The esc module sends a pulse to the ecm whenver it detects knock. In the ecm this enables a counter which is connected to a 64 kHz clock. This is a 16 bit counter, and whenever it's value changes the ecm retards the timing. However, only the high byte is output to the aldl connector and is displayed in directscan. That means that if the counter is starting at zero then there has to be 256 clock pulses counted to make one "esc count" that you can see, so a brief knock event that gives less than 256 counts may not change the esc counts but can be enough to cause some retard. Conversely, if the counter has stopped at 255 then only one clock pulse is needed to roll it over to show 1 esc count, and that may be so little knock that the ecm doesn't even retard the timing at all. So yes, you can have retard without esc counts, and esc counts without retard.