Files
disasm/NROM/Othello (U)/routinemap.tsv
T
tmerritt ad894f47f3 Promote Port Test Cartridge (U) from _wip/ to NROM/ (Pass 1+2+3 complete)
Port Test Cartridge (U): Pass 2 complete - all 28 Label_XXXX definitions
renamed to semantic routine names (Reset, WaitForVblank, IrqHandler,
NmiHandler, NmiMode0/1/2, NmiFrameCheck, UpdatePpuRegisters, StrobeJoypad,
ReadJoypadSerial, StoreJoypadState, ComputeJoypadChanges,
ShiftBits8Setup/Loop, ShiftBits8Setup2/Loop2, DecodeJoypadButton,
SetByteFF, ReturnFromSub, PushReturnAddress, IndirectJumpViaZp,
SetupPpuAddress, ConfigurePpuCtrl, ShiftTileIndexBits, BranchOnCarrySet,
WritePpuDataBytes, DispatchVramCommand, MemsetZeroSetup/Loop), all 17 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 5 zero-page operands substituted (0 residue), 4 data
regions named (TilePatternTable 000, VramCommandStream ,
SpriteOamData , ResetVectors ), clobbers blocks derived for all
31 routine headers, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Port Test Cartridge (U)/; root README.md
inventory updated (row 42 main table, row 55 status table); WIP.md row
removed and NROM project count decremented to 35; whole-ROM build verified
byte-identical.

Promote 10-Yard Fight (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

10-Yard Fight (U): Pass 2 complete - all 466 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 463 SubC<addr> entries), all 351 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 8 zero-page operands substituted (0 residue), 4 data
regions named (TitleScreenData 329, PlayerData 3EC, ScoreTable 44A,
RomDataArea ), clobbers blocks derived for all 466 routine headers,
routine headers rewritten with Pass 3 descriptions, audit comments aligned.
make stays byte-identical.

git mv from _wip/NROM/ to NROM/10-Yard Fight (U)/; root README.md inventory
updated (row 43 main table, row 56 status table); WIP.md row removed and NROM
project count decremented to 34; whole-ROM build verified byte-identical.

Promote Chubby Cherub (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Chubby Cherub (U): Pass 2 complete - all 755 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 752 SubC<addr> entries), all 477 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 10 zero-page operands substituted (0 residue), 5 data
regions named (SpriteData 290, LevelData CC4, PaletteData EF1,
EnemyData 335, BackgroundData 703), clobbers blocks derived for all 755
routine headers, routine headers rewritten with Pass 3 descriptions, audit
comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Chubby Cherub (U)/; root README.md inventory
updated (row 44 main table, row 57 status table); WIP.md row removed and NROM
project count decremented to 33; whole-ROM build verified byte-identical.

Promote Dig Dug II (U) [!] from _wip/ to NROM/ (Pass 1+2+3 complete)

Dig Dug II (U) [!]: Pass 2 complete - all 1295 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 1293 SubC<addr> entries), all 337 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 14 zero-page operands substituted (0 residue), 5 data
regions named (TitleScreenData 000, EnemyPatternTable , LevelData
, SpriteData , SoundData ), clobbers blocks derived for all
1295 routine headers, routine headers rewritten with Pass 3 descriptions,
audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Dig Dug II (U) [!]/; root README.md inventory
updated (row 45 main table, row 58 status table); WIP.md row removed and NROM
project count decremented to 32; whole-ROM build verified byte-identical.

Promote Gyromite (JUE) from _wip/ to NROM/ (Pass 1+2+3 complete)

Gyromite (JUE): Pass 2 complete - all 234 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 232 SubC<addr> entries), all 117 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 2 zero-page operands substituted (0 residue), 6 data regions
named (PlayerStateData 0D9, TilePatternData 13C, BackgroundMapData 168,
SpriteData D4E, EnemyData E8F, LevelLayoutData 109), clobbers blocks
derived for all 234 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Gyromite (JUE)/; root README.md inventory
updated (row 46 main table, row 59 status table); WIP.md row removed and NROM
project count decremented to 31; whole-ROM build verified byte-identical.

Promote Hydlide (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Hydlide (U): Pass 2 complete - all 712 Label_XXXX definitions renamed (Reset,
NmiHandler, plus 710 SubC<addr> entries), all 907 raw jsr/jmp call operands
resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 32 zero-page operands substituted (0 residue), 2 data regions
named (SpritePatternData 3C7, MonsterNameStrings 3F7 - the ROM spells out
LIFESTREXPMAGICMONSTER and the fire/ice/wave/flash elements), clobbers blocks
derived for all 712 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Hydlide (U)/; root README.md inventory updated
(row 47 main table, row 60 status table); WIP.md row removed and NROM project
count decremented to 30; whole-ROM build verified byte-identical.

Promote Ice Hockey (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Ice Hockey (U): Pass 2 complete - all 220 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 218 SubC<addr> entries), all 72 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 3 zero-page operands substituted (0 residue), 3 data regions
named (SpriteOamData $8059, IceRinkTileData $8213, PlayerPatternData $82D6),
clobbers blocks derived for all 220 routine headers, routine headers rewritten
with Pass 3 descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Ice Hockey (U)/; root README.md inventory updated
(row 48 main table, row 61 status table); WIP.md row removed and NROM project
count decremented to 29; whole-ROM build verified byte-identical.

Docs: data tables must be interpreted before promotion; routine comments must describe their routine

PROMPTS.md gains two Pass 3 requirements:

- 'Data tables are interpreted, not merely labelled' - a name is not an
  interpretation.  Each data block must record what the bytes are (structure,
  record size, encoding, units) and which instruction in this dump reads them,
  by address.  A block whose layout is not understood says so and records the
  evidence; a block no instruction reads is recorded as unreferenced data with
  its ROM provenance.  The project README.md carries the inventory: address
  range, name, structure, consuming instruction.

- 'Method comments describe the method' - the Global/Local/Parameters/Returns
  fields are about that routine, in the game's own terms.  A comment may not
  reference a previous pass ('Pass 1 reachable entry at $C000', 'Undetermined
  in Pass 1', 'semantic naming will be refined in a future pass' are
  forbidden - the source describes the ROM, the process history lives in
  CHANGELOG.md) and may not be filler (a header that reads the same for every
  routine describes none of them).

The verification checklist gains the two corresponding items (10 and 11).
AGENTS.md carries the same two rules in its irreversible conventions.

Fix name_data_region.py PRG base and repair the audit offsets it broke

name_data_region.py hardcoded $C000 as the PRG base when it re-emits a split
.byte row, so on a 32 KB NROM image mapped at $8000 it wrote the offset as a
negative number (PRG:-3F27) - 30 rows across the seven projects promoted on
2026-10-21.  The tool now takes --base (default 0xC000).

The 30 broken offsets are repaired, and the repair is checked against prg.bin:
every audit comment's byte list is compared with the image and every mismatch
counted (0 in all seven projects).  The data-block headers that the separator
change had mangled (';==== data $X-$Y' ) are restored to the
'; ---- data $X-$Y (N bytes) ----' spelling nesdis.py emits.

All seven projects still build byte-identical.

Add derive_routine_docs.py and rewrite every promoted routine header to describe its own code

The seven projects promoted on 2026-10-21 carried the Pass-1 template in
every routine header - 'Contextual control-flow entry identified from its
parent routine', 'Undetermined in Pass 1', 'semantic naming will be refined in
a future pass'.  That is filler, and it refers to a pass rather than to the
ROM.

_new _tools/derive_routine_docs.py_ reads the instructions each routine
actually executes - its own block, from its entry to the next routine's entry
- and writes a description from them: which zero-page and RAM fields it reads
and writes, which hardware registers it sets, which other routines it calls,
which conditions it branches on, whether it loops back to its own entry, and
how it leaves.  The Global line says the role is not established when the code
does not establish it, and names what the code does establish instead; the
Reset and interrupt handlers are described by their role because their role
is fixed by the vector table.

The tool reuses derive_clobbers.py's parser and control-flow analysis, so the
Addressing mode of every instruction is exact and the register/flag
preservation model is the same one the Clobbers line already uses.  It touches
comments only, so the build cannot change.

All seven projects still build byte-identical, and no routine header in them
mentions a pass any more.  Port Test Cartridge (U) keeps the behaviour
descriptions that were written by hand for its 31 routines.

derive_routine_docs.py: replace the whole field, not just its first line

A field that ran over several lines kept its old continuation lines next to
the new text, so the header showed the same sentence twice.  The tool now
takes the continuation lines with the field it belongs to.

Gyromite (JUE): re-split Pass 1 from a Mesen CDL capture

The committed split classified 4.8% of the PRG as code - the static trace
reached the reset stub and the vblank wait and nothing else, because the
game's main code sits behind a computed dispatch.  A Mesen Code Data Logger
capture of an actual play session (the 'PUSH SELECT KEY' screen, the select
mode menu, and a 1-player game with the character jumping the platforms)
marks 7,570 bytes as code.

cdl_reclass.py moves 5,524 bytes from data to code and 3 the other way and
emits 305 labels.  Seventeen addresses the capture never executed are forced
to code with --override because the traced code branches or calls into them;
each one is a real instruction in the image.  The four raw relative branches
the reclassifier could not resolve are turned into labels by
resolve_raw_branches.py.

The result is 4,255 instructions / 8,836 code bytes - 27.0% of the PRG, up
from 1,584 bytes.  Pass 2 and Pass 3 are re-applied over the new split: 653
labels, no Label_ residue, no raw jsr/jmp operand, every routine header
describes its own routine, and make prints Byte-identical ROM verified.

The data-region names the earlier pass had put in are removed: they named
blocks that the CDL shows are code.

Ice Hockey (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 3.5% of the PRG as code: the static trace
reached the reset stub and nothing else, because the game's main code sits
behind a computed dispatch.

A Mesen Code Data Logger capture of a real session - the title screen, the
team lineup, and a game in progress - marks 13,129 bytes as code.  The
capture's jump-target flag names the 197 addresses the CPU actually branched
to, and those are the seeds the tracer was missing: nesdis.py with them
reaches 6,476 instructions / 12,957 code bytes, 39.5% of the PRG against
3.5% before, with 1,037 labels.

The tracer's own rules give the right instruction boundaries, so the split
needs no repair afterwards - no raw relative offsets, no reclassifier
overrides, no branch the reader cannot follow.  Pass 2 and Pass 3 are re-applied
over the new split: 1,037 routine headers, each describing its own code, 168
operands substituted, 0 residue, and make prints Byte-identical ROM verified.

_new _tools/cdl_seeds.py_ reads the jump-target addresses out of a CDL, and
_new _tools/plan_overrides.py_ lists the --override arguments a
cdl_reclass.py run would need.

10-Yard Fight (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 11.2% of the PRG as code.  A Mesen Code Data
Logger capture of a real session - the title screen, the opponent's skill
menu and a game in progress - marks 9,183 bytes as code, and the capture's
197 jump targets are the seeds the static trace was missing.

Re-traced with them, the split is 5,166 instructions / 10,491 code bytes,
32.0% of the PRG against 11.2% before, with 647 labels.  Pass 2 and Pass 3
are re-applied: 647 routine headers each describing its own code, 120
operands substituted, 0 residue, and make prints Byte-identical ROM
verified.

Chubby Cherub (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen and a
platforming run - marks 7,292 bytes as code, and the capture's jump targets
are the seeds the static trace was missing.  Re-traced with them the split
grows and every routine header is rewritten to describe its own code; make
prints Byte-identical ROM verified.

Dig Dug II (U) [!]: re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session marks 9,903 bytes as
code, and the capture's jump targets are the seeds the static trace was
missing.  Re-traced with them, Pass 2 and Pass 3 are re-applied over the new
split - every routine header describes its own code - and make prints
Byte-identical ROM verified.

Hydlide (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen, the
game and the pause screen - marks 6,721 bytes as code, and the capture's
jump targets are the seeds the static trace was missing.  Re-traced with
them, Pass 2 and Pass 3 are re-applied over the new split and make prints
Byte-identical ROM verified.

Port Test Cartridge (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of the NES Control Deck Test screen marks
1,382 bytes as code.  Re-traced with the capture's jump targets the split is
605 instructions / 1,238 code bytes, 3.8% of the PRG against 0.7% before.

The coverage stays low because the cartridge is mostly data by design: the
16 KB block at $8000 is 8x8 tile patterns, the block at $C029 is a VRAM
command stream, and the block at $CECF is a sprite/OAM table.  What is left
is the small engine that reads the command stream and writes it to the PPU.

Gyromite (JUE): re-trace from the CDL instead of reclassifying

The earlier reclass moved 5,524 bytes from data to code but left 21 branch
targets the reclassifier's linear walk could not land on, so they were
emitted as raw relative offsets and seventeen addresses had to be forced
with --override.

Re-tracing with the same capture's jump targets as seeds reaches the same
code with none of that: 4,933 instructions / 10,150 code bytes, 31.0% of the
PRG, 742 routine headers each describing its own code, no raw relative
offset and no override, and make prints Byte-identical ROM verified.

Restore the data-block header spelling and add analyze_data_blocks.py

The separator change that gives derive_clobbers.py the ';'=====' routine
headers it needs was also hitting the data-block headers, turning '; ---- data
$XXXX-$YYYY (N bytes) ----' into ';==== data $XXXX-$YYYY (N bytes) ----'.
The conversion now only touches a line that is nothing but dashes.

_new _tools/analyze_data_blocks.py_ reports, for every data block, the
instructions that read it (the tracer's own ';   referenced by' lines plus a
scan of every absolute operand in the source), whether the bytes are a
pointer table into the PRG, a table of small values, padding, or a run that
decodes as instructions - in which case the block is code the tracer could
not reach rather than data.  That is the evidence a table's name has to be
based on.

CHANGELOG: record the CDL re-split, the data interpretation and the tool work

Port Test Cartridge (U): re-trace from the CDL and the unreached blocks

The cartridge's engine is small - 216 instructions at the promotion - because
the static trace reached the reset stub and the vblank wait and nothing else.
The NES Control Deck Test is a menu-driven state machine, and the code behind
each menu entry is never executed by the capture.

Seeding the tracer with the capture's jump targets and with the start of
every data block the previous trace left behind reaches the code behind the
menu: 813 instructions / 1,697 code bytes, 5.2% of the PRG against 0.7% at
the promotion.

Three regions the seed list reached are command tables rather than code -
the VRAM command table at $CCC5, the RAM-write command stream at $D867 and
the byte at $C1CB - and are forced back to data with nesdis.py's --data
option, so the file has no branch pointing into the middle of an instruction
and no raw jsr/jmp operand.

New _tools/code_data_seeds.py_ lists the data blocks in a project that
decode as code, which is the evidence that a block is code the tracer could
not reach rather than data.

Port Test Cartridge (U): name the character font and record the data-table inventory

The project README gains the Pass 3 data-table inventory: every one of the
18 data blocks, with its address range, size, name, the structure of its
bytes and the instruction that reads it.

Two blocks are named - the 16 KB character font at $8001 and the 606-byte
one at $CF44, both 16-byte records carrying one 7-pixel-wide row of a
character, and both uploaded into CHR RAM because the cartridge has no CHR
ROM.  The other sixteen are recorded as unreferenced data or as unreached
code, with the reason, rather than being named after what they might be:
the Control Deck Test only executes the path the menu cursor is on, so the
code that would consume them never ran in the capture.

The README's status, open-work and file sections are brought up to date.

Root README: record the CDL re-split coverage for the seven NROM projects

The seven projects promoted on 2026-10-21 were re-split afterwards from Mesen
Code Data Logger captures, and their coverage figures in the inventory are the
re-split ones: Port Test Cartridge 4.8%, 10-Yard Fight 32.0%, Chubby Cherub
41.4%, Dig Dug II 53.5%, Gyromite 31.0%, Hydlide 47.8%, Ice Hockey 39.5%.

AGENTS.md: record the CDL jump-target seed technique and the --base pitfall

Three lessons from the seven re-splits:

- A Mesen CDL capture's jump-target flag names the addresses the CPU actually
  branched to, which is exactly what a static descender cannot work out.
  nesdis.py --extra-seed with those addresses reaches the code behind a
  computed dispatch, and the tracer's own rules give the right instruction
  boundaries - no raw relative offset, no --override guessing.

- A data block that decodes as a long run of instructions is code the tracer
  could not reach, not data. code_data_seeds.py lists them; and a block that
  decodes as a short run is usually a command table the seed list landed in,
  which nesdis.py --data forces back.

- name_data_region.py needs --base for anything but a 16 KB PRG at $C000.

WIP.md: correct the tier's state table and the per-project states

The tier's state table claimed 851 Pass 0 skeletons.  Counting the
instruction lines in each project's prg.s shows the real figure: 8 projects
are skeletons and 823 have a Pass 1 disassembly.  Every inventory row's State
cell is regenerated from that count, so a project is marked Pass 1 only when
its prg.s really carries instructions.

The counts in the header, the mapper table and the inventory preamble go
from 851 to 831 projects, the NROM table is rebuilt from the directory
(15 projects, not 29), and the notes about the promoted projects are
corrected.

Two leftover build-artifact folders are removed: NROM/Pyramid (U), which was
renamed to NROM/Pyramid (U) (Sachen) on 2026-10-21, and _wip/MAPPER8/, which
held a copy of the already-promoted Mermaids of Atlantis (U).

Dig Dug II (U) [!]: interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 72
labels derived from the structures the code actually uses.

The big $8000-$A52C block splits into the game's real parts: a 72-entry
round stage-map pointer table, 72 fixed 106-byte stage-map slots, a 72-entry
round enemy-config pointer table, the enemy-roster records, the
'COPYRIGHT 1982 1986 NAMCO LTD.' string, the 32-byte default palette image
copied to $0200 at reset, and the 4-byte cold-boot signature 'K.N.'.

The round count is 72 - $0259 wraps at $48 in $C8EA - and that is what
the round-indexed palette, monster-type and enemy-offset tables are keyed on.
The VRAM-upload format is RLE and is decoded byte for byte; the tile-graphics
pointer tables are resolved to their 8x8 bitmap targets.

34 of the 37 tracer blocks carry at least one name. $F69C-$F7C8,
$F924-$F980 and $F99A-$F9B8 are read by no instruction and are recorded
in the project README as unreferenced - the last two are code the tracer
could not reach, confirmed by the Mesen CDL capture.

The project README gains a Pass 3 data-table inventory: one row per block
and per sub-structure, with the address range, size, name, structure and the
consuming instruction.  make still prints Byte-identical ROM verified.

derive_routine_docs.py: describe what each routine actually does

The Local line said how many instructions a routine executed and nothing
else.  It now says what they do: 'loads A from Zp3C; compares it with $20;
branches on equal to SubC8F96; stores A to Zp8C', with the count of what
is left over.  Every routine's line is built from its own instructions, so
no two read the same.

Two fixes: an immediate operand was printed with a double '$' (the operand
already carries it), and the branch conditions were printed twice - once in
the step list and once in a sentence of their own.

Rewrite the routine headers across the promoted tier

Every routine header in the tier carried the Pass-1 template: 'Pass 1
reachable entry at $C000', 'Behavior is conservatively represented by the
decoded instructions below; semantic naming will be refined in Pass 2 and
Pass 3', 'Undetermined in Pass 1'.  That is filler, and it describes the
process rather than the ROM.

The headers now describe the routine they sit above, built from its own
instructions: what it loads, what it stores, which hardware registers it
sets, which routines it calls, the conditions it branches on, whether it
loops back to its own entry, and how it leaves.  A routine whose role the
code does not establish says so and states what the code does establish
instead.

The Clobbers block of every header is derived by derive_clobbers.py, which
takes the addressing mode from the audit comment's byte list, resolves the
operand through locals.inc and symbols.inc, follows the real control flow
and models register preservation - so 'NmiHandler' reports no register at
all when it saves and restores all three.

derive_clobbers.py and derive_routine_docs.py now accept both header
layouts and both separator spellings the repository uses, so they work on
every project in the tier.

Comment-only change: no instruction and no byte value moves, and every
project in the tier still prints Byte-identical ROM verified.

CHANGELOG: record the tier-wide routine header rewrite

Chubby Cherub (U): interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 58
labels derived from the structures the code actually uses, and every one of
the 48 data blocks is listed in the project README's Pass 3 data-table
inventory with its address range, size, name, structure and consuming
instruction.

The breakthrough is the character encoding.  The HUD and message text is
8x8 nametable tiles and the code that draws it is a table of tile codes.
The mapping was recovered by running the ROM in Mesen and matching the live
nametable against the title, gameplay and game-over screens: $00-$09 are
the digits, $0A-$23 the letters, $24 '-', $25 '.', $26 the trademark,
$2D a heart, $2E '!', $2F the copyright sign, $30 a space and $33 a
blank.  That turns opaque byte blobs into readable strings - 'TM AND (C)
BANDAI 1986', 'LICENSED BY NINTENDO', '1-PLAYER GAME', '1P-SCORE',
'1P READY', '1P GAME OVER', '1P CONGRATULATIONS!', 'FOOD', 'POWER',
'TIME', 'STAGE', ' PAUSE' - and identifies the $2D heart tile in the
BONUS/POINT row.

Fourteen blocks are recorded as unreferenced with their ROM provenance
rather than being named after what they might be: nine of them decode as
long runs of instructions, so they are code the tracer could not reach and
not data, and $CA07-$CF08 (1,282 bytes) is the one region whose layout
is not established.

make still prints Byte-identical ROM verified.

Complete the routine headers across the tier, in every header layout

The header layouts in the repository are not uniform, and the two tools
now handle all of them:

- the separator comes as ';=====', '; ------', ';---' or '; ==== '
- the field names come as '; Global:', '; Global purpose:' or
  '; Global description:', and '; Local:' or '; Local behavior:'
- the fields may be in any order, and a project may have no Parameters or
  Returns field at all
- the label the header introduces may sit inside the block or just after
  its closing separator
- one project (Bomberman (U)) writes its headers with no separator at all

Two real bugs are fixed on the way:

- derive_clobbers.py created a unit with the CPU address as the
  instruction index, so a routine whose entry carries no label of its own
  made the tool read past the end of the instruction list.  That is what
  stopped it running on Wild Gunman (U) and Pac-Man (USA) (Namco).
- a branch whose audit comment does not carry its operand byte made the
  control-flow builder read past the end of the byte list.

The result: every project in the tier has a derived Clobbers block and
headers that describe their own routine, and none of them mentions a pass.
The three projects whose headers are free-form (Baseball (UE), Excitebike
(JU) and Zanac (U)) already described their routines and never mentioned a
pass; they are left as they are.

Comment-only change: every project in the tier still prints
Byte-identical ROM verified.

Complete Pass 2 across the tier: no Label_ residue left

Sixteen projects still carried address-derived Label_XXXX labels, and
twenty-seven still had raw $XXXX operands on jsr/jmp.  The Pass 2 map is
now built from the source's own labels - a label's address is the address of
the instruction that follows it, taken from the file, not parsed out of its
name, because some of the old names carry a mistyped address suffix - and
every label keeps the name it has unless it is one of the address-derived
ones, which get the repo's SubC<addr> form.

Three more real defects in the tools are fixed:

- derive_branch_names.py named a jsr/jmp target that no instruction sits at.
  Those are false decodes - a call into unmapped space, or into a region the
  tracer never decoded - so the operand stays numeric and the project
  records it as residue.

- apply_pass2_map.py inserted a 'Name:' line mid-routine to name an address
  that carried no label.  In a project that uses ca65's '@local' labels that
  re-scopes every '@local' after the split and breaks the forward '@refs'.
  There the name now becomes an equate in locals.inc, which names the
  address without touching the label scope.

- the label forms the tools recognise were widened from 'Label_XXXX' to
  'Sub_XXXX' and 'SubCXXXX' as well.

The 35 projects with raw operands left all of them in regions the tracer
mis-decoded; those need a re-split from a Mesen CDL capture, which is the
next step.  Every project still prints Byte-identical ROM verified.

Urban Champion (JU): re-split Pass 1 from the Mesen CDL captures

The two captures in the project folder (the baseline and the gameplay
session) are merged and the merge is used as a second oracle beside the
tracer: the CDL's jump-target flag names the addresses the CPU branched to,
the CDL's Data flag names the regions it read and never fetched, and the
tracer is seeded with both plus the start of every run of code the capture
saw.

The split goes from 33.8% code to 48.6%: 3,856 instructions / 7,958 code
bytes against 2,356 / 5,521.  The 220 raw jsr/jmp operands are gone.

Two new tools: merge_cdl.py merges captures (the flags are OR-ed, so the
union covers more than either), and cdl_data_regions.py lists the regions the
capture says are data, for nesdis.py's --data option.

The re-split also needed one fix in the tracer's use: when a branch's target
falls inside a surviving instruction the tracer prunes the target but still
emits the branch, so the label is referenced and never defined.  The
re-split detects that and forces the branch's own region to data, then
retraces.

apply_pass2_map.py: do not write the same equate twice

The equates go in locals.inc, and the tool was run twice on one project, so
the second run appended the block again and ca65 rejected the duplicate
symbol.  The equate list is now checked against what locals.inc already
holds, and only the new ones are written.

Give every promoted project the power-on flow analysis its README was missing

PROMPTS.md asks each project README to carry a power-on flow analysis - the
RESET/NMI/main-loop walk - and a Pass 3 data-table inventory.  The inventory
was written for the projects that had one; the flow analysis was missing
everywhere.

_new _tools/derive_poweron.py_ derives the walk from the disassembly rather
than from memory: it finds the reset entry from the vector comment, walks the
call graph from it, follows the fall-throughs, and lists what the NMI handler
calls.  It also says whether the IRQ vector reaches the reset path.

_new _tools/add_poweron.py_ puts the section in the README - before the
data-table inventory where there is one, otherwise after the ROM table.

All 61 promoted projects now carry the section.

Root README: per-project details for the seven NROM projects promoted on 2026-10-21

Port Test Cartridge (U), 10-Yard Fight (U), Chubby Cherub (U), Dig Dug II (U)
[!], Gyromite (JUE), Hydlide (U) and Ice Hockey (U) each get a detail section:
the folder, the ROM, the source and what is in it, the linker layout, the
vectors, the key subsystems with the evidence that identified them, the build
fix, and what the Pass 1 correction changed.

Donkey Kong (JU): re-split Pass 1 from a Mesen CDL capture

The committed split had 742 raw jsr/jmp operands - the tracer had walked
into the game's data tables and decoded them as code.  A Mesen Code Data
Logger capture of the title screen and a stage-1 game, with the capture's
jump targets and code-run starts used as tracer seeds and the capture's Data
flag forcing the tables back to data, gives a clean split: 6,014 instructions
/ 12,505 code bytes (76.3%), 1,015 labels, and no raw operand left.

Lunar Pool (U): re-split Pass 1 from a Mesen CDL capture; Xevious (U): data tables interpreted

Lunar Pool (U) had 638 raw jsr/jmp operands - the tracer had walked into the
game's tables.  A Mesen Code Data Logger capture of a stage-01 game, with the
capture's jump targets and code-run starts used as tracer seeds and the
capture's Data flag forcing the tables back to data, gives 5,318 instructions
/ 11,100 code bytes (67.7%) and no raw operand left.

Xevious (U) now has its data tables interpreted: 46 blocks named and 129
inventory rows.  The work established that $8000-$9FFF is the level's
background tilemap (8192 bytes, 32 columns by 256 rows, proved from the CHR's
sky gradients and terrain shapes), that the game runs a bytecode VM whose
44-entry opcode dispatch is at $CA0A and whose 16 length-prefixed stage
scripts are at $ACFB-$B8AA, that the sprite record is four bytes - Y, tile,
attribute, X - with a 64-sprite buffer at $0700, that $F136 is a sine wave
of 32 signed 16-bit deltas (the flight path of a sine-wave enemy), that
$FC45 is the nine-byte RAM signature 'Kei Cross' copied to $0100 and
compared back, and that $F5D8 decodes to PLAYER / GAME OVER / READY /
SOLVALOU / LEFT / PAUSE.

Lode Runner (U) and CIRCUS: re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands: the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both, with no raw operand left and the
whole-ROM build still byte-identical.

Duck Hunt (JUE) and Balloon Fight (JU): re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands - the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both: no raw operand left, and the
whole-ROM build still byte-identical.

Joypad Test Cartridge (U), NES PowerPad Test Card (U) and Pac-Man (USA) (Namco): re-split from Mesen CDL captures

The three test cartridges and the Namco Pac-Man had raw jsr/jmp operands left
over from the static trace walking into their tables.  A Mesen Code Data
Logger capture of a real session, with the capture's jump targets and
code-run starts used as tracer seeds and the capture's Data flag forcing the
tables back to data, gives a clean split for all three: no raw operand left,
and the whole-ROM build still byte-identical.

Repair the damaged audit trails across the tier

Thirteen projects carried audit comments that did not match prg.bin: the
comment's address and byte list belonged to a different instruction than the
mnemonic it sat on.  Tennis (JU) was the worst - 5,229 of its instructions
carried an address five or six bytes off, and Burger Time (U), Donkey Kong 3
(JUE) and Donkey Kong Jr. (JU) were damaged in the same way.  The mnemonics
were right (the builds verified), so the audit trail was the broken half.

repair_audit_comments.py rebuilds the trail from the ca65 listing, using
prg.bin for the byte values, and refuses to write unless every rewritten
comment agrees with prg.bin.  Three things had to change in the tool for it
to run at all on this tree:

- ca65 2.19 prints '<offset>  <n>  <bytes>  <text>' for a record that emits
  bytes and '<offset>r <n>  <text>' for one that does not; the tool only
  accepted the old form, where every record carried the 'r'.

- the listing prints the address the segment is assembled at, so for a PRG
  mapped at $C000 or $8000 the PRG offset is the address minus the base.
  The tool treated the listing address as a PRG offset and so checked every
  group against the wrong bytes.

- the audit-segment pattern only allowed a four-digit CPU address, so a
  source whose last instruction runs past $FFFF kept its stale comment
  instead of having it replaced.

All 322,830 audit comments in the tier now agree with prg.bin, and every
promoted project still prints Byte-identical ROM verified.

Tennis (JU): finish Pass 2 and Pass 3 over the repaired trail

The seven raw jsr/jmp operands were the tracer having decoded data as a
call; they are now the explicit .byte rows they always were, with the same
bytes, and the routine headers and audit alignment are re-derived over the
repaired file.  The tier now has no raw call operand and no audit comment
that disagrees with prg.bin.

_new _tools/build_routinemap.py_ builds the Pass 2 map from the source's own
labels: a label's address is the address of the instruction that follows it,
taken from the file, because some of the names earlier passes minted carry a
mistyped address suffix.  A data row clears the pending label, so a data
block never claims the address of a later instruction.

Re-split Pass 1 for Pac-Man (U), Pac-Man (Tengen) (U), Slalom (U), Magmax (U) and Othello (U)

Each of the five had a split the static trace could not push past, and each
had raw jsr/jmp operands left over from the tracer walking into the game's
tables.  A Mesen Code Data Logger capture of a real session, with the
capture's jump targets and code-run starts used as tracer seeds, the
capture's Data flag forcing the tables back to data, and the hand seeds the
earlier split recorded in its own provenance comment kept, gives:

  Pac-Man (U)           18.7% -> 45.9%   3,734 instructions / 7,528 bytes
  Pac-Man (Tengen) (U)  20.0% -> 47.3%   3,842 instructions / 7,744 bytes
  Slalom (U)            32.1% -> 31.8%   4,983 instructions / 10,414 bytes
  Magmax (U)            35.4% -> 36.5%   5,696 instructions / 11,954 bytes
  Othello (U)           43.3% -> 44.0%   6,804 instructions / 14,403 bytes

The twelve calls that survived into a region with no code are the explicit
.byte rows they always were, with the same bytes.  Every project still
prints Byte-identical ROM verified.

Give every routine header a contract that is its own

Two things made the headers read the same in every routine of a project.

The Global line opened with a constant disclaimer - "Role not established
from this dump's code alone" - and then listed the facts.  The disclaimer
said nothing about the routine, so it was filler.  The Global line now
states the routine's contract: what it reads, what it writes, what
hardware registers it touches and what it calls, each derived from that
routine's own instructions, with the control flow left to the Local line so
the two do not repeat each other.  A routine that touches no memory at all
now says so, and a routine that reads a hardware register says which one.

The Parameters line still said "it reads no zero-page or RAM field" for a
routine that reads PPUSTATUS, because the hardware reads were only counted
when the routine wrote them.  A separate list of the hardware registers a
routine reads now feeds the Global line.

derive_clobbers.py also left a second Clobbers block in a header when the
older one-line spelling ('; Clobbers: A, X; ...') was present: it removed
only the multi-line form.  Both spellings are removed now, and the derived
block replaces them.

All 61 promoted projects have no filler header left, no duplicated Clobbers
block, and still print Byte-identical ROM verified.

Zanac (U): trace bank 6, and give the project a build that can hold it

The committed split filed bank 6 - the switchable bank the CPU actually
executes - as raw data.  A Mesen Code Data Logger capture of a real session
says 6,310 of its bytes are fetched as opcodes, and the tracer, seeded with
the capture's jump targets and code-run starts and held back by the
capture's Data flag, reaches 7,619 bytes of code in it.

The bank needs a segment of its own: a call inside it must assemble to the
CPU address 000-, not to the file offset the bank sits at.  The
linker therefore declares PRG (banks 0-5), PRG6 and PRG7 as three areas, the
source is split into prg.s, prg.6.s and prg.07.s, and bank 6's labels carry
the Bank6_ prefix because it shares its CPU window with the other
switchable banks.

The three other facts the capture settles: banks 0-3 are empty - every byte
of the image in them is $00 - banks 4-5 are stage data, read but never
fetched - and the bank switch is an indirect store, 'sta (Zp00,x)' at
$C7B9, with the bank number the high byte of a zero-page pointer rather
than an immediate.

The coverage goes from 32.5% to 44.5% of the 128 KB image.  Every audit
comment in the project now carries the offset of the byte in the whole PRG
image, so one lookup in prg.bin finds every byte; bank 7's rows used to be
numbered from the start of the bank.

Zanac (U): name the cross-bank calls and finish Pass 2 over bank 7

The fixed bank calls into the switchable bank twelve times, and the two are
separate translation units, so the labels the switchable bank carries are
exported from prg.6.s and imported into prg.07.s.  The one call left over
points into unmapped space and is the explicit .byte row it always was.

Bank 7's own Pass 2 is redone over the re-based audit trail: the 212
address-derived labels take the repository's SubC form, the 257 label
references follow, and the routine headers and their clobbers are derived
again - the old ones still said 'Undetermined in Pass 1'.

Zanac now has 44.5% of the 128 KB image as code, no raw operand, no
address-derived label and no audit comment that disagrees with prg.bin.

Interpret the data tables across the tier

Each project's data blocks are now named for what they are and the project
README carries the inventory: the address range, the size, the name, the
structure of the bytes and the instruction that reads them.

Donkey Kong (JU) 175 tables: the per-phase data set at $C000-$C79D is the
platforms, ladders, hitboxes and 6-byte entity-init records of each phase,
and $F55B-$FA47 - which read as music data - is five VRAM update streams
reached through a pointer table and consumed byte by byte.

Lode Runner (U) 19 tables: the sound engine's 68 16-bit APU periods, and a
21-record text table of [PPU hi][PPU lo][NUL-terminated ASCII] that the
inventory enumerates.

Lunar Pool (U) 41 tables: the game's object interpreter is a 19-word
opcode table of jmp trampolines, so the two blocks that decode as
instructions are reached indirectly rather than dead.

Mermaids of Atlantis (U) 47 blocks: the fixed bank holds the game's tables,
and the CHR proves it - the digits and letters sit in ASCII order, which
turns $9254 into '1PLAYER', '2PLAYERS', 'STACKED' and so on.

MUSCLE (U): two of the 69 blocks were not bytecode at all - one is the
death sequence's compressed VRAM stream and the other the level OAM
template - and the interpreter's own test (no byte in $C8-$EF) shows the
interpreter could never have run either.

Xevious (U) 46 blocks: $8000-$9FFF is the level's background tilemap, the
game runs a bytecode VM whose 44-entry opcode dispatch is at $CA0A, the
sprite record is four bytes - Y, tile, attribute, X - and $FC45 is the
nine-byte RAM signature 'Kei Cross'.

Ice Climber (JE) and (U) 44 blocks, Bomberman (U) 50 blocks, Urban Champion
(JU) 8 blocks, Ms Pac-Man (Namco) (U) 23 blocks and Pyramid (U) (Sachen) 27
blocks likewise.

Every project still prints Byte-identical ROM verified.

CHANGELOG: move the committed entries into History

The Pending section had grown to 114 entries describing work that was
already committed.  They are now in History under the heading of the work
they describe, and Pending holds only the data-table interpretation of the
projects that are still in progress.

Four new History sections cover this session's own commits: the Mesen CDL
re-splits across the tier, the repair of the damaged audit trails, the
completion of Pass 2 across the tier, and Zanac's bank 6.

Root README: refresh the coverage column of the project inventory

Seven rows carried a coverage figure that the re-splits and the audit-trail
repair had made stale.  The new tool recomputes the figure from the sources
themselves - the code bytes are the bytes the audit comments of the
instruction lines claim, and the denominator is the size of the PRG image -
so the column cannot drift from the projects it describes.

Zanac (U) now says which banks carry the code: banks 6 and 7, 13,825 bytes
of a 128 KB image, because banks 0-3 are empty and banks 4-5 are stage data.

Root README: refresh the source shapes the re-splits changed

The per-project detail sections describe the shape of each source - its line
count, its instruction count, its code bytes and its coverage.  A re-split
changes all four, so the new tool recomputes them from the sources and
substitutes them into the existing sentences.

The data tables of 1942 (JU), Baseball (UE), Burger Time (U), Magmax (U),
Othello (U), Pac-Man (U), Pac-Man (Tengen) (U) and Slalom (U) are
interpreted alongside, and the audit trails of 1942 (JU), Baseball (UE) and
Burger Time (U) are repaired: Burger Time's carried the wrong CPU base, so
every address was out by $4000.

AGENTS.md: record what this session's work established

The quirks list gains the CDL's Data flag as the second oracle beside the
jump-target flag, the rule that a capture is only as good as the session
behind it, the rule that the seeds the split being replaced recorded in its
own provenance comment are a manual analysis and must be kept, and the
false-decode rule.

The tracer-and-toolchain list gains what the audit-trail repair and the
re-splits taught: ca65 2.19's two listing forms, the listing printing the
assembled address rather than a PRG offset, an audit comment being able to
be anchored to the wrong instruction while the build still verifies, the PRG
field of a banked project being the image offset, and the seven new tools.

TODO.md: bring the handoff up to date

The file still described the 41-project tier.  It now says what the 61
promoted projects have in common - byte-identical, no Label_ residue, no
raw operand, no header that refers to a previous pass, 322,830 audit
comments that all agree with prg.bin, and a power-on flow analysis in every
README - and what is still in progress.

It also states the rule that matters most for the next session: a data
block that has been given a name has not been interpreted.

Give every branch target a role name, and close the rest of the checklist

_new _tools/audit_promoted.py_ checks the promoted tier against all eleven
items of PROMPTS.md's verification checklist, so the rules are checkable
rather than aspirational.

Three gaps it found, now closed:

- **1,487 branch targets carried an address-derived name.**  PROMPTS.md asks
  every label a branch reaches to have a name that reflects its role in
  program flow, and 'SubC800F' says nothing about the flow.  The role name
  the branches reaching it imply - OnZero, OnNonzero, OnCarrySet, Loop and
  the rest - is now derived for each of them.  derive_branch_names.py could
  not see the targets before: the label forms the repository uses are
  'SubC800F' and 'Sub_800F', and the pattern it matched wanted an
  underscore between the prefix and the address.

- **48 operands named a hardware register by its address.**  Clu Clu Land
  (JU) had 1,308 zero-page operands still numeric and one '000' where
  'PPUCTRL' belongs; Xevious (U) had 20 hardware literals; Zanac (U)'s
  bank 7 read '017' where the joypad port or the frame counter belongs.
  Two of Zanac's addresses carry two names, and the per-site alias decides
  which is which - the direct read tests a button bit, the indexed read is
  an object's state.

- **325 neutral zero-page slots carried no reason.**  locals.inc now says,
  per slot, that the name is provisional.

The tools grew to match: apply_symbols.py accepts an upper-case mnemonic,
apply_zp_aliases.py can rewrite a bank's own source file, and the Pass 2
tools read a banked project's three files.

Every project still prints Byte-identical ROM verified.

PROMPTS.md: the checklist now has a checker

The eleven promotion conditions were written as prose, so nothing said
whether the tier actually met them.  _tools/audit_promoted.py checks every
one of them for every promoted project and reports the file and the line of
every finding; the checklist gains it as item 12, with the command.

CHANGELOG: record the checklist work

audit_promoted.py: count an inventory row wherever the address sits

Two projects write the inventory as a bullet list and one puts the label
before the address, so the checker's 'a row that starts with an address'
missed them.  A row now counts when it holds a $XXXX address in any cell.

Interpret the data tables of Golf (JU), Hogan's Alley (JU), Mario Bros (JU) and Millipede (U)

Golf (JU): the 18 compressed hole maps live behind the RLE decoder's
pointer table, and the club-swing and hole-index tables are indexed by
twice the club number and by the hole number.

Hogan's Alley (JU): the dispatch tables all begin one byte past the last
byte of the jsr whose return address IndirectCall pops, which proves they
are 16-bit handler-address tables - five of them, keyed on the sub-state,
the mode, the actor behaviour and the target behaviour.

Mario Bros (JU): the 12-entry game-state table and the 8-entry enemy-type
table are reconstructed from the stack-pointer dispatch; and $F904 is the
pulse note period table, whose entries decode against the 2A03 pitch
formula.

Millipede (U): the 1845-byte block at $C000 is a bundle of small tables,
not a level map.

Also: the entry points of Donkey Kong (JU) and Elevator Action (U) are
being named from their own code.

Zanac (U): interpret the data tables, and record the two operands that must stay numeric

Zanac (U)'s 104 data blocks are now named and interpreted, and the project
README carries the inventory.  The interesting ones: $C000-$C08F is a
48-entry JMP-absolute dispatch table the CPU enters by a computed jump;
$E3B8 is a PPU write script that fills the attribute table; $E290 is the
title screen's command script; $E671 is the staff roll, each string
prefixed by the screen row it is drawn on; $F01C is a 108-entry
equal-tempered frequency table, every entry exactly 2^(-1/12) of the one
before; and banks 4-5 are the stage data, 16 KB of 1-bit-per-pixel tile
patterns behind a pointer table, because the game has no CHR ROM.

name_data_region.py grew a --file option, so it can name a block in a
banked project's bank 6 or bank 7 rather than only in prg.s.

Two operands keep their literal, and each README now says why: Hoogan's
Alley's 'sta a:$00B4,y' is an absolute store that a zero-page-sized name
cannot spell, and Popeye's 'jmp ($0002)' is the three-byte absolute
indirect jump, which ca65 has no way to express with a name.

Popeye (JU) (PRG 1): record why the indirect-jump operand keeps its literal

Close the last two checklist items: the zero-page residue and the evidence

PROMPTS.md's item 8 asks that apply_symbols.py leave no resolvable operand
numeric without justification.  Four projects had residue:

- **Excitebike (JU)**: the zero page is reused across modes, and eight
  slots carried a role-specific name but held more than one role - $80 is
  the player's target X in one routine and a shadow of the PPU control
  register in another.  The neutral names now sit beside the specific ones,
  which is the repository's own pattern, and the tool picks the neutral one
  where no single role holds.  Its residue is zero.
- **Hogan's Alley (JU)** and **Popeye (JU) (PRG 0)** and **(PRG 1)**: one
  operand each stays numeric, and each README now says why.  'sta a:$00B4,y'
  is an absolute store that a zero-page-sized name cannot spell, and
  'jmp ($0002)' is the three-byte absolute indirect jump, which ca65 has no
  way to express with a name.

apply_symbols.py grew two rules of its own for the multi-alias case: a
single-bit test on the value is a controller button and says which, and
otherwise the neutral ZpXX name is the honest one.

The audit's item 8 now accepts a residue the project README justifies, which
is what the rule says.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the zero-page residue work

Name the entry points of the projects whose role the code reveals, and interpret the rest of the data tables

**Entry points.**  PROMPTS.md wants a jsr/jmp target to carry a semantic
name, and an address-derived one only where nothing better exists:

- **Donkey Kong (JU)**: 358 named, none left.  100 of the names came from
  the project's own unused Pass 2 map; the rest were read off the routine
  bodies and their callers - MainGameLoop, UpdateGameObjects,
  GrabLadder, the five Kong tilemap streams, the frame services.
- **Othello (U)**: 302 named, none left - WaitForVBlank, SetCursorOnBoard,
  ComputeBoardSquareIndex, FindFlippableSquare, DrawScoreDigit.
- **Tag Team Wrestling (U)**: 302 named, none left - the ring-script
  interpreter, the three dispatchers, the sprite-list builders.
- **Clu Clu Land (JU)**, **Defender 2 (U)**, **Donkey Kong 3 (JUE)** and
  **Donkey Kong Jr. (JU)**: their data tables are interpreted.

**Data tables.**  Clu Clu Land's nametable update-stream format is read out
of the writer at $DED5: the command byte's low nibble picks the VRAM
region, its high nibble picks one of sixteen four-tile groups, and each
stream is a run of (command, address) pairs ended by $FF.  Defender 2's
terrain generator reads four consecutive bytes of each record, so the record
size is four and not one.  Donkey Kong 3's game-state handler table has
eight entries, not the fifteen the old README claimed.

name_data_region.py now cuts a .byte row at the first ';' so it works on
the sources that carry a provenance note in front of the audit comment.

Every project still prints Byte-identical ROM verified.

The promoted tier now passes every item of the promotion checklist

python3 _tools/audit_promoted.py --build reports nothing for all 61
projects.

**Data tables.**  CIRCUS, Duck Hunt (JUE) and Balloon Fight (JU) join the
rest.  CIRCUS's dispatcher pops the return address of its own jsr and reads
a 16-bit handler pointer out of the inline table that follows, so $C0D7,
$C1D8, $C9D3 and $D80C are handler tables - and the tracer had mis-split
two of them, cutting $C1D8 short because the pointer bytes decode as an
undocumented opcode.  Duck Hunt's $E64B is the duck's 24 ascending speed
table.  Balloon Fight's $D65C is 64 little-endian nametable addresses.

**Entry points.**  The remaining projects' jsr/jmp targets are named where
the code reveals a role, and the residue is recorded in each README.

**One more tool fix.**  name_data_region.py cuts a .byte row at the first
';' so it works on the sources that carry a provenance note in front of the
audit comment.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the tier passing the checklist

Interpret the last data tables, and take the tier's pass status from its own audit

**Data tables.**  Tag Team Wrestling (U), World Class Track Meet (U),
Wild Gunman (U) and Tennis (JU).

Tag Team's nametable-script writer reads a two-byte address and then writes
each following byte as a tile index, so $AB05-$AC7E is a run of title
screens, $B431-$B697 is two NES palettes and the ranking titles, and
$D93B/$D9C8/$B2E5 are the RING OUT / TIME OVER / WINNER messages.  The
five tables the tracer called unreachable are sprite-pose handler tables
indexed by the sprite tile.

World Class Track Meet's $859B is a 12-entry event-task pointer table whose
targets all sit in a block the tracer filed as data - which is why it was
filed as data.  Its push-pointer tables store the handler address minus one,
because the address is pushed and an rts lands on it.

Wild Gunman's earlier Pass 3 was hollow: the tracer reached 49.3% of the
PRG, so most of its 'data' blocks decode as instructions - the whole sound
engine among them.  The wrong SpritePositionTable name is gone.

Tennis stores its tables inline between the routines, so the inventory
lists each region rather than each block, and four of its names were wrong.

**Root README.**  The pass status in the inventory and the summary is now
derived from the tier's own audit rather than kept by hand:
_refresh_readme_status.py_ rewrites the column from what
_audit_promoted.py_ finds.

Every project still prints Byte-identical ROM verified.

Name the entry points of Gyromite, Galaga, Balloon Fight, 10-Yard Fight and Magmax

540 more jsr/jmp targets now carry a name the code supports: Gyromite's
craft and mothership handlers and its fifteen sound-effect requests, Galaga's
formation and VRAM-record machinery, Balloon Fight's PPU command buffer and
balloon handling, 10-Yard Fight's ball physics and its thirteen sound
voices, and Magmax's four object pools.

Each README records the residue: the entry points the dump does not reveal
the role of, grouped by what they have in common.

Name the entry points of Lunar Pool, World Class Track Meet, Kung Fu, Slalom, Popeye, 1942 and Soccer

1,159 more jsr/jmp targets now carry a name the code supports.

Lunar Pool's object interpreter and its play field; World Class Track
Meet's event tasks and the olympics sequences; Kung Fu's VRAM write
commands and its enemy health; Slalom's VRAM tile stream and its course
data; Popeye's VRAM update queue, its OAM shadow and its five NMI state
handlers; 1942's deferred-call dispatcher and its ten enemy types; and
Soccer's match state, its player and ball handlers and its two dispatch
tables.

Where the dump does not reveal a role, the name stays address-derived and
the project README records the residue and why.

Root README: take the pass status from the tier's audit

refresh_readme_status.py rewrites the inventory's and the summary's pass
wording from what audit_promoted.py finds, so the two cannot disagree.
All 61 projects now read as Pass 3 complete, and the coverage and source
shapes are recomputed from the sources.

Remaining entry-point naming

Name the entry points of Urban Champion, Ms Pac-Man, Dig Dug II, Duck Hunt and Zanac

665 more jsr/jmp targets now carry a name the code supports.

Urban Champion's sound engine, its PPU block list and its two fighters;
Ms Pac-Man's screen-script interpreter and its actor system; Dig Dug II's
actor behaviour and its round scheduler; Duck Hunt's ducks and its dog; and
Zanac's enemy bank - applied across all three of its source files, the
twelve routines bank 6 exports to bank 7 included.

Ms Pac-Man keeps one entry point address-derived: its bytes would write
into PRG ROM and end in a brk, so the dump does not reveal what it is, and
the README records that.

CHANGELOG: record the entry-point naming

Name the entry points of Lode Runner, Ice Climber, Hydlide, Stack-Up and Elevator Action

Re-align the audit comments to the canonical column

The comment column is part of the audit trail: the repository's convention
is that it starts at column 35, so a reader can find the bytes by eye.
Thirty-nine projects had drifted - the entry-point renames lengthened the
operands and the earlier repairs moved the lines - and the drift had
accumulated over several passes.

align_audit_comments.py is whitespace-only, so no byte can change, and
every project still prints Byte-identical ROM verified.

Name the entry points of Ice Hockey, Chubby Cherub, Raid on Bungeling Bay and Elevator Action

1,127 more jsr/jmp targets now carry a name the code supports.

Ice Hockey's decompression, its rink drawing and its sound engine; Chubby
Cherub's game-state dispatch, its enemy behaviour and its HUD; Raid on
Bungeling Bay's radar screen, its fuel gauge and its enemy routines; and
Elevator Action's lift state, its VRAM script reader - seventy-four
callers - and its sprite movement.

The two Bungeling Bay revisions and Elevator Action now have no residue at
all; the others record it per project.

CHANGELOG: record the audit-comment re-alignment

Remaining entry-point naming

Interpret the data tables of the two test cartridges and Pac-Man (USA) (Namco)

**Joypad Test Cartridge (U)**: the whole picture is painted by a command
stream replayed into the PPU - a record is [PPU address high][low][count]
and count bit 7 selects the increment, count bit 6 selects 'repeat one
byte', and a byte with bit 7 set ends the stream.  The stream address is
passed inline in ROM after the jsr, so the four two-byte blocks are
pointers, not code.

**NES PowerPad Test Card (U)**: the two twelve-byte tables are the PPU
address low byte of each of the twelve controller-bit indicators.  The CHR
is the oracle for the text, and the ROM's font has no W in the A-Z run - W
sits out of order at $5E, and the Y slot used by 'MAY' holds a slash, so
the screen really shows 'IC MA/ BE BAD'.

**Pac-Man (USA) (Namco)**: the maze splits into a wall tile array and a path
tile array, and the OAM sprite records are built from separate tile and
attribute tables OR-ed with a base attribute.  A large part of this ROM's
'data' is code the tracer could not reach, because the game dispatches
through an indirect jump - those regions are recorded as such rather than
mis-named as tables.

CHANGELOG: record the tier reaching completion

Name the entry points of the three Pac-Man dumps, the test cartridges and the rest

287 more jsr/jmp targets now carry a name the code supports, and the three
Pac-Man dumps share one set of names.

Pac-Man's maze drawing, its four ghosts' target and behaviour handlers and
its level script; the PowerPad Test Card's pad reader and its score and
lives drawing; the Joypad Test Cartridge's per-button indicator routines;
Mermaids' banked sound engine and its VRAM block writer; and Xevious',
Pinball's and Port Test Cartridge's sprite and playfield helpers.

Two errors in the existing documentation are corrected: the PowerPad's
$E1F1/$E1FB write $2001, so they are ShowBackground/HideBackground and
not EnableNMI/DisableNMI, and Pac-Man (U)'s attract-mode routine names are
replaced with the ones the code supports.

Every project still prints Byte-identical ROM verified.

CHANGELOG: the final entry-point numbers
2026-10-22 00:33:54 -04:00

34 KiB

18000Reset
28009Sub_OnNonnegative
3800ESub_OnNegative
48013Sub_OnNonnegative2
58018Sub_OnNegative2
6801DSub_OnNonnegative3
78022Sub_OnNegative3
8804EIrqHandler
9804FSub_804F
10807ESubC807E
11808BSubC808B
128093SubC8093
13809BSubC809B
1480A7Sub_Loop
1580AFSubC80AF
1680B7SubC80B7
1780BFSubC80BF
1880C7SubC80C7
1980D8Sub_80D8
2080DDSub_80DD
2180E5Sub_Loop2
22810FSubC810F
23811ASubC811A
248126Sub_Loop3
25813ASubC813A
26813DSubC813D
278142SubC8142
288151SubC8151
29815CSubC815C
308169SubC8169
318171SubC8171
328199Sub_Loop4
33819DSub_819D
3481B2Sub_Loop5
3581B5Sub_Loop6
3681BESub_Loop7
3781C3Sub_Loop8
3881D6SubC81D6
3981EASub_Loop9
408209Sub_Loop10
41820CSub_820C
428219Sub_Loop11
43821CSub_821C
448225Sub_8225
4582B9Sub_82B9
4682C5Sub_OnNonnegative4
4782D9Sub_82D9
4882FCSub_82FC
498328Sub_8328
508338Sub_8338
518368Sub_8368
528372Sub_OnNonzero
538377Sub_OnNonzero2
548393Sub_Loop12
558394Sub_8394
56839ESubC839E
5783A7SubC83A7
5883C1Sub_Loop13
5983C3Sub_83C3
6083C8Sub_83C8
6183ECSubC83EC
6283EFSub_83EF
6383FASub_OnNegative4
6483FBSubC83FB
65840ESub_Loop14
668415Sub_Loop15
678421Sub_8421
68842CSubC842C
69843DSub_Loop16
708444Sub_Loop17
71844BSubC844B
72846DSubC846D
738474Sub_Loop18
748475SubC8475
75847BSub_Loop19
768488Sub_Loop20
77848ASub_848A
78849BSubC849B
7984A0SubC84A0
8084A1SubC84A1
8184A6SubC84A6
8284B3Sub_Loop21
8384F7Sub_Loop22
84850ASubC850A
85854ESub_854E
868562SubC8562
878573Sub_8573
88858FSubC858F
898592SubC8592
9085A0SubC85A0
9185BCSub_85BC
9285CBSubC85CB
9385DBSubC85DB
9485DESub_Loop23
9585E3Sub_85E3
9685F0Sub_85F0
97860CSubC860C
98860FSubC860F
998619SubC8619
1008623Sub_Loop24
101862ESub_Loop25
1028633SubC8633
103864DSubC864D
1048655SubC8655
1058658SubC8658
106865BSubC865B
1078660SubC8660
108869ASub_869A
10986ABSub_Loop26
11086C7SubC86C7
11186DFSub_86DF
11286FBSub_Loop27
1138702Sub_OnNonnegative5
114871DSub_Loop28
1158723Sub_Loop29
116872ASub_OnNonnegative6
1178745Sub_Loop30
1188746Sub_8746
119874ESubC874E
1208761Sub_Loop31
121876ASub_OnZero
122877FSub_Loop32
12387A0Sub_Loop33
12487BESub_Loop34
12587D5Sub_Loop35
12687DBSub_87DB
12787DESub_Loop36
12887EBSub_87EB
12987F6Sub_87F6
1308808Sub_Loop37
1318811Sub_8811
1328812Sub_8812
133882ESub_OnNonnegative7
1348838Sub_8838
135883ASub_OnNonnegative8
136888BSub_888B
137889CSub_Loop38
138889ESub_889E
13988A0Sub_88A0
14088C2Sub_Loop39
14188CASub_OnNonzero3
14288D5Sub_Loop40
14388D8Sub_Loop41
14488E6Sub_88E6
14588F0Sub_Loop42
14688FBSub_Loop43
147890BSub_Loop44
148891DSub_OnZero2
1498920Sub_Loop45
150892ESub_Loop46
1518933Sub_8933
1528961Sub_Loop47
153896CSub_Loop48
154897FSub_Loop49
15589A0Sub_89A0
15689C3Sub_89C3
15789D3Sub_89D3
15889DCSubC89DC
15989DFSub_89DF
16089EDSub_Loop50
16189F9Sub_Loop51
16289FESub_89FE
1638A1ASub_Loop52
1648A25Sub_Loop53
1658A34Sub_OnNonzero4
1668A45Sub_Loop54
1678A4CSub_8A4C
1688A5ASub_8A5A
1698A71Sub_Loop55
1708A88Sub_Loop56
1718A98Sub_Loop57
1728AA0Sub_Loop58
1738AABSub_Loop59
1748AB8Sub_Loop60
1758AC0Sub_8AC0
1768AD8Sub_Loop61
1778ADBSub_8ADB
1788AE0Sub_OnNonzero5
1798AEASub_Loop62
1808B0ESub_Loop63
1818B13Sub_OnNonzero6
1828B20Sub_Loop64
1838B3ASub_Loop65
1848B45Sub_8B45
1858B51Sub_Loop66
1868B67Sub_8B67
1878B72Sub_Loop67
1888B87Sub_Loop68
1898B9CSub_8B9C
1908BD9Sub_8BD9
1918BE7Sub_OnNonzero7
1928BF7Sub_8BF7
1938C12Sub_Loop69
1948C16Sub_8C16
1958C2BSub_Loop70
1968C2DSub_Loop71
1978C48SubC8C48
1988C68Sub_Loop72
1998C8CSub_8C8C
2008CA2Sub_Loop73
2018CBASub_Loop74
2028CBDSub_8CBD
2038CC3Sub_Loop75
2048CD4Sub_Loop76
2058CDCSub_8CDC
2068CDFSub_8CDF
2078CECSub_Loop77
2088CEESub_Loop78
2098CEFSub_8CEF
2108CFESub_Loop79
2118D03Sub_8D03
2128D22Sub_OnNonnegative9
2138D26Sub_OnNonnegative10
2148D42Sub_Loop80
2158D4ASub_Loop81
2168D6BSub_Loop82
2178D71Sub_Loop83
2188D75Sub_8D75
2198D90Sub_Loop84
2208D98Sub_8D98
2218DA3Sub_8DA3
2228DBFSubC8DBF
2238DCFSub_Loop85
2248DD1Sub_8DD1
2258DD6Sub_8DD6
2268DDASub_OnCarrySet
2278DE3Sub_OnCarrySet2
2288DECSub_OnNonnegative11
2298DF3Sub_OnCarrySet3
2308E01Sub_8E01
2318E03Sub_OnNonnegative12
2328E0DSub_8E0D
2338E11Sub_OnNonnegative13
2348E15Sub_OnNonnegative14
2358E27Sub_8E27
2368E2CSubC8E2C
2378E2FSub_8E2F
2388E37Sub_8E37
2398E3FSub_8E3F
2408E57SubC8E57
2418E60SubC8E60
2428E61Sub_Loop86
2438E64SubC8E64
2448E6ESubC8E6E
2458E81Sub_Loop87
2468E8CSub_8E8C
2478E93Sub_8E93
2488E97Sub_8E97
2498EA4Sub_8EA4
2508EB2Sub_8EB2
2518EB7SubC8EB7
2528EB8Sub_Loop88
2538EBDSubC8EBD
2548EBESub_8EBE
2558EC8Sub_OnNonnegative15
2568ECESub_Loop89
2578ED4Sub_8ED4
2588EECSub_Loop90
2598EFFSub_8EFF
2608F13Sub_Loop91
2618F22Sub_8F22
2628F24Sub_8F24
2638F2ESub_Loop92
2648F2FSub_8F2F
2658F48Sub_Loop93
2668F4ASub_8F4A
2678F60Sub_Loop94
2688F65Sub_8F65
2698F75Sub_Loop95
2708F77Sub_8F77
2718F84Sub_8F84
2728F95Sub_8F95
2738F9BSub_8F9B
2748FAFSub_8FAF
2758FF1Sub_Loop96
2768FF7Sub_Loop97
2779002Sub_Loop98
2789013Sub_9013
279901BSub_OnNonzero8
280904ASub_904A
2819050Sub_9050
2829064Sub_9064
28390A6Sub_Loop99
28490B2Sub_Loop100
28590C3Sub_Loop101
28690C4Sub_90C4
28790CCSub_OnNonzero9
2889100Sub_Loop102
2899101Sub_9101
2909105Sub_OnNonnegative16
291910CSub_910C
2929110Sub_OnNonnegative17
293911FSub_911F
2949121Sub_OnNonnegative18
295912BSub_912B
296912DSub_OnNonnegative19
2979136Sub_9136
2989138Sub_OnNonnegative20
2999142Sub_9142
300914ASub_Loop103
301915BSub_Loop104
3029169Sub_OnNonnegative21
303917DSub_OnNonnegative22
3049189Sub_Loop105
305918BSub_OnNonnegative23
3069194Sub_9194
30791A0Sub_Loop106
30891A1Sub_91A1
30991B8Sub_OnCarryClear
31091C5Sub_Loop107
31191CESub_91CE
3129210Sub_9210
3139273Sub_Loop108
314927CSub_927C
3159291Sub_Loop109
3169296Sub_Loop110
3179299Sub_Loop111
31892A0Sub_92A0
31992A9Sub_OnNonnegative24
32092B3Sub_Loop112
32192B5Sub_OnNonnegative25
3229337Sub_9337
323934ASub_Loop113
3249353Sub_9353
3259359Sub_9359
3269369Sub_9369
32793A1Sub_Loop114
32893A6Sub_Loop115
32993F6Sub_Loop116
3309404Sub_9404
3319432Sub_OnZero3
3329479Sub_9479
3339486Sub_9486
334948FSub_948F
3359497Sub_9497
33694A3Sub_Loop117
33794A6Sub_94A6
33894B2Sub_94B2
33994BFSubC94BF
34094C8Sub_94C8
34194D6Sub_94D6
34294E0Sub_94E0
34394EBSub_94EB
34494FDSub_94FD
3459511Sub_9511
3469519Sub_OnCarryClear2
347952ASub_Loop118
3489535Sub_Loop119
3499562SubC9562
350956BSub_Loop120
351957BSub_Loop121
352957FSub_Loop122
353958ASub_Loop123
35495D7SubC95D7
35595DFSub_Loop124
35695F0Sub_OnCarrySet4
35795F1SubC95F1
3589602Sub_Loop125
359960ASub_Loop126
3609617Sub_9617
3619621Sub_9621
3629626SubC9626
3639634Sub_Loop127
364963ASub_963A
3659647SubC9647
366964DSub_Loop128
3679656SubC9656
368968ESub_968E
3699691Sub_9691
37096A7Sub_Loop129
37196B3Sub_Loop132
37296B9Sub_Loop134
37396BCSub_96BC
37496BDSub_Loop135
37596D3Sub_Loop136
37696E9Sub_96E9
37796EFSub_OnNonzero10
3789706Sub_OnNonzero11
379971DSub_Loop137
3809724Sub_Loop138
381972BSub_Loop139
3829743Sub_Loop140
3839746SubC9746
3849755Sub_9755
38597C4SubC97C4
38697CESub_OnNonnegative26
38797D2Sub_OnNonnegative27
38897E6Sub_Loop141
38997E8Sub_Loop142
39097F1Sub_97F1
39197F8Sub_97F8
39297FESub_97FE
3939811SubC9811
3949814Sub_Loop143
3959825SubC9825
396982ASub_Loop144
3979836Sub_OnZero4
398983ESub_OnNonzero12
3999843Sub_9843
4009844Sub_Loop145
4019852Sub_Loop146
402985FSubC985F
4039862Sub_Loop147
404988ASub_988A
405989BSub_989B
40698A3Sub_98A3
40798AESub_Loop148
40898AFSub_Loop149
40998B2SubC98B2
41098B5Sub_98B5
41198CDSub_98CD
41298F1Sub_98F1
41398F9Sub_98F9
4149907Sub_9907
4159911SubC9911
4169919SubC9919
4179924SubC9924
4189935Sub_9935
419997ESub_OnZero5
4209996SubC9996
42199ACSub_99AC
42299B9SubC99B9
42399DASub_99DA
42499DFSubC99DF
42599E0Sub_99E0
4269A00Sub_9A00
4279A35Sub_9A35
4289A3DSubC9A3D
4299A42Sub_OnNegative5
4309A43Sub_9A43
4319A50Sub_9A50
4329A8ESub_9A8E
4339A9FSub_9A9F
4349AAASub_9AAA
4359AAFSubC9AAF
4369BB0Sub_9BB0
4379BB8Sub_Loop151
4389BCFSub_OnNonzero13
4399BE6Sub_Loop152
4409BFDSub_OnNonzero14
4419C14Sub_Loop153
4429C15Sub_9C15
4439C1DSub_Loop154
4449C2ESub_OnNonzero15
4459C3CSub_9C3C
4469C44Sub_Loop155
4479C55Sub_OnNonzero16
4489C66Sub_9C66
4499C70Sub_OnCarryClear3
4509C8ESub_OnNonzero17
4519C8FSub_9C8F
4529C99Sub_OnCarryClear4
4539CB8Sub_9CB8
4549CC2Sub_OnCarryClear5
4559CE1Sub_9CE1
4569CEBSub_OnCarryClear6
4579D0ASub_9D0A
4589D15Sub_9D15
4599D2CSub_Loop156
4609D34Sub_Loop157
4619D3BSub_9D3B
4629D4BSub_Loop158
4639D4ESub_9D4E
4649D56Sub_9D56
4659D86Sub_Loop159
4669D8ESub_9D8E
4679DB6Sub_9DB6
4689DC1Sub_9DC1
4699DE8Sub_Loop160
4709E02Sub_Loop161
4719E05Sub_9E05
4729E0DSub_OnCarryClear7
4739E28Sub_Loop162
4749E2ASub_9E2A
4759E2FSub_Loop163
4769E47Sub_9E47
4779E72Sub_OnCarryClear8
4789E91Sub_Loop164
4799E93Sub_9E93
4809EA6Sub_Loop165
4819ED3Sub_OnCarryClear9
4829EF2Sub_Loop166
4839EF4Sub_9EF4
4849F07Sub_Loop167
4859F19Sub_9F19
4869F38Sub_OnZero6
4879F51Sub_Loop168
4889F5ASub_9F5A
4899F67Sub_Loop169
4909F69Sub_9F69
4919F77Sub_9F77
4929F86Sub_OnCarryClear10
4939FAESub_9FAE
4949FD0Sub_9FD0
4959FD9Sub_9FD9
496A00ASub_A00A
497A013Sub_A013
498A03ASub_A03A
499A040Sub_A040
500A05CSub_Loop170
501A05DSub_A05D
502A0A7Sub_Loop171
503A0AFSub_Loop172
504A0B5Sub_A0B5
505A0BASub_OnNonnegative28
506A0C3Sub_A0C3
507A0CDSub_OnNonzero18
508A0D8Sub_A0D8
509A0E4Sub_A0E4
510A0EESub_A0EE
511A0F8Sub_A0F8
512A102Sub_A102
513A10CSub_A10C
514A118Sub_OnNonnegative29
515A11CSub_OnNonnegative30
516A136Sub_A136
517A148Sub_OnNonnegative31
518A14CSub_OnNonnegative32
519A157Sub_Loop173
520A15FSub_Loop174
521A168Sub_A168
522A170Sub_OnCarryClear11
523A184Sub_A184
524A19FSub_Loop175
525A1AFSub_Loop176
526A1BFSub_A1BF
527A1D6Sub_A1D6
528A1F3Sub_Loop177
529A201Sub_Loop178
530A212Sub_Loop179
531A22ESub_Loop180
532A234Sub_Loop181
533A239Sub_A239
534A25ASub_Loop182
535A2A0Sub_OnNonzero19
536A2ADSub_OnZero7
537A2AESub_A2AE
538A2C1Sub_Loop183
539A2EESub_Loop184
540A312Sub_Loop185
541A315Sub_Loop186
542A33CSub_Loop187
543A34ASub_Loop188
544A350Sub_Loop189
545A353Sub_OnZero8
546A354Sub_Loop190
547A372Sub_Loop191
548A375Sub_A375
549A378Sub_A378
550A37CSub_A37C
551A38FSub_Loop192
552A396Sub_A396
553A3A4Sub_Loop193
554A3A7Sub_A3A7
555A3B7Sub_A3B7
556A3B9Sub_A3B9
557A3C4Sub_Loop194
558A3CFSub_Loop195
559A3F9Sub_A3F9
560A40CSub_Loop196
561A413Sub_A413
562A423Sub_Loop197
563A426Sub_A426
564A430Sub_Loop198
565A43BSub_Loop199
566A446Sub_Loop200
567A46CSub_OnNonnegative33
568A474SubCA474
569A47FSubCA47F
570A484Sub_Loop201
571A485SubCA485
572A49FSub_Loop202
573A4ADSubCA4AD
574A4CCSub_Loop203
575A4E9Sub_A4E9
576A4F0Sub_A4F0
577A4F7Sub_A4F7
578A4FESub_A4FE
579A505SubCA505
580A517Sub_A517
581A526Sub_A526
582A54CSub_Loop204
583A552Sub_Loop205
584A553Sub_A553
585A569Sub_OnOverflowSet
586A56DSub_A56D
587A56FSub_A56F
588A57ASub_Loop206
589A581Sub_Loop207
590A582Sub_A582
591A679SubCA679
592A67DSub_OnCarryClear12
593A68BSub_Loop208
594A68DSub_A68D
595A69ASub_Loop209
596A69CSub_Loop210
597A6AFSubCA6AF
598A6B7Sub_OnCarryClear13
599A6D1SubCA6D1
600A6D3Sub_OnOverflowSet2
601A6D5Sub_OnNonzero20
602A6ECSub_A6EC
603ABD0Sub_ABD0
604ABE3Sub_ABE3
605ABF5Sub_Loop211
606AC03Sub_Loop212
607AC0BSub_Loop213
608AC10Sub_AC10
609AC18Sub_AC18
610AC20Sub_OnNonnegative34
611AC2CSub_Loop214
612AC2ESub_OnNonnegative35
613AC37Sub_AC37
614AC3FSub_Loop215
615AC62SubCAC62
616AC86Sub_OnZero9
617AC98Sub_Loop216
618AC9BSub_Loop217
619AC9ESub_Loop218
620ACA1Sub_Loop219
621ACA4Sub_Loop220
622ACB6Sub_Loop221
623ACC8Sub_Loop222
624ACCESub_Loop223
625ACD1Sub_Loop224
626ACECSub_Loop225
627ACEFSub_Loop226
628AD05Sub_Loop227
629AD15Sub_AD15
630AD1BSub_AD1B
631AD21Sub_AD21
632AD27Sub_AD27
633AD35Sub_AD35
634AD54Sub_AD54
635AD60Sub_Loop228
636AD63Sub_AD63
637AD6CSubCAD6C
638AD88Sub_Loop229
639AD91Sub_Loop230
640AD9ASub_Loop231
641ADA3Sub_Loop232
642ADB0Sub_Loop233
643ADBDSubCADBD
644ADDASub_Loop234
645ADDBSub_Loop235
646ADE4Sub_Loop236
647ADEDSub_Loop237
648ADF9SubCADF9
649AE02SubCAE02
650AE0BSub_Loop238
651AE14Sub_Loop239
652AE25Sub_Loop240
653AE32SubCAE32
654AE60Sub_Loop241
655AE69Sub_Loop242
656AE72Sub_Loop243
657AE7BSub_Loop244
658AE84Sub_Loop245
659AE8DSub_Loop246
660AE96Sub_Loop247
661AE9FSub_AE9F
662AEB9Sub_Loop248
663AEBASub_AEBA
664AECCSub_OnCarryClear14
665AEE6Sub_Loop249
666AEEBSub_Loop250
667AEFASub_Loop251
668AF98Sub_AF98
669AFA6Sub_Loop252
670AFAESub_OnNonzero21
671AFB9Sub_OnNonzero22
672AFC5Sub_OnZero10
673AFDBSub_OnNonzero23
674AFDCSub_Loop253
675AFE4Sub_Loop254
676AFEDSub_Loop255
677AFF1Sub_Loop256
678AFFCSub_Loop257
679B003Sub_Loop258
680B006Sub_OnNonzero24
681B038Sub_OnNonzero25
682B03ESub_OnNonzero26
683B04DSub_Loop259
684B061Sub_Loop260
685B063Sub_OnNonzero27
686B069Sub_OnNonzero28
687B078Sub_Loop261
688B08CSub_Loop262
689B097Sub_Loop263
690B099Sub_B099
691B09ESub_Loop264
692B0A5Sub_OnNonzero29
693B0AESub_Loop265
694B0B7Sub_OnZero11
695B0CDSub_B0CD
696B0D8Sub_OnNonzero30
697B0E5Sub_OnNonzero31
698B0F0Sub_OnZero12
699B10ESub_OnZero13
700B11ESub_Loop266
701B128Sub_Loop267
702B140Sub_Loop268
703B142Sub_Loop269
704B144Sub_Loop270
705B14CSub_Loop271
706B14DSub_B14D
707B156Sub_OnNonzero32
708B15FSub_OnNonzero33
709B16ASub_OnZero14
710B18CSub_Loop272
711B18ESub_Loop273
712B198Sub_OnNonzero34
713B199Sub_Loop274
714B1A1Sub_Loop275
715B1AASub_Loop276
716B1AESub_Loop277
717B1AFSub_B1AF
718B1B8Sub_OnNonzero35
719B1C1Sub_OnNonzero36
720B1CCSub_OnZero15
721B1EESub_Loop278
722B1F0Sub_Loop279
723B1FASub_OnNonzero37
724B1FBSub_Loop280
725B203Sub_Loop281
726B20CSub_Loop282
727B210Sub_Loop283
728B211Sub_B211
729B21FSub_B21F
730B222Sub_Loop284
731B238Sub_OnNonzero38
732B244Sub_OnZero16
733B26ASub_OnNonzero39
734B283Sub_Loop285
735B28DSub_Loop286
736B2B8Sub_Loop287
737B2C7Sub_B2C7
738B2E3Sub_OnNonzero40
739B2EFSub_OnZero17
740B315Sub_OnNonzero41
741B32ESub_Loop288
742B338Sub_Loop289
743B34DSub_OnNonzero42
744B350Sub_OnZero18
745B35BSub_Loop290
746B372Sub_Loop291
747B37DSub_B37D
748B37FSub_OnNonzero43
749B3B5Sub_Loop292
750B3C5Sub_Loop293
751B3C8Sub_Loop294
752B3CESub_Loop295
753B3D3Sub_Loop296
754B3D8Sub_B3D8
755B3E5Sub_OnNonzero44
756B3F2Sub_OnNonzero45
757B3FDSub_OnNonzero46
758B40FSub_OnNonzero47
759B418Sub_OnNonzero48
760B425Sub_OnNonzero49
761B430Sub_OnNonzero50
762B440Sub_Loop297
763B443Sub_Loop298
764B446Sub_Loop299
765B449Sub_Loop300
766B44CSub_Loop301
767B452Sub_OnNonzero51
768B467Sub_B467
769B46FSub_OnNonzero52
770B489Sub_B489
771B48FSub_OnNonzero53
772B4A4Sub_B4A4
773B4ACSub_OnNonzero54
774B4C6Sub_Loop302
775B4C7Sub_Loop303
776B4CASub_Loop304
777B4CDSub_B4CD
778B4CFSub_OnNonzero55
779B4DCSub_Loop305
780B4DESub_Loop306
781B4E2Sub_B4E2
782B4F0Sub_Loop307
783B4FASub_Loop308
784B4FDSub_Loop309
785B500Sub_B500
786B50ESub_B50E
787B526Sub_Loop310
788B53ASub_Loop311
789B551Sub_Loop312
790B566Sub_OnNonzero56
791B569Sub_OnZero19
792B574Sub_Loop313
793B58BSub_Loop314
794B596Sub_B596
795B598Sub_OnNonzero57
796B5D6Sub_Loop315
797B5DASub_OnZero20
798B5EASub_Loop316
799B5EFSub_Loop317
800B5F2Sub_Loop318
801B5F4Sub_OnZero21
802B604Sub_Loop319
803B609Sub_Loop320
804B60DSub_Loop321
805B612Sub_Loop322
806B617Sub_OnNonzero58
807B61ASub_OnNonzero59
808B625Sub_Loop323
809B656Sub_Loop324
810B664Sub_B664
811B671Sub_Loop325
812B67ESub_Loop326
813B689Sub_Loop327
814B693Sub_OnNonzero60
815B6B4Sub_Loop328
816B6C5Sub_B6C5
817B6D2Sub_Loop329
818B6DFSub_Loop330
819B6EASub_Loop331
820B6F4Sub_OnNonzero61
821B701Sub_B701
822B728Sub_Loop332
823B733Sub_OnCarrySet5
824B736Sub_OnCarrySet6
825B750Sub_Loop333
826B75BSub_OnCarrySet7
827B76DSub_Loop334
828B777Sub_Loop335
829B77DSub_Loop336
830B788Sub_Loop337
831B7AASub_Loop338
832B7ABSub_B7AB
833B7D2Sub_Loop339
834B7DDSub_OnCarrySet8
835B7E0Sub_OnCarrySet9
836B7FASub_Loop340
837B805Sub_OnCarrySet10
838B817Sub_Loop341
839B821Sub_Loop342
840B827Sub_Loop343
841B832Sub_Loop344
842B854Sub_Loop345
843B855Sub_B855
844B882Sub_Loop346
845B88DSub_OnCarrySet11
846B890Sub_OnCarrySet12
847B8AASub_Loop347
848B8B5Sub_OnCarrySet13
849B8C7Sub_Loop348
850B8D1Sub_Loop349
851B8D7Sub_Loop350
852B8E2Sub_Loop351
853B904Sub_Loop352
854B905Sub_B905
855B932Sub_Loop353
856B93DSub_OnCarrySet14
857B940Sub_OnCarrySet15
858B95ASub_Loop354
859B96FSub_OnCarrySet16
860B981Sub_Loop355
861B98BSub_Loop356
862B991Sub_Loop357
863B9A1Sub_Loop358
864B9CBSub_Loop359
865B9CCSub_B9CC
866B9F9Sub_Loop360
867BA04Sub_OnCarrySet17
868BA07Sub_OnCarrySet18
869BA21Sub_Loop361
870BA36Sub_OnCarrySet19
871BA48Sub_Loop362
872BA52Sub_Loop363
873BA58Sub_Loop364
874BA68Sub_Loop365
875BA92Sub_Loop366
876BA93Sub_BA93
877BA9ESub_Loop367
878BABASub_OnCarryClear15
879BAC8Sub_Loop368
880BAE1Sub_Loop369
881BAFASub_Loop370
882BB19Sub_OnCarrySet20
883BB21Sub_Loop371
884BB2CSub_Loop372
885BB3BSub_Loop373
886BB3CSub_BB3C
887BB40Sub_OnNonzero62
888BB47Sub_BB47
889BB5FSub_Loop374
890BB61Sub_OnNonzero63
891BB6CSub_BB6C
892BB7BSub_OnNonzero64
893BB85Sub_Loop375
894BB88Sub_OnNonzero65
895BB90Sub_Loop376
896BB98Sub_Loop377
897BBA5Sub_Loop378
898BBA8Sub_BBA8
899BBB2Sub_OnNonzero66
900BBC2Sub_Loop379
901BBCASub_Loop380
902BBD2Sub_Loop381
903BBD9SubCBBD9
904BBE1Sub_OnNonzero67
905BBFASub_Loop382
906BC03Sub_BC03
907BC11Sub_OnNonzero68
908BC20Sub_OnNonzero69
909BC4BSub_BC4B
910BC5ESub_Loop383
911BC66Sub_Loop384
912BC6ESub_Loop385
913BC70Sub_Loop386
914BC7DSub_Loop387
915BC85Sub_Loop388
916BCAESub_Loop389
917BCB9Sub_OnNonzero70
918BCBESub_BCBE
919BCC6Sub_Loop390
920BCCDSub_BCCD
921D6A4Sub_D6A4
922D6A8Sub_OnNonzero71
923D6AESub_D6AE
924D6B4NmiHandler
925D6DCSub_Loop391
926D6E2Sub_D6E2
927D6EBSub_OnZero22
928D6F1Sub_OnNonnegative36
929D6FDSub_D6FD
930D6FFSub_D6FF
931D708Sub_D708
932D70DSub_D70D
933D736Sub_D736
934D742Sub_Loop392
935D74ASub_OnNonzero72
936D763Sub_Loop393
937D76BSub_Loop394
938D770Sub_D770
939D776Sub_D776
940D77CSub_D77C
941D780Sub_Loop395
942D7A2Sub_Loop396
943D7BASub_Loop397
944D7CCSub_OnNonzero73
945D7E9Sub_OnNonzero74
946D7FASub_Loop398
947D804Sub_Loop399
948D80DSub_OnNonzero75
949D81ESub_Loop400
950D824Sub_D824
951D82FSub_Loop401
952D83BSub_Loop402
953D843Sub_D843
954D86ASub_OnNonzero76
955D880Sub_Loop403
956D88ASub_Loop404
957D893Sub_OnNonzero77
958D8A9Sub_Loop405
959D8AFSub_D8AF
960D8B5Sub_Loop406
961D8C1Sub_Loop407
962D8C9Sub_Loop408
963D8D0SubCD8D0
964D8D5Sub_D8D5
965D8E4Sub_Loop409
966D8F9Sub_D8F9
967D905Sub_D905
968D90ASub_D90A
969D913Sub_OnNonzero78
970D938Sub_Loop410
971D93FSub_OnNonzero79
972D95FSub_Loop411
973D965Sub_Loop412
974D966Sub_D966
975D973Sub_D973
976D975Sub_OnNonzero80
977D993SubCD993
978D9A2Sub_Loop413
979D9AESub_OnCarrySet21
980D9B2Sub_Loop414
981D9B7SubCD9B7
982D9CESub_Loop415
983D9DASub_Loop416
984D9DDSub_D9DD
985D9EASub_D9EA
986DA02Sub_Loop417
987DA04Sub_Loop418
988DA09Sub_DA09
989DA18Sub_Loop419
990DA1ASub_OnNonnegative37
991DA27Sub_Loop420
992DA2ASub_Loop421
993DA36Sub_Loop422
994DA38Sub_OnNonnegative38
995DA45Sub_Loop423
996DA48Sub_Loop424
997DA61Sub_DA61
998DA6DSub_Loop425
999DA74SubCDA74
1000DA79Sub_DA79
1001DA89Sub_OnNonzero81
1002DA96Sub_Loop426
1003DAA3Sub_Loop427
1004DAADSub_Loop428
1005DABASub_Loop429
1006DABDSubCDABD
1007DAC1Sub_OnNonzero82
1008DAC8SubCDAC8
1009DACFSub_OnNonzero83
1010DAEESub_DAEE
1011DAF7Sub_Loop430
1012DAF8Sub_DAF8
1013DB04Sub_OnNonnegative39
1014DB0FSub_DB0F
1015DB1BSub_Loop431
1016DB27Sub_Loop432
1017DB45Sub_Loop433
1018DB66Sub_OnNonzero84
1019DB6CSubCDB6C
1020DB70Sub_DB70
1021DB85Sub_Loop434
1022DB96Sub_Loop435
1023DB98Sub_OnNonnegative40
1024DBA6Sub_Loop436
1025DBABSub_OnNonnegative41
1026DBB9Sub_Loop437
1027DBBESub_OnNonnegative42
1028DBCCSub_Loop438
1029DBD1Sub_OnNonnegative43
1030DBDFSub_Loop439
1031DBE3Sub_DBE3
1032DBE9Sub_DBE9
1033DBEFSub_Loop440
1034DC1CSub_Loop441
1035DC2BSub_Loop442
1036DC32Sub_DC32
1037DC38Sub_Loop443
1038DC39Sub_Loop444
1039DC4FSub_Loop445
1040DC57Sub_OnNonnegative44
1041DC6DSub_Loop446
1042DC7FSub_Loop447
1043DCAASub_Loop448
1044DCC1Sub_Loop449
1045DCE5Sub_Loop450
1046DD02Sub_Loop451
1047DD0ESub_Loop452
1048DD22Sub_Loop453
1049DD36Sub_Loop454
1050DD42Sub_Loop455
1051DD4ESub_Loop456
1052# ---- derived internal branch-target names ----
10538000Reset
10548009Sub_OnNonnegative
1055800ESub_OnNegative
10568013Sub_OnNonnegative2
10578018Sub_OnNegative2
1058801DSub_OnNonnegative3
10598022Sub_OnNegative3
1060804EIrqHandler
1061804FSub_804F
1062807ESubC807E
1063808BSubC808B
10648093SubC8093
1065809BSubC809B
106680A7Sub_Loop
106780AFSubC80AF
106880B7SubC80B7
106980BFSubC80BF
107080C7SubC80C7
107180D8Sub_80D8
107280DDSub_80DD
107380E5Sub_Loop2
1074810FSubC810F
1075811ASubC811A
10768126Sub_Loop3
1077813ASubC813A
1078813DSubC813D
10798142SubC8142
10808151SubC8151
1081815CSubC815C
10828169SubC8169
10838171SubC8171
10848199Sub_Loop4
1085819DSub_819D
108681B2Sub_Loop5
108781B5Sub_Loop6
108881BESub_Loop7
108981C3Sub_Loop8
109081D6SubC81D6
109181EASub_Loop9
10928209Sub_Loop10
1093820CSub_820C
10948219Sub_Loop11
1095821CSub_821C
10968225Sub_8225
109782B9Sub_82B9
109882C5Sub_OnNonnegative4
109982D9Sub_82D9
110082FCSub_82FC
11018328Sub_8328
11028338Sub_8338
11038368Sub_8368
11048372Sub_OnNonzero
11058377Sub_OnNonzero2
11068393Sub_Loop12
11078394Sub_8394
1108839ESubC839E
110983A7SubC83A7
111083C1Sub_Loop13
111183C3Sub_83C3
111283C8Sub_83C8
111383ECSubC83EC
111483EFSub_83EF
111583FASub_OnNegative4
111683FBSubC83FB
1117840ESub_Loop14
11188415Sub_Loop15
11198421Sub_8421
1120842CSubC842C
1121843DSub_Loop16
11228444Sub_Loop17
1123844BSubC844B
1124846DSubC846D
11258474Sub_Loop18
11268475SubC8475
1127847BSub_Loop19
11288488Sub_Loop20
1129848ASub_848A
1130849BSubC849B
113184A0SubC84A0
113284A1SubC84A1
113384A6SubC84A6
113484B3Sub_Loop21
113584F7Sub_Loop22
1136850ASubC850A
1137854ESub_854E
11388562SubC8562
11398573Sub_8573
1140858FSubC858F
11418592SubC8592
114285A0SubC85A0
114385BCSub_85BC
114485CBSubC85CB
114585DBSubC85DB
114685DESub_Loop23
114785E3Sub_85E3
114885F0Sub_85F0
1149860CSubC860C
1150860FSubC860F
11518619SubC8619
11528623Sub_Loop24
1153862ESub_Loop25
11548633SubC8633
1155864DSubC864D
11568655SubC8655
11578658SubC8658
1158865BSubC865B
11598660SubC8660
1160869ASub_869A
116186ABSub_Loop26
116286C7SubC86C7
116386DFSub_86DF
116486FBSub_Loop27
11658702Sub_OnNonnegative5
1166871DSub_Loop28
11678723Sub_Loop29
1168872ASub_OnNonnegative6
11698745Sub_Loop30
11708746Sub_8746
1171874ESubC874E
11728761Sub_Loop31
1173876ASub_OnZero
1174877FSub_Loop32
117587A0Sub_Loop33
117687BESub_Loop34
117787D5Sub_Loop35
117887DBSub_87DB
117987DESub_Loop36
118087EBSub_87EB
118187F6Sub_87F6
11828808Sub_Loop37
11838811Sub_8811
11848812Sub_8812
1185882ESub_OnNonnegative7
11868838Sub_8838
1187883ASub_OnNonnegative8
1188888BSub_888B
1189889CSub_Loop38
1190889ESub_889E
119188A0Sub_88A0
119288C2Sub_Loop39
119388CASub_OnNonzero3
119488D5Sub_Loop40
119588D8Sub_Loop41
119688E6Sub_88E6
119788F0Sub_Loop42
119888FBSub_Loop43
1199890BSub_Loop44
1200891DSub_OnZero2
12018920Sub_Loop45
1202892ESub_Loop46
12038933Sub_8933
12048961Sub_Loop47
1205896CSub_Loop48
1206897FSub_Loop49
120789A0Sub_89A0
120889C3Sub_89C3
120989D3Sub_89D3
121089DCSubC89DC
121189DFSub_89DF
121289EDSub_Loop50
121389F9Sub_Loop51
121489FESub_89FE
12158A1ASub_Loop52
12168A25Sub_Loop53
12178A34Sub_OnNonzero4
12188A45Sub_Loop54
12198A4CSub_8A4C
12208A5ASub_8A5A
12218A71Sub_Loop55
12228A88Sub_Loop56
12238A98Sub_Loop57
12248AA0Sub_Loop58
12258AABSub_Loop59
12268AB8Sub_Loop60
12278AC0Sub_8AC0
12288AD8Sub_Loop61
12298ADBSub_8ADB
12308AE0Sub_OnNonzero5
12318AEASub_Loop62
12328B0ESub_Loop63
12338B13Sub_OnNonzero6
12348B20Sub_Loop64
12358B3ASub_Loop65
12368B45Sub_8B45
12378B51Sub_Loop66
12388B67Sub_8B67
12398B72Sub_Loop67
12408B87Sub_Loop68
12418B9CSub_8B9C
12428BD9Sub_8BD9
12438BE7Sub_OnNonzero7
12448BF7Sub_8BF7
12458C12Sub_Loop69
12468C16Sub_8C16
12478C2BSub_Loop70
12488C2DSub_Loop71
12498C48SubC8C48
12508C68Sub_Loop72
12518C8CSub_8C8C
12528CA2Sub_Loop73
12538CBASub_Loop74
12548CBDSub_8CBD
12558CC3Sub_Loop75
12568CD4Sub_Loop76
12578CDCSub_8CDC
12588CDFSub_8CDF
12598CECSub_Loop77
12608CEESub_Loop78
12618CEFSub_8CEF
12628CFESub_Loop79
12638D03Sub_8D03
12648D22Sub_OnNonnegative9
12658D26Sub_OnNonnegative10
12668D42Sub_Loop80
12678D4ASub_Loop81
12688D6BSub_Loop82
12698D71Sub_Loop83
12708D75Sub_8D75
12718D90Sub_Loop84
12728D98Sub_8D98
12738DA3Sub_8DA3
12748DBFSubC8DBF
12758DCFSub_Loop85
12768DD1Sub_8DD1
12778DD6Sub_8DD6
12788DDASub_OnCarrySet
12798DE3Sub_OnCarrySet2
12808DECSub_OnNonnegative11
12818DF3Sub_OnCarrySet3
12828E01Sub_8E01
12838E03Sub_OnNonnegative12
12848E0DSub_8E0D
12858E11Sub_OnNonnegative13
12868E15Sub_OnNonnegative14
12878E27Sub_8E27
12888E2CSubC8E2C
12898E2FSub_8E2F
12908E37Sub_8E37
12918E3FSub_8E3F
12928E57SubC8E57
12938E60SubC8E60
12948E61Sub_Loop86
12958E64SubC8E64
12968E6ESubC8E6E
12978E81Sub_Loop87
12988E8CSub_8E8C
12998E93Sub_8E93
13008E97Sub_8E97
13018EA4Sub_8EA4
13028EB2Sub_8EB2
13038EB7SubC8EB7
13048EB8Sub_Loop88
13058EBDSubC8EBD
13068EBESub_8EBE
13078EC8Sub_OnNonnegative15
13088ECESub_Loop89
13098ED4Sub_8ED4
13108EECSub_Loop90
13118EFFSub_8EFF
13128F13Sub_Loop91
13138F22Sub_8F22
13148F24Sub_8F24
13158F2ESub_Loop92
13168F2FSub_8F2F
13178F48Sub_Loop93
13188F4ASub_8F4A
13198F60Sub_Loop94
13208F65Sub_8F65
13218F75Sub_Loop95
13228F77Sub_8F77
13238F84Sub_8F84
13248F95Sub_8F95
13258F9BSub_8F9B
13268FAFSub_8FAF
13278FF1Sub_Loop96
13288FF7Sub_Loop97
13299002Sub_Loop98
13309013Sub_9013
1331901BSub_OnNonzero8
1332904ASub_904A
13339050Sub_9050
13349064Sub_9064
133590A6Sub_Loop99
133690B2Sub_Loop100
133790C3Sub_Loop101
133890C4Sub_90C4
133990CCSub_OnNonzero9
13409100Sub_Loop102
13419101Sub_9101
13429105Sub_OnNonnegative16
1343910CSub_910C
13449110Sub_OnNonnegative17
1345911FSub_911F
13469121Sub_OnNonnegative18
1347912BSub_912B
1348912DSub_OnNonnegative19
13499136Sub_9136
13509138Sub_OnNonnegative20
13519142Sub_9142
1352914ASub_Loop103
1353915BSub_Loop104
13549169Sub_OnNonnegative21
1355917DSub_OnNonnegative22
13569189Sub_Loop105
1357918BSub_OnNonnegative23
13589194Sub_9194
135991A0Sub_Loop106
136091A1Sub_91A1
136191B8Sub_OnCarryClear
136291C5Sub_Loop107
136391CESub_91CE
13649210Sub_9210
13659273Sub_Loop108
1366927CSub_927C
13679291Sub_Loop109
13689296Sub_Loop110
13699299Sub_Loop111
137092A0Sub_92A0
137192A9Sub_OnNonnegative24
137292B3Sub_Loop112
137392B5Sub_OnNonnegative25
13749337Sub_9337
1375934ASub_Loop113
13769353Sub_9353
13779359Sub_9359
13789369Sub_9369
137993A1Sub_Loop114
138093A6Sub_Loop115
138193F6Sub_Loop116
13829404Sub_9404
13839432Sub_OnZero3
13849479Sub_9479
13859486Sub_9486
1386948FSub_948F
13879497Sub_9497
138894A3Sub_Loop117
138994A6Sub_94A6
139094B2Sub_94B2
139194BFSubC94BF
139294C8Sub_94C8
139394D6Sub_94D6
139494E0Sub_94E0
139594EBSub_94EB
139694FDSub_94FD
13979511Sub_9511
13989519Sub_OnCarryClear2
1399952ASub_Loop118
14009535Sub_Loop119
14019562SubC9562
1402956BSub_Loop120
1403957BSub_Loop121
1404957FSub_Loop122
1405958ASub_Loop123
140695D7SubC95D7
140795DFSub_Loop124
140895F0Sub_OnCarrySet4
140995F1SubC95F1
14109602Sub_Loop125
1411960ASub_Loop126
14129617Sub_9617
14139621Sub_9621
14149626SubC9626
14159634Sub_Loop127
1416963ASub_963A
14179647SubC9647
1418964DSub_Loop128
14199656SubC9656
1420968ESub_968E
14219691Sub_9691
142296A7Sub_Loop129
142396B3Sub_Loop132
142496B9Sub_Loop134
142596BCSub_96BC
142696BDSub_Loop135
142796D3Sub_Loop136
142896E9Sub_96E9
142996EFSub_OnNonzero10
14309706Sub_OnNonzero11
1431971DSub_Loop137
14329724Sub_Loop138
1433972BSub_Loop139
14349743Sub_Loop140
14359746SubC9746
14369755Sub_9755
143797C4SubC97C4
143897CESub_OnNonnegative26
143997D2Sub_OnNonnegative27
144097E6Sub_Loop141
144197E8Sub_Loop142
144297F1Sub_97F1
144397F8Sub_97F8
144497FESub_97FE
14459811SubC9811
14469814Sub_Loop143
14479825SubC9825
1448982ASub_Loop144
14499836Sub_OnZero4
1450983ESub_OnNonzero12
14519843Sub_9843
14529844Sub_Loop145
14539852Sub_Loop146
1454985FSubC985F
14559862Sub_Loop147
1456988ASub_988A
1457989BSub_989B
145898A3Sub_98A3
145998AESub_Loop148
146098AFSub_Loop149
146198B2SubC98B2
146298B5Sub_98B5
146398CDSub_98CD
146498F1Sub_98F1
146598F9Sub_98F9
14669907Sub_9907
14679911SubC9911
14689919SubC9919
14699924SubC9924
14709935Sub_9935
1471997ESub_OnZero5
14729996SubC9996
147399ACSub_99AC
147499B9SubC99B9
147599DASub_99DA
147699DFSubC99DF
147799E0Sub_99E0
14789A00Sub_9A00
14799A35Sub_9A35
14809A3DSubC9A3D
14819A42Sub_OnNegative5
14829A43Sub_9A43
14839A50Sub_9A50
14849A8ESub_9A8E
14859A9FSub_9A9F
14869AAASub_9AAA
14879AAFSubC9AAF
14889BB0Sub_9BB0
14899BB8Sub_Loop151
14909BCFSub_OnNonzero13
14919BE6Sub_Loop152
14929BFDSub_OnNonzero14
14939C14Sub_Loop153
14949C15Sub_9C15
14959C1DSub_Loop154
14969C2ESub_OnNonzero15
14979C3CSub_9C3C
14989C44Sub_Loop155
14999C55Sub_OnNonzero16
15009C66Sub_9C66
15019C70Sub_OnCarryClear3
15029C8ESub_OnNonzero17
15039C8FSub_9C8F
15049C99Sub_OnCarryClear4
15059CB8Sub_9CB8
15069CC2Sub_OnCarryClear5
15079CE1Sub_9CE1
15089CEBSub_OnCarryClear6
15099D0ASub_9D0A
15109D15Sub_9D15
15119D2CSub_Loop156
15129D34Sub_Loop157
15139D3BSub_9D3B
15149D4BSub_Loop158
15159D4ESub_9D4E
15169D56Sub_9D56
15179D86Sub_Loop159
15189D8ESub_9D8E
15199DB6Sub_9DB6
15209DC1Sub_9DC1
15219DE8Sub_Loop160
15229E02Sub_Loop161
15239E05Sub_9E05
15249E0DSub_OnCarryClear7
15259E28Sub_Loop162
15269E2ASub_9E2A
15279E2FSub_Loop163
15289E47Sub_9E47
15299E72Sub_OnCarryClear8
15309E91Sub_Loop164
15319E93Sub_9E93
15329EA6Sub_Loop165
15339ED3Sub_OnCarryClear9
15349EF2Sub_Loop166
15359EF4Sub_9EF4
15369F07Sub_Loop167
15379F19Sub_9F19
15389F38Sub_OnZero6
15399F51Sub_Loop168
15409F5ASub_9F5A
15419F67Sub_Loop169
15429F69Sub_9F69
15439F77Sub_9F77
15449F86Sub_OnCarryClear10
15459FAESub_9FAE
15469FD0Sub_9FD0
15479FD9Sub_9FD9
1548A00ASub_A00A
1549A013Sub_A013
1550A03ASub_A03A
1551A040Sub_A040
1552A05CSub_Loop170
1553A05DSub_A05D
1554A0A7Sub_Loop171
1555A0AFSub_Loop172
1556A0B5Sub_A0B5
1557A0BASub_OnNonnegative28
1558A0C3Sub_A0C3
1559A0CDSub_OnNonzero18
1560A0D8Sub_A0D8
1561A0E4Sub_A0E4
1562A0EESub_A0EE
1563A0F8Sub_A0F8
1564A102Sub_A102
1565A10CSub_A10C
1566A118Sub_OnNonnegative29
1567A11CSub_OnNonnegative30
1568A136Sub_A136
1569A148Sub_OnNonnegative31
1570A14CSub_OnNonnegative32
1571A157Sub_Loop173
1572A15FSub_Loop174
1573A168Sub_A168
1574A170Sub_OnCarryClear11
1575A184Sub_A184
1576A19FSub_Loop175
1577A1AFSub_Loop176
1578A1BFSub_A1BF
1579A1D6Sub_A1D6
1580A1F3Sub_Loop177
1581A201Sub_Loop178
1582A212Sub_Loop179
1583A22ESub_Loop180
1584A234Sub_Loop181
1585A239Sub_A239
1586A25ASub_Loop182
1587A2A0Sub_OnNonzero19
1588A2ADSub_OnZero7
1589A2AESub_A2AE
1590A2C1Sub_Loop183
1591A2EESub_Loop184
1592A312Sub_Loop185
1593A315Sub_Loop186
1594A33CSub_Loop187
1595A34ASub_Loop188
1596A350Sub_Loop189
1597A353Sub_OnZero8
1598A354Sub_Loop190
1599A372Sub_Loop191
1600A375Sub_A375
1601A378Sub_A378
1602A37CSub_A37C
1603A38FSub_Loop192
1604A396Sub_A396
1605A3A4Sub_Loop193
1606A3A7Sub_A3A7
1607A3B7Sub_A3B7
1608A3B9Sub_A3B9
1609A3C4Sub_Loop194
1610A3CFSub_Loop195
1611A3F9Sub_A3F9
1612A40CSub_Loop196
1613A413Sub_A413
1614A423Sub_Loop197
1615A426Sub_A426
1616A430Sub_Loop198
1617A43BSub_Loop199
1618A446Sub_Loop200
1619A46CSub_OnNonnegative33
1620A474SubCA474
1621A47FSubCA47F
1622A484Sub_Loop201
1623A485SubCA485
1624A49FSub_Loop202
1625A4ADSubCA4AD
1626A4CCSub_Loop203
1627A4E9Sub_A4E9
1628A4F0Sub_A4F0
1629A4F7Sub_A4F7
1630A4FESub_A4FE
1631A505SubCA505
1632A517Sub_A517
1633A526Sub_A526
1634A54CSub_Loop204
1635A552Sub_Loop205
1636A553Sub_A553
1637A569Sub_OnOverflowSet
1638A56DSub_A56D
1639A56FSub_A56F
1640A57ASub_Loop206
1641A581Sub_Loop207
1642A582Sub_A582
1643A679SubCA679
1644A67DSub_OnCarryClear12
1645A68BSub_Loop208
1646A68DSub_A68D
1647A69ASub_Loop209
1648A69CSub_Loop210
1649A6AFSubCA6AF
1650A6B7Sub_OnCarryClear13
1651A6D1SubCA6D1
1652A6D3Sub_OnOverflowSet2
1653A6D5Sub_OnNonzero20
1654A6ECSub_A6EC
1655ABD0Sub_ABD0
1656ABE3Sub_ABE3
1657ABF5Sub_Loop211
1658AC03Sub_Loop212
1659AC0BSub_Loop213
1660AC10Sub_AC10
1661AC18Sub_AC18
1662AC20Sub_OnNonnegative34
1663AC2CSub_Loop214
1664AC2ESub_OnNonnegative35
1665AC37Sub_AC37
1666AC3FSub_Loop215
1667AC62SubCAC62
1668AC86Sub_OnZero9
1669AC98Sub_Loop216
1670AC9BSub_Loop217
1671AC9ESub_Loop218
1672ACA1Sub_Loop219
1673ACA4Sub_Loop220
1674ACB6Sub_Loop221
1675ACC8Sub_Loop222
1676ACCESub_Loop223
1677ACD1Sub_Loop224
1678ACECSub_Loop225
1679ACEFSub_Loop226
1680AD05Sub_Loop227
1681AD15Sub_AD15
1682AD1BSub_AD1B
1683AD21Sub_AD21
1684AD27Sub_AD27
1685AD35Sub_AD35
1686AD54Sub_AD54
1687AD60Sub_Loop228
1688AD63Sub_AD63
1689AD6CSubCAD6C
1690AD88Sub_Loop229
1691AD91Sub_Loop230
1692AD9ASub_Loop231
1693ADA3Sub_Loop232
1694ADB0Sub_Loop233
1695ADBDSubCADBD
1696ADDASub_Loop234
1697ADDBSub_Loop235
1698ADE4Sub_Loop236
1699ADEDSub_Loop237
1700ADF9SubCADF9
1701AE02SubCAE02
1702AE0BSub_Loop238
1703AE14Sub_Loop239
1704AE25Sub_Loop240
1705AE32SubCAE32
1706AE60Sub_Loop241
1707AE69Sub_Loop242
1708AE72Sub_Loop243
1709AE7BSub_Loop244
1710AE84Sub_Loop245
1711AE8DSub_Loop246
1712AE96Sub_Loop247
1713AE9FSub_AE9F
1714AEB9Sub_Loop248
1715AEBASub_AEBA
1716AECCSub_OnCarryClear14
1717AEE6Sub_Loop249
1718AEEBSub_Loop250
1719AEFASub_Loop251
1720AF98Sub_AF98
1721AFA6Sub_Loop252
1722AFAESub_OnNonzero21
1723AFB9Sub_OnNonzero22
1724AFC5Sub_OnZero10
1725AFDBSub_OnNonzero23
1726AFDCSub_Loop253
1727AFE4Sub_Loop254
1728AFEDSub_Loop255
1729AFF1Sub_Loop256
1730AFFCSub_Loop257
1731B003Sub_Loop258
1732B006Sub_OnNonzero24
1733B038Sub_OnNonzero25
1734B03ESub_OnNonzero26
1735B04DSub_Loop259
1736B061Sub_Loop260
1737B063Sub_OnNonzero27
1738B069Sub_OnNonzero28
1739B078Sub_Loop261
1740B08CSub_Loop262
1741B097Sub_Loop263
1742B099Sub_B099
1743B09ESub_Loop264
1744B0A5Sub_OnNonzero29
1745B0AESub_Loop265
1746B0B7Sub_OnZero11
1747B0CDSub_B0CD
1748B0D8Sub_OnNonzero30
1749B0E5Sub_OnNonzero31
1750B0F0Sub_OnZero12
1751B10ESub_OnZero13
1752B11ESub_Loop266
1753B128Sub_Loop267
1754B140Sub_Loop268
1755B142Sub_Loop269
1756B144Sub_Loop270
1757B14CSub_Loop271
1758B14DSub_B14D
1759B156Sub_OnNonzero32
1760B15FSub_OnNonzero33
1761B16ASub_OnZero14
1762B18CSub_Loop272
1763B18ESub_Loop273
1764B198Sub_OnNonzero34
1765B199Sub_Loop274
1766B1A1Sub_Loop275
1767B1AASub_Loop276
1768B1AESub_Loop277
1769B1AFSub_B1AF
1770B1B8Sub_OnNonzero35
1771B1C1Sub_OnNonzero36
1772B1CCSub_OnZero15
1773B1EESub_Loop278
1774B1F0Sub_Loop279
1775B1FASub_OnNonzero37
1776B1FBSub_Loop280
1777B203Sub_Loop281
1778B20CSub_Loop282
1779B210Sub_Loop283
1780B211Sub_B211
1781B21FSub_B21F
1782B222Sub_Loop284
1783B238Sub_OnNonzero38
1784B244Sub_OnZero16
1785B26ASub_OnNonzero39
1786B283Sub_Loop285
1787B28DSub_Loop286
1788B2B8Sub_Loop287
1789B2C7Sub_B2C7
1790B2E3Sub_OnNonzero40
1791B2EFSub_OnZero17
1792B315Sub_OnNonzero41
1793B32ESub_Loop288
1794B338Sub_Loop289
1795B34DSub_OnNonzero42
1796B350Sub_OnZero18
1797B35BSub_Loop290
1798B372Sub_Loop291
1799B37DSub_B37D
1800B37FSub_OnNonzero43
1801B3B5Sub_Loop292
1802B3C5Sub_Loop293
1803B3C8Sub_Loop294
1804B3CESub_Loop295
1805B3D3Sub_Loop296
1806B3D8Sub_B3D8
1807B3E5Sub_OnNonzero44
1808B3F2Sub_OnNonzero45
1809B3FDSub_OnNonzero46
1810B40FSub_OnNonzero47
1811B418Sub_OnNonzero48
1812B425Sub_OnNonzero49
1813B430Sub_OnNonzero50
1814B440Sub_Loop297
1815B443Sub_Loop298
1816B446Sub_Loop299
1817B449Sub_Loop300
1818B44CSub_Loop301
1819B452Sub_OnNonzero51
1820B467Sub_B467
1821B46FSub_OnNonzero52
1822B489Sub_B489
1823B48FSub_OnNonzero53
1824B4A4Sub_B4A4
1825B4ACSub_OnNonzero54
1826B4C6Sub_Loop302
1827B4C7Sub_Loop303
1828B4CASub_Loop304
1829B4CDSub_B4CD
1830B4CFSub_OnNonzero55
1831B4DCSub_Loop305
1832B4DESub_Loop306
1833B4E2Sub_B4E2
1834B4F0Sub_Loop307
1835B4FASub_Loop308
1836B4FDSub_Loop309
1837B500Sub_B500
1838B50ESub_B50E
1839B526Sub_Loop310
1840B53ASub_Loop311
1841B551Sub_Loop312
1842B566Sub_OnNonzero56
1843B569Sub_OnZero19
1844B574Sub_Loop313
1845B58BSub_Loop314
1846B596Sub_B596
1847B598Sub_OnNonzero57
1848B5D6Sub_Loop315
1849B5DASub_OnZero20
1850B5EASub_Loop316
1851B5EFSub_Loop317
1852B5F2Sub_Loop318
1853B5F4Sub_OnZero21
1854B604Sub_Loop319
1855B609Sub_Loop320
1856B60DSub_Loop321
1857B612Sub_Loop322
1858B617Sub_OnNonzero58
1859B61ASub_OnNonzero59
1860B625Sub_Loop323
1861B656Sub_Loop324
1862B664Sub_B664
1863B671Sub_Loop325
1864B67ESub_Loop326
1865B689Sub_Loop327
1866B693Sub_OnNonzero60
1867B6B4Sub_Loop328
1868B6C5Sub_B6C5
1869B6D2Sub_Loop329
1870B6DFSub_Loop330
1871B6EASub_Loop331
1872B6F4Sub_OnNonzero61
1873B701Sub_B701
1874B728Sub_Loop332
1875B733Sub_OnCarrySet5
1876B736Sub_OnCarrySet6
1877B750Sub_Loop333
1878B75BSub_OnCarrySet7
1879B76DSub_Loop334
1880B777Sub_Loop335
1881B77DSub_Loop336
1882B788Sub_Loop337
1883B7AASub_Loop338
1884B7ABSub_B7AB
1885B7D2Sub_Loop339
1886B7DDSub_OnCarrySet8
1887B7E0Sub_OnCarrySet9
1888B7FASub_Loop340
1889B805Sub_OnCarrySet10
1890B817Sub_Loop341
1891B821Sub_Loop342
1892B827Sub_Loop343
1893B832Sub_Loop344
1894B854Sub_Loop345
1895B855Sub_B855
1896B882Sub_Loop346
1897B88DSub_OnCarrySet11
1898B890Sub_OnCarrySet12
1899B8AASub_Loop347
1900B8B5Sub_OnCarrySet13
1901B8C7Sub_Loop348
1902B8D1Sub_Loop349
1903B8D7Sub_Loop350
1904B8E2Sub_Loop351
1905B904Sub_Loop352
1906B905Sub_B905
1907B932Sub_Loop353
1908B93DSub_OnCarrySet14
1909B940Sub_OnCarrySet15
1910B95ASub_Loop354
1911B96FSub_OnCarrySet16
1912B981Sub_Loop355
1913B98BSub_Loop356
1914B991Sub_Loop357
1915B9A1Sub_Loop358
1916B9CBSub_Loop359
1917B9CCSub_B9CC
1918B9F9Sub_Loop360
1919BA04Sub_OnCarrySet17
1920BA07Sub_OnCarrySet18
1921BA21Sub_Loop361
1922BA36Sub_OnCarrySet19
1923BA48Sub_Loop362
1924BA52Sub_Loop363
1925BA58Sub_Loop364
1926BA68Sub_Loop365
1927BA92Sub_Loop366
1928BA93Sub_BA93
1929BA9ESub_Loop367
1930BABASub_OnCarryClear15
1931BAC8Sub_Loop368
1932BAE1Sub_Loop369
1933BAFASub_Loop370
1934BB19Sub_OnCarrySet20
1935BB21Sub_Loop371
1936BB2CSub_Loop372
1937BB3BSub_Loop373
1938BB3CSub_BB3C
1939BB40Sub_OnNonzero62
1940BB47Sub_BB47
1941BB5FSub_Loop374
1942BB61Sub_OnNonzero63
1943BB6CSub_BB6C
1944BB7BSub_OnNonzero64
1945BB85Sub_Loop375
1946BB88Sub_OnNonzero65
1947BB90Sub_Loop376
1948BB98Sub_Loop377
1949BBA5Sub_Loop378
1950BBA8Sub_BBA8
1951BBB2Sub_OnNonzero66
1952BBC2Sub_Loop379
1953BBCASub_Loop380
1954BBD2Sub_Loop381
1955BBD9SubCBBD9
1956BBE1Sub_OnNonzero67
1957BBFASub_Loop382
1958BC03Sub_BC03
1959BC11Sub_OnNonzero68
1960BC20Sub_OnNonzero69
1961BC4BSub_BC4B
1962BC5ESub_Loop383
1963BC66Sub_Loop384
1964BC6ESub_Loop385
1965BC70Sub_Loop386
1966BC7DSub_Loop387
1967BC85Sub_Loop388
1968BCAESub_Loop389
1969BCB9Sub_OnNonzero70
1970BCBESub_BCBE
1971BCC6Sub_Loop390
1972BCCDSub_BCCD
1973D6A4Sub_D6A4
1974D6A8Sub_OnNonzero71
1975D6AESub_D6AE
1976D6B4NmiHandler
1977D6DCSub_Loop391
1978D6E2Sub_D6E2
1979D6EBSub_OnZero22
1980D6F1Sub_OnNonnegative36
1981D6FDSub_D6FD
1982D6FFSub_D6FF
1983D708Sub_D708
1984D70DSub_D70D
1985D736Sub_D736
1986D742Sub_Loop392
1987D74ASub_OnNonzero72
1988D763Sub_Loop393
1989D76BSub_Loop394
1990D770Sub_D770
1991D776Sub_D776
1992D77CSub_D77C
1993D780Sub_Loop395
1994D7A2Sub_Loop396
1995D7BASub_Loop397
1996D7CCSub_OnNonzero73
1997D7E9Sub_OnNonzero74
1998D7FASub_Loop398
1999D804Sub_Loop399
2000D80DSub_OnNonzero75
2001D81ESub_Loop400
2002D824Sub_D824
2003D82FSub_Loop401
2004D83BSub_Loop402
2005D843Sub_D843
2006D86ASub_OnNonzero76
2007D880Sub_Loop403
2008D88ASub_Loop404
2009D893Sub_OnNonzero77
2010D8A9Sub_Loop405
2011D8AFSub_D8AF
2012D8B5Sub_Loop406
2013D8C1Sub_Loop407
2014D8C9Sub_Loop408
2015D8D0SubCD8D0
2016D8D5Sub_D8D5
2017D8E4Sub_Loop409
2018D8F9Sub_D8F9
2019D905Sub_D905
2020D90ASub_D90A
2021D913Sub_OnNonzero78
2022D938Sub_Loop410
2023D93FSub_OnNonzero79
2024D95FSub_Loop411
2025D965Sub_Loop412
2026D966Sub_D966
2027D973Sub_D973
2028D975Sub_OnNonzero80
2029D993SubCD993
2030D9A2Sub_Loop413
2031D9AESub_OnCarrySet21
2032D9B2Sub_Loop414
2033D9B7SubCD9B7
2034D9CESub_Loop415
2035D9DASub_Loop416
2036D9DDSub_D9DD
2037D9EASub_D9EA
2038DA02Sub_Loop417
2039DA04Sub_Loop418
2040DA09Sub_DA09
2041DA18Sub_Loop419
2042DA1ASub_OnNonnegative37
2043DA27Sub_Loop420
2044DA2ASub_Loop421
2045DA36Sub_Loop422
2046DA38Sub_OnNonnegative38
2047DA45Sub_Loop423
2048DA48Sub_Loop424
2049DA61Sub_DA61
2050DA6DSub_Loop425
2051DA74SubCDA74
2052DA79Sub_DA79
2053DA89Sub_OnNonzero81
2054DA96Sub_Loop426
2055DAA3Sub_Loop427
2056DAADSub_Loop428
2057DABASub_Loop429
2058DABDSubCDABD
2059DAC1Sub_OnNonzero82
2060DAC8SubCDAC8
2061DACFSub_OnNonzero83
2062DAEESub_DAEE
2063DAF7Sub_Loop430
2064DAF8Sub_DAF8
2065DB04Sub_OnNonnegative39
2066DB0FSub_DB0F
2067DB1BSub_Loop431
2068DB27Sub_Loop432
2069DB45Sub_Loop433
2070DB66Sub_OnNonzero84
2071DB6CSubCDB6C
2072DB70Sub_DB70
2073DB85Sub_Loop434
2074DB96Sub_Loop435
2075DB98Sub_OnNonnegative40
2076DBA6Sub_Loop436
2077DBABSub_OnNonnegative41
2078DBB9Sub_Loop437
2079DBBESub_OnNonnegative42
2080DBCCSub_Loop438
2081DBD1Sub_OnNonnegative43
2082DBDFSub_Loop439
2083DBE3Sub_DBE3
2084DBE9Sub_DBE9
2085DBEFSub_Loop440
2086DC1CSub_Loop441
2087DC2BSub_Loop442
2088DC32Sub_DC32
2089DC38Sub_Loop443
2090DC39Sub_Loop444
2091DC4FSub_Loop445
2092DC57Sub_OnNonnegative44
2093DC6DSub_Loop446
2094DC7FSub_Loop447
2095DCAASub_Loop448
2096DCC1Sub_Loop449
2097DCE5Sub_Loop450
2098DD02Sub_Loop451
2099DD0ESub_Loop452
2100DD22Sub_Loop453
2101DD36Sub_Loop454
2102DD42Sub_Loop455
2103DD4ESub_Loop456