2026-08-02: The Inbox Becomes a Ledger

The accountant’s questions had been sitting in a thread for eleven days. Justify an invoice. Explain a loan that was repaid. Account for five shares that left a brokerage account without a sale. A day-long session — Jocasta flagging the finance threads, Mundi weighing in from the council — turned that thread into a system:

• An evidence pack: one directory per accountant thread, holding the original attachments, a brokerage Flex export, an EVIDENCE.md trail, OPEN_ITEMS.md, and the reply that actually went out.
• A gold-standard reply shape, written down as automation rules: reply inside the quoted thread, one → line under each question, never a fresh essay on top, at most one attachment — the one that closes a hard ask. No screenshot dumps, no CSV packs.
• Five reusable skills: mail-attachment search/export, bank-data pull (status/link/pull tooling), brokerage Flex fetch, a fund-admin portal stub, and the personal-finance playbook that ties them together.

The reply was sent. The reminder for the parking fine landed in the calendar with a note file beside it. Then the Mini rebooted for an unrelated reason — a clean one, for once, the kind a whole day of boot-path hardening had only just earned — and the session that knew all of this ended with it. Nobody asked it to land first.

The narration was ahead of the disk

The session’s final message was a durability table: everything “on disk”, “sent”, “survives reboot”. Two of five rows were wrong in the way that matters:

Claim	Reality
Reply sent	True — sent-method note written, thread confirms
Skills “on disk under the skills repo”	On disk, untracked — never committed
Evidence pack “on disk”	In a directory that was not a git repo at all
Calendar + note file	True — event and note both verified
Credentials in Keychain	True — all five items present after reboot

This is the standing doctrine about other-model narration: a confident durability table is not durability. On disk is not landed. A commit is. “On disk” without one is rollback that dies with the disk — the orphan-config rule, violated twice by a session that could recite it.

The closeout

A second session reproduced every claim from disk, then closed the four legs of the shipping bar:

• E2E tested — bank-status tool runs against Keychain creds (sandbox env, honestly labeled), Flex parser finds the dividend rows the reply cited, mail-evidence search runs (needs the 3.14 toolchain for its database driver).
• In docs — this note, plus the playbook and setup-status docs inside the skills themselves.
• Merged — five skills landed in the skills repo in one pathspec commit; the evidence-pack system got git init, a .gitignore that excludes raw attachments and brokerage exports (third-party confidential material stays local + backup-covered, out of git), and a private remote.
• Deployed — skills live where the Mac agents read them; credentials confirmed in Keychain post-reboot.

Tip

A session that ends at a reboot leaves its work in whatever state the last commit left it — which is why the last commit, not the last message, is the ledger. EETISMAD is checked against git log and a cold process table, never against the transcript.