docs+tools: screen_children.py, validated; the third paint order is blocked on input

screen_children.py walks every resident screen object (vtable 0x820b30b4), reads
the element array at +0x08 and the child array at +0x30, and prints the paint
permutation with each pivot. Validated in one run off the live title: it
reproduces BOTH previously measured orders character-for-character - the splash
[0,2,4,6,1,3,5] and the 24-element title permutation - so the next screen it is
pointed at can be trusted.

The screen that matters was not reached. GP_DIALOG DIFFICULTY carries exactly
one primitive and would say whether the game paints it first or last, which is
the bit that decides where primitives belong. But (A) does not advance the title
screen at holds of 0.10, 0.25 or 0.40s, and neither does START, with the pad
verified end to end: pad.py writes /tmp/xenia_pad.txt, the emulator runs with
--hid=file --pad_file pointing at it, and the mtime updates on every press. The
title is unambiguously the interactive one - PRESS (A) BUTTON is rendered.

Recorded as a blocker rather than worked around. Next step is specific: boot with
the emulator stdout kept and read the [RE-INPUT] IsUIActive log already present
on the canary branch, which would say whether the keystroke is being swallowed
emulator-side.

docs/re/BACKLOG.md

@@ -117,6 +117,18 @@ See [`structures/ui-composable-bundles.md`](structures/ui-composable-bundles.md)
   screen carrying exactly one primitive — the `GP_DIALOG` DIFFICULTY box, which
   is reachable from the main menu, would say whether its dim is first or last.
   This is a runtime child-list read, so it is an emulator item, not a static one.
+  🔴 **ATTEMPTED 2026-08-19 and BLOCKED.** The reader
+  (`tools/re-capture/screen_children.py`) is written and validated — it
+  reproduces both known permutations character-for-character off the live title.
+  The screen could not be reached: **Ⓐ does not advance the title screen** at any
+  hold from 0.10 s to 0.40 s, nor does START, with the pad verified end to end.
+  Two harness bugs were found and fixed on the way (`--audio` is not a cvar and
+  broke eight boot scripts; `vgamepad` no longer exists but `skip_intro.sh`
+  still called it, pressing nothing while exiting 0). Neither unblocks the title.
+  Next step: boot with the emulator's stdout **kept** and check the
+  `[RE-INPUT] XamInputGetKeystrokeEx swallowed by IsUIActive` log already in the
+  canary branch. See
+  [`ui-paint-order-third-permutation.md`](ui-paint-order-third-permutation.md).
 * ❔ **Blend mode.** Everything is straight alpha-over. The near-white flash
   quads (`0xf0ffffff`) and coloured ones (`0x60ff0000`) may be additive. The
   title capture cannot separate the two — its resting elements are all