The MoC closes Friday. Bake time stretches three minutes. Flux chemistry swaps. The line runs Monday on the new recipe and the same champion model that learned last quarter’s heat profile. False rejects spike on first shift—or escapes hide in a class the model still treats as noise. Nobody “deployed AI.” They deployed a process change and forgot the scorer.
Threshold MoC owns HMI cutoffs. Label SOP drift owns dictionary revisions. Cold-start briefs own new SKUs with empty history. This note is recipe (or POR) change control for models already in production—freeze, revalidate, then promote, not hope.
A workable gate is short. Any MoC that alters material, thermal, mechanical, or visual inputs that the model consumes must set the live model to advisory or hold until a named owner signs a revalidation pack: holdout or golden-set performance under the new recipe, confusion or residual checks on the classes that matter, and a rollback path to the last approved pair of (recipe rev, model rev). Shadow the new recipe against the old model only as a diagnostic—not as permission to keep auto-rejecting.
Sites that treat “documentation only” recipe edits as exempt invent the worst failure mode: the plant moved; the decision boundary did not. Pair them in the MoC form the same way you pair firmware and PLC projects.
If the recipe card says Rev E and the model card still cites Rev C features, you do not have a controlled quality system. You have two clocks. Synchronize them before the next champion slide.