docs: cookbook §426/§434, memory-map extent, Makefile overlay comment

* §426 listed three localizer verdicts; there are four, and the missing TABLE REJECT is
  the dominant residual on main's switch functions (§433). Its span-B table also still
  advertised SaveLoadRoutine as an unlockable owner — it is the §434 frame pair.
* §434 quoted SaveLoadRoutine at 1139 instructions; the .s has 1165.
* docs/memory-map.md:309 recorded saveHeaderTemplate @0x80072DF0 with 'handler code ptrs
  @+0x54' at the ledger's HIGHEST confidence. 0x80072DF0+0x54 = 0x80072E44, which is
  jtbl_80072E44 — func_8002B0B4's dispatch table and the first 12 bytes of the S72 span-B
  carve. The row's extent is wrong past +0x54 and now says so; a 'verified' row that
  overlaps a carve boundary is how a future resegmentation gets talked out of itself.
* Makefile's overlay --front/--tail comment sat directly under main's --order call with
  nothing distinguishing them; now says which is which.

Makefile

@@ -679,6 +679,9 @@ endif
 	# ld_interleave to place the migrated .rodata between the pre/post data-tail chunks (the
 	# data->rodata->data sandwich; cookbook §8). <bin>_JTBL_INTERLEAVE holds the --front/--tail
 	# object basenames (set per overlay in config/overlays.mk). Empty for overlays with no carve.
+	# NOTE (P31 S72): this --front/--tail form is the OVERLAY path only. main is driven by the
+	# --order call in the BINARY=main branch above — its island is 7 pieces, which --front/--tail
+	# cannot express (cookbook §426/§431).
 ifneq ($(JTBL_INTERLEAVE),)
 	$(PYTHON) tools/ld_interleave.py --section .$(BINARY) $(JTBL_INTERLEAVE) $(LD_SCRIPT)
 endif

docs/matching-cookbook.md

@@ -33880,7 +33880,7 @@ hashes, and `gate_main`'s R40 baseline control **rebuilds the tree green immedia
 failure**, overwriting `build/us/SLUS_007.26` and its map — so the one artifact that could localize
 the divergence was destroyed every time, before anyone could look at it. `tools/main_diff_locate.py`
 (new) attributes the differing bytes to symbols via the linker map; `gate_main` now preserves the red
-image first and prints **BODY REJECT / PLUMBING REJECT / MIXED**.
+image first and prints FOUR verdicts — **BODY REJECT / TABLE REJECT (§405-A, the dominant residual on main's switch functions, §433) / PLUMBING REJECT / MIXED**.
 
 **THE DERIVED OVERLAY THAT NAMES A SHIFT INSTANTLY.** splat names a symbol by its address, so
 `linked_address != name_address` **is** the shift, with no reference build to diff against:
@@ -33918,7 +33918,7 @@ instructions, 48%)** are switch functions. Span A unlocks 8 of them. The other t
 
 | span | tables | owning functions |
 |---|---|---|
-| `0x80072E44-0x80073140` | 14 | ~10, incl. `SaveLoadRoutine` (1139 ins) and `func_8003388C` (663) |
+| `0x80072E44-0x80073140` | 14 | ~10, incl. `func_8003388C` (663). `SaveLoadRoutine` (1165) is in this span but is NOT unlockable by drafting — §434 frame pair, route = §265 pair transcription |
 | `0x800732A0-0x8007344C` | 8 | ~8, incl. `StreamLoadStateMachine` |
 | `0x80073494-0x80073514` | 4 | — |
 
@@ -34264,7 +34264,7 @@ changes that:
 
 * `func_8002B0B4` (76 ins) has **no epilogue** — every exit is a raw `j` into a label inside its
   sibling, or a computed `jr $v0` through `jtbl_80072E44` whose entries land there too.
-* `SaveLoadRoutine` (1139 ins) has **no prologue** — its first live read is `andi $v1, $s0, 7` on an
+* `SaveLoadRoutine` (1165 ins) has **no prologue** — its first live read is `andi $v1, $s0, 7` on an
   `$s0` it never loads — and it **owns the epilogue** of the 0x40 frame:
   `lw $ra,0x38($sp)` / `lw $s3..$s0` / `addiu $sp,$sp,0x40` / `jr $ra`.
 

docs/memory-map.md

@@ -306,7 +306,7 @@ said "≈0x80063045"; the exact string starts, including the backslash, are belo
 | Address | Symbol/Name (proposed) | Region | Source/Provenance | Confidence | Notes |
 |---|---|---|---|---|---|
 | 0x800638FA | `BodyStatLevelTable` | US | AP-world `client.py` (`0x0638FA + 16*level`) | reported | 16-byte records indexed by level; inside EXE static data — verify in Ghidra |
-| 0x80072DF0 | `saveHeaderTemplate` | US | **VERIFIED live (T6b 2026-06-14; RAM==EXE)** | **verified** | PS1 memcard save-header template: `Hero` default name (SJIS full-width) @+0; memcard **filename** `BASLUS-00726MUSASHI` @+0xC; **title** `ＢＲＡＶＥ　ＦＥＮＣＥＲ　ＭＵＳＡＳＨＩ` (SJIS) @+0x20; save/load **handler code ptrs** 0x8002B154 / 0x8002B1AC / 0x8002BEA4 @+0x54. Anchors Q#5 |
+| 0x80072DF0 | `saveHeaderTemplate` | US | **VERIFIED live (T6b 2026-06-14; RAM==EXE)** — **CORRECTED P31 S73: the row's extent is WRONG past +0x54.** 0x80072DF0+0x54 = 0x80072E44 is `jtbl_80072E44`, `func_8002B0B4`'s SaveLoadRoutine dispatch table and the first 12 bytes of the S72 span-B `.rodata` carve — not part of this template. The "handler code ptrs" it described are that jump table's entries. Treat this row as verified only up to +0x54. | **verified (extent corrected)** | PS1 memcard save-header template: `Hero` default name (SJIS full-width) @+0; memcard **filename** `BASLUS-00726MUSASHI` @+0xC; **title** `ＢＲＡＶＥ　ＦＥＮＣＥＲ　ＭＵＳＡＳＨＩ` (SJIS) @+0x20; save/load **handler code ptrs** 0x8002B154 / 0x8002B1AC / 0x8002BEA4 @+0x54. Anchors Q#5 |
 | ~EXE+0x62620 | overlay/script pointer table | **JP** | jywjyw `note.md` (JP EXE file offset) | reported (**JP-only — re-derive for US**) | EXE-side pointer table tied to the resident script blob (§4). US analogue **TBD** — Phase 3 |
 
 ---