diff --git a/.gitignore b/.gitignore
index 654f5bc..748ddba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,6 +39,9 @@ scripts/kb-eval/data/skill-score-report.json
 # build-judge-payloads.mjs; regenerated on demand, not committed (bulk + churn).
 scripts/kb-eval/data/judge-bakeoff-payloads-*.json
 .kb-backup/
+# atomic-write temp files (atomicWriteSync writes `<name>.tmp.<pid>.<n>` then renames);
+# a crash mid-write could leave one behind — never let it reach the public mirror.
+*.tmp.*
 .rollback-in-progress
 
 # --- session/local state — LOCAL-ONLY (gitignored) ---