## 3. Execution availability — queried by non-terminal status, not by recent history

**Correction (doyle `SQ4WBG4K`).** The earlier reading — "the 8 most recent runs are all completed" —
is a blind spot, not a measurement: a queued run is not guaranteed to appear in the newest eight,
and "nothing in the last eight" is not "nothing pending". Replaced with explicit filters on every
non-terminal status. `gh run list --repo BigscreenVR/spt-bs-core --status <S> --limit 50 --json …`,
2026-09-13T05:41:12Z:

| status | query exit | rows |
| --- | --- | --- |
| `queued` | 0 | **0** |
| `in_progress` | 0 | **0** |
| `requested` | 0 | **0** |
| `waiting` | 0 | **0** |
| `pending` | 0 | **0** |
| **positive control** `completed` | 0 | **5** (limit 5) |

Every query exited 0, so the zeros are answers rather than failures, and the terminal-status control
returns rows, so the filter mechanism is alive. **No non-terminal CI run on `spt-bs-core` at that
instant.**

**Local activity snapshot, 2026-09-13T05:41:53Z (`Win32_Process`, 607 rows, `self_rows=1`):**

- **No build:** zero `cargo`, `rustc`, `link` or `Runner.Worker` rows.
- `Runner.Listener.exe` × 1 — the self-hosted runner is online and **idle** (idle *because* no
  `Runner.Worker` row exists, not because the listener looks quiet).
- 35 spt-fleet processes (daemon, brain, adapter hosts, per-agent listeners): **live
  infrastructure, not to be disturbed by this lane.**
- Free space on C: **119.6 GB**. `OutDir` still absent (`outdir_absent=True`).
- gh-only quiet-window blindness does not apply: the local half was measured directly.

## 4. Competing firewall-helper activity — absent, re-measured through the right addressing route

**Correction (doyle `SQ4WBG4K`).** `netsh advfirewall firewall show rule name=…` matches a rule's
**DisplayName**. `spt-core-bootstrap-inbound-tcp` and `spt-core-bootstrap-inbound-tcp-lan` are
NetSecurity **`-Name` / `InstanceID`** identifiers (windows.rs:11-19). My earlier "No rules match"
therefore said nothing about whether those identifiers address anything, and its
existing-rule control only proved that *DisplayName* lookup works. Withdrawn and replaced.

**`Get-NetFirewallRule -Name <n> -PolicyStore <store>`, unelevated (`elevated=False`),
2026-09-13T05:41:31Z:**

| store | name | result |
| --- | --- | --- |
| ActiveStore | `spt-core-bootstrap-inbound-tcp` | `ERROR CmdletizationQuery_NotFound_InstanceID` — no object with that InstanceID |
| ActiveStore | `spt-core-bootstrap-inbound-tcp-lan` | `ERROR CmdletizationQuery_NotFound_InstanceID` |
| PersistentStore | `spt-core-bootstrap-inbound-tcp` | `ERROR CmdletizationQuery_NotFound_InstanceID` |
| PersistentStore | `spt-core-bootstrap-inbound-tcp-lan` | `ERROR CmdletizationQuery_NotFound_InstanceID` |

**Distinguishing a successful empty result from an error, as you asked:** this cmdlet has no empty
success for `-Name`. Absence surfaces as a *typed* error —
`Microsoft.PowerShell.Cmdletization.Cim.CimJobException`, FQID
`CmdletizationQuery_NotFound_InstanceID`, message naming the InstanceID it could not find. Any other
exception type or FQID (an access denial, an RPC failure) is **not** an absence reading and must not
be recorded as one. All four readings above are the NotFound form, verbatim.

Controls, both stores:

- **Positive, per store:** `-Name NETDIS-UPnPHost-Out-TCP` → `OK objects=1`, DisplayName
  `Network Discovery (UPnP-Out)`. So `-Name` **does** address rules by InstanceID in each store,
  and 1001 rules are visible in each unelevated.
- **Negative:** `-Name hertz-no-such-rule-20260913` → the same `NotFound_InstanceID` error, never an
  empty success. So NotFound is a readable absence signal and not an artefact of a dead predicate.

**The owned pair is absent from both the ActiveStore and the PersistentStore.**

**Process side, from the 05:41:53Z snapshot.** Predicate: command line matching
`lan-firewall|EncodedCommand|New-NetFirewallRule|netsh|spt-core-bootstrap|fp-driver|d3-emission-probe`.
Three rows matched, **all self-inflicted and none a firewall helper**, named here rather than
filtered away:

1. the snapshot's own `pwsh.exe` — its command line *contains the predicate literals* (an instrument
   that matches its own text);
2. two stale `bash.exe` rows from 2026-09-12T23:47Z, matched on the path string
   `hertz-fp-driver-review` inside an old archive command. They run no firewall code; they are
   leftovers of an earlier archiving step and are noted, not reaped, since they are not mine to reap
   in this lane.

No `lan-firewall`, no `netsh` process, no `EncodedCommand`, no `New-NetFirewallRule`, no
`d3-emission-probe` execution. **No competing firewall-helper activity at that instant.**