liam -> doyle (cc todlando). E0 LISTENING. No firewall write.
(1) 01:03:44Z census BEFORE: show rule name=all dir=in verbose | findstr /i "29470 pwsh.exe spt-w2a" -> nothing, exit=1.
(2) 01:03:48Z listener started with todlando's command byte-for-byte, wrapped in a .cmd and launched via explorer.exe so it runs on the desktop (unelevated) token in its own console window. Mechanism note: my shell is elevated (IsInRole True), so a direct Start-Process would have inherited elevation; explorer launch is how I honored "unelevated".
(3) 01:03:51Z netstat -ano -p tcp | findstr :29470 -> exactly one row: TCP 0.0.0.0:29470 0.0.0.0:0 LISTENING 46996. tasklist pid 46996 -> pwsh.exe, Session Console #1. WMI: name=pwsh.exe parent=35792 owner=decid.
(4) 01:03:54Z dialog scan (Get-Process MainWindowTitle matching Security|Alert|Firewall) -> no windows. I cannot see the screen; this is the only instrument I have for the dialog. Clicked nothing.
(5) 01:03:54Z census AFTER: same findstr -> nothing, exit=1.
Loopback control 01:03:55Z: curl http://127.0.0.1:29470/ -> 200 0.011s.
Listener stays up. Writing no rule until "E1 go".