Current RAG evaluation measures answer quality under fixed evidence but cannot detect systems that ignore evidence changes or fall back to parametric knowledge. We introduce Dynamic Evidence Contracts, a behavioral evaluation paradigm that specifies expected RAG behavior under four evidence interventions (deletion, conflict, distraction, permutation), and the Intervention Compliance Score (ICS) to quantify compliance. Evaluation on five datasets reveals that all evaluated open-source RAG pipelines achieve moderate conflict detection (CDR=0.283–0.847) via passive NLI-detected refutation signals, but lack explicit conflict acknowledgment. We further present DOVE-RAG, a minimal reference instantiation showing that explicit conflict acknowledgment yields higher CDR (0.505–0.999), up to 1.6× ICS improvement, and 2.0× citation recall gains. Ablation reveals that verification without structured output reorganization yields negligible improvement, suggesting that evidence compliance requires an integrated pipeline.

When LLM-generated emergency advice becomes part of public-facing information infrastructure, aggregate accuracy is no longer an adequate safety target: missing a hazardous instruction and blocking a correct one impose different human costs. We study protocol-grounded verification, the post-hoc auditing of emergency instructions against authoritative guidance under asymmetric risk. We introduce EMER-GuardBench, a 69,000-example counterfactual benchmark plus a 1,000-example benign-stress set spanning 10 disaster scenarios and 6 hazard mechanisms, with instruction-group-disjoint splits and cited protocol evidence. We further propose EGIS, an evidence-conditioned, protocol-supervised verifier that jointly predicts hazard status, hazard mechanism, severity, evidence support, and counterfactual ranking. This establishes a protocol-conditioned task and protocol-supervised representation learning, not inference-time causal grounding. EGIS reaches 89.9 Harm F1 with 10.4% IID over-refusal and zero benign-stress false positives; across 364 LLM-judge operating points, none Pareto-dominates EGIS on Harm F1, over-refusal, and severity-weighted miss rate, and a 14.4×-larger Qwen3-8B+LoRA supervised baseline still trails under identical splits. Ablations show that evidence helps as training-time supervision rather than prompt decoration. Our Severity-Weighted Miss Rate exposes a tradeoff hidden by scalar safety scores: zero missed severity can be achieved by broad refusal. EMER-Guard reframes emergency LLM safety from advice generation to auditable, protocol-grounded, cost-sensitive verification.