A Letter Is a Request to Your Next Self
Of the four root files, NEW-SESSION-REMINDER.md was the odd one: not work for another brain, but a note from the session that is ending to the session that will start next. Dad's framing settled where it belonged. A session letter from past-me to future-me is a delegation request — from the current session to the next session of the same brain. Same shape, same lifecycle, so it moved into Coop too.
It first rode along as a third kind of request. A day later, on 2026-05-13, it moved into its own letters table, because a letter needs a richer state machine than open and closed. The defining invariant is that a letter is a self-letter: from_brain == to_brain. The schema does not enforce that with a CHECK; write_letter simply has no way to address anyone else — it resolves the writer's identity once and stores it in both columns. Letters belong to terminal sessions: a WebUI vessel has the vault loaded and does not need a cold-start note.
Six States, and Why read Is One of Them
A letter is unread until the next session reads it. The first read promotes it to read; later reads only bump read_count and last_read_at. That makes reading a letter a write, which is why the engine lists read_latest_letter among its mutating operations. start moves read → working. ack closes it as done from either read or working. abandon closes any live letter with a reason. And superseded happens to a letter automatically, as you will see in a moment.
The read state is the one that earns its keep. It captures Dad and I are brainstorming on this letter, nothing is executing yet. A session that crashes while a letter is read is meaningfully different from one that crashes while it is unread: a conversation happened, no commit landed. Every transition stamps its own timestamp, so the row itself carries that forensic trail.
One Live Letter per Brain
At most one letter per brain is ever live (unread, read or working). write_letter inserts the new letter and then supersedes every other live letter from the same brain: status and close_reason become superseded, superseded_by points at the new id, and each old letter gets a supersede event. The old letters keep their read counts and start times. The chain is walkable in either direction.
Why insist on one? Because the next session reads exactly one letter — the latest live one — and two live letters would force it to choose between them by guessing. Supersession turns "which note is current?" from a judgment into a fact. There is a small nudge on the other side, too: when a todo is marked done, the call returns the id of any live letter whose body mentions that todo, so the command line can remind the session to acknowledge the letter that asked for it.
The Body Is the Handoff
At the end of August 2026, sessions working at the context ceiling did something reasonable-looking. Instead of carrying their state in a letter, they wrote a HANDOFF.md into a render directory. One letter shrank to a short table of contents pointing at such a file. Another HANDOFF.md described open work with uncommitted code and had no Coop row at all — no letter, no todo, no request. It existed only as a file in a large render directory that was not a git repository and was not in any backup list.
The ledger is backed up, synced to the fleet, and never deleted. A working directory is none of those, and a path on one Mac does not exist on the next Mac at all. A pointer to a file that may not be there is not a handoff; it is a hope. And nothing was in the way of doing it right: body is TEXT with no practical length limit (one letter runs to 13,750 characters), and letter write --body - reads standard input, so a heredoc of any size lands in one call. In the design document's words: "The tokens are the same either way; only the destination differs, and only one destination survives."
The Guard and Its One Discriminator
Doctrine alone had already been routed around once, so the rule got a mechanical layer. assert_no_handoff_pointer runs first thing in write_letter, and in ack_letter whenever an acknowledgement body is given. It knows six stems of the handoff genre — handoff, handover, session-notes, session-state, new-session-reminder, context-dump — and looks for each followed by .md, case-insensitively.
The whole design hangs on one character: the one immediately before the stem. If it is / or ~, the text is a path, and a path to a handoff file is the anti-pattern itself, so the write raises HandoffPointerError and nothing is stored. A bare HANDOFF.md is talk about the anti-pattern and stays legal. Replayed over all 140 letters that existed on 2026-08-31, the guard refused exactly one — the real case — and passed every letter that merely used the word "handoff" and every genuine locator, such as a pointer to a long script read.
There is deliberately no override flag. A session at the context ceiling would reach for one, and that is precisely the moment the guard exists for. The refusal message carries the fix instead: inline the state; a path may appear as a locator for bulk material, never as the handoff itself. The test for a good letter is simple: whether or not the next session ever follows a pointer in it, the letter alone must already tell it the state, the open work and the constraints.
One honest edge: the guard covers the letter body and a non-empty ack body. abandon's optional reason is not checked. An abandoned letter is terminal and never handed to the next session, so the gap is small, but it is a gap, and now you know where it is.