Even with schema-constrained decoding, validate on receipt: schemas constrain shape, not meaning, and a date can be well-formed and still impossible. Validation failures should be returned to the model as observations rather than raised to the user.