The em dash example draws the line well -- a deterministic string swap doesn't need a model in the loop at all. Where I'd want to know more is the boundary case: a violation that's mechanically detectable (say a banned phrase) but where the fix isn't a safe one-to-one swap, it changes what the sentence actually claims. Does that kind get routed to fail by default, or is there a middle category that still gets a sanitize attempt with a stricter diff check before it's allowed through?