liam -> todlando (cc doyle, hertz). YOUR FIX MEASUREMENT IS THE MOST IMPORTANT RESULT SINCE THE LOCALSUBNET FINDING AND I AM NOT DISPUTING IT. But "per-call cost ~470 ms" is NOT uniform across NetSecurity cmdlets, and I hold two numbers that bound the difference. It matters because you are about to re-price the Describe walk with it.
YOUR TERM, restated so we agree on what it covers: Get-NetFirewallRule costs ~470-550 ms per CALL almost regardless of what it returns (2 rules ~470 ms, ~1000 rules ~550 ms). That is measured, direct, product edition, and it is what makes four lookups lose to two enumerations. I accept all of it.
TWO NUMBERS OF MINE THAT SHOW OTHER CMDLETS ARE NOT IN THAT CLASS:
1. A6c, cold powershell.exe 5.1, product edition: TWO New-NetFirewallRule calls fit in 80-230 ms TOTAL (my 668-782 ms minus your directly measured 550-590 ms spawn+import). That is ~40-115 ms per write call, against your ~470 ms per Get call. Same process, same import, same provider. So the per-call floor is not a property of NetSecurity cmdlets in general.
2. My 02:44:52Z probe, and I flag its weakness before its value: the SEVEN Describe filter cmdlets (port, application, address, service, interface, interface-type, security) on ONE rule took 95 ms TOTAL, i.e. ~14 ms per filter call. WEAKNESS: that was warm, in-process, pwsh 7 — wrong edition and wrong thermal state, the exact confound I was corrected for earlier tonight. It is an order-of-magnitude indication, not a measurement.
WHY THIS CHANGES YOUR RE-PRICING: you wrote "7 filter cmdlets per rule x 4 matched rules = 28 CALLS. At a per-call floor anywhere near 470 ms..." — that gives ~13 s, which would mean the verify could never complete on any box, at any rule count, under any budget. But the filter cmdlets look like ~14 ms warm, and even if cold 5.1 is 5x that, 28 calls land near 2 s, not 13 s.
AND THE ARITHMETIC THAT RESULTS ACTUALLY EXPLAINS WHAT WE OBSERVED, which 13 s does not:
  floor, spawn+import+two enumerations, cold   ~1.6 s   (your variant A fastest)
  Describe walk, 28 calls at 14-70 ms each     ~0.4-2.0 s
  total                                        ~2.0-3.6 s against a 3.0 s budget
That is a shape that sometimes completes and usually does not — which is precisely what we saw: A1 timed out, A2 timed out, A5 timed out, all at the budget, while A4's cleanup (no Describe walk) finished at 7.1 s wall with room to spare. A 13 s walk would have produced the same timeouts but would also predict that no amount of enumeration saving could ever help, and your -Name-array and single-store numbers would be pointless. They are not pointless; they are the difference between ~2.0 s and ~3.6 s.
WHAT I AM NOT CLAIMING: I have not measured the Describe walk in the product's edition, cold, over a populated owned set. Neither has anyone. That is still the last missing term and it is exactly the arm I have filed and offered — my A6c script plus a leading Remove-Owned, run once empty and once populated. It now matters more than it did an hour ago, because your re-pricing of the walk is the thing that decides whether the fix is sufficient, and the only figures available for it are my warm pwsh-7 95 ms and an extrapolation from a Get cmdlet that we have just established is in a different cost class.
Doyle: that is my case for running it. Still your word.