Reconcile the docs after the last three corrections

The last three commits changed things the documentation still asserted in the
old direction. Fixed:

roadmap
  * 227 tests -> 238.
  * The level_overlay bullet contradicted itself: it said "the header words are
    not named" in the same breath as "+0x00 load base is 0x1A7C80". Now says
    +0x00 IS the load base and is named, +0x0c is excluded as the .lit size by
    sign (below file length on 16/27, by up to 8.9%) and remains unnamed, and the
    unnamed remainder is stated as such.
  * Section names aligned with the Phase 3 list (lvl.vtbl, lvl.camvtbl,
    lvl.sndvtbl).

core-data-regions.md
  * The claim-assertion audit still said the two PCSX2 claims were "NOT
    assertable here -- needs a savestate". They are asserted now, gated on
    GC_SSTATE, in the same file. Updated, with the two corrections that fell out
    of writing them recorded right there.
  * "that string is inside the collision routine" was never established. It is
    in the string pool, yes; the reference to it is not found. Reworded to say
    so, including the zero-hit result.

research log
  * field_00 now carries its name and the .lit/$gp/program context.
  * The field_0c falsification and the byte-order retraction are both recorded
    here as well, so the log and the format file agree.

Nothing left asserting the withdrawn anchor, and no stale test counts.

docs/formats/core-data-regions.md

@@ -1707,11 +1707,14 @@ than on a sample.
 
 ### What would actually unblock this
 
-`overlay.bin` **is the game's own code**, and the collision parser is in it --
-`Camera_CollPrimTest WARNING! - grid out of bounds! (RAR)` was located in the
-debug string pool earlier, and that string is inside the collision routine. The
-format is therefore recoverable, but not by measuring bytes: it needs either
-disassembly of that routine or a reference for R&C2's collision cell record.
+`overlay.bin` **is the game's own code** -- it is the level's `.lit` section,
+loaded at `0x1A7C80` -- and the collision debug string
+`Camera_CollPrimTest WARNING! - grid out of bounds! (RAR)` is in its string pool.
+So the parser is reachable. What is *not* established is the reference to it: a
+`$gp`-relative search for the string returns **zero** instruction-aligned hits,
+so the code addresses that string by some other means. The format is therefore
+recoverable, but not by measuring bytes: it needs disassembly of that routine or
+a reference for R&C2's collision cell record.
 
 Stating this plainly is worth more than another scan. The disc-side measurement
 space for collision is now genuinely exhausted -- the bytes are available, they
@@ -1824,17 +1827,25 @@ likely to be lost. Audit against `crates/gc-extract/tests/disc.rs`:
                                                   start_16_byte_aligned
     moby class IDs in one body slot per type     moby_class_ids_sit_in_one_slot_
                                                   per_chunk_type
-    collision payload verbatim in RAM            NOT assertable here -- needs a
-                                                  savestate, so it lives in
-                                                  plan/pcsx2-verification.md
-    tfrag patch bytes all rewritten by LOD       same -- savestate-dependent
-    morphing is unobservable in that image       same -- savestate-dependent
+    collision payload essentially verbatim       collision_payload_is_verbatim_
+                                                  in_ram  (GC_SSTATE-gated)
+    tfrag pointers relocate, patches rewrite     tfrag_table_pointers_relocate_
+                                                  and_every_patch_is_rewritten
+                                                  (GC_SSTATE-gated)
+
+The last two used to be marked "not assertable here -- needs a savestate". They
+are asserted now, in the same file, gated on `GC_SSTATE` so a checkout without
+PCSX2 skips them. Writing them as tests is what corrected two claims: the
+collision payload is 903,212 of 903,248 bytes identical rather than wholly
+verbatim, and the tfrag relocation base is the *table* address `0x848040`, not
+the block base.
 
 The split is deliberate: anything readable from the disc is asserted against the
-disc, and anything that needs a running PCSX2 is documented in the plan file with
-its method. What is *not* acceptable is a disc-readable claim living only in
-prose, which is how the tie `i16[3]` finding spent two commits before it had a
-test.
+disc; anything that needs a running PCSX2 is asserted against a savestate when
+one is available, and documented in the plan file with its method when it is not.
+What is *not* acceptable is a claim living only in prose -- which is how the tie
+`i16[3]` finding spent two commits before it had a test, and how the collision
+"verbatim" claim survived long enough to be wrong.
 
 ## An external decompilation project is the same disc, and names the overlay