Misc. mentions
{
Pressing exactly BYAX during Golden Torizo's initialisation AI (the GT code, $AA:C91E) gives Samus 700 (max) health, 300 (max) reserve health, 100 (max) missiles, 20 (max) super missiles, 20 (max) power bombs, and every beam/item except screw attack (all equipped, including spazer+plasma)

There is a debug room ($8F:E82C). More of a test room for basic testing of certain special blocks. Not too interesting, but it has its own area index
There is a debug Nintendo copyright spritemap ($8C:8626). Same as the regular spritemap ($8C:8103), but also displays 'Ver. 2.00'
Enemy set name and enemy set data is written to $7E:D552 ($A0:896F). Never read by anything
An unused function ($A2:A7D8) causes the gunship to rise to Y position 80h and descend
An unused instruction list ($A2:E9B0) causes a vertical shutter to loop through a shrinking animation
An unused routine ($8B:8488) allows the active mode 7 transformation to be controlled with the controller. D-pad pans, L/R rotate, X/B zoom
An unused routine ($86:A91A) allows the active enemy projectile movement direction to be set with the d-pad. It's placed amongst the torizo enemy projectiles, but unclear which enemy projectile it was intended to be used with

There is an unused debug command handler $90:F52F that executes an unused function pointer $0A5E. There are three functions left in the ROM associated with this
$90:F535: Give Samus a shinespark if Y is newly pressed
$90:F54C: Disable rainbow Samus and stand her up if controller 2 Y is newly pressed
$90:F561: Release Samus from drained pose if Y newly pressed

$81:FF00 has an ASCII message:
' Special thanks '
'       2        '
'  Genji Kubota  '
'       &        '
'all debug staff.'
'                '
}

Non-debug mode features
{
Setting $80:8000 disables anti-piracy checks ($80:85F6). Doesn't really seem that useful, perhaps they had additional SRAM in development
Setting $80:8008 disables audio ($80:8028). Limited usability, as it causes door transitions to wait forever for the SPC engine to acknowledge sound requests ($82:8A55)
Setting $84:B366 to 60h shows graphics for scroll PLMs
Setting $84:B333 to 60h shows graphics for scroll PLM extensions
Setting $8B:8697 to EAh shows the version info on the title screen. Also displays an 'S' if audio is disabled by $80:8008
}

Everything else requires $80:8004 to be set, enabling debug mode ($05D1 in WRAM)

Basic features
{    
Debug input ($80:9497) is processed with select + L/R commands on controller 1 or with controller 2:
    $05C5: Debug input L. Newly pressed controller 1 input when select + L is pressed. Clears $05C7 if non-zero (L has priority over R)
    $05C7: Debug input R. Newly pressed controller 1 input when select + R is pressed
    $8D: Controller 2 input
    $91: Newly pressed controller 2 input

Start + select + L + R triggers soft reset ($80:94C7)
Select + L + A triggers the palette viewer ($B4:9981)
Select + L + X triggers the sprite tiles viewer ($B4:9989)
Select + L + Y toggles spare CPU display ($82:8AB3). Screen brightness is set to 6 / 10h when waiting for NMI
Select + R + A toggles IRQ ($80:951F). This notably toggles the HUD, BG3 and colour math effects. Will crash if used during door transition
Controller 2 start triggers debug game over menu ($B4:9961)
Controller 2 select triggers the enemy allocation viewer ($B4:9998). This requires the debugger font to be loaded (by the enemy debugger) to display properly
Controller 2 A toggles sprite interactions ($B4:999F)
Controller 2 L toggles enemy time is frozen flag ($B4:9978)
Controller 2 R triggers the enemy debugger ($B4:9991)
Controller 2 L + R + A during death animation suppresses palette transitions ($9B:B49B/B718/B783)
Controller 2 L + R + A whilst Samus is facing forward enables debug invincibility ($90:F5E4). Knockback is disabled ($90:DDF1) and Samus' health never updates ($90:EAEA)
}

Palette viewer
{
Page 0 shows the sprite palettes. Clobbers the first half of the enemy sprite tiles (VRAM $7000..77FF)
Select + L + A switches to the next page

Page 1 shows the BG palettes. Clobbers the sprite palettes
Select + L + A exits
}

Sprite tiles viewer
{
Page 0 shows the enemy sprite tiles (VRAM $7000..7FFF)
Select + L + A selects the next palette to use. In order: real, 1, 2, 3, 7
Select + L + X switches to the next page

Page 1 shows the non-enemy sprite tiles (VRAM $6000..6FFF) with palette 5
Select + L + X exits
}

Enemy debugger
{
Starts with the enemy selector/mover
Controller 2 select switches to the next enemy
Controller 2 B + select switches to the previous enemy
Controller 2 A teleports the enemy to Samus' right
Controller 2 d-pad moves the enemy slowly
Controller 2 X + d-pad moves the enemy quickly
Controller 2 R switches to the enemy spawn data editor

Enemy spawn data editor
Controller 2 d-pad moves the selection cursor
Controller 2 X increments the selected digit
Controller 2 B decrements the selected digit
Controller 2 A sets the enemy spawn position
Controller 2 select respawns the enemy and exits
Controller 2 L switches to the enemy spawner
Controller 2 R exits

Enemy spawner
Controller 2 down selects the next enemy set entry
Controller 2 B + L spawns the selected enemy if it has an enemy name
Controller 2 L unconditionally spawns the select enemy and exits
Controller 2 R exits. If $B4:95D6 is changed from an STZ to an INC (the "extended enemy debugger" code), this switches to the enemy RAM viewer

Enemy RAM viewer
Page 0 shows 
    TK_UPTM: [frame counter]
    TK_Stat: [AI handler]
    TK_Num : [ID]
    TK_Bank: [bank]
Controller 2 R switches to the next page

Page 1 shows
    Switch : [properties]
    Switch2: [extra properties]
    ColorPa: [palette index]
    CharaOf: [VRAM tiles index]
Controller 2 R switches to the next page

Page 2 shows
    PoseAdr: [instruction list pointer]
    WaitTim: [instruction timer]
    LpCnt  : [timer]
    Patern : [spritemap pointer]
Controller 2 R switches to the next page

Page 3 shows
    FlashCo: [flash timer]
    IceCoun: [frozen timer]
    HitCoun: [invincibility timer]
    PlplCou: [shake timer]
Controller 2 R switches to the next page

Page 4 shows
    Pwork0 : [$0FA8]
    Pwork1 : [$0FAA]
    Pwork2 : [$0FAC]
    Pwork3 : [$0FAE]
Controller 2 R switches to the next page

Page 5 shows
    Pwork4 : [$0FB0]
    Pwork5 : [$0FB2]
    InitOP0: [$0FB4]
    InitOP1: [$0FB6]
Controller 2 R switches to the enemy allocation viewer

Enemy allocation viewer
Controller 2 select exits
}

Demo recorder
{
Removing the return at $90:E756 enables demo recorder features ($90:E759)

Select + R + B toggles morphed Samus position display ($80:952E / $90:E778). When enabled, Samus missiles / super missiles show Samus X / Y position in blocks. Samus ammo is backed up / restored when toggled on / off
Select + L + B gives ammo, all items, switches to next beam configuration, and toggles the Samus tile viewer ($91:E358)
Controller 2 B toggles Samus placement mode ($90:E789). If enabled, d-pad moves Samus and controller 2 A toggles frozen time

Setting $80:8002 enables the demo recorder itself
Recorded demo duration is displayed at the top-right
Controller 2 Y starts recording
Ch bytes of data are written to bank $B8 each frame containing controller input, layer 1 position and Samus position
Max length is A00h frames (7800h bytes), after which data is no longer written (but recording is still "active")
Controller 2 X pauses/ends the recording
A Ch byte FFh terminator is written, door BTS and area index are recorded to $B8:FF00/02
Controller 2 A resets the demo recorder
}

Debug scrolling
{
Setting $80:8006 enables debug scrolling ($80:A9AC)
Controller 2 X toggles scrolling
}

Debug file select map
{
Pressing "start game" on a save file will bring up the file select map ($82:EDB1/EEB7)
This happens even on a new save file, in which case a save file will be created on the spot ($82:EEFF)
This behaviour can be suppressed by holding L when pressing "start game"

The area select map will allow d-pad / select to switch areas ($81:A809)
The room select map will show debug save points and used save points using the debug save point icons ($82:B752). In theory it will also show used debug elevators markers, however no door marks the debug elevator bit
Player 2 select switches the selected debug save point icon ($81:AD90), and will start the game from there when A/start is pressed, though the map position doesn't always reflect the loaded room

The in-game pause menu map also shows the debug save points ($82:B6AE), but uses the regular save icon
}

Debug game over menu
{
Pressing "end" will save the game (save station is unchanged) and trigger a soft reset

Pressing "continue" attempt to unpause and resume the game.
This actually runs the unpausing code, which relies on state set up by the pausing code, which is *not* run by the debug game over menu initialisation
If you haven't entered the pause menu before using this feature, this will set the regular IO registers ($51..86) to zero due to $82:8E19, which will result in a completely blank screen or a heavily glitched display
BG2 tilemap is similarly affected due to $82:8D96
Music isn't resumed
The first half of sprite tiles get clobbered, notably explosion sprites
}

Debug gunship liftoff
{
Setting $A2:AAF0 to 0 allows controller 2 B whilst Samus is entering the gunship to initiate liftoff
}

Draygon placement controller
{
Setting $A5:9366 to EAh allows controller 2 to control Draygon (to a degree)
Controller 2 d-pad moves the enemy slowly (a la the enemy debugger), it also makes Draygon turn to face left/right if left/right is pressed
Controller 2 X + d-pad moves the enemy quickly (a la the enemy debugger), it also makes Draygon turn to face left/right if left/right is pressed
Controller 2 Y triggers Draygon's fire goop action
Controller 2 B triggers Draygon's fake tail whip action
Controller 2 A triggers Draygon's fake grab action
}