#297 admission timing — 49a08a07db7f5da0ca3eb77129d5504ae107f8a9

Elevated repair, absent/mismatched rules:
  1. pre-write verify-query: one PowerShell child, 30s budget.
  2. reconcile-write: one PowerShell child, 30s budget. Its fresh ActiveStore ownership checks and Remove-Owned queries are statements inside this child, not additional children.
  3. post-write verify-query: one fresh PowerShell child, 30s budget.
Maximum sum of these child allowances: 3 x 30s = 90s. If EVERY child would hang, the FIRST query is killed and returns Err; write and post-verify never run. The 90s case requires earlier legs to complete near their ceilings before the final leg expires. An already-correct pair uses only the first query and performs no write.

Cleanup is a separate operation, not a normal bootstrap-start leg. One cleanup PowerShell child includes ownership checks, removal and verification (30s total for that script). A preceding CLI is-clean observation is another separate child. An unelevated caller can perform an initial read-only verification before launching the privileged helper; at most four child allowances across those processes, not a synchronous parent-CLI wall guarantee.

These are SOURCE-DERIVED nominal child-budget sums, not a measured hard end-to-end wall deadline. Process creation, scheduling, kill/reap, broker IPC and user elevation may add wall time.

Listener ordering: lanhost::start_at_inner binds 0.0.0.0 and publishes the bound port (lanhost.rs:700-717), waits for successful bind and stores its listener before returning LanUp (:727-741). servehost.rs:334-342 returns that result. serveverb.rs:238 prints LAN_BOOTSTRAP_UP; firewall admission starts only at :248. The accept loop runs independently in the broker, so slow policy work delays the admission verdict, not listener startup. This is not proof of remote reachability.

Measured regression:
  spt-daemon bootstrap_firewall::windows::tests::a_rule_heavy_prewrite_query_still_reaches_reconcile_write
  Benign PowerShell child sleeps 3200ms then returns a synthetic host census; no NetSecurity command or host mutation runs.
  Pre-fix policy: query killed at 3013ms; nextest cell wall 4.039s; exit100, no write reached.
  Fixed policy: nextest cell wall 5.357s; PASS in 34/34 firewall suite, producer exit0.
  Timeout preservation: bootstrap_firewall::tests::a_hung_firewall_child_is_killed_at_its_operation_budget PASS, nextest wall1.428s, supplied 100ms operation budget.
These are observed HFENDULEAM test walls, not guaranteed consumer timings. Raw output: regression-red.log / firewall-green.log.

LAN scope derivation, scope-change reporting and write-side ownership checks: unchanged. Post-write verification still uses fresh evidence and preserves the written-but-unverified diagnostic. Windows field window 6 and both consumer legs remain separate gate work.