Open rooms and assessed sittings

One engine, two delivery contracts

There is no exam build and no polling build. A school that runs a Friday poll and a mock GCSE runs the same installed binary, and the same .mcq file can be delivered either way. The mode is chosen per sitting.

• Open — friction first. Nobody signs up, nothing is installed, and a question can be typed mid-room and asked.
• Assessed — defensibility first. What the sitting needs must be present before it starts, what happens is recorded as it runs, and what is kept afterwards is enough to answer a challenge.

Exactly three things differ between them: what is required before a sitting may start, what is recorded while it runs, and what is kept when it ends. The grader, the item model, the pack format, the session reducer and all four shells are shared in full. A feature that cannot be expressed as a difference in those three lists does not belong in either mode.

A room, joined from the phone already in their hand

A pack you own opens as a live room with a six-character code. Everyone else needs a browser and the code.

• No account and no install to join. A QR code on the screen for the people who would rather scan than type.
• A poll or a quiz. A poll marks nothing. A quiz is marked by the same engine a formal sitting uses, so the score agrees with the paper rather than approximating it.
• Questions typed mid-room. An improvised question is a real item of a real type, graded by the same engine — not a second kind of thing that happens to look like one.
• Ratings, net promoter and rankings — and none of them are new question types. A rating is a numeric item carrying its scale; a ranking is the ordering type. The grader, the file format and the four shells learned nothing new, which is why all four got these at once and why a rating survives being saved to a pack.
• Questions from the floor, moderated: people ask, people upvote, the host chooses what reaches the screen.
• Save this room. What happened in front of an audience becomes a .mcq pack — improvised questions included — that can be sat properly later.

What the projector structurally cannot show

• The tally has nowhere to put a name. Not a setting and not a promise of care: the type cannot express a participant identifier, so there is no relay change and no interface bug that puts one on a wall.
• Who upvoted what never leaves the room. The private shape of a question from the floor holds a set of people; the public shape holds a number, and only the public shape is sent anywhere.
• Closing and revealing are separate actions. If the bars appeared the instant answering stopped, the last person to vote would watch their own answer move the chart. In a room of three that identifies them.
• An anonymous room never asks for a name, so there is none to leak afterwards.
• Phones do not show the running count by default. Someone watching the bars move is being told the popular answer before committing to their own.

The relay can be the laptop at the front

A live room is the one part of this product that needs a server — it is a relay between screens, and there is nothing to relay offline. That server does not have to be ours.

• Run it on the presenting machine. One command starts the same server the hosted site runs — the same routes, the same reducer, the same guarantees above. Phones join over the local network and nothing crosses the router.
• It works with the building's internet down, which is the case a hosted-only product structurally cannot serve and the common case in a school hall.
• It announces itself on the network so a phone offers the laptop by name instead of being told an IP address — and it announces only because a person started it and did not ask for silence. A library that opens a multicast socket because it was imported is not consent.
• It keeps nothing by default. Rooms live in memory. A laptop quietly accumulating other people's answers into a file nobody knows about is a data-protection incident with a calendar attached.
• For a sensitive question — pay, restructuring, a union vote — this is the answer. There is no third party who could be asked for the data later, because there is no data anywhere else.

What it does under load

A claim about capacity that has not been run is a guess. One thousand simulated phones answering five questions each against a single relay: every answer acknowledged, every acknowledged answer counted, the slowest answer of five thousand at 40ms, and no snapshot at any point carrying another participant's identifier. That test runs against the shipped relay, not a special build, and it runs in the same suite as everything else.

Pictures, recordings and film

A picture that fails to draw fails in front of the candidate, who can see it has failed. A recording that fails to play fails silently, and a candidate cannot tell a broken clip from a clip of silence. That asymmetry drives every decision here.

• Checked at the door, not at question 34. An assessed sitting needing a format this machine cannot decode is refused before it starts, in a sentence naming the format and the reason. An open room is warned and runs.
• A "maybe" is not a "yes". Browsers answer the can-you-play question in three words rather than two, and flattening the middle one into yes is exactly how a paper is declared sittable on a machine that goes quiet halfway through.
• Sound as Opus, film as VP9, both in WebM. Royalty-free, and therefore actually present on the Linux desktops that will not decode H.264 or AAC for patent reasons — the same file that plays perfectly on Windows and Android plays silently there.
• MP3, AAC, WAV, H.264 and QuickTime are accepted and converted. AVI, WMV, WMA, HEVC, AV1 and FLAC are refused on the way in, each with the reason and what to convert it to.
• An SVG is a script execution context, so it is stripped on the way in and refused if it cannot be made safe. A conformance suite asserts the cleaner can never emit executable content — a test that is not allowed to be re-baselined.
• Play limits are enforced in the engine, so a listening paper that allows two plays allows two plays, rather than hiding a button.
• Media is content-addressed inside the pack and covered by the manifest's integrity map, so a swapped picture is a broken pack rather than a quiet substitution.

What an appeals panel reads

• Every event in an attempt is hashed into a chain, so one altered answer, one deleted pause or one reordered pair moves the head and is visible.
• The chain is over canonical bytes with a published format and a version string, so two implementations agree — and a change that would invalidate every attempt sealed so far cannot be made quietly.
• Sealed at submission with Ed25519, verifiable offline from a public key alone. No server, no account, and no permission from us.
• An unsealed attempt is reported as unsealed, never as tampered. Those are different findings, and only one of them is about a person.
• The report never accuses anybody. It states what the log shows and what that does and does not establish, in sentences a panel can read.

Lockdown, named honestly

Three levels, and each one ships the list of what it cannot do — on screen, before anybody relies on it.

• None — an ordinary window. Nothing is restricted.
• Focused — the paper fills the screen and stays in front, and time spent away from it is recorded. This removes accidents, not intent.
• Supervised — everything in Focused, plus asking the operating system to keep the paper out of screenshots, to report a second display, and to empty the clipboard. This raises the cost of cheating; it does not defeat a candidate who administers the machine.

The per-platform truth is printed rather than averaged: Windows excludes the window from capture; Android uses FLAG_SECURE and screen pinning, and says so when pinning is refused because the device has no management profile; a Linux desktop on Wayland is not permitted to suppress screenshots or inspect other windows, so Supervised there is Focused plus display detection, which the app states instead of quietly downgrading; and a browser tab cannot block screenshots, see other windows, or stop another application being opened — for a paper that needs those, install the app.

What this does not claim to be

A test centre is operations, not software, and a product that implies otherwise gets caught out. There is no camera proctoring, no identity verification, no biometric check-in, no network of invigilated seats, and no third-party proctor integration. What is here is the software half: a paper that arrived before the exam did and could not be read early, a clock that cannot be bought back, a sitting that refuses to start on a machine that cannot play it, and an attempt that can prove what it was.