diff --git a/.gitignore b/.gitignore
index 90595039..ce9645a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -79,5 +79,15 @@ apps/
 .claude/*.local.md
 .claude/*.local.json
 
+# Maintainer handoff + codemap notes are working-state, not user-facing
+# artifacts. They've leaked into the public repo via .claude/ in the past
+# (HANDOFF_v0.8.28, CODEMAP_v0.8.25) — those files now live under
+# .private/handoffs/ instead. Block the patterns here so a future accidental
+# add doesn't silently land on main.
+.claude/HANDOFF_*
+.claude/CODEMAP_*
+.claude/handoff_*
+.claude/codemap_*
+
 # Maintainer-internal design notes (trade-secret material, never published)
 .private/