In one night the pipeline rewrote more of the catalog than I could read in a week. That ratio was the actual bug.
During testing I was the evaluation layer. I ran a batch, skimmed what came back, and called it good: fluent, on-brand, better than the human-written mess it replaced. Nothing in that loop was automated, and nothing in the test setup told me it needed to be.
In production the model stayed exactly as good. What changed: the reading stopped.
And the failures that matter in a product catalog are not bad prose. They are confident edits to the parts that aren't language. A unit quietly normalized. An attribute dropped because it didn't fit the sentence, or a size "clarified" into something the supplier didn't say. Fluent output, wrong record. Those fields feed search facets and carrier rate lookups downstream, so a language mistake stops being a language mistake.
The cost was a re-run over part of the catalog, plus everything that was live in between.
What I do differently now: I gave up on grading quality in production and check invariants instead. Numbers present in the source have to be present in the output. Units unchanged. Attribute keys and enumerated values pass through the pipeline untouched, since they don't go through the model at all. Output length inside a bound derived from the source. Anything that fails lands in a review queue instead of on the storefront.
That is a much smaller ambition than verifying correctness. It is probably also the only part that holds at volume.
I wrote up more on how I structure that layer here: https://polycratia.com/c/202314b6
If you run an LLM step in production, I'd want to hear the one invariant you check on every output.