Pin every model choice to an exact artifact instead of a floating alias, keep a frozen probe set per component, shadow-run each release before users meet it, and compare trajectories rather than scores — because a score delta stays flat while behaviour moves. Pin the runtime alongside the model. Use when a system's behaviour changes with no commit, before or during a model migration, when deciding whether a new release is safe to adopt, or when per-component model choices have never been revisited.
