CONFORMAL RISK CONTROL FOR CERTIFYING STREAMED GENERATION UNDER CONNECTIVITY LOSS

Conformal risk control certifies a threshold with a finite-sample guarantee, but only when the exchangeable unit is plentiful. We study it where the unit is scarce: a drive trace on a cellular network. A language-model reply streamed to a phone on a train is a sequential decision with a hidden hazard. The link can die before the last token arrives, and the serving stack learns of it last. Buffering cannot help, be- cause future tokens do not exist yet. Reacting costs a loss-detection timeout plus a fallback start. We build FORETOKEN, a runtime that admits a response only under a completion certificate. The reply must either finish inside a certified floor on the link’s remaining life, or hand off within that floor to an on-device drafter whose measured speculative-decoding acceptance rate clears a quality gate. The floor is a conformal-risk-control threshold over a grid of horizons with the trace as the exchangeable unit, so its realized per-second violation rate is bounded rather than assumed. On 21 public 5G traces (11.75 active hours, 2,830 replayed responses), FORETOKEN admits 96.7 % of launches with a response-level violation rate of 0.40 % against a 5% budget (trace-clustered 95% interval 0.18 to 0.69 %). It declines 92 launches, of which 92.4 % stall, and it holds p99 excess wait at 445 ms against 1,345 ms for a reactive hybrid. Three findings cut against our own premise. An RSRP-drop precursor covers 29.3 % of hard outages at a 19.5 % matched-control rate, and a learned ranker beats it at every false-alarm budget a phone would run. With 20 calibration traces the finite-sample term, not the hazard, decides what a 5% budget can certify: a one-second floor, eight seconds from 6%, and nothing at all below twenty traces. And when the budget sits at the hazard’s own scale, calibrated-probability thresholds exceed it on up to 14 of 21 test traces while the conformal floor declines to certify. A completion guarantee does not need the outage to be predictable. It needs the hazard on the seconds it admits to be measured, bounded, and paid for.