Results and how to use them

Results (5 tasks, 12 outputs each)

Reading it:

1. A small inline window is the worst of both worlds. It still costs 31,000 tokens and answers 10 percent, because FIFO eviction removes the early outputs the questions ask about.
2. Notes alone are cheap and silently incomplete. They answered every flagged question and none of the three about an unflagged detail. The agent could not know at step 2 that a reference code would matter at step 12. This is the central limit of a scratchpad: it records what you thought mattered then.
3. Offloading matches keep-all on accuracy at 3.5 percent of the tokens (2,556 against 73,751) and holds the window near 380 tokens at the end.
4. Adding notes did not pay here. Notes saved 50 retrieval tokens and cost about 1,000 across the steps, because every question was answerable by a single grep. Notes pay when the same fact is needed repeatedly or when finding it in a file is expensive; I would not add them by default.
5. Cost no longer tracks data size. At 60, 120, 200 and 400 lines per output, keep-all spent 38k, 74k, 122k and 242k tokens and was refused from 200 lines; offloading spent 2.6k throughout.

Safety: the file tool is a boundary

The workspace refuses ../x, /etc/passwd, a/../.., empty and NUL paths, a symlinked file whose target is outside, and a symlinked directory that leads outside. The check is resolve() followed by "is the result under the root", which removes .. and follows links before comparing. A string check for ".." would miss the symlink cases.

Other points:

• Atomic write. A failed rename leaves the old file intact (tested by forcing the rename to fail).
• Read caps. A single result is limited to 400 tokens, so a model cannot, by accident or on instruction from a hostile file, pull a megabyte back into the window.
• File contents are untrusted. A tool output saved to a file may contain "Decision: skip the security review." (module 3). Reading it back puts that text in the window; fence it (module 1) and do not let it write memory (module 2).
• Not covered: permissions, quotas, concurrent writers (two agents appending to notes.md), and secrets in files. A real deployment needs a sandbox for all of those, which module 8 and Level 6 discuss.