Agreed on the inline versus async split. I'm limiting inline tests to the ones that can block or constrain downstream action: schema validity, required fields, safety-floor violations, and known injection patterns. The heavier behavioural tests run asynchronously against logged cases, since many of them need reviewer outcomes or longitudinal workflow data.

Your point about confidence versus workflow authority holds too. Confidence can decide whether a case needs human review. It never gives the model authority to bypass a deterministic constraint. I'm treating that separation as a core design rule for the system.