**A7 AMENDMENT 3 — 2026-09-12 ~06:07Z.** doyle's corrections to Amendment 2 (comment 5644061578). Dated, not a replacement; the original quotation in 5644042784 and Amendment 2's text both stand as written, with the clauses below superseding where they conflict. **A7 remains NOT granted.**

## A4.1 Classification correction — I over-restricted "measured", and it mattered

Amendment 2 A3.1 said *"an arm is a measurement only with three `outcome=completed` rows."* **That is wrong and is corrected:** `killed` and `failed` rows **are** measurements — of `killed` and of `failed`. The three-completed requirement applies to an arm being **SUCCESSFUL**, not to an arm counting as **MEASURED**.

The distinction is not cosmetic. Under my wording, an ARM B that came back `killed` ×3 would have been "not a measurement" — which would have discarded **exactly the result that constitutes the failure verdict**, the one outcome the whole discriminator is built to detect. An arm that reads `killed` three times has measured something decisive.

**Also binding:** all three scheduled attempts are kept. **No replacement runs to manufacture three completions.** A non-completed row is reported in place, not re-rolled.

| row | is it a measurement? | does it count toward a SUCCESSFUL arm? |
|---|---|---|
| `completed` | yes | yes — three required |
| `failed` (non-deadline `Err`) | **yes — a measurement of `failed`** | no; recorded in place with its error text quoted |
| `killed` (3 s deadline expiry) | **yes — a measurement of `killed`, and the failure verdict** | no |
| row absent | **no** — the measured path was not reached | no; the run is VOID and is investigated before any further arm runs |

The missing-row rule is unchanged: absence is not a quiet success.

## A4.2 Pre-launch discipline, added to the command sequence

1. **`W` is the explicit working directory for every `cargo` command.** Not an inherited cwd — stated per command. A cargo invocation that resolves its manifest from somewhere else builds a different tree into this pool, which is the exact relationship `SPT_POOL_FOREIGN` exists to refuse.
2. **The pool claim is retained** for the duration (`pool-claim --pool W/target --label a7-verify-wall`, claimed from `W` so the recorded lane identity is this lane's), and released only after the arms.
3. **Each command's exit is checked before the next one runs.** Per command, read directly — not inferred from the tail of a later one. This is the composed-exit shape that produced a KILLED nextest reading "exit code 0" and a silent no-op edit that I reported to three peers as a completed replacement.
4. **The runner/job census is refreshed AFTER the release build and BEFORE ARM A** — two-axis, jobs-level CI read plus an ancestry-authenticated local process census. S3's release build takes minutes, and the runner can be re-occupied inside that span; a census taken before the build does not describe the box ARM A's first cold wall lands on.

## A4.3 Status of the prerequisite — specified, not demonstrated

The signed-set path in A3.3 is **specified from source, and has not been executed.** S3–S5 must establish it **before** any timed trial, and the refusal mode is unchanged: if the listener refuses by name, that is a **blocked/VOID** experiment and the finding is the prerequisite, never a wall. No wall recorded before S5's provenance row exists and matches the staged set's `artifact_sha256`.