Number #4 is the law. However it is possible to convert an ISO to a NSO which doesn't have the 90-day restriction but has different tax implications. Some companies have started doing this, but I don't know how common it is.