Keep cancelled output out of delivered evidence

docs/interview-contract-versions.md

@@ -8,10 +8,11 @@ can select it.
 
 ## The active bundle
 
-Bundle 38: live prompt 29, report prompt 22, rubric 1, report schema 3.
+Bundle 39: live prompt 30, report prompt 23, rubric 1, report schema 3.
 
 | Bundle | Introduced |
 |---|---|
+| 39 | All local interviewer-audio cancellations record delivery uncertainty beside unchanged raw transcript text. Recovery, interim-review, phase-judge and report prompt views omit affected generated words; conversation lookup preserves text and byte cursors with an explicit delivery field. Late provider fragments remain uncertain until the same socket's next completion; replacement ends that window. A cut of completed playout marks its open line and the fragments that follow until the next generation's audio, a cut that stops nothing marks nothing, and a marked line is sealed so later words open a new line. Candidate speech, raw independence checks, protected output and presentation are unchanged. A negative follow-up judgment becomes unknown when cancelled output could have contained it. Live prompt 30 covers recovery, lookup and phase judging; report prompt 23 covers interim and final assessment. Rubric and schema are unchanged. |
 | 38 | An outage reported by a run in the language on screen, once Test is recorded or while an earlier run still covers the code on screen, no longer reaches the setup-error reaction that asks the candidate to diagnose it. A reaction of its own says the platform failed rather than their code, that they may click Run once more later, and to continue from the conversation; it invites no hand trace, so the bundle 17 rule that an outage stops inviting one once Test is recorded still holds. The first outage while Test is open keeps the trace reaction, a coding-only session past the gate keeps its continuation, and an outage from a language the candidate has since left stays a setup error. Live prompt 29; the report prompt, rubric and report schema are unchanged. |
 | 37 | The signed token metadata carries the coding-only Example drawing opt-in. Disabled sessions omit drawing instructions, read_board and drawing assessment policy, and refuse drawing streams and controls. Report salvage removes drawing-related sentences and retains schema-required omission notes without changing scores or decisions; unrelated invalid fields still fail validation. Live prompt 28 and report prompt 22; rubric and report schema are unchanged. |
 | 36 | The live `read_editor` guidance says that before any editor snapshot the editor holds only the starter, which needs no read, so the opening turns do not wait on a tool round trip to see it. The `earlierSteps` reminder asks for an unrecorded earlier step with the next evidence call rather than before speaking, so it no longer adds a second tool round ahead of the reply. A turn that answered the candidate with tool calls alone and said nothing is followed by one note that asks for the reply if one is due; Jim may still answer it with silence, but not with nothing, since the note is owed a completed turn. At a typed editor the interviewer is no longer given `record_framework_evidence`, each call of which held its reply back by a second model pass, and is told that the platform records every step and says so in a system event. There, test runs no longer carry the `earlierSteps` reminder, and a rewrite after the complexity was given asks only whether it still holds. The phase judge records Repeat, Example, Algorithm, Coding and Optimizations from the candidate's words and editor as before, keeping the first three open after Coding while a step about the code is, Test from their hand trace while nothing can run the written code, and the four STAR steps from what they say inside the behavioral round; its instruction defines those steps, lets it quote a coding-round step from a comment the candidate typed to explain it, and lets it report a declined probe. The platform writes the end-of-session skips for STAR steps a started round left without evidence, which the wrap-up used to ask the interviewer for, except where the judge found the probe declined, and there the coding round leaves 8 of the 48 judgments for a behavioral round still to come. A whiteboard interviewer keeps the tool and its wording, since the judge is not shown the board. A coding silence nudge says whether the candidate has written code, instead of offering branches for an empty editor and for code that leave the interviewer reading the editor to choose between them; it says nothing is written only when the editor holds just the starter or nothing, asks them to begin coding once understanding, example and algorithm are all recorded, and leaves the choice to the editor for edits too small to count or too long to compare. The `read_editor` guidance adds that a language named aloud needs no read, since choosing it on the tabs sends its own event. The report prompt, rubric and report schema are unchanged. |

docs/interviewer-delivery-evidence.md

@@ -0,0 +1,140 @@
+# Cancelled interviewer output
+
+Output transcription describes generated words, not a delivery receipt. A
+provider generation can finish while native audio is still queued. Successful
+native capture does not establish physical audibility, and transcription has
+no word-to-PCM alignment from which to reconstruct a heard prefix.
+
+## Storage
+
+Keep raw transcript text, line positions, segment ids and turn counts intact.
+Store delivery uncertainty separately, keyed by interviewer transcript line.
+The set is monotonic for the session and independent of recognized text;
+spoken words cannot create or remove a cancellation record. Candidate lines
+are never marked or rewritten.
+
+Attribute accepted audio's existing playout deadline to its interviewer line.
+Audio received before the first transcript fragment waits for that line to
+open. This waiting attribution belongs to that generation and socket;
+completion (after its final padded audio frame), replacement, or a cut ends
+the wait if no line opened. It cannot
+attach to a later generation. Retain all lines with pending deadlines, including generations already
+closed by TurnComplete. Every cut marks the lines with audio still queued. It
+also marks the open interviewer line when it stops something: a running
+generation, or completed output still playing. A cut that stops nothing, such
+as a pause after the audio drained, marks nothing. This covers provider
+interruption, candidate stale-playout cancellation, the stale-playout backstop
+on the next generation's audio, thinking holds, pause and socket handoff.
+Partly captured and never captured turns use the same policy; no heard prefix
+is inferred.
+
+Output transcription trails audio, so a line opened after a completion and
+before the next generation's audio cannot be told apart from that output's
+trailing words. A cut of completed playout therefore marks such a line, and
+fragments arriving after the cut stay marked until the next generation's
+first audio. That generation's words ahead of its audio are over-marked;
+nothing after its first audio is. Cancelled trailing words are never kept as
+delivered.
+
+A cut seals the line it marks, and the end of a window seals the line the
+window marked. A later fragment closes the sealed interviewer turn and opens
+a new line, so a reply is never written into omitted text or ordered before
+the candidate words that cut its predecessor. Audio that arrives while the
+open line is sealed waits for the new line. The candidate's turn is not
+closed. A sealed line can split one generation into two transcript rows; the
+raw words are unchanged.
+
+A cut during generation marks later transcript fragments until the first
+TurnComplete received, whether dispatched or swallowed. A cut after a
+completion is a playout cut, even if trailing fragments arrived, and ends at
+the next audio rather than at a completion that may never come. So is a cut of
+a stalled generation, whose completion may also never come. A completion that
+brings no audio does not end a playout window either. This evidence window
+is independent of the transport's interruption guard, which a late fragment
+can clear. Ambiguous ordering may over-mark a subsequent generation until that
+boundary. This window belongs to one provider socket; replacing that socket
+closes it, cold or resumed, so the new socket's first reply starts normally.
+A local cut after completion uses the playout window instead. After the boundary, subsequent turns start normally. Protected
+greeting and closing paths that keep their audio are not marked.
+
+## Readers
+
+Recovery (cold, resumed and compressed), interim review, the phase judge's
+prompt and the report substitute the whole marked line's text with
+`[Interviewer output cancelled; delivery uncertain; generated words omitted.]`.
+Transform before taking a slice or inserting the behavioral-round marker, so
+line indexes remain correct. Omitting whole turns prevents bounded transcript
+tails from separating a marker from the words it qualifies.
+
+Conversation lookup retains raw text, search and byte offsets, with a
+`delivery: "uncertain"` field on every affected row, and `nextDelivery:
+"uncertain"` when the page ends inside an affected turn.
+Include that field in serialized page budgets. Raw text remains useful for
+finding a possibly heard idea, but does not establish delivery.
+
+No reader may infer that a marked question, hint, clarification or follow-up
+reached the candidate, or penalize a missing answer. Ignore older notes or
+restored memory that assume delivery. Candidate speech and independent
+engineering evidence remain usable. Hint counts and independence constraints
+remain unchanged: raw interviewer text still participates in the server's
+check against crediting a candidate for repeating an interviewer-supplied idea.
+Round-boundary detection and candidate-evidence grounding also keep raw text.
+Continuity does not treat a cancelled interviewer line as answering the
+preceding candidate line.
+
+A follow-up raised only in marked output is not established as raised for the
+report; candidate reasoning remains assessable independently. When follow-ups
+were released, the server conservatively stamps a negative raised judgment as
+null if any interviewer output was cancelled, since the omitted words could
+have contained that question. A positive judgment from other evidence remains
+positive. This may withhold an unrelated negative judgment; it does not claim
+that a generated question was never raised. In sessions with ordinary
+barge-ins this can make every negative follow-up judgment unknown, an accepted
+cost of preserving uncertainty without recording a new release-position state. The behavioral
+question and no-repeat rules remain: clarify it if the candidate asks, without
+automatically asking it again. When any marked line falls in the behavioral
+round, recovery conservatively avoids a new question or follow-up. It adds
+that uncertainty to what the recovered window shows of the round's opening,
+including an opening the window lost, rather than replacing it. A marked
+coding wrap-up still in flight at the transition may therefore prevent a
+STAR question that was never generated from being asked after recovery. This
+is an accepted loss of assessment opportunity: without aligned delivery or a
+new semantic judgment, the platform cannot distinguish a wrap-up-only turn
+from one that also began the question. It follows the existing rule for a
+missing behavioral opening: unsupported STAR parts receive the existing
+neutral `session_timing` / `skipped` bookkeeping at session end, without
+blaming the candidate or awarding credit. The existing declined-probe
+exception keeps those parts unassessed rather than skipped. A later
+unmarked reply does not retrospectively establish which question or follow-up
+the marked turn contained. This change sends no additional live notice on
+a local cut and does not rewind phase evidence or request an assessment call.
+
+Browser transcripts, saved history, replay and export retain recognized text
+and existing behavior. This bundle changes model-facing evidence, not those
+presentation surfaces. Unmarked output is not proof of physical audibility.
+Audio cancellation, reply debt, timers, retry and spend limits, recording
+retention, rubric 1 and report schema 3 remain unchanged.
+
+## Contract and validation
+
+Bundle 39 uses live prompt 30 and report prompt 23. The live component covers
+recovery, conversation lookup and phase judging; the report component covers
+interim and final assessment. Update server and browser constants,
+prompt goldens and their recorded digest together. No schema migration is
+needed, and existing reports retain their original contract.
+
+Handler tests cover both ordinary cancellation paths, late fragments and the
+next completion, fragments before and after a candidate playout cut, the reply
+that follows one, the backstop's ambiguous line, cold and resumed replacement
+replies, fully delivered and protected controls. Metadata tests cover partial
+capture, overlapping queued lines, audio before transcription, idle and
+playing pauses, holds and handoffs, sealing, and the other queue cuts. Verify
+every reader, behavioral-round insertion, stable conversation paging,
+interim reviews that are not rewound and unchanged candidate lines.
+
+The marking, window and sealing rules live in `InterviewerDelivery` in
+`src/agent.rs`, where mutation testing reaches them. The event handlers that
+call it are excluded from mutation testing in `.cargo/mutants.toml`, so
+their wiring rests on the handler tests alone.
+These checks establish local event handling, not provider ordering or physical
+delivery; the separate conversational media benchmark measures real media.

docs/observable-delivery-policy.md

@@ -37,6 +37,14 @@ transcript that notes, reports and recovery read; the interviewer hears the
 audio itself. None of this is a guarantee that provider-generated transcripts
 are accurate.
 
+Cancelled interviewer output is a session condition too. The
+[interviewer delivery evidence policy](interviewer-delivery-evidence.md)
+substitutes a delivery-uncertain marker for an affected whole turn in model
+prompt views. Raw transcript storage stays unchanged; conversation lookup
+retains its text with a separate delivery field. A marked turn cannot
+establish that a question or hint reached the candidate, and a missing reply
+to it must not count against the candidate. Candidate speech remains usable.
+
 ## What enforces it
 
 The report prompt states the boundary, and the server independently scans every