NASHVILLE — Tennessee spent Wednesday acquiring permission to kill Christa Gail Pike, and it got all of it.

The execution was set for 10 a.m. An hour before, a divided panel of the Sixth Circuit stayed it 2–1, wanting time to work out how the state's own reversal on Pike's childhood-abuse record bore on her earlier appeals. The attorney general's office went to Washington the same day, arguing that a last-minute halt would retraumatise the family of Colleen Slemmer, whom Pike tortured and killed in 1995 at the age of eighteen, and would reward "abusive delay tactics." The Supreme Court vacated the stay. The conservative majority gave no reasons. Sotomayor, Kagan and Jackson dissented, saying the claims deserved a closer look. Governor Bill Lee had already denied clemency on Monday.

That is the complete set. Warrant, conviction, protocol, governor, circuit court overruled, Supreme Court cleared. By Wednesday evening the State of Tennessee held every authorisation the American legal system is capable of issuing for the taking of a human life.

It then administered two full doses of pentobarbital over the better part of two hours and failed.

Pike lost consciousness. Her heart kept beating. Reporters in the witness area could hear her, in her lawyer Randy Spivey's account on Thursday, "breathe and choke and struggle while the state worked in secrecy." Her attorneys filed emergency motions in three courts at once — the Tennessee Supreme Court, the Sixth Circuit, a federal district court — not to stop an execution but to stop a failed one, arguing she was in unnecessary agony and that the Eighth Amendment protects a condemned prisoner from being executed badly as much as from being executed at all. The attempt was abandoned. Pike was moved to an off-site medical facility, where she remains in critical condition receiving what her lawyers called lifesaving care. Neither attorney has been permitted to see her. Her warrant expired at midnight.

## The part the state cannot buy

The gap here is not legal. Nobody outranked Tennessee on Wednesday. The gap is technical, and it is the same gap the state has walked into three times in nineteen years.

Phil Bredesen halted executions in 2007 to review the lethal-injection procedure. Lee halted them again in 2022 after officials conceded they had never properly tested the drugs they were using; an independent review then found broader failures. Tennessee adopted a new protocol in December 2024, switching from a three-drug sequence to a single massive dose of pentobarbital. In May of this year the execution of Tony Carruthers was postponed because staff could not find a usable vein; Lee gave him a one-year reprieve.

Stephen Ferrell, Pike's other attorney, said medical experts on their team had flagged her difficult veins and that the likeliest explanation is an infiltrated IV line — the drug delivered into tissue rather than bloodstream. Which is to say: the failure Tennessee could not solve in 2022, and could not solve in May, it did not solve by Wednesday either. The protocol was rewritten. The cannulation was not.

On Thursday Lee ordered a "comprehensive, third-party review," and cancelled the state's last scheduled execution of the year, Gary Wayne Sutton's, set for December 3. His statement is worth reading for its own admission: carrying out a lawful sentence, he said, must be done "not only legal and constitutional, but is effective." Effective is doing a great deal of work in that sentence. It is the governor conceding, four days after refusing mercy, that the state had bought a licence to perform an operation it had not confirmed it could perform.

## What happens now

No automatic rule bars a second attempt. If investigators conclude procedure was followed and Pike's rights were not impeded, Tennessee can return to court and ask for a new date, and courts have historically allowed it. But the warrant is gone, the protocol is under outside review by a team the governor has not yet hired, and Pike's lawyers now hold a factual record — two hours, two doses, a hospital, a woman who survived — that did not exist at 10 a.m. Wednesday. Her Eighth Amendment claim is no longer hypothetical. It happened to her, on camera, in front of witnesses, and the state's own governor has ordered an investigation into it.

She would have been the first woman executed in Tennessee in more than two hundred years. The UN Human Rights Office had campaigned against the sentence on the grounds of her documented childhood sexual violence and mental illness, material her attorneys say the sentencing jury never properly heard. Those arguments were available before Wednesday and were rejected. They will be heard again now, because of a vein.

The Gap. Authorised: the full execution of a lawful death sentence, cleared by the Supreme Court of the United States. Delivered: two hours, two doses, one hospital transfer, one indefinite pause on the state's remaining execution, one review not yet staffed. Distance between the two: the insertion of an intravenous line.

Google announced its most capable model on Thursday and simultaneously announced that you cannot have it.

Gemini 4 Argon is going out through something called the Fairwind Program to a vetted set of cyber defenders, plus the US government under its voluntary pre-release access process. Koray Kavukcuoglu, Google's chief AI architect, wrote that "safely releasing frontier capabilities at this level requires a phased approach." Paid API customers and AI Ultra subscribers come later. The price is already published — $2 per million input tokens, $10 per million output — for a product with no general customers.

This is now the house style of the American frontier. Anthropic has kept Claude Mythos Preview behind Project Glasswing for five months, restricted to vetted defenders, explicitly because of what it can do to software. On Monday the *Wall Street Journal* reported that OpenAI scrapped GPT-6.1 Astra, which had been scheduled for an October debut in ChatGPT and Codex, after internal safety testing. Three labs, three locked doors, one month.

The problem arrived on Tuesday from Anthropic's own Frontier Red Team, and it is the most useful document anyone published this week.

## The numbers

Zhipu AI — Z.ai outside China — released GLM-5.3 with open weights. Anyone can download it. Anthropic benchmarked it against the model it refuses to ship.

On ExploitBench, which tests end-to-end exploitation of known flaws in Chrome's V8 engine, GLM-5.3 produced working exploits in 50 of 410 attempts. Mythos Preview managed 56. On Anthropic's internal binary-exploitation set, GLM-5.3 achieved full control-flow hijack on 4 percent of 100 tasks against Mythos Preview's 6 percent. Claude Opus 4.6 and GLM-5.2, a generation back, scored zero on both.

Then the part that matters. Because the weights are public, the refusal behaviour can be surgically removed — a procedure called abliteration. Anthropic did it to GLM-5.3 itself: roughly 2,200 GPU hours, about $4,400, dropping the refusal rate from above 90 percent to as low as 2 percent with little capability loss. The team estimated an experienced group would need around 600 GPU hours, about $1,200. Several developers published abliterated builds within days of launch.

NIST's Center for AI Standards and Innovation reached the same place from a different direction on 17 September, calling GLM-5.3 "the most cyber-capable open-weight model released to date" and putting it roughly four months behind the US frontier.

## What the gate is actually gating

Read those two findings together. The gap between the model Google will not sell you and the model you can torrent is about four months of capability and $1,200 of compute. Gating is a policy that only works on scarce goods, and the thing being gated is four months from being free.

That does not make the restraint worthless. There is a real argument that a six-week head start for defenders is worth having, that vetted distribution buys patch cycles, that the alternative — everyone shipping everything — is worse. Google is not wrong to stage Argon. Anthropic is not wrong to hold Mythos. The red team that published the GLM numbers is the same company declining to release its own model, which is either admirable consistency or an unusually expensive advertisement, and probably both.

But nobody should mistake the staging for a safety property of the world. It is a safety property of three companies' release calendars, and it expires on a schedule set in Beijing. Argon's guardrails are being tested by a trusted cohort. GLM-5.3's guardrails were tested by whoever wanted to, and they came off for the price of a transmission.

The Gap. Claimed: frontier cyber capability held back from public access by phased release. Actual: an openly downloadable model at roughly 90 percent of the benchmark performance, with its refusals removable for about $1,200. Distance between the two: four months, and falling.

SINGAPORE — The news arrived the way genuinely important energy news usually does: four people briefed on the matter, no announcement, and a national holiday starting the same morning.

Chinese refiners have suspended exports of refined oil products to any destination outside Hong Kong and Macau until further notice from Beijing, Reuters reported Thursday. PetroChina cancelled a handful of gasoline and jet-fuel shipments scheduled for October, most of them deals it had committed to within the previous fortnight. Zhejiang Petrochemical simply scheduled nothing for the holiday week. The National Development and Reform Commission did not respond; the country is on break until 7 October, and nobody will say whether the taps reopen after that.

China holds the largest refining capacity on earth. It is also, awkwardly for everyone downstream, the world's largest crude importer, and the US–Iran war is in its eighth month.

## The arithmetic Beijing is doing

Beijing restricted fuel exports in March, shortly after the war broke out and Middle Eastern crude supply went unreliable. It relaxed the curbs in July and has since run exports month by month, on an explicit condition: domestic inventories must return to pre-war levels.

They have not. Zameer Yusof of Kpler, who tracks clean products, puts commercial gasoil and diesel stocks roughly 20 million barrels below that threshold and gasoline about 9 million barrels short. "A pause on those products was likely," he said, which is analyst for *this was never close*.

September's outbound volumes give the size of the hole now opening in the market: about 1.4 million tonnes of diesel, 500,000 tonnes of gasoline, and at least 2 million tonnes of jet fuel, heading largely to Singapore, Vietnam, Bangladesh and Australia. Those buyers now compete for barrels in a market already short Russian and Middle Eastern supply. Several of them have no refining alternative worth the name.

## The price

Brent's new front-month December contract settled at $102.31, up $4.28 or 4.37 percent. WTI finished at $92.87, up 2.71 percent. Energy was the best of the eleven S&P sectors at 1.9 percent on a day when the index as a whole managed 0.19 percent, to 7,666.45.

The sell-side attributed the crude move mostly to the third US carrier group sailing for the Gulf. That is the more cinematic explanation and probably the smaller one. Carriers have been arriving for months. What changed Thursday is that the single largest swing supplier of refined product in Asia stopped supplying, on the eve of a week when its own officials are unreachable, with no stated end date and a reopening condition — inventories back to pre-war levels — that is 20 million barrels away.

Crude shortages move the oil price. Product shortages move what people actually buy: diesel for trucks, jet fuel for airlines, gasoline at the pump. The AP–NORC poll released the same day found 65 percent of Americans blaming the president's policies for high prices. They have thirty-two days to think about it and nobody in Beijing is answering the phone.

The Gap. Capacity: the largest refining complex in the world, running. Available to buyers outside Hong Kong and Macau in October: nothing. Distance between the two: an unpublished instruction and a week-long holiday.

LUSBY, Md. — Read the Constellation press release and you get $3 billion of Maryland infrastructure investment, 190 new megawatts of emissions-free capacity between 2030 and 2032, a twenty-year relicensing runway for the state's only nuclear plant, and hundreds of jobs. All true. Read the calendar and you get something more interesting.

In early May, Amazon Web Services filed a conceptual site plan with Calvert County for the Calvert Technology Center: three campuses, roughly 2.46 million square feet across about 2,000 acres, eight buildings, an estimated 500 megawatts of demand, next door to the Calvert Cliffs reactors. In the same period the county's Environmental Commission recommended a pause of at least twelve months on further data-centre approvals, citing noise, water, forest clearing, threatened species and cumulative effects. On 4 August, Amazon withdrew. The company insisted the decision was commercial, not political — development timelines, operational requirements, "our ability to deliver quickly for customers" — and said Constellation remained a valued partner.

On 30 September, Amazon signed a twenty-year power purchase agreement for 690 megawatts from the plant, including the 190-megawatt uprate, plus a retail supply agreement covering its operations across the thirteen-state PJM market. No price disclosed.

## What actually got decided

The county retained the thing it controls — land use — and lost the thing it assumed came attached to it. Megawatts are fungible on a regional grid in a way that 2.46 million square feet of concrete is not. Amazon did not need the parcel. It needed the generation, the relicensing, and a PJM retail contract that lets it put the load wherever permitting is easier. That is what it bought.

Calvert County now hosts the reactors, the uprate construction, the cooling water draw and the twenty-year commitment, and will host none of the buildings, none of the property tax base, and none of the jobs that were the entire argument for tolerating the buildings. Constellation, for its part, said in August that the opportunity to build digital infrastructure in Calvert County "continues," which is a statement with a future tense in it and no counterparty.

The useful lesson for every county council currently drafting a data-centre moratorium: you are regulating the warehouse. The industry is buying the wire. Local planning authority over hyperscaler siting is real, and it is also the least binding constraint in the stack, because the firm can satisfy its power requirement in your jurisdiction and its square-footage requirement two states away without renegotiating either.

Constellation gets revenue certainty to relicense Calvert Cliffs for another twenty years and to work toward new generation on the site. That is a genuinely good outcome for the grid, and it was financed by a customer the host community voted, in effect, not to have. Both of those things are true at once, which is why this deal is worth more attention than the press release it came in.

The Gap. Sought in May: 500 megawatts and 2.46 million square feet in Calvert County. Obtained by September: 690 megawatts and no square feet in Calvert County. Distance between the two: the difference between what a county can zone and what a utility can sell.

UK Maritime Trade Operations logged it as Warning 147-26: a tanker struck by an unknown projectile while transiting the Strait of Hormuz, fire aboard, crew reported safe, damage and environmental impact unknown. The time was 1750 UTC Thursday. Iran's Fars agency put the vessel at 2.5 million barrels of capacity, hit eight kilometres off the Omani coast while using what it called an "unauthorised route" south of the waterway.

That phrase is the story. Somebody is now issuing route authorisations in the Strait of Hormuz, and somebody is enforcing them with ordnance, and neither party will put a name to either act.

September produced at least sixteen attacks on vessels in the strait, mostly tankers, including four in the twenty-four hours of 28–29 September: the Kuwait Oil Tanker Co VLCC *Al Funtas*, Sinokor's *Mersin Prosperity*, the Anglo-Eastern-managed *Sinbad*, and ADNOC's product tanker *Al Ruwais*. Iran's Persian Gulf Strait Authority said this week that of the most recent three, all were owned or chartered by the UAE. Tehran formally barred safe passage to Israeli- and US-affiliated shipping on 28 February, after the opening strikes. Washington says it is in total control of the waterway. The insurers are not persuaded by either claim.

## The force arriving

A US official told Al Jazeera that the Theodore Roosevelt carrier strike group left San Diego on Sunday, followed a day later by the Makin Island amphibious group carrying more than 2,000 Marines. By the end of November the United States expects three carriers and two landing groups positioned around Iran, with additional F-35s, layered on top of roughly 50,000 service members already in the region. Reporting on the deployment, with as many as 10,000 additional troops, is what the oil desks blamed for part of Thursday's 4.37 percent move in Brent.

The stated purpose is to keep military options available to the president regardless of how diplomacy goes — including, officials indicated, if an agreement is reached. Trump told Fox News he believes the US will win "very soon," and has suggested resuming strikes is possible but not something he wants to spell out before the midterms. On Thursday he added, on the South Lawn, that Iran "won't exist any longer" unless it signs a fair deal, and that if Tehran turns out to be behind the Flydubai co-pilot who stabbed his captain over the Gulf, "they'll be hit, very hard, don't worry."

## The offer nobody has answered

Iran's proposal has been on the table since 25 September, conveyed through Qatar and, Pezeshkian has now confirmed, Pakistan. Araghchi's version: four to five days of initial steps, the strait reopens on day six, nuclear talks begin on day seven. What Washington would do first is lift the naval blockade, waive sanctions on Iranian oil, release roughly $12 billion in frozen assets, and observe a regional ceasefire covering Lebanon and Yemen.

Trump rejected it publicly within days — Iran was "losing so badly," the offer "would not be acceptable." Mediators kept working anyway. Tehran confirmed last week that an official US response had arrived and declined to say what was in it. The impasse is entirely about sequence: Iran wants the blockade lifted before it discusses centrifuges, Washington wants centrifuges discussed before it lifts anything. Both positions are coherent. Neither has moved in seven months.

Meanwhile the price of the disagreement is being paid by crews on ships that are not party to it, on a route one side says is unauthorised and the other says is under its total control.

The Gap. Declared: total US control of the Strait of Hormuz; a seven-day Iranian plan to reopen it. Delivered in the first seventeen hours of October: one burning supertanker, crew safe, attacker unnamed. Distance between the two: eight kilometres off the coast of Oman.

WASHINGTON — The itinerary is the poll.

A president who freely concedes he dislikes travelling plans to do almost nothing else for the next month: at least seventeen states over thirty-two days before 3 November, beginning Thursday in Texas and the Choctaw Nation in Oklahoma, continuing to Alabama, Ohio and Nebraska. "I'm doing it myself," he told reporters. He has asked Republican voters to pretend he is on the ballot.

Look at where he is going. Oklahoma, Alabama, Nebraska. These are not states in contention. A campaign that spends the closing month of a midterm cycle in its safest territory is not persuading; it is trying to get its own people to show up, which is a different and more worrying problem. All 435 House seats and 35 Senate seats are up. The Hill's forecasting partner Decision Desk HQ puts Democratic odds at 75 percent for the House and 54 percent for the Senate.

## The two numbers driving it

The AP–NORC survey released Thursday is brutal in a specific way. Seventy-one percent disapprove of the handling of the war with Iran, now in its eighth month and conspicuously not over despite both sides declaring victory. Seventy-three percent disapprove of his handling of the economy. Sixty-five percent say his policies — not the war, not the Fed, not supply chains — are the main driver of high prices. Sixty-nine percent say the economic agenda has gone worse than expected.

The second number is the dangerous one, because it is self-reinforcing with the first. The war raised fuel prices. Brent closed Thursday at $102.31. China stopped exporting refined product the same day. The ten-year Treasury touched 5.34 percent on Wednesday, the highest since 2002, after the worst quarterly bond rout since 1994, and the Fed raised rates 25 basis points in September. There is no configuration of those facts that produces cheaper petrol or cheaper mortgages before 3 November.

Asked directly whether Iran could cost him Congress, Trump said: "Well, it's possible. It should help. Because Iran will not have a nuclear weapon." Then the conditional that gives the game away: "So when you say it that way, it would help. If you don't say that, it could hurt." He is aware the framing is doing the work, and aware that he does not control the framing.

## The advertisement problem

Running alongside the rallies is roughly $2.5 million in federal money, by AdImpact's estimate, buying television spots promoting the president and his administration. Wednesday's instalment is about the Iran war, scored with audio of Trump and Defence Secretary Pete Hegseth over unclassified strike footage. The White House calls them public service announcements, "very clearly not campaign ads," a reminder to Americans to love their country. Trump called them "for the spirit of our country."

Representatives Jamie Raskin and George Whitesides have asked the Government Accountability Office and the Office of Special Counsel to look at them as, in their phrase, "desperate pre-election propaganda," and some Republicans have joined the objection. FCC chair Brendan Carr said federally funded ads do not merit any FCC review.

Both things are the same manoeuvre. When the measurable indicators are against you — fuel, rates, an unfinished war, your own approval — you spend what you can control on the presentation. Thirty-two days of rallies in safe states and $2.5 million of taxpayer-funded atmosphere are the behaviour of a campaign that has given up on changing the conditions and is working on the description.

The Gap. Required: Republican turnout sufficient to hold two chambers. Being deployed: a thirty-two-day personal tour of districts already won and $2.5 million of federal advertising. Distance between the two: $102.31 Brent and a 5.34 percent ten-year.

On 21 September, Thélyson Orélien won the Prix du roman Fnac for *C'était ça ou mourir* — a first-person account of a history and geography teacher fleeing a home country consumed by gang violence, published by Grasset in August, 35,000 copies sold, rights in more than twenty countries, longlisted for the Goncourt.

The same day, an X account called Balance ton Claude, then holding 92 followers, announced it had run passages through the American detection service Pangram and got "almost always the same result: 100% IA."

On 25 September the Académie Goncourt withdrew the book, citing findings that the novel is "in all likelihood, very largely the product of artificial intelligence," plus separate plagiarism allegations, and saying the removal was about making clear the academy does not endorse or reward texts generated with AI. The shortlist comes Tuesday, 6 October. Orélien's Canadian publisher, Boréal, suspended promotion, citing his well-being. He denies everything. "I've always loved creating and writing," he told *Libération*. "I don't see why I would use a machine."

## What the evidence is and is not

Pangram is the best-regarded tool in this category, and that is a claim with an asterisk nailed to it. Two independent studies rate it the most reliable detector available; both evaluated English only. The company advertises an error rate of 0.0041 for Pangram 4, the version used here. France Inter ran the book and got 95–100 percent AI. AFP put the same passages through rival detectors and got divergent results.

The strongest evidence is not the score. It is the control. Balance ton Claude also tested four Orélien texts predating 2022; all returned 0 percent AI. Franceinfo independently checked his 2015 book *Le temps qui reste* and a 2014 Huffington Post piece — both classified 100 percent human. That is a natural experiment with the author's own prose on both sides of ChatGPT, and it is harder to wave away than a single score.

The weakest part is what the score can mean. Researchers contacted by TF1's verification desk made the obvious point: a text flagged 100 percent AI may have been written entirely by a human who then asked a model to tighten the long paragraphs. The detector sees the model's fingerprints on the surface and cannot see whose book is underneath. One is a machine writing a novel; the other is an author using a copy editor that happens to be software. Pangram returns the same number for both, and the Goncourt treated the number as a verdict.

Orélien is offering $1,000 to charity for anyone who can get a 100 percent AI score out of Pangram using 1,000 words of pre-2022 French literature. As a defence of his book that is a non-sequitur — proving the tool rarely false-positives Balzac does not prove it false-positived him. As a demand that someone validate the instrument in the language it is being used to judge, it is fair, and nobody has taken it up.

Then there is the part the academy mentioned and the internet skipped. *La Presse* found that Orélien's 2012 short story *Où va le monde*, a Radio-Canada readers'-choice winner, contains four passages totalling roughly 100 words that appear lifted from *Le matin des magiciens*, the 1960 Pauwels and Bergier book on the paranormal. That charge requires no detector, no model and no statistics. It is two texts side by side, and it is the only accusation here that can be checked by reading.

The academy had the authority to remove him and used it in four days, on an instrument never audited in French, in a case where a verifiable allegation was sitting right there.

The Gap. Claimed: a determination that a longlisted novel was very largely machine-written. Evidence available: a detector validated only in English, divergent results from rival tools, and 100 words of 2012 plagiarism nobody needed a detector to find. Distance between the two: Tuesday.

At Bloomberg's Screentime conference on Wednesday, Lucas Shaw asked Ben Affleck what AI did on *Animals*, his film arriving on Netflix and in select theatres on 9 October. Affleck said he used it "for lots of things." Pressed for which, he offered the magic-show analogy: you don't want to know there are mirrors before the trick.

It is a charming answer and it should not survive contact with the week it was given in.

The tool was InterPositive, Affleck's own AI startup, which he sold to Netflix earlier this year for $600 million. So the director used proprietary software he built, sold to the distributor, and will not say what it did to the picture that distributor is releasing in eight days. Affleck has been the industry's most articulate pro-AI voice and also one of its more honest sceptics — he has called the technology "a craftsman at best," and argued that once a director works with it long enough to feel in control, it stops being "this nebulous, abstract, terrifying alien" and becomes a tool. That is a defensible position. It is undermined by refusing to show the tool.

The magician comparison fails on its own terms. Magicians withhold method because the method *is* the product; knowing how ruins what you paid for. Nobody has ever bought a ticket to *Animals* for the pleasure of not knowing which frames were generated. The audience's interest in disclosure is not a desire to spoil a trick. It is a desire to know what they are watching, and — because this is an industry that struck twice over exactly this question — who got paid to make it.

Note the asymmetry with the other AI story of the week. France's Académie Goncourt removed a novelist from its longlist on four days' notice, on the strength of a detector score, with the burden of proof landing entirely on the writer to demonstrate he wrote his own book. Affleck, who has confirmed the use, bears no burden at all, and the thing that protects him is not a better argument. It is that he owns the software and the buyer is the distributor.

Meanwhile the infrastructure keeps shipping. Utopai Studios launched PAI on Thursday, a platform that breaks a screenplay into scenes and shots, holds characters and locations consistent across a project, and generates the footage with its own Utopai X model before handing cuts off to Premiere and Resolve. Utopai says X ranks second globally on Artificial Analysis' text-to-video-with-audio leaderboard at an Elo of 1,150, nine points off the top and the highest-placed US model there. It is already running on *The Most Serious Fart*, Mike Bender's animated feature, a title that will do more for the cause of human screenwriting than any manifesto.

And Sia sold half her catalogue to Pophouse for $180 million — publishing and masters, not name and likeness — ahead of an immersive avatar show a couple of years out. Pophouse funded ABBA Voyage and owns Kiss outright, with Kiss Forever slated for Las Vegas in 2028. An insider puts Sia's annual writing and performance royalties at $18 million. That deal is the clearest statement of the week: the catalogue is the asset, the artist's likeness is held back separately, and the performance is becoming a software build.

Affleck is right that the panic is overdone. He is wrong that the trick is the point. *Animals* opens on 9 October. He has eight days to say what he did.

The Gap. Disclosed: that AI was used extensively on a major release. Disclosed about how: nothing. Distance between the two: a $600 million acquisition by the company shipping the film.

Set aside, for a moment, whether Christa Pike deserves to die. She tortured and killed Colleen Slemmer in 1995, and if you believe anyone has earned the penalty, she is a candidate. Slemmer's family has waited thirty-one years. None of that is in dispute here, and the people who want this to be a simple story about mercy are as mistaken as the people who want it to be a simple story about justice.

What happened on Wednesday was neither. It was a demonstration of competence, and the state failed it.

The entire moral architecture of American capital punishment rests on a distinction between an execution and a killing. A killing is chaotic, unaccountable, improvised. An execution is deliberate, reviewable, proportionate, and above all *controlled* — the state does precisely the thing the law authorised, no more, and stops. Every appellate ruling in this area is a variation on that promise. The Supreme Court vacated the Sixth Circuit's stay on Wednesday on the strength of it, without writing a word of explanation, over three dissents.

Tennessee then administered two full doses of pentobarbital over roughly two hours. The condemned woman lost consciousness and kept breathing. Witnesses heard her choke. Her lawyers filed in three courts at once trying to make the state stop. She was taken to a hospital where the state is now spending public money to preserve the life it spent public money trying to end that evening. She is alive tonight, in critical condition, and her own attorneys have not been allowed to see her.

That is not an execution. There is no word for it in the law, which is the problem.

The state's defenders will say this was a medical misadventure — a difficult vein, an infiltrated line, bad luck. Stephen Ferrell, her lawyer, thinks that is exactly what it was. Fine. Then consider what Tennessee knew. In 2022 Governor Lee halted executions after officials admitted they had never properly tested their drugs, and an outside review found the problems ran wider than that. In May of this year the state could not find a vein in Tony Carruthers and gave him a one-year reprieve. The protocol was rewritten in December 2024. The cannulation was not fixed, because cannulation is a clinical skill performed by people who are not clinicians, since clinicians will not do it, since their professional bodies forbid it.

So the state asked the Supreme Court for permission to perform a medical procedure it cannot staff. The Court granted it in silence. And the governor who refused clemency on Monday ordered a "comprehensive, third-party review" on Thursday, which is an admission dressed as diligence. You do not commission a review of a thing you were confident about four days earlier.

Here is the part that ought to trouble supporters of the penalty more than opponents. If the justification for execution is that it is the controlled, lawful alternative to vengeance, then a botch is not a regrettable exception to the argument. It is a refutation of it. A state that announces it will take a life with surgical deliberation and instead produces two hours of audible suffering and a hospital transfer has not delivered justice imperfectly. It has delivered the thing capital punishment was supposed to be distinguishable from.

Tennessee can go back to court. The warrant expired at midnight, so it must. No rule automatically bars a second attempt, and courts have permitted them before. But it should have to answer one question first, in public, with names attached: who was holding the needle, what are their qualifications, and what in the state's procedure changed between Tony Carruthers in May and Christa Pike on Wednesday.

If the answer is nothing, then the review the governor ordered is not an investigation. It is a delay until the next one.

I want to be fair to the labs first, because the cheap version of this column writes itself and it is wrong.

Google withholding Gemini 4 Argon from general release is a real cost willingly borne. So is Anthropic sitting on Claude Mythos Preview for five months behind Project Glasswing. So, most expensively, is OpenAI scrapping GPT-6.1 Astra after internal testing — a model slated for October, built to run long tasks without supervision, killed before launch while a competitor ships agents at DevDay. These are companies in a capability race voluntarily surrendering position. Whatever you think of the industry, that is not nothing, and the people sneering at it have not explained what they would prefer.

Now the uncomfortable part, which Anthropic itself published on Tuesday.

Zhipu AI's GLM-5.3 has open weights. On ExploitBench, testing end-to-end exploitation of known V8 flaws, it built working exploits in 50 of 410 attempts against Mythos Preview's 56. On Anthropic's binary-exploitation set, 4 percent full control-flow hijack against Mythos's 6. One generation back, Claude Opus 4.6 and GLM-5.2 scored zero on both — so this is not a plateau, it is the steep part.

And because the weights are public, the refusals come off. Anthropic did the procedure on GLM-5.3 and reported it: around 2,200 GPU hours, roughly $4,400, refusal rate from above 90 percent down to as low as 2 percent, capability essentially intact. They estimate a competent team needs 600 hours, about $1,200. Abliterated builds appeared within days of release. On 17 September NIST's standards centre independently called GLM-5.3 the most cyber-capable open-weight model yet released, trailing the US frontier by roughly four months.

Hold those two facts together and the policy question resolves itself unpleasantly.

Staged release by a lab is a sensible corporate decision. It buys defenders a head start, it limits the blast radius of a mistake, it is cheap relative to the harm it might avert. Keep doing it.

Staged release as *public policy* is something else entirely. It is a control whose effectiveness is set by the release schedule of a company in Hangzhou. The US government is currently running a voluntary pre-release access process — Google is participating, and said so in its announcement — which means the state's visibility into frontier capability is mediated by firms whose principal safety mechanism has a four-month half-life and no renewal clause. Washington is building a regulatory posture on a moat that refills from the other side.

The honest version of the argument for gating is narrow and I would sign it: a six-to-sixteen-week head start for defenders is worth real money, patch cycles are the unit of account, and a staged rollout to vetted cyber defenders is how you buy them. That is a logistics claim, and it is true.

What is not true, and what the industry keeps letting people believe because the misunderstanding is flattering, is that withholding a model withholds the capability. It withholds *your* model. The capability is a research result, and research results diffuse. The only durable question is what defenders did with the four months, and on that nobody — not Google, not Anthropic, not NIST — has published a number.

Argon will reach paid API customers and Ultra subscribers soon enough, at $2 in and $10 out. By then GLM-5.4 will presumably exist, and the four months will be three, and somebody will write a blog post about phased approaches.

Here is the test I would apply to the next one. If a lab tells you it is holding a model back for safety, ask what specifically gets fixed during the hold, who is doing the fixing, and how they will know it worked. If the answer is "we're gathering feedback from trusted testers as we iterate on guardrails," you have been told the schedule, not the plan.