diff --git a/.gitignore b/.gitignore
index 1da393b..c32e609 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,18 @@
+# Secrets — per-service env files. Never commit; real values live in
+# Vaultwarden and are injected via docker-compose ${VAR} substitution.
 adolf/.env
 seafile/.env
 openai/.env
+agap-mcp/.env
+.env
+
+# Machine-generated noise (added 2026-07-30). These had accumulated untracked
+# for weeks; they churn on every run and only produce noisy diffs.
+__pycache__/
+*.pyc
+*.log
+
+# Timestamped backup snapshots left behind by edit scripts
+# (e.g. docker-compose.yml.bak-20260704-141509, CLAUDE.md.bak-kb).
+*.bak
+*.bak-*
diff --git a/family/__pycache__/migrate.cpython-312.pyc b/family/__pycache__/migrate.cpython-312.pyc
deleted file mode 100644
index f287b54..0000000
Binary files a/family/__pycache__/migrate.cpython-312.pyc and /dev/null differ