with the help of sarayan that did most of the work, we figured out most of the MM78 stuff now. Including bit order, and that it looks like my dumps are good. All of the opcodes except a couple have been figured out now and the code looks pretty decent.
It looks like I was correct in that the CPU starts dumping at the reset vector, after 4 "junk" bytes. Address 0004h in my dumps is address 03c0h in the CPU space. The init code happened to be the same on both chips which helped a bit. Having more than 1 example is very useful in determining how close you are.
I still am mystified how I got all 2K of data out of the chip, seeing how it has a polynomial program counter (verified) and a bank latch. Apparently the bank latch is really a counter, and every time the polynomial PC wraps it increments it. The other 4 bitters sure don't do this.
There's hundreds of examples in the disassembly of this not being a fluke. I particularly liked the jmp slide which appears at 0522h of c6.txt. They used jumps (they call them "transfers", or T) because each one takes 2 cycles instead of 1 cycle like a NOP, and the possibility of them properly pointing to each other like that by chance is impossible because it's in polynomial order.
Each usage of the TAB instruction is also "proper". the jump itself doesn't occur until 2 cycles later, so they nop them out or have another instruction or so before the jump table itself.
Also, every time the skisl instruction is used, there's a NOP before it because it takes a cycle to read the port bit in question, selected by B.
On other micros, I finished dumping all my HD38820's. I had 8 of these surface mount chips to dump and finished doing that finally. So I think we got 14 or 15 games backed up waiting to be emulated, only being held up by lack of documentation.