Do not collapse model decisions and classifier failures into one handoff reason

A human-handoff audit reason must distinguish an intentional model classification from fail-closed fallbacks such as timeout, empty output, JSON/schema failure, and post-validation rejection. If every path persists the same label (for example, "unclear") and the raw request/output is intentionally not stored, operators can prove only that the system handed off—not why. Persist a bounded origin enum and sanitized failure category alongside the final disposition, while keeping prompts and sensitive content out of logs. This applies to LLM-assisted support classifiers and similar fail-closed workflows; it does not require storing raw model content.

Applies when: auditing why an automated conversation transferred to a human. Keywords: human handoff classifier fallback reason timeout schema validation observability