GOG Galaxy "offline": it is GOG's own maintenance outage, not the LAN

www.gog.com serves GOG's maintenance page (503, "Galaxy Launcher will also be down");
auth/api/remote-config.gog.com return 500 "Fastly error: unknown domain". Proven
global by hitting it from a second egress (same 503); local DNS, TLS and clock are
clean, so there is nothing to fix on this machine.

Records the diagnosis recipe (where Galaxy 2.0 logs actually live, the log line
that decides the offline badge, and how to separate a GOG outage from a LAN
outage) in MyMistakes.md, and the operational note in HANDOFF.md.

No code touched - no build/test gate applies to this docs-only change.

HANDOFF.md

@@ -100,6 +100,13 @@ Zombie entities deleted from the registry: `script.leak_strobe`, `script.doorbel
   intended target before starting — do not assume.
 
 ## Open (operational)
+- **GOG Galaxy launcher shows "offline" (2026-10-21) — GOG-side outage, NOT the LAN.** GOG put
+  `www.gog.com` behind a maintenance page (503) and their Fastly services for `auth.gog.com` /
+  `api.gog.com` / `remote-config.gog.com` return `500 "Fastly error: unknown domain"`; the page itself
+  says *"Galaxy Launcher will also be down."* `status.gog.com` is NXDOMAIN globally. Proven global by
+  hitting it from a second egress (same 503), and the local DNS/TLS/clock are all fine. **Nothing to fix
+  locally** — wait for GOG. Diagnosis recipe: `MyMistakes.md` → 2026-10-21 GOG Galaxy "offline".
+  Galaxy 2.0 logs live in `C:\ProgramData\GOG.com\Galaxy\logs\` (NOT `%LOCALAPPDATA%`).
 - **verify.sh's known-failure whitelist is too loose** (confirmed twice 2026-10-16): require EVERY failure
   line to be whitelisted, and add `MasterLimiter_CapsTheLiveMix_OnThePipe` +
   `RealMouseDrag_OnTheLayerList_PersistsTheReorder` to the list.

MyMistakes.md

@@ -1821,6 +1821,51 @@ Tapo bulbs cannot be flashed usefully. Measured on `light.officeone` (2026-10-20
   "not a bug"), so an event must end by **explicitly turning off** bulbs that were off — otherwise the
   bulb keeps its internal colour memory and comes back the wrong colour.
 
+## 2026-10-21 — GOG Galaxy says "offline": a Fastly "unknown domain" 500 is GOG's outage, not your LAN
+
+**Symptom:** the GOG Galaxy launcher (2.0) shows the offline badge. The instinct is "my network" — on this
+LAN (Pi-hole, dnscrypt, an ASUS router, a Pi with a 43 h-wrong clock two weeks ago) that instinct is
+usually wrong, and chasing it burns a session. Read the launcher's own log FIRST.
+
+**Where Galaxy 2.0 logs live (the hunt):** `C:\ProgramData\GOG.com\Galaxy\logs\` — **NOT**
+`%LOCALAPPDATA%\GOG.com\Galaxy\logs` (that folder exists but has no `logs` in it; the layout/config
+lives in `%LOCALAPPDATA%\GOG.com\Galaxy\Configuration\config.json`).
+- `CommunicationService.log` — auth/API side.
+- `GalaxyClient.log` — the Electron/Qt UI side, which is where the **offline decision** is made.
+
+**The launcher decides "offline" here** (`GalaxyClient.log`):
+`Failed to check API status. Assuming it's offline.` → `Authentication failed but API is offline. Assuming
+persisted refresh token is valid.` → `nativeReceiver received an unknown command: ShowOfflinePage`.
+So "offline" = *the API status check failed*, not "the socket is down".
+
+**Recipe (works — verified 2026-10-21):**
+1. `grep -iE "offline|Failed to sign in|responseCode=500" "C:\ProgramData\GOG.com\Galaxy\logs\GalaxyClient.log" CommunicationService.log`
+2. Curl GOG's hosts from Windows and **read the body, not the status code**:
+   `curl.exe -sS -i https://www.gog.com/` and `https://auth.gog.com/auth`.
+3. **Fastly answering `500` with `Fastly error: unknown domain: <host>` is GOG's outage, not your DNS.**
+   Their `gog.com` services are simply not configured on the edge right now. The cert still verifies
+   (`ssl_verify_result=0`), so it is NOT a MITM and NOT a hijack; the DNS (real Fastly 151.101.x.241) and
+   TLS are both fine.
+4. Prove global-vs-LAN by hitting the same URL from a **second egress** (another box on the LAN, or the
+   `webfetch` tool, which leaves via a cloud IP). Same 503 ⇒ GOG-side, stop looking at your network.
+5. `status.gog.com` was **NXDOMAIN globally** (Google DoH, `Status:3`, authority = gog.com's Cloudflare
+   NS) during the outage — no status page to consult, so the maintenance page on `www.gog.com` is the
+   authoritative signal. It states it outright: *"GOG.COM is temporarily down for maintenance work…
+   Galaxy Launcher will also be down."*
+
+**What it actually looked like:** `www.gog.com` → 503 (GOG's own maintenance page), `auth.gog.com` /
+`api.gog.com` / `remote-config.gog.com` → 500 "unknown domain", `notifications-pusher.gog.com` → the
+websocket refused to connect. Nothing to fix locally; installed GOG games still launch (DRM-free).
+
+**Separate, unrelated noise in the same logs:** `Waiting for process initialization failed … Return code:
+4294967295` for `GalaxyUpdater.exe`, repeating hourly — the **updater**, not the connection. Do not let it
+steer the offline diagnosis.
+
+**Also false-lead here:** `w32tm /query /status` said "The service has not been started. (0x80070426)" —
+the Windows Time *service* is off, but the clock was right and TLS verified, so it was not the cause. The
+clock is the first thing to suspect on *TLS* failures (the officerFriendly PS5 case), never on a clean
+handshake with a valid cert.
+
 ## HA: THE ALERT SYSTEM'S ARCHITECTURE (RECIPE — the shape that works, do not "improve" it)
 
 Producer/consumer split, and **one single writer** of the bulbs: