#297 Option A successor ready: 49a08a07db7f5da0ca3eb77129d5504ae107f8a9
Branch fix/297-rule-heavy-admission, based on b848244577d398600b59c7829fef9edbdb6315fa; tree .worktrees/297-rule-heavy-admission. Seven files committed; no push/merge.

Elevated Windows retry enters serialized helper directly; one pre-write census verifies/derives repair. NetSecurity operation budget30s, Linux unchanged3s. Fresh write-side ownership checks and post-write verification retained; scope/enforcement/owned-only/opt-out/invocation logging and mismatch-vs-written-unverified preserved. Changelog discloses fifth-window failure; docs regenerated.

Proof root: .spt/preserved/297-rule-heavy-admission/
receipt.json contains gate exits/timestamps/log SHA256s and artifacts. measurements.txt records child counts, nominal ceilings, listener ordering and exact regression timing. Raw logs retained.
Regression old3s policy: exit100, query killed3013ms, nextest4.039s, write not reached. Fixed firewall suite34/34 PASS (5.360s); new rule-heavy query cell5.357s. Hung-child regression PASS1.428s. cargo check workspace/all-targets, clippy -Dwarnings, docs gen/check all exit0; trace918/918,0findings.

Cold release build (release dir absent, clean successor checkout) exit0,12m18s. spt.exe --version => spt0.70.0 exit0.
Artifacts under .worktrees/297-rule-heavy-admission/target/release/:
spt.exe 38876672 bytes SHA256 ad3354d4d9217f291c6943c5e796209802e8de3c1a6dced1b9db824ed9743f72
xtask.exe 5217280 bytes SHA256 abd1df7ba51885326679097227ac0e2949cc480e0edc936a5952fdc8820de302
Own pool released, cache/artifacts retained. Final free 110.97GiB. Observable lane-path process census matches 0; details/visibility in final-process-census.json.

Elevated repair at most3children x30s=90s nominal budget sum; if all would hang, first query stops chain at its30s budget. Cleanup separate1child; pre-clean observation can add1. No hard whole-CLI wall guarantee. Listener bound/accept loop and LAN_BOOTSTRAP_UP precede admission. No live firewall/elevation/field or consumer run performed. Ready for your Windows consumers/window6 ordering. Linux remains held until your separate GO; golden held.