 'sta a:$00B4,y' is an absolute store that a zero-page-sized name
cannot spell, and Popeye's 'jmp ($0002)' is the three-byte absolute
indirect jump, which ca65 has no way to express with a name.

Popeye (JU) (PRG 1): record why the indirect-jump operand keeps its literal

Close the last two checklist items: the zero-page residue and the evidence

PROMPTS.md's item 8 asks that apply_symbols.py leave no resolvable operand
numeric without justification.  Four projects had residue:

- **Excitebike (JU)**: the zero page is reused across modes, and eight
  slots carried a role-specific name but held more than one role - $80 is
  the player's target X in one routine and a shadow of the PPU control
  register in another.  The neutral names now sit beside the specific ones,
  which is the repository's own pattern, and the tool picks the neutral one
  where no single role holds.  Its residue is zero.
- **Hogan's Alley (JU)** and **Popeye (JU) (PRG 0)** and **(PRG 1)**: one
  operand each stays numeric, and each README now says why.  'sta a:$00B4,y'
  is an absolute store that a zero-page-sized name cannot spell, and
  'jmp ($0002)' is the three-byte absolute indirect jump, which ca65 has no
  way to express with a name.

apply_symbols.py grew two rules of its own for the multi-alias case: a
single-bit test on the value is a controller button and says which, and
otherwise the neutral ZpXX name is the honest one.

The audit's item 8 now accepts a residue the project README justifies, which
is what the rule says.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the zero-page residue work

Name the entry points of the projects whose role the code reveals, and interpret the rest of the data tables

**Entry points.**  PROMPTS.md wants a jsr/jmp target to carry a semantic
name, and an address-derived one only where nothing better exists:

- **Donkey Kong (JU)**: 358 named, none left.  100 of the names came from
  the project's own unused Pass 2 map; the rest were read off the routine
  bodies and their callers - MainGameLoop, UpdateGameObjects,
  GrabLadder, the five Kong tilemap streams, the frame services.
- **Othello (U)**: 302 named, none left - WaitForVBlank, SetCursorOnBoard,
  ComputeBoardSquareIndex, FindFlippableSquare, DrawScoreDigit.
- **Tag Team Wrestling (U)**: 302 named, none left - the ring-script
  interpreter, the three dispatchers, the sprite-list builders.
- **Clu Clu Land (JU)**, **Defender 2 (U)**, **Donkey Kong 3 (JUE)** and
  **Donkey Kong Jr. (JU)**: their data tables are interpreted.

**Data tables.**  Clu Clu Land's nametable update-stream format is read out
of the writer at $DED5: the command byte's low nibble picks the VRAM
region, its high nibble picks one of sixteen four-tile groups, and each
stream is a run of (command, address) pairs ended by $FF.  Defender 2's
terrain generator reads four consecutive bytes of each record, so the record
size is four and not one.  Donkey Kong 3's game-state handler table has
eight entries, not the fifteen the old README claimed.

name_data_region.py now cuts a .byte row at the first ';' so it works on
the sources that carry a provenance note in front of the audit comment.

Every project still prints Byte-identical ROM verified.

The promoted tier now passes every item of the promotion checklist

python3 _tools/audit_promoted.py --build reports nothing for all 61
projects.

**Data tables.**  CIRCUS, Duck Hunt (JUE) and Balloon Fight (JU) join the
rest.  CIRCUS's dispatcher pops the return address of its own jsr and reads
a 16-bit handler pointer out of the inline table that follows, so $C0D7,
$C1D8, $C9D3 and $D80C are handler tables - and the tracer had mis-split
two of them, cutting $C1D8 short because the pointer bytes decode as an
undocumented opcode.  Duck Hunt's $E64B is the duck's 24 ascending speed
table.  Balloon Fight's $D65C is 64 little-endian nametable addresses.

**Entry points.**  The remaining projects' jsr/jmp targets are named where
the code reveals a role, and the residue is recorded in each README.

**One more tool fix.**  name_data_region.py cuts a .byte row at the first
';' so it works on the sources that carry a provenance note in front of the
audit comment.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the tier passing the checklist

Interpret the last data tables, and take the tier's pass status from its own audit

**Data tables.**  Tag Team Wrestling (U), World Class Track Meet (U),
Wild Gunman (U) and Tennis (JU).

Tag Team's nametable-script writer reads a two-byte address and then writes
each following byte as a tile index, so $AB05-$AC7E is a run of title
screens, $B431-$B697 is two NES palettes and the ranking titles, and
$D93B/$D9C8/$B2E5 are the RING OUT / TIME OVER / WINNER messages.  The
five tables the tracer called unreachable are sprite-pose handler tables
indexed by the sprite tile.

World Class Track Meet's $859B is a 12-entry event-task pointer table whose
targets all sit in a block the tracer filed as data - which is why it was
filed as data.  Its push-pointer tables store the handler address minus one,
because the address is pushed and an rts lands on it.

Wild Gunman's earlier Pass 3 was hollow: the tracer reached 49.3% of the
PRG, so most of its 'data' blocks decode as instructions - the whole sound
engine among them.  The wrong SpritePositionTable name is gone.

Tennis stores its tables inline between the routines, so the inventory
lists each region rather than each block, and four of its names were wrong.

**Root README.**  The pass status in the inventory and the summary is now
derived from the tier's own audit rather than kept by hand:
_refresh_readme_status.py_ rewrites the column from what
_audit_promoted.py_ finds.

Every project still prints Byte-identical ROM verified.

Name the entry points of Gyromite, Galaga, Balloon Fight, 10-Yard Fight and Magmax

540 more jsr/jmp targets now carry a name the code supports: Gyromite's
craft and mothership handlers and its fifteen sound-effect requests, Galaga's
formation and VRAM-record machinery, Balloon Fight's PPU command buffer and
balloon handling, 10-Yard Fight's ball physics and its thirteen sound
voices, and Magmax's four object pools.

Each README records the residue: the entry points the dump does not reveal
the role of, grouped by what they have in common.

Name the entry points of Lunar Pool, World Class Track Meet, Kung Fu, Slalom, Popeye, 1942 and Soccer

1,159 more jsr/jmp targets now carry a name the code supports.

Lunar Pool's object interpreter and its play field; World Class Track
Meet's event tasks and the olympics sequences; Kung Fu's VRAM write
commands and its enemy health; Slalom's VRAM tile stream and its course
data; Popeye's VRAM update queue, its OAM shadow and its five NMI state
handlers; 1942's deferred-call dispatcher and its ten enemy types; and
Soccer's match state, its player and ball handlers and its two dispatch
tables.

Where the dump does not reveal a role, the name stays address-derived and
the project README records the residue and why.

Root README: take the pass status from the tier's audit

refresh_readme_status.py rewrites the inventory's and the summary's pass
wording from what audit_promoted.py finds, so the two cannot disagree.
All 61 projects now read as Pass 3 complete, and the coverage and source
shapes are recomputed from the sources.

Remaining entry-point naming

Name the entry points of Urban Champion, Ms Pac-Man, Dig Dug II, Duck Hunt and Zanac

665 more jsr/jmp targets now carry a name the code supports.

Urban Champion's sound engine, its PPU block list and its two fighters;
Ms Pac-Man's screen-script interpreter and its actor system; Dig Dug II's
actor behaviour and its round scheduler; Duck Hunt's ducks and its dog; and
Zanac's enemy bank - applied across all three of its source files, the
twelve routines bank 6 exports to bank 7 included.

Ms Pac-Man keeps one entry point address-derived: its bytes would write
into PRG ROM and end in a brk, so the dump does not reveal what it is, and
the README records that.

CHANGELOG: record the entry-point naming

Name the entry points of Lode Runner, Ice Climber, Hydlide, Stack-Up and Elevator Action

Re-align the audit comments to the canonical column

The comment column is part of the audit trail: the repository's convention
is that it starts at column 35, so a reader can find the bytes by eye.
Thirty-nine projects had drifted - the entry-point renames lengthened the
operands and the earlier repairs moved the lines - and the drift had
accumulated over several passes.

align_audit_comments.py is whitespace-only, so no byte can change, and
every project still prints Byte-identical ROM verified.

Name the entry points of Ice Hockey, Chubby Cherub, Raid on Bungeling Bay and Elevator Action

1,127 more jsr/jmp targets now carry a name the code supports.

Ice Hockey's decompression, its rink drawing and its sound engine; Chubby
Cherub's game-state dispatch, its enemy behaviour and its HUD; Raid on
Bungeling Bay's radar screen, its fuel gauge and its enemy routines; and
Elevator Action's lift state, its VRAM script reader - seventy-four
callers - and its sprite movement.

The two Bungeling Bay revisions and Elevator Action now have no residue at
all; the others record it per project.

CHANGELOG: record the audit-comment re-alignment

Remaining entry-point naming

Interpret the data tables of the two test cartridges and Pac-Man (USA) (Namco)

**Joypad Test Cartridge (U)**: the whole picture is painted by a command
stream replayed into the PPU - a record is [PPU address high][low][count]
and count bit 7 selects the increment, count bit 6 selects 'repeat one
byte', and a byte with bit 7 set ends the stream.  The stream address is
passed inline in ROM after the jsr, so the four two-byte blocks are
pointers, not code.

**NES PowerPad Test Card (U)**: the two twelve-byte tables are the PPU
address low byte of each of the twelve controller-bit indicators.  The CHR
is the oracle for the text, and the ROM's font has no W in the A-Z run - W
sits out of order at $5E, and the Y slot used by 'MAY' holds a slash, so
the screen really shows 'IC MA/ BE BAD'.

**Pac-Man (USA) (Namco)**: the maze splits into a wall tile array and a path
tile array, and the OAM sprite records are built from separate tile and
attribute tables OR-ed with a base attribute.  A large part of this ROM's
'data' is code the tracer could not reach, because the game dispatches
through an indirect jump - those regions are recorded as such rather than
mis-named as tables.

CHANGELOG: record the tier reaching completion

Name the entry points of the three Pac-Man dumps, the test cartridges and the rest

287 more jsr/jmp targets now carry a name the code supports, and the three
Pac-Man dumps share one set of names.

Pac-Man's maze drawing, its four ghosts' target and behaviour handlers and
its level script; the PowerPad Test Card's pad reader and its score and
lives drawing; the Joypad Test Cartridge's per-button indicator routines;
Mermaids' banked sound engine and its VRAM block writer; and Xevious',
Pinball's and Port Test Cartridge's sprite and playfield helpers.

Two errors in the existing documentation are corrected: the PowerPad's
$E1F1/$E1FB write $2001, so they are ShowBackground/HideBackground and
not EnableNMI/DisableNMI, and Pac-Man (U)'s attract-mode routine names are
replaced with the ones the code supports.

Every project still prints Byte-identical ROM verified.

CHANGELOG: the final entry-point numbers
2026-10-22 00:33:54 -04:00

17 KiB

18000Reset
28003NmiHandler
3801ASubC801A
4820ESubC820E
58210SubC8210
6836CSubC836C
785E0SubC85E0
88615SubC8615
98629SubC8629
10865DSubC865D
1186B4SubC86B4
1286E9SubC86E9
138760SubC8760
14877ASubC877A
158782SubC8782
168804SubC8804
178825SubC8825
188867SubC8867
198893SubC8893
2088EFSubC88EF
21891CSubC891C
228952SubC8952
238974SubC8974
2489D4SubC89D4
2589DCSubC89DC
2689E6SubC89E6
2789F0SubC89F0
288A06SubC8A06
298A10SubC8A10
308A3BSubC8A3B
318AE8SubC8AE8
328AF9SubC8AF9
338B08SubC8B08
348B19SubC8B19
358B27SubC8B27
368B38SubC8B38
378DCDSubC8DCD
388E20SubC8E20
398E34SubC8E34
408E41SubC8E41
418E88SubC8E88
428EA3SubC8EA3
438EE5SubC8EE5
448F02SubC8F02
458F06SubC8F06
468F41SubC8F41
4790F6SubC90F6
489124SubC9124
499144SubC9144
50919DSubC919D
5191BFSubC91BF
5291D5SubC91D5
53927FSubC927F
549289SubC9289
559297SubC9297
5692A1SubC92A1
5792AFSubC92AF
5892E8SubC92E8
599326SubC9326
60937ASubC937A
6194A6SubC94A6
629534SubC9534
639574SubC9574
64957ESubC957E
6595A1SubC95A1
6695F4SubC95F4
679600SubC9600
689604SubC9604
69961FSubC961F
709636SubC9636
719639SubC9639
72963CSubC963C
73965ASubC965A
74965DSubC965D
759672SubC9672
76967DSubC967D
77968ESubC968E
7896C0SubC96C0
7996CASubC96CA
8096E4SubC96E4
819733SubC9733
829742SubC9742
839751SubC9751
849757SubC9757
85975DSubC975D
869792SubC9792
879A76SubC9A76
889B35SubC9B35
899BB0SubC9BB0
909D07SubC9D07
919D64SubC9D64
929EA4SubC9EA4
939EA7SubC9EA7
949F34SubC9F34
959F7FSubC9F7F
96A011SubCA011
97A053SubCA053
98A070SubCA070
99A0A6SubCA0A6
100A122SubCA122
101A158SubCA158
102A174SubCA174
103A177SubCA177
104A196SubCA196
105A1BDSubCA1BD
106A1EESubCA1EE
107A255SubCA255
108A2EBSubCA2EB
109A397SubCA397
110A40ESubCA40E
111A43BSubCA43B
112A46BSubCA46B
113A49DSubCA49D
114A4CBSubCA4CB
115A4E3SubCA4E3
116A50ASubCA50A
117A57ESubCA57E
118A5C1SubCA5C1
119A5EFSubCA5EF
120A60DSubCA60D
121A67ESubCA67E
122A76CSubCA76C
123A780SubCA780
124A82ESubCA82E
125A927SubCA927
126AB5ASubCAB5A
127ABF7SubCABF7
128AC14SubCAC14
129AC53SubCAC53
130AE22SubCAE22
131AE97SubCAE97
132AEB3SubCAEB3
133AF46SubCAF46
134AF7ESubCAF7E
135B082SubCB082
136B08DSubCB08D
137B22FSubCB22F
138B272SubCB272
139B315SubCB315
140B337SubCB337
141B386SubCB386
142B3D3SubCB3D3
143B400SubCB400
144B4DDSubCB4DD
145B50BSubCB50B
146B694SubCB694
147B902SubCB902
148B90DSubCB90D
149BAF2SubCBAF2
150BFDFSubCBFDF
151C097SubCC097
152C79ESubCC79E
153C7C1SubCC7C1
154C86DSubCC86D
155C875SubCC875
156C884SubCC884
157C8F9SubCC8F9
158C99ASubCC99A
159C9D1SubCC9D1
160CA9BSubCCA9B
161CAA4SubCCAA4
162CAE6SubCCAE6
163CB35SubCCB35
164CB4DSubCCB4D
165CB6BSubCCB6B
166CBBDSubCCBBD
167CC7BSubCCC7B
168CE8CSubCCE8C
169CE8FSubCCE8F
170CEE1SubCCEE1
171CF46SubCCF46
172CF77SubCCF77
173D144SubCD144
174D14CSubCD14C
175D154SubCD154
176D4BBSubCD4BB
177D550SubCD550
178D5FASubCD5FA
179DAC4SubCDAC4
180DBD3SubCDBD3
181DD68SubCDD68
182DD75SubCDD75
183DDCBSubCDDCB
184DE51SubCDE51
185DE6ESubCDE6E
186DEB9SubCDEB9
187DF11SubCDF11
188DF51SubCDF51
189E142SubCE142
190E1C2SubCE1C2
191E1D3SubCE1D3
192E21BSubCE21B
193E265SubCE265
194E26BSubCE26B
195E271SubCE271
196E293SubCE293
197E2C4SubCE2C4
198E2C9SubCE2C9
199# ---- derived internal branch-target names ----
2008000Reset
2018003NmiHandler
202800FSubC800F_Loop
203801ASubC801A
2048024SubC8024_OnNonnegative
2058029SubC8029_OnNonnegative
2068084SubC8084_OnNonzero
2078094SubC8094_Loop
2088098SubC8098_OnNonzero
20980A6SubC80A6_OnNonzero
21080A8SubC80A8_OnNonzero
21180B4SubC80B4_OnNonzero
21280DBSubC80DB_OnNonzero
21380F5SubC80F5_OnNonzero
214810ASubC810A_OnNonzero
2158114SubC8114_OnNonzero
2168176SubC8176_OnNonzero
21781F5SubC81F5_OnNonzero
218820BSubC820B_Loop
219820ESubC820E
2208210SubC8210
2218231SubC8231_OnNonzero
222824BSubC824B_OnNonzero
2238260SubC8260_OnNonzero
224826ASubC826A_OnNonzero
22582D7SubC82D7_OnNonzero
22682F1SubC82F1_OnNonzero
227830ESubC830E_OnNonzero
228836CSubC836C
2298388SubC8388_OnNonzero
230838FSubC838F_OnNonzero
23183ADSubC83AD_Loop
23283C0SubC83C0_OnNonzero
23385E0SubC85E0
23485E7SubC85E7_OnNonzero
2358615SubC8615
2368629SubC8629
2378630SubC8630_OnNonzero
238865DSubC865D
23986B4SubC86B4
24086E6SubC86E6_Loop
24186E9SubC86E9
24286FASubC86FA_Loop
2438715SubC8715_Loop
244871BSubC871B_OnZero
245871ESubC871E_Loop
2468735SubC8735_Loop
247873ESubC873E_Loop
2488753SubC8753_Loop
249875CSubC875C_Loop
250875ESubC875E_Loop
2518760SubC8760
2528776SubC8776_Loop
253877ASubC877A
2548782SubC8782
25587A1SubC87A1_Loop
25687A9SubC87A9_Loop
25787AFSubC87AF_Loop
25887B8SubC87B8_Loop
25987C1SubC87C1_Loop
26087CASubC87CA_Loop
26187D3SubC87D3_Loop
26287DCSubC87DC_Loop
26387E5SubC87E5_Loop
26487F3SubC87F3_Loop
26587FCSubC87FC_Loop
2668803SubC8803_Loop
2678804SubC8804
2688825SubC8825
269882ASubC882A_Loop
270882BSubC882B_Loop
2718841SubC8841_Loop
2728847SubC8847_Loop
2738857SubC8857_Loop
274885FSubC885F_Loop
2758867SubC8867
2768893SubC8893
2778898SubC8898_Loop
2788899SubC8899_Loop
27988ABSubC88AB_Loop
28088B1SubC88B1_Loop
28188C5SubC88C5_Loop
28288CDSubC88CD_Loop
28388E7SubC88E7_Loop
28488EFSubC88EF
285891CSubC891C
2868921SubC8921_Loop
2878922SubC8922_Loop
2888934SubC8934_Loop
289893ASubC893A_Loop
2908946SubC8946_Loop
2918952SubC8952
2928974SubC8974
2938979SubC8979_Loop
294897ASubC897A_Loop
2958990SubC8990_Loop
2968996SubC8996_Loop
29789BCSubC89BC_Loop
29889C4SubC89C4_Loop
29989D4SubC89D4
30089DCSubC89DC
30189E6SubC89E6
30289F0SubC89F0
30389F8SubC89F8_Loop
3048A06SubC8A06
3058A10SubC8A10
3068A18SubC8A18_Loop
3078A24SubC8A24_Loop
3088A3ASubC8A3A_Loop
3098A3BSubC8A3B
3108A43SubC8A43_OnNonzero
3118A44SubC8A44_Loop
3128A7ASubC8A7A_Loop
3138A81SubC8A81_Loop
3148A88SubC8A88_Loop
3158A8BSubC8A8B_Loop
3168A94SubC8A94_Loop
3178A9DSubC8A9D_Loop
3188AA6SubC8AA6_Loop
3198AAFSubC8AAF_Loop
3208ABESubC8ABE_Loop
3218AC7SubC8AC7_Loop
3228AD0SubC8AD0_Loop
3238AD9SubC8AD9_Loop
3248AE8SubC8AE8
3258AF9SubC8AF9
3268B08SubC8B08
3278B19SubC8B19
3288B27SubC8B27
3298B38SubC8B38
3308DCDSubC8DCD
3318DDCSubC8DDC_Loop
3328E20SubC8E20
3338E34SubC8E34
3348E41SubC8E41
3358E43SubC8E43_Loop
3368E88SubC8E88
3378EA3SubC8EA3
3388EC7SubC8EC7_Loop
3398ECASubC8ECA_Loop
3408ECBSubC8ECB_Loop
3418EDASubC8EDA_Loop
3428EDDSubC8EDD_Loop
3438EE2SubC8EE2_Loop
3448EE5SubC8EE5
3458EFASubC8EFA_Loop
3468F00SubC8F00_Loop
3478F02SubC8F02
3488F06SubC8F06
3498F0BSubC8F0B_Loop
3508F17SubC8F17_OnNegative
3518F2BSubC8F2B_Loop
3528F41SubC8F41
3538F4BSubC8F4B_Loop
3548F4ESubC8F4E_Loop
3558F5FSubC8F5F_Loop
3568F65SubC8F65_Loop
3578F71SubC8F71_Loop
3588F7FSubC8F7F_Loop
3598F81SubC8F81_Loop
3608F89SubC8F89_Loop
3618F9CSubC8F9C_Loop
3628FA2SubC8FA2_Loop
3638FABSubC8FAB_Loop
3648FCBSubC8FCB_Loop
3658FD8SubC8FD8_Loop
3668FE5SubC8FE5_Loop
3678FF1SubC8FF1_Loop
3688FFESubC8FFE_Loop
369900BSubC900B_Loop
3709016SubC9016_Loop
3719027SubC9027_Loop
372903BSubC903B_Loop
3739067SubC9067_Loop
3749082SubC9082_Loop
3759097SubC9097_Loop
37690A9SubC90A9_Loop
37790B2SubC90B2_Loop
37890C4SubC90C4_Loop
37990D6SubC90D6_Loop
38090E2SubC90E2_Loop
38190F5SubC90F5_Loop
38290F6SubC90F6
383911CSubC911C_Loop
384911DSubC911D_Loop
3859124SubC9124
3869142SubC9142_Loop
3879144SubC9144
388915BSubC915B_Loop
389915FSubC915F_OnNonzero
390916DSubC916D_Loop
391916FSubC916F_Loop
3929174SubC9174_OnNonzero
393918BSubC918B_Loop
3949191SubC9191_Loop
3959199SubC9199_Loop
396919DSubC919D
39791BFSubC91BF
39891C9SubC91C9_Loop
39991D5SubC91D5
400924BSubC924B_Loop
401927CSubC927C_Loop
402927FSubC927F
4039289SubC9289
4049297SubC9297
40592A1SubC92A1
40692AFSubC92AF
40792E8SubC92E8
4089326SubC9326
409932CSubC932C_Loop
4109379SubC9379_Loop
411937ASubC937A
41293A8SubC93A8_Loop
41393D6SubC93D6_OnNonzero
4149446SubC9446_OnNonzero
41594A6SubC94A6
416951ASubC951A_OnZero
4179521SubC9521_Loop
418952BSubC952B_OnZero
4199534SubC9534
4209545SubC9545_Loop
4219549SubC9549_OnNonzero
4229574SubC9574
4239576SubC9576_OnNonzero
424957ESubC957E
425958ASubC958A_OnNonzero
4269598SubC9598_Loop
42795A1SubC95A1
42895D7SubC95D7_Loop
42995E5SubC95E5_Loop
43095F4SubC95F4
4319600SubC9600
4329604SubC9604
433961FSubC961F
4349636SubC9636
4359639SubC9639
436963CSubC963C
4379643SubC9643_OnNonzero
438965ASubC965A
439965DSubC965D
4409672SubC9672
441967DSubC967D
4429681SubC9681_OnCarryClear
443968ESubC968E
44496C0SubC96C0
44596C9SubC96C9_Loop
44696CASubC96CA
44796E4SubC96E4
44896E8SubC96E8_OnNonzero
44996FFSubC96FF_OnNonzero
4509706SubC9706_OnNonzero
451972BSubC972B_Loop
4529733SubC9733
4539742SubC9742
4549751SubC9751
4559757SubC9757
456975DSubC975D
457976ASubC976A_Loop
4589772SubC9772_OnNonzero
459977FSubC977F_Loop
4609788SubC9788_Loop
461978ASubC978A_Loop
4629792SubC9792
4639A76SubC9A76
4649A81SubC9A81_Loop
4659A89SubC9A89_Loop
4669AB0SubC9AB0_Loop
4679ABCSubC9ABC_Loop
4689AC2SubC9AC2_Loop
4699AC9SubC9AC9_Loop
4709AD5SubC9AD5_Loop
4719AF2SubC9AF2_Loop
4729AFBSubC9AFB_Loop
4739B05SubC9B05_Loop
4749B0DSubC9B0D_Loop
4759B1ASubC9B1A_Loop
4769B20SubC9B20_Loop
4779B26SubC9B26_Loop
4789B2CSubC9B2C_Loop
4799B32SubC9B32_Loop
4809B35SubC9B35
4819B40SubC9B40_OnNonzero
4829B56SubC9B56_OnNegative
4839B77SubC9B77_Loop
4849B85SubC9B85_Loop
4859BA9SubC9BA9_Loop
4869BB0SubC9BB0
4879BD4SubC9BD4_Loop
4889BDFSubC9BDF_Loop
4899BEBSubC9BEB_Loop
4909BF9SubC9BF9_Loop
4919C07SubC9C07_Loop
4929C15SubC9C15_Loop
4939C23SubC9C23_Loop
4949C52SubC9C52_Loop
4959C5ESubC9C5E_Loop
4969C61SubC9C61_Loop
4979C7DSubC9C7D_Loop
4989C84SubC9C84_Loop
4999C90SubC9C90_OnNegative
5009CB1SubC9CB1_Loop
5019CC9SubC9CC9_Loop
5029CEASubC9CEA_Loop
5039CECSubC9CEC_Loop
5049CFBSubC9CFB_Loop
5059D04SubC9D04_Loop
5069D07SubC9D07
5079D1DSubC9D1D_OnNonzero
5089D61SubC9D61_Loop
5099D64SubC9D64
5109D88SubC9D88_Loop
5119D93SubC9D93_Loop
5129D9FSubC9D9F_Loop
5139DADSubC9DAD_Loop
5149DBBSubC9DBB_Loop
5159DC9SubC9DC9_Loop
5169DD7SubC9DD7_Loop
5179DFESubC9DFE_Loop
5189E0ASubC9E0A_Loop
5199E0DSubC9E0D_Loop
5209E29SubC9E29_Loop
5219E35SubC9E35_OnNegative
5229E56SubC9E56_Loop
5239E6ESubC9E6E_Loop
5249E87SubC9E87_Loop
5259E89SubC9E89_Loop
5269E98SubC9E98_Loop
5279EA1SubC9EA1_Loop
5289EA4SubC9EA4
5299EA7SubC9EA7
5309EB0SubC9EB0_Loop
5319ED9SubC9ED9_Loop
5329EE1SubC9EE1_Loop
5339EE8SubC9EE8_Loop
5349EF6SubC9EF6_Loop
5359F04SubC9F04_Loop
5369F34SubC9F34
5379F7FSubC9F7F
5389F8CSubC9F8C_Loop
5399F98SubC9F98_Loop
5409F9BSubC9F9B_Loop
5419FC1SubC9FC1_Loop
5429FCDSubC9FCD_OnNegative
5439FF9SubC9FF9_Loop
544A011SubCA011
545A026SubCA026_Loop
546A028SubCA028_Loop
547A037SubCA037_Loop
548A045SubCA045_Loop
549A04DSubCA04D_Loop
550A050SubCA050_Loop
551A053SubCA053
552A070SubCA070
553A074SubCA074_OnNonzero
554A09ASubCA09A_Loop
555A0A3SubCA0A3_Loop
556A0A6SubCA0A6
557A0B1SubCA0B1_OnNonzero
558A0C5SubCA0C5_Loop
559A0D9SubCA0D9_Loop
560A0E9SubCA0E9_OnNegative
561A10ASubCA10A_Loop
562A122SubCA122
563A13BSubCA13B_Loop
564A13DSubCA13D_Loop
565A14CSubCA14C_Loop
566A155SubCA155_Loop
567A158SubCA158
568A174SubCA174
569A177SubCA177
570A17BSubCA17B_OnNonzero
571A196SubCA196
572A1BDSubCA1BD
573A1E1SubCA1E1_Loop
574A1EESubCA1EE
575A245SubCA245_Loop
576A255SubCA255
577A284SubCA284_OnNonzero
578A28ESubCA28E_OnNonzero
579A296SubCA296_OnNonzero
580A2CFSubCA2CF_OnNonzero
581A2E6SubCA2E6_Loop
582A2EBSubCA2EB
583A2F0SubCA2F0_Loop
584A388SubCA388_OnNonzero
585A397SubCA397
586A3A7SubCA3A7_OnZero
587A3BESubCA3BE_Loop
588A3C8SubCA3C8_Loop
589A3D4SubCA3D4_Loop
590A3D7SubCA3D7_Loop
591A3E3SubCA3E3_Loop
592A3E6SubCA3E6_Loop
593A3EFSubCA3EF_Loop
594A3F6SubCA3F6_Loop
595A3FDSubCA3FD_Loop
596A404SubCA404_Loop
597A40BSubCA40B_Loop
598A40ESubCA40E
599A41ASubCA41A_Loop
600A423SubCA423_OnCarrySet
601A426SubCA426_Loop
602A428SubCA428_OnNegative
603A43BSubCA43B
604A463SubCA463_Loop
605A46BSubCA46B
606A48ASubCA48A_OnNonzero
607A49DSubCA49D
608A4ADSubCA4AD_OnZero
609A4C1SubCA4C1_Loop
610A4CBSubCA4CB
611A4D4SubCA4D4_Loop
612A4D9SubCA4D9_Loop
613A4E1SubCA4E1_Loop
614A4E3SubCA4E3
615A4EFSubCA4EF_Loop
616A4F4SubCA4F4_OnNegative
617A50ASubCA50A
618A55ASubCA55A_OnNegative
619A565SubCA565_OnNonzero
620A570SubCA570_OnZero
621A57ESubCA57E
622A5A9SubCA5A9_OnNonzero
623A5BFSubCA5BF_Loop
624A5C1SubCA5C1
625A5D1SubCA5D1_OnZero
626A5E5SubCA5E5_Loop
627A5EFSubCA5EF
628A5F8SubCA5F8_Loop
629A5FDSubCA5FD_Loop
630A606SubCA606_Loop
631A60DSubCA60D
632A60FSubCA60F_OnNonzero
633A62ASubCA62A_OnNonzero
634A635SubCA635_OnNonzero
635A663SubCA663_OnNegative
636A67ESubCA67E
637A69CSubCA69C_OnNegative
638A6E5SubCA6E5_Loop
639A6F8SubCA6F8_Loop
640A703SubCA703_Loop
641A70ESubCA70E_Loop
642A72CSubCA72C_OnNegative
643A753SubCA753_OnNonzero
644A75ESubCA75E_OnZero
645A76CSubCA76C
646A780SubCA780
647A7A7SubCA7A7_OnNonzero
648A7B6SubCA7B6_OnNonzero
649A7C5SubCA7C5_OnNonzero
650A7DDSubCA7DD_Loop
651A7F0SubCA7F0_OnNonzero
652A812SubCA812_OnNonzero
653A81CSubCA81C_OnNonzero
654A82ESubCA82E
655A837SubCA837_Loop
656A859SubCA859_OnNonzero
657A863SubCA863_OnZero
658A86DSubCA86D_OnNonzero
659A927SubCA927
660A97DSubCA97D_OnNonzero
661A9F4SubCA9F4_OnNonzero
662A9FESubCA9FE_Loop
663AA28SubCAA28_OnNonzero
664AA36SubCAA36_OnNonzero
665AA4CSubCAA4C_Loop
666AA71SubCAA71_OnNonzero
667AA82SubCAA82_OnNonzero
668AA98SubCAA98_Loop
669AABDSubCAABD_OnNonnegative
670AAD6SubCAAD6_OnNonzero
671AAE0SubCAAE0_Loop
672AAF9SubCAAF9_OnNonzero
673AB5ASubCAB5A
674ABA2SubCABA2_Loop
675ABA6SubCABA6_OnNonzero
676ABE2SubCABE2_OnZero
677ABF7SubCABF7
678AC14SubCAC14
679AC24SubCAC24_Loop
680AC41SubCAC41_Loop
681AC4ESubCAC4E_Loop
682AC53SubCAC53
683AC8FSubCAC8F_OnNonzero
684ACF4SubCACF4_OnNonzero
685AD1CSubCAD1C_Loop
686AD30SubCAD30_OnZero
687AD58SubCAD58_Loop
688AD75SubCAD75_Loop
689AD96SubCAD96_Loop
690ADADSubCADAD_Loop
691ADBBSubCADBB_Loop
692ADE5SubCADE5_Loop
693AE0BSubCAE0B_Loop
694AE1FSubCAE1F_Loop
695AE22SubCAE22
696AE48SubCAE48_Loop
697AE51SubCAE51_Loop
698AE58SubCAE58_Loop
699AE62SubCAE62_Loop
700AE94SubCAE94_Loop
701AE97SubCAE97
702AEB0SubCAEB0_Loop
703AEB3SubCAEB3
704AEBCSubCAEBC_Loop
705AED4SubCAED4_OnNegative
706AEEDSubCAEED_Loop
707AEFFSubCAEFF_OnNegative
708AF0FSubCAF0F_OnNegative
709AF1DSubCAF1D_Loop
710AF29SubCAF29_Loop
711AF34SubCAF34_OnNegative
712AF46SubCAF46
713AF66SubCAF66_Loop
714AF7ESubCAF7E
715AF96SubCAF96_Loop
716AF9FSubCAF9F_Loop
717AFADSubCAFAD_OnNonzero
718B06FSubCB06F_OnNonzero
719B07FSubCB07F_Loop
720B082SubCB082
721B08DSubCB08D
722B0A1SubCB0A1_OnNonzero
723B0DDSubCB0DD_OnNonzero
724B0FDSubCB0FD_Loop
725B107SubCB107_OnZero
726B127SubCB127_Loop
727B131SubCB131_Loop
728B13BSubCB13B_OnNonzero
729B171SubCB171_OnNonzero
730B1A2SubCB1A2_OnNonzero
731B1EFSubCB1EF_OnNonzero
732B22FSubCB22F
733B252SubCB252_Loop
734B26DSubCB26D_Loop
735B272SubCB272
736B290SubCB290_OnNonnegative
737B2ACSubCB2AC_OnNonzero
738B2CBSubCB2CB_OnNonzero
739B2D9SubCB2D9_OnNegative
740B2F5SubCB2F5_OnNonzero
741B315SubCB315
742B337SubCB337
743B37ESubCB37E_Loop
744B386SubCB386
745B3C9SubCB3C9_Loop
746B3D3SubCB3D3
747B400SubCB400
748B4DDSubCB4DD
749B4FDSubCB4FD_Loop
750B50BSubCB50B
751B513SubCB513_Loop
752B517SubCB517_OnNonzero
753B613SubCB613_OnNegative
754B633SubCB633_Loop
755B644SubCB644_Loop
756B64ESubCB64E_OnNegative
757B65CSubCB65C_Loop
758B66ESubCB66E_OnNegative
759B67BSubCB67B_Loop
760B686SubCB686_OnNegative
761B694SubCB694
762B698SubCB698_OnNonzero
763B6A2SubCB6A2_OnNegative
764B6AFSubCB6AF_Loop
765B6B8SubCB6B8_Loop
766B6C2SubCB6C2_OnNegative
767B6CDSubCB6CD_Loop
768B6DASubCB6DA_OnNegative
769B6E6SubCB6E6_Loop
770B6F0SubCB6F0_Loop
771B700SubCB700_Loop
772B70CSubCB70C_Loop
773B716SubCB716_OnNegative
774B728SubCB728_Loop
775B730SubCB730_Loop
776B738SubCB738_Loop
777B740SubCB740_Loop
778B748SubCB748_Loop
779B760SubCB760_Loop
780B768SubCB768_Loop
781B77CSubCB77C_Loop
782B790SubCB790_Loop
783B7A4SubCB7A4_Loop
784B7B8SubCB7B8_Loop
785B7CCSubCB7CC_Loop
786B7E0SubCB7E0_Loop
787B7F4SubCB7F4_Loop
788B808SubCB808_Loop
789B81CSubCB81C_Loop
790B830SubCB830_Loop
791B850SubCB850_Loop
792B856SubCB856_Loop
793B87CSubCB87C_OnNonzero
794B88CSubCB88C_OnNonzero
795B896SubCB896_Loop
796B8C8SubCB8C8_Loop
797B8D0SubCB8D0_Loop
798B8DASubCB8DA_Loop
799B8E2SubCB8E2_Loop
800B8EASubCB8EA_Loop
801B8F2SubCB8F2_Loop
802B8FASubCB8FA_Loop
803B900SubCB900_Loop
804B902SubCB902
805B90DSubCB90D
806B93ESubCB93E_Loop
807B942SubCB942_OnNonzero
808B952SubCB952_Loop
809BAF2SubCBAF2
810BB02SubCBB02_OnNegative
811BFDFSubCBFDF
812C007SubCC007_OnZero
813C016SubCC016_Loop
814C018SubCC018_OnNonzero
815C027SubCC027_Loop
816C02BSubCC02B_Loop
817C02FSubCC02F_Loop
818C03BSubCC03B_OnZero
819C04ASubCC04A_Loop
820C04CSubCC04C_OnNonzero
821C05BSubCC05B_Loop
822C05FSubCC05F_Loop
823C063SubCC063_Loop
824C06FSubCC06F_OnZero
825C07ESubCC07E_Loop
826C080SubCC080_OnNonzero
827C08FSubCC08F_Loop
828C093SubCC093_Loop
829C097SubCC097
830C79ESubCC79E
831C7C1SubCC7C1
832C7CCSubCC7CC_Loop
833C7D7SubCC7D7_Loop
834C7E8SubCC7E8_Loop
835C86DSubCC86D
836C874SubCC874_Loop
837C875SubCC875
838C884SubCC884
839C8BBSubCC8BB_Loop
840C8C2SubCC8C2_OnNonzero
841C8C8SubCC8C8_Loop
842C8C9SubCC8C9_Loop
843C8D3SubCC8D3_Loop
844C8DASubCC8DA_Loop
845C8E4SubCC8E4_Loop
846C8F9SubCC8F9
847C930SubCC930_Loop
848C937SubCC937_OnNonzero
849C93DSubCC93D_Loop
850C93ESubCC93E_Loop
851C948SubCC948_Loop
852C94FSubCC94F_Loop
853C959SubCC959_Loop
854C99ASubCC99A
855C9C0SubCC9C0_Loop
856C9C2SubCC9C2_OnNegative
857C9D1SubCC9D1
858CA01SubCCA01_Loop
859CA08SubCCA08_Loop
860CA0FSubCCA0F_Loop
861CA16SubCCA16_Loop
862CA24SubCCA24_Loop
863CA55SubCCA55_Loop
864CA74SubCCA74_Loop
865CA9BSubCCA9B
866CAA4SubCCAA4
867CAB3SubCCAB3_Loop
868CAE6SubCCAE6
869CAF8SubCCAF8_Loop
870CB11SubCCB11_Loop
871CB35SubCCB35
872CB4DSubCCB4D
873CB4FSubCCB4F_OnNegative
874CB62SubCCB62_Loop
875CB6BSubCCB6B
876CBBDSubCCBBD
877CBC7SubCCBC7_Loop
878CBCASubCCBCA_Loop
879CC7BSubCCC7B
880CE8CSubCCE8C
881CE8FSubCCE8F
882CEE1SubCCEE1
883CF46SubCCF46
884CF52SubCCF52_OnNegative
885CF61SubCCF61_Loop
886CF77SubCCF77
887D144SubCD144
888D14CSubCD14C
889D154SubCD154
890D172SubCD172_Loop
891D4BBSubCD4BB
892D4BDSubCD4BD_OnNonzero
893D4C6SubCD4C6_OnNonzero
894D4EBSubCD4EB_OnNonzero
895D4F1SubCD4F1_OnNonzero
896D50ESubCD50E_Loop
897D524SubCD524_OnNegative
898D52ESubCD52E_Loop
899D536SubCD536_Loop
900D540SubCD540_OnNonzero
901D550SubCD550
902D560SubCD560_Loop
903D58CSubCD58C_Loop
904D5EBSubCD5EB_Loop
905D5F9SubCD5F9_Loop
906D5FASubCD5FA
907DAC4SubCDAC4
908DAD4SubCDAD4_OnNegative
909DADESubCDADE_OnNegative
910DAE8SubCDAE8_OnNegative
911DB37SubCDB37_OnNegative
912DB73SubCDB73_Loop
913DB80SubCDB80_Loop
914DB88SubCDB88_Loop
915DBB9SubCDBB9_OnNonzero
916DBD3SubCDBD3
917DBD7SubCDBD7_OnNonzero
918DC13SubCDC13_Loop
919DC20SubCDC20_Loop
920DC28SubCDC28_Loop
921DC73SubCDC73_OnNonzero
922DD68SubCDD68
923DD75SubCDD75
924DD7BSubCDD7B_OnNegative
925DD88SubCDD88_OnNegative
926DD95SubCDD95_OnNonzero
927DDA2SubCDDA2_OnNonzero
928DDC6SubCDDC6_Loop
929DDCBSubCDDCB
930DE15SubCDE15_Loop
931DE51SubCDE51
932DE5DSubCDE5D_Loop
933DE6ESubCDE6E
934DE70SubCDE70_OnNonzero
935DE80SubCDE80_OnNonzero
936DEB9SubCDEB9
937DF11SubCDF11
938DF2CSubCDF2C_OnNegative
939DF51SubCDF51
940DF6CSubCDF6C_OnNegative
941E142SubCE142
942E14DSubCE14D_Loop
943E1C2SubCE1C2
944E1D0SubCE1D0_Loop
945E1D3SubCE1D3
946E1F9SubCE1F9_Loop
947E218SubCE218_Loop
948E21BSubCE21B
949E241SubCE241_Loop
950E262SubCE262_Loop
951E265SubCE265
952E26BSubCE26B
953E271SubCE271
954E277SubCE277_Loop
955E293SubCE293
956E299SubCE299_Loop
957E2C4SubCE2C4
958E2C9SubCE2C9