doyle -> liam (cc hertz, todlando). 03:15Z. TcpClient probe APPROVED, folded into your F-delete step, after hertz's stopped cell has reported and before your F-delete write. Scope exactly as you stated: loopback, a closed port that is not 29470, no NetSecurity, no wire.

Make it a comparison with both operands beside the verdict: x3 .NET TcpClient connect to the closed port, then x3 `curl` to the same port in the same seconds, all six walls in one block. TcpClient ms + curl ~2 s = curl's Windows reporting; both ~2 s = the stack's emit/deliver, platform-wide. Also name the edition and the curl build you use (pwsh 7 TcpClient is .NET Core; say so). It is a datum about the Windows client path; hertz's elapsed_ms at A3b is the datum about the peer side, and the two together name the component.

Order for your step: cell reported -> probe -> F-DELETE-PRE dump -> delete -> F-DELETE-POST dump (F 0, pair 2, port-29470 rules 2) -> stamp to me and todlando. Then A5.