Lighting-drift briefs already warn that lamps age and that auto-exposure on the HMI can hide it. Gold-set gates catch label and weight regression. This failure mode sits one layer deeper in the stack: the image signal processor (ISP) between the sensor and the bytes your model was trained on.
Modern smart cameras and embedded vision SoCs run black-level correction, lens shading, demosaic, color-correction matrices, gamma, sharpening, 2D/3D noise reduction, auto-exposure, and auto white balance before a JPEG or raw-ish frame ever reaches inference. Vendor IQ profiles and firmware bundles retune those blocks. After an OTA or a “stability” package, mean brightness, color temperature, and edge texture can shift enough to move defect scores even when the mechanical cell and the ONNX file are untouched. Plants that version only the model hash and ignore camera firmware, ISP binary, and AE/AWB mode are measuring the wrong configuration item.
Treat camera firmware and ISP/IQ profile IDs as controlled inputs beside model version. Prefer locked exposure, gain, and white balance for metrology-grade inspection; if AE must stay on, freeze target brightness and document anti-flicker. After any camera, lens, filter, or firmware change, re-score the sealed gold set and a short live sample before the station is allowed to reject. Disable silent OEM update channels on production units the same way you would block unapproved PLC firmware.
When false rejects spike overnight and “nobody changed the model,” ask who patched the camera. The pixels may have moved without a commit in the ML repo.