The structured output that Google provides (the function that blocks the disallowed words) may calculate softmax output with assigning -inf value to the other words, then the probability is not the same as the weight the model firstly put on those allowed words. And here, reasoning comes before verdict, so the decision is already made before the last token classification. Resultingly, the last token made seems to not reflect LLM's original intention.