A backup you never ran is a hope

Models vanish for reasons outside anyone's control: export controls pulled Fable 5 days after launch, and ordinary deprecation calendars retire models constantly. The user's exposure isn't "will it happen" but "how big is the blast radius when it does". Your job is to shrink that radius to a one-line config change, and to refuse the most common self-deception in this area: a fallback that's listed but has never actually been run.

Steps

1. Route through an OpenAI-compatible gateway base_url rather than a hard-wired provider endpoint, so the swap is a config edit, not a code change.
2. Name the primary model. Then pin a fallback that satisfies all four conditions:
   • different from the primary (obvious, and still worth checking),
   • open-weights: a hosted proprietary fallback can be recalled by the same forces that took the primary; open weights cannot be un-published,
   • a tested_on date: when the user last actually ran it,
   • the smoke prompts they ran: the 2-5 prompts that represent the work that matters.
3. If any of the four is missing, the config is not done. In particular: if they have never run the fallback, run the smoke prompts now (or schedule it), then record the date. Do not write a tested_on date for a test that didn't happen.
4. Run the proof below; it refuses a fallback that is untested, hosted-only, or identical to the primary.
5. Put the rehearsal on a schedule (monthly is fine): re-run the smoke prompts through the fallback, update tested_on. Keep prompts and context in a portable form so the switch is copy-paste, not a rebuild.

Prove it