The most dangerous failure in AI workflows isn’t a direct error.

It’s when the main model goes down and the fallback also fails, yet the system still outputs a seemingly complete result—making people think it’s done.
I hit this once: during daily information processing, the main model got cut off at 60 seconds, the fallback didn’t succeed either, but in the end I still received an extraction text that looked respectable. The problem isn’t “switch to another route and keep trying,” but that after switching routes, nobody clearly explains what happened.
Later, I added three receipt checks to every run: if any piece is missing, it can only be marked as pending verification—not as completed:
1. The actual final used: ____（which model / which service）
2. Result of each attempt: ____（success / timeout / error）
3. Current output status: ____（normal generation / explicit degradation / failure）
You can switch routes, but you must write it into the result so it can be reviewed. Silent completion is more dangerous than a reported error.