Sonic & Knuckles Lock-on

Sonic & Knuckles was unusual in that it allowed you to "lock" another cartridge on top. If you locked on Sonic 3, the two games would merge and you'd get Sonic 3 & Knuckles. If you locked on Sonic 2, you'd get Knuckles in Sonic 2. Other games would unlock a special form of Get Blue Spheres.

If you just want to get to the point instead of an explanation skip directly to the summary.

How Sonic 3 & Knuckles works

The main Sonic & Knuckles cartridge shows up in the lower 2MB of the cartridge area as usual. The locked on cartridge shows up in the upper 2MB. However, it's the upper 2MB of said cartridge that's mapped here, not the lower 2MB.

In other words:

Why is it done this way? To save in the Sonic 3 cartridge. Sonic 3 implements the register that swaps between ROM and save RAM (check the article on saving to SRAM for details), and Sonic & Knuckles passes it to the locked on cartridge as-is. Since Sonic 3 mirrors its 2MB ROM when save RAM is not mapped in, Sonic & Knuckles exploits this to toggle between the ROM and save RAM.

It's more nuanced than this though, see next section.

Sonic 2's patch ROM

With Sonic 2 things become trickier. The engine and some graphics need to be replaced, but there isn't enough room for that in the main Sonic & Knuckles ROM, so a second "patch" ROM (256KB large) is used. This ROM is mapped in the upper 1MB of the cartridge area:

Note that as expected, Sonic 2 will mirror its ROM into the upper address range, hence why it shows up at the 2MB mark.

But wait, the patch ROM can't be mapped in all the time (since otherwise it'd make half of Sonic 3 inaccessible), so how is the patch ROM mapped in? With the same register used to toggle save RAM! When it's set, it also swaps in the upper 1MB with the patch ROM. This doesn't interfere with Sonic 3 (since save RAM isn't so large), and allows the above mapping when using Sonic 2 too.

In other words, in Sonic & Knuckles case the register at $A130F1 performs double duty: it tells Sonic 3 to map in its save RAM, and it maps in the patch ROM too.

Get Blue Spheres

Get Blue Spheres is exactly the same case as Sonic 3 & Knuckles in terms of hardware, everything is handled by software. There is a bug though (see next section).

Why some games don't work?

Some games don't work with the lock-on mechanism (specifically, those that are larger than 2MB) and Sonic & Knuckles will act as if there was nothing there.

The reason is that Sonic & Knuckles looks for a valid ROM header to see if there's a cartridge present. Now, remember how the upper 2MB of the cartridge are visible? With smaller games, the ROM will be mirrored and the header will show up in the upper 2MB. Larger games won't do this and so Sonic & Knuckles will think that there's nothing.

Fun fact: Tanglewood is an exception to the rule as it intentionally puts a fake ROM header where Sonic & Knuckles expects to see it (making Get Blue Spheres show up). Sonic Classics does something similar. Relevant code snippet from Tanglewood, courtesy of Big Evil Corporation (the dcb instruction aligns the fake header to where it should be): 

    ; ...game before the 2MB mark...
    
    IFD FINAL
    dcb.b 0x00200100-*, $FF
    dc.b 'SEGA            '
    dc.b '                '
    dc.b '                                                '
    dc.b '                                                '
    dc.b 'GM 00001009-00'
    ENDIF
    
    ; ...game after the 2MB mark...

Quick summary

When bit 0 of $A130F1 is 0:

When bit 0 of $A130F1 is 1:

Also accesses to that register are passed on straight to the locked on cartridge.