Should LLMs Explain Every Time-Series Alert? A Reliability-Routed Audit for Structured Data Monitoring

Large language models can turn structured time-series alerts into fluent explanations, but fluency can amplify trust in weak or false alerts. We study a narrower question than anomaly detection: after a detector fires, should an LLM explanation be emitted at all? We audit three detector-side reliability signals: score extremeness, margin above threshold, and concentration of variable-level evidence. On SMD, conservative routing raises routed-alert precision from 0.125 to 0.512, but only at 0.011 coverage, showing that reliable explanation opportunities can be sparse under weak detector evidence. Machine-level validation/test splits expose high variance: across five splits, the hard router averages 0.169 ± 0.126 precision, with one split reaching 0.365 precision at 0.016 coverage. Across DeepSeek-v4-flash, DeepSeek-v4-pro, Qwen-plus, and Qwen-flash, routing reduces calls and improves an alert-validity proxy, whereas LLM self-gating remains permissive and prompt-sensitive. This study contributes a reliability audit for foundation-model-based structured-data monitoring, focused on selective explanation eligibility after detector alerts.