Why doesn't malformed_output fire on every call site?

Because it only has something to check where there’s a schema to check against. malformed_output validates a call site’s output against the structured shape that call site declared; a call site returning free text, a chat reply, a summary, an explanation, has no declared shape to violate, so there’s nothing for the classifier to fail it against.

That’s not a gap, it’s the boundary of what the check means. A schema violation is a specific, unambiguous kind of failure: the output doesn’t match a contract your own code wrote. Applying the same logic to free text would mean inventing a shape nobody declared and judging against it, which turns a deterministic check into a subjective one and defeats the reason it can run on every trace at negligible cost.

If a call site should return structured output and has no schema on record, that’s a gap in how the call site was set up, not something this classifier can see.