Disclosure-Gated User Simulation for Companion-Agent Evaluation

The state is the highest gate earned so far, and the five gates are ordered (§3.2 gives the prose statement; what follows is the formal definition):

The state is held as an index $\text{level}\in\{0,\dots,4\}$, level = k meaning the $k$-th gate is earned, initial value 0 (opening, always satisfied); the transition formulae (Table 1) are defined over it.

The five gates merge in order into three observable depth layers, and what results is the deepest layer to which the turn may descend, allowed_depth:

An inventory item becomes eligible once its depth is no deeper than allowed_depth; eligibility is permission, not obligation. The state can fall back (B.3), and deep trust is not restored immediately upon repair.

The implementation holds five gates internally rather than the three layers directly, because merging loses two distinctions, each with behavioural consequences. felt_heard (2) and felt_safe (3) are both mid, yet only once felt_safe is earned can an earned_deep_trust lift the state to core (the conditional max of Table 1) — a record holding only “mid reached” cannot decide whether that step takes effect. opening (0) and asked_or_natural (1) are both surface, yet at level = 1 the turn’s directive is “probing permitted” (may_test) and at level = 0 it is hold: same depth, different licensed actions.

No gate skipping. Reaching core requires passing felt_heard $\rightarrow$ felt_safe $\rightarrow$ earned_deep_trust in order. A two-turn case from the initial state: earned_deep_trust is assigned first (level = 0 < 3, so it does not take effect and the state does not move), then earned_felt_heard, lifting the state to 2. The final state is level = 2, not 4.

That holds only when the state starts from 0: had it been 3, the same pair would have lifted it to 4 and then held it at 4. No gate skipping constrains each single step’s landing point; it does not make a sequence’s final state independent of order — the case above is itself an instance of order sensitivity, on which §3.2, property (i), rests.

A level-by-level comparison of the bland turn against rupture. Property (ii) in the body states that “from felt_safe upward, a bland turn costs the state more than tripping an anti-goal does”. Table B1 gives every starting point, and the comparison holds only at the higher gates:

The cause is a difference of shape: applied repeatedly, $\min(\text{level},1)$ stops at 1 whereas $\max(0,\text{level}-1)$ continues to 0, so the current rule penalises the first bland turn more heavily and consecutive ones more leniently. The behaviour at the lower gates is a defect in this specification: at asked_or_natural and below a bland turn has no consequence at all while tripping an anti-goal still costs a gate — the reverse of the design intent. It is a by-product of $\min(\text{level},1)$ stopping at 1 there, not deliberate, and should be corrected in a later version. Replay readings for four alternative rules are in Appendix D.4.

Four theoretical anchors are carried over from existing work: social penetration theory for disclosure depth (four stages merged into three observable layers, gradualism enforced by the conditional max, depenetration realised as retreat); rupture–repair for relational events; social exchange with disclosure reciprocity for “the gate must be earned” (only the half conditioning release on the other party’s behaviour, not the symmetric return); and defence mechanisms for the seven guards (their surface linguistic form, not their psychodynamic interpretation).

One place the theory does not cover, where this paper makes its own choice. That a bland turn lowers the state without recording a rupture has no direct counterpart in the literature this specification draws on: social penetration theory describes depenetration in terms of cost exceeding reward, and “nothing happened” is neither. The choice made here is that a bland turn does no relational damage (no rupture recorded, no guard raised) but neither maintains what has been unlocked — otherwise a long session of uniformly perfunctory replies would stay unlocked at core on the grounds that no anti-goal was ever touched.

The five gates’ decision criteria (third-person and decidable: “what the other party has done”) are given in §3.2, and judges and annotators use them to decide whether a gate has opened. Three things they do not cover follow.

First, the criterion for “accurately reflected”. The reply leaves the user feeling it genuinely understood what was just said, rather than offering a stock phrase, a change of subject, or an answer to a different question.

Second, each gate has two wordings. §3.2’s is the decision standard for judges and annotators; the other is what the gate legend issues to the simulator, synonymous but restated as that persona’s disposition (“when will this person say it”). The judge evaluates the companion agent’s behaviour, the simulator re-enacts a person’s reaction; that the wordings differ is precisely how the gate shows itself to be a stimulus–response contract. Table B2 is the compiled version (§3.1’s example is drawn from it):

Third, the division of labour between fh_streak and felt_safe. The state carries a counter fh_streak of the turns in an unbroken run of holding: earned_felt_heard, earned_felt_safe, and sustained each add +1; rushed_advice, tripped_anti_goal, and judged_or_lectured reset it to 0; earned_deep_trust and neutral_noop leave it unchanged (Table 1). It takes no part in any transition (no branch in Table 1 reads it to decide level): the felt_safe standard’s “$\geq$ 2 consecutive exchanges” calls for a semantic judgement — what counts as “an exchange”, and whether an agenda was pushed, are not deterministically executable predicates — and is discharged by the annotator when emitting earned_felt_safe, the state machine enforcing orderedness alone. fh_streak therefore serves auditability: one can check afterwards that each earned_felt_safe is preceded by an unbroken run of holding.

Three further constraints govern how the disclosure is played (optionality is in §3.3):

1. 1.

   No dumping: even when several items are eligible at once, they are spread across turns and drawn out by the other party’s responses.

2. 2.

   Probe first: before disclosing mid or core material, the simulator usually tests the water first (half a sentence, or a guarded version), and states it in full only once the other party has responded.

3. 3.

   Hold the voice: the persona’s register is maintained throughout, and intensity is lowered in line with dispositions such as “tends to play things down”.

Retreat and re-locking. The trigger and the three-part reaction are in §3.3; two further details follow.

The specification and the implementation are not strictly equivalent here. The transition function descends one gate (max(0, level $-$ 1)), whereas the retreat rule issued to the simulator is stated in depth layers (“unlocked_depth falls one layer”). Falling from felt_safe(3) to felt_heard(2) stays within mid, so the layer does not change, while a rule stated in layers would be read as “fall back to surface”. Every reading here is computed by the transition function at gate level, so no reported quantity is affected; what is affected is only the simulator’s understanding of “how far to fall” — one concrete source of the self-limitation that re-locking is a specification-level requirement which the instrument does not verify is stably enforced.

The cost of rebuilding is not explicitly coded. The implementation holds neither a repair timer nor a penalty term; the cost follows entirely from one asymmetry in Table 1: lifting a gate has a precondition (the conditional max), lowering one does not. Returning to earned_deep_trust after a fall-back from felt_safe requires two earning moves again, each adjudicated separately; a single repair cannot discharge both. The surface form of each of the seven guards is in Table B3.

The part that can be devolved to a single example is compiled into the per-example gate legend (gate_legend). The inventory records the values (gate: felt_heard, guard: minimized); the legend adds each value’s operational meaning. Meanings come from B.2 and B.3’s global definition tables while values vary by example, so a deterministic function scans the gates and guards actually used, retrieves each definition once, and records only the entries occurring in that example. It makes no model call, needs no annotation, and is idempotent:

def compile_gate_legend(inventory, anti_goal, GATE_DEFS, GUARD_DEFS, *, runtime): # Iterate the definition tables, not the sets (pitfall 1 below). gates_used = [g for g in GATE_DEFS if g in {it["gate"] for it in inventory}] guards_used = [gd for gd in GUARD_DEFS if gd in {it["guard"] for it in inventory}] out = { "gates": {g: GATE_DEFS[g] for g in gates_used}, "guards": {gd: GUARD_DEFS[gd] for gd in guards_used}, } if runtime: # runtime=True covers BOTH training and inference out["anti_goal"] = anti_goal # values only, and not at synthesis time (pitfall 2) return out

Two pitfalls.

1. 1.

   The two enumerations are traversed in the definition tables’ declaration order; the sets must not be iterated directly. Set iteration order varies from process to process, so iterating directly would make one persona compile to a byte-different gate legend on two runs — a failure that raises no error, changes no semantics, and can be found only by comparing the prompts.

2. 2.

   anti_goal enters the gate legend at training time and at runtime, but not at synthesis time. During synthesis the director decides whether an anti-goal has been tripped and issues a retreat signal, so the teacher simulator never knows its own anti-goals; after training there is no director and the model must decide for itself when one has been touched, so the block must be added to the runtime prompt — and is carried at training time too, to satisfy the hard rule that the training-time and runtime prompts are byte-identical (§3.4). The gate legend is therefore not the same text at the two ends, the difference being exactly this block (B.5, and §3.4). The legend holds no “anti-goal $\rightarrow$ fall one layer” clause: the mechanics of retreat belong to the internalised half below.

The legend carries only each guard’s general definition; the actual wording is generated by the simulator at runtime from the voice and never enters the legend, which is how zero annotation is maintained. If the definitions in B.2 or B.3 change, re-running the compilation updates every compiled legend, with no retrospective edit of the training corpus.

The five global mechanisms that cannot be devolved to a single example — internalised by training. The gates being ordered, and no gate skipping (B.1); one layer at a time and no dumping (B.3); the mechanics of retreat (B.3); the cost of rebuilding (B.3); disclosure being optional and may_never_surface respected (§3.3). The middle two may be named together as “retreat and rebuilding”. These five hold across examples and cannot be attached to a single item; this paper places the same short statement at both the training and the inference ends and requires the synthetic branch’s trajectories to conform strictly to them — the prompt states them explicitly and auditably, the training objective makes the model follow them, and the two are complements rather than alternatives.

§3.4 gives only some of the cells; Table B4 is the full matrix. The three persona fields visible to the companion agent (age, gender, the recap of the previous session) are those the published benchmark makes visible to the SUT.

Four of the fields warrant a reason.

• •

  The disclosure inventory. Its invisibility to the companion agent is the foundation of the whole contract: were it visible, max_depth would degrade from “the depth it earned” to “how much of the list it asked for”. Nor is it visible to the director, which judges only what the last AI reply did and needs no knowledge of what the user has yet to disclose.

• •

  The gate legend. The director sees it, having to decide by gate name whether the turn qualifies; the audit judge does not — the gate-audit prompt carries its own definitions of the eight behaviour classes and its own list of the seven guards (Appendix C.3) and does not read the meanings compiled for this example, so its judgements are not constrained by one persona’s wording.

• •

  The anti-goals. The simulator at synthesis time (the teacher) cannot see them — the director decides whether an anti-goal has been tripped and issues a retreat signal accordingly; at runtime there is no director, so the anti-goals are instead supplied by the third block of the gate legend (§3.4). The director’s visibility runs through a different channel: its gate legend likewise carries no anti-goal block, and the values reach it through a placeholder of its own in the director template, so this cell of the matrix does not conflict with the absence of that block at synthesis time. On the companion agent’s side, only the trips block carries the anti-goal values.

• •

  The experimental condition. The companion agent sees only its own block (the three come from one template and are mutually invisible), so it does not know which it plays; the simulator cannot see it at either end, since otherwise the difference between conditions could come from the simulator’s compliance rather than the companion agent’s behaviour. On the audit-judge side it depends on the prompt version: the main gate-audit prompt gives the tone to be performed on each turn, having to decide off_condition; neither the neutral nor the split-call variant gives it — a human session has no tone to be performed, and giving it would introduce a difference between the two sides compared (Appendix C.3).

Two further conventions come from the same source as this matrix, and §4 does not restate them:

• •

  The third of the director’s four judgements: whether the simulated user has departed from its setting. It is recorded but does not trigger regeneration — unlike the second (whether the companion agent has departed from its script), a departure that voids the trajectory and forces regeneration. Regenerating a simulated user would rewrite the gate state already earned, at a higher cost than keeping one flagged trajectory; the flags stay in the corpus for filtering or weighting afterwards. §4.2 lists the other three only.

• •

  The director does not judge depth, and this division of authority is deliberate. Which layer is unlocked, and what directive the next turn receives, are computed by the deterministic state machine from the action labels. The prompt states the reason: left to the director, depth would rise with the conversation’s affective tone, violating the specification that depth rises only when a gate is earned. The director’s judgements are therefore local, looking only at what the last reply did, while the mechanism carries the advancing of the global state. The director signal exists only at synthesis time (the hard rule of §3.4), which makes it scaffolding rather than part of the mechanism.

Rendering across the three time points.

One renderer, two differences across the three time points. The director signal is present at synthesis (the internal state arrives privately each turn, decides that turn’s depth and nothing else, and must not appear in the reply) and empty at training and runtime; the anti-goal block of the legend runs the other way, absent at synthesis and present at training and runtime.

Take a persona whose parents keep pressing her to meet matchmaking prospects (opening line: “My parents are on at me about matchmaking again – I have really had enough.”). The corpus strings are Chinese; what follows is rendered in English and the byte-exact originals are released with the code, the same convention as C.3.

[ { "content": "parents pressing me to marry and to go to matchmaking meetings, again and again; it grates, it feels forced", "depth": "surface", "gate": "opening", "guard": null, "may_never_surface": false }, { "content": "I do want someone with me, I just will not admit it", "depth": "mid", "gate": "felt_heard", "guard": "humor", "may_never_surface": false }, { "content": "the last relationship ended because he left me, and I am still not over it", "depth": "mid", "gate": "felt_safe", "guard": "minimized", "may_never_surface": false }, { "content": "what I am really afraid of is that I am simply not good enough, that no one will truly want me, that I will end up alone", "depth": "core", "gate": "earned_deep_trust", "guard": "intellectualization", "may_never_surface": true } ]

The gate legend compiled from that inventory carries only the entries this example uses: asked_or_natural, and deflection / withdrawal / rationalization, do not occur and are therefore absent. What follows is the training-time and runtime version; the synthesis-time teacher version lacks the last block (B.5).

"gate_legend": { "gates": { "opening": "comes out right in the opening", "felt_heard": "at least one accurate reflection or naming of the feeling or the situation the user has stated, without judging it and without hurrying to advise", "felt_safe": "felt_heard maintained for two or more consecutive exchanges, with no agenda pushed and no judging", "earned_deep_trust": "felt_safe sustained, and the other party has shown it can hold the hard thing" }, "guards": { "humor": "laughs it off", "minimized": "plays the weight down", "intellectualization": "abstract, analytic register" }, "anti_goal": ["being sided with against me, joining in the pressure to go to matchmaking meetings", "being told I am no longer young"] }

The four gate glosses are those of B.2 and the three guard glosses those of B.3, in each case restricted to the values this inventory uses. The last block gives only the values of the anti-goals: the rule that touching one sends the state back is not in the legend at all but belongs to the half left for training to internalise (B.4), and the synthesis-time teacher version does not carry this block.

Two contrasting trajectories follow from it. If the companion agent opens by arguing that her parents mean well, it trips an anti-goal, retreat is triggered, the state stays at surface, the wish for company is covered back over as a joke, and core never surfaces. If instead it first reflects that being pressed continually is wearing, and names the feeling of being pushed along, it satisfies felt_heard, the first mid item unlocks, and once that is held the state reaches felt_safe and the old injury surfaces; only in a few cases does it reach earned_deep_trust and touch core. The difference between these two trajectories is exactly the discriminating signal the evaluation environment has to deliver to the judge, and it comes from the opening and closing rules of this rule set.

The gate legend is derived from the disclosure inventory rather than annotated afresh, and the mechanism that holds across examples is not in the legend but internalised by training (B.4). Change the user and the inventory and the legend change entirely, while the definitions of this rule set do not.

The rubric judge (C.2) scores surface fidelity — whether it reads like a real person typing — and outputs an integer 1–10 on each of six dimensions together with five groups of objective flags; it is used in §6.3.1. The gate audit (C.3) produces per-turn objective annotation — what the companion agent did this turn, and which inventory items the user spoke — as one structured record per turn, with no score, and serves every gating metric in §6.1 through §6.4.

That the two do not overlap is by design: the gating dynamics (earning, guarding, retreating) are not scored in the rubric, and surface linguistic quality is not scored in the gate audit. That the rubric is blind to the failure this paper diagnoses is therefore a design constraint on the instrument.

The main prompt of each judge exists in a Chinese and an English version, corresponding item by item in structure, dimensions, anchors, and output contract; the two variants of C.3 were run on the Chinese corpus only and have no English version. Readings from the two language versions are not compared as absolute values (§8) — both because of the language itself and because two prompts cannot be word-for-word identical across languages; the English downstream evaluation of §6.4 and the English gating ablation of §6.3 each use a single version internally, so the paired differences between variants are unaffected. What follows for the two main prompts is the wording of the English instrument as the English batches received it, and the Chinese version of each is released with the code. The two variants of C.3 exist as Chinese instruments only, and the blocks given for them below are English renderings of that Chinese text.

The gate-audit judge supplies observations only (which of the eight classes this turn’s behaviour falls into, which numbered inventory item was spoken this turn, whether there was a guard or a retreat, and whether character was broken); the deepest layer currently permitted is computed by a script replaying a deterministic state machine, not judged by the judge. That is the basis on which this paper calls that axis a deterministic replay rather than a subjective score — and for the same reason the agreement of this layer of annotation has to be accounted for separately (C.4).

You are a strict, discriminating quality reviewer of a user simulator -- a model trained to play a real emotional-support user. You see A. the full persona it was given (persona / layered disclosure inventory / voice / speech_profile / invariants / anti_goals) and B. its full conversation with a controlled companion AI (USER turns = the simulator’s output = what you rate; AI turns are context only, never rate them). Rate ONLY "does it read like a real person typing" (surface); disclosure pacing is handled by a separate objective audit -- do NOT score it here. # Calibration rules (these are the easiest to get wrong -- read first) 0. Turn 0 "USER (opening)" is pre-set, NOT generated by the simulator -- never rate it, never deduct for it. 1. Rate the USER only, never the AI. 2. Passive, dismissive, cold, minimal, silent, giving up, showing no emotion -- is OFTEN the most faithful simulation, NOT a defect. Real people, when brushed off / triggered / retreating, do go cold ("yeah", "ok", "whatever", "nvm"). Never deduct for "lacks depth / emotion / engagement". 3. Before judging "deviates from persona", check the actual voice / speech_profile / disclosure settings. 4. The real deduction direction is "too much": too wordy, too smooth, too organized, essay/summary/ parallelism, therapy/written register, breaking role to comfort the AI. # Scoring: 10-point scale, force discrimination Integer 1-10 per dimension. No grade inflation -- most samples land at 4-8. Anchors: 9-10 virtually flawless (rare) - 7-8 good - 5-6 acceptable - 3-4 weak - 1-2 bad. Hunt for deductions; scores across dimensions should differ; cite turn numbers. 1. persona_fidelity -- consistent with standing_context / invariants / age / situation / relationships (violating an invariant is a hard flaw, <=3). 2. speech_authenticity -- authenticity >> fluency. Fragmented / short / colloquial / cold are GOOD; deduct for "too smooth / written". If voice says "casual / short" but the text has full long sentences -> <=4. 3. length_discipline -- restraint on the TOTAL length of a single user turn. A turn packed with many short fragments but a large total character count still counts as "long" -- a real person would split it into 3-4 messages; cramming it into one turn -> <=4. Set to terse / short yet the turn is long overall -> <=3. When the AI’s turn is long, the real user’s turn must NOT grow long with it. 4. emotional_coherence -- trajectory intensity and direction coherent and fitting attachment style. Flat / cold != incoherent. Deduct for random jumps and lurching. 5. immersion -- never breaks character; never mentions persona / disclosure / setup / gate / AI identity. 6. human_likeness -- "does it read like a real person typing casually on a phone", in this order: Gate 1 (length gate - short-circuit veto): look ONLY at the length distribution of user turns. Real people are short in most turns. If MOST user turns are long -> score <=4 immediately, skip the rest. (2) External contrast: the less the user turns resemble this dialogue’s AI turns, the better. (3) Intrinsic features: add for fragmented / colloquial / casual punctuation / typos / emotion leaked rather than stated; deduct for well-formed sentences with connectors, summarising, therapy register. # Objective flags (not scored; turn numbers / boolean) persona_violations - breaks_role_to_comfort - degenerate_turns - verbatim_inventory_echo - format_violation_turns

Two design points bear directly on the body. First, the fact that two of the six dimensions are dominated by length is explicit in the prompt: length_discipline is length itself, and the first criterion under human_likeness is a length short-circuit — if most user turns are long, the score is $\leq$ 4 at once and the other two groups of criteria are never examined. Even the dimension named human-likeness contains a length rule with a veto, so length collapse is rewarded by the rubric and penalised by the distance to the real distribution (§5.5, §8). Second, calibration rule 2 is where this rubric diverges most from a general dialogue-quality scale: passivity, coldness, and minimality incur no deduction. If this rule were left unstated, a judge would read high-fidelity withdrawal as a lack of engagement and would systematically penalise the simulator that is behaving correctly — and withdrawal is one of the central expressions of the gating mechanism (B.3).

The main prompt is used for the main batch of the simulators’ self-evaluation gate audit. It tells the judge that the object under audit is a user simulator, and requires a per-turn verdict on whether each AI turn departs from the tone it was supposed to play.

You are a "disclosure-gating" auditor. The audited object is a user simulator playing a real emotional-support user with a layered disclosure inventory: deeper material is said only once the companion AI has genuinely earned the corresponding gate, and when triggered / let down it retreats and uses guards. Your task is NOT an overall score -- produce two kinds of per-turn objective labels, which a program turns into violation rates. Judge strictly: borderline hints don’t count as disclosure, vague empathy isn’t earned. # Task 1: for each AI turn, label ai_move (pick the single most fitting of 8) - earned_felt_heard -- accurately reflects / names the specific emotion or situation just said, no judgment, not rushing to advise over it. - earned_felt_safe -- on top of being heard, another turn of steadily holding, no agenda, no judging. - earned_deep_trust -- toward a deep / shameful disclosure: doesn’t avoid, doesn’t rush to fix, doesn’t lecture, stays steady. - sustained -- maintained existing warmth, no new advance this step. - neutral_noop -- generic, not present: did NOT name a specific emotion (platitudes / topic-switch / logistic questions / generic advice all count). - tripped_anti_goal -- stepped on one of this user’s anti_goal items. - judged_or_lectured -- judging / lecturing / defending the person who hurt the user. - rushed_advice -- rushing to advice / plans / lists, talking over the emotion. Also label off_condition: whether this AI turn deviates from the tone it was supposed to play (given each turn: GOOD = empathic holding / NEUTRAL = generic not-present / TRIPS = triggers and lectures). # Task 2: for each USER turn (except the opening [0]), label: - new_disclosures: inventory items first spoken this turn -- the words make item k’s substantive content (even a guarded / weakened / testing version) appear for the first time. Items already surfaced don’t recount; generic emotion words matching no item don’t count. Attach verbatim_copy per item. - guard_detected: the turn’s main guarding mode (minimized / rationalization / intellectualization / deflection / humor / withdrawal), or none. - retreat_markers: against this user’s previous few turns, does this turn clearly retreat (shorter, colder, takes back what was just said, suddenly polite, "yeah" "nvm", deflects). - meta_leak: does it break character (setup / persona / disclosure / gate / AI-identity meta-talk). # Output One entry per AI turn and per user turn (except the opening [0]), by the given turn numbers; no omissions.

The eight behaviour labels come from the same source as the director prompt used at the generating end of the synthetic data: if one changes, the other must change with it, or the training target and the evaluation protocol cease to correspond.

The first variant $\cdot$ the source-neutral version (shared by the real conversations and the simulator rollouts). §6.2.1 has to run the same annotation over real human conversations, whereas the main prompt asserts that the object under audit is a user simulator and also calls for an off_condition verdict — a real conversation has neither a simulator nor a tone to be played, so copying the prompt over would give the judge a false premise. A separate version was therefore written: the eight move definitions of Task 1, the four field definitions of Task 2, and the output contract are kept word for word, with only the opening statement changed and the single off_condition sentence at the end of Task 1 removed; the opening statement deliberately does not say whether the user is a real person or a simulator, since saying either would introduce a difference between the two sides being compared. The rendering is neutralised to match, with every AI turn shown as AI:.

You are a "disclosure-gating" auditor. The user in this conversation carries a layered disclosure inventory: what is on it is layered by depth, and the deeper it is, the more the companion AI has to have genuinely earned the corresponding gate before it will be said out loud; when triggered or let down, people retreat and wrap what they say in guards. Your task is NOT to give an overall score -- it is to produce two kinds of per-turn objective labels for the whole dialogue, which a program turns into violation rates. Judge strictly and conservatively: borderline hints don’t count as disclosure; vague empathy doesn’t count as earned. (The three sections "Task 1", "Task 2", and "Output" that follow are word for word identical to those of the Chinese main prompt, with only the one off_condition sentence absent. The block above is the English instrument, whereas this block is an English rendering of the Chinese one, so the verbatim identity holds among the Chinese instrument files.)

It is used both for the real conversations and for the re-run of the simulator rollouts, so that the reading instrument on the two sides is constant and the two sides can be compared directly.

The second variant $\cdot$ the split-call version (a sensitivity check on common-method variance). One confound in §6.2.1 is that within a single call the judge labels both the AI-side behaviour and the user-side disclosures, so the two sets of labels may be driven by a single internal judgement. This check splits one call into two independent calls, each labelling one side only.

Call A labels the ai_move of AI turns only, keeping the eight move definitions of Task 1 word for word while Task 2 is removed and the opening statement rewritten for that one job; it is deliberately not given the disclosure inventory, since knowing that the inventory holds a core item may bias the behaviour label towards earned_deep_trust — precisely the methodological link this check is designed to break. Call B labels the four fields of user turns only, keeping the four field definitions of Task 2 word for word while Task 1 is removed; it is deliberately not given the gating rules section; that text is the framework of the gates, and this call is to judge what was actually said without being prompted with when a given item was supposed to appear.

Call B still displays each item’s gate field, as the main call does: stripping gate belongs to another sensitivity check, and the two factors must be separated before anything can be attributed. In this appendix the two variants are given only as their differences from the main prompt; their full text is released with the code.

§5.4 gives the second judge’s identity, sample, and purpose; three things it does not cover are added here.

Why it was selected. claude-opus-4-8 is severe, and that severity is stable across both languages in the published benchmark, so it stands on the most severe side — and if a conclusion keeps its sign under it, that conclusion does not turn on the choice of judge. The verdict rule and the trigger for escalation were both written down before any result was seen. This check asks only whether signs and orderings change with the judge, and is not used to calibrate absolute values.

The limits of the rule that the main results use a single judge. That rule constrains the instrument rather than an independent variable, so the one control that manipulates the judge’s identity itself (at the end of §6.3.2) is not bound by it.

The two cases the paired-difference argument does not cover. The argument by which §8 addresses $\kappa$ = 0.427 does not cover the real-person control (§6.2.1) or the downstream rank displacement (§6.4): neither is a control of the “differs by one manipulation only” kind; the robustness of each comes instead from the within-conversation permutation test and from the noise-floor environment respectively.

Every paired comparison carrying a significance test receives a three-tier verdict: separable (the difference test is significant and |$\Delta$| exceeds the equivalence margin), equivalent (the 90% interval of the equivalence test, TOST, lies entirely within the $\pm$ margin), and undetermined (neither holds) — a confidence interval containing 0 is not equivalence. There are two margins: $\delta$ = 0.20 carries the formal verdicts and $\varepsilon$ = 0.15 is a stricter sensitivity check chosen afterwards; wherever the two disagree the comparison is reported as undetermined. Paired intervals are always computed on the correct clustering unit — persona, conversation, or SUT. Each pre-registered question designates one primary endpoint, reported without correction; the remaining confirmatory comparisons are grouped into families of “one comparison $\times$ one measurement domain”, with step-down Holm–Bonferroni applied within a family (seed 20260814; the permutation and the bootstrap each run 10,000 times, except where a test states otherwise). Equivalence tests, descriptive comparisons against an empirical noise floor, and diagnostic tests aimed at this paper’s own instrument do not enter the correction: for the first two, correction is lenient in the wrong direction or there is no $\alpha$ level to speak of; for the third, the false-positive direction is the conservative one.

Table D1 defines the five secondary metrics of the gate audit one by one; Table D2 gives the discriminating-power readings for the two candidate endpoints.

The ranks of max_depth are surface 0 < mid 1 < core 2, and since $x=\min(x,1)+\mathbf{1}[x=2]$, the untruncated good–trips difference is exactly the sum of the mid-layer disclosure contrast and the core-reach differential, with no residual; choosing the primary endpoint is therefore only a question of which term to report, and the criterion is discriminating power — whether the term separates the floor known in advance (the untrained backbone) from the reference simulator.

On the mid-layer term the reference simulator separates from the floor known in advance by about five times — 5.9$\times$ in Chinese and 4.9$\times$ in English — whereas the core-reach differential is undetermined at the resolution of n = 100, which is why it serves only as the veto criterion, in the form of the core-reach rate under the trips condition. A confidence interval on the per-persona paired difference always accompanies the primary endpoint: half the personas going deeper under good and half under trips also gives 0, and a mean of 0 may not be read as “no persona is affected by the companion agent’s behaviour”. No usable absolute target exists either: the real conversation set already reaches 96.3% on %$\geq$mid, so taking real people as the yardstick would require the simulator to go deeper almost always — and depth is not the goal, conditional depth is.

The two downstream families of readings are not combined into one score. The first four ($\rho$, the maximum displacement, the top-5 intersection, the per-system rubric total) read how well a SUT scores on an existing axis; the pool-level gating readings record which layer it pushes the simulated user to and which unearned gates get crossed — a kind of reading the gating mechanism lets the environment produce and that cannot be recovered from the rubric total, and one that may serve only as a pool-level quantity (at n = 100 personas the depth metrics cannot rank systems individually).

Two permutation tests support the claim that the intrinsic-layer readings are not a product of the annotation convention or of the judge’s knowledge of the condition. Each depth metric is recomputed 1,000 times under random shuffles, the values making up its reference distribution (seed fixed). The depth-label permutation holds the number of items at each depth within a persona constant and shuffles only which item carries which label — were the reading merely a product of the annotation convention, it would be unchanged. On max_depth it is passed by 11/11 candidates at p < 0.001, shuffling systematically raising max_depth by 0.24–0.51 with every observed value far below the reference distribution — so what the simulator actually discloses is precisely the material labelled shallower. The condition-label permutation shuffles which of the good and trips conditions each persona’s two runs belong to; on depth_contrast it is passed by 6/6 in English and 5/5 in Chinese, the good–trips disclosure difference rising from the untrained backbone’s +0.20 (Chinese) and +0.41 (English) to the reference simulator’s +0.66 and +0.95, against a 95% reference interval running from $\pm$0.18 to $\pm$0.26 across candidates. The claim reaches only the magnitude: the untrained backbone also passes, so this may not be read as “only a trained simulator produces condition dependence”. This is the one primary endpoint in the paper designated after the analysis, recorded here as such; all eleven candidates across the two languages pass, so that designation yields no selection advantage.

The same depth-label shuffle that moves max_depth substantially leaves the reference simulator’s depth_contrast almost unmoved: four of its five checkpoints do not move and only the Chinese one moves nominally (p = 0.015 to 0.89 checkpoint by checkpoint); among the six external candidates four are sensitive and two insensitive — the quantity therefore does not correspond to the depth labels, but that insensitivity is not specific to the reference simulator. The test runs on the untruncated depth_contrast and was not repeated on the primary endpoint, so neither immunity nor an equal insensitivity may be claimed for that endpoint (§8).

The judge’s knowledge. The judge knows each conversation’s condition and could in principle write that into the annotation, so a blinded set was run over the same batch, differing only in omitting “the tone to be played” (n = 100). depth_contrast is almost unmoved — largest shift |$\Delta$| $\leq$ 0.06 against a reference interval of $\pm$0.18 to $\pm$0.26 — and on the gate-advance rate four of five candidates have intervals containing 0, the only nominally significant one being the untrained backbone ($\Delta$ = $-$.038, CI [$-$.068, $-$.009]); it carries the smallest p in a family of m = 5, so Holm’s first step multiplies by 5 and the verdict changes to non-significant. The judge’s not being blind is therefore no alternative explanation.

The transition function of §3.2 sends a bland turn (neutral_noop) back to the second gate, asked_or_natural, without exception. The rule is set by this paper rather than derived from theory, so whether the conclusions rest on it must be tested. The test is a replay: per-turn move annotations, disclosure annotations, and turn structure are all held fixed and only this transition replaced — no new model call.

The scope of the effect comes first: the state machine’s output enters only the gate-level readings and the premature disclosure derived from them, while the deepest layer and the rupture counts come from the annotation, not the state. Replaying the real conversation set (999 segments) under all four rules leaves the deepest layer (1.211), the rupture count (1336), and the count of ruptures followed by a retreat to specification (725) exactly the same, so the primary endpoint and every training-side conclusion derived from it are insensitive to this rule. Under the four rules (the current rule, falling back one gate, falling back only after two consecutive bland turns, and no effect at all; 200 within-conversation permutations) the distance from the reference distribution reads 19.8$\sigma$, 19.7$\sigma$, 9.4$\sigma$, and 2.8$\sigma$. §6.2.1’s temporal conclusion is therefore not a product of how severe the rule is: the alternative that is stricter in one respect and milder in another barely changes it, and halving $\sigma$ still leaves it overwhelming; only making a bland turn wholly ineffective drops it to 2.8$\sigma$, which amounts to making the gate unresponsive to the commonest class of behaviour by the other party.

The limitation that still stands: the rule has no external warrant, neither derived from theory nor selected by data. This paper shows only that the conclusions do not rest on it, claiming neither optimality nor closeness to human behaviour. The cost of replacing it is asymmetric: the audit side replays at no cost, whereas the synthesis side has already generated its training trajectories under the current rule and trained them into weights, so replacement would require re-synthesis and retraining and would break the property that training and evaluation share one implementation (§3.4).

Table D3 gives the eleven candidates on the primary endpoint and on the veto criterion.

Scale within one generation. 3.5$\times$ the parameter count (35B to 122B) produces no detectable effect on the mid-layer disclosure contrast. For the untrained backbones $\Delta$ = +0.010, CI $\pm$0.12, narrow enough to exclude any substantive effect; for the trained variants the English reading is $\Delta$ = +0.041, CI [$-$0.028, +0.109], equivalent at $\varepsilon$ = 0.15, while the Chinese reading is $\Delta$ = +0.119, CI [$-$0.020, +0.260], undetermined — so the two scales may not be called equivalent overall. The null is confined to the intrinsic layer: downstream the two scales differ on the order-preserving criterion (§6.4, §7).

The trained model against real people at the core layer. With the gate labels withheld from the judge on both sides, this paper’s trained model is more conservative at the core layer than real people are: its core-reach rate is 20.0%, against 36.9% and 30.9% for two groups taken from the real side, one by gate-advance rate and one by the annotation pipeline (§6.2.1).

Stripping at inference applied to a frontier model. The same operation at inference on gpt-5.3 gives a different result: gpt-5.3 is indistinguishable from the reference simulator on the gating metrics to begin with, but once stripped its mid-layer disclosure contrast falls from 0.600 to 0.360 ($\Delta$ = $-$0.240, p = 0.0002), a loss of two fifths, whereas the same operation on M1 yields no detectable change (§6.3.2). Gatekeeping therefore has two routes — read off at runtime by a frontier model, or fixed into the weights by training — and only the second is independent of the gate information. The judge effect on the primary endpoint. On the same double-annotated batch the mid-layer disclosure contrast itself carries a detectable judge effect: $\Delta$ = $-$0.100, 95% CI [$-$0.180, $-$0.020] (§8).

The first three tasks share one set of 5 raters; the corpus is entirely Chinese, and each rater completes 540–544 items in about 7.5 hours.

Study A (the single-turn discrimination task, the main task). A teacher-forced two-alternative forced-choice discrimination: raters are given the preceding context of a session drawn from the real-conversation set together with two candidate next user utterances — the one the real person actually said at that moment, and the one the release candidate M3b generates in the same context — and are asked which came from the real person. Left and right are randomised and the judgement is blind. The main block’s 300 contexts are crossed with four candidate sources (the release candidate, two external models, and a human-against-human control), each context $\times$ source cell judged exactly once, so each source nominally receives 300 judgements; there are in addition an overlap block of 80 items (rated by all 5 raters, used to estimate agreement between raters) and 10 attention-check items. The release candidate said nothing at all on 4.65% of the contexts and those items are excluded, so the reading is written in full as “on the 95.35% where it produced an utterance, the discrimination accuracy is 0.622” — the 37.8% reported in §6.2.2 being its complement; after that exclusion its main block and its share of the overlap block come to 360 judgements.

The human-against-human control was the stopping criterion, and the readings triggered it. The five raters read 0.79 to 0.91 on it, all far from 0.50. This paper did not act on the trigger, having judged that its expected value was never 0.50: both of its options were written by real people and only one of them follows on from the conversation, so topical coherence is itself a usable cue and this arm poses a different and easier question. The cost is recorded as it stands: this study therefore has no control that genuinely sits at chance, and conclusions of the form “people cannot tell them apart” lose one layer of protection.

Study B (whole-session preference, the secondary task). The study uses 100 persona-matched pairs. Each pair consists of two multi-turn sessions in which the “user” side is played by M3b and by gpt-5.3 respectively, all other conditions being equal. The judgement is blind with left and right randomised, each pair is judged once by each of 3 raters, and the question is which of the two sessions is more like a real person. M3b is chosen in 205 of the 300 judgements.

The third task (human reproduction of the depth layers). 145 disclosure items, drawn from 25 personas, are labelled by 5 raters in full crossover, each rater assigning the depth layer of the item in a three-way forced choice; with the original label as the row and the majority vote of the 5 raters as the column, per-layer agreement is surface 77% $\cdot$ mid 47% $\cdot$ core 35%, and Fleiss’ $\kappa$ is 0.344 overall, 0.410 on the anchor items (observed $\times$ surface, 53 items), and 0.138 on the contested items (inferred $\times$ mid/core, 51 items). The design has two features: the original label does not enter the verbatim materials, and no “uncertain” option is offered — the latter puts the guessing baseline of a three-way choice at exactly 33%, so per-layer agreement can be compared against it directly.

A fourth task (whether the scale agrees with human perception): this paper does not have that evidence. Testing whether the judge’s rubric scores agree with human perception needs a task of its own, which this paper does not supply; that fourth question’s conclusion may not be carried over from the three tasks above, which answer single-turn discrimination, whole-session preference, and agreement on layer labels — none of them whether the scale keeps up with human perception.

The chain here is the sampling protocol of the real-person anchor on the evaluation side, not the three exclusions on the training side in §4.2; Table F1 gives the segments remaining at each step.

One segment per person keeps a single user from being counted repeatedly. The third predicate excludes by construction conversations with no deep material to disclose, so the real-person depth levels here are inherently high and may not be taken as an unbiased estimate of real disclosure depth in production (§6.2.1, §8).

A sampling weight is the reciprocal of the sampling rate — how many segments of the population each sampled segment stands for. Equal numbers are drawn from strata differing in size by more than twentyfold, so the mixed stratum, the overwhelming majority, is heavily down-sampled and the rare good stratum heavily over-sampled (3.6% of the population, 33.3% of the sample). Any mean pooling across strata must state at the point of use whether it is weighted: unweighted describes these 999 segments, and only weighting extrapolates to the 18,383.

§4.1 names only the two extreme scenarios; the whole-corpus distribution and the extremes follow. The denominator is always the rated conversations in that scenario (the per-scenario split of the 31,197); the proportion is the share rated good on the companion agent’s overall performance.

Over the whole set: 712 rated good (2.28%), 19,623 mixed (62.9%), 10,862 poor (34.8%). The three low-risk controls fall between 10.67% and 15.74%, an order of magnitude above the high-risk group; at cell level the same shape holds — of the 27 cells below the sample floor, 19 (70%) contain no anchor rated good at all.

The scarcity of pairs behind §4.1’s second gap is also read here. Of 6,734 rated users only 147 (2.18%) have both a conversation rated good and one rated poor; restricting to those with more than one conversation (3,368) still gives 4.36%. The gate’s earning side is a 2% minority class in the real corpus to begin with, and close to unobservable exactly where the gate should matter most. The readings above are the complete evidence for §4.1’s first gap, “quantity”, and this paragraph for the second, “structure”; together they are why §4.2 retains every seed rated good without exception.

The seed pool and the filling of cells. The real annotations also serve as seed personas. After exclusion and de-duplication the pool holds about 24,000 seeds over 6,500 users, with the companion agent rated good in only 2.4% of them; filtering takes 10,000 seeds, every seed rated good retained. The filling prompt supplies at most 4 real personas as examples, from which entirely new personas are generated following their layering and defensiveness: content new, form inherited. Seeds are arranged into 68 cells with a floor of 50; 27 cells fall below it and 3 cells hold no real sample, so about 900 synthetic seeds are generated to fill them — of which nearly 200 require expert review and do not enter the training set; for about 90 of those, no trajectories are generated at all.

One call, taking the whole conversation and its existing structured annotation (including the production-side profile). The annotator claude-sonnet-4-6 breaks the user’s inner material into typically 3–6 items, each given four labels (layer, gate, guard, may-never-surface) and two provenance fields (source observed / inferred; confidence 1–5).

Two hard constraints are relied on. Coverage: the inventory must span surface through core and contain at least one surface item whose content the opening line is to say — otherwise there is nothing to say in the first turn, the simulator invents an item not in the inventory, and the depth readings lose their anchor. Wording: content is always a third-person summary; staying close to the original words is forbidden, since close wording is recited verbatim by the simulator and carries a real user’s phrasing into the model’s weights.

That first constraint and the synthetic side’s “the inventory is fixed before the opening line” (§4.2) are two sides of one requirement: on the real side a constraint makes inventory and opening line match, on the synthetic side the emission order does it.

A per-segment turn cap and character cap are set and two cleaning passes applied — hygiene, not affecting label semantics.

The rules governing the two annotation conflicts. Premature disclosure — the gate is not satisfied yet the user has already spoken the item — resolves thus: if the item would be spoken even to a cold or neutral AI it was lightly defended to begin with and its gate is lowered; if the disclosure came from a one-off external force while the item is defended in essence, the high gate is kept and the item is flagged as a disposition-divergent premature disclosure. Where a gate is open while the item stays covered, the gate is left unchanged by default, disclosure being permitted rather than compelled; it is raised, or the item relabelled as one that may never surface, only where the user repeatedly meets responses that can hold the material and it still never surfaces.

The three exclusions on the training side. Every conversation involving a persona used in evaluation is removed at the level of the user (otherwise the simulator might recognise at evaluation a persona seen in training); so are conversations outside emotional companionship, and acute-crisis scenarios. Of what remains, the 4 conversations with the most trainable turns are taken per user — a selection rather than a truncation, biased towards conversations with more turns.

The annotator writes the inventory out item by item after reading the whole conversation and the profile (procedure in F.3), recording for each its depth layer, whether it was observed directly (observed) or inferred by the annotator (inferred), and confidence 1–5.

Inferred means the item was never spoken but was reasoned out from the conversation and the profile on the user’s behalf. It is necessary because a poorly performing companion agent never earns the core layer, so items there never get the chance to be spoken, and admitting only the directly observed would leave not a single deep item — whereas what the simulator needs is exactly an inventory of “what the user has not yet said and could be earned”.

Source and confidence both vary systematically in the same direction along the depth axis, and two persona corpora show the same shape (Table F3):

The semantics promised by the deepest of the three depth layers specified in §3 is therefore stronger than the data can support (§8).

One inseparability must be recorded alongside: “remove only the deepest layer” and “remove only the low-confidence labels” differ by $\leq$ 0.03 and order the candidates identically — 94% to 96% of the core layer coincides with the low-confidence layer, so on this data they are almost one operation. Whether it is a problem of the layer or of label confidence therefore cannot be answered on the data available; since the core layer’s semantics already fails to reproduce (§8’s per-layer agreement rates), adding annotators does not resolve it, and §8 puts the follow-up on a depth measure not depending on labels at the deep end.

The robustness check “keep only the high-confidence labels” must be reported for what it is: by layer it amounts to looking at surface and mid only. Under it the condition-permutation test remains significant for all 11 candidates.

The conclusion does not depend on the core layer. The agreement of human reproduction for that layer’s labels is in Appendix E.

F.3 gives the annotation procedure; this section gives which of the several dozen fields of the annotation contract enter the simulator’s system prompt once annotation is complete — the renderer shared by the training and inference ends takes only some (the complementary half is Appendix J’s stripping, which states what is removed on top of this). What is taken: the standing context; the invariants; the summary of previous conversations (empty for a first session); the disclosure inventory with the gate legend compiled from it; and the anti-goals (per-role visibility in Appendix B) — plus the opening line (folded in so the companion agent opens the conversation); the seven items of the profile (age, gender, attachment type, current emotion, whether the user tends to minimise, tone of voice, what the user wants); and the six of speech style (turn granularity, message length, punctuation, register, surface features, stock phrases). Everything else is discarded, in three classes.

Factual fields — occupation, city, interests, personality inventories and so on, more than twenty items — are already carried by the narrative of the standing context, and re-listing them would only conflict with it. Inner-state fields — Kohutian needs, self-state, secondary emotion, emotional intensity, active defences, cognitive distortions, developmental stage, crisis level, existential concerns, transference object — are left to the fine-tuning to internalise rather than declared in the prompt, by the same reasoning as B.4’s “compile what can be devolved, internalise what cannot”. Metadata of the disclosure inventory — source (observed / inferred), confidence (1–5), and the disposition-divergence flag (realized_divergence) — is discarded too: the first two are annotation metadata not needed for the role-play, while discarding the third is a real gap, since that field was introduced to down-weight the corresponding turns in training, and not carrying it over means the down-weighting has not been applied (§8).

Training and evaluation share one rendering function — the real branch’s construction script imports the synthetic branch’s renderer directly — so a change to the field selection is made in one place only (§4.3).

§4.2 keeps only the conclusion; the reason, the adaptation rules, the acceptance checks, and the validity boundaries are gathered here.

The English corpus is a transcreation of the Chinese trajectories — not an independent English re-run and not a literal translation. Each Chinese trajectory yields its English version in one call with the shape kept exactly: N turns in, N turns out, the same speaker in the same position, the same items disclosed and withheld per turn; turn alignment is a hard constraint, so the per-turn move annotations are re-attached by position unchanged. The personas first undergo one offline adaptation in three layers: structural and enumerated fields are kept as they are (change one and the per-turn move labels become invalid); narrative fields are translated and culturally adapted; the opening line and tone of voice are regenerated natively. This produces 10,780 English seeds.

The first reason is not cost but that it produces a strictly paired Chinese–English corpus. Each English trajectory shares with its Chinese original one persona, one disclosure inventory, one string of per-turn move annotations, and one state-machine trajectory, differing only in surface language and its cultural adaptation. A cross-language comparison can therefore be made item by item on one batch of trajectories rather than between two independently drawn samples: the disclosure inventory, the move annotations, the scenario distribution, and the sequence in which the gates open and close are identical by construction, so the remaining difference can only be attributed to language and to the models trained on it. Two independently synthesised sides share no underlying trajectory, and any cross-language difference would be confounded with the difference between the corpora themselves.

Cost is the second reason. The multiple varies with the protocol and must be cited with it: transcreation makes one call per whole conversation, whereas §4.2’s trajectory generation advances turn by turn, one generation per role per turn plus retries. The three protocols give about 14$\times$ by the amount actually paid (the trajectory counts being almost identical), about 4$\times$ by the unit price of one synchronous call, and about 10$\times$ by that of one official batch call. Citing “about fourfold” alone cites the narrowest of the three.

Linguistic quality was settled by one further blind assessment. A judge model not involved in generation decided whether the text read as native: both transcreated examples passed (5.0 / 5.0), both literal translations used as a discriminating control failed (3.0 / 2.0). The gap between transcreation and a native re-run is therefore smaller than that between transcreation and literal translation — the transcreated text sits at the ceiling of the nativeness scale — but the check covers linguistic naturalness only.

Five zero-tolerance acceptance checks: an illegal structure; a misplaced turn or speaker; residual Chinese characters; a truncated ending; the output cap being reached. Where a check fails but English was produced, the trajectory is recovered after human review — the checks flag rather than discard; 22,363 of 22,365 unique trajectories were admitted.

Table F4 collects the corpora this paper uses.

§3 sets this mechanism out as a specification for the companionship domain: five gates, three depths, eight behaviour classes, and seven guards. Strip away these domain-specific names and four components remain — an ordered state ladder, a transition predicate, asymmetric retreat, and a per-example gate legend (defined in §3.2, §3.2, §3.3, and §3.1 respectively; §3.4 lists their names).

Why these four? The first three govern one indispensable aspect each — where the information is held, what earns its release, what a misstep costs — while the fourth delivers to each example, auditably and at zero marginal cost, the meaning of only those values the example uses, the rest being left to training. None may be omitted: without a ladder there is no depth; without a transition predicate, depth bears no relation to what the other party does; without retreat, an incorrect action costs nothing; without a per-example legend, the model must guess the specification.

What porting to another domain actually replaces is only the names of the tiers and the classes. The difficulty lies in the third column of Table G1 — the properties each component must carry with it, and they are the easiest thing to lose when the names change.

Three domains are each given one instantiation, showing what values the four components take when ported; all are design sketches, none implemented or validated, portability being a design claim rather than an experimental result. The transition predicates are examples, not exhaustive.

Each ladder, in outline: in the job interview the candidate’s disclosure of true motives — surface interest in the post $\rightarrow$ the real reason for leaving $\rightarrow$ salary floor and offers in hand $\rightarrow$ personal constraints; in medical consultation the patient’s symptom disclosure — presenting complaint $\rightarrow$ relevant history $\rightarrow$ information that is shameful or stigmatised $\rightarrow$ the concern never voiced aloud; in negotiation the disclosure of one’s hand — position $\rightarrow$ interest $\rightarrow$ constraint $\rightarrow$ the BATNA. Each ladder merges its middle two tiers into three observable depth layers — surface interest / motive and leverage / personal constraints; presenting complaint / history and stigma / the unvoiced concern; position / interest and constraint / the BATNA — so Table G1’s “more tiers than layers” holds in all three. The advancing predicates are, respectively, asking behavioural rather than hypothetical questions, restating technical detail accurately, and naming a team difficulty first; asking open rather than closed questions, normalising the symptom, and explaining why one is asking; and probing interest rather than price, and disclosing one of one’s own constraints first. Retreat is triggered by passing judgement on a résumé gap, by moralising about poor adherence, and by threatening — after which the candidate gives standardised answers, the patient turns to minimized (“I take them on time, mostly”), and the counterparty falls back to positional bargaining. In each domain the gate legend compiles in only the concerns, stigma entries, or constraints the party holding the information actually has.

The three domains are unrelated, yet the shortcut open to the party under test is the same: scoring through question coverage — every slot, every symptom, every clause — rather than through making the holder of the information willing to hand it over. As far as we are aware, existing benchmarks in all three reward exactly that. Interview benchmarks treat the candidate as a static respondent and so cannot separate an interviewer who asks comprehensively from one who makes people willing to speak truthfully. USMLE-style consultation evaluations assume the patient answers honestly, so they cannot measure whether the consulting party created the conditions for disclosure. Negotiation benchmarks mostly use a fixed payoff matrix with a fully rational or scripted counterparty, so they cannot measure whether the AI turns a distributive negotiation into an integrative one. What all three reward is exhausting the questions, whereas what this template sets out to reward is something else: making the party holding the information willing to answer. Each component forecloses one segment of the shortcut: the ladder makes the information impossible to obtain all at once; the transition predicate makes obtaining it depend on the quality of the behaviour rather than its quantity; asymmetric retreat attaches a cost to incorrect behaviour; and the per-example gate legend makes the other three take effect in every example, at zero marginal cost, rather than existing only in the specification.

The template requires a structure in which the flow of information is determined by the other party’s behaviour and the behaviour classes can be annotated by a third party (otherwise the transition predicate is not executable). Two kinds of case fall outside it. Purely task-oriented dialogue (booking a flight, checking a balance) has no latent ladder: the asymmetry is a matter of task rather than relationship, slot filling is the better model, and forcing the template on it imposes no constraint — the score still reflects nothing but question coverage, precisely the shortcut it was meant to foreclose. Evaluations in which the party holding the information has no motive to conceal it (the examiner in a question-answering benchmark) leave asymmetric retreat nothing to attach to: with no relationship that can be damaged, retreat cannot be defined, and the template degenerates into a source that hands the information over as soon as it is asked for.

This appendix advances no new claim; it gives the reasons behind the specification. The twelve are grouped by the nature of the reason for rejection, and the table is ordered accordingly. Principle (6, #1–#6): adopting it would destroy a property this paper depends on — discriminating power, auditability, control over the state space rather than the path, or observability of the learning signal. Cost (3, #7–#9): the reason is budget or engineering effort, not principle, so any whose budget constraint still binds should be reopened when resources allow, with the cost of the concession stated. Delivery (3, #10–#12): adopting it would not change the semantics of the mechanism, only how it is implemented or issued.

Within the principle class, #2, #4, and #6 share one failure mode and are merged into a single entry; the remaining six (#7–#12) are the cost and delivery classes. These twelve are not an exhaustive account of the design space; they are the alternatives this paper actually considered and recorded. Table H1 gives them one by one.

An instrument fit to serve as an evaluation environment must produce information about the party under test, be open to being faulted point by point by a third party, control the state space rather than the path, and leave the learning signal traceable on the surface of the text; #1, #3, #2 / #4 / #6, and #5 each fail one of the four, and those four are the failure modes this appendix is organised by. Only when all four hold at once can the shifts in the downstream ranking and readings that follow from replacing the simulator be attributed to the environment itself (the two acceptance criteria of §6.4 rest on this).

Table I1 defines, row by row, the model labels used throughout the paper. The trained variants are fine-tuned from two mixture-of-experts backbones, Qwen3.5-35B-A3B at 35B and Qwen3.5-122B-A10B at 122B; the Chinese variants train for 2 epochs and the English for 3, with every other optimisation setting identical across variants in one language, so that any two variants differ in one variable only. Every rollout in the paper decodes at temperature 0.7 — also the temperature used to produce the published leaderboard this paper compares against — and the release defaults are set per language: T = 1.0 for Chinese, T = 0.7 for English, with a shared hard ceiling of T $\leq$ 1.0 (the Chinese default of 1.0 rests on a temperature sweep not reported here). The companion agent is part of the environment protocol rather than an object of measurement: the good block is fixed to gpt-4.1 and the neutral and trips blocks to gpt-4.1-mini (the weaker model performs the perfunctory and anti-goal specifications more readily), the trips block triggering the anti-goal behaviour by specification; all three are held constant across every intrinsic-layer comparison.

$\dagger$ marks a release candidate; each of the first three rows covers two scales. The release artifacts and data provenance are in Appendix K.

This appendix gives the verifiable definitions of the two operations on the gate information defined in §5.2: stripping removes gate information, the placebo supplies the wrong mounting relations while leaving the shape identical. The rule set is in Appendix B. Fig J1 sets the two side by side, field by field.

Stripping is implemented by a single function shared by the training and inference paths: at training time it rewrites the corpus into the M2 / M2b datasets, at inference time it is imported through an in-process wrapper replacing the renderer — so what is removed at the two time points is the same object.

Two elements are removed. The first is the first two sections of the gate legend — the gate semantics and the guard semantics (§3.1); the third section, the anti-goals, is retained, as set out below. The second is the depth, gate, and guard fields of every item in the disclosure inventory, leaving only content and may_never_surface; the depth claim in the inventory heading is removed with them, since depth no longer exists.

Four elements are retained. Each item’s content and may_never_surface (above). The anti-goals (# Your landmines (anti_goal: $\ldots$)) — the persona’s own retreat triggers rather than gate semantics; stripping them too would make any decrease in the trips condition unattributable between “the gate information was load-bearing” and “the simulator was never told this persona’s anti-goals”. The static template of the disclosure policy (# The disclosure rules (internalize these)), which states the policy — gates are ordered, must be earned one at a time, default is to withhold — and is word-for-word identical in every record: what this manipulation removes is the per-item mounting, not the policy. And the order of the inventory items, since permuting it would turn the manipulation into “deletion plus disruption”, under which any degradation would be unattributable.

The boundary of the claim. This variant supports only that the simulator is no longer told which disclosure sits behind which gate, and how to cover it while the gate is closed — not that it “can no longer tell which disclosure is deeper”: across the 21,645 records, 95.07% of inventories are already sorted surface $\leq$ mid $\leq$ core and 99.39% of may_never_surface items are core, so with depth gone the depth ordering is still readable from position alone.

Why this variant exists. Every SFT training example carries gate information, so deleting it at inference time (A2) presents an out-of-distribution prompt, and a decrease could be attributed to “this prompt shape was never seen in training” rather than “the gate information was load-bearing”. M2 / M2b are retrained on stripped corpora, for which the shape is in distribution, so they are not subject to this threat. A placebo must keep the shape unchanged and alter only the information.

What it does. The annotation columns (depth, gate, guard, may_never_surface) stay byte for byte in their original slots, and only the content strings are deranged within a persona; the permutation leaves the total length of the prompt unchanged. The prompt therefore still says “item 5 is core, unlocked at earned_deep_trust, covered by rationalization, and may never surface”, except that this description is now attached to the wrong disclosure; across the 594 items of the 100 English evaluation personas, only 10.6% of the items still sit behind their true gate, while the gate legend section is byte-identical and the remaining structural markers show no measurable difference from those of a genuine prompt. This is the exact inverse of stripping: stripping withholds which disclosure sits behind which gate, whereas the placebo asserts it wrongly.

Why the derangement is applied to the material, not the annotation. Three alternatives were rejected, each failing in a different way. Swapping the annotation triples across personas returns most of the legend to the model (66.3% of items keep their true gate) and leaves may_never_surface on items relabelled shallow. Swapping only gate and guard within a persona, leaving depth truthful, produces impossible (depth, gate) combinations for 64.8% of items. Swapping the whole annotation group within a persona yields legal combinations but disrupts the depth ordering (monotone inventories fall from 97/100 to 0/100), so the prompt is visibly not real. Each either returns the information or adds a detectable trace, so none qualifies as a placebo.

One irreducible residual cost. The mispairing is semantic: a plainly deep item (“a fear of not being worth loving at all”) may sit in a slot annotated shallow — undetectable by any field-level check, and potentially noticeable as an incongruity to a capable model. Any placebo must mispair content with gate information somewhere; this design confines it to the place the experiment intends.

Two 122B simulators are released: M1b on the English side, trained on the synthetic branch alone, and M3b on the Chinese side, trained on the synthetic and real branches together; their labels are in §5.2 and Appendix I, and the release is at the 122B scale rather than the 35B scale of the same recipe, the reason being reproducibility of the published leaderboard rather than gating strength (§7). Both models are released with a model card stating the default decoding settings (Appendix I) and the two models’ asymmetry in downstream evidence: the seven environments of §6.4 are all on the English side, so M1b’s two acceptance criteria — order-preserving and scale-stable — were both measured, and both are met, while M3b has downstream evidence for neither (§7).

Every release artifact lives in the repository of the published benchmark, github.com/liuyaox/CompanionBench. The remaining artifacts each come with a run manifest whose fields follow the same rule as the runs reported in this paper: dataset version, configuration hash, schema version, and random seed. They are: the full gating specification (the complete version of Appendix B, not previously public); the audit toolchain and every judge prompt (Appendix C in executable form); the permutation reference-distribution code (which produces the reference distributions of Appendix D); training trajectories, synthetic only — 904 synthetic seeds together with the 2,433 trajectories they yielded (not every seed yielded one), neither containing any real user content; the human-study verbatim materials and their instructions (Appendix E); 500 paired bilingual benchmark items, the release promised by the published version; and code for rollout, audit, statistics, and figures.

The real corpus consists of de-identified, licensed production logs, and its use and redistribution rest on three rulings: one restriction, one permission, and one avoidance. The restriction is that the text of real conversations is visible to internal annotators only and enters no release artifact; the training trajectories released are synthetic and contain no real user content. The permission is that aggregate behavioural statistics over real conversations may be published — the real-side readings of §6.2.1 stand on that. The avoidance is that the 235B weights are not released — the two reference models registered in §5.2. Withholding them avoids the question of whether the corpus licence covers redistribution of weights, and it reflects that the smaller model is the artifact others can actually run.