feat(voice): brevity becomes a rule with a budget, and something that grades it (#12)

* fix: the four defects the live tier turned up, and the gap that hid them

**A summary that announces a result is not one that carries it.** The
`complete` nudge guarded the case where the summary is EMPTY and nothing
covered the case where it is present and says only that the work happened.
Live, the agent closed a downloads listing with "Done — that's the full
listing, and I've released the machine" — affirmative, no listing — and
"briefly tell the user the result" was obeyed against data holding no
result: Sai reported the folder empty. It was not. The wording now says
what to do when the answer is not in front of it, and names getSaiStatus as
the way to look rather than leaving a gap to fill.

**A held nudge may already have been delivered.** The same completion then
went out twice, because it landed while Sai was answering "what's going on
with all that?" — a turn that had already fetched and reported that result —
and flushed afterwards regardless. Nudges released by the flush now carry a
preamble saying the turn just ended may have covered this already.
Deliberately NOT solved by collapsing same-kind completions: two
completions in one turn are usually two different tasks, and dropping the
older one loses a result outright.

**An unmapped `data-*` frame now names its fields.** Envelope markers
(`text-start`, `reasoning-end`) are right to drop silently; a custom data
part is the server handing over state, and every other one has a handler.
This is how `data-session` — arriving once per turn, unhandled — turned out
to carry `sessionId`. Field names only, never values: this log is mirrored
to a projector. The claim in HttpAgentBridge that no session id comes back
was simply false, and is corrected rather than removed, because keeping no
session identity is still the right call.

**The agent double could not represent an abort.** `ScriptedAgent.post`
recorded the call and let the aborted task's beats land anyway, so an
aborted task finished normally and was reported as done — the exact lie the
interrupt path exists to prevent, invisible to every test. `abortRunning`
had sat there unused, which is why every assertion about abort in the whole
suite was a negative one.

Tests: AbortConversationTest drives the positive stop path off-device for
the first time. LiveQueueTest is the only place a second ask is admitted
behind a task that is genuinely still running — real latency, not a driven
clock — and the only place `abort` and `new-session` reach a real endpoint;
both passed against staging. A tenth on-device check covers stopping work,
which the by-ear gate never had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(voice): brevity becomes a rule with a budget, and something that grades it

Brevity was the one headline property of a voice-only interface that the
prompt asserted and nothing measured. It lived as an adjective clause at
block 2 ("one or two sentences"), repeated with no added constraint at
block 4 ("extra short"), competing with 36KB of correctness rules that
mostly push the other way: name the specific action, echo the detail you
heard, account for each outstanding task separately, give the reversal
beat before the result. Length pressure here is structural, and the
prompt never said which side yields.

**A budget, not an adjective.** The new LENGTH block sits after the
hands-free context that motivates it and gives a countable default — one
sentence, under about fifteen words, roughly six seconds — because a
sentence can be forty words and the ear counts time, not punctuation. It
names what to cut, which nothing did before: openers, restating the
request, announcing what it is about to do, unsolicited offers, and a
closing "anything else?" — the call stays open, so it never has to ask.
A worked too-long/right pair carries more than the adjectives did.

**And what it yields to.** LENGTH YIELDS TO ACCURACY, AND TO NOTHING
ELSE. Without that paragraph a tightened brevity rule quietly erodes the
honesty rules the prompt is built around, so the four cases that
genuinely need words are named: a verbatim read-back, two tasks
accounted for separately, presenting a choice's options, why a capture
failed. Blocks 2 and 4 now defer to it instead of stating weaker
versions of it.

**`no-filler` is what makes it hold.** Thirty-eight behaviours in this
prompt hold because a rule grades them; this one did not, and the rubric
had no rule about length or filler at all. The first run proved the
point in the other direction: the rule as first written flagged "I'm
currently checking your unread emails and Slack messages, and after that
I'll book your table" — the exact line the LENGTH block exists to
protect, and a line anyone would be happy to hear on the glasses. The
rule keyed on repeating the request when what matters is whether the
words are an ANSWER. It now says naming a task inside an answer about
that task is content, and carries an operational test for the judge:
flag a line only if words could be deleted with nothing the user asked
for lost. Both rows pass.

Transcripts: a plain calendar check, where nothing needs elaborating and
filler is all there is to add; and `no-filler` added to the existing
"one running, one waiting" row, pointing the other way — that reply
legitimately needs two clauses, so it is where a brevity rule would do
its damage.

Evals (gemini-3.1-flash-lite-preview, judge gemini-3.5-flash-lite):
transcript tier 54/56 effect choice, 74/76 judged, 1 ungraded on a 503;
loop tier 6/6 structural, 8/9 judged. Both `no-filler` rows pass. The
remaining flags are the documented lite-tier ones (`queued-not-underway`
twice, `no-fabricated-timing` once). The two attachLatestImage misses
are NOT this change: A/B'd two runs per prompt on those transcripts and
the pre-change prompt fails the same row the same way.

Counts that had drifted with the catalogue: 41 -> 42 blocks, 31 -> 32
rules, 32 -> 33 transcripts in README, DIRECTORY, SAI_GLASSES_APP and
LoopEvalTest's header.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: jamie-simular

README.md

@@ -57,6 +57,13 @@ at runtime looking like a bug — so fill in the whole required section.
 
 ## Build and test
 
+**The simple path.** Open the `meta-android-app` folder in Android Studio — not the repo root; Gradle
+lives one level down, and the parent will not look like a project. Fill in `local.properties`,
+**File > Sync Project with Gradle Files**, plug in a phone with USB debugging, and click **Run**.
+That installs and launches. It does not run the tests.
+
+The command line does both:
+
 ```bash
 export JAVA_HOME="/Applications/Android Studio.app/Contents/jbr/Contents/Home"
 cd meta-android-app && ./gradlew :app:installDebug
@@ -65,7 +72,7 @@ cd meta-android-app && ./gradlew :app:testDebugUnitTest --rerun
 
 `--rerun` matters. Without it the test task reports `UP-TO-DATE` from cache and verifies nothing.
 
-CI runs the same gate on every push and PR (`.github/workflows/android.yml`) — 321 JVM tests,
+CI runs the same gate on every push and PR (`.github/workflows/android.yml`) — 327 JVM tests,
 including the 59-scenario FSM golden catalog, the string goldens described below, and the conversation
 harness that drives a fake brain through the real gate, FSM and bridge down to a scripted agent. On-device
 and by-ear checks are still manual: [`docs/ON_DEVICE_CHECK.md`](docs/ON_DEVICE_CHECK.md).
@@ -77,10 +84,14 @@ when you do. CI never sets any of these:
 # contract drift against a real cloud-api — an SSE field that changed shape, a status we don't map
 SAI_LIVE_AGENT=1 ./gradlew :app:testDebugUnitTest --tests "*LiveAgent*" --rerun
 
+# the queue and the stop button against a real agent: a second ask while the first is genuinely
+# still running, then abort and new-session on the wire
+SAI_LIVE_AGENT=1 ./gradlew :app:testDebugUnitTest --tests "*LiveQueueTest*" --rerun
+
 # the real model through the real FSM, graded against the rubric (a full run takes minutes)
 SAI_CONVERSATION_EVAL=1 GEMINI_API_KEY=… ./gradlew :app:testDebugUnitTest --tests "*LoopEvalTest*" --rerun
 
-# the real model over 32 fixed transcripts, no FSM — phrasing and effect choice, graded the same way
+# the real model over 33 fixed transcripts, no FSM — phrasing and effect choice, graded the same way
 SAI_TRANSCRIPT_EVAL=1 GEMINI_API_KEY=… ./gradlew :app:testDebugUnitTest --tests "*TranscriptEvalTest*" --rerun
 
 # a real model AND a real agent, end to end; add SAI_PRESENTER=1 to watch it in the dashboard
@@ -89,7 +100,7 @@ SAI_DEMO=1 GEMINI_API_KEY=… ./gradlew :app:testDebugUnitTest --tests "*DemoFlo
 
 The two judged tiers grade against the same rubric and see different failures, which is why both
 exist: `LoopEvalTest` runs a handful of conversations through a queue that really exists;
-`TranscriptEvalTest` runs 32 fixed transcripts with no FSM, so it can grade whether she SAYS the right
+`TranscriptEvalTest` runs 33 fixed transcripts with no FSM, so it can grade whether she SAYS the right
 thing about a waiting task but not whether the task was really waiting. Narrow either with
 `EVAL_ONLY="<name fragment>"`, and read `EVAL_MODEL` before reading a red — the default is a tier
 below what the glasses run.

docs/DIRECTORY.md

@@ -161,7 +161,7 @@ model's tool calls go into `applyEffects`, and the WebSocket path it replaced is
 
 | Path | What it is |
 | --- | --- |
-| `voice-profile.json` | The system prompt (41 blocks), the 17 tool declarations, the model and the voice. **Generated** from the server's source before it was deleted — the wording is load-bearing, so it was never retyped. It is on the unit-test classpath too (`sourceSets` in `build.gradle.kts`), so `VoiceProfileTest` and `LiveBrain` grade the file the app loads. There is no vendored second copy: the one that existed drifted, and is gone. |
+| `voice-profile.json` | The system prompt (42 blocks), the 17 tool declarations, the model and the voice. **Generated** from the server's source before it was deleted — the wording is load-bearing, so it was never retyped. It is on the unit-test classpath too (`sourceSets` in `build.gradle.kts`), so `VoiceProfileTest` and `LiveBrain` grade the file the app loads. There is no vendored second copy: the one that existed drifted, and is gone. |
 
 ### Resources — `app/src/main/res/`
 
@@ -174,7 +174,7 @@ model's tool calls go into `applyEffects`, and the WebSocket path it replaced is
 
 ### Tests — `app/src/test/java/…/saispike/`
 
-321 JVM tests, no device or emulator needed — everything below runs on `./gradlew
+327 JVM tests, no device or emulator needed — everything below runs on `./gradlew
 :app:testDebugUnitTest` except the tiers that cost money and the golden generator, each gated on an
 environment variable and skipping itself otherwise. Five kinds:
 
@@ -195,15 +195,18 @@ environment variable and skipping itself otherwise. Five kinds:
 - **`conversation/`** — the closed loop, with everything real except the brain and the agent: a fake
   brain's tool calls go through the real `LiveTurnGate`, `Concierge` and `HttpAgentBridge` to a
   `ScriptedAgent` that implements `VoiceTransport`, the seam *under* the bridge — so a wire bug has
-  nowhere to hide. `BargeInConversationTest` and `QueueConversationTest` cover the two hardest paths,
+  nowhere to hide. `BargeInConversationTest` and `QueueConversationTest` cover the two hardest paths, `AbortConversationTest` the
+  one that stops work (the positive abort path, which every other assertion in the suite only ever
+  proved *didn't* happen),
   `LongConversationTest` the state that only accumulates, and `TimingMatrixTest` replays one
   conversation at seven speeds asserting invariants rather than orderings, because every barge-in ⇄
   queue bug on record is a race. `PresenterPublisher` can mirror a harness run to the dashboard.
 - **The paid tiers** — off by default, each behind its own switch: `LiveAgentTest` /
   `SummaryFixLiveTest` (`SAI_LIVE_AGENT=1`) drive a real cloud-api to catch **contract drift** and
-  nothing else; `eval/LoopEvalTest` (`SAI_CONVERSATION_EVAL=1`) runs the real model through the real
+  nothing else, joined by `LiveQueueTest`, which is the only place the queue is admitted behind a task
+  that is genuinely still running and the only place `abort` / `new-session` reach a real endpoint; `eval/LoopEvalTest` (`SAI_CONVERSATION_EVAL=1`) runs the real model through the real
   FSM and grades the transcript against `eval/rubric.json`; `eval/TranscriptEvalTest`
-  (`SAI_TRANSCRIPT_EVAL=1`) runs it over the 32 fixed transcripts in `eval/Transcripts.kt` with no FSM,
+  (`SAI_TRANSCRIPT_EVAL=1`) runs it over the 33 fixed transcripts in `eval/Transcripts.kt` with no FSM,
   grading phrasing by judge and effect choice deterministically; `DemoFlowTest` (`SAI_DEMO=1`) drives a
   real model and a real agent end to end, paced for the presenter so a demo can be rehearsed without
   hardware.

docs/ON_DEVICE_CHECK.md

@@ -1,7 +1,8 @@
 # On-device check — verifying a build on real hardware
 
-**What this is.** Eight checks, ~25 minutes, each naming what it actually exercises. Two of them
-(the queue and the hang-up) carry extra lettered cases, because those are where the failures cluster.
+**What this is.** Ten checks, ~30 minutes, each naming what it actually exercises. Three of them
+(the queue, stopping work, and the hang-up) carry extra lettered cases, because those are where the
+failures cluster.
 Run it after any change that touches the call — and after any server change to the concierge, because
 half of what these checks exercise lives there.
 
@@ -106,9 +107,9 @@ streams to a browser. DEBUG builds only, LAN only.
 > | Waking a machine | The "it's waking / it's ready" lines now travel as `notice` over the stream |
 > | Cancelling a queued task | Four endpoints deep, and the race answers are new — check 6 covers it |
 
-## 1. The eight checks
+## 1. The ten checks
 
-Each names **what it actually exercises** — that is the point of running these specific eight rather
+Each names **what it actually exercises** — that is the point of running these specific ten rather
 than "have a chat with it". Kotlin names (`GreetingGate`, `HangupPolicy`, `CallService`) are in this
 repo; a bare `.ts` filename means the server's half of the same thing, and what the client owes it
 either way is [`CONCIERGE_CLIENT_PROTOCOL.md`](CONCIERGE_CLIENT_PROTOCOL.md).
@@ -255,9 +256,45 @@ mid-sentence.
 - **Then barge in while a task is running**, and let its completion land. Cutting Sai off must not
   cost you the result: it should still arrive after the exchange.
 
-### 8. endCall
+### 9. Stopping work
 
-**8a — with work still outstanding.** Do this one *before* letting the queue drain — if check 6's tasks
+The other half of the queue: check 6 is about work that waits, this is about work that dies.
+
+**9a — stop one thing.** Start a long task. While it runs:
+
+> "Actually, stop that"
+
+- **Expect:** it stops, Sai says so plainly, and — the part that matters — it does **not** describe the
+  stopped task as finished. "That's done" about work that was killed is the failure.
+- **Exercises:** `interrupt` → `applyInterrupt` → `POST abort`. Watch for `→ effect: interrupt` and then
+  `→ POST abort` in logcat. The abort produces **no agent event by design** (the stream reader is torn
+  down), so the handler has to close the turn out itself. If it doesn't, everything you ask afterwards
+  queues behind a turn that will never end — so follow up with a fresh, quick task and check it runs.
+
+**9b — stop everything, from two.** Start a long task, queue a second behind it (check 6a), then:
+
+> "Stop"
+
+- **Expect:** with two things outstanding "stop" is ambiguous, so Sai **asks which** rather than
+  guessing. Answer "all of it" → both go, and a follow-up "what's queued?" reports nothing waiting.
+- **Exercises:** the one-shot scope question in `applyInterrupt` — the first interrupt asks, the second
+  goes straight through. Guessing silently is the failure this exists to prevent, and it stops the wrong
+  task in half of all cases.
+
+**9c — start fresh.** With **nothing** outstanding:
+
+> "Let's start fresh"
+
+- **Expect:** Sai confirms a clean slate, and a `recallHistory` question afterwards no longer reaches
+  the old conversation.
+- **Exercises:** `resetSession` → `POST new-session`. Then repeat it **with a task running**:
+  **expect a refusal that names what is in the way**, not a rotation — rotating out from under live work
+  orphans it. This path is worth the attention: its last bug rotated the *terminal's* conversation
+  instead of this one, which no off-device test could see.
+
+### 10. endCall
+
+**10a — with work still outstanding.** Do this one *before* letting the queue drain — if check 6's tasks
 have all finished by now, start one long one and say goodbye straight over it:
 
 > "Thanks, that's everything — bye"
@@ -267,19 +304,19 @@ have all finished by now, start one long one and say goodbye straight over it:
 - **Exercises:** the persona contract's hang-up-vs-work rule, decided server-side, against the same
   `session-state` picture check 6b reads. Hanging up with a queued task unmentioned is the failure.
 
-**8b — the plain goodbye.** Once nothing is outstanding, say it again.
+**10b — the plain goodbye.** Once nothing is outstanding, say it again.
 
 - **Expect:** Sai says goodbye, *then* the call ends a beat later — not the other way round, and not
   both at once.
 
-**8c — the guard.** Start a fresh call, and with Sai never having spoken, say something that sounds
+**10c — the guard.** Start a fresh call, and with Sai never having spoken, say something that sounds
 like a farewell aimed at someone else ("yeah, bye!" as if to another person).
 
 - **Expect:** Sai does **not** hang up — it asks "did you want me to hang up?"
 - **Exercises:** `HangupPolicy` (covered by JVM tests, but only the decision — not the audio). The
   failure mode is cutting you off mid-sentence with another human.
 
-**8d — talking over the goodbye.** Cut in during the goodbye window.
+**10d — talking over the goodbye.** Cut in during the goodbye window.
 
 - **Expect:** the hangup aborts and Sai carries on, without saying goodbye a second time. Two triggers
   reach this — the barge-in itself and fresh speech after the goodbye finished playing — so also try
@@ -290,7 +327,7 @@ like a farewell aimed at someone else ("yeah, bye!" as if to another person).
 
 ## 2. Recording the result
 
-Write down, for each of the eight — and separately for each lettered case under 6 and 8 —
+Write down, for each of the ten — and separately for each lettered case under 6, 9 and 10 —
 **pass / fail / not-reached**, and for any failure, the log excerpt and what you actually heard. "Not
 reached" is a real result and worth recording; it usually means an earlier check left the session in a
 state the later one could not be provoked from, which is itself worth knowing. The queue cases in
@@ -324,4 +361,4 @@ worth keeping should become an executable spec rather than a memory — the serv
 **Going further.** This is the short gate — run it for a change. The cumulative by-ear matrix (60-odd
 rows, one per bug ever found on a device) and the demo runbook with its on-stage recovery notes live
 with the server's test docs and are **not mirrored here**; ask for them before a release or a stage
-rehearsal, because these eight checks are not a substitute for either.
+rehearsal, because these ten checks are not a substitute for either.

docs/SAI_GLASSES_APP.md

@@ -363,7 +363,7 @@ Layered the same way the server's own suite is — deterministic first, by-ear l
    status the mapper does not know — because behaviour belongs in the scripted tier where it is
    reproducible and free. `SAI_CONVERSATION_EVAL=1` (`eval/LoopEvalTest`) puts the real model through
    the real FSM and grades the transcript rule by rule against `eval/rubric.json`.
-   `SAI_TRANSCRIPT_EVAL=1` (`eval/TranscriptEvalTest`) runs it over 32 fixed transcripts with no FSM,
+   `SAI_TRANSCRIPT_EVAL=1` (`eval/TranscriptEvalTest`) runs it over 33 fixed transcripts with no FSM,
    grading phrasing by judge and effect choice deterministically — the two share the rubric and catch
    different things, since this one can grade whether she SAYS the right thing about a waiting task but
    not whether the task was really waiting. `SAI_DEMO=1` (`DemoFlowTest`) drives a real model **and** a