If I remember correctly the 6502 uses a selective pull down to move data. Pre-charging a bus on phi2 and most likely pulling bus lines down on phi1 if necessary. On surface level this seems simple enough, but I'm having hard time figuring out how it works on hardware level. Where does the pull down actually happen? One theory I have is that once a control line such as X/SB is enabled the low voltage level from that register bit causes the pull down, but I'm not entirely sure of the specifics how it works in terms of where the pre-charge from the bus goes to

I think there are two or three unrelated ideas in here. It's true that some internal busses on the 6502 are precharged, and there are two ways in which that's used: it's used to correct the weak logic 1 that passes through a pass transistor, by arranging that the pass transistor only needs to pass a 0; and it's used to produce a logic '1' on an otherwise undriven bus. That latter effect allows for the constant FF to be available for free. And in that circumstance, we also see conditional pulldowns which can convert an FF to an FE, FD, FC, FB or FA, which are all needed for the low byte of the address bus when fetching vectors.

In most situations, a bus is always driven. The nature of NMOS logic gates is that there's always a pullup, and the pulldown (or pulldowns) act to drive the voltage of the output towards ground. There's always, in effect, a resistive divider. It's sometimes better to think of MOS transistors as voltage-controlled resistors. Sometimes it's enough to think of them as voltage-controlled switches.

In any case, if a node at a high voltage is subsequently driven to a low voltage, that means charge has been moved, which means current has flowed. If you think of a resistor to ground, which is what a pulldown transistor is acting as, you can see how current will flow, and that's how the voltage drops, as the charge leaks away.

To read a register, the state bit is pretty much always going to be read through a logic gate of some sort. That is, a charge-storing node will not be connected directly to a bus, in a charge-sharing kind of way. The charge-storing node will control a pulldown, that forms an inverter, and it will drive a bus through one or more pass gates.

Hope this helps. We might need a picture - if we do, perhaps you can draw it, or find it!

The charge-sorting node sounds like what I'm looking for. Where is this node located in Visual6502? I tried to look for one but couldn't find one. I even tried simulating a short program and once I the bus got the value I wanted to transfer, I tried to look for what could have drained a bus line that had logical 0. There have been cases where the line stays 0 even during pre-charge phase. Still couldn't find what drained the line.

Any zero bit of any register might be a good place to look. Say for example x0, if we run a series of INX instructions.
http://visual6502.org/JSSim/expert.html ... 8&steps=16
You can see x0 controls an inverter which drives notx0 which drives 1169 which can be connected to sb0 under the control of dpc2_XSB
http://visual6502.org/JSSim/expert.html ... c2_XSB,sb0

Edit: perhaps a better link to find x0:
http://visual6502.org/JSSim/expert.html ... &zoom=12.4
(Use the Find box below the layout, zoom in a bit, and then 'link to this location')
Here's s0:
http://visual6502.org/JSSim/expert.html ... &zoom=12.4

Oh right, it does make sense now. I most of the time think that control signals such as X/SB move the charge from the register to the bus, but didn't think of that a pre-charge can move the opposite way from bus to the register to be drained.

(You'll notice the X and Y registers have a simpler circuit than the S register, and that's mostly because S can be read and written in the same cycle. (S can also drive one of two busses.) I've added some links to my previous post.)

So if S register can be read and written on same cycle, S/S is used to pass the current value on the "write side" the "read side" of the register? Not sure how else to explain it.

From this simulation
http://visual6502.org/JSSim/expert.html ... re=dpc7_SS
I'd think of it more like a recirculate signal, which normally fires but is suppressed as necessary, for example during JSR it's suppressed twice, when S is written. It's also suppressed once during RTS when S is written.