system: apply 12 improvements to second-brain automation

- .gitignore: add 02 Areas/credentials.md (gitignored, iCloud-only)
- CLAUDE.md: document dual daily logs, raw/ inbox, multi-device setup, credentials policy
- compile.py: git commit+push vault after compile, wiki-count-sync call, macOS notification
- session-start.py: dynamic wiki topic hints (auto-detect from folder names)
- flush.py: richer extraction prompt with calibration examples
- obsidian-session-start.py: more explicit stub note warning
- icloud-dedup.py: new script to auto-merge/delete iCloud duplicate files
- LaunchAgents: icloud-dedup (9:00 + 21:30), memory-compiler (21:00)
- credentials: moved to ~/.secrets/mailgun.env (chmod 600)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -11,6 +11,7 @@
 05 Aimpress LTD/Credentials.md
 01 Projects/NotebookLlama env back.md
 01 Projects/for script.md
+02 Areas/credentials.md
 
 # macOS
 .DS_Store

.obsidian/plugins/hoarder-sync/data.json

@@ -4,7 +4,7 @@
   "syncFolder": "Hoarder",
   "attachmentsFolder": "Hoarder/attachments",
   "syncIntervalMinutes": 60,
-  "lastSyncTimestamp": 1777973078671,
+  "lastSyncTimestamp": 1777976677101,
   "updateExistingFiles": false,
   "excludeArchived": true,
   "onlyFavorites": false,

CLAUDE.md

@@ -137,7 +137,63 @@ Even if the session is short. Even if just answering a question. Log it.
 - Stack preferences: Python/FastAPI for backends, Docker for deployment, vanilla JS+Tailwind or React for frontends
 - Language for notes: **English**
 - Date format: **YYYY-MM-DD** everywhere
-- Credentials are NOT in the vault — stored at `~/.secrets/` locally
+- Credentials are NOT tracked in vault git — stored at `~/.secrets/` locally
+  - `~/.secrets/mailgun.env` — Mailgun shared infra defaults
+  - `02 Areas/credentials.md` is gitignored (iCloud-only, never pushed to GitHub)
+
+## Two-Tier Daily Log System
+
+The system maintains **two separate daily log streams** — do not confuse them:
+
+| Location | Written by | Read by | Purpose |
+|----------|-----------|---------|---------|
+| `~/.claude/memory-compiler/daily/YYYY-MM-DD.md` | `flush.py` (SessionEnd hook) | `compile.py` (nightly) | Source material for wiki compilation |
+| `99 Daily/YYYY-MM-DD.md` | `obsidian-session-log.py` (Stop hook) | Human (you) | Human-readable session log |
+
+`compile.py` reads ONLY from `memory-compiler/daily/`. It never reads `99 Daily/`.
+Both logs cover the same sessions but in different formats.
+
+## raw/ Inbox — How to Use
+
+Drop any source material into `raw/` and say "compile raw":
+- Articles, PDFs, transcripts, research notes
+- Screenshots of config files or error messages (describe them as text)
+- Architecture diagrams (describe as text)
+
+Claude will extract knowledge into the correct `wiki/` folder, update `_index.md`, and move the file to `raw/_processed/`.
+
+**Do NOT put credentials or sensitive data in raw/.**
+
+## Multi-Device Setup
+
+When setting up a new machine, run this sequence:
+```bash
+# 1. Clone memory-compiler
+git clone <repo> ~/.claude/memory-compiler
+
+# 2. Copy scripts from vault (they sync via iCloud)
+# Scripts live in vault at: 00 Automation/ (if set up)
+# OR copy from another machine's ~/.claude/
+
+# 3. Install dependencies
+cd ~/.claude/memory-compiler && uv sync
+
+# 4. Create ~/.secrets/ with credentials
+mkdir -p ~/.secrets
+# Copy mailgun.env and other secrets from 1Password / secure source
+
+# 5. Register LaunchAgents (edit paths for new machine username first)
+cp ~/path/to/LaunchAgents/*.plist ~/Library/LaunchAgents/
+launchctl load ~/Library/LaunchAgents/com.claude.memory-compiler.plist
+launchctl load ~/Library/LaunchAgents/com.vadym.icloud-dedup.plist
+
+# 6. Update settings.json hooks (replace ai_leed with new username)
+sed -i '' 's|/Users/ai_leed/|/Users/NEW_USERNAME/|g' ~/.claude/settings.json
+```
+
+**Note:** All hook commands in `settings.json` use hardcoded `/Users/ai_leed/` paths.
+When working on a different machine, update these paths. A machine-agnostic setup
+(using `$HOME`) is a future improvement.
 
 ## Wiki System — You Are the Librarian