Fix contract: elevated retry enters the existing serialized helper BEFORE any advisory verify; Windows reconcile verifies its one pre-write snapshot and reuses it to derive/render any repair, then performs fresh post-write verification. No snapshot crosses elevation or broker-state revalidation. Opt-out/read-only reporting remains available. NetSecurity children get an explicit bounded 30s administrative-operation allowance, separate from Linux’s existing 3s command budget; this also covers the fresh ownership queries inside write/cleanup, not just the initial census. 30s is a policy ceiling, not a benchmark-derived guarantee. Hermetic regression adds a real 3.2s query at the production child boundary and must reach repair + post-verify; baseline 3s policy is compiling now. Actual host admission still requires window 6.