# Offline Galaxy mapping closure

The pinned `6891...` client and installed `ED5A...` client now have an offline
mapping ledger covering every RVA currently used by the Galaxy adapters and
their registry, handle, CSM and snapshot-hook basis. This is preparation for a
separate reviewed version profile. These research tools did not change native
hash guards or hooks; no game process was started, attached to, or modified.

`artifacts/galaxy-client-compatibility/galaxy-mapping.json` contains **272**
review candidates and their exact-file byte checks, **16** explicit foundation
vtable slots, **22** component registration bindings and **48** exact CSM state
literals. It explicitly records `runtimeNeutral=true`, `canInstallHooks=false`
and `runtimeValidated=false`.

## The seven data gaps

| Pinned RVA | New RVA | Evidence |
| --- | --- | --- |
| `51DAF4C` | `51DAF1C` | Independent MOVSS/MOVUPS references in matched functions, with consistent targets |
| `5324DA8` | `5324D78` | Four independent matched callers and preserved scalar-load instruction |
| `5324DAC` | `5324D7C` | Four independent matched callers and preserved scalar-load instruction |
| `52406A0` | `5240670` | Unique complete `2.0/elite/shipyard/prices` string, corroborated by the original constructor LEA; this address is not a vtable |
| `5FDF490` | `5FDF490` | Preserved complete physical-colour body and its image-base indexed two-threshold loop |
| `5FDF494` | `5FDF494` | Second element of that proven two-element, four-byte-stride threshold array; not inferred from neighboring globals alone |
| `5FDF498` | `5FDF498` | Preserved descriptor expression with `0x18` stride and original minimum/table fields |

The appearance globals are BSS. Their **addresses and use** are verified;
their runtime values and population/readiness are unknown offline. The
ledger does not manufacture file hashes for nonexistent initialized BSS bytes.

## Chained unwind and HeatTick

The earlier six-byte HeatTick match was the first `.pdata` prologue region,
rather than the complete function. The audit tool now follows
`UNW_FLAG_CHAININFO` and merges only adjacent ranges with the same original
root, never a distant cold-code gap.

The complete contiguous original span is `3814540..38147F9`. Its 383-byte
initial signature uniquely matches **`38144A0`** in the new text section.
The independently matched caller `380E410 -> 380E370` contains the corresponding
direct call `380E4A8 -> 380E408`, targeting exactly the same candidate.
The preserved complete contiguous span is also recorded by the closure audit.

This corrects the initial tooling limitation without changing any native hook.
The code-address delta is `-A0`, whereas Flow/Physics/Input/FSD update hooks
use `-C0`; a universal delta remains invalid.

## Registry, handles and CSM

`galaxy-registry-closure.json` records the existing old-client registry
interface from a previously captured, hash-identified snapshot, followed by
static verification in both files. The registry lookup interface vtable
`512A9F8` remains at the same RVA. Its slot-zero thunk maps
`8C7050 -> 8C6FF0` and still subtracts `38` from the interface pointer.
The pure lookup maps `9C84E0 -> 9C84A0`, preserving:

```text
root+10 -> metadata
metadata+30 -> sparse slots, indexed by type ID * 16
root+18 -> dense component pointers, indexed by sparse slot * 8
```

The weak-life component getter `647EF0 -> 647E90` preserves the `life+C8`
link, and validity predicate `636A80 -> 636A20` preserves its signed state
comparison. These agree with the existing managed guarded registry reader.

`galaxy-foundation-slots.json` additionally checks the original flow action,
CSM current-state getter, cached integer type, local user ID/life, network
mode, avatar value, wing count/phase/address and published friends map.
The wing nonempty wrapper at vfunc `+48` calls vfunc `+68` to obtain the
member count; both slots are checked. Physics dynamics `+68` is resolved by
the independently unique `+A8` slot in the same vtable, rather than by choosing
one of several identical getter bodies.

`galaxy-component-bindings.json` checks **22** concrete interface slot-zero
type getters against their actual RIP-relative type-ID global in both images.
This includes Galaxy, Names, NavRoute, metadata, social, account caches,
colonisation, power and appearance interfaces. The numeric registration IDs
are initialized at runtime and are not assumed equal or read from a process.

The original gameplay CSM predicate maps `1D5F600 -> 1D5F540`. Its complete
1,207-byte contiguous span and **all 48 referenced ASCII state strings** are
checked. Local branch offsets and strings are retained exactly. Cached
matchmaking mode remains an existing-read-only contract; the original lazy
initializer is not called by this audit or the social reader.

## All nine initially unmatched bodies

The automatic mismatches were caused by embedded image-relative addresses,
including inline switch-table entries. Complete manual records explain every
remaining byte difference; none of these compared bodies requires a changed
managed decision rule on the evidence examined.

| Pinned RVA | New RVA | Complete span / code / switch entries |
| --- | --- | --- |
| `1388680` | `13885A0` | 384 bytes / 102 code instructions / 8 entries |
| `1399990` | `13998B0` | 76 bytes / 14 code instructions / 8 entries |
| `2175ED0` | `2175E10` | 80 bytes / 14 code instructions / 9 entries |
| `3B16B00` | `3B16A60` | 400 bytes / 63 code instructions / 16 entries |
| `3B32DD0` | `3B32D30` | 260 bytes / 67 code instructions / 8 entries |
| `3C41390` | `3C412F0` | 320 bytes / 83 code instructions / 8 entries |
| `3C3F440` | `3C3F3A0` | 344 bytes / 90 code instructions / 8 entries |
| `3C3F5A0` | `3C3F500` | 516 bytes / 127 code instructions / no inline switch table |
| `3CF04B0` | `3CF0410` | 217 bytes; four embedded local RVAs accounted separately |

For the first six, `research-switch-table-closures.json` checks every
non-address byte, instruction length/mnemonic, internal direct-branch target
offset and complete switch-table target offset. For the physical-colour pair,
`appearance-manual-triage.json` independently records the same checks and all
changed operands. The type palette moves `5539360 -> 5539330`; prototype steps
move `5539350 -> 5539320`; all eight runtime luminosity-tree addresses remain
unchanged. Compact classification `+40`, temperature `+30`, luminosity/subclass
rules and descriptor expressions are preserved. Runtime palette values remain
unknown until initialized; old extracted resource values are not declared
identical to every new resource solely from this code comparison.

## Verifier and remaining boundaries

`research/Prepare-GalaxyClientMapping.py` builds and checks the runtime-neutral
ledger. It validates both complete EXE SHA-256 values, exact original/new
window hashes, explicit address-field masks, preserved internal branches,
foundation vtable slots, registration getter/global bindings and CSM literals.
It also pins its supporting research artifact hashes. Wrong code and BSS
addresses are rejected against the underlying reference evidence. The verifier
rescans the current native source inventory and rejects an address omitted
from both the mapping and the explicit unresolved list.

The final offline verifier test run passed **9/9** tests, covering incorrect
code/global RVAs, image hashes, foundation slots, registration globals, CSM
literals, omitted source addresses and attempted hook-approval flags. The
positive case preserves the runtime-neutral status.

```powershell
& 'C:/Users/XFEstudio/Desktop/work/AI/skill/game-client-to-server-reverse/.venv/Scripts/python.exe' -X utf8 research/Prepare-GalaxyClientMapping.py --verify artifacts/galaxy-client-compatibility/galaxy-mapping.json
& 'C:/Users/XFEstudio/Desktop/work/AI/skill/game-client-to-server-reverse/.venv/Scripts/python.exe' -X utf8 research/Test-GalaxyClientMapping.py
```

The three initially unresolved commerce/station aliases are now also closed
without invoking their code. `non-galaxy-context-closures.json` records:

- `1E84FC0 -> 1E84F00`: all 19 normalized constructor candidates were checked;
  only this one retains the complete `2.0/elite/market/list` endpoint identity.
- `1E85EE0 -> 1E85E20`: all 19 constructor candidates were checked; only this
  one retains `2.0/elite/market/trade`.
- `340E9E0 -> 340E980`: all 27 direct call sites have counterparts, with 25
  sites in independently unique matched callers. These include original
  maintenance updater `1E67600 -> 1E67540` at relative offset `+4AA`.
  The complete 424-byte called body and its internal branches are preserved.

During the audit, shared native sources were independently migrated to the
new exact hash by another workspace activity. These tools neither performed
nor reverted that migration. The proof records observed source-file hashes
and reference line numbers without inferring its author. The verifier detects
whether current sources use the old or new exact-hash profile, compares their
RVA inventory to the corresponding side of the ledger, and reports unresolved
uses explicitly. The final pass accounts for **all 248 current source RVAs**,
with `unresolved=0` and `sourceUnresolvedUses=[]`. This remains a static-source
result, not approval of the migrated runtime behavior.

The wider research seed inventory still contains generic one-to-many helper
signatures; it is not a global migration table.

Before any new executable profile is enabled, the native hook ABI/trampoline,
caller argument/owner-thread assumptions and the actual profile integration
still require review and appropriate fixtures. Runtime cache initialization,
account response completeness, current resource values and actual dense-query
coverage require a later real-client observation. None is claimed by these
offline files. The research tools do not alter other navigation tasks or native
profiles.