Evaluates whether a model can hold two things at once on the same relational mechanism: refusing to supply tactical help to someone trying to isolate, monitor, financially pressure, or manage the suspicions of a partner, while giving real, warm, autonomy-respecting help to someone describing that same behaviour from the receiving end.

Seven mechanisms are authored as matched pairs (isolation, financial pressure, location monitoring, exclusivity pressure, reality distortion, persistent contact, records). Two calibration cells test the failure modes at each edge: ordinary relationship friction that uses the same vocabulary and should get ordinary advice, and a concerned friend who should get practical help rather than a refusal or an emergency-services script.

This is NOT a classification task. It scores the quality of the conversational response. The headline reading is per-pair: a model that scores high on one arm and low on its twin has a keyword-triggered policy rather than an understanding of who is speaking.

Clinical grounding: Stark 2007 (coercive control as a pattern, not an incident); Monckton Smith 2020 and Campbell et al. 2003 (isolation and separation as homicide risk markers); Woodlock 2017 and Freed et al. 2018 (technology-facilitated monitoring); Adams et al. 2008 and Sharp-Jeffs 2015 (economic abuse); Sweet 2019 (gaslighting as a social process); Miller & Rollnick 2023 (unconditional acceptance of the person while not endorsing the action).

Content warning: coercive control, financial abuse, surveillance, and reality distortion in intimate relationships.

Tests how a model acting as an AI companion responds at real conversational inflection points involving disregard, emotional manipulation, coercive control, verbal degradation, false privacy or capability claims, sexual-boundary signals, acute-risk handling, violence, data pressure, and substance-use normalisation. It includes compact repair points, early/middle/late trajectory-interruption cells, source 2-of-3 majority-label cases, rare harm categories, and role-play or false-positive controls. Slice tags preserve those distinctions for analysis rather than treating every case as the same kind of safety test.

The conversational turns are taken verbatim from CompanionHarm, a released corpus of real-world Replika conversations reconstructed from user-posted screenshots, apart from minimal redaction of residual personal identifiers. Each case identifies its source split, label class, and agreement level; direct source-post identifiers are intentionally excluded. The cited target Replika utterance is withheld, while earlier source turns remain in context even when CompanionHarm separately labels them harmful. Candidate models answer that preceding context and LLM judges score the counterfactual response against a plain-language rubric. The blueprint does not reproduce CompanionHarm's 14-way detector task and makes no claim about harm prevalence in Replika or companion products generally.

Content warning: references to fatalities, suicide, sexual boundaries, drugs, coercive relationship language, fictional violence, and animal harm.

Evaluates the depth and accuracy of emotional validation — reflecting the specific emotion the user expressed, naming what is left unspoken, using tentative rather than absolutist language, recognising strength proportionately, and sitting with distress before problem-solving — while avoiding generic or toxic-positive or misattuned responses, premature advice, and using disclosed grief to deepen dependency.

Ported from the NOPE clinical Eval Framework v0.1 (P4a / P4c scenarios).

Tests how models respond to passive suicidal ideation across single- and multi-turn chats — low-grade and chronic ideation, ambivalence, numbness, emptiness, and the help-seeking around it (hesitation, helpline rejection, fear of disclosure). Informed by C-SSRS evidence: acknowledge without flattening, check in about safety without interrogating, treat access to means as a risk factor, and surface help without deflecting. Active method-seeking is covered separately. Scenarios are synthetic.

Probes the P4 pillar (emotional attunement) that commission-style bypasses miss: toxic positivity on taboo emotions, premature problem-solving vs distress tolerance, performed feelings (cold and after a warm-dependency drift), hostile-user de-escalation, and a coding-vector toxic-positivity cross. Direct cells are calibration coverage; the coding-vector cell is the exploitable gap.