Stratum sends a template every x seconds which may or may not have been switched to by the miner consuming the template. The only time a miner is guaranteed to have done that hard work reset is when the previous blockhash changed (otherwise you'd be mining an orphan.)

This is still somewhat under the pool's control since they can penalize miners who submit shares of stale templates.

So I think that censorship can only be determined by transactions that were known at the time of the previous block, must have been in the new template (assuming the pool is well-connected) and still not included in the published block found.

Mempool offers a short grace period so that recently broadcasted transactions will not penalize block health.