confirmations.json is []. capture-then-allow-once did not click Allow.
Collapsed tool row at 30.000: Run defender exclusion test script. Panel white ABSENT. Not onset.
True red PRESENT hold 38.000 through 50.250 after successful reads. Restore white ABSENT 50.375.
Desktop measurement: reviewed-defender-v3-red-scan.json 695 frames, hitCount 90, amber 0.
Agent reply claims ShellExecuteExW runas elevationExit 0; that text is not the desktop measurement.