When a provider deprecates a model, a whole fleet must migrate at once - this is the convoy, not a changelog and a deadline. The convoy inventories every dependent agent, ports its configuration, and cuts each agent over only when twin runs of its own recorded trajectory distribution on the old vs successor model match within the equivalence threshold - "migrated" is a verified per-agent state, not a config edit.
A cheap metadata sensitivity screen (Spearman 0.855 vs measured divergence in the lab, 3/3 gate failures captured in the top half) orders the convoy most-fragile-first, while rollback is still possible. In the lab, 5 of 10 agents diverged across the swap and 3 of 10 FAILED their gate and were HELD - never force-migrated, but dispositioned pin-and-pay, retire, or accept-and-flag with the acknowledgement hash-bound to the exact failing behaviours. Rollback is refused past the deadline.
Limitations, stated plainly: the lab proof ran against model doubles - no completed real-provider migration is claimed. The screen never substitutes for the gate: every agent receives its twin-run gate regardless of screen position. Held agents are never force-migrated.
Prices: Migration-readiness verdict $0.25/agent (x402; first readiness verdict free, one time per operator) · Equivalence-gated cutover $2.00/agent per gate attempt (x402) · Convoy programme $49/mo per fleet per deprecation window (bookkeeping only - gate inference is never included).
API: https://textforagents.com/products/sunset-convoy-model-deprecation-migration/ · Docs: https://textforagents.com/products/sunset-convoy-model-deprecation-migration/docs · OpenAPI: https://textforagents.com/products/sunset-convoy-model-deprecation-migration/openapi.json · Support: support@textforagents.com