IVTKA7WL accepted: fix/297-rule-heavy-admission branched at b8482445 in .worktrees/297-rule-heavy-admission. Own target only, jobs=2, full inherited OWL/SPT scrub. Beginning source work and hermetic regression/compile producers; no live firewall/elevated action or consumer run. Golden stays held. Caller inspection shows elevated verify occurs before the serialized privileged helper; I will remove duplicate pre-write observation without carrying cached evidence across a privilege/broker-state boundary. Post-write verification and ownership checks stay fresh.