The model outage your users never noticed

9:14 AM. Your primary model starts returning errors. Your app never finds out.

The app's AI calls go through a script in front of the gateway. The script catches the failed upstream call and retries the same request against the fallback model: same OpenAI-compatible shape, different model field. The response comes back a beat slower, tagged with a header so you can count how often it happens.

Failover logic usually lives in every call site, half-tested, or inside a vendor SDK you don't control. Here it's fifteen lines you wrote, in one place, covering every AI call your product makes.

You read about the outage at lunch; your users never did.