@@ -2,3 +2,6 @@
# It is credential-free by contract (see its header): no ssh keys, no HA
# token, no mikrotik password — secrets come from the add-on options.
!config.toml
+
+# per-recipe run ledgers (machine-local state; the ha.lan add-on holds the live ones)
+recipes/*/.lock
