diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index 026d90f..10156ca 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -4082,3 +4082,68 @@ which reports 225 addresses in the report and 66 inside the mapping sections.
 The difference is dominated by internal labels; every one of those belongs to an
 entry point that *is* in a row. The entry points themselves are enumerated above
 and in sections 53–58.
+
+## 60. Machine-generated coverage: every entry point, not a spot check
+
+Section 59.3's 30-address check was a spot check and 59.1's "internal labels"
+claim was an assertion. This section replaces both with a mechanical
+classification of **every** address the report mentions.
+
+### 60.1 Method
+
+```python
+unmapped = all_report_addresses - addresses_in_sections_53_59
+entries  = sites whose first instruction is MMTM  (0x098f)
+covered  = unmapped addresses whose enclosing entry is in a mapping row
+orphans  = the rest -> their enclosing entry needs a row
+```
+
+Result:
+
+```
+report addresses                 225
+in a mapping row                  82
+unmapped                         143
+  of which covered by a mapped
+  enclosing function             102
+  in an unmapped entry            41  -> 26 distinct entry points
+```
+
+So the honest answer to "are all found addresses mapped?" was **no** — 26
+function entries were missing. They are listed and mapped below.
+
+### 60.2 The 26 entries
+
+| ROM | status |
+|---|---|
+| `0x3F60FB60` | **ARP resolve** — contains the `arpresolve: no free entry` log site `0x3F610660` → `arpresolve()` `if_ether.c:261` |
+| `0x3F623180` | **interface lookup by network** → `ifa_ifwithnet()` `sys/net/if.c:189` |
+| `0x3F60EE00` | deferred ARP callback (registered at `0x3F614340`) — firmware-specific deferred work |
+| `0x3F6BD9F0` | **`tcp_respond()` `sys/netinet/tcp_subr.c:112`** — builds the ACK from the SYN_RECEIVED handler |
+| `0x3F9DAFF0` | **`leerror()` `sys/pmax/dev/if_le.c:972`** — called with `(5)` from the ISR on `ERR` |
+| `0x3F9D8A50` | the TINT half of **`leintr()` `if_le.c:501`** (TX completion) |
+| `0x3F9D27D0` | the driver's **`leinit()`/`lereset()`** path (contains the CSR/init-block writes) |
+| `0x3F602DB0` | the receive function — **entry of the deferred-RX glue** (see 60.3) |
+| `0x3F604C30` | contains `0x3F606010`/`0x3F606210` → the **`tcp_fasttimo()`/`tcp_slowtimo()`** pair (`tcp_timer.c:51`/`:76`) |
+| `0x3F5FFD90`, `0x3F60C100`, `0x3F6166D0`, `0x3F623940`, `0x3F6448E0`, `0x3F64FE90`, `0x3F653610`, `0x3F65A0C0`, `0x3F660000`, `0x3F662410`, `0x3F675C40`, `0x3F9E14C0`, `0x3FA7C050`, `0x3FE21120` | **firmware-specific** — helpers inside the protocol/OS layers with no 4.4BSD counterpart found (each was checked for a prologue and for call sites; the codec dispatcher `0x3F660000` and the protocol-id dispatcher's default `0x3F65A0C0` are covered by 57.1–57.3) |
+| `0x3F634600` | **firmware-specific** — the default IP-protocol handler that dumps the packet (BSD's equivalent is the silent `bad:` drop at `ip_input.c:368`, which has no body to map to) |
+| `0x3FA932D0`, `0x3FA935D0` | **firmware OS interrupt stubs** (`0x3FA935D0` calls the diagnostics handler `0x3FDD8E80`) |
+
+### 60.3 Correction: the RX function entry is `0x3F602DB0`
+
+Sections 30.1 and 56.2 call `0x3F602E00` the receive entry. The prologue scan
+shows the function starts at **`0x3F602DB0`** (`mmtm sp,a9,a11,a13`); `0x3F602E00`
+is its third instruction. The mapping row should therefore be
+`0x3F602DB0` (deferred-RX glue), with `0x3F602E00` as an interior label.
+
+### 60.4 Coverage statement (replaces 56.3/57.5/58.5/59.3)
+
+> Every function **entry point** the report mentions now has a mapping row:
+> a quoted 4.4BSD counterpart where one exists, otherwise an explicit
+> firmware-specific entry naming why. Interior labels and call sites are
+> covered by their enclosing entry, and that is checked mechanically by the
+> script in 60.1 rather than by inspection.
+
+The remaining honest caveat: for the fourteen entries marked firmware-specific
+in 60.2 I did not find a counterpart; that is a statement about my search, not a
+proof that none exists.