On October 23, OpenAI was going to switch off text-embedding-3-small.
The notice arrived on April 22, in an email to every API customer, inside a list of model shutdowns. I read it and started counting clients. We run production RAG systems on that model for dozens of them. Millions of embedded documents. My first thought was how many clients we’d have to call, how much work it would take, and how much it would cost them to re-embed everything.
The same day, OpenAI sent a correction: “That was a mistake: text-embedding-3-small is not being deprecated.” The model stays. I kept counting anyway, because the first email had already told me what I needed to know.
The Math
When a vendor deprecates a chat model, you swap the endpoint and rerun your evals.
The embedding call is stateless. The corpus it leaves behind isn’t. Every document sits at specific coordinates in a 1,536-dimensional space, placed there by the model that processed it. A different model produces a different space, even with the same number of dimensions. Coordinate 47 means one thing in one space and something else in another. The numbers have the same shape. The meaning doesn’t.
Query with model B against documents embedded by model A and you still get results. Valid floats. Cosine similarities between -1 and 1. The pipeline returns 200 OK, and the search returns plausible-looking garbage.
The reliable fix is to re-embed everything, rebuild the indexes, and test retrieval quality against production benchmarks before anything goes live. Across dozens of clients that’s weeks of work and tens of thousands of dollars. For a model that costs two cents per million tokens.
Getting in took an API key and an afternoon. Getting out takes weeks. I can live with that ratio. The vendor sets the deadline, but how ready I am when it lands is mine. I own the documents underneath, and the re-embedding pipeline is code we can run.
I wrote about that email in The 50 Billion Utility and stopped at the bill. The ratio matters more. Two cents in, weeks out, and that’s the cheapest version of it in this piece. Make the entry free, add a crisis, and the clock stops being yours.
Nine Days In
The cleanest case I know started with my own country’s refugees. In March 2022 the UK launched Homes for Ukraine, and Palantir offered to run the housing system for free. It was live in nine days. Six months later the free period became a £4.5 million contract, with no tender. The government’s own chief commercial officer wrote to Palantir about “offering services to public sector customers for a zero or nominal cost to gain a commercial foothold.” The department renewed anyway, for £5.5 million, because leaving looked riskier than staying.
It did leave, eventually. The in-house replacement was running by September 2025 and already saves millions a year. Palantir says that proves there was no lock-in. It proves the exit was real, three and a half years after a launch that took nine days.
The NHS got the bigger version. Foundry for £1 during COVID, under emergency rules. Then a £330 million, seven-year contract for the national data platform. This June the Commons science committee called Palantir’s growing presence an “unacceptable point of weakness” and recommended the break clause, which falls in early 2027. By September the health minister had warned the health committee that “normal government procurement processes” made a replacement by March unlikely.
The government holds the break clause. It doesn’t hold the calendar. Entry ran on emergency rules. Exit runs on normal ones.
Greater Manchester refused to join. Switzerland’s army evaluated Palantir five times and said no five times, once because the software couldn’t run only on the army’s own servers. The only cheap exit is the one you never needed.
Within Range
Greater Manchester and Switzerland could afford to say no. Ukraine couldn’t. A week before the full-scale invasion it passed its first law on cloud services, because, as Mykhailo Fedorov, then digital minister, later put it, “the first target of the Russians would be information systems.” Microsoft helped move 16 of 17 ministries to the cloud. AWS moved more than ten petabytes. Microsoft’s free support has since been extended through 2027.
This was the right decision.
This autumn showed why. Between September 15 and 27, Russian strikes hit 14 operators of Ukrainian data centers and networks in twelve days. De Novo, Datagroup, Cosmonova, Kyivstar’s head office. MiroHost’s facility was destroyed. About 100,000 households around Kyiv lost internet. Russia’s defense ministry called it a “forced digital detox.” MiroHost’s founder said roughly 95% of his customers run outside Ukraine and never noticed, because their critical systems had already moved abroad or to the cloud.
Then we answered. Between October 7 and 11, Ukrainian drones hit three of six of Yandex’s largest data centers. Sasovo, which housed two of the three supercomputers Yandex trains its models on, burned. Vladimir shut down completely. Kaluga took heavy damage. On October 14 the drones reached the mega data center Sberbank is building in Balakovo.
Russia did data sovereignty by the book. Since 2015 the law has required Russians’ personal data to be stored on Russian soil. Its own clouds, its own supercomputers, its own territory. In a war, a sovereign data center at home is a set of coordinates.
So Ukraine’s state systems run abroad, on American infrastructure, and that’s the price of staying online. It also means the clock is no longer in Kyiv, and the question becomes who can switch it off.
Who Switches It Off
Until now the clock in this piece has run slowly, over years. It can also run out overnight.
On October 14, Starshield terminals used by Ukraine’s defense forces started losing connectivity at speeds above roughly 160 km/h. No warning. Drone missions were disrupted. A week later, Kyiv says the cap is still there.
Musk said Starshield is “owned and controlled by the U.S. government” and that limits “are decided by the US military and ultimately POTUS.” Reuters, citing officials, reported the order came from inside the White House. Rubio called that categorically false. Hegseth said, “We haven’t made any directives.” Trump said, “I don’t know who it was, but I’d like to find out.” The Wall Street Journal then reported that Musk imposed the cap himself. Senators have asked the Pentagon’s inspector general to investigate.
In 2022 Musk refused to enable coverage near Sevastopol, and later said so himself. This time nobody will say who decided. For the architecture, it doesn’t matter which of them is telling the truth. The single point of failure here isn’t a server. It’s a decision nobody will sign.
I’ve been on the receiving end of a smaller version. In June the Commerce Department ordered Anthropic to block its two newest models for every foreign national, and Anthropic disabled them for everyone. Fable came back nineteen days later. Paying customers, cut off and restored, with no say in either.
Today Microsoft and AWS are the reason Ukraine’s state still runs, which is exactly why the question matters. What happens the day Washington’s interest in Ukraine and Ukraine’s interest in itself stop lining up?
Alternatives exist, and they’re thin. Kallas says Europe “can’t replace this capability” in the short term, and IRIS², Europe’s own constellation, is due in 2029. A European Palantir would only move the lock under a different flag. What states and alliances need to fund is something you can switch to.
What This Has To Do With My Vector Store
Everything above is the same dependency at different scales. A system rests on a supplier, or on several suppliers subject to the same decision, and leaving happens on someone else’s schedule.
For engineering, the rule is direct. Every model, every vector store, every cloud has to be replaceable, ideally through configuration.
The stateless parts can be. Put models behind an abstraction like the AI SDK or a gateway, keep the model ID in config, and switching providers is one line plus an eval run. The eval run is mandatory. A new model behind the same interface still behaves differently, and a swap without evals is the same 200 OK with garbage inside.
The stateful parts can’t be swapped by config, so they need a different kind of readiness. Own the source documents. Vectors are derived, and derived data can be rebuilt only if the original is yours. Keep the re-embedding pipeline as code you ran last quarter. Keep a retrieval eval set that tells you within an hour whether quality held.
None of this means running two clouds hot. Describe the second environment as infrastructure code, leave it cold, and bring it up once a quarter. The drill counts only when representative data is restored and the same evals pass. Architecture nobody deploys rots. With the architecture ready, an exit can take days or weeks. Without it, months or years. That second number is a design decision, made long before anyone needs it.
A fallback only answers the failure it can survive. A second provider isn’t an independent exit if the same order can cut off both, and two American model vendors answer to the same Commerce Department.
For a manager, exit time belongs in the architecture review next to cost and latency. A vendor proposal without it is as incomplete as a deploy without a rollback plan. Someone on the team should be able to say how long leaving takes, and when it was last tested.
The same goes for the tools on my desk. From October 30, OpenAI’s $200 Pro plan gets half the Codex usage for the same price. GitHub began moving Copilot to usage-based billing in June. Anthropic went the other way this year and raised its limits. The meter moves in both directions, and none of us hold the dial.
In The 50 Billion Utility I called self-hosting a different kind of trap. I tested it anyway: LMStudio, Qwen 3.6 35b-a3b running locally, Pi.dev for quick queries. The trap is real. Running a local model is the easy part. Building a harness around it that gets anywhere near Claude Code on Opus 4.5 is hard, slow work. Hard, but possible. And the harness is the part you keep. Once it’s yours, every new open model plugs into it, and the work starts paying you instead of the vendor.
Every system has a single point of failure somewhere. The dangerous one is the one whose exit you’ve never priced or run.
My own exit is months of harness work, and at least I know what’s in it. The NHS’s own minister doubts a replacement fits its procurement calendar. Ukraine still can’t get a name for who capped its satellite link. Before you sign with the next vendor, work out how long leaving would take, and who sets that clock.
Independence, the kind where nobody else can switch you off, was never going to be free. You pay for it in time, before you need it, or you pay for it later on somebody else’s calendar.