# Bounded exposure-default compatibility:6891 to ED5

This is a read-only comparison of local PE files. It neither opens a game process nor changes Native, production controls, a hash guard or an installed client. Mutable initial bytes are not live producer readiness.

`Trace-GalaxyExposureControlsCompatibility.py` binds SHA256 `6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93` to current ED5 SHA256 `ed5a8f8cd10f9a80d3bda5badd7ba1d4fcfc15996c8c7e018852cb170e264b63`. Every listed complete unwind span has one full masked-body match, equal instruction count and no unexplained non-address byte changes. Actual RIP/call operands are retained in the JSON; no fixed relocation delta is assumed.

| Original function | Current ED5 entry | Complete bytes | Role |
|---|---|---:|---|
|351F8E0|351F880|1553|Owner constructor, EV0 and mode0 initial upper-half stores|
|351F450|351F3F0|1167|Shadow constructor, provisional mode later overwritten|
|3526320|35262C0|3444|Per-render owner100→shadow6FC EV, owner120→shadow6C8 mode|
|3523480|3523420|10723|Five exposure controls and actual pass selection|
|3525E70|3525E10|1124|Separate optional blur/downsample|
|3521E90|3521E30|1456|Actual embedded exposure program loader|

The constructor's new351FA15 and351FA35 stores are byte-identical to old351FA75/351FA95. Each is64 bits: the zero upper DWORD establishes EV0 at100 and mode0 at120, independently of neighboring .5 atFC and1 at11C. The per-render copies remain exactly the same field offsets and integer-bit copies.

Actual paired RIP operands in the full publisher map each global to itself. Their `.data` initial bytes are identical:

| Control | Both-image RVA | Raw little-endian bytes | Initial value |
|---|---|---|---:|
|Toe|5E8B918|D7A3803F|1.0049999952316284|
|Shoulder|5E8B910|33331340|2.299999952316284|
|Offset|5E8B908|0000A040|5|
|Slope|5E8B914|0000803F|1|
|Enabled curve|5E8B997|01|true|
|Dispatch flag|5E8B994|01|true|

The matching loader's actual old3521EC8/new3521E68 RIP operand binds descriptor54C6248→54C6218. Its **actual data pointer**, not a guessed neighboring-data delta, binds compressed program54C4568→54C4538; the platform remains `Win64_SM50`. Inflating7370 bytes in each image yields the same95472-byte program SHA256 `62ef0e8e73e653df972031438fdf5a44e5c152e3c7aa0c9af8fd42e14df7cea7`. Actual pass order remains0 `AnalyseLuminance_AutoExposure`,1 `AnalyseLuminance_ManualExposure`.

At new3525D6B the same copied mode is tested, then `sete` supplies R8D for new4F8D10. Thus mode0 still selects the named manual pass, consistent with the original source evidence. The source program's reflection and compute bytes are unchanged as part of the full program hash.

All bounded checks are closed in `artifacts/galaxy-client-compatibility/exposure-controls-paired.json`. This supports an explicitly labelled **tool-owned ManualCS initial fallback** using these proven static defaults. It does not establish current game options, a completed manual/automatic dispatch, runtime exposure history, or another camera's live histogram. No production defaults or source guards were changed by this audit.