Accurate Ensembles, Fragile Narratives:
Multi-Scale Stacking and a Fidelity Audit of
LLM-Generated Explanations for Credit Risk

1. 1.

   A multi-scale stacking ensemble for credit default prediction. Four gradient-boosting learners deliberately configured at different depth/learning-rate scales, plus a residual network, are fused by a small neural meta-learner trained on out-of-fold predictions. It attains test ROC-AUC $0.9539$ and PR-AUC $0.9137$ (Section VII).

2. 2.

   Statistical rather than rhetorical model comparison. We attach confidence intervals to every headline metric and test the ensemble’s margin over the best single model under an assumption chosen to disadvantage our own claim. The margin survives ($p=0.016$).

3. 3.

   An operating-point analysis that qualifies the headline. We show that the ranking gain translates into a cost reduction of under $2\%$ at the deployed threshold across a wide range of misclassification cost ratios (Section VIII). Reporting AUC alone would have overstated the practical benefit.

4. 4.

   A measured account of what the attribution layer actually provides. The ensemble’s risk representation differs qualitatively from that of the linear baseline: loan_grade absorbs the role that loan_int_rate and the bureau default flag play in logistic regression (Section IX). We quantify SHAP–LIME agreement, cross-model agreement, attribution concentration and directional stability instead of asserting them.

5. 5.

   A fidelity audit of the narrative layer, with a documented failure. We define a lightweight sign-and-membership audit, apply it, and report a case in which the generated rationale inverts the direction of three of the four drivers it was given (Section X). We connect this to the attribution instability measured in the previous section rather than treating it as a one-off.

6. 6.

   Honest trustworthiness diagnostics. Calibration, perturbation stability, local explanation consistency and group disparity are reported against the acceptance thresholds our own protocol specifies. Three of the four fail (Section XI). We argue this is more useful to a practitioner than a table of green ticks.

A note on provenance is in order. An earlier version of this work reported a test ROC-AUC of $0.96$. Recomputation from the persisted artefacts gives $0.9539$. Every figure reported in this paper is recomputed from the serialised experiment outputs, and the reproduction scripts are released with the code.

Benchmarking studies over the past decade converge on a consistent ordering: ensembles of decision trees outperform single learners and outperform neural networks on typical credit-scoring feature sets, with the margin over regularised logistic regression material but not overwhelming [2, 3]. The broader tabular literature reports the same phenomenon and offers explanations grounded in the geometry of tabular decision boundaries: tree ensembles are biased towards axis-aligned, piecewise-constant functions, which suits features such as grade bands and debt-ratio thresholds [19, 20]. Our results reproduce this ordering, with random forest and XGBoost outperforming every neural architecture we test, and our ensemble is designed around it rather than against it, using the neural component as one voice among five rather than as a replacement.

SHAP [4] grounds attribution in the Shapley value [34, 35], which uniquely satisfies local accuracy, consistency and missingness. LIME [5] fits a sparse linear surrogate in a sampled neighbourhood. Both are model-agnostic and both are widely deployed in finance [6, 36, 37].

Their limitations are also well documented. LIME’s reliance on random perturbation makes its explanations unstable across runs [17], and both methods can be deliberately fooled by an adversary who exploits the off-manifold queries they issue [16]. Rudin argues from these failure modes that high-stakes decisions should use models that are interpretable by construction [18]. We do not resolve that debate. We do take from it the methodological point that an attribution vector is evidence about a model, not a transcript of it, and that anything built downstream inherits its noise. Section IX measures that noise on our system; Section X shows it propagating.

The proposal to have an LLM verbalise XAI output is recent and active [7, 8]. Kroeger et al. [9] ask whether LLMs can act as post-hoc explainers directly. Factorial studies of narrative quality find that readers prefer LLM-written explanations to raw attribution tables [10], which is the intended effect and also the reason a wrong narrative is worse than a wrong table. Work specific to credit risk asks whether LLMs can serve as governance-grade explainability tools [11] and whether LLM-derived feature rationales align with those of classical models [13]. Two-stage designs that add an explicit verification pass over the generated text [12] are, in our reading, the correct architectural response, and our results are an empirical argument for them.

Faithfulness, meaning whether an explanation reflects the reasoning it purports to describe, has a precise treatment in NLP [15], and hallucination in conditional generation is surveyed in [14]. Our contribution here is narrow and concrete: we apply a minimal faithfulness check to a credit-risk narrative pipeline built the way the literature recommends, and report that it fails.

Relative to prior work, the novelty of this paper is not the ensemble, and it is not the idea of pairing attribution with an LLM. It is the audit. We are not aware of a credit-risk study that reports both a full attribution-stability profile of its own ensemble and a documented sign-inversion failure of its own narrative layer, and that connects the two.

We use the public Credit Risk Dataset, comprising $32{,}581$ consumer loan applications described by eleven predictors and a binary outcome loan_status ($1=$ default). Seven predictors are numeric and four categorical; Table I lists them. The target is imbalanced: $25{,}473$ non-defaults ($78.18\%$) against $7{,}108$ defaults ($21.82\%$), a ratio of $3.58{:}1$.

Overall completeness is $98.97\%$. Missingness is confined to two continuous variables, loan_int_rate ($3{,}116$ records, $9.56\%$) and person_emp_length ($895$ records, $2.75\%$), and is scattered rather than structured. Duplicate rows account for $165$ records ($0.51\%$).

The single most consequential preprocessing decision is ordering. We partition before we learn anything from the data. The design matrix and labels are split $80/20$ with stratify=y, preserving the $21.82\%$ default rate in both partitions, yielding $26{,}064$ training and $6{,}517$ test records ($5{,}095$ non-defaults, $1{,}422$ defaults). Every subsequent transformation (winsorisation caps, imputation, scaling, encoding) estimates its parameters on the training partition only and is then applied unchanged to the test partition. The fitted transformer objects are serialised so that the inference service applies numerically identical transformations.

Winsorisation. Domain-implausible extremes were capped rather than deleted: person_age at $100$ years and person_emp_length at $50$ years, against raw maxima of $144$ and $123$ respectively. Caps are estimated on training data and reused.

Imputation. The two incomplete numeric columns are filled with a $k$-nearest-neighbour imputer ($k=5$). Because the missing variables are correlated with income and principal, local interpolation is preferable to global mean or median substitution.

Scaling. Numeric features are centred on the training median and scaled by the training interquartile range. Income is severely right-skewed (sample skewness $\approx 32$, driven by a small number of very high earners), which is exactly the regime in which a robust scaler outperforms standardisation for gradient-based learners.

Encoding. loan_grade carries a natural order (A $<\cdots<$ G) and is ordinal-encoded so that higher values mean worse credit quality. person_home_ownership and loan_intent are one-hot encoded with the first level dropped and handle_unknown=’ignore’ so that unseen categories at inference yield a zero vector rather than an exception. cb_person_default_on_file is mapped $\{$N,Y$\}\!\to\!\{0,1\}$.

Concatenation yields a $17$-dimensional design matrix used identically by every model reported here.

Stacked generalisation [25] improves on a single learner when the base learners make different mistakes. Diversity is therefore the design objective, not accuracy of the individual components. Credit data is mixed-type, moderately imbalanced, and contains both broad monotone trends (higher repayment burden, higher risk) and sharp local interactions (a marginal grade combined with short tenure). We assemble learners whose inductive biases cover that range.

Multi-scale gradient boosting. Rather than four tuned variants of the same configuration, we deliberately spread the learners across the depth–shrinkage plane. A deep XGBoost (depth $8$, $\eta=0.02$, $500$ trees) captures high-order interactions. A shallow XGBoost (depth $3$, $\eta=0.05$, $300$ trees) acts as a low-variance anchor that represents global monotone structure. LightGBM’s leaf-wise growth [22] concentrates capacity on high-gradient regions, improving coverage of sparse segments. CatBoost’s ordered boosting [23] reduces target leakage in categorical splits, which matters for the one-hot grade and intent blocks. Hyperparameters are given in Table II.

Residual network. Tree learners approximate smooth functions with staircases. The fifth base learner is a residual MLP over the scaled numeric manifold: dense layers of $512$ and $256$ units, a residual block expanding back to $512$ with an identity skip [26], then $128$ and $64$ units before a sigmoid output. It contributes a smooth approximator whose errors are, by construction, poorly correlated with the trees’.

Every base learner absorbs the class imbalance before stacking, so that the meta-learner receives comparably scaled signals. The boosting models use

$$w_{+}\;=\;\frac{1-\pi}{\pi}\;=\;\frac{1-0.2182}{0.2182}\;\approx\;3.58,$$

(1)

with $\pi$ the training default rate. The neural components use focal loss [29],

$$\mathcal{L}_{\mathrm{focal}}(p_{t})\;=\;-\,\alpha_{t}\,(1-p_{t})^{\gamma}\log p_{t},$$

(2)

with $\alpha=0.25$ for the positive class, $0.75$ otherwise, and $\gamma=2.0$. Focal loss down-weights the abundant easy negatives and concentrates gradient on the hard positives, which is the behaviour we want when defaults are the minority and the expensive error.

Training a meta-learner on in-sample base predictions leaks the target: the base models are overconfident on data they memorised, and the meta-learner learns to trust that overconfidence. We avoid this with the standard out-of-fold construction, illustrated in Fig. 2.

Let $\mathcal{D}_{\mathrm{tr}}$ be partitioned into five stratified folds $\{\mathcal{F}_{k}\}_{k=1}^{5}$. For each base learner $m$ and fold $k$ we refit on $\mathcal{D}_{\mathrm{tr}}\setminus\mathcal{F}_{k}$ and score $\mathcal{F}_{k}$:

$$Z_{i,m}\;=\;\hat{p}_{m}^{(-k(i))}\!\left(\mathbf{x}_{i}\right),\qquad i\in\mathcal{F}_{k(i)},$$

(3)

where $k(i)$ is the fold containing sample $i$. The result is a meta-feature matrix $Z\in\mathbb{R}^{26064\times 5}$ in which every entry is an honest held-out probability. Test meta-features average the five fold-models,

$$Z^{\mathrm{te}}_{i,m}\;=\;\frac{1}{5}\sum_{k=1}^{5}\hat{p}_{m}^{(-k)}\!\left(\mathbf{x}_{i}\right),$$

(4)

which also reduces variance relative to any single refit.

The meta-learner is deliberately small: with only five inputs, capacity is a liability. It maps $5\to 32\to 16\to 1$ with Swish activations [33], $L_{2}$ penalty $10^{-4}$, batch normalisation [31] after each hidden layer, and dropout $0.2$ [32] after the first. Optimisation uses Adam [30] at $10^{-3}$ with focal loss, plateau-triggered learning-rate halving (factor $0.5$, patience $5$, floor $10^{-6}$) and early stopping on validation ROC-AUC (patience $10$, best weights restored). The narrow $32\!\to\!16$ bottleneck forces compact combination rules; batch normalisation stabilises training on the strongly correlated meta-features.

Monitoring ROC-AUC rather than loss is a deliberate choice under imbalance: validation loss can improve while ranking quality degrades, and ranking is what the downstream threshold consumes.

A $0.5$ cut-off is inappropriate at a $21.8\%$ base rate. We select

$$\tau^{\star}\;=\;\arg\max_{\tau}\;\frac{2\,\mathrm{Prec}(\tau)\,\mathrm{Rec}(\tau)}{\mathrm{Prec}(\tau)+\mathrm{Rec}(\tau)}$$

(5)

on training data, giving $\tau^{\star}=0.362$ for the ensemble, and apply it unchanged to the test partition. We stress in Section VIII that $F_{1}$ is a convenient but economically arbitrary criterion, and that the choice of $\tau$ matters more to realised cost than the choice of model.

SHAP. Because the ensemble is a composition of five heterogeneous learners and a network, no model-specific fast path applies. We wrap the entire pipeline (base scoring, stacking, meta-learner) in a single callable and explain that, using a permutation explainer with a $200$-sample background drawn from training data. Attributions are computed for $100$ test instances, giving $\Phi\in\mathbb{R}^{100\times 17}$. Explaining the composition rather than a component is the methodologically important part: attributions taken from one base learner would describe a model that is not the one making the decision. Global importance is $\bar{\phi}_{j}=\frac{1}{n}\sum_{i}|\phi_{ij}|$.

LIME. For each of $50$ test instances we fit a proximity-weighted sparse linear surrogate on perturbed neighbours,

	$\displaystyle g^{\ast}$	$\displaystyle=\arg\min_{g\in\mathcal{G}}\;\sum_{z}\pi_{\mathbf{x}}(z)\bigl(f(z)-g(z)\bigr)^{2}+\Omega(g),$		(6)
	$\displaystyle\pi_{\mathbf{x}}(z)$	$\displaystyle=\exp\!\bigl(-\lVert z-\mathbf{x}\rVert^{2}/\sigma^{2}\bigr),$

and take the surrogate coefficients as local importances.

Fusion. SHAP and LIME scores are min–max normalised to a common scale, $\tilde{\phi}_{j}$ and $\tilde{\lambda}_{j}$, and averaged, $\bar{a}_{j}=\tfrac{1}{2}(\tilde{\phi}_{j}+\tilde{\lambda}_{j})$. The intent is that consensus suppresses method-specific artefacts. Section IX examines whether the two methods agree enough for this averaging to be meaningful.

The narrative layer uses microsoft/phi-2, a 2.7B-parameter decoder-only transformer [45], loaded in float32 with left-side padding. Model choice is driven by deployment constraints: narrative generation is an inference-time cost per application, and a 2.7B model runs on the same commodity hardware as the scoring service.

The prompt is deliberately impoverished. It contains the predicted probability, a discretised risk band (high/moderate/low), the raw applicant profile, the top four fused drivers with signed impacts, the five globally most important features, and the three most sensitive features. It instructs the model to write two to three sentences, to reference at least three named features, to describe how they change risk, and to avoid both jargon and numerals. Decoding is greedy (do_sample=False, repetition_penalty=1.05). The full template is reproduced in the appendix.

Every control here is an input-side control. Nothing in the design inspects the generated text. This is the standard configuration in the literature, and Section X is an argument that it is insufficient.

Accuracy is excluded. At a $21.8\%$ default rate a constant non-default predictor achieves $78\%$ accuracy while providing no risk discrimination, so accuracy would reward exactly the behaviour we need to detect. We report ROC-AUC for threshold-free ranking quality, PR-AUC for behaviour on the minority class, and $F_{1}$, precision, recall and specificity at the selected operating point. Section VIII adds a cost-weighted view.

Point estimates without intervals invite over-reading of small differences. We report a $95\%$ confidence interval for every AUC using the Hanley–McNeil variance approximation [42],

$$\begin{split}\widehat{\mathrm{Var}}(A)=\frac{1}{n_{+}n_{-}}\Bigl[\,&A(1-A)+(n_{+}-1)(Q_{1}-A^{2})\\[-1.0pt] &+\,(n_{-}-1)(Q_{2}-A^{2})\Bigr],\end{split}$$

(7)

with $Q_{1}=A/(2-A)$ and $Q_{2}=2A^{2}/(1+A)$, and Wilson score intervals [44] for recall, precision and specificity, which behave correctly near the boundary where the normal approximation does not.

For the ensemble-versus-baseline comparison the correct instrument is a correlated test such as DeLong’s [43], which requires the paired score vectors. Those were not retained by the original experiment. We therefore compute the $z$ statistic under the assumption that the two AUCs are independent. Since predictions on a shared test set are strongly positively correlated, and $\mathrm{Var}(A_{1}-A_{2})=\sigma_{1}^{2}+\sigma_{2}^{2}-2\rho\sigma_{1}\sigma_{2}$ decreases in $\rho$, this inflates the standard error and understates significance. Any conclusion that survives it would survive the correct test. We report the sensitivity to $\rho$ explicitly rather than quietly assuming a favourable value.

Experiments ran on Windows 11 with an Intel Core Ultra 9 275HX (24 cores), 32 GB RAM, and GPU acceleration, under Python 3.10.13 with NumPy 1.26, pandas 2.1, SciPy 1.11, scikit-learn 1.4, XGBoost 2.0, LightGBM 4.0, CatBoost 1.2, TensorFlow 2.15, PyTorch 2.0 with pytorch-tabnet 4.0, SHAP 0.45 and LIME 0.2. A fixed seed, 5-fold stratified cross-validation and the $80/20$ stratified split are enforced throughout. Training and test tensors, fitted preprocessing objects, trained models and all metric artefacts are serialised; the analyses and figures in this paper are regenerated from those artefacts by released scripts.

Fig. 5 gives the global profile. loan_percent_income leads at $\bar{\phi}=0.0827$, followed by loan_grade ($0.0768$) and person_income ($0.0464$).

The interesting result is what is absent. In the L1-regularised logistic baseline, the largest positive coefficients belong to loan_percent_income, loan_int_rate and the bureau default flag. In the ensemble, loan_int_rate ranks twelfth ($0.0131$) and cb_person_default_on_file sixteenth of seventeen ($0.0020$).

This is not a contradiction, and it is not a defect. loan_grade is an internal rating that is itself a function of interest rate and bureau history: grade determines price. A linear model, unable to represent that dependence, must recover the signal from the constituent variables. The ensemble represents the composite directly and the constituents become redundant. The practical consequence is specific and easy to get wrong: a compliance narrative generated from ensemble attributions will not mention prior defaults, even though prior defaults demonstrably influence the outcome through the grade. An adverse-action notice that omits them may be accurate about the model and still misleading about the decision. Attribution to a feature is not attribution to a cause, and collinear composites make the gap operationally visible.

The earlier draft asserted that the top five features account for “almost $75\%$” of attribution mass. Recomputed from the stored SHAP matrix, the figure is $67.4\%$; eight of seventeen features are required to reach $80\%$. Locally the picture is similar: the median instance requires six features to account for $80\%$ of its own $|\phi|$ mass (IQR $5$–$6$).

This matters directly for the narrative layer, which is handed only the top four drivers. Averaged over the explained instances, those four carry $72.3\%$ of an instance’s attribution mass, so the prompt discards more than a quarter of the evidence before the language model sees it. The truncation is a defensible engineering choice, since shorter prompts are easier to constrain, but it is a lossy summary and the residual is not negligible.

Two agreement questions are often conflated. They have different answers here.

Across base learners, agreement is genuinely high (Fig. 6). Mean pairwise overlap@10 is $0.860$ and mean Kendall $\tau$ is $0.776$; loan_grade and loan_percent_income appear in all five learners’ top three, and seven features appear in all five top-ten lists. Disagreement is concentrated in low-frequency one-hot levels: loan_intent_VENTURE has a coefficient of variation of $0.833$ across learners, cb_person_default_on_file $0.695$. So the claim that the ensemble’s headline drivers are architecture-independent is supported.

Across attribution methods, agreement is weaker than the framework assumes (Fig. 7). SHAP and LIME share $8$ of $10$ top features (overlap@10 $=0.80$), but rank correlation on the common set is only $\tau=0.429$ ($p=0.179$), Spearman $\rho=0.524$ ($p=0.183$), neither significant at $n=8$. Overlap@3 is $1/3$. LIME’s top-ranked feature, person_home_ownership_OWN, is eleventh under SHAP; SHAP’s top feature is LIME’s third.

Hypothesis H4 as originally stated, namely that SHAP and LIME show high agreement on top features and that their combination is therefore more robust, is supported for membership and unsupported for ordering. This is a material qualification, because the fusion step averages normalised scores and then truncates to the top four. Averaging two rankings that disagree on order produces a third ranking that is not the consensus of anything; it is an artefact of the normalisation. Where the methods agree on the set but not the order, a set-level fusion (intersection or union with equal weight) would be more defensible than a score-level average.

A narrative asserts direction: it says a factor raised or lowered risk. That proposition is only meaningful if the attribution’s sign is stable enough to support it. Fig. 8(a) measures this as the share of explained instances on which each feature takes its modal sign.

The results are uneven. loan_percent_income and loan_intent_VENTURE take a consistent sign on $79\%$ of instances and loan_grade on $76\%$, high but not decisive. person_income sits at $0.53$, statistically indistinguishable from a coin flip; loan_amnt at $0.59$; person_home_ownership_RENT at $0.63$.

Some of this is legitimate interaction: income raises risk when paired with a large principal and lowers it otherwise, and a model that captures that is doing its job. But it has a consequence the framework must respect. Any statement of the form “the applicant’s income increased their risk” is a claim about one instance that cannot be generalised, and the fusion step, which averages normalised magnitudes and discards sign, provides the language model with no signal about how reliable the direction is. Fig. 8(b) sharpens the point: person_income is the input to which the ensemble’s output is most sensitive ($\overline{|\Delta\hat{p}|}=0.0356$) and simultaneously the one whose attribution direction is least stable.

This is the mechanism we see fail in the next section.

The pipeline’s grounding argument is entirely structural: the prompt contains only computed drivers, the model is told to translate rather than infer, and decoding is deterministic. Determinism is not fidelity. A greedy decode produces the same output every time; it does not produce a correct one.

We therefore define a minimal post-generation audit. Given an instance with fused drivers $\{(j,\bar{a}_{j})\}$ and generated narrative $y$:

• •

  Membership. Every feature named in $y$ must appear in the driver set supplied in the prompt.

• •

  Direction. For every named feature, the direction asserted in $y$ (raises / lowers risk) must match $\operatorname{sign}(\bar{a}_{j})$.

• •

  Coverage. The prompt’s top driver by $|\bar{a}_{j}|$ should be named.

These are necessary conditions, not sufficient ones, and they are cheap: all three are checkable automatically against data already in memory.

Table V reports the audit on the worked case distributed with the reference implementation: an applicant aged $34$, income $92,000, renting, requesting $92,000 for a stated venture purpose at grade B and $13.5\%$, with no bureau default. The ensemble returns $\hat{p}=0.9402$, band high.

The generated narrative reads:

“The risk level for this borrower is high due to their age, income, and home ownership status. Their intent to take out a venture loan also increases the risk. This case is similar to other high-risk cases in terms of income and home ownership status. However, the intent to take out a venture loan is a unique factor that sets this case apart. Based on these factors, it is recommended to closely monitor this borrower’s credit history and consider additional risk mitigation measures.”

It is fluent, appropriately hedged, correctly identifies the risk band, and would pass casual review. It is also wrong in a specific and consequential way.

Three failures are visible in Table V:

1. 1.

   Sign inversion. The narrative asserts that age, income and venture intent increase risk. The attributions score all three as risk-reducing ($-0.0092$, $-0.0569$, $-0.0720$). The model did not misjudge magnitude; it reversed direction, and did so for the majority of the features it chose to name.

2. 2.

   Coverage failure. The dominant driver, loan_amnt at $+0.3297$, is never mentioned. It carries roughly three times the next largest impact and is the one factor that plainly explains a $94\%$ default probability on a loan equal to annual income.

3. 3.

   Membership violation. person_age is asserted as a risk factor although it was not among the four drivers supplied.

The narrative additionally attributes salience to venture intent (“a unique factor that sets this case apart”) that the evidence assigns to principal size.

Three properties of the surrounding system make this outcome likely rather than accidental.

The prompt discards sign reliability. Fusion averages normalised magnitudes. The language model receives a signed impact but nothing about how stable that sign is, and Section IX shows that for person_income it is barely stable at all ($0.53$).

Prior knowledge overrides supplied evidence. A 2.7B model has strong priors about credit: high income is good, venture lending is speculative, young borrowers are risky. When the supplied attributions contradict those priors, as they do here since this applicant’s income and stated purpose reduce risk relative to the population, the prior wins. The instruction to translate rather than infer does not bind.

Nothing checks the output. Every control is upstream. The system has no mechanism that could have caught a sign inversion, which is why a deterministic decode produced a reproducibly wrong narrative rather than an occasionally wrong one.

We are explicit about what this is and is not. It is a documented, reproducible failure of a specific model under a specific prompt on a specific instance, verified against the attributions supplied in the same run. It is not an estimate of failure frequency: producing one would require generating and adjudicating narratives across a labelled sample, which is future work we describe in Section XIII. A single audited failure cannot establish a rate. It is, however, sufficient to refute the claim the earlier draft made, that the narratives “accurately reflect the underlying feature contributions”, and sufficient to establish that input-side constraints alone do not guarantee grounding.

Our recommendation follows directly from the audit definition: the three checks above are cheap, automatic, and would have blocked this output. A narrative layer in a regulated setting should run them and fall back to a deterministic template when they fail. This is the two-stage generate-then-verify pattern argued for in [12], and our result is a concrete instance of why the second stage is not optional.

Read together, our results describe a system whose two halves succeed differently.

The predictive half works, modestly. Multi-scale stacking beats the best single model by a margin that survives a deliberately unfavourable significance test, generalises without overfitting despite six trainable components, and improves PR-AUC by more than it improves ROC-AUC, which is the right direction under imbalance. But its operational advantage at the deployed threshold is six defaults in six thousand decisions. An institution weighing five base learners, a meta-network and the attendant governance burden against a single random forest should know that number before committing.

The explanatory half is where the interesting failure is, and it is not where the literature usually looks. The attribution layer is sound in construction: explaining the composed pipeline rather than a component is the right choice, and cross-learner agreement confirms the headline drivers are not artefacts. What breaks is the last step, the one added specifically to make the system usable by non-specialists. That step inherits every instability upstream of it (diffuse attribution, unstable signs, method disagreement on ordering), compresses them into four numbers, and hands them to a model with strong independent priors and no obligation to defer.

Three points generalise beyond this system.

Constrained prompting is a necessary but not sufficient control. Our prompt does everything the literature recommends. It still produced sign inversions. The reason is structural: prompt constraints shape the input distribution and cannot bind the output. Any deployment that treats prompt design as the safety mechanism is relying on a control that has no enforcement.

Verification is cheap and should be mandatory. Membership, direction and coverage checks require no model calls, no labels and no human review. They would have blocked our failure case. In a regulated setting, an unverified narrative is a liability whose cost is bounded by the size of the credit decision, and the check costs microseconds.

Explanation quality inherits attribution quality. A narrative cannot be more faithful than the attributions it summarises. Reporting sign stability and inter-method rank agreement alongside importance rankings should be standard, because these properties, not mean $|\phi|$, determine whether a directional claim about an individual applicant is supportable.

For practitioners building similar systems, our results suggest an ordering of effort that differs from the one we followed. Calibrate before deploying, since miscalibrated probabilities corrupt both pricing and the risk bands that reach human reviewers, and the fix is a single held-out fold. Optimise the threshold against an explicit cost ratio rather than $F_{1}$; Fig. 4 indicates this matters more than the choice among strong models. Verify narratives after generation. And treat additional base learners as the last resort rather than the first, since our fifth learner bought less than our threshold choice did.