romdevtools 0.87.2 → 0.88.1

package/AGENTS.md

@@ -105,7 +105,9 @@ questions, and running both early is normal.** A good default:
    you may have just skipped a long memory hunt. If it returns nothing useful (no
    match, or no cheat for *your* target), that's fine — move on, no time lost.
 3. **Disassemble / trace** whenever the hack is about CODE or about data the
-   cheats don't cover: `disasm({target:'project'})` for a rebuildable project,
+   cheats don't cover: `disasm({target:'project'})` for a rebuildable project
+   (then edit a region `.asm` and `build({output:'reassemble', platform, path})` to
+   rebuild a byte-identical ROM in one call — the "cmp before commit" gate),
    `disasm({target:'references'})` for "what touches this address", `breakpoint({on:'write'})` for the exact
    instruction that wrote a byte, `watch({on:'mem'})`/`breakpoint({on:'write',precision:'sampled'})` to find an address
    empirically. For STRUCTURE — "what are the functions, how do they call each
@@ -347,10 +349,13 @@ Different platforms have different levels of MCP-exposed debugging — different
 > (VDP DMA) — elsewhere use `breakpoint({on:'write'})`/`watch({on:'range'})`. All other RE tools above
 > work on every platform that has the register-write/watch core hooks (the 15 classic platforms).
 > `disasm({target:'rom'})` + `disasm({target:'references'})` cover **all 18** (incl. the 3D consoles' MIPS/SH-4), and `disasm({target:'project'})` byte-exact reassembly the **15 classic platforms** (incl. GameTank) — every
-> CPU family disassembles through a native binutils `objdump` (WASM), and
-> `disasm({target:'project'})` reassembles byte-exact through the matching native
-> `as`/`ld`/`objcopy`. The per-platform notes below cover the platform-SPECIFIC
-> inspectors + chips (PC Engine + MSX: generic shapes only so far).
+> CPU family disassembles through a native binutils `objdump` (WASM). To REBUILD,
+> **`build({output:'reassemble', platform, path})` turns a `disasm({target:'project'})`
+> dir back into a byte-identical ROM in ONE call on all 15** — it assembles each
+> region `.asm` with the native assembler and splices the results into the original's
+> header/gaps/pad. (Edit a region first for an intentional change; a same-length edit
+> rebuilds a modified ROM, a length-changing edit is refused.) The per-platform notes
+> below cover the platform-SPECIFIC inspectors + chips (PC Engine + MSX: generic shapes only so far).
 
 The deep per-platform inspectors + the exact memory-region names, core quirks, and any platform-specific traps live in **each platform's `MENTAL_MODEL.md`** (read via `platform({op:'doc', platform, name:'mental_model'})`) — read it for the system you're on. Symptom → doc:
 - **NES** — blank/black screen, wrong sprites/colors, or need live PPU regs / CIRAM-attribute / MMC1-banked CHR state.
@@ -365,7 +370,7 @@ The deep per-platform inspectors + the exact memory-region names, core quirks, a
 - **Atari Lynx** — `sprites({op:'inspect'})` returns an SCB list head (no fixed OAM), or you need the Mikey palette/audio, 65C02 regs, or the `lynx_hw_regs` $FC00-$FDFF window.
 - **MSX** — VDP/PSG inspection or AY8910 `audioDebug`. (ColecoVision is bring-up-only: standard `system_ram`/`save_ram`/`video_ram`, no custom inspectors — extend by patching its core per the snes9x/gpgx pattern.)
 - **PC Engine** — generic shapes + the core's native regions only so far (no custom-inspector treatment yet).
-- **GameTank** — Clyde Shaffer's open-hardware W65C02S console (cc65 toolchain, ext `.gtr`). Full classic-style Tier-1: `cpu({op:'read'})` (65c02 regsnap), `audioDebug({op:'inspect', chip:'acp'})` (the ACP audio coprocessor), `breakpoint({on:'write'|'read'|'pc'})` + watchdog + coverage, `disasm` (`bytes`/`rom`/`references` + the 6502 Rizin/Ghidra cfg/xrefs/functions/decompile path), `cart({op:'extract'|'wrap'})`, and the 6502 re-inject path (`romPatch`) same as NES/C64/Lynx. **No `sprites({op:'inspect'})`/`background`** — it's a blitter framebuffer with no sprite OAM / no tilemap (like the Dreamcast). No genre example games yet (brand-new platform).
+- **GameTank** — Clyde Shaffer's open-hardware W65C02S console (cc65 toolchain, ext `.gtr`). Full classic-style Tier-1: `cpu({op:'read'})` (65c02 regsnap), `audioDebug({op:'inspect', chip:'acp'})` (the ACP audio coprocessor), `breakpoint({on:'write'|'read'|'pc'})` + watchdog + coverage, `disasm` (`bytes`/`rom`/`references`/`project` + the 6502 Rizin/Ghidra cfg/xrefs/functions/decompile path — a 32KB flat cart @ `$8000`, one region, rebuilt byte-identical via `build({output:'reassemble', platform:'gametank', path})`), `cart({op:'extract'|'wrap'})`, and the 6502 re-inject path (`romPatch`) same as NES/C64/Lynx. **No `sprites({op:'inspect'})`/`background`** — it's a blitter framebuffer with no sprite OAM / no tilemap (like the Dreamcast). No genre example games yet (brand-new platform).
 
 Starter snippets per platform live under `src/platforms/<platform>/lib/`. Discover via `examples({op:'snippets', platform})` (default `mode:'list'`), fetch one via `examples({op:'snippets', platform, mode:'get', snippetName})`. SNES + NES + Genesis + SMS + Game Boy + Atari 2600 + Atari 7800 have substantial snippet libraries; others are minimal.
 

package/CHANGELOG.md

@@ -4,6 +4,60 @@ All notable changes to `romdevtools`. Dates are release dates.
 (Published as `romdev-mcp` through 0.11.0; renamed to `romdevtools` in 0.13.0 —
 the `romdev-mcp` bin is kept as an alias.)
 
+## 0.88.0 — 2026-07-12
+
+- **`build({output:'reassemble'})` — the UNIFORM byte-exact ROUND-TRIP.** `disasm({target:'project'})`
+  splits a ROM into byte-exact region `.asm` files, but a one-call rebuild only existed for the
+  cc65-native subset (NES/C64/Atari7800/Lynx/PCE via `rebuild.json`). Every other platform documented
+  a "run these native tools yourself" recipe — so an agent (or one of Jay's disassemble/annotate
+  skills) following the "rebuild byte-identical + `cmp` before every commit" gate would stall on
+  SNES/Genesis/GB/etc. This adds a single rebuild call that works on **every** classic platform.
+  - `disasm({target:'project'})` now also writes `reassemble.json` (a `{platform, romTemplate,
+    romLength, regions:[{file, startAddress, fileOffset, byteLength}]}` manifest) + a verbatim
+    `original.rom` copy, for all platforms. `BUILD.md` leads with the one-call path.
+  - `build({output:'reassemble', platform, path})` reads the manifest, ASSEMBLES each (possibly
+    hand-edited) region `.asm` with the platform's native assembler — ca65 for 6502/65816, GNU-as for
+    m68k/arm/z80/sm83 — and SPLICES each result into a copy of `original.rom` at its file offset, so
+    the cartridge header, inter-region gaps, and trailing pad return byte-for-byte. Returns
+    `{ok, byteExact, outputPath, regions:[{file, byteExact, …}]}`.
+  - **The annotation gate is now real on every platform:** a same-length region edit rebuilds a
+    modified-but-valid ROM (`byteExact:false`, exactly the changed bytes differ); a length-changing
+    edit is REFUSED with a precise per-region error (splicing can't shift every later byte). Verified
+    byte-identical end-to-end on all six CPU families (6502, 65816, sm83, z80, m68k, arm).
+  - New `assembleRegionText()` in `toolchains/common/reassemble.js` (the assemble-only half — no
+    disassemble/heal). It also fixes a latent silent-truncation bug: a length-growing edit on the GNU
+    paths was truncated back to the region size by the objcopy slice; it now reports `producedLength`
+    so the caller catches it.
+- **GameTank joins the rebuildable-project platforms (14 → 15 classic).** `disasm({target:'project'})`
+  now handles GameTank's flat W65C02S EEPROM cart (32KB mapped at `$8000`, vectors at `$FFFA`; rides the
+  6502-family da65/ca65 path), so `build({output:'reassemble', platform:'gametank'})` rebuilds it
+  byte-identical like every other classic system. `.gtr` now sniffs to `gametank` (no explicit platform
+  needed) and has a `PLATFORM_VIRTUAL_EXT` entry. (The docs already claimed GameTank was covered — this
+  makes it true.)
+
+## 0.87.2 — 2026-07-12
+
+- Pin the reproducible `cc65` toolchain (`romdev-toolchain-cc65@0.1.3`) so cc65 builds are
+  deterministic across environments.
+- Fix the m68k (Genesis) byte-exact reassembly: the ELF `.text` word-aligned, so `objcopy -O binary`
+  emitted 2 leading pad bytes and the region shifted by 2. `SUBALIGN(1)` on the link script pins the
+  section at its origin.
+
+## 0.87.1 — 2026-07-08
+
+- **PICO-8: input fix + 5 finished genre example games.** The `_clearInputOnResume` patch delivers
+  the first button press after a cart load (without it no cart leaves its title screen). Ships five
+  complete example carts (shmup/platformer/puzzle/sports/racing) with original art + looping
+  public-domain music.
+
+## 0.87.0 — 2026-07-08
+
+- **PICO-8 platform via FAKE-08.** The MIT-licensed FAKE-08 player compiled to a WASM libretro core
+  (`romdev-core-fake08`, no BIOS). Full tool surface: `build({platform:'pico8'})` packages a `.p8`,
+  `disasm({target:'source'})` returns the cart's Lua, `memory({region:'system_ram'})` reads the flat
+  64KB PICO-8 map, and load/run/see/drive work. Capability tier `fantasy` (excluded from the
+  CPU-emulator RE contracts — it's a Lua VM, not machine code).
+
 ## 0.86.0 — 2026-07-01
 
 - **GameTank Game Genie — a brand-new cheat-code format.** Nobody had made GameTank cheat codes

package/README.md

@@ -10,7 +10,7 @@ npx romdevtools
 
 - **Build** — bundled per-platform toolchains (cc65, SDCC, RGBDS, asar, vasm, SGDK, PVSnesLib, libtonc, …) as WASM. Write source, compile, get a real ROM.
 - **Run + see + drive** — load the ROM into an emulated console (libretro cores as WASM), step frames, screenshot, script controller input. The 2D consoles render in software; the 3D consoles (N64 via glide64, PlayStation via Beetle PSX HW, Dreamcast via Flycast) render on the **real GPU** through [`native-gles`](https://github.com/monteslu/native-gles) — headless OpenGL/EGL, no browser. PlayStation ships [OpenBIOS](https://github.com/grumpycoders/pcsx-redux) (MIT) embedded, so there's no proprietary firmware to supply. **Dreamcast is EXPERIMENTAL** — it boots and renders, but the WASM build runs the SH-4 (+ AICA) as interpreters, so it's currently too slow to be playable; treat it as analysis/RE-only for now.
-- **Inspect + romhack** — read CPU/video/save RAM, watch memory, write-breakpoints, the Cheat-Engine value-search loop, a bundled cheat database, mapper-aware disassembly, and a byte-exact rebuildable-project disassembler.
+- **Inspect + romhack** — read CPU/video/save RAM, watch memory, write-breakpoints, the Cheat-Engine value-search loop, a bundled cheat database, mapper-aware disassembly, and a byte-exact rebuildable-project disassembler (`disasm({target:'project'})` splits a ROM into byte-exact region `.asm`; **`build({output:'reassemble'})` rebuilds it into a byte-identical ROM in one call on all 15 classic platforms** — edit a region and rebuild, the "cmp before commit" gate for any structural hack).
 - **Reverse-engineering analysis engine (all 18 platforms — incl. the 3D consoles' MIPS R3000/R4300 + SH-4)** — control-flow graphs, deep cross-references, auto-detected functions (ranked real-code-first), a one-shot structural map, and a Ghidra **decompiler** (C-like pseudocode, with hardware registers named and 6502 SLEIGH clutter folded to readable C): `disasm({target:'cfg'|'xrefs'|'functions'|'decompile'})` and `symbols({op:'analyze'})`. And the piece no static tool has: **live computed-jumptable recovery** — `breakpoint({on:'jumptable'})` runs the emulator to resolve the `JMP (table,X)` / RTS-trick dispatchers (state machines, script/battle VMs) that static analysis collapses to "could not recover." Understand *how* a routine works before you touch it — no $3,000 IDA license, no install.
 - **Convert assets** — PNG → platform tiles/tilemaps, quantize-to-palette, audio importers (BRR for SNES, XGM2 PCM for Genesis).
 - **Native game runtimes (beyond emulation)** — the same run/see/drive loop also hosts two *native* game formats: **wasmcart** (`.wasc` — WASM games from any language; 2026) and **jsgame** (`.jsgame` — JavaScript canvas/WebGL games; 2024). `loadMedia({platform:'wasmcart'|'jsgame'})` → `frame({op:'step'|'screenshot'})` → `input`, over the same tools — plus V8/WASM introspection (the cart's live WASM heap + exports; the JS game's globals) an emulator can't offer, and `pack({target:'wasc'|'jsgame'})` to zip a source dir into the distributable archive (the "build" step; romdev doesn't compile the WASM — bring your own). A capability descriptor marks the emulator-only tools (memory regions / cpuState / disasm) *not-applicable* for these kinds. Depends on the [`wasmcart`](https://www.npmjs.com/package/wasmcart) + [`rungame`](https://www.npmjs.com/package/rungame) packages (jsgame runs in a `vm` realm — the server self-re-execs with `--experimental-vm-modules`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "romdevtools",
-  "version": "0.87.2",
+  "version": "0.88.1",
   "description": "Tool server giving coding agents full control of homebrew ROM development AND reverse-engineering/romhacking across 17 retro platforms (NES, SNES, GB, Genesis, Atari, C64, PC Engine, MSX, PlayStation, N64, Dreamcast, ...) via WASM toolchains + emulator cores. Use over plain HTTP, as an Agent Skill, or as an MCP server.",
   "type": "module",
   "main": "src/mcp/server.js",
@@ -59,7 +59,7 @@
     "romdev-core-fceumm": "0.11.0",
     "romdev-core-flycast": "0.2.0",
     "romdev-core-gambatte": "0.10.0",
-    "romdev-core-gametank": "0.2.0",
+    "romdev-core-gametank": "0.3.0",
     "romdev-core-geargrafx": "0.8.0",
     "romdev-core-gpgx": "0.13.0",
     "romdev-core-handy": "0.8.0",

package/src/host/LibretroHost.js

@@ -212,6 +212,7 @@ export const PLATFORM_VIRTUAL_EXT = {
   atari7800:  ".a78",
   pce:        ".pce",
   msx:        ".rom",
+  gametank:   ".gtr",
   pico8:      ".p8",
 };
 import { RETRO_DEVICE_JOYPAD, ROMDEV_PIXEL_FORMAT_RGBA8888 } from "./retroConstants.js";

package/src/host/WasmcartHost.js

@@ -25,7 +25,7 @@ const WASMCART_FB_FORMAT = RETRO_PIXEL_FORMAT_XRGB8888;
 // setInput speaks the libretro button vocabulary (b,y,select,start,up,down,left,
 // right,a,x,l,r,…); wasmcart pads carry the same conceptual buttons. We translate
 // the input bitmask/object into the pad object shape CartHost._writePads expects.
-const JOYPAD = {
+const _JOYPAD = {
   b: 0, y: 1, select: 2, start: 3, up: 4, down: 5, left: 6, right: 7,
   a: 8, x: 9, l: 10, r: 11, l2: 12, r2: 13, l3: 14, r3: 15,
 };

package/src/mcp/tools/disasm.js

@@ -1043,7 +1043,7 @@ async function disassembleRomCore(args) {
       return jsonContent({ ...baseResult, ok: true, asm });
 }
 
-async function disassembleProjectCore({ path: romPath, outputDir, platform }) {
+export async function disassembleProjectCore({ path: romPath, outputDir, platform }) {
       const { reassembleForPlatform, CPU_FAMILY } = await import("../../toolchains/common/reassemble.js");
       const data = new Uint8Array(await readFile(romPath));
       const resolved = platform ?? sniffPlatformFromPath(romPath);
@@ -1098,11 +1098,35 @@ async function disassembleProjectCore({ path: romPath, outputDir, platform }) {
         );
       }
       const buildMd = renderBuildMd({
-        platform: resolved, romPath, regions: out, blobs: writtenBlobs,
+        platform: resolved, romPath, outputDir, regions: out, blobs: writtenBlobs,
         build: absBuild, verifiable: plan.verifiable, notes: plan.notes, allOk,
       });
       await writeFile(nodePath.join(outputDir, "BUILD.md"), buildMd);
 
+      // reassemble.json — the UNIFORM byte-exact rebuild manifest, written for
+      // EVERY platform (unlike rebuild.json's one-call subset). It lets
+      // build({output:'reassemble', path}) rebuild the ROM in one call on any
+      // platform: assemble each region .asm and splice it into a copy of the
+      // ORIGINAL rom (kept as original.rom) at its file offset, so the header,
+      // inter-region gaps, and trailing pad come back verbatim. See toolchain.js.
+      await writeFile(nodePath.join(outputDir, "original.rom"), data);
+      const reassembleManifest = {
+        platform: resolved,
+        romTemplate: "original.rom",  // relative to the project dir
+        romLength: data.length,
+        regions: regions.map((reg) => ({
+          file: reg.file,
+          startAddress: reg.startAddress,
+          fileOffset: reg.fileOffset,
+          byteLength: reg.bytes.length,
+          ...(reg.kind === "data" ? { kind: "data" } : {}),
+        })),
+      };
+      await writeFile(
+        nodePath.join(outputDir, "reassemble.json"),
+        JSON.stringify(reassembleManifest, null, 2) + "\n"
+      );
+
       return jsonContent({
         ok: allOk,
         path: romPath,
@@ -1116,14 +1140,17 @@ async function disassembleProjectCore({ path: romPath, outputDir, platform }) {
           verifiable: plan.verifiable, // true = expected byte-identical via that call
           buildDoc: "BUILD.md",
           notes: plan.notes,
+          // The UNIFORM one-call rebuild, available on EVERY platform (splices
+          // the reassembled regions into a copy of the original for the gaps).
+          reassemble: { output: "reassemble", platform: resolved, path: outputDir },
         },
         note: allOk
           ? `All ${out.length} region(s) round-trip BYTE-EXACT (avg ${avgReadable}% disassembled as instructions, the rest as .byte data). ` +
+            `Rebuild byte-identical in ONE call: build({output:'reassemble', platform:'${resolved}', path:'${outputDir}'}).` +
             (absBuild
-              ? `Rebuild it with the build() call in rebuild.json / BUILD.md` +
-                (plan.verifiable ? " — expected byte-identical." : " (see notes — may need linker tweaks).")
-              : `See BUILD.md for how to rebuild.`)
-          : `Some regions did NOT round-trip byte-exact — see regions[].note.`,
+              ? ` (build() one-call rebuild also available via rebuild.json.)`
+              : ``)
+          : `Some regions did NOT round-trip byte-exact — see regions[].note. build({output:'reassemble', platform:'${resolved}', path:'${outputDir}'}) still rebuilds the original bytes (edited regions must reassemble to their length).`,
       });
 }
 
@@ -1142,7 +1169,7 @@ function absolutizeBuild(build, outputDir) {
 }
 
 /** Human + agent readable rebuild instructions for a disassembled project. */
-function renderBuildMd({ platform, romPath, regions, blobs, build, verifiable, notes, allOk }) {
+function renderBuildMd({ platform, romPath, outputDir, regions, blobs, build, verifiable, notes, allOk }) {
   const lines = [];
   lines.push(`# Rebuilding this ${platform} project`, "");
   lines.push(`Disassembled from \`${nodePath.basename(romPath)}\` by \`disasm({target:'project'})\`.`, "");
@@ -1151,21 +1178,35 @@ function renderBuildMd({ platform, romPath, regions, blobs, build, verifiable, n
     lines.push(`- \`${r.file}\` — ${r.region}${r.kind === "data" ? " (data)" : ""}, byte-exact${r.roundTripOk === false ? " ⚠ round-trip FAILED" : ""}.`);
   }
   for (const b of blobs) lines.push(`- \`${b.file}\` — ${b.bytes} bytes of binary data (extracted from the ROM; do not hand-edit).`);
-  lines.push("- `rebuild.json` — the exact `build()` args below, with absolute paths.", "");
+  lines.push("- `original.rom` — a verbatim copy of the source ROM (the rebuild template; do not edit).");
+  lines.push("- `reassemble.json` — the region→offset manifest the one-call rebuild reads.");
+  if (build) lines.push("- `rebuild.json` — the alternate cc65-native `build()` args below.");
+  lines.push("");
+
+  // The UNIFORM one-call rebuild — available on EVERY platform.
+  lines.push("## Rebuild (recommended — one call, all platforms)", "");
+  lines.push("Rebuild this project into a **byte-identical** ROM in one call:", "");
+  lines.push("```json", JSON.stringify({ output: "reassemble", platform, path: outputDir }, null, 2), "```", "");
+  lines.push(
+    "Pass these as the arguments to the `build` tool. It assembles each region `.asm` " +
+    "and splices the result into a copy of `original.rom`, so the header, gaps, and pad " +
+    "return verbatim. `byteExact:true` = the rebuild equals the original exactly. Edit a " +
+    "region `.asm` first to make a change — a same-length edit rebuilds a modified ROM; a " +
+    "length-changing edit is reported (splicing would shift every later byte).", "",
+  );
+
   if (build) {
-    lines.push("## Rebuild", "");
+    lines.push("## Rebuild (alternate — cc65-native `build()`)", "");
     if (verifiable) {
-      lines.push("This rebuilds **byte-identical** to the source ROM. Call:", "");
+      lines.push("This platform also has a native `build()` recipe that rebuilds byte-identical:", "");
     } else {
-      lines.push("Rebuild call (see Notes — may need linker adjustments for an exact match):", "");
+      lines.push("Alternate native `build()` recipe (see Notes — may need linker adjustments):", "");
     }
     lines.push("```json", JSON.stringify(build, null, 2), "```", "");
-    lines.push("Pass these as the arguments to the `build` tool. The same JSON is in `rebuild.json`.", "");
-  } else {
-    lines.push("## Rebuild", "", "No automatic rebuild recipe for this platform yet. " + notes, "");
+    lines.push("The same JSON is in `rebuild.json`.", "");
   }
   if (notes) lines.push("## Notes", "", notes, "");
-  if (!allOk) lines.push("> ⚠ Some regions did not round-trip byte-exact — edit those `.asm` files before rebuilding.", "");
+  if (!allOk) lines.push("> ⚠ Some regions did not round-trip byte-exact as INSTRUCTIONS (they floored to `.byte` data, which is still byte-exact). The one-call rebuild above is unaffected.", "");
   return lines.join("\n") + "\n";
 }
 
@@ -1507,9 +1548,13 @@ export function registerDisasmTools(server, z) {
     "regions (PER-BANK on every banked format: NES mappers, SNES LoROM, GB MBC, Sega-mapper SMS/GG, MSX megaROM, " +
     "2600 F8/F6/F4, 7800 SuperGame, >32KB HuCards), REASSEMBLES each and verifies BYTE-EXACT (`roundTripOk`); " +
     "non-faithful lines fall back to `.byte` so it ALWAYS rebuilds; `readablePercent` reports instruction-vs-data. " +
-    "NES/C64/7800/Lynx/PCE ship a one-call `build()` rebuild in rebuild.json (flat AND banked); the rest ship a " +
-    "proven native recipe in BUILD.md. (SNES 65816 usually lands at the byte-exact " +
-    "data-only floor — its `.a8/.i8` width state desyncs when instructions and pinned `.byte` mix.)\n" +
+    "REBUILD (one call, ALL 15 classic platforms): `build({output:'reassemble', platform, path})` turns the project " +
+    "dir back into a BYTE-IDENTICAL ROM — it assembles each region + splices them into the kept `original.rom` " +
+    "(header/gaps/pad verbatim). Edit a region `.asm` first for a change: a same-length edit rebuilds a modified " +
+    "ROM (`byteExact:false`), a length-changing edit is refused. NES/C64/7800/Lynx/PCE ALSO ship a cc65-native " +
+    "one-call `build({output:'rom'})` recipe in rebuild.json (flat AND banked). (SNES 65816 usually lands at the " +
+    "byte-exact data-only floor — its `.a8/.i8` width state desyncs when instructions and pinned `.byte` mix; the " +
+    "reassemble rebuild is byte-identical regardless of readability.)\n" +
     "'references' = scan a ROM's code for operands matching a CPU `address` and classify each (call/jump/branch/" +
     "read/write); also walks the vector table. Banked carts are scanned PER BANK (all of the formats above) — " +
     "refs carry `prgBank` (NES) / `romBank` (everything else). LIMITATION: direct addressing only " +
@@ -1663,6 +1708,7 @@ function sniffPlatformFromPath(p) {
   if (/\.prg$/i.test(p)) return "c64";
   if (/\.(lnx|lyx)$/i.test(p)) return "lynx";
   if (/\.gba$/i.test(p)) return "gba";
+  if (/\.gtr$/i.test(p)) return "gametank";
   if (/\.(z64|n64|v64)$/i.test(p)) return "n64";
   if (/\.(psexe|psx)$/i.test(p)) return "ps1"; // .exe/.bin are ambiguous — pass platform explicitly
   if (/\.(gen|md|bin)$/i.test(p)) return "genesis";
@@ -1883,6 +1929,21 @@ function planRegions(platform, data) {
     }
     return regions;
   }
+  if (platform === "gametank") {
+    // GameTank (Clyde Shaffer's open W65C02S console): a flat, size-keyed EEPROM
+    // cart (default 32KB = EEPROM32K) mapped so the image ends at $FFFF — a 32KB
+    // ROM spans $8000-$FFFF, with the 6-byte NMI/RESET/IRQ vector table at $FFFA.
+    // One flat region at the top of the address space; the 65C02 rides the same
+    // da65/ca65 6502-family path (--cpu 65c02). No trailing-pad trim: the cart is
+    // exactly `size` bytes and the vectors + any pad are REAL bytes.
+    const org = (0x10000 - data.length) & 0xffff;
+    regions.push({
+      name: "rom", file: "rom.asm", bytes: data.slice(0),
+      startAddress: org, fileOffset: 0,
+      label: `flat cart @ $${org.toString(16).toUpperCase()} (W65C02, vectors at $FFFA)`,
+    });
+    return regions;
+  }
   if (platform === "msx") {
     // MSX cartridge maps at $4000-$BFFF; the 16-byte "AB" header at $4000 is
     // data (magic + INIT/STATEMENT/DEVICE/TEXT pointers), code follows.

package/src/mcp/tools/toolchain.js

@@ -712,10 +712,11 @@ export function registerToolchainTools(server, z, sessionKey) {
     "• output:'rom' (default) — assemble or compile `source` (single) / `sources` ({name:contents}) / `sourcePath` / `sourcesPaths`. Returns the ROM (path by default; `inline:true` for binaryBase64) + build log. **`binaryIncludes`/`binaryIncludePaths` (base64/path CHR-ROM, music blobs for `.incbin`) — WITHOUT them no game with external assets builds.** `includes`/`includePaths` for `.include`d text. `linkerConfig` (cc65; NES preset 'chr-ram-runtime' RECOMMENDED). `crt0`/`crt0Path`/`codeLoc`/`dataLoc` (SDCC). `runtime`/`maxmod`/`rebuildSdk` (GBA/Genesis SDK). **`lint:'strict'` fails the build (stage:'lint', no binary) if the pre-flight SDCC crash-pattern scan flags anything (e.g. the uint8 loop-bound trap); 'advisory' (default) just lists hits in issues[].** **`includeSymbols:true` returns the .map text inline on a PLAIN rom build — distinct from output:'romWithDebug' which writes .dbg/.map FILES.** Language is inferred from extension/content — usually OMIT `language`.\n" +
     "• output:'romWithDebug' — like 'rom' but also emits linker debug info for the `symbols` tool: cc65 → `.dbg`, SDCC → sdld `.map`, Genesis m68k → GNU ld map (find where a RAM var landed). DEFAULT writes ROM + debug file + log to disk (`outputPath` required unless `inline:true`). **`resolveSymbols:['grid','score']` folds those names' addresses ({resolvedSymbols:{grid:{address,hex,region?,ramOffset?}}}) straight into the result — the cheap way to a WRAM variable's address without loading the whole map (or round-tripping it through `symbols`).**\n" +
     "• output:'run' — BUILD + LOAD + RUN + SCREENSHOT in one round trip — the fastest iteration loop. Same build args; runs `frames` frames and returns the screenshot INLINE. `holdInputs` holds controller state; `screenshotPath` writes the PNG to disk instead; `projectName` titles the playtest window.\n" +
-    "• output:'project' — build a project DIRECTORY (`path`) without re-passing the file manifest each call. Entry point auto-detects `main.c` (C/SGDK Genesis, GBA, cc65/SDCC C) OR `main.s`/`main.asm` (asm); pass `entry:'smw.asm'` to point at a differently-named top-level file (e.g. an existing disassembly). Every `.c`/`.s`/`.asm` in the dir is a translation unit (linked together), every `.h`/`.inc` an include, and `.bin/.chr/.pcm/.brr/.vgm/...` (recursively, including subdirectories) become binaryIncludes (for `.incbin`). `options` (e.g. asar `--define _VER=1`) and `defines` are honored here too. Iterate an on-disk project by re-calling with just `{path, platform}`. **This is the no-boilerplate path for an examples({op:'fork'}) dir: the per-platform recipe auto-supplies the crt0 + load address — GB/GBC default `gb_crt0.s` + `codeLoc:0x150` (don't hand-pass them!), MSX routes `msx_crt0.s` + `codeLoc:0x4010`, SMS/GG auto-inject their bundled crt0, NES applies the chr-ram-runtime preset. PREFER this over re-passing `crt0Path`/`codeLoc` to output:'rom' for a forked project.**",
+    "• output:'project' — build a project DIRECTORY (`path`) without re-passing the file manifest each call. Entry point auto-detects `main.c` (C/SGDK Genesis, GBA, cc65/SDCC C) OR `main.s`/`main.asm` (asm); pass `entry:'smw.asm'` to point at a differently-named top-level file (e.g. an existing disassembly). Every `.c`/`.s`/`.asm` in the dir is a translation unit (linked together), every `.h`/`.inc` an include, and `.bin/.chr/.pcm/.brr/.vgm/...` (recursively, including subdirectories) become binaryIncludes (for `.incbin`). `options` (e.g. asar `--define _VER=1`) and `defines` are honored here too. Iterate an on-disk project by re-calling with just `{path, platform}`. **This is the no-boilerplate path for an examples({op:'fork'}) dir: the per-platform recipe auto-supplies the crt0 + load address — GB/GBC default `gb_crt0.s` + `codeLoc:0x150` (don't hand-pass them!), MSX routes `msx_crt0.s` + `codeLoc:0x4010`, SMS/GG auto-inject their bundled crt0, NES applies the chr-ram-runtime preset. PREFER this over re-passing `crt0Path`/`codeLoc` to output:'rom' for a forked project.**\n" +
+    "• output:'reassemble' — **the UNIFORM byte-exact ROUND-TRIP**: rebuild a `disasm({target:'project'})` output dir (`path`) into a byte-identical ROM in ONE call, on EVERY classic platform (NES/SNES/Genesis/GB/GBC/SMS/GG/MSX/GBA/C64/Atari/PCE/Lynx) — not just the cc65-native subset that `rebuild.json` covers. It reads the `reassemble.json` manifest disasm wrote, ASSEMBLES each region `.asm` with the platform's native assembler (ca65 for 6502/65816, GNU-as for m68k/arm/z80/sm83), and SPLICES each result into a copy of the original ROM (`original.rom`, kept in the dir) at its file offset — so the cartridge header, inter-region gaps, and trailing pad return verbatim. Returns `{ok, byteExact, outputPath, regions:[{file,byteExact,...}]}`; writes the ROM to `outputPath` (or `<dir>/rebuilt.<ext>` by default). **This is the 'cmp before commit' gate for a ROM-hacking / annotation workflow: edit a region `.asm`, call this, get a byte-identical ROM back (or a precise per-region mismatch if your edit changed a region's length).** `byteExact:true` = the rebuild equals `original.rom` exactly.",
     {
-      output: z.enum(["rom", "romWithDebug", "run", "project"])
-        .describe("rom=produce a ROM (default); romWithDebug=ROM + .dbg/.map debug files; run=build+load+run+screenshot; project=build a project directory."),
+      output: z.enum(["rom", "romWithDebug", "run", "project", "reassemble"])
+        .describe("rom=produce a ROM (default); romWithDebug=ROM + .dbg/.map debug files; run=build+load+run+screenshot; project=build a project directory; reassemble=rebuild a disasm({target:'project'}) dir into a byte-identical ROM (uniform across ALL platforms)."),
       platform: z.string().describe("Target platform id (e.g. 'nes', 'genesis')."),
       language: z.string().optional().describe("Language override ('c'/'asm'/'basic'). USUALLY OMIT — inferred from source extension/content; only the ambiguous case falls to the platform default. Ignored by output:'romWithDebug' (C only)."),
       // source inputs (rom/romWithDebug/run)
@@ -780,6 +781,10 @@ export function registerToolchainTools(server, z, sessionKey) {
           if (!args.path) throw new Error("build({output:'project'}): `path` (the project directory) is required.");
           return await buildProjectImpl(args);
         }
+        case "reassemble": {
+          if (!args.path) throw new Error("build({output:'reassemble'}): `path` (the disasm project directory) is required.");
+          return await reassembleProjectCore(args);
+        }
         case "romWithDebug": return await buildSourceWithDebugCore(args);
         default: throw new Error(`build: unknown output '${args.output}'`);
       }
@@ -1162,3 +1167,133 @@ export async function buildProjectCore({ path: projPath, platform, outputPath, o
     issues: rankIssues(result.issues ?? []),
   });
 }
+
+/**
+ * build({output:'reassemble'}) — the UNIFORM byte-exact round-trip.
+ *
+ * Rebuild a `disasm({target:'project'})` output dir into a byte-identical ROM,
+ * on EVERY platform. Reads the `reassemble.json` manifest disasm wrote, then for
+ * each region assembles its (possibly hand-edited) `.asm` with the platform's
+ * native assembler and SPLICES the result into a copy of the original ROM
+ * (`original.rom`, kept in the dir) at the region's file offset — so the header,
+ * inter-region gaps, and trailing pad come back verbatim. The result equals the
+ * original exactly when no region was edited; an edit that keeps a region's
+ * length rebuilds a modified-but-valid ROM; an edit that CHANGES a region's
+ * length is reported as a per-region mismatch (splicing would corrupt offsets).
+ *
+ * This is the "cmp before commit" gate a ROM-hacking / annotation workflow needs,
+ * and unlike rebuild.json it exists for ALL classic platforms, not just the
+ * cc65-native subset.
+ */
+export async function reassembleProjectCore({ path: projPath, platform, outputPath }) {
+  const { assembleRegionText } = await import("../../toolchains/common/reassemble.js");
+  const manifestPath = path.join(projPath, "reassemble.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } catch {
+    throw new Error(
+      `build({output:'reassemble'}): no reassemble.json in '${projPath}'. This op rebuilds a ` +
+      `disasm({target:'project'}) directory — run that first (it writes reassemble.json + original.rom).`,
+    );
+  }
+  const plat = platform ?? manifest.platform;
+  if (platform && manifest.platform && platform !== manifest.platform) {
+    throw new Error(`build({output:'reassemble'}): platform '${platform}' ≠ manifest platform '${manifest.platform}'.`);
+  }
+
+  // The gap template: a copy of the original ROM. Reassembled regions overwrite
+  // their ranges; everything else (header, vectors, inter-region gaps, pad) is
+  // preserved byte-for-byte from here.
+  const templatePath = path.isAbsolute(manifest.romTemplate)
+    ? manifest.romTemplate
+    : path.join(projPath, manifest.romTemplate);
+  let template;
+  try {
+    template = new Uint8Array(await readFile(templatePath));
+  } catch {
+    throw new Error(`build({output:'reassemble'}): missing ROM template '${templatePath}' (the original.rom disasm kept). Re-run disasm({target:'project'}).`);
+  }
+  if (manifest.romLength != null && template.length !== manifest.romLength) {
+    throw new Error(`build({output:'reassemble'}): original.rom is ${template.length} bytes but manifest says ${manifest.romLength} — stale project.`);
+  }
+
+  const rom = template.slice(); // mutable copy — splice regions into it
+  const regionResults = [];
+  let anyEditKeptExact = false;
+
+  for (const reg of manifest.regions) {
+    const asmText = await readFile(path.join(projPath, reg.file), "utf8");
+    const r = await assembleRegionText({
+      platform: plat,
+      asmText,
+      startAddress: reg.startAddress,
+      byteLength: reg.byteLength,
+    });
+    if (!r.ok || !r.bytes) {
+      regionResults.push({ file: reg.file, ok: false, byteExact: false, error: (r.log || "assemble failed").split("\n").slice(-3).join(" | ").slice(0, 400) });
+      continue;
+    }
+    // A length-changing edit can't be spliced without shifting every later byte —
+    // refuse rather than silently corrupt the ROM. `producedLength` (GNU path) is
+    // the true assembled size BEFORE the byteLength slice; without it fall back to
+    // the sliced length (the cc65 path errors at ld65 on overflow, so it's safe).
+    const producedLen = r.producedLength ?? r.bytes.length;
+    if (producedLen !== reg.byteLength) {
+      regionResults.push({
+        file: reg.file, ok: false, byteExact: false,
+        error: `region reassembled to ${producedLen} bytes but must be ${reg.byteLength} (a length-changing edit can't be spliced back — keep the region's byte count, or use build({output:'rom'}) with a full linker recipe).`,
+      });
+      continue;
+    }
+    // Compare against the original bytes at this offset to report whether THIS
+    // region matches the source ROM (edited-but-valid regions differ, that's ok).
+    const orig = template.slice(reg.fileOffset, reg.fileOffset + reg.byteLength);
+    let regionExact = true;
+    for (let i = 0; i < reg.byteLength; i++) {
+      rom[reg.fileOffset + i] = r.bytes[i];
+      if (r.bytes[i] !== orig[i]) regionExact = false;
+    }
+    if (!regionExact) anyEditKeptExact = true;
+    regionResults.push({
+      file: reg.file, ok: true, byteExact: regionExact,
+      startAddress: "$" + reg.startAddress.toString(16).toUpperCase(),
+      fileOffset: "0x" + reg.fileOffset.toString(16).toUpperCase(),
+      bytes: reg.byteLength,
+    });
+  }
+
+  // Whole-ROM byte-exact vs the original template.
+  let romExact = rom.length === template.length;
+  if (romExact) for (let i = 0; i < rom.length; i++) if (rom[i] !== template[i]) { romExact = false; break; }
+
+  const anyRegionFailed = regionResults.some((r) => !r.ok);
+  const ext = PLATFORM_VIRTUAL_EXT[plat] ?? ".bin";
+  const outPath = outputPath ?? path.join(projPath, "rebuilt" + ext);
+  // Only write when every region assembled (a failed region means the ROM is
+  // incomplete/garbage — don't hand back a broken image).
+  let wrote = null;
+  if (!anyRegionFailed) {
+    await writeFile(outPath, rom);
+    wrote = outPath;
+  }
+
+  const note = anyRegionFailed
+    ? `Reassembly INCOMPLETE — ${regionResults.filter((r) => !r.ok).length} region(s) failed (see regions[].error). No ROM written.`
+    : romExact
+      ? `Byte-IDENTICAL to the original ROM (${rom.length} bytes). Round-trip verified — safe to commit.`
+      : anyEditKeptExact
+        ? `Rebuilt ${rom.length} bytes with edited region(s) (regions[].byteExact=false = your changes). Not identical to the original — that's expected for an intentional edit.`
+        : `Rebuilt ${rom.length} bytes but NOT byte-identical to the original despite no reported region edits — investigate regions[] before trusting this.`;
+
+  return jsonContent({
+    ok: !anyRegionFailed,
+    output: "reassemble",
+    platform: plat,
+    byteExact: !anyRegionFailed && romExact,
+    outputPath: wrote,
+    romLength: rom.length,
+    regions: regionResults,
+    note,
+  });
+}

package/src/platforms/_guides/ROMHACKING_PLAYBOOK.md

@@ -462,24 +462,31 @@ that won't reproduce faithfully heals to a `.byte`/`db` of its real bytes, so th
 `.asm` ALWAYS rebuilds (`roundTrip.allByteExact`). `readablePercent` per region tells you
 how much came back as real instructions vs. data. Alongside the `.asm` it writes the
 turnkey **rebuild glue**: data blobs (NES CHR-ROM → `chr.bin`; stripped Genesis/GBA/Lynx/MSX
-cartridge header → `*.bin`), a `BUILD.md` with the exact steps, and — where a one-call
-rebuild exists — a `rebuild.json` of the precise `build({...})` args. So the loop is
-`disasm({target:'project'})` → edit a `.asm` → rebuild → `romPatch({op:'diff'})` to confirm.
-
-**Two rebuild tiers** (the disasm emits each CPU's native-reassembler syntax — ca65 for
-6502/65816, GNU `as` for m68k/arm/z80/gbz80 — which only some `build()` toolchains consume):
-- **One-call `build()` rebuild, byte-identical** — **NES (NROM *and* banked mappers), C64,
-  Atari 7800 (flat *and* SuperGame banked), Lynx, PC Engine (flat *and* banked HuCards)**.
-  Feed `rebuild.json` straight to `build`. Banked projects ship a HEADER segment with the
-  original header bytes (16 iNES / 128 .a78 / 512 copier), per-bank segment wrappers, and a
-  generated multi-bank `.cfg` referenced via `linkerConfigPath` (so the cfg never streams
-  through context). (Lynx: `build()` yields the headerless image; prepend the shipped
-  `lnx_header.bin` for the full `.lnx`.)
-- **Native-recipe rebuild (`buildCall:null`), byte-identical, steps in `BUILD.md`** — **SMS,
-  GG, MSX, GB, GBC, Genesis, GBA, Atari 2600**. Their `build()` toolchains (SDCC/RGBDS/asar/
-  dasm/vasm) can't reassemble ca65/GNU-as syntax, so `BUILD.md` gives the proven native
-  `as`/`ld`/`objcopy` chain — per-bank on banked carts (Sega-mapper SMS/GG, MSX megaROMs,
-  banked 2600 get per-bank wrappers + cfg blobs and a bank-by-bank recipe).
+cartridge header → `*.bin`), a verbatim `original.rom` template, a `reassemble.json` manifest,
+a `BUILD.md` with the exact steps, and — where a cc65-native one-call rebuild also exists — a
+`rebuild.json` of the precise `build({...})` args. So the loop is
+`disasm({target:'project'})` → edit a `.asm` → `build({output:'reassemble'})` → `romPatch({op:'diff'})` to confirm.
+
+**The rebuild — one call, every platform.** `build({output:'reassemble', platform, path})` turns
+the project dir back into a **byte-identical ROM in ONE call on all 15 classic platforms** — no
+per-CPU recipe to run by hand. It assembles each region `.asm` with the CPU's native assembler
+(ca65 for 6502/65816, GNU `as`/`ld`/`objcopy` for m68k/arm/z80/gbz80) and splices the results into
+a copy of `original.rom`, so the cartridge header, inter-region gaps, and trailing pad come back
+verbatim. `byteExact:true` = the rebuild equals the original exactly. **Edit a region `.asm` first
+for an intentional change:** a same-length edit rebuilds a modified-but-valid ROM
+(`byteExact:false`, only the changed bytes differ); a length-changing edit is REFUSED with a
+per-region error (splicing can't shift every later byte — keep the byte count, or drop to a full
+`build({output:'rom'})` linker recipe). This is the "cmp before commit" gate for any structural hack.
+
+**Alternate cc65-native `build()` rebuild (`rebuild.json`)** — for **NES (NROM *and* banked
+mappers), C64, Atari 7800 (flat *and* SuperGame banked), Lynx, PC Engine (flat *and* banked
+HuCards)** the project also ships a `rebuild.json` you can feed straight to `build({output:'rom'})`
+(these platforms' `build()` toolchain IS cc65/ca65). Banked projects ship a HEADER segment with
+the original header bytes (16 iNES / 128 .a78 / 512 copier), per-bank segment wrappers, and a
+generated multi-bank `.cfg` via `linkerConfigPath`. (Lynx: it yields the headerless image; prepend
+the shipped `lnx_header.bin` for the full `.lnx`.) The other platforms (SMS/GG/MSX/GB/GBC/Genesis/
+GBA/Atari 2600) have no `rebuild.json` — but `build({output:'reassemble'})` above rebuilds them all
+the same one-call way, so you never need the native `as`/`ld`/`objcopy` chain yourself.
 
 **Rebuilding a commercial NES (NROM CHR-ROM) game — `build({inesHeader})`:** the most common
 NES RE rebuild. `build({output:'rom', platform:'nes', inesHeader:{prgBanks, chrBanks, mapper,

package/src/platforms/atari2600/MENTAL_MODEL.md

@@ -219,7 +219,8 @@ What you can read:
   F6 = 16 KB, F4 = 32 KB) `references` scans EVERY 4 KB bank at `$F000`,
   refs tagged `romBank`; `disasm({target:'project'})` likewise emits one
   region per bank plus per-bank `BANKn` wrappers and a multi-area `.cfg`
-  blob for the native ca65/ld65 rebuild.
+  blob, and **`build({output:'reassemble', platform:'atari2600', path})`
+  rebuilds the whole cart byte-identical in one call** (no ca65/ld65 by hand).
 
 Memory regions for **`memory({op:'read'})`**:
 

package/src/platforms/gba/MENTAL_MODEL.md

@@ -182,8 +182,10 @@ Pair `sprites` / `palette` / `background` / `cpu` with
 `disasm({target:'rom'})`, `disasm({target:'references'})`, and
 `disasm({target:'project'})` run the native binutils
 **`arm-none-eabi-objdump`** (WASM) — **ARM mode by default**, pass
-`thumb:true` for Thumb code. The byte-exact project reassembles through
-`arm-none-eabi-as` / `ld` / `objcopy`.
+`thumb:true` for Thumb code. To rebuild, **`build({output:'reassemble',
+platform:'gba', path})` turns the project dir back into a byte-identical ROM in
+one call** — it assembles each region through `arm-none-eabi-as`/`ld`/`objcopy` and
+splices the results into the original's header/pad (you don't run them yourself).
 
 **Gotcha (until ARM/Thumb mode-tracking lands):** GBA C compiles mostly to
 **Thumb** reached via an **ARM crt0 stub**, so an ARM-mode disasm of a full

package/src/platforms/msx/MENTAL_MODEL.md

@@ -121,8 +121,10 @@ exactly this.
   `objdump`. MegaROMs (>32 KB) are handled per 16 KB bank: `references` scans
   bank 0 at `$4000` (after the "AB" header) and banks 1+ at `$8000` (an
   assumed ASCII16-style window), refs tagged `romBank`;
-  `disasm({target:'project'})` splits the header into its own data region and
-  emits a bank-by-bank native rebuild recipe in `BUILD.md`.
+  `disasm({target:'project'})` splits the header into its own data region, and
+  **`build({output:'reassemble', platform:'msx', path})` rebuilds the whole ROM
+  byte-identical in one call** (each bank assembled + spliced back — no
+  bank-by-bank native recipe to run by hand).
 
 ## MCP debug & inspection tooling
 

package/src/platforms/sms/MENTAL_MODEL.md

@@ -321,7 +321,9 @@ disassemblers.
 Sega-mapper banked carts (>48 KB) are handled per-bank: `references` scans
 every 16 KB bank (bank 0 @ `$0000`, bank 1 @ `$4000`, banks 2+ @ their slot-2
 window `$8000`), refs tagged `romBank`; `disasm({target:'project'})` emits one
-region per bank with a bank-by-bank native rebuild recipe in `BUILD.md`.
+region per bank, and **`build({output:'reassemble', platform:'sms', path})`
+rebuilds the whole cart into a byte-identical ROM in one call** (it assembles each
+bank and splices them back — no bank-by-bank native recipe to run by hand).
 
 ## Horizontal scrolling (for side-scrollers)
 

package/src/platforms/snes/MENTAL_MODEL.md

@@ -224,9 +224,10 @@ video are fully readable, so you assert live state instead of guessing:
   master mixer (see "Debugging sound" above for `audioDebug`).
 - **`disasm({target:'references'})`** scans EVERY 32 KB LoROM bank (refs
   tagged `romBank`) — a hit in bank 12 of a 1 MB cart shows up, not just
-  bank 0. `disasm({target:'project'})` likewise splits per-bank with a
-  native ca65/ld65 rebuild recipe (build() is asar, which can't consume
-  the disasm's ca65 output).
+  bank 0. `disasm({target:'project'})` likewise splits per-bank, and
+  **`build({output:'reassemble', platform:'snes', path})` rebuilds the whole dir
+  into a byte-identical ROM in one call** (it assembles each region's ca65 + splices
+  them into the original's header/pad — no need to run ca65/ld65 yourself).
 - **Memory regions:** `memory({op:'read'})` exposes OAM, CGRAM, ARAM (SPC700
   audio RAM), and **FillRAM**. Note the FillRAM quirk: snes9x mirrors the
   PPU registers $2100-$213F (OBSEL/BGMODE/TM/TS/color-math, etc.) into

package/src/toolchains/common/reassemble.js

@@ -76,6 +76,9 @@ export const CPU_FAMILY = {
   // PC Engine's HuC6280 is a 65C02 superset — the 6502-family da65/ca65 path
   // reassembles it (da65 also has an explicit --cpu huc6280 mode for decode).
   pce: "6502",
+  // GameTank's W65C02S is a 65C02 superset — same 6502-family da65/ca65 path.
+  // 65C02-only opcodes da65 doesn't decode floor to `.byte` (still byte-exact).
+  gametank: "6502",
 };
 
 /**
@@ -149,7 +152,12 @@ async function reassembleGnuNative(disasm, startAddress, original, tools, family
   // binutils chain for this CPU. asArgs (e.g. for z80's -march=gbz80) ride
   // through to the assembler call (the z80 wrapper bakes march in itself).
   const { runAs, runLd, runObjcopy, fmtLines = "" } = tools;
-  const ld = `${fmtLines}ENTRY(_start)\nSECTIONS {\n  .text 0x${startAddress.toString(16)} : {\n    *(.text*) *(.rodata*) *(.data*)\n  }\n  /DISCARD/ : { *(.ARM.attributes) *(.comment) *(.note*) }\n}\n`;
+  // SUBALIGN(1) is load-bearing: without it, the m68k ELF aligns .text to a 2-byte
+  // (word) boundary, so `objcopy -O binary` emits 2 leading pad bytes and the whole
+  // region shifts by 2 → byte-exact FAILS even for a pure `.byte` floor. Forcing
+  // sub-alignment to 1 places the section exactly at its origin with no leading pad.
+  // (ARM shares this linked path; harmless there where alignment already matches.)
+  const ld = `${fmtLines}ENTRY(_start)\nSECTIONS {\n  .text 0x${startAddress.toString(16)} : SUBALIGN(1) {\n    *(.text*) *(.rodata*) *(.data*)\n  }\n  /DISCARD/ : { *(.ARM.attributes) *(.comment) *(.note*) }\n}\n`;
 
   // Parse objdump's normalized lines into {label?, code?, addr, bytes}.
   const lines = disasm.split(/\r?\n/).map(parseLine);
@@ -358,3 +366,116 @@ async function reassembleCc65Native(disasm, startAddress, original, family) {
       note: ok ? "incremental heal did not converge; emitted byte-exact data-only (low readability)" : "could not reach byte-exact even as data" };
   }
 }
+
+// ── ASSEMBLE-ONLY path (the byte-exact ROUND-TRIP rebuild) ───────────────────
+//
+// reassembleForPlatform above DISASSEMBLES bytes and heals them back. But
+// build({output:'reassemble'}) rebuilds from region .asm files that
+// disasm({target:'project'}) already emitted (and that an agent may have
+// EDITED). Those files are the platform's native dialect already — ca65 for
+// 6502/65816, GNU-as for m68k/arm/z80/sm83 — so we just ASSEMBLE them; no
+// disassemble, no heal loop. `assembleRegionText` is that half: source text +
+// its origin/length → the produced bytes (or null + log on error). It reuses
+// the SAME per-family as/ld/objcopy/ca65/ld65 calls the heal path uses, so a
+// region that round-trips in disasm reassembles identically here.
+
+/**
+ * Assemble one region's .asm source (possibly hand-edited) back to raw bytes,
+ * using the platform's native assembler chain. No disassembly, no heal loop —
+ * the source is already the right dialect.
+ * @param {Object} a
+ * @param {string} a.platform
+ * @param {string} a.asmText     the region .asm contents (comments ok; leading `; ...` header ignored by the assembler)
+ * @param {number} a.startAddress CPU/origin address of the first byte
+ * @param {number} a.byteLength   expected produced length (the region's original size)
+ * @returns {Promise<{ ok:boolean, bytes:Uint8Array|null, family:string, log?:string }>}
+ */
+export async function assembleRegionText(a) {
+  const { platform, asmText, startAddress, byteLength } = a;
+  const family = CPU_FAMILY[platform];
+  if (!family) throw new Error(`assembleRegionText: no reassembly path for platform '${platform}'`);
+
+  if (family === "6502" || family === "65816") {
+    const { runCa65, runLd65 } = await import("../cc65/cc65.js");
+    const cpuTag = family === "65816" ? "65816" : "6502";
+    const cfg = `MEMORY{M:start $${startAddress.toString(16)},size $${byteLength.toString(16)},type ro,file %O,fill yes,fillval $FF;}\nSEGMENTS{CODE:load M,type ro;}\n`;
+    // The emitted .asm carries `.setcpu`/`.org` from the heal path; if a hand-
+    // edited file dropped them, ca65 still needs the CPU + origin, so ensure both.
+    let src = asmText;
+    if (!/^\s*\.setcpu\b/m.test(src)) src = `\t.setcpu "${cpuTag}"\n` + src;
+    if (!/^\s*\.org\b/m.test(src)) src = src.replace(/(\.setcpu\s+"[^"]+")/, `$1\n\t.org $${startAddress.toString(16).toUpperCase()}`);
+    const ca = await runCa65({ source: src, target: "none" }).catch((e) => ({ object: null, log: String(e) }));
+    if (!ca || !ca.object) return { ok: false, bytes: null, family, log: ca?.log || "ca65 failed" };
+    const ld = await runLd65({ objects: { "o.o": ca.object }, target: "none", linkerConfig: cfg }).catch((e) => ({ binary: null, log: String(e) }));
+    if (!ld || !ld.binary) return { ok: false, bytes: null, family, log: ld?.log || "ld65 failed" };
+    return { ok: true, bytes: new Uint8Array(ld.binary), family };
+  }
+
+  // GNU families (m68k/arm/z80/sm83): as → (ld) → objcopy. Mirror the toolset
+  // selection + the SUBALIGN(1)/`.org`/no-link rules from reassembleGnuNative.
+  let tools;
+  if (family === "m68k") {
+    const m = await import("../m68k-elf-gcc/gcc.js");
+    tools = { runAs: m.runM68kAs, runLd: m.runM68kLd, runObjcopy: m.runM68kObjcopy, fmtLines: `OUTPUT_FORMAT("elf32-m68k")\nOUTPUT_ARCH(m68k)\n` };
+  } else if (family === "arm") {
+    const m = await import("../arm-none-eabi-gcc/gcc.js");
+    tools = { runAs: m.runArmAs, runLd: m.runArmLd, runObjcopy: m.runArmObjcopy, fmtLines: "" };
+  } else if (family === "z80" || family === "sm83") {
+    const z = await import("../z80/binutils.js");
+    tools = { runAs: z.runZ80As, runObjcopy: z.runZ80Objcopy, march: family === "sm83" ? "gbz80" : "z80", noLink: true };
+  } else {
+    throw new Error(`assembleRegionText: no reassembly path for family '${family}'`);
+  }
+
+  const { runAs, runLd, runObjcopy, fmtLines = "", noLink, march } = tools;
+  const ld = `${fmtLines}ENTRY(_start)\nSECTIONS {\n  .text 0x${startAddress.toString(16)} : SUBALIGN(1) {\n    *(.text*) *(.rodata*) *(.data*)\n  }\n  /DISCARD/ : { *(.ARM.attributes) *(.comment) *(.note*) }\n}\n`;
+
+  // GNU `as` for these CPUs does NOT treat `;` as a comment — `;` is a statement
+  // separator. The emitted .asm uses `;` two ways: a LEADING `; …` metadata header
+  // block, and a TRAILING `; ADDR` address comment on each `.byte`/instruction
+  // line (from dataRegionSource + normalizeObjdump). Strip BOTH: drop the leading
+  // comment-only lines, then cut any trailing `; …` off every remaining line.
+  let gnuSrc;
+  {
+    const lines = asmText.split(/\r?\n/);
+    let i = 0;
+    while (i < lines.length && (lines[i].trim() === "" || lines[i].trimStart().startsWith(";"))) i++;
+    gnuSrc = lines.slice(i).map((ln) => {
+      const c = ln.indexOf(";");
+      return (c >= 0 ? ln.slice(0, c) : ln).replace(/\s+$/, "");
+    }).join("\n");
+  }
+  // A DATA region (dataRegionSource) is just `.org` + `.byte` rows with no
+  // `.section .text`/`_start:` scaffolding the link script needs. Wrap it so the
+  // linked (m68k/arm) path finds `_start` at the origin; the code path already
+  // carries its own scaffolding (skip if present). The no-link (z80/gbz80) path
+  // keeps its `.org` and never needs `_start`.
+  if (!noLink && !/^\s*\.section\s+\.text/m.test(gnuSrc)) {
+    gnuSrc = `.section .text\n.global _start\n_start:\n` + gnuSrc.replace(/^\s*\.org\s+\S+\s*$/m, "");
+  }
+  gnuSrc = gnuSrc + "\n";
+  const a2 = await runAs({ source: gnuSrc, march }).catch((e) => ({ object: null, log: String(e) }));
+  if (!a2 || !a2.object) return { ok: false, bytes: null, family, log: a2?.log || "as failed" };
+  let elf;
+  if (noLink) {
+    elf = a2.object;
+  } else {
+    const l = await runLd({ objects: { "main.o": a2.object }, linkScript: ld }).catch((e) => ({ elf: null, log: String(e) }));
+    if (!l || !l.elf) return { ok: false, bytes: null, family, log: l?.log || "ld failed" };
+    elf = l.elf;
+  }
+  const o = await runObjcopy({ elf }).catch((e) => ({ binary: null, log: String(e) }));
+  if (!o || !o.binary) return { ok: false, bytes: null, family, log: o?.log || "objcopy failed" };
+  let bin = new Uint8Array(o.binary);
+  // producedLength = how many REAL bytes the region assembled to (for the no-link
+  // path, minus the `.org` leading-zero pad). The caller checks this against the
+  // region's expected byteLength so a length-changing edit is REFUSED, not
+  // silently truncated by the slice below.
+  const produced = noLink ? Math.max(0, bin.length - startAddress) : bin.length;
+  if (noLink) {
+    bin = bin.slice(startAddress, startAddress + byteLength);
+  } else if (bin.length > byteLength) {
+    bin = bin.slice(0, byteLength);
+  }
+  return { ok: true, bytes: bin, family, producedLength: produced };
+}