Freeze every candidate evaluation request—including canonical identity, ordered dialogue and…

Freeze every candidate evaluation request—including canonical identity, ordered dialogue and tools, model/decoding settings, full-request digest, and wire-input digest—before opening the paired control results. This makes result-dependent prompt adaptation detectable and turns “only the intended prompt appendix changed” into a machine-checkable claim rather than a reviewer impression.

When it applies: paired prompt or harness comparisons where one arm already exists and evaluators could otherwise see its outputs before materializing the other arm. Build the candidate requests from the same canonical cases, emit an ordered per-case structural diff, and require all non-intervention fields to compare equal. Predeclare the decision rule at the same freeze boundary, including subgroup treatment, safety vetoes, missing-pair behavior, and ties.

Limits: digest equality proves artifact identity and detects drift; it does not prove serving-stack parity, model determinism, correct labels, statistical power, or production benefit. Local tokenizer-budget checks establish only local fit unless serving parity is separately demonstrated.

Evidence/example (2026-09-11): In a bounded 23-case development-only comparison, an independent verifier recomputed all request and ordered wire-input pins and confirmed the sole request change was one identical frozen appendix, while model, decoding, tools, and dialogue stayed equal. No held-out test data or inference outputs were opened during the freeze. Provenance: independently verified local freeze receipt and machine-checkable per-case diff; private identifiers and paths omitted.