A restart point should restore a coherent snapshot, not whichever fields happened to be copied before a failed attempt.
Use it in a project
MODE=0 captures the three live byte fields, XOR checksum and SAVED=1. MODE=1 restores only if SAVED is exactly 1 and the saved bytes match CHECKSUM. RESULT=1 reports a completed capture or restore; other modes, absent snapshots or checksum mismatch return zero and leave live fields unchanged. Coordinates and resource counts have no additional game-specific range policy.
Include component.inc once (MOS callers include the shared 6502 implementation through it). Reserve the public fields in this exact order: RESULT, SAVED, LIVE_X, LIVE_Y, LIVE_RESOURCE, MODE, SAVED_X, SAVED_Y, SAVED_RESOURCE, CHECKSUM. They occupy 10 contiguous bytes. Also reserve the private workspace: T0 (1 bytes). Array names in the explanation refer to the numbered consecutive bindings, such as C0, C1 and so on.
Call checkpoint_state_init once at the intended reset boundary. It clears inputs as well as outputs and workspace. Set your starting state and configuration afterwards, then call checkpoint_state_step whenever the described event occurs. The helper reads no device, waits for no frame and installs no interrupt handler.
| Ownership | Fields |
|---|---|
| Retain between calls | SAVED, SAVED_X, SAVED_Y, SAVED_RESOURCE and CHECKSUM |
| Supply before service | MODE and the live fields before capture |
| Read after service | RESULT and the live fields after successful restore |
Restoration validates the complete saved record before touching any live field. That makes a failed restore a no-op on the player state rather than a partial rollback.
Reusable initialisation and service
; SPDX-License-Identifier: MIT
; Capture and Restore a Checked Checkpoint. See README.md for the byte interface and ownership.
; init clears the public fields and private workspace; set inputs afterwards.
checkpoint_state_init:
lda #0
sta RESULT
sta SAVED
sta LIVE_X
sta LIVE_Y
sta LIVE_RESOURCE
sta MODE
sta SAVED_X
sta SAVED_Y
sta SAVED_RESOURCE
sta CHECKSUM
sta T0
rts
checkpoint_state_step:
; RESULT = 0
lda #0
sta RESULT
; if MODE == 0:
lda MODE
cmp #0
beq checkpoint_state_L4
checkpoint_state_L5:
jmp checkpoint_state_L2
checkpoint_state_L4:
jmp checkpoint_state_L1
checkpoint_state_L1:
; SAVED_X = LIVE_X
lda LIVE_X
sta SAVED_X
; SAVED_Y = LIVE_Y
lda LIVE_Y
sta SAVED_Y
; SAVED_RESOURCE = LIVE_RESOURCE
lda LIVE_RESOURCE
sta SAVED_RESOURCE
; CHECKSUM = SAVED_X ^ SAVED_Y
lda SAVED_X
eor SAVED_Y
sta CHECKSUM
; CHECKSUM = CHECKSUM ^ SAVED_RESOURCE
lda CHECKSUM
eor SAVED_RESOURCE
sta CHECKSUM
; SAVED = 1
lda #1
sta SAVED
; RESULT = 1
lda #1
sta RESULT
; return
rts
jmp checkpoint_state_L3
checkpoint_state_L2:
checkpoint_state_L3:
; if MODE != 1:
lda MODE
cmp #1
bne checkpoint_state_L9
checkpoint_state_L10:
jmp checkpoint_state_L7
checkpoint_state_L9:
jmp checkpoint_state_L6
checkpoint_state_L6:
; return
rts
jmp checkpoint_state_L8
checkpoint_state_L7:
checkpoint_state_L8:
; if SAVED != 1:
lda SAVED
cmp #1
bne checkpoint_state_L14
checkpoint_state_L15:
jmp checkpoint_state_L12
checkpoint_state_L14:
jmp checkpoint_state_L11
checkpoint_state_L11:
; return
rts
jmp checkpoint_state_L13
checkpoint_state_L12:
checkpoint_state_L13:
; T0 = SAVED_X ^ SAVED_Y
lda SAVED_X
eor SAVED_Y
sta T0
; T0 = T0 ^ SAVED_RESOURCE
lda T0
eor SAVED_RESOURCE
sta T0
; if T0 != CHECKSUM:
lda T0
cmp CHECKSUM
bne checkpoint_state_L19
checkpoint_state_L20:
jmp checkpoint_state_L17
checkpoint_state_L19:
jmp checkpoint_state_L16
checkpoint_state_L16:
; return
rts
jmp checkpoint_state_L18
checkpoint_state_L17:
checkpoint_state_L18:
; LIVE_X = SAVED_X
lda SAVED_X
sta LIVE_X
; LIVE_Y = SAVED_Y
lda SAVED_Y
sta LIVE_Y
; LIVE_RESOURCE = SAVED_RESOURCE
lda SAVED_RESOURCE
sta LIVE_RESOURCE
; RESULT = 1
lda #1
sta RESULT
rts
component_end:Machine contract
A/X/status may change; Y and decimal mode are preserved. Use CLD for binary arithmetic. A direct JSR needs two return-address stack bytes. The helper makes no nested calls and adds no other stack use. Its named scratch is private workspace, not a pointer, a ROM variable or shared zero-page space that the game may borrow concurrently. The samples use fixed symbol bindings. Scope or rename every label and binding, including the component_end measurement marker, and allocate a separate block for each independent instance. Different helpers can also use common field names, so combining them needs separate namespaces or explicitly renamed bindings. Give each block one mutation owner.
The diagnostic PRG owns screen, font and colour RAM and disables interrupts; it does not return to BASIC. The reusable helper does none of those things.
Adapt the caller
demo.asm supplies the bindings and include order. exercise.inc first runs table cases, then a separate client retaining state between calls. A game can call the public step entry directly and remove the diagnostic packet and display. Do not copy the diagnostic’s hardware takeover into an existing game loop.
Build with make ASM198X=/path/to/asm198x. The Makefile produces normal, custom, deliberately wrong and repaired programs. Tools must already be installed; the sample downloads nothing.
Bindings and include order
RESULT=$80
SAVED=$81
LIVE_X=$82
LIVE_Y=$83
LIVE_RESOURCE=$84
MODE=$85
SAVED_X=$86
SAVED_Y=$87
SAVED_RESOURCE=$88
CHECKSUM=$89
T0=$8a
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$c000
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=0
BROKEN=0
COYOTE_STEPS=4
BUFFER_STEPS=4
TEXT_CAP=8
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=7
!source "caller.inc"
!source "exercise.inc"
component_start:
!source "component.inc"
!source "data.inc"
!source "cases.inc"
hex_font:
!byte 0,0,0,0,0,0,0,0,0,56,40,40,40,56,0,0,0,16,48,16,16,56,0,0,0,56,8,56,32,56,0,0,0,56,8,56,8,56,0,0,0,40,40,56,8,8,0,0,0,56,32,56,8,56,0,0,0,56,32,56,40,56,0,0,0,56,8,8,8,8,0,0,0,56,40,56,40,56,0,0,0,56,40,56,8,56,0,0,0,16,40,56,40,40,0,0,0,48,40,48,40,48,0,0,0,56,32,32,32,56,0,0,0,48,40,40,40,48,0,0,0,56,32,48,32,56,0,0,0,56,32,48,32,32,0,0
code_end:A client retaining state between calls
preview_rules:
!if CUSTOM {
; LIVE_X = 250
lda #250
sta LIVE_X
; LIVE_Y = 1
lda #1
sta LIVE_Y
; LIVE_RESOURCE = 255
lda #255
sta LIVE_RESOURCE
!if BROKEN {
; SAVED_RESOURCE = 0
lda #0
sta SAVED_RESOURCE
}
jsr checked_step
jsr emit_state
; LIVE_X = 0
lda #0
sta LIVE_X
; MODE = 1
lda #1
sta MODE
!if BROKEN {
; SAVED_RESOURCE = 0
lda #0
sta SAVED_RESOURCE
}
jsr checked_step
jsr emit_state
rts
} else {
; LIVE_X = 20
lda #20
sta LIVE_X
; LIVE_Y = 30
lda #30
sta LIVE_Y
; LIVE_RESOURCE = 4
lda #4
sta LIVE_RESOURCE
!if BROKEN {
; SAVED_RESOURCE = 0
lda #0
sta SAVED_RESOURCE
}
jsr checked_step
jsr emit_state
; LIVE_X = 99
lda #99
sta LIVE_X
; LIVE_Y = 88
lda #88
sta LIVE_Y
; LIVE_RESOURCE = 0
lda #0
sta LIVE_RESOURCE
; MODE = 1
lda #1
sta MODE
!if BROKEN {
; SAVED_RESOURCE = 0
lda #0
sta SAVED_RESOURCE
}
jsr checked_step
jsr emit_state
}
rtsCustomise it
Capture high coordinate/resource values and restore after a different live change. The maintained custom caller changes its inputs or client sequence rather than hiding a different implementation behind the same label. Compare every state of the two clients, not only their final display.
Custom client selection
RESULT=$80
SAVED=$81
LIVE_X=$82
LIVE_Y=$83
LIVE_RESOURCE=$84
MODE=$85
SAVED_X=$86
SAVED_Y=$87
SAVED_RESOURCE=$88
CHECKSUM=$89
T0=$8a
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$c000
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=1
BROKEN=0
COYOTE_STEPS=2
BUFFER_STEPS=2
TEXT_CAP=4
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=49
!source "caller.inc"
!source "exercise.inc"
component_start:
!source "component.inc"
!source "data.inc"
!source "cases.inc"
hex_font:
!byte 0,0,0,0,0,0,0,0,0,56,40,40,40,56,0,0,0,16,48,16,16,56,0,0,0,56,8,56,32,56,0,0,0,56,8,56,8,56,0,0,0,40,40,56,8,8,0,0,0,56,32,56,8,56,0,0,0,56,32,56,40,56,0,0,0,56,8,8,8,8,0,0,0,56,40,56,40,56,0,0,0,56,40,56,8,56,0,0,0,16,40,56,40,40,0,0,0,48,40,48,40,48,0,0,0,56,32,32,32,56,0,0,0,48,40,40,40,48,0,0,0,56,32,48,32,56,0,0,0,56,32,48,32,32,0,0
code_end:The custom diagnostic row is 01 01 FA 01 FF 01 FA 01. The full client trace in the source explains how it gets there.
Mistake and repair
The wrong caller overwrites a saved field before restoring. The checksum rejects the damaged snapshot and preserves the current live state. Keep snapshot ownership with the capture/restore routine.
The BROKEN branch lives in the sequential client, not the reusable helper. wrong.asm selects it; repaired.asm restores the normal call sequence. The repaired executable matches the normal program (for Spectrum, compare loaded CODE rather than the tape filename).
Select the deliberately wrong client
RESULT=$80
SAVED=$81
LIVE_X=$82
LIVE_Y=$83
LIVE_RESOURCE=$84
MODE=$85
SAVED_X=$86
SAVED_Y=$87
SAVED_RESOURCE=$88
CHECKSUM=$89
T0=$8a
STATE=$80
input_ptr=$70
cases_left=$72
ptr=$74
saved_y=$76
OUTPUT=$c000
preview=OUTPUT+1400
ready=OUTPUT+1408
CUSTOM=0
BROKEN=1
COYOTE_STEPS=4
BUFFER_STEPS=4
TEXT_CAP=8
PROPERTY_COUNT=16
STREAM_BYTES=13
CRC_POLY=7
!source "caller.inc"
!source "exercise.inc"
component_start:
!source "component.inc"
!source "data.inc"
!source "cases.inc"
hex_font:
!byte 0,0,0,0,0,0,0,0,0,56,40,40,40,56,0,0,0,16,48,16,16,56,0,0,0,56,8,56,32,56,0,0,0,56,8,56,8,56,0,0,0,40,40,56,8,8,0,0,0,56,32,56,8,56,0,0,0,56,32,56,40,56,0,0,0,56,8,8,8,8,0,0,0,56,40,56,40,56,0,0,0,56,40,56,8,56,0,0,0,16,40,56,40,40,0,0,0,48,40,48,40,48,0,0,0,56,32,32,32,56,0,0,0,48,40,40,40,48,0,0,0,56,32,48,32,56,0,0,0,56,32,48,32,32,0,0
code_end:
Cost and alternatives
The measured helper extent is 154 code bytes; public state is 10 bytes and private scratch is 1 bytes. There are no immutable helper tables. Caller data, the test cases, return-address stack, alignment and display buffers cost additional space. These are assembled sizes, not cycle measurements.
Constant work for three fields. Larger games need an explicit snapshot schema, versioning and ownership; copying an entire object pool may cost much more RAM than a small checkpoint.
This is an in-memory checkpoint, not disk persistence or interrupt-safe saving. XOR can miss multi-byte changes that cancel; it is a small accidental-damage guard, not authentication. Use stronger checksums and an atomic storage protocol for durable saves.
Execution evidence
Four variants run on PAL stock-ROM PRG, using Asm198x 0.0.72, Emu198x 0.44.2. Each executes 64 boundary/varied/error table cases, dirty initialisation and the separate retained-state client. An independent mathematical/container model checks every public byte after every call. This is bounded example coverage, not exhaustive correctness for every possible state.
The records retain loaded immutable code, completion, register sentinels, full packets, source/tool/firmware hashes and captures. The public gate validates these retained observations and rejects altered evidence; it does not run restricted firmware. No firmware is distributed. The eight displayed bytes are the first eight public fields, zero-padded when shorter; the packet includes every field.
Where it fits
Streaming CRC: A stronger checksum can detect more accidental changes, but it still does not make a write atomic.