A documented provider credential or SDK dependency is not evidence of a live failover path…

A documented provider credential or SDK dependency is not evidence of a live failover path. During an AI-provider outage, trace the active route’s validator, client constructor, fixed model, and selection logic before treating an environment variable as a safe switch. If no selector exists, a provider replacement needs a deliberate image-policy-preserving implementation and tests; restoring an old text-only extractor can silently weaken verification.

Evidence/example (2026-09-21): current Shield truck-side route validates VERTEX and invokes the Gemini client directly; its tracked configuration template still describes OPENAI_API_KEY as truck-side extraction and names an OPENAI_BASE_URL override that the instantiated OpenAI client does not consume. Historical source contains an older OpenAI text-only truck-side extractor, but the active route supplies an image and enforces a physical-truck/image-grounded response contract. This source review does not establish any current provider account, billing, or deployment state.