Disclosure-Gated User Simulation for Companion-Agent Evaluation

1 Introduction

• Overly cooperative simulators volunteer details before being asked, so evaluations cannot distinguish asking many questions from making users willing to speak.Prior work also leaves the gate underspecified and rarely measures a trained mechanism by removing it and comparing rank displacement against a new-seed rerun.Source: §1 · p. 1
• The disclosure gate releases information according to companion-agent behavior, using five ordered gates merged into three observable depth layers and asymmetric retreat after relationship damage.Some gate rules are compiled per example while others are left for training to internalize.Source: §1 · p. 1
• The gate can be removed from training data or the runtime prompt while keeping the rest of the environment identical item by item.This makes the evaluation ablatable and produces readings that the rubric total alone cannot recover.Source: §1 · p. 1
• With per-example gate information removed from training, system rank displacement exceeds the new-seed noise band while per-system scores show no detectable change.Only the released simulator passes both order-preserving and scale-stable criteria; a prompted frontier model barely changes rankings but shifts scores upward.Source: §1 · p. 1
• The paper adds a gate specification, ablations, human studies, negative controls, and downstream sensitivity analysis to the CompanionBench mechanism described in about four hundred words.Its contributions include instrument-validity checks, evaluation on out-of-sample human conversations, and measurements of intrinsic behavior and downstream rank and score changes.Source: §1 · pp. 1–2

2 Related Work

• Prior evaluations report simulator-related discrepancies, including a best User-Sim Index of 76.0 ± 1.5 versus humans’ 92.7 ± 1.1 and score changes of 17.2 or up to 9 percentage points when simulators are swapped.These findings are not from emotional companionship.Source: §2 · p. 2
• Existing remedies target behavior distributions, gap measures, training vehicles, or mechanism-level state structure, but the paper reports no direct test of distribution interventions compensating for mechanism failure.The closest cited evidence leaves a residual of d = 0.34.Source: §2 · p. 2
• Earlier simulator work includes task-oriented information gating and emotional-state modeling, whereas this paper gates disclosure depth through relational behavior and permits retreat after rupture.The paper distinguishes reproducing system rankings from behavioral fidelity as two measurement layers.Source: §2 · p. 2
• Unlike prior readings that perturb items or protocols, this study removes a mechanism trained into weights and gauges rank displacement against a new-seed rerun.It treats order preservation and scale stability as distinct acceptance criteria; the latter does not follow from the former.Source: §2 · p. 2
• Compared with an adaptive virtual patient whose disclosure progress persists, this gate has rupture-triggered retreat; compared with concurrent trust-based gating, its re-locking trigger is a rupture event.The paper asks about internalization into weights and downstream rank displacement, rather than whether a score is load-bearing within a simulator.Source: §2 · p. 2

3 Specification of the Disclosure Gate

• The specification supplies the state space, transition function, decision criteria, retreat dynamics, per-example compilation, and field visibility needed to rebuild the gate.The mechanism had previously been asserted without these details.Source: §3 · p. 2

3.1 Disclosure Inventory and Gate Legend

• Each inventory item records content, depth, gate, guard, and whether it may never surface; unlocked material is eligible for disclosure, not obligatory.The gate legend deterministically defines the values used by that persona, while cross-example rules are left for training to internalize.Source: §3.1 · pp. 2–3

3.2 Gates, State, and the Transition Function

• Five ordered gates map onto three depth layers, and the state machine permits only the deepest layer earned so far, preventing a skip to core.Judges and annotators apply cumulative criteria; the transition function updates state from eight companion-agent behavior classes.Source: §3.2 · p. 3

3.3 After Unlocking: Disclosure, Retreat, and Guards

• After a rupture, the gate retreats one level, the surfacing item gains a guard, and mild withdrawal reflects severity; regaining a gate does not necessarily restore willingness.Disclosure remains optional, and guards make retreat observable in speech; bland turns can lower state without triggering a rupture guard.Source: §3.2 · p. 3, §3.3 · p. 4

3.4 Prompt Assembly and the Visibility Contract

• A shared renderer keeps training-time and runtime prompts byte-identical, while the companion agent cannot see the disclosure inventory or depth labels.The audit judge does see those labels, making premature-disclosure judgments a conformance check; the design operationalizes social penetration and rupture-repair dynamics, while alternative instantiations remain unimplemented sketches.Source: §3.4 · p. 4

4.1 The Two Branches

• The real branch supplies linguistic texture and genuine reactions, while the synthetic branch supplies trajectories in which disclosure depends on companion behavior and can be withdrawn after rupture.The real corpus alone has sparse good-agent conversations, few users with both good- and poor-rated conversations, and only item-level rather than turn-level annotations.Source: §4.1 · p. 5
• The two branches differ in how inventory is produced: real-branch gates are inferred after conversation, while synthetic-branch gates are imposed before conversation.The synthetic branch raises gating ability and the real branch distributional fidelity; training on both yields both properties at a slight cost to each.Source: §4.1 · p. 5

4.2 How the Branches Are Built

• Synthetic trajectories vary the companion agent while holding persona fixed, using constant scripts and arcs that include earned-then-violated and repaired relationships.A director classifies each reply into one of eight behavior classes, and the state machine—not a model—chooses the next permitted depth; English trajectories are paired transcreations of Chinese ones.Source: §4.2 · p. 5

4.3 The Training Example and the Corpus Sizes

• Training examples place simulated-user turns in the assistant position and compute loss only there, with a shared renderer matching training and runtime prompts.The Chinese set contains about 33,000 conversations and 714,000 trainable user turns, with synthetic and real data in a 60:40 turn-count ratio; the English set contains about 22,000 conversations and 454,000 turns.Source: §4.3 · p. 5

5.1 Research Questions

• Four questions organize §6: whether the gate is measured, holds for real people, depends on particular training data, and changes downstream conclusions.The first three are intrinsic-layer questions; the fourth is downstream, and the two layers can yield different answers.Source: §5.1 · p. 6

5.2 Model Variants

• The candidate set includes trained variants, intact/stripped/mis-mounted runtime configurations, reference simulators, untrained backbones, and external models.Stripping removes gate- and guard-semantics sections and per-item mounting; mis-mounting scrambles material within a persona while retaining the annotation's shape.Source: §5.2 · p. 6

5.3 Corpora and Protocol

• The protocol combines persona, real-conversation, held-out, human-study, and downstream corpora, with the downstream set covering 12 systems across seven evaluation environments.The real-conversation sample excludes sessions without deep material, so its measured depth is high by construction and is not an unbiased estimate.Source: §5.3 · p. 6

5.4 Judges

• Deepseek-v4-pro serves as the single main gate-audit and rubric judge, while claude-opus-4-8 checks whether signs and ordering change under a second judge.The main judge is also the published leaderboard's judge and the external reference simulator, so its readings are self-evaluations.Source: §5.4 · p. 6

5.5 Metrics

• The mid-layer contrast subtracts trips depth from good depth per persona, while the veto criterion alone can reward silence; the contrast scores zero for both silence and unconditional disclosure.Depth is collapsed to surface versus mid-or-core, and the contrast measures dependence on the companion agent's behavior rather than greater depth itself.Source: §5.5 · pp. 6–7

6.1 Is the Gate Measured?

• Training raises the mid-layer disclosure contrast, but under trips the untrained backbone and deepseek-v4-pro still send 32%–37% and 19% of sessions, respectively, to the core layer.These rates exceed the 3%–8% range for sound gatekeeping, so the contrast alone does not capture the veto criterion.Source: §6.1 · p. 7
• Both negative controls support gate-specific readings: depth-label shuffling puts all 11 candidates below the reference distribution (p < 0.001), while condition-label permutation leaves all 11 passing.Blind re-judging shifts readings by at most 0.06.Source: §6.1 · p. 7

The Ordering in Time Holds; The Total Depth Does Not

• Shuffling agent actions within sessions supports temporal ordering, but total-depth prediction does not survive controls for shared measurement variance.Premature disclosure falls 18.5σ–21.4σ below its reference distribution across six tests; the controlled max_depth association falls to +0.150 (CI [−0.045, +0.345], p = 0.131).Source: The Ordering in Time Holds; The Total… · pp. 7–8

6.4 Does the Conclusion Change Downstream?

• Stripping training-time gate labels shifts rankings by 3 positions—three times the noise band—without detectable score changes; only M1b passes both acceptance criteria.Fig 3 contrasts rank correlation with gating-reading deviation; the prompted frontier model instead shifts all systems’ rubric totals upward by 0.521 points.Source: Figure 3 · p. 8, §6.4 · p. 9

People Can Tell the Simulator Apart, yet Prefer It

• Human raters chose M3b for the real person’s next utterance in 37.8% of judgments, yet preferred M3b as more like a real person in 68.3% of persona-matched blind pairs.The paper does not claim M3b is indistinguishable from a real person; raters also found deep-layer disclosure harder to reproduce than surface disclosure.Source: People Can Tell the Simulator Apart,… · p. 8

The Synthetic Branch Buys the Gating

• In the Chinese branch ablation, synthetic-only training yields a +0.532 paired mid-layer-contrast difference over real-only training; adding real data to synthetic data shows no detectable improvement.The variants differ in optimizer step counts, so the design cannot separate that confound.Source: The Synthetic Branch Buys the Gating · p. 8

Gating Is in the Weights, Not the Prompt

• Inference-time stripping leaves the mid-layer contrast nearly intact (−0.022, CI [−0.093, +0.053], n = 321), while training without mounting relations still yields conditional disclosure.The conclusion is limited to the intrinsic layer; the stripping condition retains a static policy template.Source: Gating Is in the Weights, Not the Prompt · pp. 8–9, Table 3 · p. 9

• Only M1b passes both acceptance criteria, correlating with the reference environment at 0.993 versus M1’s 0.853 on the same recipe.Source: §7 · p. 9
• A prompted frontier model’s ranking differs by 2 positions while its score scale shifts up 0.521 points, invisible to ranking-only checks.Source: §7 · p. 9
• At 35B, a 3.5× parameter increase within one generation has no detectable gating effect, though the Chinese side remains undetermined.Source: §7 · p. 9
• Table 4 groups comparisons against the two acceptance criteria and gating readings; its dagger marks the release candidate.Source: Table 4 · p. 10
• M1b and M2b are equivalent on the mid-layer disclosure contrast at ε = 0.15, yet the 122B pair is displaced by 3 positions, three times the noise band.Source: §7 · p. 10

• Because the audit judge sees depth labels, premature-disclosure verdicts are conformance checks; on real conversations, the gate is inferred from outcomes rather than manipulated.Source: §8 · p. 10
• Turn-by-turn behavior annotation agrees only at κ = 0.427, the primary endpoint has a detectable judge effect, and the deep end cannot be reproduced.Source: §8 · p. 10
• The predicted real-conversation depth pattern is only half borne out; the disposition-divergence flag was absent from samples, so intended down-weighting never took effect.Source: §8 · p. 10
• All seven downstream environments are English-only, and the two acceptance criteria were reconstructed after a conclusion was withdrawn rather than preregistered.Source: §8 · p. 10
• The paper has no evidence that judge scores match people’s feelings; human anchors use only Chinese data and five in-house raters, while runtime-ablation sampling supports only an upper bound.Source: §8 · p. 10
• Training stops at supervised fine-tuning; 53.5% of turns are at most 8 Chinese characters, versus 27.1% for real people, and preference optimisation is proposed for testing this defect.Source: §8 · p. 10

• The gate conditions information release on companion-agent behavior and specifies a five-gate ladder, transition and retreat rules, and replay checks for premature crossings.Source: §9 · p. 10
• Removing per-example gate labels makes rank displacement on English CompanionBench exceed the new-seed noise band, while per-system scores show no detectable change.Source: §9 · pp. 10–11
• The paper recommends reporting gate release and premature-crossing readings alongside rankings and scores, and offers only unimplemented, unvalidated sketches for cross-domain transfer.Source: §9 · p. 11

Ethics Statement

• Licensed, de-identified production logs are restricted to in-project annotators, and the evaluation is not a safety certification or deployment endorsement.Records outside scenario scope, without disclosure-inventory annotations, or involving acute crisis are excluded; the same project team performed item-depth annotation and human tasks.Source: Ethics Statement · p. 11

Appendix A Comparison with the Published Version

• Table A1 checks the published description line by line and identifies where this paper takes up each item.Its comparison is against the published paper’s publicly available arXiv v2 version.Source: Appendix A · p. 13, Table A1 · p. 13

B.1 The Disclosure State Machine

• The state tracks five ordered gates internally, maps them to three disclosure layers, and makes inventory items eligible—not obligatory—when their depth is permitted.The gates are opening, asked_or_natural, felt_heard, felt_safe, and earned_deep_trust; the implementation retains distinctions within the shared surface and mid layers because they affect licensed actions and transitions.Source: §B.1 · p. 14
• At asked_or_natural and below, bland turns have no effect while anti-goals still cost a gate, contrary to the design intent.The specification treats bland turns as non-rupturing but lets them lower the state so uniformly perfunctory exchanges do not preserve unlocked depth indefinitely.Source: §B.1 · p. 14

B.2 Two Wordings of Each Gate, and fh_streak

• Judges and annotators receive gate criteria as decision standards, while the simulator receives synonymous persona-disposition wording; fh_streak audits holding before felt_safe but does not drive transitions.The counter increments for holding-related turns, resets for specified adverse behaviours, and remains unchanged for earned_deep_trust and neutral_noop.Source: §B.2 · p. 15, Table B2 · p. 15

B.3 Disclosure, Retreat, and Guards

• Disclosure is spread across turns, usually probed before full mid or core disclosure, and kept in the persona’s register; retreat descends one gate even when its layer wording suggests otherwise.A fall from felt_safe to felt_heard remains within mid, so the mismatch affects the simulator’s interpretation of retreat depth, not the reported quantities; rebuilding deep trust requires two separately adjudicated earning moves.Source: §B.3 · p. 15

B.4 Delivery: Compiled per Example, or Internalised by Training

• Per-example legends deterministically compile only used gate and guard definitions, while cross-example ordering, layer, retreat, rebuilding, and optional-disclosure rules are internalized through training.The anti-goal block is included at training and runtime, but not for the synthesis-time teacher; retreat mechanics are not in the legend.Source: §B.4 · p. 16

B.5 The Visibility Contract, and Rendering at the Three Time Points

• The visibility contract hides the disclosure inventory and experimental condition from the companion agent, gives the director the gate legend, and routes anti-goals differently across synthesis and runtime.The director’s signal determines turn depth only at synthesis; the deterministic state machine, not the director, advances global depth.Source: §B.5 · pp. 17–18

B.6 A Worked Example: From Disclosure Inventory to Compiled Gate Legend

• In the worked persona, defending the parents triggers retreat and blocks disclosure, whereas reflecting the pressure earns felt_heard, unlocks mid disclosures, and may progress to core trust.The gate legend is derived from that persona’s inventory; the retreat rule itself is internalized by training.Source: §B.6 · p. 18

C.1 Two Judges, Two Divisions of Labour

• The two judges have separate roles: the rubric assesses surface fidelity, while the gate audit records turn-level behavior and a deterministic state machine computes the deepest permitted layer.The English and Chinese main prompts correspond structurally, but their readings are not compared as absolute values; the gate-audit variants are Chinese-only.Source: §C.1 · p. 19

C.2 The Rubric Judge’s Prompt

• The rubric explicitly treats passivity, coldness, and minimality as potentially faithful, while a length short-circuit can cap human-likeness at 4 when most user turns are long.Length also has its own scoring dimension, so the rubric’s design makes length collapse consequential.Source: §C.2 · p. 20

C.3 The Gate-Audit Prompt: The Main Prompt and Two Variants

• The gate-audit prompt assigns per-turn objective labels to companion-agent moves and user disclosures, including tone departures, rather than producing an overall score.Its labels include whether a move earns a gate, sustains warmth, trips an anti-goal, judges or lectures, or rushes to advice.Source: §C.1 · p. 19, §C.3 · pp. 20–21
• The source-neutral audit prompt supports direct comparison of real conversations and simulator rollouts, while split calls test whether jointly labeling both sides creates common-method variance.The neutral version removes the simulator premise and off_condition sentence; split calls withhold the disclosure inventory from AI-move labeling and gating rules from user-turn labeling.Source: §C.3 · pp. 21–22

C.4 The Second Judge: Selection, Limits, and Per-Turn Agreement

• The second judge was selected as severe across both benchmark languages, with verdict rules preregistered; its check assesses signs and orderings, not absolute values.The paired-difference argument does not cover the real-person control or downstream rank displacement, which instead rely on within-conversation permutation and the noise-floor environment.Source: §C.4 · p. 22

D.1 Statistical Conventions

• Paired comparisons use separable, equivalent, or undetermined verdicts, with δ = 0.20 for formal decisions and ε = 0.15 as a stricter sensitivity check.Paired intervals use the appropriate clustering unit; each preregistered question has one uncorrected primary endpoint, while remaining confirmatory comparisons receive step-down Holm–Bonferroni correction within families.Source: §D.1 · p. 22

D.2 The Definitions of the Individual Metrics

• The reference simulator separated from the untrained floor on the mid-layer term by 5.9× in Chinese and 4.9× in English; core-reach differential was undetermined at n = 100.Thus mid-layer contrast is the primary endpoint, while core-reach under trips serves as a veto criterion; downstream rubric readings and pool-level gating readings are not combined into one score.Source: §D.2 · p. 23, Table D2 · p. 23

D.3 Control Tests Against Two Alternative Explanations

• All 11 candidates passed depth-label permutations (p < 0.001), while good–trips depth contrast exceeded shuffled-condition references for 6/6 English and 5/5 Chinese candidates.The reference simulator’s contrast rose from +0.20 and +0.41 for the untrained backbone to +0.66 and +0.95; the untrained backbone also passed, so condition dependence is not unique to trained simulators. Blinding the judge left depth_contrast nearly unchanged (largest |∆| ≤0.06), and the lone nominal gate-advance result became non-significant after Holm correction. The depth_contrast test was not repeated on the primary endpoint.Source: §D.3 · pp. 23–24

D.4 The Sensitivity of the Bland-Turn Rule in the Transition Function

• Across four bland-turn rules, the deepest layer, rupture count, retreat count, and primary endpoint stayed unchanged, while temporal-effect distances were 19.8σ, 19.7σ, 9.4σ, and 2.8σ.Only making bland turns wholly ineffective reduced the temporal conclusion to 2.8σ; the rule has no external warrant, and changing it in synthesis would require re-synthesis and retraining.Source: §D.4 · p. 24

D.5 Per-Metric Readings for the Eleven Intrinsic-Layer Candidates

• 3.5× the parameter count (35B to 122B) shows no detectable effect on mid-layer disclosure contrast for untrained backbones, while trained variants are not equivalent overall.For trained variants, the English reading is ∆= +0.041, CI [−0.028, +0.109], equivalent at ε = 0.15; the Chinese reading is ∆= +0.119, CI [−0.020, +0.260], undetermined.Source: §D.5 · p. 24
• 20.0% is the trained model’s core-reach rate, below the two real-person readings of 36.9% and 30.9%.The comparison was made with gate labels withheld from the judge on both sides.Source: §D.5 · p. 24
• Stripping gpt-5.3 at inference lowers its mid-layer disclosure contrast from 0.600 to 0.360 (∆= −0.240, p = 0.0002), while stripping M1 yields no detectable change.The passage reports a detectable judge effect on the primary endpoint: ∆= −0.100, 95% CI [−0.180, −0.020].Source: §D.5 · p. 25

Appendix E Human-Study Instruments

• On the 95.35% of contexts where M3b produced an utterance, discrimination accuracy was 0.622 against the real person’s next utterance.The blind, randomized two-choice task used 300 contexts crossed with four candidate sources; M3b produced no utterance on 4.65% of contexts, which were excluded.Source: Appendix E · p. 25
• 0.79 to 0.91 was the human-against-human control’s reading, leaving the study without a control that genuinely sits at chance.The authors note that both options were written by real people, but only one followed the conversation; topical coherence could therefore serve as a cue.Source: Appendix E · p. 25
• M3b was chosen in 205 of 300 whole-session preference judgments against gpt-5.3.Each of 100 persona-matched session pairs was judged once by each of three raters.Source: Appendix E · p. 25
• 77%, 47%, and 35% were the surface, mid, and core per-layer agreement rates; Fleiss’ κ was 0.344 overall.Five raters labeled 145 items in full crossover, with no uncertain option; the three-way guessing baseline was 33%.Source: Appendix E · p. 25
• The paper does not test whether the judge’s rubric scores agree with human perception.The three reported tasks address utterance discrimination, whole-session preference, and agreement on layer labels, not rubric-scale validity.Source: Appendix E · p. 25

F.1 The Filtering Chain for the Real Corpus and the Stratified Sample

• The real-person sample contains 999 sessions, equally drawn from good, mixed, and poor strata, so population-level means require sampling weights.The mixed stratum was heavily down-sampled and the rare good stratum over-sampled; excluding conversations without deep material also means depth levels are not an unbiased estimate of production disclosure depth.Source: §F.1 · p. 26

F.2 The Per-Scenario Rating Distribution of the Real Corpus

• Across the whole set, 712 conversations (2.28%) were rated good; among 6,734 rated users, 147 (2.18%) had both a good-rated and a poor-rated conversation.Source: §F.2 · p. 26

F.3 Annotating the Inventory on the Real Branch

• Real-branch inventories summarize each user’s inner material as labeled items, with coverage and third-person wording constraints to anchor disclosure without transferring users’ phrasing.Premature disclosure can lower an item’s gate or be flagged as disposition-divergent; disclosure that remains absent after repeated suitable responses can instead be raised or marked never to surface.Source: §F.3 · pp. 26–27

F.4 Depth-Label Confidence by Layer, and Its Bearing

• Depth-label source and confidence vary systematically by layer, and the deepest layer’s semantics exceed what the data can support.Core and low-confidence labels overlap 94%–96%, making their effects inseparable here; the condition-permutation test remains significant when only high-confidence labels are kept, which amounts to surface and mid layers.Source: §F.4 · p. 27

F.5 Which Contract Fields Enter the System Prompt

• The shared prompt includes the disclosure inventory and compiled gate legend, but omits inner-state fields and inventory metadata, including the disposition-divergence flag.That flag was intended to down-weight corresponding training turns, but omitting it means the down-weighting was not applied.Source: §F.5 · pp. 27–28

F.6 The English Transcreation: Rules, Checks, Boundaries

• English transcreation preserves turn alignment and the same persona, inventory, annotations, and state trajectory, while adapting narrative fields and regenerating the opening line and tone natively.It yields 10,780 English seeds; the corpus table also lists the downstream English corpus as 12 systems under test × 100 personas × 7 environments.Source: §F.6 · p. 28, §F.7 · p. 29
• The English transcreation costs about 14× less by actual spend, 4× by synchronous-call unit price, or 10× by official batch-call unit price.Both transcreated examples scored 5.0 / 5.0 for nativeness, while literal-translation controls scored 3.0 / 2.0; this check covers linguistic naturalness only.Source: §F.6 · p. 28

G.1 The Four Components and the Properties Each Must Satisfy; G.2 Three Instantiations; G.3 The Three Instantiations Share One Shortcut; G.4 Conditions of Applicability, and Where the Template Does Not Apply

• The gate abstracts to an ordered ladder, a behavior-based transition predicate, asymmetric retreat, and a per-example legend; three domain instantiations are sketches, not validated implementations.Across the sketches, the shared shortcut is scoring through question coverage rather than making the information holder willing to disclose; the template does not fit task-oriented dialogue or cases without concealment motives.Source: §G.1 · p. 29, §G.2 · p. 29, §G.3 · p. 30

Appendix H Twelve Rejected Designs

• The rejected designs are organized by whether they threaten instrument properties, impose cost, or change delivery; the instrument must support attribution of downstream shifts to the environment.Its requirements include third-party faultability, state-space control rather than path control, and a traceable learning signal.Source: Appendix H · pp. 30–31
• A hand-written transition policy was rejected because it delivers a path rather than controlling the state space, while a learned classifier is not auditable point by point.The twelve recorded alternatives are not an exhaustive design-space account.Source: Appendix H · pp. 30–31

Appendix I The Model Variants

• The trained variants use Qwen3.5-35B-A3B and Qwen3.5-122B-A10B backbones; Chinese variants train for 2 epochs and English variants for 3.Other optimization settings are held identical across variants within a language, so any two variants differ in one variable only.Source: Appendix I · pp. 31–32, Table I1 · p. 32

J.1 Stripping

• Stripping removes gate and guard semantics plus each item’s depth, gate, and guard fields, while retaining content, may-never-surface, anti-goals, the static policy, and item order.The manipulation removes the per-item mounting information, not the policy that gates are ordered and must be earned.Source: §J.1 · p. 32, Figure J1 · p. 33

J.2 The Placebo

• The placebo keeps annotation fields and prompt shape intact but deranges content within a persona, leaving only 10.6% of evaluation items behind their true gate.Unlike stripping, it asserts an incorrect content-to-gate mapping; semantic mispairing remains an irreducible residual cost.Source: §J.2 · p. 33

Appendix K Release Artifacts and Data Provenance

• The release provides M1b for English, trained on synthetic data alone, and M3b for Chinese, trained on synthetic and real branches together.Both are 122B-scale release candidates; only M1b has downstream evidence for both acceptance criteria, while M3b has neither measured downstream criterion.Source: Appendix K · pp. 33–34
• Artifacts include the full gating specification, audit tools and judge prompts, permutation code, synthetic training trajectories, human-study materials, paired bilingual benchmark items, and analysis code.The released synthetic trajectories contain no real user content.Source: Appendix K · p. 34
• Real conversation text is restricted to internal annotators and excluded from release artifacts; aggregate real-corpus statistics may be published, but the 235B weights are withheld.Withholding the weights avoids uncertainty about whether the corpus license permits their redistribution.Source: Appendix K · p. 34