diff --git a/bridge/ghidra/ReaGhidraBridge.java b/bridge/ghidra/ReaGhidraBridge.java
index 82d75c5cc23..1733dc60f4c 100644
--- a/bridge/ghidra/ReaGhidraBridge.java
+++ b/bridge/ghidra/ReaGhidraBridge.java
@@ -605,6 +605,11 @@ private JsonObject sessionInfo(SessionDescriptor descriptor) throws Exception {
         String riscvCallingConvention = currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO)
             .getString("REA RISC-V calling convention", null);
         if (riscvCallingConvention != null) result.add("riscv_calling_convention", JsonParser.parseString(riscvCallingConvention));
+        // Written by ReaGhidraPrepareElfLoad before auto-analysis; REA requires it
+        // exactly when the committed profile declares a RISC-V load preparation.
+        String loadPreparation = currentProgram.getOptions(ghidra.program.model.listing.Program.PROGRAM_INFO)
+            .getString("REA ELF load preparation", null);
+        if (loadPreparation != null) result.add("elf_load_preparation", JsonParser.parseString(loadPreparation));
         return result;
     }
 
diff --git a/bridge/ghidra/ReaGhidraPrepareElfLoad.java b/bridge/ghidra/ReaGhidraPrepareElfLoad.java
new file mode 100644
index 00000000000..62d4bf9753c
--- /dev/null
+++ b/bridge/ghidra/ReaGhidraPrepareElfLoad.java
@@ -0,0 +1,358 @@
+import com.google.gson.JsonObject;
+import ghidra.app.script.ImproperUseException;
+import ghidra.app.util.headless.HeadlessScript;
+import ghidra.program.database.ProgramDB;
+import ghidra.program.database.mem.FileBytes;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.address.AddressFactory;
+import ghidra.program.model.address.AddressIterator;
+import ghidra.program.model.address.AddressSet;
+import ghidra.program.model.address.AddressSpace;
+import ghidra.program.model.listing.Program;
+import ghidra.program.model.mem.Memory;
+import ghidra.program.model.mem.MemoryBlock;
+import ghidra.program.model.mem.MemoryBlockSourceInfo;
+import ghidra.program.model.symbol.Namespace;
+import ghidra.program.model.symbol.Reference;
+import ghidra.program.model.symbol.ReferenceManager;
+import ghidra.program.model.symbol.SourceType;
+import ghidra.program.model.symbol.Symbol;
+import ghidra.program.model.symbol.SymbolTable;
+import ghidra.program.model.symbol.SymbolType;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Give an executable section that a NOBITS reservation shares addresses with the default address
+ * space before auto-analysis (docs/providers/ghidra-riscv.md). Ghidra 12.1.4's ELF loader resolves the
+ * overlap in favour of the later section, so ESP-IDF's .flash_rodata_dummy keeps the default space
+ * and .flash.text lands in an overlay, which DWARF import, call-frame entries and default-space
+ * references never reach. REA's TypeScript admission commits both sections, and the script refuses
+ * any other memory map, and then turns off headless auto-analysis, since REA discards the session.
+ * The file bytes and their offsets do not change.
+ */
+public final class ReaGhidraPrepareElfLoad extends HeadlessScript {
+    static final String POLICY = "nobits-reservation-overlay-v1";
+    static final String REPORT_KEY = "REA ELF load preparation";
+    /** The handshake bounds a refusal; this leaves room for the context around a failure. */
+    private static final int FAILURE_DETAIL_MAX = 512;
+
+    private record Label(String name, long offset, Namespace namespace, SourceType source) {}
+
+    @Override
+    public void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length != 6 || !arguments[0].equals(POLICY)) {
+            throw new IllegalArgumentException(
+                "ELF load preparation requires policy " + POLICY + " and the committed code and reservation sections"
+            );
+        }
+        long codeAddress = parseHex(arguments[1]);
+        long codeSize = parseHex(arguments[2]);
+        long codeOffset = parseHex(arguments[3]);
+        long reservationAddress = parseHex(arguments[4]);
+        long reservationSize = parseHex(arguments[5]);
+        if (codeSize == 0 || reservationAddress != codeAddress ||
+            Long.compareUnsigned(reservationSize, codeSize) < 0) {
+            throw new IllegalArgumentException(
+                "ELF load preparation requires a reservation that starts with the code and covers it"
+            );
+        }
+        Memory memory = currentProgram.getMemory();
+        AddressSpace space = currentProgram.getAddressFactory().getDefaultAddressSpace();
+        List<FileBytes> files = memory.getAllFileBytes();
+        if (files.size() != 1) {
+            refuse("Ghidra holds " + files.size() + " imported file images instead of one");
+            return;
+        }
+        FileBytes file = files.get(0);
+        MemoryBlock code = null;
+        MemoryBlock reservation = null;
+        int codeCandidates = 0;
+        for (MemoryBlock block : memory.getBlocks()) {
+            AddressSpace blockSpace = block.getStart().getAddressSpace();
+            if (block.getStart().getOffset() != codeAddress) continue;
+            if (block.isInitialized() && block.isExecute() && block.getSize() == codeSize &&
+                blockSpace.getPhysicalSpace() == space && mapsFile(block, file, codeOffset)) {
+                code = block;
+                codeCandidates++;
+            }
+            if (!block.isInitialized() && !block.isExecute() && blockSpace == space &&
+                block.getSize() == reservationSize) {
+                reservation = block;
+            }
+        }
+        String committed = "executable section " + hex(codeAddress) + " (" + hex(codeSize) +
+            " bytes at file offset " + hex(codeOffset) + ")";
+        if (codeCandidates != 1) {
+            refuse("Ghidra has " + codeCandidates + " initialized executable blocks for the committed " + committed);
+            return;
+        }
+        if (!code.isOverlay() && reservation == null) {
+            JsonObject result = new JsonObject();
+            result.add("code", echoCode(code, code.getStart().getAddressSpace().getName()));
+            report("canonical", result);
+            return;
+        }
+        if (!code.isOverlay() || reservation == null) {
+            refuse("Ghidra placed the committed " + committed + (code.isOverlay()
+                ? " in an overlay, but no uninitialized default-space reservation " + hex(reservationAddress) +
+                    " (" + hex(reservationSize) + " bytes) displaced it"
+                : " in the default space beside a reservation block"));
+            return;
+        }
+        // The code's whole overlay space moves with it and then becomes the reservation's.
+        for (MemoryBlock block : memory.getBlocks()) {
+            if (block != code && block.getStart().getAddressSpace().equals(code.getStart().getAddressSpace())) {
+                refuse("Ghidra placed block " + block.getName() + " in the overlay space of the committed " + committed);
+                return;
+            }
+        }
+        JsonObject moved;
+        try {
+            moved = swap(code, reservation, file, codeOffset, committed);
+        }
+        catch (Exception failure) {
+            // A failed swap can leave the program half moved: REA must not analyze it. If Ghidra
+            // rolls back the failed script's changes, the refusal goes too, and the missing report
+            // refuses the session instead (not tested).
+            refuse("Ghidra failed while moving the committed " + committed + ": " + detail(failure));
+            throw failure;
+        }
+        if (moved != null) report("moved", moved);
+    }
+
+    /**
+     * Ghidra 12.1.4 constraints: Memory.moveBlock keeps a block in its address space, and the
+     * native decompiler stops registering programs once any overlay space is removed. The code
+     * therefore moves by re-creating its block and moving program content, and its overlay space
+     * becomes the reservation's. Returns null after a refusal.
+     */
+    private JsonObject swap(MemoryBlock code, MemoryBlock reservation, FileBytes file, long fileOffset,
+            String committed) throws Exception {
+        Memory memory = currentProgram.getMemory();
+        SymbolTable symbols = currentProgram.getSymbolTable();
+        AddressSpace space = currentProgram.getAddressFactory().getDefaultAddressSpace();
+        long size = code.getSize();
+        long reservationSize = reservation.getSize();
+        String codeName = code.getName();
+        String reservationName = reservation.getName();
+        AddressSpace overlaySpace = code.getStart().getAddressSpace();
+        String overlayName = overlaySpace.getName();
+        // Everything in the code's overlay space belongs to the code, including labels past its
+        // end, such as ESP-IDF's section-relative _etext.
+        AddressSet old = new AddressSet(overlaySpace.getMinAddress(), overlaySpace.getMaxAddress());
+        List<Label> labels = new ArrayList<>();
+        for (Symbol symbol : symbols.getSymbols(range(reservation), SymbolType.LABEL, true)) {
+            // Ghidra pins absolute ELF symbols: they keep their default-space address.
+            if (symbol.isPinned()) continue;
+            labels.add(new Label(
+                symbol.getName(),
+                symbol.getAddress().getOffset(),
+                symbol.getParentNamespace(),
+                symbol.getSource()
+            ));
+        }
+        boolean reservationRead = reservation.isRead();
+        boolean reservationWrite = reservation.isWrite();
+        String reservationComment = reservation.getComment();
+        String reservationSource = reservation.getSourceName();
+        // Removing a block keeps the references into its range, entry points included.
+        memory.removeBlock(reservation, monitor);
+        MemoryBlock canonical = memory.createInitializedBlock(
+            unusedBlockName(codeName, codeName, reservationName), space.getAddress(code.getStart().getOffset()), file, fileOffset, size, false
+        );
+        canonical.setPermissions(code.isRead(), code.isWrite(), code.isExecute());
+        canonical.setVolatile(code.isVolatile());
+        canonical.setComment(code.getComment());
+        canonical.setSourceName(code.getSourceName());
+        ((ProgramDB) currentProgram).moveAddressRange(code.getStart(), canonical.getStart(), size, monitor);
+        // The move takes symbols, functions and the references from the range, not the references
+        // into it, such as entry points and the loader's section-header reference: retarget them.
+        ReferenceManager references = currentProgram.getReferenceManager();
+        List<Reference> into = new ArrayList<>();
+        for (Address target : references.getReferenceDestinationIterator(old, true)) {
+            for (Reference reference : references.getReferencesTo(target)) into.add(reference);
+        }
+        for (Reference reference : into) {
+            Address target = space.getAddress(reference.getToAddress().getOffset());
+            if (reference.isEntryPointReference()) {
+                symbols.removeExternalEntryPoint(reference.getToAddress());
+                symbols.addExternalEntryPoint(target);
+            }
+            else if (reference.isMemoryReference() && !reference.isOffsetReference() &&
+                !reference.isShiftedReference()) {
+                references.delete(reference);
+                references.setPrimary(references.addMemoryReference(reference.getFromAddress(), target,
+                    reference.getReferenceType(), reference.getSource(), reference.getOperandIndex()),
+                    reference.isPrimary());
+            }
+        }
+        // The move covers the block; labels outside it are created again at the same offsets.
+        List<Symbol> outside = new ArrayList<>();
+        for (Symbol symbol : symbols.getSymbols(old, SymbolType.LABEL, true)) outside.add(symbol);
+        for (Symbol symbol : outside) {
+            symbols.createLabel(space.getAddress(symbol.getAddress().getOffset()), symbol.getName(),
+                symbol.getParentNamespace(), symbol.getSource());
+            symbol.delete();
+        }
+        // Any other kind of reference stays behind, as would a symbol the move missed: refuse both.
+        boolean symbolsLeft = symbols.getPrimarySymbolIterator(old, true).hasNext();
+        if (symbolsLeft || references.getReferenceDestinationIterator(old, true).hasNext()) {
+            refuse("Ghidra left " + (symbolsLeft ? "symbols" : "references") + " in overlay space " + overlayName +
+                " after moving the committed " + committed);
+            return null;
+        }
+        // The emptied overlay block becomes the reservation: no bytes and no file mapping.
+        MemoryBlock displaced = memory.convertToUninitialized(code);
+        if (reservationSize > size) {
+            MemoryBlock rest = memory.createUninitializedBlock(
+                unusedBlockName(reservationName, codeName, reservationName), displaced.getEnd().add(1), reservationSize - size, false
+            );
+            displaced = memory.join(displaced, rest);
+        }
+        displaced.setName(reservationName);
+        displaced.setPermissions(reservationRead, reservationWrite, false);
+        displaced.setComment(reservationComment);
+        if (reservationSource != null) displaced.setSourceName(reservationSource);
+        String reservationSpace = overlaySpaceName(reservationName, overlayName);
+        if (!reservationSpace.equals(overlayName)) currentProgram.renameOverlaySpace(overlayName, reservationSpace);
+        canonical.setName(codeName);
+        AddressSpace overlay = displaced.getStart().getAddressSpace();
+        // The reservation holds no code, so its labels mark no entry points. An entry mark the
+        // loader gave one of them stays at its default-space address (docs/providers/ghidra-riscv.md).
+        for (Label label : labels) {
+            symbols.createLabel(overlay.getAddress(label.offset()), label.name(), label.namespace(), label.source());
+        }
+        JsonObject outcome = new JsonObject();
+        outcome.add("code", echoCode(canonical, overlayName));
+        outcome.add("reservation", echo(displaced, space.getName()));
+        outcome.addProperty("functions", count(currentProgram.getFunctionManager().getFunctions(range(canonical), true)));
+        outcome.addProperty("entry_points", entryPoints(canonical).size());
+        outcome.addProperty("reservation_labels", count(symbols.getSymbols(range(displaced), SymbolType.LABEL, true)));
+        return outcome;
+    }
+
+    /**
+     * The overlay space name Ghidra 12.1.4's memory map derives from a block name, as for an
+     * overlay block it creates: `:` and characters up to space become `_`, and a name another
+     * address space has gains `.1`, `.2` and so on. Section names are display labels, so a
+     * reservation named like another address space, or with characters Ghidra rejects, still loads.
+     */
+    private String overlaySpaceName(String blockName, String current) {
+        StringBuilder fixed = new StringBuilder(blockName.length());
+        for (char c : blockName.toCharArray()) fixed.append(c == ':' || c <= 0x20 ? '_' : c);
+        AddressFactory factory = currentProgram.getAddressFactory();
+        String name = fixed.toString();
+        for (int index = 1; !name.equals(current) && factory.getAddressSpace(name) != null; index++) {
+            name = fixed + "." + index;
+        }
+        return name;
+    }
+
+    /** A block as the script left it, for the client to compare with the committed section. */
+    private static JsonObject echo(MemoryBlock block, String spaceBefore) {
+        JsonObject result = new JsonObject();
+        result.addProperty("name", block.getName());
+        result.addProperty("address", hex(block.getStart().getOffset()));
+        result.addProperty("size", hex(block.getSize()));
+        result.addProperty("space_before", spaceBefore);
+        result.addProperty("space_after", block.getStart().getAddressSpace().getName());
+        return result;
+    }
+
+    private static JsonObject echoCode(MemoryBlock block, String spaceBefore) {
+        JsonObject result = echo(block, spaceBefore);
+        result.addProperty("file_offset", hex(block.getSourceInfos().get(0).getFileBytesOffset()));
+        return result;
+    }
+
+    private void report(String outcome, JsonObject counts) {
+        JsonObject result = new JsonObject();
+        result.addProperty("policy", POLICY);
+        result.addProperty("outcome", outcome);
+        if (counts != null) {
+            for (String key : counts.keySet()) result.add(key, counts.get(key));
+        }
+        currentProgram.getOptions(Program.PROGRAM_INFO).setString(REPORT_KEY, result.toString());
+        println("REA ELF load preparation: " + result);
+    }
+
+    /**
+     * Written instead of an outcome: REA refuses the session with this reason, so the program is
+     * not analyzed. Later scripts still run, and the bridge reports the refusal.
+     */
+    private void refuse(String reason) throws ImproperUseException {
+        JsonObject result = new JsonObject();
+        result.addProperty("policy", POLICY);
+        result.addProperty("refused", reason);
+        currentProgram.getOptions(Program.PROGRAM_INFO).setString(REPORT_KEY, result.toString());
+        println("REA ELF load preparation refused: " + reason);
+        enableHeadlessAnalysis(false);
+    }
+
+    private static boolean mapsFile(MemoryBlock block, FileBytes file, long offset) {
+        List<MemoryBlockSourceInfo> sources = block.getSourceInfos();
+        if (sources.size() != 1) return false;
+        MemoryBlockSourceInfo source = sources.get(0);
+        return source.getFileBytes().map(file::equals).orElse(false) &&
+            source.getFileBytesOffset() == offset && source.getLength() == block.getSize();
+    }
+
+    private List<Address> entryPoints(MemoryBlock block) {
+        List<Address> found = new ArrayList<>();
+        AddressIterator entries = currentProgram.getSymbolTable().getExternalEntryPointIterator();
+        while (entries.hasNext()) {
+            Address entry = entries.next();
+            // An overlay block also contains its base space's addresses at the same offsets.
+            if (entry.getAddressSpace().equals(block.getStart().getAddressSpace()) && block.contains(entry)) {
+                found.add(entry);
+            }
+        }
+        return found;
+    }
+
+    private static int count(Iterable<?> values) {
+        int count = 0;
+        for (Object ignored : values) count++;
+        return count;
+    }
+
+    private static String detail(Exception failure) {
+        String text = failure.getClass().getSimpleName() +
+            (failure.getMessage() == null ? "" : ": " + failure.getMessage());
+        return text.length() <= FAILURE_DETAIL_MAX ? text : text.substring(0, FAILURE_DETAIL_MAX);
+    }
+
+    /**
+     * A name for a block that exists only during the move. Block names are unique in a program
+     * but carry no meaning here, so a section already named `<name>.rea` must not refuse the image.
+     * The final names stay free too: the reservation's block is gone when the code's temporary is
+     * named, and both blocks take their final names back after it.
+     */
+    private String unusedBlockName(String base, String... finalNames) {
+        Memory memory = currentProgram.getMemory();
+        Set<String> reserved = Set.copyOf(List.of(finalNames));
+        String name = base + ".rea";
+        for (int index = 1; memory.getBlock(name) != null || reserved.contains(name); index++) {
+            name = base + ".rea." + index;
+        }
+        return name;
+    }
+
+    private static AddressSet range(MemoryBlock block) {
+        return new AddressSet(block.getStart(), block.getEnd());
+    }
+
+    private static long parseHex(String value) {
+        if (!value.matches("0x[0-9a-f]{1,16}")) {
+            throw new IllegalArgumentException("ELF load preparation expects lowercase 0x-hex values: " + value);
+        }
+        return Long.parseUnsignedLong(value.substring(2), 16);
+    }
+
+    private static String hex(long value) {
+        return "0x" + Long.toUnsignedString(value, 16);
+    }
+}
diff --git a/docs/providers/ghidra-provider.md b/docs/providers/ghidra-provider.md
index f259fd84c21..abd5bbde05f 100644
--- a/docs/providers/ghidra-provider.md
+++ b/docs/providers/ghidra-provider.md
@@ -78,7 +78,7 @@ request ceiling.
 | Symbols          | `list_names` includes address-bearing memory and external symbols, including dynamic symbols, while excluding variable and no-address namespace records. Each item reports primary, dynamic, external, symbol type, and source facts.                                                           |
 | Procedures       | Both non-external and external functions are listed. A local thunk remains distinct from its resolved target; exact and qualified name lookup fails on ambiguity rather than guessing.                                                                                                          |
 | Strings          | Only Ghidra-defined string `Data` is observed. Items report charset, byte length, and whether a required null terminator is missing. The API cannot distinguish a present terminator from fixed/Pascal layouts when no terminator is missing, so that state is named `present_or_not_required`. |
-| Memory           | Memory-block end addresses are exclusive. Read/write/execute, initialization, overlay, address space, and image base are direct Ghidra observations.                                                                                                                                            |
+| Memory           | Memory-block end addresses are exclusive. Read/write/execute, initialization, overlay, address space, and image base are direct Ghidra observations, after any memory-map preparation a lane documents, such as the [RISC-V load layout](ghidra-riscv.md#load-layout).                          |
 | Inventory        | Procedure, symbol, and string listings plus searches return the complete matching collection in one response; callers do not provide offsets or result-count limits.                                                                                                                            |
 | Search           | Literal and Java-regex searches return every match in the immutable provider-defined inventory; string search does not cover every text sequence in artifact bytes. Search waits for a reply or caller cancellation; there are no caller-supplied offsets or result-count limits.               |
 | Analysis state   | The socket is exposed only after default auto-analysis completes. Established operations wait for their reply or caller cancellation; there is no fixed response-size ceiling.                                                                                                                  |
diff --git a/docs/providers/ghidra-riscv.md b/docs/providers/ghidra-riscv.md
index 5ff3fc3543a..c99703ab2b6 100644
--- a/docs/providers/ghidra-riscv.md
+++ b/docs/providers/ghidra-riscv.md
@@ -33,21 +33,25 @@ that ISA.
 Provider selection returns the specific unsupported constraint rather than
 guessing a compatible profile:
 
-| Declaration                                                                | Outcome                                                                                                              |
-| -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| Little-endian ELF64 `ET_EXEC`, double-float ABI                            | admitted, `RISCV:LE:64:default` + `gcc`, lane `elf64-exec-le-double-float-generic-v1`                                |
-| Little-endian ELF32 `ET_EXEC`, double-float ABI                            | admitted, `RISCV:LE:32:default` + `gcc`, lane `elf32-exec-le-double-float-generic-v1`                                |
-| Little-endian ELF32 `ET_EXEC`, soft-float ABI, decoded extensions only     | admitted, `RISCV:LE:32:default` + `gcc` with the `__rea_ilp32` prototype, lane `elf32-exec-le-soft-float-generic-v1` |
-| ELF32 soft-float ABI without `Tag_RISCV_arch`, or with any other extension | refused; the reason names the extensions outside the decoded set                                                     |
-| ELF32 single-float ABI (ilp32f)                                            | refused until its [written policy](#ilp32f) is implemented and verified                                              |
-| ELF64 soft- or single-float ABI (lp64, lp64f), or the quad-float ABI       | refused; no verified calling-convention policy                                                                       |
-| Big-endian                                                                 | refused; Ghidra 12.1.4 ships no big-endian RISC-V language                                                           |
-| `ET_REL`, `ET_DYN`, other `e_type`                                         | refused with the declared value                                                                                      |
-| `EF_RISCV_RVE`                                                             | refused; the embedded 16-register profile (x0–x15) needs its own processor specification                             |
-| `EF_RISCV_TSO`                                                             | refused; the total-store-order memory model is unverified here                                                       |
-| Reserved or newer `e_flags` bits                                           | refused with the offending bits named                                                                                |
-
-`e_type` is the only load-shape declaration this lane reads. A fixed-address
+| Declaration                                                                      | Outcome                                                                                                              |
+| -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Little-endian ELF64 `ET_EXEC`, double-float ABI                                  | admitted, `RISCV:LE:64:default` + `gcc`, lane `elf64-exec-le-double-float-generic-v1`                                |
+| Little-endian ELF32 `ET_EXEC`, double-float ABI                                  | admitted, `RISCV:LE:32:default` + `gcc`, lane `elf32-exec-le-double-float-generic-v1`                                |
+| Little-endian ELF32 `ET_EXEC`, soft-float ABI, decoded extensions only           | admitted, `RISCV:LE:32:default` + `gcc` with the `__rea_ilp32` prototype, lane `elf32-exec-le-soft-float-generic-v1` |
+| ELF32 soft-float ABI without `Tag_RISCV_arch`, or with any other extension       | refused; the reason names the extensions outside the decoded set                                                     |
+| ELF32 single-float ABI (ilp32f)                                                  | refused until its [written policy](#ilp32f) is implemented and verified                                              |
+| ELF64 soft- or single-float ABI (lp64, lp64f), or the quad-float ABI             | refused; no verified calling-convention policy                                                                       |
+| Big-endian                                                                       | refused; Ghidra 12.1.4 ships no big-endian RISC-V language                                                           |
+| `ET_REL`, `ET_DYN`, other `e_type`                                               | refused with the declared value                                                                                      |
+| `EF_RISCV_RVE`                                                                   | refused; the embedded 16-register profile (x0–x15) needs its own processor specification                             |
+| `EF_RISCV_TSO`                                                                   | refused; the total-store-order memory model is unverified here                                                       |
+| Reserved or newer `e_flags` bits                                                 | refused with the offending bits named                                                                                |
+| One NOBITS section covering a code section from its start                        | admitted if no other section overlaps either; REA prepares the [memory map](#load-layout) before analysis            |
+| Any other section overlap involving executable code                              | refused; the reason names the two sections that cause the refusal, with their ranges                                 |
+| A section table that cannot be read, or with more than 65,280 allocated sections | refused with the read failure or the count; REA rejects most malformed tables when it opens the file                 |
+
+`e_type` and the [section overlaps](#load-layout) are the load-shape
+declarations this lane reads; program headers are not. A fixed-address
 `ET_EXEC` declaration does **not** establish static linkage: `PT_INTERP` and
 dynamic dependencies are not inspected, and the session records that boundary as
 a limitation rather than inferring a load model.
@@ -246,7 +250,98 @@ other extension is refused. In particular:
 ESP-IDF builds ESP32-C2 and C3 images as `rv32imc_zicsr_zifencei` and ESP32-C5,
 C6, C61, H2 and H21 images as `rv32imac_zicsr_zifencei_zaamo_zalrsc`, all ilp32.
 Those base strings are admitted. Builds that add `_zba_zbb_zbs`,
-`_zcb_zcmp_zcmt` or an `xesp` extension are refused.
+`_zcb_zcmp_zcmt` or an `xesp` extension are refused. These images also reserve
+their flash text's addresses; [load layout](#load-layout) states which layouts
+the lane admits.
+
+## Load layout
+
+Section addresses are load addresses in a fixed-address image, so the target
+reader also checks whether an executable section shares allocated addresses
+with another section. The check keeps at most 65,280 allocated sections
+(`SHN_LORESERVE`); a table with more is refused like a table that cannot be
+read. ESP-IDF builds such overlaps. For ESP32-C5, C6, C61, H2, H21
+and H4, flash text and rodata share one virtual window from `0x42000020`, and
+the linker script reserves the text's addresses in the rodata segment with the
+NOBITS section `.flash_rodata_dummy`. For C5 and C61, a second NOBITS section,
+`.ext_ram.dummy`, also reserves the text and rodata addresses for external RAM.
+Ghidra 12.1.4's ELF loader resolves overlapping sections in favour of the later
+one: the reservation takes the default address space and `.flash.text` goes
+into an overlay space. Ghidra's DWARF importer, its call-frame (FDE) processing
+and references from other code and data resolve ELF virtual addresses in the
+default space only. Without
+preparation, code in that overlay gets no DWARF signature, local variables or
+`DW_AT_noreturn` flag, each of its functions gets a one-byte shadow function in
+the reservation, and pseudocode continues past calls to no-return functions
+such as `esp_restart`.
+
+When one NOBITS section starts at an executable PROGBITS section's address and
+covers it, and no other section overlaps either, the lane commits both sections
+to the analysis profile as `elf_load_preparation` (policy
+`nobits-reservation-overlay-v1`). Before auto-analysis,
+`ReaGhidraPrepareElfLoad.java` gives the code the default address space and the
+reservation an uninitialized overlay instead:
+
+- The file bytes and their offsets do not change. A new default-space block maps
+  the code's file range, and the overlay maps no file bytes, so each file offset
+  keeps one address.
+- The loader's symbols and functions move with the code, and so do the
+  references into it: its entry points and the loader's section-header
+  reference. So does everything else in the code's overlay space, such as
+  ESP-IDF's section-relative `_etext` just past the code's last byte. Ghidra
+  pins absolute ELF symbols such as `_text_start`; they keep their addresses.
+- Labels in the reservation, such as `_flash_rodata_dummy_start`, move into its
+  overlay. They mark no entry points, because the reservation holds no code. An
+  entry mark that Ghidra's loader gave such a label stays at its default-space
+  address. Inside the code, Ghidra could start a function at that mark; REA
+  neither removes nor checks it. No surveyed image has such a mark
+  (source-derived).
+- Flash code therefore has its ELF address, for example `0x42002ab6` rather than
+  `.flash.text:0x42002ab6`.
+- The reservation's overlay space takes the name that Ghidra's memory map gives
+  an overlay block: `:` and whitespace become `_`, and a name that another
+  address space already has gains `.1`, `.2` and so on. A reservation named
+  `ram`, the RISC-V default space's name, therefore gets the space `ram.1`.
+  Section names are display labels, so no name causes a refusal.
+
+Before it reports `moved`, the script checks that no symbol or reference
+remains in the code's old overlay space. It reports `canonical` when Ghidra
+already loaded the code in the default space, which happens when the reservation
+comes first in the section table. The `moved` report echoes both blocks the
+script left, and `canonical` the code block: name, address, size, the code's
+file offset, and the address space before and after. REA closes the session
+unless each address, size and file offset is the committed section's, and the
+spaces agree with the outcome: moved code goes from an overlay into the default
+space and the reservation out of it, and canonical code stays in the default
+space. Block names are display only and are not compared. The script refuses
+any other memory map, and REA refuses the session with the mismatch. A refusal
+also turns off Ghidra's headless auto-analysis, so Ghidra does not analyze a
+program that REA discards; later pre-scripts and the bridge still run, so the
+session reports the reason. If Ghidra
+fails during the move, the session is also refused. Ghidra probably rolls back
+the failed script's changes, its refusal included, so the reason may be missing
+(inferred; not tested). Session Evidence states the preparation and its
+outcome.
+
+The lane refuses any other overlap that involves executable code. Examples are
+two code sections at one address, a reservation that does not cover the code, a
+third section that overlaps the reservation, and a second reservation such as
+`.ext_ram.dummy`. The reason names the two sections that cause the refusal,
+with their ranges. Overlaps between data sections only are outside this check,
+and so are images without a section table, which Ghidra loads from their
+program headers.
+
+ESP-IDF v5.5.2's C5 and C61 builds declare `.ext_ram.dummy`, so this lane
+refuses them. To analyze such a build, make a transformed copy without that
+section header:
+
+```sh
+llvm-objcopy --remove-section=.ext_ram.dummy app.elf app-no-ext-ram-dummy.elf
+```
+
+The copy has the prepared shape. REA admitted and prepared such a copy of a
+v5.5.2 C5 `hello_world` build; C61 copies were not tried. Evidence identifies
+the copy, not the original image.
 
 ## Evidence
 
@@ -258,7 +353,9 @@ booleans `float_abi_double`, `rvc_declared`, `rve_declared`, and
 report declarations the header and attributes make, and the policy REA applied;
 none of them is evidence of the original compiler or of instruction
 conformance. Session Evidence states the prototype and how many functions and
-definitions use it.
+definitions use it. An image that needs the [load layout](#load-layout)
+preparation also commits `elf_load_preparation`: the policy, each section's
+index, name, address and size, and the code's file offset.
 
 ## Verification and limits
 
@@ -282,7 +379,7 @@ REA_RISCV_OBJDUMP=/path/to/llvm/bin/llvm-objdump \
 npm run verify:ghidra:riscv
 ```
 
-The lane builds four `ET_EXEC` fixtures from committed freestanding C and
+The lane builds seven `ET_EXEC` fixtures from committed freestanding C and
 assembly sources:
 
 - RV32 and RV64 double-float builds (`rv{32,64}imafdc`) of `riscv.c`.
@@ -290,6 +387,16 @@ assembly sources:
   `-march=rv32imc_zicsr_zifencei -mabi=ilp32`, typed with DWARF.
 - The same objects linked with `--strip-all`. Every allocated section keeps
   its address and bytes, so the typed build's symbols locate its functions.
+- An RV32 soft-float build of `riscv-esp-layout.c` with ESP32-C6's
+  `-march=rv32imac_zicsr_zifencei -mabi=ilp32`, linked with
+  `tests/conformance/esp/esp32c6-shared-window.ld`. As ESP-IDF does, it places
+  `.flash.text` and the NOBITS `.flash_rodata_dummy` at `0x42000020`, with the
+  absolute `_text_start` and `_text_end`, the section-relative `_etext` and the
+  reservation's `_flash_rodata_dummy_start`.
+- The same objects linked with `esp32c6-reservation-first.ld`, which puts the
+  reservation before the code in the section table.
+- The same objects linked with `esp32c6-reservation-named-ram.ld`, which names
+  the reservation `ram`, as the default address space is named.
 
 Independent LLVM readelf observations establish ELF declarations,
 `Tag_RISCV_arch` and symbol addresses. Public CLI and stdio MCP workflows verify
@@ -315,6 +422,35 @@ For the soft-float builds the lane also checks:
 - Retained Evidence states the prototype outcome; the stripped build has no
   function definitions.
 
+For the ESP layout build the lane checks:
+
+- The profile commits the two sections LLVM readelf reports.
+- The load image maps `.flash.text` initialized and executable in the default
+  space, with the reservation as an uninitialized overlay. Only the moved block
+  maps the code's file bytes, and a `file-offset:` selector reaches the flash
+  function at that offset.
+- No entry point has an overlay address, and each flash function keeps its
+  entry mark. `_text_start` and `_text_end` keep their addresses, `_etext` is
+  at the code's end in the default space, and `_flash_rodata_dummy_start` is in
+  the reservation's overlay.
+- Every procedure keeps its ELF address, which selects it. The pseudocode of a
+  flash function that ends by calling a `noreturn` function stops at that call.
+  A flash function's pseudocode names its DWARF parameters, and an IRAM
+  function's call reaches flash code.
+- The outcome states the four moved functions, the entry points the load image
+  reports in the code's range and the one overlay label. Retained Evidence
+  keeps it, and the reopened snapshot lists the same procedures.
+- A copy whose reservation is smaller than the code is refused over CLI and
+  MCP, with the reservation named. `analyzeHeadless` with a code file offset one
+  byte off makes the pre-analysis script refuse, and Ghidra then runs no
+  auto-analysis.
+
+The reservation-first build reports `canonical`: Ghidra loads its code in the
+default space, and REA changes nothing. In the build whose reservation is named
+`ram`, `analyzeHeadless` reports `moved`, with the reservation in the overlay
+space `ram.1`. A copy of the RV32 double-float build
+with a truncated section table is refused when REA opens it.
+
 Header-mutated copies check admission. The RV32 double-float image relabelled as
 soft-float (`e_flags` `0x1`), refused before this lane, is admitted through the
 soft-float lane over CLI and MCP. The soft-float image relabelled as
@@ -322,8 +458,9 @@ single-float, RV64 soft-float, and unsupported high bits are refused with their
 reasons. Failures retain the diagnostic workspace; successful runs remove it and
 report the observed process lineage.
 
-Module tests cover admission, malformed headers and attribute sections, the
-handshake, and the conformance checks against recorded LLVM and Ghidra output.
+Module tests cover admission, malformed headers, attribute sections and section
+overlaps, the handshake, and the conformance checks against recorded LLVM and
+Ghidra output.
 Call-graph completeness, string inventories, dynamic linkage, Andes or RVE/TSO
 images, big-endian targets, ilp32f images, and decoding beyond the probes are
 **not** established by this lane.
diff --git a/package.json b/package.json
index 1649b6c00fd..9b3751da9a5 100644
--- a/package.json
+++ b/package.json
@@ -68,6 +68,7 @@
     "bridge/ghidra/ReaGhidraRiscvCallingConvention.java",
     "bridge/ghidra/ReaGhidraPrepareRaw.java",
     "bridge/ghidra/ReaGhidraPrepareDol.java",
+    "bridge/ghidra/ReaGhidraPrepareElfLoad.java",
     "bridge/android/ReaJadxBridge.java",
     "bridge/mitmproxy/capture.py",
     "bridge/agentenv/capture.py",
diff --git a/scripts/verify-real-ghidra-riscv.mjs b/scripts/verify-real-ghidra-riscv.mjs
index 7a83878d665..1d2742326c2 100644
--- a/scripts/verify-real-ghidra-riscv.mjs
+++ b/scripts/verify-real-ghidra-riscv.mjs
@@ -536,6 +536,518 @@ try {
       original_unchanged: true,
     });
   }
+  // ESP-IDF's flash layout: the NOBITS .flash_rodata_dummy reserves
+  // .flash.text's addresses. Ghidra 12.1.4's loader puts such code in an overlay
+  // that DWARF import and default-space references never reach, unless REA
+  // prepares the memory map before analysis.
+  const esp = await buildRiscvFixture(workspace, 32, "esp");
+  assert.equal(esp.riscv.sectionOverlap.status, "code-reservation");
+  const resolvedEsp = await parseBinaryTarget(esp.path);
+  if (!resolvedEsp.ok) throw resolvedEsp.error;
+  assert.deepEqual(resolvedEsp.value.riscv, esp.riscv);
+  const { code, reservation } = esp.riscv.sectionOverlap;
+  const plan = { policy: "nobits-reservation-overlay-v1", code, reservation };
+  // ESP-IDF's text bounds are absolute; the reservation's label is not.
+  assert.equal(esp.linkerSymbols._text_start?.section, "ABS");
+  assert.equal(esp.linkerSymbols._text_end?.section, "ABS");
+  assert.equal(esp.linkerSymbols._etext?.section, code.index);
+  assert.equal(
+    esp.linkerSymbols._flash_rodata_dummy_start?.section,
+    reservation.index,
+  );
+  /** MCP calls on an ESP layout, collecting the limitations Ghidra reports. */
+  const layoutCaller =
+    (fixture, limitations) =>
+    async (name, args = {}) => {
+      const reply = await client.callTool(
+        { name, arguments: args },
+        { timeout: 240000 },
+      );
+      const lifecycle = ["open_binary", "close_binary"].includes(name);
+      const admitted = lifecycle
+        ? requireMcpLifecycleResult(reply, name)
+        : parseEvidence(requireMcpOutput(reply, name));
+      const validate = validators.get(name);
+      assert.ok(
+        validate(JSON.parse(mcpTextValue(reply))),
+        `${name}: ${JSON.stringify(validate.errors)}`,
+      );
+      if (lifecycle) return admitted;
+      assert.equal(admitted.subject.digest.sha256, fixture.sha256);
+      if (admitted.provider.id === "ghidra") {
+        assert.deepEqual(
+          admitted.analysis_profile.parameters.elf_load_preparation,
+          {
+            policy: "nobits-reservation-overlay-v1",
+            code: fixture.riscv.sectionOverlap.code,
+            reservation: fixture.riscv.sectionOverlap.reservation,
+          },
+        );
+        for (const limitation of admitted.limitations)
+          limitations.add(limitation);
+      }
+      return admitted.normalized_result;
+    };
+  const espLimitations = new Set();
+  const espCall = layoutCaller(esp, espLimitations);
+  await espCall("open_binary", { path: esp.path, provider_id: "ghidra" });
+  const espImage = await espCall("inspect_native_load_image");
+  const blocks = (name) =>
+    espImage.observations.mappings.filter((value) => value.block === name);
+  const [text] = blocks(code.name);
+  assert.ok(text, `${code.name} missing from the load image`);
+  assert.equal(text.address_space, espImage.observations.default_address_space);
+  assert.equal(text.overlay, false);
+  assert.equal(text.executable, true);
+  assert.equal(text.start, code.address);
+  assert.equal(text.file_offset, Number(BigInt(code.offset)));
+  const [held] = blocks(reservation.name);
+  assert.ok(held, `${reservation.name} missing from the load image`);
+  assert.equal(held.overlay, true);
+  assert.equal(held.initialized, false);
+  assert.ok(
+    !espImage.observations.mappings.some(
+      (value) => value.overlay && value.executable && value.initialized,
+    ),
+    "Initialized executable code remains in an overlay",
+  );
+  // Only the moved block maps any of the code's file bytes.
+  assert.deepEqual(
+    espImage.observations.mappings
+      .filter(
+        (value) =>
+          value.file_offset !== null &&
+          value.file_offset < text.file_offset + text.length &&
+          text.file_offset < value.file_offset + value.length,
+      )
+      .map((value) => value.block),
+    [code.name],
+  );
+  // Ghidra marks every global ELF symbol as an entry point. None remains in
+  // an overlay: flash entry points move with the code, and the reservation's
+  // label marks none.
+  const entries = espImage.observations.entry_points;
+  assert.ok(
+    entries.every((value) => /^0x[\da-f]+$/u.test(value)),
+    JSON.stringify(entries),
+  );
+  for (const name of [
+    "rea_riscv_esp_main",
+    "rea_riscv_esp_restart",
+    "rea_riscv_esp_sum",
+    "rea_riscv_esp_next",
+  ])
+    assert.ok(
+      entries.includes(esp.symbols[name]),
+      `${name} lost its entry mark`,
+    );
+  assert.ok(entries.includes(esp.linkerSymbols._text_end.address));
+  const codeEnd = BigInt(code.address) + BigInt(code.size);
+  const codeEntries = entries.filter(
+    (value) => BigInt(value) >= BigInt(code.address) && BigInt(value) < codeEnd,
+  ).length;
+  const espNames = await espCall("list_names");
+  const nameAt = (name) =>
+    espNames
+      .filter((value) => value.value === name)
+      .map((value) => value.address);
+  // Pinned absolute symbols keep their default-space addresses.
+  assert.deepEqual(nameAt("_text_start"), [code.address]);
+  assert.deepEqual(nameAt("_text_end"), [esp.linkerSymbols._text_end.address]);
+  assert.equal(
+    esp.linkerSymbols._text_end.address,
+    `0x${codeEnd.toString(16)}`,
+  );
+  // A label past the code's last byte leaves the code's overlay space too.
+  assert.deepEqual(nameAt("_etext"), [esp.linkerSymbols._text_end.address]);
+  assert.deepEqual(nameAt("_flash_rodata_dummy_start"), [
+    `${reservation.name}:${reservation.address}`,
+  ]);
+  const espProcedures = await espCall("list_procedures");
+  // Every procedure, flash code included, keeps its ELF address in the default space.
+  assert.ok(
+    espProcedures.every((value) => /^0x[\da-f]+$/u.test(value.address)),
+    JSON.stringify(espProcedures.map((value) => value.address)),
+  );
+  for (const name of [
+    "rea_riscv_esp_entry",
+    "rea_riscv_esp_main",
+    "rea_riscv_esp_restart",
+    "rea_riscv_esp_sum",
+    "rea_riscv_esp_next",
+  ])
+    assert.equal(
+      espProcedures.find((value) => value.value === name)?.address,
+      esp.symbols[name],
+      `${name} missing from the Ghidra inventory at its ELF address`,
+    );
+  // The ELF address of flash code selects the procedure itself.
+  const espMain = await espCall("procedure_pseudo_code", {
+    procedure: esp.symbols.rea_riscv_esp_main,
+  });
+  assert.match(espMain, /\brea_riscv_esp_main\s*\(void\)/u);
+  assert.match(espMain, /\brea_riscv_esp_restart\(\)/u);
+  // The no-return call ends the pseudocode before rea_riscv_esp_next's store.
+  assert.doesNotMatch(espMain, /0x5a5a|23130/u);
+  // DWARF reaches flash code: the parameter names come from the image.
+  assert.match(
+    await espCall("procedure_pseudo_code", {
+      procedure: esp.symbols.rea_riscv_esp_sum,
+    }),
+    /\brea_riscv_esp_sum\s*\(int left,\s*int right\)/u,
+  );
+  const entryCallees = await espCall("procedure_callees", {
+    procedure: esp.symbols.rea_riscv_esp_entry,
+  });
+  assert.ok(
+    entryCallees.includes(esp.symbols.rea_riscv_esp_main),
+    `IRAM entry does not call the flash procedure: ${JSON.stringify(entryCallees)}`,
+  );
+  const espMapping = await espCall("address_to_file_offset", {
+    address: esp.symbols.rea_riscv_esp_main,
+  });
+  const mainOffset =
+    BigInt(code.offset) +
+    BigInt(esp.symbols.rea_riscv_esp_main) -
+    BigInt(code.address);
+  assert.equal(BigInt(espMapping.file_offset), mainOffset);
+  // One block maps each file offset, so a file-offset selector is not ambiguous.
+  assert.match(
+    await espCall("procedure_pseudo_code", {
+      procedure: `file-offset:0x${mainOffset.toString(16)}`,
+    }),
+    /\brea_riscv_esp_main\s*\(void\)/u,
+  );
+  const espSnapshotPath = join(workspace, "rv32-esp.snapshot.json");
+  const espSaved = await espCall("close_binary", {
+    snapshot_path: espSnapshotPath,
+  });
+  assert.ok(espSaved.evidence_records > 0);
+  const espSnapshot = parseAnalysisSnapshot(
+    JSON.parse(await readFile(espSnapshotPath, "utf8")),
+  );
+  assert.equal(espSnapshot.target.sha256, esp.sha256);
+  assert.deepEqual(
+    espSnapshot.binding.analysis_profile.parameters.elf_load_preparation,
+    plan,
+  );
+  const space = espImage.observations.default_address_space;
+  const outcome = `RISC-V load preparation outcome: before analysis REA moved \`${code.name}\` from overlay space \`${code.name}\` into default space \`${space}\`, with the same file bytes and offsets, and kept \`${reservation.name}\` as uninitialized overlay space \`${reservation.name}\`. Functions in the moved block: 4; entry points: ${codeEntries}; labels in the overlay: 1.`;
+  // The fixture's four flash functions move; its IRAM entry stays.
+  assert.ok(espLimitations.has(outcome), [...espLimitations].join("\n"));
+  assert.ok(
+    espSnapshot.evidence_bundle.records.some((record) =>
+      parseEvidence(record).limitations.includes(outcome),
+    ),
+    "The preparation outcome is missing from retained Evidence",
+  );
+  await espCall("open_binary", {
+    path: esp.path,
+    provider_id: "ghidra",
+    snapshot_path: espSnapshotPath,
+  });
+  assert.deepEqual(await espCall("list_procedures"), espProcedures);
+  await espCall("close_binary");
+  assert.ok(
+    [...espLimitations].some((value) =>
+      value.startsWith(
+        "RISC-V ELF load layout: NOBITS section `.flash_rodata_dummy` reserves the addresses of executable section `.flash.text`",
+      ),
+    ),
+  );
+  const espCli = parseEvidence(
+    JSON.parse(
+      (
+        await execute(
+          process.execPath,
+          [
+            entrypoint,
+            "function",
+            esp.path,
+            "rea_riscv_esp_main",
+            "--provider",
+            "ghidra",
+            "--json",
+          ],
+          { env, timeout: 240000, maxBuffer: 16 * 1024 * 1024 },
+        )
+      ).stdout,
+    ),
+  );
+  assert.equal(
+    espCli.normalized_result.procedure.address,
+    esp.symbols.rea_riscv_esp_main,
+  );
+  assert.doesNotMatch(espCli.normalized_result.pseudocode, /0x5a5a|23130/u);
+  assert.deepEqual(
+    espCli.analysis_profile.parameters.elf_load_preparation,
+    plan,
+  );
+  // A reservation smaller than the code is not the verified shape.
+  const shrunkPath = join(workspace, "rv32-esp-short-reservation.elf");
+  const shrunk = Buffer.from(await readFile(esp.path));
+  shrunk.writeUInt32LE(
+    Number(BigInt(code.size)) - 2,
+    shrunk.readUInt32LE(32) + reservation.index * 40 + 20,
+  );
+  await writeFile(shrunkPath, shrunk);
+  const refusal = `\`${reservation.name}\` (NOBITS, ${reservation.address}, 0x${(
+    BigInt(code.size) - 2n
+  ).toString(16)} bytes) share addresses`;
+  const refused = requireMcpToolError(
+    await client.callTool(
+      {
+        name: "open_binary",
+        arguments: { path: shrunkPath, provider_id: "ghidra" },
+      },
+      { timeout: 240000 },
+    ),
+  );
+  assert.ok(JSON.stringify(refused).includes(refusal), JSON.stringify(refused));
+  await assert.rejects(
+    execute(
+      process.execPath,
+      [
+        entrypoint,
+        "function",
+        shrunkPath,
+        "rea_riscv_esp_main",
+        "--provider",
+        "ghidra",
+        "--json",
+      ],
+      { env, timeout: 240000, maxBuffer: 16 * 1024 * 1024 },
+    ),
+    (cause) =>
+      Number.isInteger(cause.code) &&
+      cause.code !== 0 &&
+      `${cause.stdout}\n${cause.stderr}`.includes(refusal),
+  );
+  // The pre-analysis script refuses a code block whose file mapping is not the
+  // committed one; REA's admission would never commit this plan. Ghidra then
+  // skips auto-analysis of the program REA discards.
+  const javaRefusal = join(workspace, "java-refusal");
+  await mkdir(join(javaRefusal, "tmp"), { recursive: true });
+  const headless = await execute(
+    join(installation.installDir, "support", "analyzeHeadless"),
+    [
+      javaRefusal,
+      "refusal",
+      "-import",
+      esp.path,
+      "-processor",
+      "RISCV:LE:32:default",
+      "-cspec",
+      "gcc",
+      "-scriptPath",
+      fileURLToPath(new URL("../bridge/ghidra/", import.meta.url)),
+      "-preScript",
+      "ReaGhidraPrepareElfLoad.java",
+      plan.policy,
+      code.address,
+      code.size,
+      `0x${(BigInt(code.offset) + 1n).toString(16)}`,
+      reservation.address,
+      reservation.size,
+      "-deleteProject",
+    ],
+    {
+      env: { ...env, TMPDIR: join(javaRefusal, "tmp") },
+      timeout: 300000,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  assert.ok(
+    `${headless.stdout}\n${headless.stderr}`.includes(
+      `REA ELF load preparation refused: Ghidra has 0 initialized executable blocks for the committed executable section ${code.address} (${code.size} bytes at file offset 0x${(BigInt(code.offset) + 1n).toString(16)})`,
+    ),
+    headless.stdout,
+  );
+  assert.ok(
+    !`${headless.stdout}\n${headless.stderr}`.includes("ANALYZING"),
+    headless.stdout,
+  );
+  assert.equal(
+    createHash("sha256")
+      .update(await readFile(esp.path))
+      .digest("hex"),
+    esp.sha256,
+  );
+
+  // A reservation named like the default space still moves into an overlay
+  // space, named as Ghidra's memory map names overlay blocks.
+  const named = await buildRiscvFixture(
+    workspace,
+    32,
+    "esp-reservation-named-ram",
+  );
+  assert.equal(named.riscv.sectionOverlap.status, "code-reservation");
+  assert.equal(named.riscv.sectionOverlap.reservation.name, "ram");
+  const namedProject = join(workspace, "java-named-ram");
+  await mkdir(join(namedProject, "tmp"), { recursive: true });
+  const namedRun = await execute(
+    join(installation.installDir, "support", "analyzeHeadless"),
+    [
+      namedProject,
+      "named",
+      "-import",
+      named.path,
+      "-processor",
+      "RISCV:LE:32:default",
+      "-cspec",
+      "gcc",
+      "-noanalysis",
+      "-scriptPath",
+      fileURLToPath(new URL("../bridge/ghidra/", import.meta.url)),
+      "-preScript",
+      "ReaGhidraPrepareElfLoad.java",
+      plan.policy,
+      named.riscv.sectionOverlap.code.address,
+      named.riscv.sectionOverlap.code.size,
+      named.riscv.sectionOverlap.code.offset,
+      named.riscv.sectionOverlap.reservation.address,
+      named.riscv.sectionOverlap.reservation.size,
+      "-deleteProject",
+    ],
+    {
+      env: { ...env, TMPDIR: join(namedProject, "tmp") },
+      timeout: 300000,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  const namedReport = /REA ELF load preparation: (\{.*\})/u.exec(
+    namedRun.stdout,
+  );
+  assert.ok(namedReport !== null, namedRun.stdout);
+  const namedOutcome = JSON.parse(namedReport[1]);
+  assert.equal(namedOutcome.outcome, "moved", namedReport[1]);
+  assert.equal(namedOutcome.reservation.name, "ram");
+  assert.equal(namedOutcome.reservation.space_after, "ram.1");
+
+  // Sections named like the temporary blocks, the reservation among them, do
+  // not refuse the image, and the move still takes place.
+  const edge = await buildRiscvFixture(workspace, 32, "esp-edge-names");
+  assert.equal(edge.riscv.sectionOverlap.status, "code-reservation");
+  assert.equal(edge.riscv.sectionOverlap.reservation.name, ".flash.text.rea");
+  const edgeLimitations = new Set();
+  const edgeCall = layoutCaller(edge, edgeLimitations);
+  await edgeCall("open_binary", { path: edge.path, provider_id: "ghidra" });
+  const edgeImage = await edgeCall("inspect_native_load_image");
+  assert.ok(
+    edgeImage.observations.mappings.some(
+      (value) => value.block === ".flash.text.rea.1" && value.overlay === false,
+    ),
+    JSON.stringify(edgeImage.observations.mappings),
+  );
+  const [edgeText] = edgeImage.observations.mappings.filter(
+    (value) => value.block === edge.riscv.sectionOverlap.code.name,
+  );
+  assert.equal(
+    edgeText?.overlay,
+    false,
+    JSON.stringify(edgeImage.observations.mappings),
+  );
+  await edgeCall("close_binary");
+  assert.ok(
+    [...edgeLimitations].some((value) =>
+      value.startsWith(
+        "RISC-V load preparation outcome: before analysis REA moved",
+      ),
+    ),
+    [...edgeLimitations].join("\n"),
+  );
+
+  // With the reservation first, Ghidra already loads the code in the default
+  // space, and the preparation changes nothing.
+  const first = await buildRiscvFixture(workspace, 32, "esp-reservation-first");
+  assert.equal(first.riscv.sectionOverlap.status, "code-reservation");
+  assert.ok(
+    first.riscv.sectionOverlap.reservation.index <
+      first.riscv.sectionOverlap.code.index,
+  );
+  const firstLimitations = new Set();
+  const firstCall = layoutCaller(first, firstLimitations);
+  await firstCall("open_binary", { path: first.path, provider_id: "ghidra" });
+  const firstImage = await firstCall("inspect_native_load_image");
+  const [firstText] = firstImage.observations.mappings.filter(
+    (value) => value.block === code.name,
+  );
+  assert.equal(firstText?.overlay, false);
+  assert.equal(firstText.start, first.riscv.sectionOverlap.code.address);
+  const firstProcedures = await firstCall("list_procedures");
+  for (const name of ["rea_riscv_esp_main", "rea_riscv_esp_sum"])
+    assert.equal(
+      firstProcedures.find((value) => value.value === name)?.address,
+      first.symbols[name],
+    );
+  await firstCall("close_binary");
+  assert.ok(
+    firstLimitations.has(
+      `RISC-V load preparation outcome: Ghidra loaded \`${code.name}\` in default space \`${firstImage.observations.default_address_space}\`, so REA changed nothing.`,
+    ),
+    [...firstLimitations].join("\n"),
+  );
+  assert.ok(
+    ![...firstLimitations].some((value) => /REA (?:moves|moved)/u.test(value)),
+  );
+
+  // A double-float lane reads no ISA declaration, but REA still refuses an
+  // image whose section table it cannot read.
+  const [double32] = fixtures;
+  const double32Bytes = await readFile(double32.path);
+  const truncatedPath = join(workspace, "rv32-truncated-section-table.elf");
+  await writeFile(
+    truncatedPath,
+    double32Bytes.subarray(0, double32Bytes.readUInt32LE(32) + 2 * 40),
+  );
+  const truncated = requireMcpToolError(
+    await client.callTool(
+      {
+        name: "open_binary",
+        arguments: { path: truncatedPath, provider_id: "ghidra" },
+      },
+      { timeout: 240000 },
+    ),
+  );
+  assert.ok(
+    JSON.stringify(truncated).includes("truncated ELF section header table"),
+    JSON.stringify(truncated),
+  );
+  reports.push({
+    esp_layout: {
+      path: esp.path,
+      sha256: esp.sha256,
+      riscv: esp.riscv,
+      toolchain: esp.toolchain,
+      sources: esp.sources,
+      preparation: outcome,
+      procedures: espProcedures.length,
+      entry_points: entries.length,
+      snapshot_replay: true,
+      refused_short_reservation: true,
+      refused_by_preparation_script: true,
+      refusal_skips_analysis: true,
+      reservation_named_ram: {
+        path: named.path,
+        sha256: named.sha256,
+        space_after: namedOutcome.reservation.space_after,
+      },
+      edge_names: {
+        path: edge.path,
+        sha256: edge.sha256,
+      },
+      reservation_first: {
+        path: first.path,
+        sha256: first.sha256,
+        riscv: first.riscv,
+        procedures: firstProcedures.length,
+      },
+      refused_truncated_section_table: true,
+      cli: true,
+      stdio_mcp: true,
+      original_unchanged: true,
+    },
+  });
   reports.push({
     call_sites: {
       fixture: typedSoft.path,
diff --git a/src/application/BinaryTargetResolver.ts b/src/application/BinaryTargetResolver.ts
index 819d7acf20f..1aab542b9c3 100644
--- a/src/application/BinaryTargetResolver.ts
+++ b/src/application/BinaryTargetResolver.ts
@@ -48,7 +48,7 @@ import {
   validateElfDeclaredRanges,
   type ElfDeclarationRead,
 } from "../domain/elfDeclaredRanges.js";
-import { readRiscvIsaDeclaration } from "../domain/riscvIsaDeclaration.js";
+import { readRiscvElfDeclarations } from "../domain/riscvIsaDeclaration.js";
 import {
   resolveAppleBundleExecutable,
   type ResolvedAppBundle,
@@ -1160,6 +1160,8 @@ const readExecutableMetadata = async (
   return parsed;
 };
 
+const ET_EXEC = 2;
+
 /** ELF structure and family declarations share one descriptor before provider selection. */
 const readElfMetadata = async (
   handle: FileHandle,
@@ -1185,12 +1187,15 @@ const readElfMetadata = async (
       ...parsed.value,
       riscv: {
         ...parsed.value.riscv,
-        isa: await readElfDeclarations(
+        ...(await readElfDeclarations(
           handle,
           bytes,
-          readRiscvIsaDeclaration(bytes, fileSize),
+          readRiscvElfDeclarations(bytes, fileSize, {
+            // Section addresses are load addresses only in fixed-address images.
+            sectionOverlap: parsed.value.riscv.type === ET_EXEC,
+          }),
           signal,
-        ),
+        )),
       },
     });
   if (parsed.value.architecture !== "mips" || parsed.value.mips.elfClass !== 32)
diff --git a/src/domain/binaryTargetTypes.ts b/src/domain/binaryTargetTypes.ts
index 755912e2039..f88b1f6906c 100644
--- a/src/domain/binaryTargetTypes.ts
+++ b/src/domain/binaryTargetTypes.ts
@@ -91,8 +91,46 @@ export interface MipsElfMetadata extends ElfFamilyMetadata {
 export interface RiscvElfMetadata extends ElfFamilyMetadata {
   /** Undefined until `.riscv.attributes` is inspected. */
   readonly isa?: RiscvIsaDeclaration;
+  /** Undefined until the section table is inspected; read for ET_EXEC only. */
+  readonly sectionOverlap?: ElfSectionOverlap;
 }
 
+/** One allocated section as its header declares it; values are lowercase 0x-hex. */
+export interface ElfSectionExtent {
+  readonly index: number;
+  /** Display only; null when the section-name table was not read. */
+  readonly name: string | null;
+  readonly address: string;
+  readonly size: string;
+}
+
+/** A section that takes part in an overlap of another shape. */
+export interface ElfSectionWitness extends ElfSectionExtent {
+  readonly nobits: boolean;
+  readonly executable: boolean;
+}
+
+/**
+ * Allocated address ranges that an executable section of a fixed-address image
+ * shares with another section. `code-reservation` is the one verified shape: a
+ * NOBITS section that starts with an executable PROGBITS section and covers it,
+ * with no other section overlapping either, as ESP-IDF's `.flash_rodata_dummy`
+ * reserves `.flash.text`.
+ */
+export type ElfSectionOverlap =
+  | { readonly status: "none" }
+  | {
+      readonly status: "code-reservation";
+      readonly code: ElfSectionExtent & { readonly offset: string };
+      readonly reservation: ElfSectionExtent;
+    }
+  /** The two sections whose overlap departs from that shape. */
+  | {
+      readonly status: "unsupported";
+      readonly witnesses: readonly [ElfSectionWitness, ElfSectionWitness];
+    }
+  | { readonly status: "unavailable"; readonly reason: string };
+
 /** The ISA an image declares in `.riscv.attributes`; not proof of every instruction. */
 export type RiscvIsaDeclaration =
   | {
diff --git a/src/domain/elfSectionHeader.ts b/src/domain/elfSectionHeader.ts
index a1c09af650e..3530b3d12c1 100644
--- a/src/domain/elfSectionHeader.ts
+++ b/src/domain/elfSectionHeader.ts
@@ -1,5 +1,10 @@
 import { err, ok } from "./result.js";
 
+export type ElfSectionHeader = Extract<
+  ReturnType<typeof readElfSectionHeader>,
+  { readonly ok: true }
+>["value"];
+
 /** Fixed ELF32/ELF64 section declarations; consumers own names, numbering and mapping admission. */
 export const readElfSectionHeader = (
   bytes: Uint8Array,
diff --git a/src/domain/elfSectionOverlap.ts b/src/domain/elfSectionOverlap.ts
new file mode 100644
index 00000000000..e28ce6ddc7d
--- /dev/null
+++ b/src/domain/elfSectionOverlap.ts
@@ -0,0 +1,212 @@
+import type {
+  ElfSectionExtent,
+  ElfSectionOverlap,
+  ElfSectionWitness,
+} from "./binaryTargetTypes.js";
+import type {
+  ElfDeclarationRead,
+  ElfTableDeclarations,
+} from "./elfDeclaredRanges.js";
+import type { ElfSectionHeader } from "./elfSectionHeader.js";
+
+const SHT_NULL = 0;
+const SHT_PROGBITS = 1;
+const SHT_NOBITS = 8;
+const SHF_ALLOC = 0x2n;
+const SHF_EXECINSTR = 0x4n;
+/** Names are display only; a larger section-name table is left unread. */
+const SECTION_NAMES_MAX_BYTES = 64 * 1024;
+/**
+ * The allocated sections the sweep keeps: SHN_LORESERVE, from which ELF counts
+ * sections through section zero. NOBITS headers take no file bytes, so the
+ * file size alone would not bound the records.
+ */
+const ALLOCATED_SECTIONS_MAX = 0xff00;
+
+/** One allocated, non-empty section: the only facts the sweep keeps. */
+interface Allocated {
+  readonly index: number;
+  readonly type: number;
+  readonly executable: boolean;
+  readonly address: bigint;
+  readonly end: bigint;
+  readonly offset: bigint;
+  readonly nameOffset: number;
+}
+
+type Pair = readonly [Allocated, Allocated];
+
+const hex = (value: bigint): string => `0x${value.toString(16)}`;
+
+const overlaps = (first: Allocated, second: Allocated): boolean =>
+  first.address < second.end && second.address < first.end;
+
+/** A NOBITS section that starts with executable PROGBITS and covers it. */
+const isReservation = ([code, reservation]: Pair): boolean =>
+  code.type === SHT_PROGBITS &&
+  code.executable &&
+  reservation.type === SHT_NOBITS &&
+  !reservation.executable &&
+  reservation.address === code.address &&
+  reservation.end >= code.end;
+
+/**
+ * The first two overlaps that involve an executable section, in address order.
+ * Each pair is found once, when its later-starting section is visited, with the
+ * executable section first. The sweep stops at the second pair, so its work
+ * stays O(n log n) on any table.
+ */
+const executableOverlaps = (sorted: readonly Allocated[]): Pair[] => {
+  const pairs: Pair[] = [];
+  // reach[i]: the furthest end of sorted[0..i], which bounds the backward scan.
+  const reach: bigint[] = [];
+  let active: Allocated[] = [];
+  let furthest = -1n;
+  for (const [position, section] of sorted.entries()) {
+    if (section.executable) {
+      for (let earlier = position - 1; earlier >= 0; earlier -= 1) {
+        if (pairs.length >= 2 || (reach[earlier] ?? -1n) <= section.address)
+          break;
+        const other = sorted[earlier];
+        if (other !== undefined && other.end > section.address)
+          pairs.push([section, other]);
+      }
+    } else {
+      active = active.filter((code) => code.end > section.address);
+      for (const code of active.slice(0, 2 - pairs.length))
+        pairs.push([code, section]);
+    }
+    if (pairs.length >= 2) break;
+    if (section.executable) active.push(section);
+    if (section.end > furthest) furthest = section.end;
+    reach.push(furthest);
+  }
+  return pairs;
+};
+
+/**
+ * Collect allocated sections during one section-table pass, then derive the
+ * overlap fact. Section addresses are load addresses only in fixed-address
+ * (`ET_EXEC`) images, so callers collect for those. Overlaps between two
+ * non-executable sections are outside the fact, unless one of them is the
+ * reservation, which then departs from the verified shape.
+ */
+export const elfSectionOverlapCollector = () => {
+  const allocated: Allocated[] = [];
+  let names: ElfSectionHeader | undefined;
+  let exceeded = false;
+  return {
+    visit(
+      section: ElfSectionHeader,
+      index: number,
+      tables: ElfTableDeclarations,
+    ): void {
+      if (index === tables.sections.namesIndex && index !== 0) names = section;
+      if (
+        section.type === SHT_NULL ||
+        (section.flags & SHF_ALLOC) === 0n ||
+        section.size === 0n
+      )
+        return;
+      if (allocated.length === ALLOCATED_SECTIONS_MAX) {
+        exceeded = true;
+        return;
+      }
+      allocated.push({
+        index,
+        type: section.type,
+        executable: (section.flags & SHF_EXECINSTR) !== 0n,
+        address: section.address,
+        end: section.address + section.size,
+        offset: section.offset,
+        nameOffset: section.nameOffset,
+      });
+    },
+    *finish(
+      fileSize: number,
+    ): Generator<ElfDeclarationRead, ElfSectionOverlap, Buffer> {
+      if (exceeded)
+        return {
+          status: "unavailable",
+          reason: `the section table declares more than ${String(ALLOCATED_SECTIONS_MAX)} allocated sections, the most the overlap check keeps`,
+        };
+      const sorted = allocated.sort((first, second) =>
+        first.address === second.address
+          ? first.index - second.index
+          : first.address < second.address
+            ? -1
+            : 1,
+      );
+      const [first, second] = executableOverlaps(sorted);
+      if (first === undefined) return { status: "none" };
+      const [code, reservation] = first;
+      const shaped = isReservation(first);
+      // Only the reservation can reach a third section: the code overlaps one.
+      const intruder =
+        second === undefined && shaped
+          ? sorted.find(
+              (other) =>
+                other !== code &&
+                other !== reservation &&
+                overlaps(reservation, other),
+            )
+          : undefined;
+      const nameOf = yield* readSectionNames(names, fileSize);
+      const extent = (section: Allocated): ElfSectionExtent => ({
+        index: section.index,
+        name: nameOf(section.nameOffset),
+        address: hex(section.address),
+        size: hex(section.end - section.address),
+      });
+      if (second === undefined && shaped && intruder === undefined)
+        return {
+          status: "code-reservation",
+          code: { ...extent(code), offset: hex(code.offset) },
+          reservation: extent(reservation),
+        };
+      const witness = (section: Allocated): ElfSectionWitness => ({
+        ...extent(section),
+        nobits: section.type === SHT_NOBITS,
+        executable: section.executable,
+      });
+      // Name the sections that cause the refusal, not a pair of the verified shape.
+      const [left, right] =
+        intruder !== undefined
+          ? [reservation, intruder]
+          : second !== undefined && shaped
+            ? second
+            : first;
+      return {
+        status: "unsupported",
+        witnesses: [witness(left), witness(right)],
+      };
+    },
+  };
+};
+
+/** Section names for display, or null for each name when the table is unreadable. */
+function* readSectionNames(
+  names: ElfSectionHeader | undefined,
+  fileSize: number,
+): Generator<
+  ElfDeclarationRead,
+  (nameOffset: number) => string | null,
+  Buffer
+> {
+  const unknown = (): null => null;
+  if (
+    names === undefined ||
+    names.type === SHT_NOBITS ||
+    names.size === 0n ||
+    names.size > BigInt(SECTION_NAMES_MAX_BYTES) ||
+    names.offset > BigInt(fileSize) - names.size
+  )
+    return unknown;
+  const size = Number(names.size);
+  const bytes = yield { offset: Number(names.offset), size };
+  if (bytes.length !== size) return unknown;
+  return (start) => {
+    const end = start < size ? bytes.indexOf(0, start) : -1;
+    return end < 0 ? null : bytes.toString("latin1", start, end);
+  };
+}
diff --git a/src/domain/elfSectionTable.ts b/src/domain/elfSectionTable.ts
new file mode 100644
index 00000000000..f2cfdc83049
--- /dev/null
+++ b/src/domain/elfSectionTable.ts
@@ -0,0 +1,51 @@
+import {
+  readElfTableDeclarations,
+  type ElfDeclarationRead,
+  type ElfTableDeclarations,
+} from "./elfDeclaredRanges.js";
+import {
+  readElfSectionHeader,
+  type ElfSectionHeader,
+} from "./elfSectionHeader.js";
+import { err, type Result } from "./result.js";
+
+/**
+ * Visit every declared section header in reads of at most 64 KiB from the
+ * caller's descriptor. The visitor returns a reason to stop with that failure.
+ */
+export function* visitElfSectionHeaders(
+  prefix: Buffer,
+  fileSize: number,
+  visit: (
+    section: ElfSectionHeader,
+    index: number,
+    tables: ElfTableDeclarations,
+  ) => string | undefined,
+): Generator<ElfDeclarationRead, Result<ElfTableDeclarations, string>, Buffer> {
+  const declarations = yield* readElfTableDeclarations(prefix, fileSize);
+  if (!declarations.ok) return declarations;
+  const { header, sections } = declarations.value;
+  const little = header.byteOrder === "little";
+  const perRead = Math.max(1, Math.floor((64 * 1024) / sections.width));
+  for (let index = 0; index < sections.count; index += perRead) {
+    const count = Math.min(perRead, sections.count - index);
+    const size = count * sections.width;
+    const bytes = yield {
+      offset: Number(sections.offset) + index * sections.width,
+      size,
+    };
+    if (bytes.length !== size) return err("truncated ELF section header table");
+    for (let item = 0; item < count; item += 1) {
+      const at = item * sections.width;
+      const parsed = readElfSectionHeader(
+        bytes.subarray(at, at + sections.width),
+        header.elfClass,
+        little,
+      );
+      if (!parsed.ok) return err(parsed.error.message);
+      const failure = visit(parsed.value, index + item, declarations.value);
+      if (failure !== undefined) return err(failure);
+    }
+  }
+  return declarations;
+}
diff --git a/src/domain/riscvIsaDeclaration.ts b/src/domain/riscvIsaDeclaration.ts
index a8d84fa4283..dc67b78b48b 100644
--- a/src/domain/riscvIsaDeclaration.ts
+++ b/src/domain/riscvIsaDeclaration.ts
@@ -1,9 +1,11 @@
-import type { RiscvIsaDeclaration } from "./binaryTargetTypes.js";
-import {
-  readElfTableDeclarations,
-  type ElfDeclarationRead,
-} from "./elfDeclaredRanges.js";
-import { readElfSectionHeader } from "./elfSectionHeader.js";
+import type {
+  ElfSectionOverlap,
+  RiscvIsaDeclaration,
+} from "./binaryTargetTypes.js";
+import type { ElfDeclarationRead } from "./elfDeclaredRanges.js";
+import type { ElfSectionHeader } from "./elfSectionHeader.js";
+import { elfSectionOverlapCollector } from "./elfSectionOverlap.js";
+import { visitElfSectionHeaders } from "./elfSectionTable.js";
 import { err, ok, type Result } from "./result.js";
 
 /** `EF_RISCV_FLOAT_ABI` declarations in `e_flags`, named as the psABI names them. */
@@ -192,69 +194,102 @@ export const riscvIsaDeclaration = (arch: string): RiscvIsaDeclaration => {
 };
 
 /**
- * Find and interpret the image's `SHT_RISCV_ATTRIBUTES` section. Every section
- * header is examined, so an absent declaration is observed, not assumed; two
- * attribute sections leave the declaration unavailable. The caller satisfies
- * each read from its own descriptor.
+ * Find the image's `SHT_RISCV_ATTRIBUTES` section during a section-table pass,
+ * then interpret it. Every section header is examined, so an absent declaration
+ * is observed, not assumed; two attribute sections leave it unavailable.
  */
-export function* readRiscvIsaDeclaration(
-  prefix: Buffer,
-  fileSize: number,
-): Generator<ElfDeclarationRead, RiscvIsaDeclaration, Buffer> {
-  const unavailable = (reason: string): RiscvIsaDeclaration => ({
-    status: "unavailable",
-    reason,
-  });
-  const declarations = yield* readElfTableDeclarations(prefix, fileSize);
-  if (!declarations.ok) return unavailable(declarations.error);
-  const { header, sections } = declarations.value;
-  const little = header.byteOrder === "little";
+const riscvIsaCollector = () => {
   let attributes:
     | { readonly offset: bigint; readonly size: bigint }
     | undefined;
-  const perRead = Math.max(1, Math.floor((64 * 1024) / sections.width));
-  for (let index = 0; index < sections.count; index += perRead) {
-    const count = Math.min(perRead, sections.count - index);
-    const size = count * sections.width;
-    const bytes = yield {
-      offset: Number(sections.offset) + index * sections.width,
-      size,
-    };
-    if (bytes.length !== size)
-      return unavailable("truncated ELF section header table");
-    for (let item = 0; item < count; item += 1) {
-      const at = item * sections.width;
-      const parsed = readElfSectionHeader(
-        bytes.subarray(at, at + sections.width),
-        header.elfClass,
-        little,
-      );
-      if (!parsed.ok) return unavailable(parsed.error.message);
-      if (parsed.value.type !== SHT_RISCV_ATTRIBUTES) continue;
-      if (attributes !== undefined)
+  let duplicated = false;
+  return {
+    visit(section: ElfSectionHeader): void {
+      if (section.type !== SHT_RISCV_ATTRIBUTES) return;
+      if (attributes !== undefined) duplicated = true;
+      else attributes = { offset: section.offset, size: section.size };
+    },
+    *finish(
+      little: boolean,
+      fileSize: number,
+    ): Generator<ElfDeclarationRead, RiscvIsaDeclaration, Buffer> {
+      if (duplicated)
         return unavailable(
           "the image has more than one RISC-V attribute section",
         );
-      attributes = { offset: parsed.value.offset, size: parsed.value.size };
-    }
-  }
-  if (attributes === undefined) return { status: "absent" };
-  if (
-    attributes.size === 0n ||
-    attributes.size > BigInt(RISCV_ATTRIBUTES_MAX_BYTES)
-  )
-    return unavailable(
-      `RISC-V attribute section size ${String(attributes.size)} is outside REA's inspected bound of ${RISCV_ATTRIBUTES_MAX_BYTES} bytes`,
-    );
-  if (attributes.offset > BigInt(fileSize) - attributes.size)
-    return unavailable("RISC-V attribute section lies outside the file");
-  const size = Number(attributes.size);
-  const bytes = yield { offset: Number(attributes.offset), size };
-  if (bytes.length !== size)
-    return unavailable("truncated RISC-V attribute section");
-  const arch = parseRiscvAttributes(bytes, little);
-  if (!arch.ok) return unavailable(arch.error);
-  return arch.value === null
-    ? { status: "absent" }
-    : riscvIsaDeclaration(arch.value);
+      if (attributes === undefined) return { status: "absent" };
+      if (
+        attributes.size === 0n ||
+        attributes.size > BigInt(RISCV_ATTRIBUTES_MAX_BYTES)
+      )
+        return unavailable(
+          `RISC-V attribute section size ${String(attributes.size)} is outside REA's inspected bound of ${RISCV_ATTRIBUTES_MAX_BYTES} bytes`,
+        );
+      if (attributes.offset > BigInt(fileSize) - attributes.size)
+        return unavailable("RISC-V attribute section lies outside the file");
+      const size = Number(attributes.size);
+      const bytes = yield { offset: Number(attributes.offset), size };
+      if (bytes.length !== size)
+        return unavailable("truncated RISC-V attribute section");
+      const arch = parseRiscvAttributes(bytes, little);
+      if (!arch.ok) return unavailable(arch.error);
+      return arch.value === null
+        ? { status: "absent" }
+        : riscvIsaDeclaration(arch.value);
+    },
+  };
+};
+
+const unavailable = (reason: string): RiscvIsaDeclaration => ({
+  status: "unavailable",
+  reason,
+});
+
+/**
+ * The RISC-V declarations the section table makes, from one pass over it: the
+ * ISA, and for fixed-address images the section overlap. The caller satisfies
+ * each read from its own descriptor.
+ */
+export function* readRiscvElfDeclarations(
+  prefix: Buffer,
+  fileSize: number,
+  options: { readonly sectionOverlap: boolean },
+): Generator<
+  ElfDeclarationRead,
+  {
+    readonly isa: RiscvIsaDeclaration;
+    readonly sectionOverlap?: ElfSectionOverlap;
+  },
+  Buffer
+> {
+  const isa = riscvIsaCollector();
+  const overlap = options.sectionOverlap
+    ? elfSectionOverlapCollector()
+    : undefined;
+  const visited = yield* visitElfSectionHeaders(
+    prefix,
+    fileSize,
+    (section, index, tables) => {
+      isa.visit(section);
+      overlap?.visit(section, index, tables);
+      return undefined;
+    },
+  );
+  if (!visited.ok)
+    return {
+      isa: unavailable(visited.error),
+      ...(overlap === undefined
+        ? {}
+        : {
+            sectionOverlap: {
+              status: "unavailable",
+              reason: visited.error,
+            },
+          }),
+    };
+  const little = visited.value.header.byteOrder === "little";
+  const declared = yield* isa.finish(little, fileSize);
+  return overlap === undefined
+    ? { isa: declared }
+    : { isa: declared, sectionOverlap: yield* overlap.finish(fileSize) };
 }
diff --git a/src/ghidra/GhidraAdmissionError.ts b/src/ghidra/GhidraAdmissionError.ts
index 428c0170fa8..e1a6e925a8d 100644
--- a/src/ghidra/GhidraAdmissionError.ts
+++ b/src/ghidra/GhidraAdmissionError.ts
@@ -7,12 +7,14 @@ const GHIDRA_ADMISSION_CODES = [
   "existing_project_language_override",
   "existing_project_mips_soft_float",
   "existing_project_riscv_calling_convention",
+  "existing_project_riscv_load_preparation",
   "existing_project_analysis",
   "gamecube_dol_combined",
   "psp_combined",
   "psp_raw_binary",
   "mips_soft_float_scope",
   "riscv_calling_convention_scope",
+  "riscv_load_preparation_scope",
   "language_override_dos",
   "language_override_raw_binary",
   "raw_binary_dos",
diff --git a/src/ghidra/GhidraBridgeSources.ts b/src/ghidra/GhidraBridgeSources.ts
index 509eaa98116..fa2e63afa3b 100644
--- a/src/ghidra/GhidraBridgeSources.ts
+++ b/src/ghidra/GhidraBridgeSources.ts
@@ -6,6 +6,7 @@ export const GHIDRA_BRIDGE_SOURCES = Object.freeze({
   prepareCom: "ReaGhidraPrepareCom.java",
   prepareRaw: "ReaGhidraPrepareRaw.java",
   prepareDol: "ReaGhidraPrepareDol.java",
+  prepareElfLoad: "ReaGhidraPrepareElfLoad.java",
   applySeeds: "ReaGhidraApplySeeds.java",
   analysisOptions: "ReaGhidraAnalysisOptions.java",
   noReturnFix: "ReaGhidraNoReturnFix.java",
diff --git a/src/ghidra/GhidraLauncher.ts b/src/ghidra/GhidraLauncher.ts
index 2a15f6c5464..0adbcd53cb2 100644
--- a/src/ghidra/GhidraLauncher.ts
+++ b/src/ghidra/GhidraLauncher.ts
@@ -9,7 +9,10 @@ import {
   type GhidraSeedCommitment,
 } from "./GhidraAnalysisSeeds.js";
 import type { GhidraLanguageOverride } from "../config/ghidraLanguageOverride.js";
-import type { GhidraRiscvCallingConvention } from "./GhidraRiscvProfile.js";
+import type {
+  GhidraRiscvCallingConvention,
+  GhidraRiscvLoadPreparation,
+} from "./GhidraRiscvProfile.js";
 import { snapshotEnvironment } from "../process/snapshotEnvironment.js";
 import { copyFile, mkdir, readFile, realpath } from "node:fs/promises";
 import { basename, dirname, join, posix, win32 } from "node:path";
@@ -258,6 +261,8 @@ export interface GhidraHeadlessLauncherOptions {
   readonly mipsSoftFloat?: true;
   /** Apply this committed RISC-V calling-convention policy after analysis. */
   readonly riscvCallingConvention?: GhidraRiscvCallingConvention;
+  /** Prepare the memory map for this committed RISC-V section overlap before analysis. */
+  readonly riscvLoadPreparation?: GhidraRiscvLoadPreparation;
   /** Spawn seam for provider-boundary lifecycle tests. */
   readonly spawnProcess?: typeof spawnOwnedProviderProcess;
   /** LaunchSupport probe seam for Java-free launcher fixtures. */
@@ -449,6 +454,9 @@ export class GhidraHeadlessLauncher implements GhidraLauncher {
           : {
               riscvCallingConvention: this.options.riscvCallingConvention,
             }),
+        ...(this.options.riscvLoadPreparation === undefined
+          ? {}
+          : { riscvLoadPreparation: this.options.riscvLoadPreparation }),
         projectRoot: paths.projectRoot,
         targetPath: session.targetPath,
         ...(existingProject === undefined ? {} : { existingProject }),
@@ -804,6 +812,7 @@ export interface GhidraHeadlessArgumentOptions {
   readonly psp?: true;
   readonly mipsSoftFloat?: true;
   readonly riscvCallingConvention?: GhidraRiscvCallingConvention;
+  readonly riscvLoadPreparation?: GhidraRiscvLoadPreparation;
   readonly dosMz?: true;
   readonly dosCom?: true;
   readonly rawBinary?: {
@@ -834,6 +843,7 @@ type ExistingProjectOptions = Pick<
   | "languageOverride"
   | "mipsSoftFloat"
   | "riscvCallingConvention"
+  | "riscvLoadPreparation"
   | "seedPath"
   | "disabledAnalyzers"
 > & { readonly analysisSeeds?: GhidraSeedCommitment };
@@ -866,6 +876,8 @@ const validateExistingProjectOptions = (
       throw new GhidraAdmissionError(
         "existing_project_riscv_calling_convention",
       );
+    if (options.riscvLoadPreparation !== undefined)
+      throw new GhidraAdmissionError("existing_project_riscv_load_preparation");
     if (
       options.seedPath !== undefined ||
       options.analysisSeeds !== undefined ||
@@ -896,6 +908,7 @@ export const ghidraHeadlessArguments = (
       options.dosCom === true ||
       options.mipsSoftFloat === true ||
       options.riscvCallingConvention !== undefined ||
+      options.riscvLoadPreparation !== undefined ||
       rawBinary !== undefined ||
       override !== undefined)
   )
@@ -926,6 +939,15 @@ export const ghidraHeadlessArguments = (
       rawBinary !== undefined)
   )
     throw new GhidraAdmissionError("riscv_calling_convention_scope");
+  if (
+    options.riscvLoadPreparation !== undefined &&
+    (options.psp === true ||
+      options.mipsSoftFloat === true ||
+      options.dosMz === true ||
+      options.dosCom === true ||
+      rawBinary !== undefined)
+  )
+    throw new GhidraAdmissionError("riscv_load_preparation_scope");
   if (
     override !== undefined &&
     (options.dosMz === true || options.dosCom === true)
@@ -1045,6 +1067,22 @@ export const ghidraHeadlessArguments = (
           scriptPath.join(bridgeDirectory, GHIDRA_BRIDGE_SOURCES.prepareDol),
           gamecubeDol.sectionFilePath,
         ]),
+    // The memory map is final before seeds name addresses and analysis starts.
+    ...(options.riscvLoadPreparation === undefined
+      ? []
+      : [
+          "-preScript",
+          scriptPath.join(
+            bridgeDirectory,
+            GHIDRA_BRIDGE_SOURCES.prepareElfLoad,
+          ),
+          options.riscvLoadPreparation.policy,
+          options.riscvLoadPreparation.code.address,
+          options.riscvLoadPreparation.code.size,
+          options.riscvLoadPreparation.code.offset,
+          options.riscvLoadPreparation.reservation.address,
+          options.riscvLoadPreparation.reservation.size,
+        ]),
     // Seeds follow any loader preparation and precede default auto-analysis.
     ...(options.seedPath === undefined
       ? []
diff --git a/src/ghidra/GhidraProjectHistory.ts b/src/ghidra/GhidraProjectHistory.ts
index 7572e6374da..f490092675c 100644
--- a/src/ghidra/GhidraProjectHistory.ts
+++ b/src/ghidra/GhidraProjectHistory.ts
@@ -22,6 +22,9 @@ export const ghidraProjectHistoryEvidence = (
     ...(info.riscv_calling_convention === undefined
       ? {}
       : { riscv_calling_convention: info.riscv_calling_convention }),
+    ...(info.elf_load_preparation === undefined
+      ? {}
+      : { elf_load_preparation: info.elf_load_preparation }),
   };
   if (Object.keys(reports).length === 0) return undefined;
   return createEvidence(
diff --git a/src/ghidra/GhidraProviderClient.ts b/src/ghidra/GhidraProviderClient.ts
index 0e2e1e34fac..2502d1d652b 100644
--- a/src/ghidra/GhidraProviderClient.ts
+++ b/src/ghidra/GhidraProviderClient.ts
@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import {
   filterGhidraLiteralCandidates,
   GHIDRA_LITERAL_CANDIDATES_LIMITATION,
@@ -110,6 +111,10 @@ import {
   ghidraRiscvCallingConventionFailure,
   ghidraRiscvCallingConventionLimitations,
   ghidraRiscvLimitations,
+  ghidraRiscvLoadPreparation,
+  ghidraRiscvLoadPreparationFailure,
+  ghidraRiscvLoadPreparationLimitations,
+  ghidraRiscvLoadPreparationParameters,
 } from "./GhidraRiscvProfile.js";
 import { ghidraPePdbLimitations } from "./GhidraPeProfile.js";
 import { unverifiedGhidraBuildLimitation } from "./GhidraReleasePolicy.js";
@@ -361,6 +366,23 @@ export const createGhidraProviderClient = (input: {
         },
       }),
     );
+  const riscvLoadPreparation = ghidraRiscvLoadPreparation(target);
+  if (
+    !isDeepStrictEqual(
+      committedProfile.parameters.elf_load_preparation,
+      riscvLoadPreparation === undefined
+        ? undefined
+        : ghidraRiscvLoadPreparationParameters(riscvLoadPreparation),
+    )
+  )
+    return err(
+      new ProviderAdapterError("ghidra", "open_binary", {
+        diagnostics: {
+          reason:
+            "Resolve the RISC-V load preparation into the analysis profile before opening the session.",
+        },
+      }),
+    );
   const extensionProfile = ghidraExtensionSchema
     .array()
     .safeParse(committedProfile.parameters.analysis_extensions ?? []);
@@ -524,8 +546,10 @@ export const createGhidraProviderClient = (input: {
   const softFloatLimitations: string[] = [
     ...ghidraMipsSoftFloatLimitations(softFloat),
   ];
-  // Replaced by the reported prototype outcome once the handshake is checked.
-  const riscvCallingConventionLimitations: string[] = [
+  // Replaced by the reported preparation and prototype outcomes once the
+  // handshake is checked.
+  const riscvPolicyLimitations: string[] = [
+    ...ghidraRiscvLoadPreparationLimitations(riscvLoadPreparation),
     ...ghidraRiscvCallingConventionLimitations(riscvCallingConvention),
   ];
   // Replaced by the reported per-program outcome once the handshake is checked.
@@ -626,6 +650,7 @@ export const createGhidraProviderClient = (input: {
       ...(riscvCallingConvention === undefined
         ? {}
         : { riscvCallingConvention }),
+      ...(riscvLoadPreparation === undefined ? {} : { riscvLoadPreparation }),
       ...(target.format === "dos-mz" ? { dosMz: true } : {}),
       ...(target.format === "dos-com" ? { dosCom: true } : {}),
       ...(rawLanguage === undefined || target.format !== "raw-binary"
@@ -708,7 +733,8 @@ export const createGhidraProviderClient = (input: {
     seeds !== undefined ||
     disabledAnalyzers !== undefined ||
     softFloat ||
-    riscvCallingConvention !== undefined;
+    riscvCallingConvention !== undefined ||
+    riscvLoadPreparation !== undefined;
   const lostProviderHealth = (): ProviderOperationHealth | undefined =>
     providerStarted ? client.operationHealthSnapshot?.() : undefined;
   let projectHistory: Evidence | undefined;
@@ -736,7 +762,12 @@ export const createGhidraProviderClient = (input: {
           info,
         );
     } else {
-      const callingConventionReason =
+      const policyReason =
+        ghidraRiscvLoadPreparationFailure(
+          riscvLoadPreparation,
+          info.elf_load_preparation,
+          info.target.default_address_space,
+        ) ??
         ghidraMipsSoftFloatFailure(softFloat, info.mips_soft_float_storage) ??
         ghidraRiscvCallingConventionFailure(
           riscvCallingConvention,
@@ -754,10 +785,10 @@ export const createGhidraProviderClient = (input: {
           info.disabled_analyzers,
           operation,
         ) ??
-        (callingConventionReason === undefined
+        (policyReason === undefined
           ? undefined
           : new ProviderAdapterError("ghidra", operation, {
-              diagnostics: { reason: callingConventionReason },
+              diagnostics: { reason: policyReason },
             }));
       if (extensionFailure === undefined && info.analysis_seeds !== undefined)
         seedLimitations.splice(
@@ -775,9 +806,13 @@ export const createGhidraProviderClient = (input: {
           ),
         );
       if (extensionFailure === undefined)
-        riscvCallingConventionLimitations.splice(
+        riscvPolicyLimitations.splice(
           0,
-          riscvCallingConventionLimitations.length,
+          riscvPolicyLimitations.length,
+          ...ghidraRiscvLoadPreparationLimitations(
+            riscvLoadPreparation,
+            info.elf_load_preparation,
+          ),
           ...ghidraRiscvCallingConventionLimitations(
             riscvCallingConvention,
             info.riscv_calling_convention,
@@ -838,7 +873,7 @@ export const createGhidraProviderClient = (input: {
       ...targetLimitations,
       ...(psp ? GHIDRA_PSP_LIMITATIONS : []),
       ...softFloatLimitations,
-      ...riscvCallingConventionLimitations,
+      ...riscvPolicyLimitations,
       ...ghidraExtensionLimitations(extensions),
       ...seedLimitations,
       ...disabledAnalyzerLimitations,
diff --git a/src/ghidra/GhidraRiscvProfile.test.ts b/src/ghidra/GhidraRiscvProfile.test.ts
index 3851a99ecdf..b1d3a66d446 100644
--- a/src/ghidra/GhidraRiscvProfile.test.ts
+++ b/src/ghidra/GhidraRiscvProfile.test.ts
@@ -22,11 +22,16 @@ import {
   ghidraRiscvCallingConvention,
   ghidraRiscvCallingConventionFailure,
   ghidraRiscvLimitations,
+  ghidraRiscvLoadPreparation,
+  ghidraRiscvLoadPreparationFailure,
+  ghidraRiscvLoadPreparationLimitations,
   ghidraRiscvSupportLane,
   ghidraRiscvUnsupportedReason,
   type GhidraRiscvCallingConventionReport,
+  type GhidraRiscvLoadPreparationReport,
 } from "./GhidraRiscvProfile.js";
 import { ghidraProjectHistoryEvidence } from "./GhidraProjectHistory.js";
+import { stating } from "../../tests/support/statingFacts.js";
 import {
   GHIDRA_SESSION_CAPABILITIES,
   type GhidraSessionInfo,
@@ -90,6 +95,7 @@ const target = (change: Partial<RiscvElfMetadata> = {}): BinaryTarget => ({
     byteOrder: "little",
     type: 2,
     flags: 0x5,
+    sectionOverlap: { status: "none" },
     ...change,
   },
 });
@@ -547,7 +553,10 @@ const report: GhidraRiscvCallingConventionReport = {
   functions: 11,
   definitions: 11,
 };
-const sessionInfo = (reported?: GhidraRiscvCallingConventionReport) => ({
+const sessionInfo = (
+  reported?: GhidraRiscvCallingConventionReport,
+  prepared?: GhidraRiscvLoadPreparationReport,
+) => ({
   name: "REA Ghidra bridge" as const,
   run_id: "11111111-1111-4111-8111-111111111111",
   profile_digest: "a".repeat(64),
@@ -565,11 +574,13 @@ const sessionInfo = (reported?: GhidraRiscvCallingConventionReport) => ({
     sha256: "a".repeat(64),
   },
   ...(reported === undefined ? {} : { riscv_calling_convention: reported }),
+  ...(prepared === undefined ? {} : { elf_load_preparation: prepared }),
 });
 const session = async (
   value: BinaryTarget,
   reported: GhidraRiscvCallingConventionReport | undefined,
   profileFor: BinaryTarget = value,
+  prepared?: GhidraRiscvLoadPreparationReport,
 ) => {
   const counts = { starts: 0, calls: 0, closes: 0 };
   const launches: unknown[] = [];
@@ -583,7 +594,7 @@ const session = async (
       return {
         start: () => {
           counts.starts++;
-          return Promise.resolve(ok(sessionInfo(reported)));
+          return Promise.resolve(ok(sessionInfo(reported, prepared)));
         },
         callTool: () => {
           counts.calls++;
@@ -672,7 +683,7 @@ describe("RISC-V calling-convention handshake", () => {
       reason: "a report from a double-float session",
       value: target(),
       reported: report,
-      operation: "health",
+      operation: "list_procedures",
     },
   ] as const)("rejects $reason", async ({ value, reported, operation }) => {
     const { counts, client } = await session(value, reported);
@@ -704,3 +715,426 @@ describe("RISC-V calling-convention handshake", () => {
     ).toEqual({ origin: "caller-project", riscv_calling_convention: report });
   });
 });
+
+// ESP-IDF v6.1 ESP32-C6 hello_world's sections, as the ELF reader records them.
+const C6_ARCH =
+  "rv32i2p1_m2p0_a2p1_c2p0_zicsr2p0_zifencei2p0_zmmul1p0_zaamo1p0_zalrsc1p0_zca1p0";
+const espOverlap = {
+  status: "code-reservation",
+  code: {
+    index: 15,
+    name: ".flash.text",
+    address: "0x42000020",
+    size: "0xfff2",
+    offset: "0xc020",
+  },
+  reservation: {
+    index: 16,
+    name: ".flash_rodata_dummy",
+    address: "0x42000020",
+    size: "0x18000",
+  },
+} as const;
+/** The same target before its section table is inspected. */
+const uninspected = (value: BinaryTarget): BinaryTarget => {
+  if (value.kind !== "executable" || value.architecture !== "riscv")
+    return value;
+  const { sectionOverlap: _uninspected, ...riscv } = value.riscv;
+  return { ...value, riscv };
+};
+const esp = (change: Partial<RiscvElfMetadata> = {}): BinaryTarget =>
+  ilp32(C6_ARCH, { sectionOverlap: espOverlap, ...change });
+const movedCode = {
+  name: ".flash.text",
+  address: "0x42000020",
+  size: "0xfff2",
+  file_offset: "0xc020",
+  space_before: ".flash.text",
+  space_after: "ram",
+} as const;
+const moved: GhidraRiscvLoadPreparationReport = {
+  policy: "nobits-reservation-overlay-v1",
+  outcome: "moved",
+  code: movedCode,
+  reservation: {
+    name: ".flash_rodata_dummy",
+    address: "0x42000020",
+    size: "0x18000",
+    space_before: "ram",
+    space_after: ".flash_rodata_dummy",
+  },
+  functions: 549,
+  entry_points: 331,
+  reservation_labels: 1,
+};
+const canonical: GhidraRiscvLoadPreparationReport = {
+  policy: "nobits-reservation-overlay-v1",
+  outcome: "canonical",
+  code: { ...movedCode, space_before: "ram" },
+};
+
+// Profiles of images without a section overlap, as main 2885347cd commits them.
+const UNCHANGED_DIGESTS = {
+  ilp32: "728ff911222c1d6dfe4f99126030028bb5f109abed249cb1c76c9406d9c015c4",
+  double64: "687953088295bc6eee57d97256a18b979fe76159ab5ec8cf0ccb778b86af7b5d",
+} as const;
+
+describe("RISC-V load preparation admission", () => {
+  it("keeps the profile of every image without an overlap byte for byte", async () => {
+    for (const [name, value] of [
+      ["ilp32", ilp32()],
+      ["double64", target()],
+    ] as const) {
+      const resolved = await ghidra().resolveAnalysisProfile(value);
+      if (!resolved.ok || resolved.value.profile === null)
+        throw new Error("expected a RISC-V profile");
+      expect(resolved.value.profile.parameters).not.toHaveProperty(
+        "elf_load_preparation",
+      );
+      expect(resolved.value.profile.digest).toBe(UNCHANGED_DIGESTS[name]);
+    }
+  });
+
+  it("commits ESP-IDF's code reservation to the profile", async () => {
+    const resolved = await ghidra().resolveAnalysisProfile(esp());
+    const plain = await ghidra().resolveAnalysisProfile(
+      esp({ sectionOverlap: { status: "none" } }),
+    );
+    if (
+      !resolved.ok ||
+      !plain.ok ||
+      resolved.value.profile === null ||
+      plain.value.profile === null
+    )
+      throw new Error("expected ilp32 profiles");
+    expect(resolved.value.profile.parameters.elf_load_preparation).toEqual({
+      policy: "nobits-reservation-overlay-v1",
+      code: espOverlap.code,
+      reservation: espOverlap.reservation,
+    });
+    expect(resolved.value.profile.digest).not.toBe(plain.value.profile.digest);
+  });
+
+  const unreadable = {
+    status: "unavailable",
+    reason: "truncated ELF section header table",
+  } as const;
+  const overlapping = {
+    status: "unsupported",
+    witnesses: [
+      {
+        index: 1,
+        name: ".text",
+        address: "0x1000",
+        size: "0x100",
+        nobits: false,
+        executable: true,
+      },
+      {
+        index: 2,
+        name: null,
+        address: "0x1080",
+        size: "0x100",
+        nobits: true,
+        executable: false,
+      },
+    ],
+  } as const;
+  it.each([
+    [
+      "not inspected",
+      [uninspected(target()), uninspected(ilp32())],
+      ["section table", "not inspected"],
+    ],
+    [
+      "unreadable",
+      [
+        target({ sectionOverlap: unreadable }),
+        ilp32(C3_ARCH, { sectionOverlap: unreadable }),
+      ],
+      ["section table", "truncated ELF section header table"],
+    ],
+    [
+      "an unsupported overlap",
+      [
+        target({ sectionOverlap: overlapping }),
+        ilp32(C3_ARCH, { sectionOverlap: overlapping }),
+      ],
+      [
+        "`.text`",
+        "section [2]",
+        "0x1000",
+        "0x1080",
+        "0x100",
+        "NOBITS",
+        "docs/providers/ghidra-riscv.md",
+      ],
+    ],
+  ] as const)(
+    "refuses a section table that is %s in every lane",
+    (_label, values, facts) => {
+      for (const value of values) {
+        expect(ghidraRiscvUnsupportedReason(value)).toEqual(stating(...facts));
+        expect(ghidraRiscvLoadPreparation(value)).toBeUndefined();
+      }
+    },
+  );
+
+  it("names the lane's ISA refusal before the section table", () => {
+    expect(
+      ghidraRiscvUnsupportedReason(uninspected(ilp32(`${C3_ARCH}_zcb1p0`))),
+    ).toContain("outside the set this lane decodes: zcb");
+  });
+});
+
+describe("RISC-V load preparation report check", () => {
+  it.each([
+    ["the committed outcome", true, moved, undefined],
+    ["a canonical outcome", true, canonical, undefined],
+    ["no preparation", false, undefined, undefined],
+    [
+      "a block other than the committed code",
+      true,
+      { ...moved, code: { ...movedCode, size: "0xfff0" } },
+      ["`.flash.text`", "size", "0xfff0", "0xfff2"],
+    ],
+    [
+      "a code block at another file offset",
+      true,
+      { ...canonical, code: { ...movedCode, file_offset: "0xc021" } },
+      ["file offset", "0xc021", "0xc020"],
+    ],
+    [
+      "a reservation other than the committed one",
+      true,
+      {
+        ...moved,
+        reservation: { ...moved.reservation, size: "0x10000" },
+      },
+      ["`.flash_rodata_dummy`", "size", "0x10000", "0x18000"],
+    ],
+    [
+      "blocks that Ghidra names differently",
+      true,
+      {
+        ...moved,
+        code: { ...movedCode, name: "section.15" },
+        reservation: { ...moved.reservation, name: "section.16" },
+      },
+      undefined,
+    ],
+    [
+      "moved code left outside the default space",
+      true,
+      { ...moved, code: { ...movedCode, space_after: ".flash.text" } },
+      ["`.flash.text`", "after", "`ram`"],
+    ],
+    [
+      "moved code that was already in the default space",
+      true,
+      { ...moved, code: { ...movedCode, space_before: "ram" } },
+      ["`.flash.text`", "`ram`", "before", "overlay"],
+    ],
+    [
+      "a reservation left in the default space",
+      true,
+      {
+        ...moved,
+        reservation: { ...moved.reservation, space_after: "ram" },
+      },
+      ["`.flash_rodata_dummy`", "`ram`", "after", "overlay"],
+    ],
+    [
+      "canonical code in an overlay",
+      true,
+      {
+        ...canonical,
+        code: { ...movedCode, space_after: ".flash.text" },
+      },
+      ["`.flash.text`", "before", "`ram`"],
+    ],
+    ["a missing report", true, undefined, ["nobits-reservation-overlay-v1"]],
+    ["an uncommitted report", false, moved, ["RISC-V load preparation"]],
+    [
+      "a refusal",
+      true,
+      { policy: "nobits-reservation-overlay-v1", refused: "no reservation" },
+      ["`.flash.text`", "no reservation"],
+    ],
+  ] as const)("checks %s", (_label, planned, reported, failure) => {
+    const reason = ghidraRiscvLoadPreparationFailure(
+      planned ? ghidraRiscvLoadPreparation(esp()) : undefined,
+      reported,
+      "ram",
+    );
+    if (failure === undefined) expect(reason).toBeUndefined();
+    else expect(reason).toEqual(stating(...failure));
+  });
+
+  it("prepares unnamed sections by their coordinates", () => {
+    const unnamed = esp({
+      sectionOverlap: {
+        ...espOverlap,
+        code: { ...espOverlap.code, name: "" },
+        reservation: { ...espOverlap.reservation, name: "" },
+      },
+    });
+    const prepared = ghidraRiscvLoadPreparation(unnamed);
+    expect(ghidraRiscvLoadPreparationFailure(prepared, moved, "ram")).toBe(
+      undefined,
+    );
+    expect(ghidraRiscvLoadPreparationLimitations(prepared, moved)[0]).toEqual(
+      stating("section [16]", "section [15]", "NOBITS"),
+    );
+  });
+});
+
+describe("RISC-V load preparation handshake", () => {
+  it("launches the preparation and reports its outcome as session limitations", async () => {
+    const { client, launches } = await session(esp(), report, esp(), moved);
+    const health = await client.execute("health", {});
+    if (!health.ok) throw health.error;
+    expect(launches).toEqual([
+      expect.objectContaining({
+        options: expect.objectContaining({
+          riscvLoadPreparation: ghidraRiscvLoadPreparation(esp()),
+        }),
+      }),
+    ]);
+    // The session reports the owning formatter's statements; each carries
+    // the sections, their coordinates and the bridge's counts.
+    const [layout, outcome] = ghidraRiscvLoadPreparationLimitations(
+      ghidraRiscvLoadPreparation(esp()),
+      moved,
+    );
+    expect(health.value.limitations).toEqual(
+      expect.arrayContaining([layout, outcome]),
+    );
+    expect(layout).toEqual(
+      stating(
+        "`.flash_rodata_dummy`",
+        "`.flash.text`",
+        "0x42000020",
+        "0xfff2",
+        "NOBITS",
+      ),
+    );
+    expect(outcome).toEqual(
+      stating(
+        "`.flash.text`",
+        "`ram`",
+        "`.flash_rodata_dummy`",
+        "549",
+        "331",
+        "1",
+      ),
+    );
+    // The planned statement gives way to the reported outcome.
+    expect(health.value.limitations).not.toContainEqual(
+      ghidraRiscvLoadPreparationLimitations(
+        ghidraRiscvLoadPreparation(esp()),
+      )[1],
+    );
+  });
+
+  it("states that Ghidra already loaded the code where it belongs", async () => {
+    const { client } = await session(esp(), report, esp(), canonical);
+    const health = await client.execute("health", {});
+    if (!health.ok) throw health.error;
+    const outcome = ghidraRiscvLoadPreparationLimitations(
+      ghidraRiscvLoadPreparation(esp()),
+      canonical,
+    )[1];
+    expect(health.value.limitations).toContainEqual(outcome);
+    expect(outcome).toEqual(stating("`.flash.text`", "`ram`"));
+    const prepared = ghidraRiscvLoadPreparation(esp());
+    for (const other of [
+      ghidraRiscvLoadPreparationLimitations(prepared)[1],
+      ghidraRiscvLoadPreparationLimitations(prepared, moved)[1],
+    ])
+      expect(health.value.limitations).not.toContainEqual(other);
+  });
+
+  it("checks a double-float preparation before the first analysis call", async () => {
+    const value = target({ elfClass: 32, sectionOverlap: espOverlap });
+    const { counts, client } = await session(value, undefined, value, {
+      policy: "nobits-reservation-overlay-v1",
+      refused: "no reservation",
+    });
+    const failed = await client.execute("list_procedures", {});
+    expect(failed.ok).toBe(false);
+    if (!failed.ok) expect(failed.error._tag).toBe("ProviderAdapterError");
+    expect(counts).toEqual({ starts: 1, calls: 0, closes: 1 });
+  });
+
+  it.each([
+    [
+      "a refused preparation",
+      esp(),
+      esp(),
+      {
+        policy: "nobits-reservation-overlay-v1",
+        refused: "no reservation",
+      } as const,
+    ],
+    ["a missing report", esp(), esp(), undefined],
+    ["a report the profile did not commit", ilp32(), ilp32(), moved],
+  ] as const)(
+    "closes the session on %s",
+    async (_label, value, profileFor, prepared) => {
+      const { counts, client } = await session(
+        value,
+        report,
+        profileFor,
+        prepared,
+      );
+      const failed = await client.execute("health", {});
+      expect(failed.ok).toBe(false);
+      expect(counts).toEqual({ starts: 1, calls: 0, closes: 1 });
+    },
+  );
+
+  it("closes a session without a preparation that reports one, before any analysis call", async () => {
+    const { counts, client } = await session(
+      target(),
+      undefined,
+      target(),
+      moved,
+    );
+    const failed = await client.execute("list_procedures", {});
+    expect(failed.ok).toBe(false);
+    if (!failed.ok) expect(failed.error._tag).toBe("ProviderAdapterError");
+    expect(counts).toEqual({ starts: 1, calls: 0, closes: 1 });
+  });
+
+  it("refuses a profile whose preparation disagrees with the target", async () => {
+    for (const [value, profileFor] of [
+      [esp(), esp({ sectionOverlap: { status: "none" } })],
+      [esp({ sectionOverlap: { status: "none" } }), esp()],
+    ] as const) {
+      const { counts, client } = await session(
+        value,
+        report,
+        profileFor,
+        moved,
+      );
+      expect((await client.execute("health", {})).ok).toBe(false);
+      expect(counts.starts).toBe(0);
+    }
+  });
+
+  it("keeps a caller project's stored preparation report as history", async () => {
+    const resolved = await ghidra().resolveAnalysisProfile(esp());
+    if (!resolved.ok || resolved.value.profile === null)
+      throw new Error("expected an ilp32 profile");
+    const info: GhidraSessionInfo = sessionInfo(report, moved);
+    expect(
+      ghidraProjectHistoryEvidence(esp(), resolved.value.profile, info)
+        ?.normalized_result,
+    ).toEqual({
+      origin: "caller-project",
+      riscv_calling_convention: report,
+      elf_load_preparation: moved,
+    });
+  });
+});
diff --git a/src/ghidra/GhidraRiscvProfile.ts b/src/ghidra/GhidraRiscvProfile.ts
index 2eb5430b088..c6da7194a48 100644
--- a/src/ghidra/GhidraRiscvProfile.ts
+++ b/src/ghidra/GhidraRiscvProfile.ts
@@ -1,5 +1,8 @@
 import type {
   BinaryTarget,
+  ElfSectionExtent,
+  ElfSectionOverlap,
+  ElfSectionWitness,
   RiscvElfMetadata,
   RiscvIsaDeclaration,
 } from "../domain/binaryTargetTypes.js";
@@ -73,6 +76,53 @@ export const GHIDRA_RISCV32_DECODED_EXTENSIONS: ReadonlySet<string> = new Set([
   "zcd",
 ]);
 
+/** The memory-map preparation policy an analysis profile can commit. */
+export const GHIDRA_RISCV_LOAD_PREPARATION = "nobits-reservation-overlay-v1";
+
+/**
+ * Before analysis, `ReaGhidraPrepareElfLoad.java` gives an executable section
+ * that a NOBITS reservation shares addresses with the default address space,
+ * and the reservation an overlay instead.
+ */
+export interface GhidraRiscvLoadPreparation {
+  readonly policy: typeof GHIDRA_RISCV_LOAD_PREPARATION;
+  readonly code: ElfSectionExtent & { readonly offset: string };
+  readonly reservation: ElfSectionExtent;
+}
+
+/** A memory block as the pre-analysis script left it, and its space before. */
+export interface GhidraPreparedBlock {
+  readonly name: string;
+  readonly address: string;
+  readonly size: string;
+  readonly space_before: string;
+  readonly space_after: string;
+}
+
+/**
+ * Outcome the pre-analysis script records for the bridge handshake. It echoes
+ * the blocks it found, so the client compares them with the committed sections.
+ */
+export type GhidraRiscvLoadPreparationReport =
+  | {
+      readonly policy: typeof GHIDRA_RISCV_LOAD_PREPARATION;
+      readonly outcome: "moved";
+      readonly code: GhidraPreparedBlock & { readonly file_offset: string };
+      readonly reservation: GhidraPreparedBlock;
+      readonly functions: number;
+      readonly entry_points: number;
+      readonly reservation_labels: number;
+    }
+  | {
+      readonly policy: typeof GHIDRA_RISCV_LOAD_PREPARATION;
+      readonly outcome: "canonical";
+      readonly code: GhidraPreparedBlock & { readonly file_offset: string };
+    }
+  | {
+      readonly policy: typeof GHIDRA_RISCV_LOAD_PREPARATION;
+      readonly refused: string;
+    };
+
 /** Outcome the post-analysis script records for the bridge handshake. */
 export interface GhidraRiscvCallingConventionReport {
   readonly policy: GhidraRiscvCallingConvention;
@@ -143,6 +193,34 @@ const ghidraRiscvIsaRefusal = (
       ].join(", ")} with p-code; see docs/providers/ghidra-riscv.md.`;
 };
 
+const sectionLabel = (extent: ElfSectionExtent): string =>
+  extent.name === null || extent.name === ""
+    ? `section [${extent.index}]`
+    : `\`${extent.name}\``;
+
+const witnessLabel = (witness: ElfSectionWitness): string =>
+  `${sectionLabel(witness)} (${[
+    ...(witness.executable ? ["executable"] : []),
+    ...(witness.nobits ? ["NOBITS"] : []),
+    `${witness.address}, ${witness.size} bytes`,
+  ].join(", ")})`;
+
+/**
+ * Every lane needs the section table: a section that shares an executable
+ * section's addresses decides where Ghidra 12.1.4 loads that code.
+ */
+const ghidraRiscvSectionOverlapRefusal = (
+  overlap: ElfSectionOverlap | undefined,
+): string | null => {
+  if (overlap === undefined)
+    return "This RISC-V lane requires the image's section table, which was not inspected; overlapping sections decide where Ghidra loads code.";
+  if (overlap.status === "unavailable")
+    return `This RISC-V lane requires a readable section table: ${overlap.reason}.`;
+  if (overlap.status !== "unsupported") return null;
+  const [first, second] = overlap.witnesses;
+  return `Sections ${witnessLabel(first)} and ${witnessLabel(second)} share addresses, so Ghidra 12.1.4's ELF loader would put one of them in an overlay address space. This lane prepares only one NOBITS section that starts at an executable PROGBITS section's address and covers it, with no other section overlapping either; see docs/providers/ghidra-riscv.md.`;
+};
+
 /**
  * Keep family recognition separate from the deliberately bounded Ghidra lane.
  *
@@ -181,11 +259,54 @@ export const ghidraRiscvUnsupportedReason = (
   const unsupportedFlags = (metadata.flags & ~EF_RISCV_DECLARED_BITS) >>> 0;
   if (unsupportedFlags !== 0)
     return `RISC-V e_flags declares bits outside the verified lane (0x${unsupportedFlags.toString(16)}); reserved or newer declarations are not treated as compatible with this profile.`;
-  return lane.callingConvention === undefined
-    ? null
-    : ghidraRiscvIsaRefusal(metadata.isa);
+  const isa =
+    lane.callingConvention === undefined
+      ? null
+      : ghidraRiscvIsaRefusal(metadata.isa);
+  return isa ?? ghidraRiscvSectionOverlapRefusal(metadata.sectionOverlap);
 };
 
+/** The memory-map preparation an admitted target's sections need, if any. */
+export const ghidraRiscvLoadPreparation = (
+  target: BinaryTarget,
+): GhidraRiscvLoadPreparation | undefined => {
+  if (
+    target.kind !== "executable" ||
+    target.architecture !== "riscv" ||
+    ghidraRiscvUnsupportedReason(target) !== null
+  )
+    return undefined;
+  const overlap = target.riscv.sectionOverlap;
+  return overlap?.status === "code-reservation"
+    ? {
+        policy: GHIDRA_RISCV_LOAD_PREPARATION,
+        code: overlap.code,
+        reservation: overlap.reservation,
+      }
+    : undefined;
+};
+
+const sectionParameters = (
+  extent: ElfSectionExtent,
+): { [key: string]: JsonValue } => ({
+  index: extent.index,
+  name: extent.name,
+  address: extent.address,
+  size: extent.size,
+});
+
+/** The committed form of a preparation; the profile digest covers every field. */
+export const ghidraRiscvLoadPreparationParameters = (
+  preparation: GhidraRiscvLoadPreparation,
+): JsonValue => ({
+  policy: preparation.policy,
+  code: {
+    ...sectionParameters(preparation.code),
+    offset: preparation.code.offset,
+  },
+  reservation: sectionParameters(preparation.reservation),
+});
+
 /** The calling-convention policy an admitted target's lane applies, if any. */
 export const ghidraRiscvCallingConvention = (
   target: BinaryTarget,
@@ -225,6 +346,7 @@ export const ghidraRiscvProfileParameters = (
     return {};
   const floatAbi = riscvFloatAbi(target.riscv.flags);
   const convention = ghidraRiscvCallingConvention(target);
+  const preparation = ghidraRiscvLoadPreparation(target);
   const isa = target.riscv.isa;
   return {
     riscv_elf: {
@@ -243,6 +365,13 @@ export const ghidraRiscvProfileParameters = (
     ...(convention === undefined
       ? {}
       : { riscv_calling_convention: convention }),
+    // Present only when needed, so other images keep their profile digests.
+    ...(preparation === undefined
+      ? {}
+      : {
+          elf_load_preparation:
+            ghidraRiscvLoadPreparationParameters(preparation),
+        }),
     riscv_support_lane: ghidraRiscvSupportLane({
       elfClass: target.riscv.elfClass,
       floatAbi,
@@ -273,7 +402,7 @@ export const ghidraRiscvLimitations = (
           `\`.riscv.attributes\` declares \`${isa.arch}\`. Every declared extension is in the set this lane decodes; the declaration does not prove that every instruction belongs to it.`,
         ]
       : []),
-    "Admission reads `e_type` only: a fixed-address ET_EXEC declaration does not establish static linkage, and program headers (`PT_INTERP`, dynamic dependencies) are not inspected by this lane.",
+    "Admission reads `e_type` and section overlaps, not program headers: a fixed-address ET_EXEC declaration does not establish static linkage, and `PT_INTERP` and dynamic dependencies are not inspected by this lane.",
   ];
 };
 
@@ -305,3 +434,102 @@ export const ghidraRiscvCallingConventionLimitations = (
     "Ghidra recovers a variadic call's arguments from the registers the caller writes, not from their types: a padding register can appear as an argument, and arguments after an unwritten register are omitted.",
   ];
 };
+
+/** Where a prepared block must be, before and after the pre-analysis script. */
+type PreparedSpaces = readonly [
+  before: "default" | "overlay",
+  after: "default" | "overlay",
+];
+
+/** The first echoed coordinate or space that differs from the committed section's. */
+const preparedMismatch = (
+  committed: ElfSectionExtent & { readonly offset?: string },
+  block: GhidraPreparedBlock & { readonly file_offset?: string },
+  [before, after]: PreparedSpaces,
+  defaultSpace: string,
+): string | undefined => {
+  // Block names are display only, as section names are, so they are not compared.
+  const coordinate = (
+    [
+      ["address", committed.address, block.address],
+      ["size", committed.size, block.size],
+      ["file offset", committed.offset, block.file_offset],
+    ] as const
+  ).find(
+    ([, expected, reported]) => expected !== undefined && expected !== reported,
+  );
+  if (coordinate !== undefined)
+    return `${sectionLabel(committed)}: Ghidra's block reports ${coordinate[0]} ${String(coordinate[2])}, not ${coordinate[1]}`;
+  const space = (
+    [
+      ["before", before, block.space_before],
+      ["after", after, block.space_after],
+    ] as const
+  ).find(
+    ([, expected, reported]) =>
+      (reported === defaultSpace) !== (expected === "default"),
+  );
+  return space === undefined
+    ? undefined
+    : `${sectionLabel(committed)}: Ghidra's block reports space \`${space[2]}\` ${space[0]} the preparation, not ${space[1] === "default" ? `the default space \`${defaultSpace}\`` : "an overlay space"}`;
+};
+
+/** Fail closed unless the pre-analysis script applied exactly the committed preparation. */
+export const ghidraRiscvLoadPreparationFailure = (
+  expected: GhidraRiscvLoadPreparation | undefined,
+  report: GhidraRiscvLoadPreparationReport | undefined,
+  defaultSpace: string,
+): string | undefined => {
+  if (expected === undefined)
+    return report === undefined
+      ? undefined
+      : "The Ghidra session reported a RISC-V load preparation that the profile did not commit.";
+  if (report === undefined)
+    return `The Ghidra session did not report the committed RISC-V load preparation ${expected.policy}.`;
+  if ("refused" in report)
+    return `REA could not prepare Ghidra's memory map for ${sectionLabel(expected.code)}: ${report.refused}`;
+  if (report.policy !== expected.policy)
+    return `The Ghidra session did not report the committed RISC-V load preparation ${expected.policy}.`;
+  // A moved code block and its reservation trade spaces; canonical code stays put.
+  const mismatch =
+    report.outcome === "moved"
+      ? (preparedMismatch(
+          expected.code,
+          report.code,
+          ["overlay", "default"],
+          defaultSpace,
+        ) ??
+        preparedMismatch(
+          expected.reservation,
+          report.reservation,
+          ["default", "overlay"],
+          defaultSpace,
+        ))
+      : preparedMismatch(
+          expected.code,
+          report.code,
+          ["default", "default"],
+          defaultSpace,
+        );
+  return mismatch === undefined
+    ? undefined
+    : `The RISC-V load preparation did not act on the committed sections. ${mismatch}.`;
+};
+
+/** State the preparation REA applies, and its outcome once the bridge reports it. */
+export const ghidraRiscvLoadPreparationLimitations = (
+  expected: GhidraRiscvLoadPreparation | undefined,
+  report?: GhidraRiscvLoadPreparationReport,
+): readonly string[] => {
+  if (expected === undefined) return [];
+  const code = sectionLabel(expected.code);
+  const reservation = sectionLabel(expected.reservation);
+  return [
+    `RISC-V ELF load layout: NOBITS section ${reservation} reserves the addresses of executable section ${code} (${expected.code.address}, ${expected.code.size} bytes). When the reservation follows the code in the section table, Ghidra 12.1.4's ELF loader puts the code in an overlay address space, which its DWARF import, call-frame entries and default-space references do not reach; see docs/providers/ghidra-riscv.md.`,
+    report === undefined || "refused" in report
+      ? `Before analysis REA moves ${code} out of such an overlay into the default address space, with the same file bytes and offsets, and keeps ${reservation} as an uninitialized overlay.`
+      : report.outcome === "moved"
+        ? `RISC-V load preparation outcome: before analysis REA moved ${code} from overlay space \`${report.code.space_before}\` into default space \`${report.code.space_after}\`, with the same file bytes and offsets, and kept ${reservation} as uninitialized overlay space \`${report.reservation.space_after}\`. Functions in the moved block: ${report.functions}; entry points: ${report.entry_points}; labels in the overlay: ${report.reservation_labels}.`
+        : `RISC-V load preparation outcome: Ghidra loaded ${code} in default space \`${report.code.space_after}\`, so REA changed nothing.`,
+  ];
+};
diff --git a/src/ghidra/GhidraSessionValues.test.ts b/src/ghidra/GhidraSessionValues.test.ts
index 124585b8acc..fd38d7da8a9 100644
--- a/src/ghidra/GhidraSessionValues.test.ts
+++ b/src/ghidra/GhidraSessionValues.test.ts
@@ -174,6 +174,77 @@ describe("Ghidra RISC-V calling-convention report", () => {
   });
 });
 
+describe("Ghidra RISC-V load preparation report", () => {
+  const code = {
+    name: ".flash.text",
+    address: "0x42000020",
+    size: "0xfff2",
+    file_offset: "0xc020",
+    space_before: ".flash.text",
+    space_after: "ram",
+  };
+  const moved = {
+    policy: "nobits-reservation-overlay-v1",
+    outcome: "moved",
+    code,
+    reservation: {
+      name: ".flash_rodata_dummy",
+      address: "0x42000020",
+      size: "0x18000",
+      space_before: "ram",
+      space_after: ".flash_rodata_dummy",
+    },
+    functions: 549,
+    entry_points: 331,
+    reservation_labels: 1,
+  };
+  const { reservation: _reservation, ...withoutReservation } = moved;
+  const { file_offset: _fileOffset, ...withoutOffset } = code;
+  it.each([
+    ["a moved outcome", moved],
+    [
+      "a canonical outcome",
+      { policy: "nobits-reservation-overlay-v1", outcome: "canonical", code },
+    ],
+    [
+      "a refusal",
+      { policy: "nobits-reservation-overlay-v1", refused: "no reservation" },
+    ],
+  ])("accepts %s", (_label, report) => {
+    const parsed = parseGhidraSessionInfo(
+      { ...session(), elf_load_preparation: report },
+      expected,
+    );
+    if (!parsed.ok) throw parsed.error;
+    expect(parsed.value.elf_load_preparation).toEqual(report);
+  });
+  it.each([
+    [
+      "an unknown policy",
+      { ...moved, policy: "nobits-reservation-overlay-v2" },
+    ],
+    ["an unknown outcome", { ...moved, outcome: "partial" }],
+    ["a negative count", { ...moved, entry_points: -1 }],
+    ["a moved outcome without its reservation", withoutReservation],
+    ["a code block without its file offset", { ...moved, code: withoutOffset }],
+    [
+      "a non-hex address",
+      { ...moved, code: { ...code, address: "1107296288" } },
+    ],
+    ["counts on a canonical outcome", { ...moved, outcome: "canonical" }],
+    ["an empty refusal", { policy: moved.policy, refused: "" }],
+    ["an outcome beside a refusal", { ...moved, refused: "no reservation" }],
+    ["a non-object report", "moved"],
+  ])("rejects %s", (_label, report) => {
+    expect(
+      parseGhidraSessionInfo(
+        { ...session(), elf_load_preparation: report },
+        expected,
+      ).ok,
+    ).toBe(false);
+  });
+});
+
 describe("Ghidra disabled analyzer report", () => {
   const valid = {
     format: "rea-ghidra-disabled-analyzers-v1",
diff --git a/src/ghidra/GhidraSessionValues.ts b/src/ghidra/GhidraSessionValues.ts
index f0b7c031ac5..4e10902ef70 100644
--- a/src/ghidra/GhidraSessionValues.ts
+++ b/src/ghidra/GhidraSessionValues.ts
@@ -10,7 +10,10 @@ import { GHIDRA_INVENTORY_OPERATIONS } from "./GhidraInventoryOperations.js";
 import { GHIDRA_FUNCTION_OPERATIONS } from "./GhidraFunctionOperations.js";
 import { ghidraExtensionResultSchema } from "./extensions/GhidraExtensions.js";
 import { GHIDRA_MIPS_SOFT_FLOAT_STORAGE } from "./GhidraMipsProfile.js";
-import { GHIDRA_RISCV_CALLING_CONVENTION_IDS } from "./GhidraRiscvProfile.js";
+import {
+  GHIDRA_RISCV_CALLING_CONVENTION_IDS,
+  GHIDRA_RISCV_LOAD_PREPARATION,
+} from "./GhidraRiscvProfile.js";
 
 /** Exact methods proved by the selected Program bridge handshake. */
 export const GHIDRA_SESSION_CAPABILITIES = [
@@ -35,6 +38,20 @@ const pdbAttributeSchema = z
 
 const capabilitySchema = z.enum(GHIDRA_SESSION_CAPABILITIES);
 
+const hexSchema = z.string().regex(/^0x[0-9a-f]+$/u);
+const preparedBlockSchema = z
+  .object({
+    name: z.string().min(1),
+    address: hexSchema,
+    size: hexSchema,
+    space_before: z.string().min(1),
+    space_after: z.string().min(1),
+  })
+  .strict();
+const preparedCodeSchema = preparedBlockSchema
+  .extend({ file_offset: hexSchema })
+  .strict();
+
 const sessionInfoSchema = z
   .object({
     name: z.literal("REA Ghidra bridge"),
@@ -102,13 +119,42 @@ const sessionInfoSchema = z
       })
       .strict()
       .optional(),
+    // Written by ReaGhidraPrepareElfLoad before auto-analysis.
+    elf_load_preparation: z
+      .union([
+        z
+          .object({
+            policy: z.literal(GHIDRA_RISCV_LOAD_PREPARATION),
+            outcome: z.literal("moved"),
+            code: preparedCodeSchema,
+            reservation: preparedBlockSchema,
+            functions: z.int().nonnegative(),
+            entry_points: z.int().nonnegative(),
+            reservation_labels: z.int().nonnegative(),
+          })
+          .strict(),
+        z
+          .object({
+            policy: z.literal(GHIDRA_RISCV_LOAD_PREPARATION),
+            outcome: z.literal("canonical"),
+            code: preparedCodeSchema,
+          })
+          .strict(),
+        z
+          .object({
+            policy: z.literal(GHIDRA_RISCV_LOAD_PREPARATION),
+            refused: z.string().min(1).max(1024),
+          })
+          .strict(),
+      ])
+      .optional(),
     capabilities: z.array(capabilitySchema),
     target: z
       .object({
         name: z.string().min(1),
         language_id: z.string().min(1),
         compiler_spec_id: z.string().min(1),
-        image_base: z.string().regex(/^0x[0-9a-f]+$/u),
+        image_base: hexSchema,
         default_address_space: z.string().min(1),
         sha256: z.string().regex(/^[a-f0-9]{64}$/u),
       })
diff --git a/tests/boundary/filesystem/elfSectionOverlap.test.ts b/tests/boundary/filesystem/elfSectionOverlap.test.ts
new file mode 100644
index 00000000000..70c15959ae9
--- /dev/null
+++ b/tests/boundary/filesystem/elfSectionOverlap.test.ts
@@ -0,0 +1,460 @@
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { parseBinaryTarget } from "../../../src/application/BinaryTargetResolver.js";
+import {
+  ghidraRiscvLoadPreparation,
+  ghidraRiscvUnsupportedReason,
+} from "../../../src/ghidra/GhidraRiscvProfile.js";
+import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
+
+const SHT_PROGBITS = 1;
+const SHT_STRTAB = 3;
+const SHT_NOBITS = 8;
+const SHT_RISCV_ATTRIBUTES = 0x70000003;
+const ALLOC = 0x2;
+const WRITE_ALLOC = 0x3;
+const EXEC_ALLOC = 0x6;
+const SECTION_TABLE = 128;
+// Deliberately outside BinaryTargetResolver's 4 KiB probe.
+const PAYLOADS = 8192;
+// ESP-IDF's ESP32-C6 base string, which the ilp32 lane admits.
+const C6_ARCH =
+  "rv32i2p1_m2p0_a2p1_c2p0_zicsr2p0_zifencei2p0_zmmul1p0_zaamo1p0_zalrsc1p0";
+
+interface Section {
+  readonly name: string;
+  readonly type: number;
+  readonly flags: number;
+  readonly address: number;
+  readonly size: number;
+  readonly payload?: Buffer;
+}
+
+const attributes = (): Buffer => {
+  const list = [5, ...Buffer.from(`${C6_ARCH}\0`, "latin1")];
+  const scoped = Buffer.alloc(5 + list.length);
+  scoped[0] = 1; // Tag_File
+  scoped.writeUInt32LE(scoped.length, 1);
+  scoped.set(list, 5);
+  const vendor = Buffer.from("riscv\0", "latin1");
+  const header = Buffer.alloc(5);
+  header[0] = 0x41;
+  header.writeUInt32LE(4 + vendor.length + scoped.length, 1);
+  return Buffer.concat([header, vendor, scoped]);
+};
+
+// ELF header and section header field offsets of each class.
+const LAYOUTS = {
+  32: {
+    shoff: 32,
+    flags: 36,
+    ehsize: 52,
+    shentsize: 40,
+    counts: 40,
+    sh: { flags: 8, address: 12, offset: 16, size: 20 },
+  },
+  64: {
+    shoff: 40,
+    flags: 48,
+    ehsize: 64,
+    shentsize: 64,
+    counts: 52,
+    sh: { flags: 8, address: 16, offset: 24, size: 32 },
+  },
+} as const;
+
+/**
+ * A RISC-V image with these sections, its attributes and, unless `names` is
+ * false, a section-name table. ELF32 images declare the soft-float ABI and
+ * ELF64 images the double-float ABI, so each reaches an admitted lane.
+ */
+const elf = (
+  sections: readonly Section[],
+  options: {
+    readonly type?: number;
+    readonly names?: boolean;
+    readonly elfClass?: 32 | 64;
+  } = {},
+): Buffer => {
+  const elfClass = options.elfClass ?? 32;
+  const layout = LAYOUTS[elfClass];
+  const all: Section[] = [
+    ...sections,
+    {
+      name: ".riscv.attributes",
+      type: SHT_RISCV_ATTRIBUTES,
+      flags: 0,
+      address: 0,
+      size: 0,
+      payload: attributes(),
+    },
+  ];
+  const names = Buffer.from(
+    `\0${[...all.map((section) => section.name), ".shstrtab"].join("\0")}\0`,
+    "latin1",
+  );
+  if (options.names !== false)
+    all.push({
+      name: ".shstrtab",
+      type: SHT_STRTAB,
+      flags: 0,
+      address: 0,
+      size: 0,
+      payload: names,
+    });
+  const filed = all.map((section) =>
+    section.type === SHT_NOBITS
+      ? Buffer.alloc(0)
+      : (section.payload ?? Buffer.alloc(section.size, 0x13)),
+  );
+  const payloads = Math.max(
+    PAYLOADS,
+    SECTION_TABLE + (1 + all.length) * layout.shentsize,
+  );
+  const bytes = Buffer.alloc(
+    payloads + filed.reduce((total, payload) => total + payload.length, 0),
+  );
+  const word = (value: number, at: number): void => {
+    if (elfClass === 64) bytes.writeBigUInt64LE(BigInt(value), at);
+    else bytes.writeUInt32LE(value, at);
+  };
+  bytes.set([0x7f, 0x45, 0x4c, 0x46, elfClass === 64 ? 2 : 1, 1, 1]);
+  bytes.writeUInt16LE(options.type ?? 2, 16);
+  bytes.writeUInt16LE(243, 18); // EM_RISCV
+  bytes.writeUInt32LE(1, 20);
+  word(SECTION_TABLE, layout.shoff);
+  // RVC with the soft-float ABI, or with the double-float ABI.
+  bytes.writeUInt32LE(elfClass === 64 ? 0x5 : 0x1, layout.flags);
+  bytes.writeUInt16LE(layout.ehsize, layout.counts);
+  bytes.writeUInt16LE(layout.shentsize, layout.counts + 6);
+  // From SHN_LORESERVE on, ELF counts sections through section zero's size.
+  const count = 1 + all.length;
+  bytes.writeUInt16LE(count < 0xff00 ? count : 0, layout.counts + 8);
+  if (count >= 0xff00) word(count, SECTION_TABLE + layout.sh.size);
+  bytes.writeUInt16LE(
+    options.names === false ? 0 : all.length,
+    layout.counts + 10,
+  );
+  let offset = payloads;
+  let nameOffset = 1;
+  all.forEach((section, index) => {
+    const header = SECTION_TABLE + (1 + index) * layout.shentsize;
+    const payload = filed[index] ?? Buffer.alloc(0);
+    bytes.writeUInt32LE(nameOffset, header);
+    nameOffset += section.name.length + 1;
+    bytes.writeUInt32LE(section.type, header + 4);
+    word(section.flags, header + layout.sh.flags);
+    word(section.address, header + layout.sh.address);
+    word(offset, header + layout.sh.offset);
+    word(
+      section.type === SHT_NOBITS ? section.size : payload.length,
+      header + layout.sh.size,
+    );
+    payload.copy(bytes, offset);
+    offset += payload.length;
+  });
+  return bytes;
+};
+
+const resolve = async (bytes: Buffer) => {
+  const directory = await createTestTempDirectory("rea-elf-overlap-test-");
+  const path = join(directory, "fixture.elf");
+  await writeFile(path, bytes);
+  const resolved = await parseBinaryTarget(path);
+  if (!resolved.ok) throw resolved.error;
+  if (
+    resolved.value.kind !== "executable" ||
+    resolved.value.architecture !== "riscv"
+  )
+    throw new Error("Expected a resolved RISC-V executable");
+  return {
+    overlap: resolved.value.riscv.sectionOverlap,
+    refusal: ghidraRiscvUnsupportedReason(resolved.value),
+    preparation: ghidraRiscvLoadPreparation(resolved.value),
+  };
+};
+
+// The ESP-IDF v6.1 ESP32-C6 hello_world layout, scaled down: the NOBITS
+// reservation starts with the code and covers it, and rodata follows.
+const code: Section = {
+  name: ".flash.text",
+  type: SHT_PROGBITS,
+  flags: EXEC_ALLOC,
+  address: 0x42000020,
+  size: 0x40,
+};
+const reservation: Section = {
+  name: ".flash_rodata_dummy",
+  type: SHT_NOBITS,
+  flags: WRITE_ALLOC,
+  address: 0x42000020,
+  size: 0x100,
+};
+const rodata: Section = {
+  name: ".flash.rodata",
+  type: SHT_PROGBITS,
+  flags: ALLOC,
+  address: 0x42000120,
+  size: 0x10,
+};
+const iram: Section = {
+  name: ".iram0.text",
+  type: SHT_PROGBITS,
+  flags: EXEC_ALLOC,
+  address: 0x40800000,
+  size: 0x20,
+};
+
+describe("ELF section overlaps at target resolution", () => {
+  it("records ESP-IDF's code reservation and plans the memory-map preparation", async () => {
+    const { overlap, refusal, preparation } = await resolve(
+      elf([iram, code, reservation, rodata]),
+    );
+    expect(overlap).toEqual({
+      status: "code-reservation",
+      code: {
+        index: 2,
+        name: ".flash.text",
+        address: "0x42000020",
+        size: "0x40",
+        offset: "0x2020",
+      },
+      reservation: {
+        index: 3,
+        name: ".flash_rodata_dummy",
+        address: "0x42000020",
+        size: "0x100",
+      },
+    });
+    expect(refusal).toBeNull();
+    expect(preparation).toEqual({
+      policy: "nobits-reservation-overlay-v1",
+      code: overlap?.status === "code-reservation" ? overlap.code : undefined,
+      reservation:
+        overlap?.status === "code-reservation"
+          ? overlap.reservation
+          : undefined,
+    });
+  });
+
+  it("keeps the reservation without names when the image has no name table", async () => {
+    const { overlap } = await resolve(
+      elf([code, reservation], { names: false }),
+    );
+    expect(overlap).toMatchObject({
+      status: "code-reservation",
+      code: { index: 1, name: null },
+      reservation: { index: 2, name: null },
+    });
+  });
+
+  it.each([
+    ["separate code and data", [iram, code, rodata]],
+    [
+      "overlapping data sections",
+      [
+        code,
+        rodata,
+        { ...rodata, name: ".flash.tdata", type: SHT_NOBITS, size: 0x8 },
+      ],
+    ],
+  ] as const)("admits %s without a preparation", async (_label, sections) => {
+    const { overlap, refusal, preparation } = await resolve(elf(sections));
+    expect(overlap).toEqual({ status: "none" });
+    expect(refusal).toBeNull();
+    expect(preparation).toBeUndefined();
+  });
+
+  it("leaves relocatable images uninspected, since their addresses are not load addresses", async () => {
+    const { overlap, refusal } = await resolve(
+      elf([code, reservation], { type: 1 }),
+    );
+    expect(overlap).toBeUndefined();
+    expect(refusal).toContain("fixed-address ET_EXEC only");
+  });
+});
+
+describe("ELF section overlap refusals", () => {
+  const CODE = "`.flash.text` (executable, 0x42000020, 0x40 bytes)";
+  it.each([
+    [
+      "a reservation smaller than the code",
+      [code, { ...reservation, size: 0x20 }],
+      `${CODE} and \`.flash_rodata_dummy\` (NOBITS, 0x42000020, 0x20 bytes)`,
+    ],
+    [
+      "a reservation that starts inside the code",
+      [code, { ...reservation, address: 0x42000030 }],
+      `${CODE} and \`.flash_rodata_dummy\` (NOBITS, 0x42000030, 0x100 bytes)`,
+    ],
+    [
+      "two overlapping code sections",
+      [code, { ...code, name: ".flash.text2", address: 0x42000040 }],
+      `\`.flash.text2\` (executable, 0x42000040, 0x40 bytes) and ${CODE}`,
+    ],
+    [
+      "an executable reservation",
+      [code, { ...reservation, flags: EXEC_ALLOC }],
+      `\`.flash_rodata_dummy\` (executable, NOBITS, 0x42000020, 0x100 bytes) and ${CODE}`,
+    ],
+    // The pair of the verified shape is not the cause: the third section is.
+    [
+      "a reservation that also covers rodata",
+      [code, reservation, { ...rodata, address: 0x42000100 }],
+      "`.flash_rodata_dummy` (NOBITS, 0x42000020, 0x100 bytes) and `.flash.rodata` (0x42000100, 0x10 bytes)",
+    ],
+    [
+      "code that also overlaps rodata",
+      [code, reservation, { ...rodata, address: 0x42000040 }],
+      `${CODE} and \`.flash.rodata\` (0x42000040, 0x10 bytes)`,
+    ],
+    // ESP-IDF v5.5.2's C5 and C61 builds also reserve the code and rodata for external RAM.
+    [
+      "a second reservation over the code and rodata",
+      [
+        code,
+        reservation,
+        rodata,
+        { ...reservation, name: ".ext_ram.dummy", size: 0x200 },
+      ],
+      `${CODE} and \`.ext_ram.dummy\` (NOBITS, 0x42000020, 0x200 bytes)`,
+    ],
+    [
+      "a second code reservation",
+      [
+        code,
+        reservation,
+        { ...iram, address: 0x42000400 },
+        { ...reservation, name: ".iram_dummy", address: 0x42000400 },
+      ],
+      "`.iram0.text` (executable, 0x42000400, 0x20 bytes) and `.iram_dummy` (NOBITS, 0x42000400, 0x100 bytes)",
+    ],
+  ] as const)(
+    "refuses %s and names its cause",
+    async (_label, sections, named) => {
+      const { overlap, refusal, preparation } = await resolve(elf(sections));
+      expect(overlap?.status).toBe("unsupported");
+      expect(refusal).toContain(`Sections ${named} share addresses`);
+      expect(refusal).toContain(
+        "This lane prepares only one NOBITS section that starts at an executable PROGBITS section's address and covers it",
+      );
+      expect(refusal).toContain("docs/providers/ghidra-riscv.md");
+      expect(preparation).toBeUndefined();
+    },
+  );
+});
+
+describe("ELF section tables at the reader's bounds", () => {
+  it("stops at the second overlap in a table of 10,000 executable sections at one address", async () => {
+    const sections = Array.from({ length: 10_000 }, () => ({
+      ...code,
+      size: 4,
+    }));
+    const { overlap, refusal } = await resolve(elf(sections, { names: false }));
+    expect(overlap).toEqual({
+      status: "unsupported",
+      witnesses: [
+        {
+          index: 2,
+          name: null,
+          address: "0x42000020",
+          size: "0x4",
+          nobits: false,
+          executable: true,
+        },
+        {
+          index: 1,
+          name: null,
+          address: "0x42000020",
+          size: "0x4",
+          nobits: false,
+          executable: true,
+        },
+      ],
+    });
+    expect(refusal).toContain(
+      "Sections section [2] (executable, 0x42000020, 0x4 bytes) and section [1]",
+    );
+  });
+
+  // Disjoint NOBITS sections, so only the number of records matters.
+  const disjoint = (count: number): Section[] =>
+    Array.from({ length: count }, (_, index) => ({
+      ...reservation,
+      address: 0x42000020 + index * 0x100,
+    }));
+
+  it("keeps 65,280 allocated sections, the most the overlap check keeps", async () => {
+    const { overlap, refusal } = await resolve(
+      elf(disjoint(0xff00), { names: false }),
+    );
+    expect(overlap).toEqual({ status: "none" });
+    expect(refusal).toBeNull();
+  });
+
+  it("refuses a table with more allocated sections than the overlap check keeps", async () => {
+    const { overlap, refusal } = await resolve(
+      elf(disjoint(0xff01), { names: false }),
+    );
+    expect(overlap).toEqual({
+      status: "unavailable",
+      reason:
+        "the section table declares more than 65280 allocated sections, the most the overlap check keeps",
+    });
+    expect(refusal).toContain(
+      "requires a readable section table: the section table declares more than 65280 allocated sections",
+    );
+  });
+
+  it("reads ELF64 section tables, with addresses beyond 32 bits", async () => {
+    const high = 0x1_4200_0020;
+    const { overlap, refusal, preparation } = await resolve(
+      elf(
+        [
+          { ...code, address: high },
+          { ...reservation, address: high },
+        ],
+        { elfClass: 64 },
+      ),
+    );
+    expect(overlap).toEqual({
+      status: "code-reservation",
+      code: {
+        index: 1,
+        name: ".flash.text",
+        address: "0x142000020",
+        size: "0x40",
+        offset: "0x2000",
+      },
+      reservation: {
+        index: 2,
+        name: ".flash_rodata_dummy",
+        address: "0x142000020",
+        size: "0x100",
+      },
+    });
+    expect(refusal).toBeNull();
+    expect(preparation?.code.address).toBe("0x142000020");
+  });
+
+  // Double-float lanes read no ISA declaration; the resolver still refuses a
+  // table it cannot read before any lane sees the image.
+  it("rejects a truncated section table of a double-float image", async () => {
+    const directory = await createTestTempDirectory("rea-elf-overlap-test-");
+    const path = join(directory, "truncated.elf");
+    await writeFile(
+      path,
+      elf([code, reservation], { elfClass: 64 }).subarray(
+        0,
+        SECTION_TABLE + 64 * 2,
+      ),
+    );
+    const resolved = await parseBinaryTarget(path);
+    expect(resolved.ok).toBe(false);
+    if (!resolved.ok)
+      expect(resolved.error.message).toContain(
+        "truncated ELF section header table",
+      );
+  });
+});
diff --git a/tests/boundary/providers/ghidra/ghidraLauncher.test.ts b/tests/boundary/providers/ghidra/ghidraLauncher.test.ts
index f33e3ddfd6a..01872bbd0b7 100644
--- a/tests/boundary/providers/ghidra/ghidraLauncher.test.ts
+++ b/tests/boundary/providers/ghidra/ghidraLauncher.test.ts
@@ -29,6 +29,25 @@ import {
   ghidraHeadlessCommand,
   GhidraHeadlessLauncher,
 } from "../../../../src/ghidra/GhidraLauncher.js";
+import type { GhidraRiscvLoadPreparation } from "../../../../src/ghidra/GhidraRiscvProfile.js";
+
+// ESP-IDF v6.1 ESP32-C6 hello_world's committed preparation.
+const ESP_PREPARATION: GhidraRiscvLoadPreparation = {
+  policy: "nobits-reservation-overlay-v1",
+  code: {
+    index: 15,
+    name: ".flash.text",
+    address: "0x42000020",
+    size: "0xfff2",
+    offset: "0xc020",
+  },
+  reservation: {
+    index: 16,
+    name: ".flash_rodata_dummy",
+    address: "0x42000020",
+    size: "0x18000",
+  },
+};
 
 const fixturePath = fileURLToPath(
   new URL(
@@ -425,6 +444,86 @@ describe("Ghidra headless launcher", () => {
   });
 });
 
+describe("Ghidra RISC-V load preparation arguments", () => {
+  it("prepares a committed RISC-V section overlap after the loader and before seeds", () => {
+    const base = {
+      platform: "linux" as const,
+      projectRoot: "/tmp/project",
+      targetPath: "/tmp/target",
+      bridgeScriptPath: "/package/bridge/ReaGhidraBridge.java",
+      descriptorPath: "/tmp/session.json",
+      ghidraLogPath: "/tmp/ghidra.log",
+      scriptLogPath: "/tmp/script.log",
+      languageOverride: {
+        languageId: "RISCV:LE:32:default",
+        compilerSpecId: "gcc",
+      },
+      seedPath: "/tmp/runtime/seeds/seeds.tsv",
+      disabledAnalyzers: ["Decompiler Parameter ID"],
+    };
+    const script = "/package/bridge/ReaGhidraPrepareElfLoad.java";
+    expect(ghidraHeadlessArguments(base)).not.toContain(script);
+    const arguments_ = ghidraHeadlessArguments({
+      ...base,
+      riscvLoadPreparation: ESP_PREPARATION,
+    });
+    const at = arguments_.indexOf(script);
+    expect(arguments_.slice(at - 1, at + 7)).toEqual([
+      "-preScript",
+      script,
+      "nobits-reservation-overlay-v1",
+      "0x42000020",
+      "0xfff2",
+      "0xc020",
+      "0x42000020",
+      "0x18000",
+    ]);
+    expect(at).toBeGreaterThan(arguments_.indexOf("-import"));
+    for (const later of [
+      "/package/bridge/ReaGhidraApplySeeds.java",
+      "/package/bridge/ReaGhidraAnalysisOptions.java",
+      "/package/bridge/ReaGhidraNoReturnFix.java",
+    ])
+      expect(at).toBeLessThan(arguments_.indexOf(later));
+    const { languageOverride: _pin, ...unpinned } = base;
+    for (const conflict of [
+      { psp: true as const },
+      { mipsSoftFloat: true as const },
+      { dosMz: true as const },
+      { dosCom: true as const },
+      {
+        rawBinary: {
+          languageId: "x86:LE:32:default",
+          compilerSpecId: "default",
+          baseAddr: "0x1000",
+        },
+      },
+    ])
+      expect(() =>
+        ghidraHeadlessArguments({
+          ...unpinned,
+          riscvLoadPreparation: ESP_PREPARATION,
+          ...conflict,
+        }),
+      ).toThrow(
+        expect.objectContaining({
+          _tag: "GhidraAdmissionError",
+          code: "riscv_load_preparation_scope",
+        }),
+      );
+    expect(() =>
+      ghidraHeadlessArguments({
+        ...unpinned,
+        riscvLoadPreparation: ESP_PREPARATION,
+        gamecubeDol: {
+          languageId: "PowerPC:BE:32:default",
+          sectionFilePath: "/tmp/gamecube-dol-sections.txt",
+        },
+      }),
+    ).toThrow(expect.objectContaining({ code: "gamecube_dol_combined" }));
+  });
+});
+
 describe("Ghidra configured import language and seeds", () => {
   const base = {
     platform: "darwin" as const,
@@ -686,6 +785,10 @@ describe("Ghidra existing project", () => {
       { riscvCallingConvention: "ilp32-prototype-v1" as const },
       "existing_project_riscv_calling_convention",
     ],
+    [
+      { riscvLoadPreparation: ESP_PREPARATION },
+      "existing_project_riscv_load_preparation",
+    ],
     [{ seedPath: "/tmp/runtime/seeds/seeds.tsv" }, "existing_project_analysis"],
     [
       { disabledAnalyzers: ["Decompiler Parameter ID"] },
diff --git a/tests/conformance/c/riscv-esp-layout.c b/tests/conformance/c/riscv-esp-layout.c
new file mode 100644
index 00000000000..3dd1f1d689f
--- /dev/null
+++ b/tests/conformance/c/riscv-esp-layout.c
@@ -0,0 +1,33 @@
+/*
+ * Freestanding ESP-IDF flash layout probe for REA's RISC-V lane. REA never
+ * runs it. tests/conformance/esp/esp32c6-shared-window.ld places .flash.text
+ * where the NOBITS .flash_rodata_dummy reserves the same addresses, as
+ * ESP-IDF does for ESP32-C6 and H4.
+ */
+#define REA_FLASH __attribute__((section(".flash.text"), noinline))
+#define REA_IRAM __attribute__((section(".iram0.text"), noinline))
+
+volatile int rea_riscv_esp_sink;
+const int rea_riscv_esp_table[2] = {7, 9};
+
+REA_FLASH __attribute__((noreturn)) void rea_riscv_esp_restart(void) {
+  for (;;) rea_riscv_esp_sink = 1;
+}
+
+REA_FLASH int rea_riscv_esp_sum(int left, int right) {
+  return left + right + rea_riscv_esp_table[1];
+}
+
+/* Ends with the no-return call, as ESP-IDF's app_main ends with esp_restart(). */
+REA_FLASH void rea_riscv_esp_main(void) {
+  rea_riscv_esp_sink = rea_riscv_esp_sum(2, 3);
+  rea_riscv_esp_restart();
+}
+
+/* Follows rea_riscv_esp_main; pseudocode that runs past the call shows 0x5a5a. */
+REA_FLASH void rea_riscv_esp_next(void) { rea_riscv_esp_sink = 0x5a5a; }
+
+/* IRAM calls flash code through auipc+jalr, as ESP-IDF's startup does. */
+REA_IRAM void rea_riscv_esp_entry(void) {
+  rea_riscv_esp_main();
+}
diff --git a/tests/conformance/esp/esp32c6-edge-names.ld b/tests/conformance/esp/esp32c6-edge-names.ld
new file mode 100644
index 00000000000..ed73bb13dfa
--- /dev/null
+++ b/tests/conformance/esp/esp32c6-edge-names.ld
@@ -0,0 +1,34 @@
+ENTRY(rea_riscv_esp_entry)
+/*
+ * esp32c6-shared-window.ld with names the load preparation's temporary blocks
+ * must avoid: the reservation is named `.flash.text.rea`, the code's first
+ * temporary name, and a disjoint section takes the next, `.flash.text.rea.1`.
+ */
+PHDRS
+{
+  iram PT_LOAD;
+  dram PT_LOAD;
+  irom PT_LOAD;
+  drom PT_LOAD;
+}
+SECTIONS
+{
+  .iram0.text 0x40800000 : { *(.iram0.text) } :iram
+  .flash.text.rea.1 0x40808000 : { LONG(0x00000013) } :iram
+  .dram0.data 0x40810000 : { *(.sdata .sdata.* .data .data.* .sbss .sbss.* .bss .bss.*) } :dram
+  .flash.text 0x42000020 :
+  {
+    _text_start = ABSOLUTE(.);
+    *(.flash.text) *(.text .text.*)
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } :irom
+  .flash.text.rea 0x42000020 (NOLOAD) :
+  {
+    _flash_rodata_dummy_start = .;
+    . = ALIGN(ALIGNOF(.flash.text)) + SIZEOF(.flash.text);
+    . = ALIGN(0x10000) + 0x20;
+  } :drom
+  .flash.rodata : { *(.srodata .srodata.* .rodata .rodata.*) } :drom
+  /DISCARD/ : { *(.comment) *(.note.*) }
+}
diff --git a/tests/conformance/esp/esp32c6-reservation-first.ld b/tests/conformance/esp/esp32c6-reservation-first.ld
new file mode 100644
index 00000000000..2a848330bcf
--- /dev/null
+++ b/tests/conformance/esp/esp32c6-reservation-first.ld
@@ -0,0 +1,27 @@
+ENTRY(rea_riscv_esp_entry)
+/*
+ * esp32c6-shared-window.ld with the NOLOAD reservation before the code in the
+ * section table. Ghidra 12.1.4's ELF loader gives overlapping addresses to the
+ * later section, so this order already loads the code in the default address
+ * space, and REA's load preparation must change nothing.
+ */
+PHDRS
+{
+  iram PT_LOAD;
+  dram PT_LOAD;
+  irom PT_LOAD;
+  drom PT_LOAD;
+}
+SECTIONS
+{
+  .iram0.text 0x40800000 : { *(.iram0.text) } :iram
+  .dram0.data 0x40810000 : { *(.sdata .sdata.* .data .data.* .sbss .sbss.* .bss .bss.*) } :dram
+  .flash_rodata_dummy 0x42000020 (NOLOAD) :
+  {
+    _flash_rodata_dummy_start = .;
+    . = . + 0x10000;
+  } :drom
+  .flash.text 0x42000020 : { *(.flash.text) *(.text .text.*) } :irom
+  .flash.rodata 0x42010020 : { *(.srodata .srodata.* .rodata .rodata.*) } :drom
+  /DISCARD/ : { *(.comment) *(.note.*) }
+}
diff --git a/tests/conformance/esp/esp32c6-reservation-named-ram.ld b/tests/conformance/esp/esp32c6-reservation-named-ram.ld
new file mode 100644
index 00000000000..2a8dfc7f061
--- /dev/null
+++ b/tests/conformance/esp/esp32c6-reservation-named-ram.ld
@@ -0,0 +1,35 @@
+ENTRY(rea_riscv_esp_entry)
+/*
+ * esp32c6-shared-window.ld with the NOLOAD reservation named `ram`, the name of
+ * the RISC-V default address space. Section names are display labels, so REA's
+ * load preparation must still give the reservation an overlay space.
+ */
+PHDRS
+{
+  iram PT_LOAD;
+  dram PT_LOAD;
+  irom PT_LOAD;
+  drom PT_LOAD;
+}
+SECTIONS
+{
+  .iram0.text 0x40800000 : { *(.iram0.text) } :iram
+  .dram0.data 0x40810000 : { *(.sdata .sdata.* .data .data.* .sbss .sbss.* .bss .bss.*) } :dram
+  /* ESP-IDF's text bounds: Ghidra pins the absolute ones; _etext is past the
+     section's last byte. */
+  .flash.text 0x42000020 :
+  {
+    _text_start = ABSOLUTE(.);
+    *(.flash.text) *(.text .text.*)
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } :irom
+  ram 0x42000020 (NOLOAD) :
+  {
+    _flash_rodata_dummy_start = .;
+    . = ALIGN(ALIGNOF(.flash.text)) + SIZEOF(.flash.text);
+    . = ALIGN(0x10000) + 0x20;
+  } :drom
+  .flash.rodata : { *(.srodata .srodata.* .rodata .rodata.*) } :drom
+  /DISCARD/ : { *(.comment) *(.note.*) }
+}
diff --git a/tests/conformance/esp/esp32c6-shared-window.ld b/tests/conformance/esp/esp32c6-shared-window.ld
new file mode 100644
index 00000000000..4259eb6bab9
--- /dev/null
+++ b/tests/conformance/esp/esp32c6-shared-window.ld
@@ -0,0 +1,37 @@
+ENTRY(rea_riscv_esp_entry)
+/*
+ * ESP-IDF v6.1's ESP32-C6 application layout, reduced for REA's RISC-V lane
+ * (components/esp_system/ld/esp32c6/memory.ld.in and sections.ld.in): flash
+ * text and rodata share the 0x42000020 window, and the NOLOAD
+ * .flash_rodata_dummy reserves the text's addresses in the rodata segment.
+ * The two allocations overlap by design, so the link needs --no-check-sections.
+ */
+PHDRS
+{
+  iram PT_LOAD;
+  dram PT_LOAD;
+  irom PT_LOAD;
+  drom PT_LOAD;
+}
+SECTIONS
+{
+  .iram0.text 0x40800000 : { *(.iram0.text) } :iram
+  .dram0.data 0x40810000 : { *(.sdata .sdata.* .data .data.* .sbss .sbss.* .bss .bss.*) } :dram
+  /* ESP-IDF's text bounds: Ghidra pins the absolute ones; _etext is past the
+     section's last byte. */
+  .flash.text 0x42000020 :
+  {
+    _text_start = ABSOLUTE(.);
+    *(.flash.text) *(.text .text.*)
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } :irom
+  .flash_rodata_dummy 0x42000020 (NOLOAD) :
+  {
+    _flash_rodata_dummy_start = .;
+    . = ALIGN(ALIGNOF(.flash.text)) + SIZEOF(.flash.text);
+    . = ALIGN(0x10000) + 0x20;
+  } :drom
+  .flash.rodata : { *(.srodata .srodata.* .rodata .rodata.*) } :drom
+  /DISCARD/ : { *(.comment) *(.note.*) }
+}
diff --git a/tests/conformance/ghidra/riscv-fixture.mjs b/tests/conformance/ghidra/riscv-fixture.mjs
index 65636d171c4..6e985250958 100644
--- a/tests/conformance/ghidra/riscv-fixture.mjs
+++ b/tests/conformance/ghidra/riscv-fixture.mjs
@@ -8,7 +8,7 @@ import { promisify } from "node:util";
 
 const execute = promisify(execFile);
 
-/** One build per float ABI the lane verifies. */
+/** One build per float ABI the lane verifies, plus ESP-IDF's flash layout. */
 const BUILDS = {
   double: {
     sources: ["../c/riscv.c", "./riscv-probe.S"],
@@ -27,6 +27,44 @@ const BUILDS = {
     mabi: () => "ilp32",
     flags: 1,
   },
+  // ESP-IDF's ESP32-C6 base string and flash layout: the NOBITS
+  // .flash_rodata_dummy reserves .flash.text's addresses.
+  esp: {
+    sources: ["../c/riscv-esp-layout.c"],
+    march: () => "rv32imac_zicsr_zifencei",
+    mabi: () => "ilp32",
+    flags: 1,
+    entry: "rea_riscv_esp_entry",
+    linkerScript: "../esp/esp32c6-shared-window.ld",
+  },
+  // The same image with the reservation first in the section table.
+  "esp-reservation-first": {
+    sources: ["../c/riscv-esp-layout.c"],
+    march: () => "rv32imac_zicsr_zifencei",
+    mabi: () => "ilp32",
+    flags: 1,
+    entry: "rea_riscv_esp_entry",
+    linkerScript: "../esp/esp32c6-reservation-first.ld",
+  },
+  // The same image with the reservation named like the default address space.
+  "esp-reservation-named-ram": {
+    sources: ["../c/riscv-esp-layout.c"],
+    march: () => "rv32imac_zicsr_zifencei",
+    mabi: () => "ilp32",
+    flags: 1,
+    entry: "rea_riscv_esp_entry",
+    linkerScript: "../esp/esp32c6-reservation-named-ram.ld",
+  },
+  // The same image with the reservation and a disjoint section named like the
+  // preparation's temporary blocks.
+  "esp-edge-names": {
+    sources: ["../c/riscv-esp-layout.c"],
+    march: () => "rv32imac_zicsr_zifencei",
+    mabi: () => "ilp32",
+    flags: 1,
+    entry: "rea_riscv_esp_entry",
+    linkerScript: "../esp/esp32c6-edge-names.ld",
+  },
 };
 
 const readerOptions = {
@@ -50,15 +88,17 @@ const readRiscvElf = async (reader, path, floatAbi) => {
   };
   const sections = [
     ...stdout.matchAll(
-      /^\s*\[\s*\d+\]\s+(\S+)\s+(\S+)\s+([\da-f]+)\s+([\da-f]+)\s+([\da-f]+)\s+[\da-f]+\s+(\S*)\s+\d+\s+\d+\s+\d+\s*$/gmu,
+      /^\s*\[\s*(\d+)\]\s+(\S+)\s+(\S+)\s+([\da-f]+)\s+([\da-f]+)\s+([\da-f]+)\s+[\da-f]+\s+(\S*)\s+\d+\s+\d+\s+\d+\s*$/gmu,
     ),
-  ].map(([, name, type, address, offset, size, flags]) => ({
+  ].map(([, index, name, type, address, offset, size, flags]) => ({
+    index: Number(index),
     name,
     type,
     address: Number.parseInt(address, 16),
     offset: Number.parseInt(offset, 16),
     size: Number.parseInt(size, 16),
     allocated: flags.includes("A"),
+    executable: flags.includes("X"),
   }));
   assert.ok(sections.length > 0, "Missing readelf section table");
   // LLVM readelf prints each attribute as Tag, TagName and Value lines.
@@ -85,17 +125,61 @@ const readRiscvElf = async (reader, path, floatAbi) => {
   };
 };
 
+/** REA's section-overlap fact, recomputed from LLVM readelf's section table. */
+const sectionOverlapOf = (sections) => {
+  const hex = (value) => `0x${value.toString(16)}`;
+  const allocated = sections.filter(
+    (section) => section.allocated && section.size > 0,
+  );
+  const pairs = allocated
+    .filter((code) => code.executable && code.type === "PROGBITS")
+    .flatMap((code) =>
+      allocated
+        .filter(
+          (other) =>
+            other !== code &&
+            code.address < other.address + other.size &&
+            other.address < code.address + code.size,
+        )
+        .map((other) => [code, other]),
+    );
+  if (pairs.length === 0) return { status: "none" };
+  assert.equal(pairs.length, 1, "A fixture declares more than one overlap");
+  const [[code, reservation]] = pairs;
+  assert.equal(reservation.type, "NOBITS");
+  assert.equal(reservation.executable, false);
+  assert.equal(reservation.address, code.address);
+  assert.ok(reservation.size >= code.size);
+  return {
+    status: "code-reservation",
+    code: {
+      index: code.index,
+      name: code.name,
+      address: hex(code.address),
+      size: hex(code.size),
+      offset: hex(code.offset),
+    },
+    reservation: {
+      index: reservation.index,
+      name: reservation.name,
+      address: hex(reservation.address),
+      size: hex(reservation.size),
+    },
+  };
+};
+
 const sha256 = async (path) =>
   createHash("sha256")
     .update(await readFile(path))
     .digest("hex");
 
 /** Build and independently inspect a source-owned ELF; never execute it. */
-export async function buildRiscvFixture(directory, bits, floatAbi = "double") {
+export async function buildRiscvFixture(directory, bits, variant = "double") {
   assert.ok(bits === 32 || bits === 64);
-  const build = BUILDS[floatAbi];
-  assert.ok(build !== undefined, `No ${floatAbi}-float RISC-V fixture`);
-  assert.ok(floatAbi === "double" || bits === 32);
+  const build = BUILDS[variant];
+  assert.ok(build !== undefined, `No ${variant} RISC-V fixture`);
+  assert.ok(variant === "double" || bits === 32);
+  const floatAbi = variant === "double" ? "double" : "soft";
   const compiler = process.env.REA_RISCV_CLANG ?? "clang";
   const linker = process.env.REA_RISCV_LLD ?? "ld.lld";
   const reader = process.env.REA_RISCV_READELF ?? "llvm-readelf";
@@ -104,7 +188,7 @@ export async function buildRiscvFixture(directory, bits, floatAbi = "double") {
   );
   const path = join(
     directory,
-    `rv${bits}${floatAbi === "double" ? "" : `-${floatAbi}`}.elf`,
+    `rv${bits}${variant === "double" ? "" : `-${variant}`}.elf`,
   );
   const args = [
     `--target=riscv${bits}-unknown-elf`,
@@ -116,8 +200,15 @@ export async function buildRiscvFixture(directory, bits, floatAbi = "double") {
     "-fno-pic",
     "-O0",
     "-g",
-    "-Wl,-e,rea_riscv_entry",
+    `-Wl,-e,${build.entry ?? "rea_riscv_entry"}`,
     "-Wl,--build-id=none",
+    ...(build.linkerScript === undefined
+      ? []
+      : [
+          `-Wl,-T,${fileURLToPath(new URL(build.linkerScript, import.meta.url))}`,
+          // ESP-IDF's reservation overlaps the code it reserves by design.
+          "-Wl,--no-check-sections",
+        ]),
     ...sources,
     "-o",
     path,
@@ -146,6 +237,17 @@ export async function buildRiscvFixture(directory, bits, floatAbi = "double") {
     assert.equal(symbols[name], undefined, `Ambiguous readelf symbol ${name}`);
     symbols[name] = `0x${BigInt(`0x${value}`).toString(16)}`;
   }
+  // Linker-script symbols, with the section index or ABS that readelf reports.
+  const linkerSymbols = {};
+  for (const [, value, section, name] of elf.stdout.matchAll(
+    /^\s*\d+:\s+([\da-f]+)\s+0\s+NOTYPE\s+GLOBAL\s+\S+\s+(ABS|\d+)\s+(_\w+)\s*$/gmu,
+  )) {
+    assert.equal(linkerSymbols[name], undefined, `Ambiguous symbol ${name}`);
+    linkerSymbols[name] = {
+      address: `0x${BigInt(`0x${value}`).toString(16)}`,
+      section: section === "ABS" ? section : Number(section),
+    };
+  }
   return {
     path,
     sha256: await sha256(path),
@@ -155,8 +257,10 @@ export async function buildRiscvFixture(directory, bits, floatAbi = "double") {
       type: 2,
       flags: elf.flags,
       isa: elf.isa,
+      sectionOverlap: sectionOverlapOf(elf.sections),
     },
     symbols,
+    linkerSymbols,
     sections: elf.sections,
     toolchain: {
       compiler: { command: compiler, version: compilerVersion.stdout.trim() },
diff --git a/tests/support/statingFacts.ts b/tests/support/statingFacts.ts
new file mode 100644
index 00000000000..dbd08c92ab9
--- /dev/null
+++ b/tests/support/statingFacts.ts
@@ -0,0 +1,15 @@
+import { expect } from "vitest";
+
+const token = (fact: string): string =>
+  `(?<!\\w)${fact.replace(/[\\^$.*+?()[\]{}|/]/gu, "\\$&")}(?!\\w)`;
+
+/**
+ * Matches text that states every fact as a whole token, in any order and
+ * wording, so a test checks the parameter names and values an explanation
+ * must carry without freezing the sentence around them. `arm` does not match
+ * inside `armv7-m`.
+ */
+export const stating = (...facts: readonly string[]) =>
+  expect.stringMatching(
+    new RegExp(facts.map((fact) => `(?=[\\s\\S]*${token(fact)})`).join("")),
+  );