ARM E PACKAGE -- todlando, HFENDULEAM, measured 2026-09-12T00:55-01:02Z. Predictions already filed; NOT re-filed.
doyle: your 01:00Z message landed while I was writing this; section 4 of my draft (reverse-ssh) is DELETED, your
fetcher already answers it. LocalIP is folded in below as a column, not as a footnote.

== 0. THE TWO CENSUSES I WAS WOKEN TO READ ARE VOID. Do not use their numbers. ==
Old probe section B ("occupied LocalPort set") printed EMPTY. Positive control I already held says that is false:
"spt lan-bootstrap 5470" carries LocalPort 5470. Root cause measured: Get-NetFirewallPortFilter -All returns
"Access is denied" unelevated, and the probe swallowed the denial into a clean zero. Section A ("26 BLANKET
rules") dies to the SAME denial -- with the port test denied every rule read as port=Any, so port-scoped rules
were counted as blanket.
My own first replacement pass was ALSO void and I killed it the same way: netsh show rule OMITS Program unless
you pass "verbose", so it reported 417 blankets and ZERO rules naming spt.exe. Zero spt.exe is provably false.
Everything below is the third pass, "netsh advfirewall firewall show rule name=all dir=in verbose", which passes
BOTH controls: port-5470 rows = 1, spt.exe rows = 7.

== 1. CENSUS (population: 685 inbound blocks, 521 enabled+inbound+allow) ==
A. Predicate: Program in (Any,empty) AND LocalPort in (Any,empty) AND Protocol in (TCP,Any) AND Private in
   Profiles -> 35 rows. Adding doyle's LocalIP column splits them exactly:
     LocalIP = Any                    -> 33   (LAN-relevant blanket candidates)
     LocalIP pinned to one address    ->  2   BOTH are "Tailscale-In": 100.68.35.65/32 and its
                                              fd7a:115c:a1e0::a601:23bf/128 twin, proto Any.
   So Tailscale-In is a blanket admit AT THE TAILNET ADDRESS ONLY and is NOT a LAN blanket for E0. doyle
   measured that first; I re-derived it on my own dump with my own predicate and got 35-2 = 33, which is
   doyle's 33 reached independently. My earlier predicate had no LocalIP and would have mis-listed
   Tailscale-In as the decisive row -- corrected here rather than annotated.
   The 33 are the per-user Store-app rules (Microsoft Store, Xbox, Game Bar, Teams, Copilot, ...). Neither
   netsh nor Get-NetFirewallApplicationFilter exposes the AppContainer package condition that should scope
   them, so on paper they are blanket admits on Private and the paper cannot say otherwise. Agreed with doyle.
B. Occupied explicit LocalPort set (control: 5470 present):
   numeric: 22 68 135 137 138 546 554 1455 1457 1900 2177 2869 3540 3702 5000 5353 5355 5357 5358 5470 7000
   7100 7235 7250 7680 8088 8264 8265 8266 8443 8888 8889 9955 10246 10247 17500 23443 23554 23555 23556
   50000 57621
   ranges: 3128-3159 4371-4379 4381-4390 5000-5020 7200-17210 7460-7499 8080-8082 8081-8112 8554-8558
   17500-17510 57621-57631   (7200-17210 is a genuinely huge span; avoid all of it)
C. Rules naming a candidate listener exe (controls: spt.exe 7, python 2):
   python -> 2  ("Python", TCP and UDP, Private, remote Any, C:\program files\python312\python.exe)
                => PYTHON IS DISQUALIFIED. The old probe was right on this one point and only this one.
   pwsh -> 0    powershell -> 0    py.exe -> 0

== 2. FEASIBILITY: E0 IS THE ONLY DECIDER. Same conclusion doyle reached, same pre-registration. ==
  E0 BLOCKED  => the 33 are package-scoped in fact, arm E exists, E1/E2 mean what we designed them to mean.
  E0 ADMITTED => arm E is VOID ON THE SPOT. Do not run E1/E2. That is itself a result: a live blanket admit on
                 this box, and a FOURTH confound on the LAN 200 already logged at 5470. The 33 are first
                 suspects; disabling any of them is a separate operator question, not tonight's arm.
My filed E0 BLOCKED stands unchanged.

== 3. THE PACKAGE ==
PORT: 29470. Measured: zero occurrences in the entire inbound dump (enabled or disabled), covered by none of
  the ranges in B, nothing LISTENING (netstat control: 5470 shows LISTENING pid 4732), below the Windows
  dynamic range 49152-65535.
LISTENER EXE: C:\Program Files\PowerShell\7\pwsh.exe -- zero enabled inbound allow rules name it, measured
  with the predicate whose controls returned 7 for spt.exe and 2 for python. Needs no copying, unlike python.
  Deliberately not spt.exe, whose bootstrap would reconcile rules mid-arm.
LISTENER COMMAND (liam, on HFENDULEAM, unelevated, foreground; deliberately backtick-free):
  "C:\Program Files\PowerShell\7\pwsh.exe" -NoProfile -Command "$nl=[char]13+[char]10; $l=[Net.Sockets.TcpListener]::new([Net.IPAddress]::Any,29470); $l.Start(); Write-Host 'ARM-E LISTENING 29470'; while($true){ $c=$l.AcceptTcpClient(); $s=$c.GetStream(); $b=[Text.Encoding]::ASCII.GetBytes('HTTP/1.1 200 OK'+$nl+'Content-Length: 5'+$nl+'Connection: close'+$nl+$nl+'ARM-E'); $s.Write($b,0,$b.Length); $s.Flush(); $c.Close() }"
  Serves a fixed 200 on any path, needs no config, writes no firewall rules.
  NOTE for doyle's fetcher: this answers 200 on "/", where your 5470 positive control read 404. Expect 200.
THE FOUR netsh LINES (liam, elevated, one writer, each announced with a UTC timestamp):
  E1 add (program-scoped, remote Any -- mirrors the dead arm B shape):
    netsh advfirewall firewall add rule name="spt-w2a-E1" dir=in action=allow enable=yes profile=private protocol=TCP localport=29470 remoteip=any program="C:\Program Files\PowerShell\7\pwsh.exe"
  E1 delete:
    netsh advfirewall firewall delete rule name="spt-w2a-E1"
  E2 add (port+remote scoped, program ANY -- mirrors the operator lan-bootstrap shape):
    netsh advfirewall firewall add rule name="spt-w2a-E2" dir=in action=allow enable=yes profile=private protocol=TCP localport=29470 remoteip=192.168.1.0/24
  E2 delete:
    netsh advfirewall firewall delete rule name="spt-w2a-E2"
ARM ORDER: E0 (no rule) -> E1 add, fetch, delete -> E2 add, fetch, delete -> E3 (no rule).
CENSUS PREDICATE for the fetcher, before and after every fetch, in the same command, columns
  proto / localport / profile / LocalIP / RemoteIP / program:
    netsh advfirewall firewall show rule name=all dir=in verbose
  filtered to rows mentioning 29470 or pwsh.exe. THE "verbose" IS LOAD-BEARING -- without it Program is blank
  and the census silently reads every rule as program-Any. That is the exact defect that voided my second pass,
  so it is worth one line of your positive control: a census that cannot see "spt-core daemon" naming spt.exe
  is not seeing Program at all.
LOOPBACK CONTROL each arm, from HFENDULEAM: curl -sS -o NUL -w "%{http_code} %{time_total}" http://127.0.0.1:29470/
  Loopback bypasses the firewall, so it separates "listener dead" from "listener blocked".
HAZARD, unchanged: starting the listener can raise the Windows Security Alert dialog, and clicking it ADDS A
  RULE mid-arm. liam reports it with a UTC timestamp and dismisses it NEITHER way until doyle rules.

liam: nothing to write until doyle gives the go. When he does, you are the only writer.