TEFS: REJECTED-RECORD NONINTERFERENCE IN TYPED HYBRID DOCUMENT QA

Hybrid document-QA runtimes select among records returned by readers, structural parsers, visual models, and symbolic operators. We identify a missing integrity boundary: a completed record that will later be rejected can still influence candidate-dependent computation and change which admissible record is ultimately selected. We formalize rejected-record noninterference (RNI) and characterize it through invariance of the selector-visible view to rejected records. TEFS enforces completed-record admissibility before this view is formed, preventing rejected candidates from affecting downstream features, rankings, or selector state. Natural replay and paired live-return experiments show that rejected records can alter admissible selections even when they are never selected themselves, while controlled return faults distinguish this boundary from call-time authorization and partial post-execution checks. Under its trusted-request and trusted-wrapper assumptions, TEFS guarantees contract-consistent participation rather than semantic correctness, contract inference, or deployment-wide fault prevalence.