Regarding spawns, it seems everything depends not on checkpoints you activate, but simply on level config pointer incrementing. Whenever camera reaches some place (direction won't matter), it spawns what config pointer tells it, and if it can't get to there, config pointer won't change. It knows that it should stop spawning if the pointed value is $FF.
Download objects.luaLanguage: lua
function objects()
CamX = memory.readwordsigned(0x87)
CamY = memory.readwordsigned(0x89)
LevelCheckpointVal = memory.readbyte(0x585)
newVal = memory.readword(0xB7)
PointedAddr = memory.readbyte(newVal)
gui.text(200,1, "ChP: "..string.format("%02X",LevelCheckpointVal), "#00ff00ff")
gui.text( 95,1, string.format("$%04X:%02X",newVal,PointedAddr), "#00ff00ff")
for i = 0, 14 do
id = memory.readbyte(0x3c1+i)
x = memory.readword(0x3FD+i,0x3EE+i) - CamX
z = memory.readword(0x439+i,0x42A+i)
y = memory.readword(0x41B+i,0x40C+i) - z - CamY
xSh = memory.readbyte(0x484+i)
ySh = memory.readbyte(0x493+i)
zFl = memory.readbyte(0x475+i)
move = memory.readbyte(0x4A2+i)
state = memory.readbyte(0x4B1+i)
ZspdSub = memory.readbyte(0x4CF+i)
hp = memory.readbyte(0x51a+i)
linked = memory.readbyte(0x529+i)
linker = memory.readbyte(0x538+i)
dthTmr = memory.readbyte(0x574+i)
follow = memory.readbyte(0x592+i)
lives = memory.readbyte(0x11+i)
invis = SHIFT(move,7)
if x< 1 then x= 1 elseif x>242 then x=242 end
if y<10 then y=10 elseif y>232 then y=232 end
if id>0 then
gui.text(x, y, string.format("%X",id))
end
--gui.text(1+i*16+18, 1, i)
end
end
gui.register(objects);
EDIT:
1 player clipping depends on positioning very heavily. The lowest I can get is Z=240.248.
EDIT:
Language: asm6502
surfcity_obj_Y_limits:
$B3CA:A9 A8 LDA #$A8
$B3CC:DD 1B 04 CMP Objects_Ypos_L,X @ Objects_Ypos_L = #$F0
$B3CF:90 03 BCC loc_5000_B3D4
loc_5000_B3D4:
$B3D4:A9 E6 LDA #$E6
$B3D6:DD 1B 04 CMP Objects_Ypos_L,X @ Objects_Ypos_L = #$F0
$B3D9:B0 03 BCS locret_5000_B3DE
$B3DB:9D 1B 04 STA Objects_Ypos_L,X @ Objects_Ypos_L = #$F0
locret_5000_B3DE:
$B3DE:60 RTS (from surfcity_obj_Y_limits) -----------
And then this happens
Language: asm6502
$BCE0:B1 19 LDA ($19),Y @ $C14F = #$36 A:00 X:00 Y:01
$BCE2:85 15 STA tmp_var_15 = #$F0 A:36
$BE04:06 15 ASL tmp_var_15 = #$36 A:00
$BE06:2A ROL A:00
$BE07:06 15 ASL tmp_var_15 = #$6C A:00
$BE1A:BD FD 03 LDA Objects_Xpos_L,X @ Objects_Xpos_L = #$88 A:02
$BE1D:49 1F EOR #$1F A:88
$BE25:29 1F AND #$1F A:97
$BE27:85 8B STA tmp_var_8b = #$00 A:17
$BE31:A5 8B LDA tmp_var_8b = #$17 A:0C
$BE33:18 CLC A:17
$BE34:65 15 ADC tmp_var_15 = #$D8 A:17
$BE36:85 15 STA tmp_var_15 = #$D8 A:EF
$BD32:A5 15 LDA tmp_var_15 = #$EF A:F7
$BD34:85 17 STA tmp_var_17 = #$F0 A:EF
$BD7A:A5 17 LDA tmp_var_17 = #$EF A:0C
$BD7C:9D 1B 04 STA Objects_Ypos_L,X @ Objects_Ypos_L = #$E6 A:EF
Post checksums of your rom and bios.
This doesn't spawn the snowman, but now we know there's a spike-invincibility period after getting hit.