Retire the model only after its consumers and delayed work migrate

Inventory endpoint callers, model aliases, explicitly pinned versions, batch configurations, notebooks promoted into jobs, offline feature builders, and services that consume the model's outputs as features. Record owners, compatibility contracts, traffic schedules, and maximum work durations. A new model can preserve its output shape while changing class order, units, calibration, or score meaning, so consumer migration includes semantic compatibility. Historical logs can reveal callers absent from an ownership list, but observing no recent traffic does not prove a monthly or rarely triggered workflow has disappeared.

Registry aliases provide indirection, not universal invalidation. A process that loaded an artifact can retain it until its next reload or restart, while another caller may bypass the alias with an explicit version. Log the resolved artifact identity at execution time and verify the deployed consumer configuration. TensorFlow Serving version policies and labels illustrate that serving selection is a separate configuration surface from a training registry. Updating one control plane does not establish that every endpoint, worker, scheduled job, and cached client has transitioned.

Stop admitting new work to the old version, then track in-flight requests, retry queues, asynchronous workflows, and scheduled jobs under explicit bounds. Measure terminal completions rather than assuming a routing change canceled work already accepted. A conservative artifact-retention rule can combine the latest possible old-version work completion with a rollback interval, when the rollback interval is explicitly required after that completion. If timers overlap instead, a different maximum applies. State each time origin so adding durations does not hide an unsupported assumption about when obligations begin.

Serving artifacts, historical prediction records, and sensitive raw inputs can have different retention requirements. Keeping a prediction and its artifact identity may allow a delayed label join without retaining a live endpoint; reproducing the original computation may additionally require the immutable model, preprocessing, and environment. Specify which capability is required and keep only the data and artifacts needed under the applicable policy. If any old-version workflow has unbounded retries or unknown ownership, no finite arithmetic deadline proves complete retirement; resolve or explicitly terminate that dependency first.

Use resolved-version metrics and representative scheduled executions to verify migration, including rarely active consumers. Reconcile requests by version rather than relying on an endpoint's display name. Test how a consumer handles an unavailable old version and whether its fallback is semantically compatible. Preserve a retirement record containing the consumer inventory, migration evidence, final serving configuration, rollback decision, and artifact-retention policy. Monitor for old-version access after retirement so a forgotten caller becomes an observable migration failure rather than silently receiving a different model.

The queue instrument supplies a small draining analogy. Reset, set λ=0 and μ=2, predict that its initial backlog four reaches zero after two seconds, then take four Steps. Separately Reset, set λ=1 and μ=2, predict backlog two after two seconds, then take four Steps. The model recomputes from its initial backlog for each fixed rate pair; it does not preserve a history when controls change. It has no retries, consumer discovery, artifact aliases, or bounded-job proof. Reaching zero in this toy cannot certify that a real retired model has no hidden work.