[CoinThrow]

The outstanding call-site ordering note from #11 is now measured for the remaining three lists.
Call-site order cannot reproduce them: registration execution order does not follow the call sites,
and the aura-application list carries one original-only callback that has no call site at all.

Measured from the original's live list links in two independent game sessions of a sibling build
(identical results). The same walk reproduces the Before71E930 / After80B5D0 fixtures byte-exactly
in the reference image, and every address was translated with per-band deltas validated on all entries.

list (native object)	captured call order
0x10BE2B6C aura application (before 0x724820)	AscAura137::BeforeApply, AscSpellVisuals::BeforeAuraApply, AscSpellMods::AuraFlagOn, AscAppearance::BeforeAuraApply, AscSpawnVisibility::BeforeAuraApply, + original-only 6th that runs last
0x10BE2D78 effect filtering	AscSpellVisuals::RemoveEffect, AscQuestSpellHide::RemoveEffect
0x10BE2D98 visual hiding	AscSpellVisuals::HideVisual, AscQuestSpellHide::HideVisual

• OnBefore724820 / OnEffectFilter / OnVisualHide now rank by the captured site order
  (InsertByCapturedOrder), like the two lists from Codex/captured callback order #11. The filter lists are exactly reversed vs
  ascending site order; the aura list is not any site sort (AscSpellMods registered before
  AscSpellVisuals, AscSpawnVisibility before AscAppearance).
• The fixture gains Before724820 / EffectFilter / VisualHide sections (reference-image
  addresses). The sixth aura-application entry is null/null: it is runtime-registered through the
  original's protection (VM) layer — no static site anywhere in the image; its address only
  materializes in a VM lane cell at runtime — so it is not reconstructed. It runs after the five
  captured entries, which the append-after-captured rule reproduces.
• The portable test now exercises the aura-application detour under all 120 registration permutations
  (vetoes, fall-through, duplicate registration), an off-array "unknown" site landing last, and the
  filter registrars including the visual-hide consumer's first-true-wins short-circuit. Locally:
  3367 checks, 0 failures (MSVC x86); native_ca_packets.py unaffected.
• New docs/CALLBACK-ORDER-MEASURED.md carries the measurement notes plus the decoded condition
  logic of the original-only callback (spell veto for the custom ids 0x79BB0 / 0x79BC5 / 0x79C3F
  / 0x79C40 / 0x978960 behind GM / developer / account flags — now identified as the client's
  Mentor / Newcomer / Returning-Player / Ascension-logo overhead-icon handling; names and tooltips in
  the doc). The GM flag only ever allows; the suppressing flag is the developer bit 0x8000.