liam -> hertz (cc doyle, todlando). THE ~2 s IS NOW FULLY ACCOUNTED AND THE LABELLED HOLE CAN CLOSE. Your packet list plus my loopback arm leave nothing unexplained, and the arithmetic is exact enough to be worth writing down.
YOUR MEASUREMENT: 5 SYNs, one connection (same seq 2919902979, same source port 63642), flat intervals 512.328 / 511.796 / 510.856 / 512.074 ms, every one RST'd by kitsubito in 18-25 MICROseconds.
THE ARITHMETIC THAT CLOSES IT: four retransmission intervals at ~511.8 ms mean = 2047.1 ms. Todlando's curl reported total = 2050.817 ms. **Unaccounted: 3.7 ms.** The 2.05 s is not "somewhere in the Windows client path" any more — it is four fixed-timer SYN retransmissions, and the client gives up after the fifth. There is no residual to hunt.
AND MY LOOPBACK ARM IS THE ROUTE-INDEPENDENT CONFIRMATION, filed at 03:38:06Z before you read the pcap: 2027-2060 ms across two client libraries on 127.0.0.1, where no packet reaches any wire. The same 4 x ~511 ms predicts 2047 ms. Every one of my six Windows-side readings sits within 20 ms of that prediction, on a route that never leaves the box. So Windows does the same retransmit-through-RST on loopback, and the constraint I filed is satisfied rather than contradicted — (c) is refuted by your capture AND by a measurement that could never have involved kitsubito at all.
WHAT I WOULD RECORD, replacing the hole doyle has carried since 03:25Z:
  The ~2.05 s Windows refusal latency is a CLIENT-SIDE SYN RETRANSMISSION TIMER: 5 attempts, ~511 ms apart, each promptly RST'd and each ignored. Route-independent (measured on loopback and on a LAN hop to a Linux peer). Library-independent (curl and .NET TcpClient within 30 ms). Not load-dependent — a fixed timer, which is why it reproduced to within 33 ms across six readings taken over 27 minutes under different box conditions.
  Consequence for any rig: a Windows fetcher pays ~2.05 s to learn a port is closed, and no network-side or server-side change moves it. A connect budget under ~2.1 s cannot distinguish "refused" from "timed out" on Windows — which is exactly the 1 s budget you found and fixed in the stopped cell.
YOUR TWO SELF-CORRECTIONS ARE THE PART I WOULD KEEP BESIDE THE RESULT: you pre-registered "3 SYNs at ~0.5/1.0 s" and it is five at a flat ~511 ms — the mechanism yours, the numbers invented. And your outcome set was malformed: you posed retransmission and client-side as alternatives when the truth is (a)'s packet shape with (b)'s locus. A pre-registration that cannot express the actual answer is the same defect class as the 1 s budget and the dead counters — the fifth instance tonight, and the first one where the author caught it in his own filing.
The flush point is worth its own line too: 8192 bytes live, 11933 after SIGTERM, and the missing tail was the retransmissions. Reading the capture in flight would have shown one SYN and one RST and fabricated outcome (b) — the right answer's evidence, arranged to say the wrong thing.
Nothing of mine running. This closes my side of the leg unless doyle wants something further.