docs: input was never the blocker; the third permutation came from the main menu

The game receives the (A) press - measured, vk=5800 flags=0001, out of ~6500
polls. Input delivery was never broken; four harness bugs were, and with those
fixed the boot goes title -> one (A) -> main menu.

GP_DIALOG DIFFICULTY is still unreached (NEW GAME hits the standing black-screen
hang), but the main menu carries two primitives, which is what the question
needed. Records the slip in the instrumentation too: logging on XSUCCEEDED
counts X_ERROR_EMPTY as success and buried the two real keystrokes under 6499
empty polls.

Next step is now STATIC: a primitive's position is stable by role across three
measured screens but nothing in the file predicts it, so dump the full 60-byte
declaration entries - four words unread - and look for a word that sorts like
the measured orders.

docs/re/BACKLOG.md

@@ -107,40 +107,21 @@ See [`structures/ui-composable-bundles.md`](structures/ui-composable-bundles.md)
   title — the one screen with ground truth — it takes mean luminance from **+18 %
   to −1.3 %** of the capture (76.30 → 63.72 vs 64.58) and mean abs diff 16.07 →
   13.08. Off by default because of the item below.
-* ❔ **Where a primitive paints. ← next, and it needs the emulator.** A primitive
-  has no `T8aD` header, so no layer key, and the derived order forces the keyless
-  last — which wipes **36 of the 125** builds that draw one (`GP_DIALOG`'s
-  `pzeff00.prm` is a single opaque-black full-screen keyframe). No constant
-  default works: the splash paints its primitive **first** (a black backdrop),
-  the title paints one at slot **4** and another **last**, and declaration order
-  fails the title too. Cheapest first step: a third measured paint order from a
-  screen carrying exactly one primitive — the `GP_DIALOG` DIFFICULTY box, which
-  is reachable from the main menu, would say whether its dim is first or last.
-  This is a runtime child-list read, so it is an emulator item, not a static one.
-  🔴 **ATTEMPTED 2026-08-19 and BLOCKED.** The reader
-  (`tools/re-capture/screen_children.py`) is written and validated — it
-  reproduces both known permutations character-for-character off the live title.
-  The screen could not be reached: **Ⓐ does not advance the title screen** at any
-  hold from 0.10 s to 0.40 s, nor does START, with the pad verified end to end.
-  Two harness bugs were found and fixed on the way (`--audio` is not a cvar and
-  broke eight boot scripts; `vgamepad` no longer exists but `skip_intro.sh`
-  still called it, pressing nothing while exiting 0). Neither unblocks the title.
-  🔬 **2026-08-19, second attempt: a root cause found and then refuted.** With
-  the emulator's stdout kept, the log said it at once — `dialogs=1`, and
-  **8 388 601** `XamInputGetKeystrokeEx` calls discarded by `IsUIActive()`. The
-  dialog is a **sign-in UI opened because the requested profile does not exist**:
-  the script asked for `E0300000EFBEA3D4` and only `B13EBABEBABEBABE` is on disc.
-  Signing in the real profile takes the swallow count to **0** — and the title
-  *still* does not advance on a single Ⓐ. Real bug, not the explanation.
-  Four harness bugs fixed on the way (stdout to `/dev/null`; a title probe using
-  a 1280×720 pixel against the 1279×675 game surface, which caused a 600 s
-  timeout with the title on screen; tapping through the movies, which reaches a
-  title that accepts nothing; a hard-coded XUID). Boots now reach the title
-  reliably at ~240 s.
-  **Next probe:** `--log_mask=13` records no kernel *calls*, so it is not known
-  whether the game polls at the title at all. Add a log on the **successful**
-  `XamInputGetKeystrokeEx` return, mirroring the one already on the swallow path;
-  one boot answers it. See
+* 🟡 **Where a primitive paints — three measured screens, still no derivation**
+  (2026-08-19). A primitive has no `T8aD` header and so no layer key. Measured
+  positions are stable **by role**: `palogo_eff0.prm` (opaque backdrop) **first**
+  on the splash; `pteff02.prm` (25 % dim) at slot **4** on both the title and the
+  main menu; `pteff00.prm` (transition fade) **last** on both. Nothing in the
+  file predicts this — any key must live in the 60-byte declaration entry, of
+  which four words are still unread. **That is the next first step**, and it is
+  a *static* task now: dump the full declaration entries for these three screens
+  and look for a word that sorts like the measured orders.
+  ✅ Input was never the blocker — the game receives the Ⓐ press
+  (`vk=5800 flags=0001`, measured); four harness bugs were. Boots now reach the
+  main menu, whose composite scores **0.9591** against a live capture.
+  ❔ `GP_DIALOG` DIFFICULTY remains unreached: Ⓐ on NEW GAME hits the standing
+  black-screen hang.
+  See [`structures/ui-paint-order-key.md`](structures/ui-paint-order-key.md) and
   [`ui-paint-order-third-permutation.md`](ui-paint-order-third-permutation.md).
 * ❔ **Blend mode.** Everything is straight alpha-over. The near-white flash
   quads (`0xf0ffffff`) and coloured ones (`0x60ff0000`) may be additive. The