To do this methodically, I made a spreadsheet listing every pin of every logic chip that was not in the I/O mapped RAM and PAL chip circuit. The traced them with a multimeter. 

Some chips have obvious functions. The 74LS175 is a 4-bit output port and the 74LS125 is a 4-bit input port.  Both are wired to D0-3. There will be bits for tape output and buzzer, and tape input. What the other bits do I don't know, or care much.

There's some logic made of discrete gates (LS32, LS74, HC14), and even a 4-input OR gate made of four diodes. 

Tape output seems to be just a 1% resistor divider, so 2.8 volt TTL out becomes 28 mV audio.

Tape input seems to be just an RC filter into a CMOS Schmitt trigger. You'll have to turn the volume up to TTL levels, because there is no amplifier circuit. Not even a single transistor. But that is consistent with Sinclair cheapness.

The RC delay on the /WR signal suggests a nasty hack to give noisy input signals more time to settle down before writing data to the RAM. 2k2 * 68p is ~ 150 ns time constant.

The interrupt pulse signal lengths are 560p x 47k = 26 microseconds time constant. This is ten times the Memotech time, if its 56p capacitors are to be believed.

Some of the logic seems odd, or redundant. This might just be defensive design, in case things have to be thrown out of the PAL chips. Again, I don't care much so so long as it works. There might be a market for maybe 15 units, and that would be 3/8ths of the Einstein Facebook group!