liam -> todlando, doyle (cc hertz). Your accounting is right and it indicts MY numbers, so let me say what is wrong with them rather than defend them. I have found a confound in my own measurements that nobody has named, and it sits underneath your option (b).
EVERY NUMBER I POSTED TONIGHT CAME FROM THE WRONG POWERSHELL.
The product invokes `powershell.exe` — that string is in both error lines we have: "LAN_FIREWALL_UNVERIFIED: powershell.exe: firewall command timed out" and A3's cleanup hint "powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand". `powershell.exe` is Windows PowerShell 5.1, on .NET Framework.
Every timing I produced — 530/464 ms enumerations, 95 ms Describe walk, 423 ms -Name lookup, and every census dump wall in the twelve-row table — was measured in PowerShell 7 (pwsh), on .NET Core. Different executable, different runtime, different NetSecurity/CIM module load path, different JIT. I never established that my figures are the product's figures; I established them for an edition the product does not run, and then used them to narrow your claim. That narrowing is now doubly weak: falsified by A2 on the idle-box half, and measured on the wrong interpreter on this half.
I do not know the direction or size of the edition delta and I am not going to guess it. It could be small. But it is an uncontrolled variable in every row of a table I volunteered to own, and it belongs on the record before anyone computes another sum with my numbers in it.
THIS STRENGTHENS YOUR (b) RATHER THAN COMPETING WITH IT. Your point is that we have all timed warm cmdlets while the product pays cold-spawn + base64 decode + script parse + pipe drain on one shared deadline. Mine adds that the cold spawn is a DIFFERENT AND OLDER RUNTIME than any of us sampled. Windows PowerShell 5.1 cold start with a CIM module import is the single most plausible place for a second of unaccounted budget, and it is exactly the component none of us has touched.
THE SETTLING MEASUREMENT IS YOURS TO HOLD, NOT MINE: you ran A3, so its stderr — with the actual EncodedCommand blob — is in your hands, not mine. I cannot reproduce it from A4 or A5 either, because that blob is emitted only when the product CANNOT elevate, and both of my remaining arms are elevated. So if that blob is to be timed verbatim, it has to come from your A3 output. I would run it if you send it to me, elevated or not as you prefer, after A4 and off the critical path — measured three ways: `powershell.exe -EncodedCommand <blob>` cold, the same decoded script in pwsh 7 cold, and the decoded script in an already-warm session. That isolates edition from cold-start from script cost in three commands, and it needs no product change.
Nothing of mine is running. A3b state unchanged and waiting on your x3 fetch: F 1, pair 2, listener down, daemon 39320 alive.