Route around a provider outage

The current job description names a clear goal: no single provider outage causes user-visible degradation. A good design routes around a failing provider before most requests reach it.

Use several controls because they address different failures. Health routing avoids a provider that is already unhealthy. A circuit breaker stops new calls after repeated failures. A bounded retry can recover a brief error. A fallback list chooses another provider when the first one is unavailable. Health is only one routing condition. First filter routes by model capability, data policy, region, context limit and available capacity. Then choose among the eligible healthy routes. Track health by provider, model and region so a failure on one route does not remove every route from that provider.