Pup - the AI's own browser

@@ -116,3 +116,14 @@ Three measurement traps that produced false zeros on the way here, so they are n    the test VM kill pup's own browser PID first and confirm zero chrome-win64 processes. 3. Run the sampler CONCURRENTLY with the page load; the sockets exist only for the seconds the    binding activity runs and are gone by the time a sequential sampler starts.++## Who actually sees the dialog (measured 2026-09-04)++Windows shows the "allow this app" dialog ONLY to administrator accounts. A standard user sees+nothing: Windows silently writes Inbound Block rules for the exe (ConfRoomROG, admin=False, holds+two such rules for CfT 148 from the day that build was installed, and John never saw a dialog+there). winvm's azureuser is an administrator and its CfT exe was freshly downloaded, so it+prompted. notifyOnListen was True on every profile on both boxes, so that setting is not the+variable; account type and exe freshness are. Check both before chasing a flag:+`[Security.Principal.WindowsPrincipal]::IsInRole(Administrator)` and+`Get-NetFirewallApplicationFilter | ? Program -like '*chrome-win64*'`.