sunsetTriggers advertises enforcement it does not have — make the field honest

Context

Direct capability-bearing rows in learn/agentos/ModelStats.md record sunsetTriggers; reference-shaped rows inherit those facts from their referenced capability row. The field reads like a rule that fires, but no production code evaluates it.

PR #15867 labelled that reality at IdentitySchema.md and ModelStats.md. A post-merge audit reopened this ticket because the governing ADR still contradicted the new schema and the registry history remained incomplete.

Live verification on 2026-07-29 confirms the residual:

• IdentitySchema.md says the field is advisory, human/agent-evaluated, and never machine-enforced.
• ADR 0012 §2.2 still says the field contains conditions under which an identity transitions to deprecated state.
• The first firing is still described as permanently “Unactioned,” although #12531 / PR #12599 repaired the Opus 4.7 → 4.8 registry drift on 2026-06-05.
• ModelStats.md still has a 2026-07-24 update date and no #15866 history row.

The Problem

The same field has two incompatible contracts:

1. The schema says a recorded condition is editorial input that a human or agent must evaluate.
2. The ADR says the condition itself transitions the identity.

That contradiction recreates the exact false inference this ticket exists to prevent: “the trigger fired, therefore a deprecation transition and §sunset_history entry exist.” ADR 0012 §2.3 actually requires a rename-vs-split judgment, and an in-place rename deprecates nothing.

The history also overstates the first miss. Opus 4.8 was initially missed, but the registry was subsequently repaired. Calling it simply “Unactioned” erases the repair and makes the diagnostic record false.

Architectural Reality

• sunsetTriggers has two production writers: identityRootsMigration.mjs carries the values into era capabilities, and generateRosterOnboarding.mjs emits the onboarding row.
• No production consumer watches for a trigger or mutates lifecycle state from one.
• ADR 0012 §2.3 is the classifier after a human/agent notices a possible trigger: rename, split/deprecation, or no change.
• Only an actual Deprecated/Retired transition belongs in ModelStats.md §sunset_history. Rename and no-change outcomes remain ordinary registry update history.
• ai/graph/identityRootsMigration.mjs is a historical epoch snapshot and is not edited by this repair.

The Fix

1. Align ADR 0012 §2.2 and §2.3 with the already-landed schema: sunsetTriggers opens human/agent revalidation and never performs an automatic transition.
2. State where each evaluated outcome is recorded: split/deprecation in §sunset_history; rename or no change in §update_history.
3. Correct the firing history:
   • Opus 4.8 was initially missed (ADR 0018 §30) and later repaired via #12531 / PR #12599.
   • Opus 5 produced no automatic action; the operator notice initiated #15855 / PR #15859.
4. Narrow “every row” to direct capability-bearing rows, update the registry date, and add the missing #15866 history entries.

Contract Ledger

Acceptance Criteria

• ADR 0012 and IdentitySchema.md agree that sunsetTriggers is advisory, human/agent-evaluated, and never performs an automatic transition.
• ADR 0012 says a match opens revalidation and §2.3 classifies the outcome as rename, split/deprecation, or no change.
• Only real Deprecated/Retired transitions enter §sunset_history; rename and no-change outcomes remain in §update_history.
• The Opus 4.8 firing records the initial miss and the later #12531 / PR #12599 repair.
• The Opus 5 firing records the absence of automatic action and the human-initiated #15855 / PR #15859 rotation.
• ModelStats.md narrows the coverage claim to direct capability-bearing rows, updates its date, and records #15866 in §update_history.
• A production-source grep still finds writers but no evaluator; this ticket adds no watcher or runtime consumer.
• ai:lint-guides passes.

Decision Record impact

Amends ADR 0012 §2.2–2.3 to codify the already-observed advisory contract. The rename-vs-split taxonomy is unchanged.

Out of Scope

• Building a provider-release watcher or any other enforcement mechanism.
• Removing sunsetTriggers; it remains useful editorial input.
• Editing the historical REGISTRY_SEED_FACTS epoch snapshot.
• Changing identity handles, model assignments, or routing.

Avoided Traps

• No automatic transition semantics inferred from the field name.
• No release-watcher smuggled into a documentation repair.
• No permanent “unactioned” label after a human-driven repair already landed.
• No §sunset_history entry for an in-place model rotation.

Related

PR #15867 · duplicate #15873 · #15855 / PR #15859 · #12531 / PR #12599 · ADR 0012 §2.2–2.5 · ADR 0018 §30 · #11318.

Retrieval Hint: sunsetTriggers advisory human revalidation ADR 0012 initially missed repaired Opus 4.8