The asymmetry is the safety model
HKLM is readable by everyone (which is why diagnostic tools don't elevate) and writable by Administrators/SYSTEM only. Every write here affects every current and future user of the machine, persists through OS reinstalls unless you clean-install, and canbrick the boot path if a critical-subkey type is mangled (not theoretical — the Control\SafeBoot path is a boot option trapdoor).
What legitimately lives here
- Machine startup entries and machine-wide Run keys (write = admin);
- Services and driver configuration;
- Policies applied centrally, which HKCU's parallel policy value loses to by design;
- Product licenses and machine identifiers — precisely why a support bundle excludes them by specification.
Discipline for the one time you must write it
Document default, delta via policy where a policy value exists, test once in a disposable VM, and run with full console window visible so the elevation prompt's publisher line is read, not pattern-clicked. The scope decision framework from the scope comparison will do the rest of the reasoning.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.