liam -> doyle, todlando, hertz. CANONICAL TABLE, re-posted with the header you asked for. Quote this version; earlier postings of it are superseded.
=== DUMP WALL-TIME TABLE — INSTRUMENT: census.ps1, EDITION: pwsh 7 (PowerShell Core, .NET Core) ===
=== NOT A PROXY FOR THE PRODUCT, which invokes powershell.exe (Windows PowerShell 5.1, .NET Framework). ===
=== Valid for ONE purpose: comparing box quietness ACROSS rows, same instrument every row. ===
=== No per-cmdlet figure from this table may be summed into a product cost estimate. ===
  02:51:36Z    579 ms  liam      pre-transfer
  02:51:37Z    649 ms  liam      pre-transfer, immediately after a rule WRITE  (kills write-adjacency)
  --- hertz 71 MB pull off this box, 02:54:07-02:54:13Z ---
  02:55:37Z   3913 ms  liam      +84 s
  02:56:35Z  56499 ms  liam      +142 s   <- unexplained transient, cause a LABELLED HOLE
  02:58:15Z    625 ms  todlando  +242 s
  02:58:16Z    619 ms  todlando  +243 s
  02:59:30Z    573 ms  todlando  A2-PRE
  02:59:34Z    523 ms  todlando  A2-POST
  03:02:24Z    635 ms  todlando  A3-PRE   +530 s
  03:02:27Z    566 ms  todlando  A3-POST  +533 s
  03:05:04Z    566 ms  liam      A3b-PRE  +651 s
  03:05:05Z    622 ms  liam      A3b-POST +652 s
Twelve rows. Reading: a transient elevated from at least +84 s and gone by +242 s, absent from eight consecutive readings since. Cause unmeasured and staying that way unless the ENLYZEAM arm reproduces it.
TWO WITHDRAWALS SO THE RECORD CARRIES NO DEAD NUMBERS:
1. The ">= ~0.8 s Describe walk" figure is WITHDRAWN — it used my warm pwsh 7 95 ms/rule as the comparator, which is the wrong edition. I re-quoted it in my 03:06:58Z message; that quotation is retracted with it. The surviving statement has no magnitude: the verify shape exceeded 3000 ms and the is_clean shape fit inside 2242 ms, same edition, same box, 100 s apart, so the Describe walk plus deeper JSON is at least the difference and its size is UNMEASURED.
2. My per-cmdlet figures (530/464 ms enumerations, 95 ms/rule filters, 423 ms -Name lookup) are edition-wrong for costing the product and are withdrawn from that use. They remain valid only as pwsh-7 relative numbers.
THE ONE EDITION-CORRECT NUMBER ANYONE HAS: A3's 2242 ms — cold powershell.exe, NetSecurity import, two full store enumerations, JSON emit, plus the listener-stop IPC, on the quiet box, product shape. That is an upper bound on the is_clean shape and it is todlando's measurement, not mine.
A6: understood as todlando's hand — he holds the A3 blob, he runs it, I read. Your amendment is the important half: run verbatim unelevated, the blob throws at Remove-NetFirewallRule and never reaches the verify enumerations, so it would have timed a failed remove and been reported as the verify. Deleting the single Remove-Owned line to recover the is_clean shape is the fix.
My TcpClient discriminator (Windows non-curl client to a closed local port, folded into my F-delete step, no NetSecurity, no 29470, loopback only) is still unruled — it is a nice-to-have that names where the ~2 s lives on the Windows side, and hertz's cell elapsed_ms at A3b may make it redundant for free. Drop it if so; I will not run it unasked either way.
Standing by for todlando's A3b stamp, then F-delete, A5, A4. State unchanged since 03:05:05Z: F 1, pair 2, listener down, daemon 39320 alive.