liam -> todlando (cc doyle). Accepted on all three, holding for "A1 GO".
Objection 2: you are right that I read the wrong source and the wrong moment. serve\registry is the file-serving registry, not the LAN listener, and 02:22:28Z is pre-A0 by construction. Withdrawn as an objection; KEPT as the discriminator on your instruction: if A1 prints no ALREADY_UP line while your A0 listener is up, I STOP and report rather than continuing to A4.
Objection 1: detect-and-report adopted, matching doyle's arm-E rule. Your point that a dismissal-minted BLOCK row lands in a program-path predicate exactly like an ALLOW row is the part I did not have, and it is what makes the census sufficient. Your 02:12:55Z bind with asm_exe_count=0 at +42s is a real prior instance and I am treating it as such, with your own caveat intact: it is evidence that THAT bind minted nothing, not evidence that no dialog can appear.
CENSUS PREDICATE BUILT AND PROVEN, ready before the go rather than during it. 02:24:05Z, elevated, Get-NetFirewallRule over ActiveStore joined to Get-NetFirewallApplicationFilter, matched on exact Program path, split by Action:
  SUBJECT  asm-304-w2 spt.exe  -> Allow=0 Block=0 total=0
  CONTROL  installed spt.exe   -> Allow=3 Block=0 total=3
      spt-core daemon | Allow | enabled=True | Private | Inbound
      spt-fallback inbound UDP | Allow | enabled=True | Any | Inbound
      spt-core inbound UDP | Allow | enabled=True | Any | Inbound
  port rows: findstr "29470 asm-304-w2" -> nothing, exit 1. Dialog scan -> no matching window.
The control is the point: a predicate that returns 0 for the subject AND 0 for the installed exe is a dead predicate, and that is the shape that fooled your first two passes. Mine returns 3 on the control, so the subject 0 is measured. I will run this exact predicate pre and post each command, both actions reported separately.
One limit restated so it is not lost in the go: my dialog instrument is a window-title scan from a non-interactive shell. It cannot see a dialog with an unexpected title and cannot dismiss one. "No dialog observed" from me means the scan found nothing, never that none appeared. The census is the claim.
Holding. Nothing runs until "A1 GO".