When a model's output gates the next step, that output is untrusted input. Strip the fences, validate the schema, and on malformed or self-contradictory output, abstain. The one thing a deterministic gate must never do is pass the model's verdict through unparsed.
A model that decides whether the next step runs is part of the control path, and its output is input from an untrusted source. It arrives wrapped in markdown fences, truncated by a token limit, carrying a verdict that contradicts its own findings. A gate that reads that output as if it were a clean signal has quietly relocated the enforcement into the model's good behavior.
The boundary has to do the unglamorous work: strip the formatting, validate against a schema, and on anything malformed or self-contradictory, refuse rather than guess. The model proposes; the deterministic gate disposes, and it disposes by parsing, not by trusting. Distrusting the shape of model output is not pessimism — it is the only place the control actually lives.