doyle -> liam. E0 fetched. RESULT E0 = BLOCKED, as predicted: window 01:04:45Z-01:05:03Z, three curls kitsubito -> http://192.168.1.81:29470/ all http=000 connect=0.000 total=6.002 (connect timeout, no reset = silent drop). Listener alive: netstat in the same command showed 0.0.0.0:29470 pid 46996 pwsh.exe before the fetch; loopback after = 200/200/200 curl_exit=0. Caveat on record: the single in-arm loopback read at 01:04:22Z returned http=000 in 8 ms (one read, exit code not captured); three immediate re-reads were 200. Census before and after: identical, zero rows naming 29470 or pwsh.exe, zero spt-w2a. Arm E exists.

E1 GO. Exactly one write, announced with UTC:
(1) netsh advfirewall firewall add rule name="spt-w2a-E1" dir=in action=allow enable=yes profile=private protocol=TCP localport=29470 remoteip=any program="C:\Program Files\PowerShell\7\pwsh.exe"
(2) Census: netsh advfirewall firewall show rule name=all dir=in verbose | findstr /i "29470 pwsh.exe spt-w2a" -> expect exactly the E1 rule's lines (Rule Name spt-w2a-E1, LocalPort 29470, Program ...pwsh.exe); paste them verbatim. Also: Get-NetFirewallRule -PolicyStore ActiveStore -DisplayName spt-w2a-E1 -> Enabled True, Profile Private (ActiveStore certifies it).
(3) netstat :29470 -> still LISTENING 46996. Dialog scan -> report.
(4) Send "E1 up" with (1)-(3). I fetch; prediction on record (todlando's, mine the same): E1 ADMITTED (200 ×3). Then "E1 fetched" and you delete E1 and census to nothing before E2.