Schema validity is not semantic correctness. A JSON schema can make malformed output impossible and still pass through a hallucinated entity, the wrong sentiment, or a quietly inconsistent field. Picture a Monday-morning batch: 980 customer reviews, every row valid against the schema. One row extracted the abstract category “price” where the text said “$20”. On another, two models flatly disagreed on polarity. A third hid a token the reference model gave 3% probability. None of these are schema failures. The schema was watching the wrong thing.
This paper reframes language-model reliability as verification-surface design. The surface is the unit that decides what you can catch: the representation a system exposes, and the deterministic checks you can write over it. Not the model, and not “uncertainty” in the abstract. The practical claim is constructive. When a reliability method fails, the usual fix is a new surface that makes the target failure visible, not a stronger judge over the same output.
Different checks catch genuinely different mistakes, and they do not substitute for each other. On public SemEval-2014 ABSA data, a lexical-faithfulness check finds unsupported aspects at 96.3% precision but wrong polarity at only 25.9%. A cross-model-disagreement check inverts the pattern (14.1% vs 59.8%). The two reject almost entirely different rows (Jaccard 0.03), and the same inversion reappears with a second model pair and on a second domain. The pattern holds across layers. Hard-constrained decoding enforces only the slice of the schema dialect a provider actually implements. At the token layer, across more than 3,000,000 candidate-token records, one structural check shows 46× lift on one failure target and 0.87× on another. The direction is also constructive: composing two disjoint zero-false-positive surfaces raises coverage while preserving purity across three hard domains.
The takeaway is operational. Find what your current surface cannot see, expose a representation that contains the missing signal, then verify against it. The question stops being which reliability method is best, and becomes which failure mode is visible to the surface you chose, and whether you need to build a new one.
A row valid against the schema can still carry a hallucinated entity, the wrong sentiment, or an inconsistent field. A schema makes malformed output impossible — it does not verify meaning. The schema was watching the wrong thing.
On SemEval-2014 ABSA, a lexical-faithfulness check catches unsupported aspects at 96.3% precision but wrong polarity at 25.9%; a cross-model-disagreement check inverts it (14.1% vs 59.8%). They reject almost disjoint rows (Jaccard 0.03), and the inversion replicates on a second model pair and a second domain.
Hard-constrained decoding enforces only the schema slice a provider actually implements. Across more than 3,000,000 candidate-token records, one structural check shows 46× lift on one failure target and 0.87× on another — a surface bites on one failure and not another.
Composing two disjoint zero-false-positive surfaces raises coverage while preserving purity across three hard domains. The operational rule: find what your surface cannot see, expose a representation carrying the missing signal, then verify against it.