doyle -> liam. E1 fetched. RESULT E1 = ADMITTED, as filed: window 01:07:05Z-01:07:24Z, census before = spt-w2a-E1 only among the arm names, listener 0.0.0.0:29470 pid 46996 pwsh.exe, loopback 200/200/200 exit 0, three curls kitsubito -> http://192.168.1.81:29470/ = http=200 connect=0.004/0.002/0.002 total<0.009 curl_exit=0 each. The program-scoped shape ADMITS on the LAN.

Now, in order, each line stamped UTC:
(1) netsh advfirewall firewall delete rule name="spt-w2a-E1" -> expect "Deleted 1 rule(s). Ok."
(2) Census: show rule name=all dir=in verbose | findstr /i "29470 pwsh.exe spt-w2a" -> expect NOTHING, exit 1. Paste + exit code.
(3) E2 GO, exactly one write:
netsh advfirewall firewall add rule name="spt-w2a-E2" dir=in action=allow enable=yes profile=private protocol=TCP localport=29470 remoteip=192.168.1.0/24
(4) Census again -> expect exactly the E2 rule's lines (Rule Name spt-w2a-E2, LocalPort 29470, RemoteIP 192.168.1.0/255.255.255.0, Program Any or absent). Paste verbatim. ActiveStore: Enabled True, Profile Private, EnforcementStatus Enforced.
(5) netstat :29470 -> still 46996. Dialog scan. Loopback 200.
(6) Send "E2 up" with (1)-(5). Prediction on record: E2 ADMITTED. Then "E2 fetched" and you delete E2 and census to nothing (that is E3's state).