re(ui): measure the paint-order hedge -- exact on 4 of 5, and bound the rest

`compose` claimed the derived paint order "reproduces both measured
orders up to ties". That sentence was never measured and was stale by
one: there are three measured orders, not two. examples/paint_order_audit.rs
checks it.

  main menu (entries 5, 8)      derived == measured   0 inverted pairs
  developer splash (11, 14)     derived == measured   0 inverted pairs
  title (entry 4)               DIFFERS               8, all same-key ties

So the claim holds and the exception is entirely ties -- but two of those
ties are total occlusions, not near-misses. The tied family is the five
ptlogo_back2eff glows (key 32899); back2eff5 is 1133x280 and FULLY
CONTAINS back2eff3 (82,824 px^2 = 100% of the smaller) and back2eff4
(152,047 px^2 = 100%). Derived paints it on top of two glows it entirely
covers; the game paints it underneath. A tie-break by declaration index
can therefore be wrong by a whole layer. The title itself is unaffected --
it has a measured order.

The port's actual exposure, per screen: title, main menu and developer
splash all use MEASURED orders; the publisher splash is derived but has
ZERO ties, so it is fully determined; EXTRAS is derived with 15 tied
pairs of which only 2 OVERLAP. Two element pairs on one screen is the
whole risk, and that is what HANDOFF now says -- not the raw 15, which
would have overstated it 7x.

Reach stated: this compares the derived order against orders measured
from the game, not an independent derivation, so where no measured order
exists only the tie exposure can be checked. Overlap uses pivot*2 as the
element size at its resting placement.

Stale comment in compose corrected. METHOD: a hedge in a code comment is
an unmeasured claim; and count the cases that can bite, not the ones that
match the pattern.

docs/re/structures/ui-paint-order-derived-check.md

@@ -0,0 +1,74 @@
+# ✅ Does the derived paint order reproduce the measured ones? Mostly — and the gap is bounded
+
+**Status:** ✅ **checked, with numbers.** `compose` uses a paint order *measured
+from the running game* for the builds that have one and falls back to
+`derived_paint_order` — a sort on each sprite's layer key — everywhere else. The
+code's doc comment claimed the derived order "reproduces both measured orders up
+to ties". That was a hedge with no measurement behind it, and it was stale:
+there are **three** measured orders now, not two.
+
+Tool: `cargo run -p sylpheed-formats --example paint_order_audit -- dat/GP_TITLE.pak`.
+Output committed at [`data/paint-order-audit.txt`](../data/paint-order-audit.txt).
+
+## The claim holds, and the exception is all ties
+
+| build | derived == measured | inverted pairs | of which same-key ties |
+|---|---|---|---|
+| main menu (entries 5, 8) | **YES** | 0 | — |
+| developer splash (11, 14) | **YES** | 0 | — |
+| title (entry 4) | **NO** | 8 | **8 — every one** |
+
+Four of the five measured bundles reproduce **exactly**. The title's eight
+disagreements are all between elements that share a layer key, which the sort
+cannot order and breaks by declaration index.
+
+## ⚠️ Two of those ties are total occlusions
+
+The tied family is the five `ptlogo_back2eff` glows, all key `32899`:
+
+```
+measured paints: 14, 15, 18, 16, 17
+derived  paints: 14, 15, 16, 17, 18
+```
+
+Two pairs flip, and they are not near-misses:
+
+| pair | overlap | |
+|---|---|---|
+| `back2eff5` vs `back2eff3` | 82 824 px² | **100 % of the smaller** |
+| `back2eff5` vs `back2eff4` | 152 047 px² | **100 % of the smaller** |
+
+`back2eff5` is 1133×280 and **fully contains** both. Derived paints it on top of
+two glows it completely covers; the game paints it underneath. So a tie-break by
+declaration index is not cosmetic — where it is wrong, it can be wrong by a whole
+layer. ✅ The title is unaffected in practice, because it has a measured order.
+
+## ✅ The port's actual exposure is two element pairs
+
+Per build, counting tied pairs and how many of them **overlap** (only those can
+paint visibly differently):
+
+| entry | the port's screen | order used | tied pairs | overlapping |
+|---|---|---|---|---|
+| 4 | title | **measured** | — | — |
+| 5 | main menu | **measured** (derived agrees exactly) | 0 | 0 |
+| **6** | **`EXTRAS`** | **derived** | 15 | **2** |
+| 10 | publisher splash | derived | **0** | **0** |
+| 11 | developer splash | **measured** | — | — |
+
+So of the five screens, **one** rests on an unverified derived order, and its
+risk is **two overlapping tied pairs** — not the 15 the raw tie count suggests.
+The publisher splash's derived order is fully determined (no ties at all).
+
+🟡 For completeness, outside the port's set: entry 7 (the Japanese title) is the
+worst on the disc at 37 tied pairs, 16 overlapping.
+
+## Reach
+
+* This checks the derived order against the orders **measured from the running
+  game**; it is not an independent derivation of what the game does. Where no
+  measured order exists, agreement cannot be checked at all — only the *tie
+  exposure* can, which is what the table above reports.
+* Overlap uses `pivot × 2` as the element's size (documented as the sprite's own
+  dimensions for a `.t32`) at its resting placement, so scaled or rotated
+  elements are approximated.