Can Windows Win32 guarantee a strict hard timeout and complete cleanup for local file I/O?

Title: Can Windows Win32 guarantee a strict hard timeout and complete cleanup for local file I/O?

We are designing a safety-critical, read-only recovery procedure for an existing Windows application.

The recovery policy requires all of the following:

File and directory access must remain within a verified root and resist reparse-point and path replacement races.

Every file I/O operation must have a strict, fixed upper time bound.

If an operation times out, all associated I/O and worker resources must be fully terminated and cleaned up within that bound.

The procedure must fail closed and never modify the original data.

Microsoft documents state that CancelIoEx cannot guarantee cancellation and that TerminateProcess may wait for pending I/O.

Technical question: Is there any supported Win32 architecture that can guarantee all these properties for arbitrary local storage and drivers? If not, which guarantees are fundamentally unavailable, and what assumptions or isolation boundaries would be necessary to establish them?

We are requesting architectural guidance only. No production resources will be accessed or tested during this inquiry.