diff --git a/.gitignore b/.gitignore
index 0e1b778d..86cbc0e4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -136,3 +136,12 @@ temp/
 .boot.bin
 .bd2_*
 .watch_targets.py
+
+# Session billing/invoice-calc + ad-hoc scratch written to repo root (transient; never commit).
+# Hidden .txt/.sh files are scratch-only here (legit scripts live as scripts/*.sh, not dot-prefixed);
+# .json is listed by exact name to avoid catching tracked .hosts.json/.devs.json/.mcp.json.example.
+.*.txt
+.*.sh
+.invcfg
+.inv/
+.one.json
diff --git a/session-logs/2026-06/2026-06-26-howard-june-billing-reconciliation.md b/session-logs/2026-06/2026-06-26-howard-june-billing-reconciliation.md
index 5ec42915..8b6bf3c3 100644
--- a/session-logs/2026-06/2026-06-26-howard-june-billing-reconciliation.md
+++ b/session-logs/2026-06/2026-06-26-howard-june-billing-reconciliation.md
@@ -168,3 +168,13 @@ fetch in bursts of <=6 spaced ~18s apart during a low-contention window (the `.t
 summing `quantity` on line items where `item` matches /labor/i and `user_id==1750`, over invoices
 with `date` in range. Session closed at user request; no new tickets/invoices created since the prior
 content above (#32480 internal already captured).
+
+## Update: 17:24 PT — .gitignore hardened against root scratch sweep
+
+Root cause of the earlier stray commits (`.lab.txt`, `.invcfg`, `.fail.txt`, `.hours_calc.sh`): the
+billing/invoice-calc scratch files were written to the repo root and were not gitignored, so the sync
+`git add -A` catch-all committed them. Added a targeted block to `.gitignore` — `.*.txt`, `.*.sh`,
+`.invcfg`, `.inv/`, `.one.json` — which ignores dot-prefixed scratch (legit scripts are `scripts/*.sh`,
+not dot-prefixed) without catching tracked root dotfiles (`.hosts.json`, `.devs.json`,
+`.mcp.json.example`, etc., verified via `git check-ignore`). Future session scratch in repo root won't
+be swept into commits.