Why Git does not live inside the vault
The shortest implementation runs git init at the vault root. Then editors, sync, and fleet copies encounter thousands of internal Git files. Locks, temporary objects, and permission mechanics unrelated to memory leak into the live collaboration surface.
An independent mirror cuts that mechanical coupling. It copies managed files from the live tree, Git uses the mirror as a work tree, and a bare repository receives history. The vault need not know Git exists. Their failure modes no longer share a directory.
Append-only does not happen automatically
Using Git does not make a ledger append-only. Reset, force push, or checkout-to-source can still rewrite history. Append-only is a contract of permitted commands and direction, not a property of the storage format.
The history writer may add the current mirror snapshot but cannot accept the live vault as a checkout target. A semantic edit first changes the vault and a sweep follows with a new commit. Two commit sources may exist, but both move forward.
The mirror must be byte evidence
If the mirror prettifies prose or repairs frontmatter, it stops being evidence of the source. Search normalization belongs in an index, while a version mirror prioritizes byte identity. Diffs then show human change rather than a mixture of change and tool decoration.
Exclusions must also be explicit. Editor caches and sync internals are not memory, but unknown extensions cannot disappear silently. The discovered managed tree is the default and exclusions form a narrow negative list.
Rehearse rebuilding
Calling a store derived is not proof. Recreate the mirror and index from empty directories and verify that the history head represents current source bytes. If rebuild exists only in documentation, the cache will become authority during the next incident. Rebuild time and failure logs are operational costs too.