Reconcile the docs after the last three corrections

The last three commits changed things the documentation still asserted in the
old direction. Fixed:

roadmap
  * 227 tests -> 238.
  * The level_overlay bullet contradicted itself: it said "the header words are
    not named" in the same breath as "+0x00 load base is 0x1A7C80". Now says
    +0x00 IS the load base and is named, +0x0c is excluded as the .lit size by
    sign (below file length on 16/27, by up to 8.9%) and remains unnamed, and the
    unnamed remainder is stated as such.
  * Section names aligned with the Phase 3 list (lvl.vtbl, lvl.camvtbl,
    lvl.sndvtbl).

core-data-regions.md
  * The claim-assertion audit still said the two PCSX2 claims were "NOT
    assertable here -- needs a savestate". They are asserted now, gated on
    GC_SSTATE, in the same file. Updated, with the two corrections that fell out
    of writing them recorded right there.
  * "that string is inside the collision routine" was never established. It is
    in the string pool, yes; the reference to it is not found. Reworded to say
    so, including the zero-hit result.

research log
  * field_00 now carries its name and the .lit/$gp/program context.
  * The field_0c falsification and the byte-order retraction are both recorded
    here as well, so the log and the format file agree.

Nothing left asserting the withdrawn anchor, and no stale test counts.

docs/plan/level-assets.md

@@ -1693,11 +1693,30 @@ as one.
 splits out the constant block and the level-specific tail, and a real-disc test
 covers all 27 levels:
 
-    overlay: 27 levels; field_00 1735808, field_08 1;
+    overlay: 27 levels; field_00 1735808 = 0x1A7C80, field_08 1;
     field_04 37540..=45308, field_0c 2763912..=3027336
     (17 below the file length, 10 above);
     +0x10..0x1220 identical on all
 
+Later, from OpenRAC/rac2-gc-decomp (same disc, SHA-256 verified identical):
+
+    field_00  IS the .lit load base -- 0x1A7C80, constant on all 27 levels
+              because every level's literal section loads at the same address.
+              overlay.bin IS that section: it holds code and the string pool.
+    $gp      0x1A7C80 + section offset is computed against $gp = 0x1AEFF0.
+    program  seven sections: .lit .bss .data lvl.vtbl lvl.camvtbl
+              lvl.sndvtbl .text
+
+field_0c tested as the .lit size and FAILED: it is smaller than the file on 16 of
+27 levels, by up to 8.9% (level11 file 3,151,128 vs field_0c 2,870,792). Excluded
+by sign, not by a near miss. Still unnamed.
+
+The collision assert string was then used as an anchor and the first attempt was
+WRONG -- a byte-order bug, recorded in core-data-regions.md. The PS2's MIPS is
+little-endian, so an I-type immediate is word bytes 0 and 1; searching bytes 1..3
+matches opcode/$rs instead and manufactured a single convincing "hit". Corrected,
+the count is zero. The anchor is NOT established.
+
 **`+0x0c` is not the file length.** It was recorded as one on the strength of the
 first levels measured, where it sat close to the file end. Across all 27 it falls
 on **both sides** -- below on 17, above on 10 -- so it is an ordinary