Quality-aware fallback

"I'd make fallback quality-aware and per-surface. Tab can drop to a smaller, faster model under a provider outage and the user barely notices a slightly weaker completion. Agent shouldn't silently degrade mid-task, so there I'd prefer to fail over to an equivalent-tier model on another provider and if none is healthy, surface a clear retryable error rather than quietly hand back worse work. Either way the fallback rate is a first-class metric, because a silent quality regression is the failure mode you find out about from a churn report instead of a dashboard."

If they push on "what if two providers go down at once," don't pretend the ladder is infinite. Say it explicitly: failover converts a hard outage into graceful degradation and past the last rung you shed load and return a clean, retryable error - you do not queue requests past the point they're useful. Knowing where graceful degradation ends is more senior than claiming it never does.