At 8:10 in the morning, Musa Kilonzo had already made the mistake before he fully understood it. He clicked **Send**, pulled his tea closer to the keyboard, then looked back at the recipient line. Instead of the four procurement officers he had selected by hand, the screen showed `ALL-CLIENTS`. Beneath it, the attachment read `Annex_Blue_Internal_v7.pdf`.
For one second he stopped breathing. Meridian MedSupply had hired him four months earlier. During his first week, Victor Ndege had taught him one rule above all others: check the recipient list twice and the attachment name three times. Musa normally did. That morning he had tried to save five minutes because Victor wanted a price update out before 8:15.
“Sent?” Victor called from two cubicles away.
Musa opened Sent Items. A message-ID already existed. Delivery statuses were filling in one after another: delivered, delivered, delivered.
“Victor,” he said, his mouth dry, “I sent it to the whole list.”
Victor spun around. His expression changed from surprise to calculation. “Recall it. Now. Then send a correction.”
Musa reached for the mouse, then stopped. The CRM had a follow-up automation that would resend the same attachment in ten minutes. He opened the campaign queue and set it to `PAUSED`, then called Amina Wekesa in the warehouse.
“Hold the morning dispatches linked to the pricing email until I give you a new reference.”
“Why?” Scanners and a pallet jack beeped behind her.
“I sent the wrong attachment to all clients. I’m stopping a second wave.”
“Do you have a hold reason?”
“I’m entering it now.”
Victor tapped the desk. “Don’t drag the warehouse into this. It’s an email error, not a supply incident.”
“The email is tied to dispatch instructions. If the automation runs before we verify, we can send the same error twice.”
Musa entered a narrow reason: **external attachment error pending confirmation**. He did not write fraud, breach, or contract mismatch. He did not know that yet.
The first reply arrived at 8:13.
> Kindly clarify why replacement response has changed from 72 hours to 24 hours.
Musa opened the file he should have sent, `Annex_Standard_v7.pdf`. It said seventy-two hours. The Blue file said twenty-four.
A second reply came in.
> What is “equivalent substitute without additional written consent”? Our signed annex requires approval.
Victor stepped behind him. “Don’t answer.”
“I’m not.”
“Good. Send an apology. Wrong draft attached. No contractual effect.”
Musa opened a new message but did not type. “Is it actually a draft?”
Victor looked at him as if the question itself were dangerous. “It’s an internal working document. That is the line you need.”
The PDF properties showed different footers: `STD-7.2` and `BLU-7.2`. Different page counts. At least three substantive clauses already differed. Musa was not a lawyer, but he knew the difference between formatting and terms.
“I can send a correction,” he said, “but first I want the sent record preserved. If a client has one version and we rewrite the incident, we lose the timeline.”
“You want to create an incident against yourself?”
“Yes. The recipient and attachment error are mine.”
Musa opened the incident portal and entered the send time, recipient group, filename, campaign pause, and warehouse hold. Under initial cause he wrote: **Sender failed to verify recipient group and attachment before transmission.** He did not blame the system. He did not blame Victor’s deadline.
Victor read over his shoulder. “Change that to formatting error. Legal can rebuild the proper wording.”
“It wasn’t a formatting error.”
“You’re making this bigger.”
“I’m making a record of what happened.”
Victor lowered his voice. “You’re new. HR will ask why you sent a confidential attachment. If you correct it now, this can be over before lunch.”
Musa thought about rent, the money he had sent home to Kisii, and the thin emergency savings in his account. Then he looked at the two client replies. If he erased the send record, he would erase the clearest way to prove what file had reached whom and when.
He clicked **Submit Incident**.
Ticket `INC-24817` appeared. Musa linked the message-ID, the count of sixty-four recipients, the attachment hash, and Amina’s warehouse hold reference. Then he drafted a correction that said only that the wrong attachment had been sent, clients should not treat it as a new instruction, and Meridian would clarify after verification. Victor rejected it as “too cautious.”
The desk phone rang. Caller ID: **Northgate Hospital — Compliance**.
Victor held out a hand. “Don’t take it.”
Musa looked at the incident number, then lifted the receiver.
“Meridian Contracts, Musa speaking.”
“Musa, this is Ruth Kamau. I have your email and our signed annex in front of me. I don’t want a sales explanation. I want one answer.”
Before the pressure swallowed the details, Musa wrote the incident number, the send time, and both filenames in his work notebook. It was not formal evidence, but it would keep him from relying on memory. Amina sent the hold confirmation and he linked its reference into the incident instead of taking a screenshot. For the first time, Musa understood that correcting a mistake did not require pretending it had never happened.
Ruth asked, “Which annex is our real contract?”