Log sanitized reason instead of raw error; fail-closed scrub_url