[88plug]

Amendments R1 and R2 to the F3 pre-registration (k3d-gpu eas up --agent-toolkit on the i9-13900T). Both were pushed before any F3 step (R1 at 2026-10-29 22:12:30 PDT, R2 at 22:48:02 PDT, from the branch's activity log), so each push time is its pre-registration time.

F3's row and its section are already on main, from #249, with prior P(SUPPORTED) = 0.35. A second F3 row was drafted for the same run, with other wording and a prior of 0.5. It is not added: the first one stands, and no prediction is edited. R1 changes no step, ceiling or grade. It only fixes how the run is held and where its files go:

• Locks. The desktop holds (H55, H57dp, H59d) take ~/k3dgpu-bench.lock. The F3 section names only <scratchpad>/live.lock, so F3 could have overlapped a hold. F3 now takes ~/k3dgpu-bench.lock first, then live.lock, each with flock -o -w 36000. That is H55's order with AD_EXTRA_LOCK, so no wait cycle forms. The 180 min cap counts from the moment both are held.
• Node image. Step 0's image gets a local tag that step 1 names with K3D_GPU_IMAGE; the header records its image ID.
• Run directory. K3D_GPU_STATE_DIR is a new directory on disk for the run, and KUBECONFIG is unset, so every step uses the cluster's own kubeconfig there.
• ps samples. The 2 s samples go to one gzip file, and step 7 counts through zcat. A second scan after step 8 also covers eas down's log and samples; it is recorded and not graded.
• When. k3d-gpu eas (eas: k3d-gpu eas up, down, status and check (EAS with EAT 2.0 on a k3d-gpu cluster) #260) is not on main yet. F3 waits for it, as its section already says, and eas: k3d-gpu eas up, down, status and check (EAS with EAT 2.0 on a k3d-gpu cluster) #260's unscored wiring smoke runs first inside the same two locks.

R2 changes only which values step 7's secret scan counts. #260's second wiring smoke showed that keycloak-admin-secret holds a 5-byte username next to its 24-byte password. The username is an account name, and a fixed-string count of it found 717 lines in the smoke's logs, which would grade any run REFUTED with no secret shown. Step 7 now counts the password key only and records that username was not counted. Step 7's own log, written while it counts, is left out.

Checks on this branch: tests/ledger_drift_check.py (81 rows, 42 files agree), tests/claims_check.sh (clean) and tests/pe_premise_check.sh (ok). No row or verdict changes, so docs/intel/technical-report.md needs no update.