diff --git a/HANDOFF.md b/HANDOFF.md
index e1ff9e7..8ce08ab 100644
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -100,6 +100,13 @@ Zombie entities deleted from the registry: `script.leak_strobe`, `script.doorbel
   intended target before starting — do not assume.
 
 ## Open (operational)
+- **GOG Galaxy launcher shows "offline" (2026-10-21) — GOG-side outage, NOT the LAN.** GOG put
+  `www.gog.com` behind a maintenance page (503) and their Fastly services for `auth.gog.com` /
+  `api.gog.com` / `remote-config.gog.com` return `500 "Fastly error: unknown domain"`; the page itself
+  says *"Galaxy Launcher will also be down."* `status.gog.com` is NXDOMAIN globally. Proven global by
+  hitting it from a second egress (same 503), and the local DNS/TLS/clock are all fine. **Nothing to fix
+  locally** — wait for GOG. Diagnosis recipe: `MyMistakes.md` → 2026-10-21 GOG Galaxy "offline".
+  Galaxy 2.0 logs live in `C:\ProgramData\GOG.com\Galaxy\logs\` (NOT `%LOCALAPPDATA%`).
 - **verify.sh's known-failure whitelist is too loose** (confirmed twice 2026-10-16): require EVERY failure
   line to be whitelisted, and add `MasterLimiter_CapsTheLiveMix_OnThePipe` +
   `RealMouseDrag_OnTheLayerList_PersistsTheReorder` to the list.
diff --git a/MyMistakes.md b/MyMistakes.md
index 17d1513..2169775 100644
--- a/MyMistakes.md
+++ b/MyMistakes.md
@@ -1821,6 +1821,51 @@ Tapo bulbs cannot be flashed usefully. Measured on `light.officeone` (2026-10-20
   "not a bug"), so an event must end by **explicitly turning off** bulbs that were off — otherwise the
   bulb keeps its internal colour memory and comes back the wrong colour.
 
+## 2026-10-21 — GOG Galaxy says "offline": a Fastly "unknown domain" 500 is GOG's outage, not your LAN
+
+**Symptom:** the GOG Galaxy launcher (2.0) shows the offline badge. The instinct is "my network" — on this
+LAN (Pi-hole, dnscrypt, an ASUS router, a Pi with a 43 h-wrong clock two weeks ago) that instinct is
+usually wrong, and chasing it burns a session. Read the launcher's own log FIRST.
+
+**Where Galaxy 2.0 logs live (the hunt):** `C:\ProgramData\GOG.com\Galaxy\logs\` — **NOT**
+`%LOCALAPPDATA%\GOG.com\Galaxy\logs` (that folder exists but has no `logs` in it; the layout/config
+lives in `%LOCALAPPDATA%\GOG.com\Galaxy\Configuration\config.json`).
+- `CommunicationService.log` — auth/API side.
+- `GalaxyClient.log` — the Electron/Qt UI side, which is where the **offline decision** is made.
+
+**The launcher decides "offline" here** (`GalaxyClient.log`):
+`Failed to check API status. Assuming it's offline.` → `Authentication failed but API is offline. Assuming
+persisted refresh token is valid.` → `nativeReceiver received an unknown command: ShowOfflinePage`.
+So "offline" = *the API status check failed*, not "the socket is down".
+
+**Recipe (works — verified 2026-10-21):**
+1. `grep -iE "offline|Failed to sign in|responseCode=500" "C:\ProgramData\GOG.com\Galaxy\logs\GalaxyClient.log" CommunicationService.log`
+2. Curl GOG's hosts from Windows and **read the body, not the status code**:
+   `curl.exe -sS -i https://www.gog.com/` and `https://auth.gog.com/auth`.
+3. **Fastly answering `500` with `Fastly error: unknown domain: <host>` is GOG's outage, not your DNS.**
+   Their `gog.com` services are simply not configured on the edge right now. The cert still verifies
+   (`ssl_verify_result=0`), so it is NOT a MITM and NOT a hijack; the DNS (real Fastly 151.101.x.241) and
+   TLS are both fine.
+4. Prove global-vs-LAN by hitting the same URL from a **second egress** (another box on the LAN, or the
+   `webfetch` tool, which leaves via a cloud IP). Same 503 ⇒ GOG-side, stop looking at your network.
+5. `status.gog.com` was **NXDOMAIN globally** (Google DoH, `Status:3`, authority = gog.com's Cloudflare
+   NS) during the outage — no status page to consult, so the maintenance page on `www.gog.com` is the
+   authoritative signal. It states it outright: *"GOG.COM is temporarily down for maintenance work…
+   Galaxy Launcher will also be down."*
+
+**What it actually looked like:** `www.gog.com` → 503 (GOG's own maintenance page), `auth.gog.com` /
+`api.gog.com` / `remote-config.gog.com` → 500 "unknown domain", `notifications-pusher.gog.com` → the
+websocket refused to connect. Nothing to fix locally; installed GOG games still launch (DRM-free).
+
+**Separate, unrelated noise in the same logs:** `Waiting for process initialization failed … Return code:
+4294967295` for `GalaxyUpdater.exe`, repeating hourly — the **updater**, not the connection. Do not let it
+steer the offline diagnosis.
+
+**Also false-lead here:** `w32tm /query /status` said "The service has not been started. (0x80070426)" —
+the Windows Time *service* is off, but the clock was right and TLS verified, so it was not the cause. The
+clock is the first thing to suspect on *TLS* failures (the officerFriendly PS5 case), never on a clean
+handshake with a valid cert.
+
 ## HA: THE ALERT SYSTEM'S ARCHITECTURE (RECIPE — the shape that works, do not "improve" it)
 
 Producer/consumer split, and **one single writer** of the bulbs: