# Second brains rot at write access

> Saving into a personal notes vault is mostly solved. Vaults still fail when AI agents edit those notes without preserving where claims came from.

Source: Dewey · https://trydewey.ai/blog/second-brains-rot-at-write-access

A second brain is a personal library of saved knowledge: articles, PDFs, transcripts, highlights, and notes collected so those materials can be found and reused later. The folder or app that holds them is often called a vault. For years the hard problem looked like getting material into that library at all. That intake step is mostly solved. The failure showing up in 2025–2026 setups sits one layer deeper: AI agents (systems that can read and edit those note folders) changing saved files without a clear trail back to the original source.

The operators building these stacks were trying to do something simple. Save more of what they read. Keep a durable record of evidence. Later ask questions against that record and get answers grounded in what was saved. Capture tools (the clippers and importers that save pages into the vault) made the first half cheap. Once agents gained write access (permission to change saved files, not just open them), synthesis started replacing originals, and the trail from a claim back to a passage or URL began to disappear. That is a systems problem, not a motivation problem.

## What capture actually does

Capture means moving something from the open web into a notes folder with little friction. Apps such as Pocket (a one-click page saver) stash the article. Matter or Readwise Reader are where reading and highlighting happen. Readwise syncs those highlights into note apps. An Obsidian plugin (Obsidian is a local Markdown note app) often creates one note per source with metadata for title, author, URL, tags, and date, Notion still shows up for databases and tasks; Logseq for outliners; Reflect, Capacities, and Mem appear in roundups. Among builders who wire AI agents into the loop, Obsidian dominates because local Markdown is something an agent can read and edit without an API tax.

Research automation sits next to that pipeline. Multi-agent systems plan a literature pass, search arXiv and the open web, ingest PDFs into searchable indexes, synthesize, then emit a brief that is supposed to cite its sources. The better ones treat citations as first-class objects: live URL checks, contradiction flags, inspectable traces. The worse ones emit confident prose with invented references. Hallucinated citations are a known failure class, which is why verifiers and "no citation, no claim" rules keep showing up in serious builds.

Two surfaces converge on the same scarce asset. The personal vault wants durable memory. The research agent wants grounded reports. Both collapse when the write path erases where a claim came from.

## Provenance, citation trails, and write access

Provenance is the record of origin: which article, PDF, or transcript a statement came from, and ideally which passage. A citation trail is that record made concrete inside the notes: a sources field, a link to an immutable original, a URL, a title that travels with the answer. Without that trail, a confident sentence in the vault is just text. With it, the claim can be checked.

Write access is the permission to change those saved files. Read-only tools can search and summarize without altering the archive. Write-capable agents can rename notes, polish phrasing, merge summaries, and overwrite the operator's own language. Useful for drafting. Destructive when the live vault is treated as an infinite scratchpad.

## What write access actually breaks

Four failure modes recur once an agent can edit live notes.

**Original thought gets overwritten.** Agents that polish phrasing inside the live vault replace the operator's language with the model's paraphrase. Later search treats the paraphrase as ground truth. Operators who hit this pattern describe the same break: a second brain that edits memory is no longer theirs.

**Citations vanish in synthesis.** Summaries drop the passage, the URL, or the source title. The vault fills with unattributed statements that feel familiar in search and fail under scrutiny. The cheap mitigation is architectural: every processed note keeps a sources field and a trail back to an original the agent cannot overwrite.

**Links and graphs rot under renames.** Note apps often connect files with internal links (sometimes called wikilinks) and build graphs of related notes. Agents that move or rename files through a command line can skip the vault's link resolver. Those links go stale without a warning. Backlinks and plugin indexes are not "just Markdown." A vault's value sits partly in structures the agent does not understand unless those structures are treated as load-bearing.

**The librarian tax returns in a new costume.** Capture stays free. Cross-referencing, contradiction checks, and upkeep do not. AI was supposed to retire the unpaid librarian. Without a review step before drafts become trusted memory, the human still reconciles the agent's mess, only faster and more confident.

None of these are arguments against agents. They are arguments against treating the vault as a place where uncited rewrites can land without friction.

## Architectures that survive write access

The setups that keep compounding share a small set of constraints.

**Immutable originals.** A `raw/` or inbox folder holds frozen sources: articles, transcripts, PDFs converted once to Markdown. The agent may read that folder. It does not overwrite it. Processed notes live elsewhere and link back. The scarce asset starts here: originals that stay put.

**Append and promote, do not rewrite.** Drafts land in a staging area or a separate git worktree (an isolated working copy of the files). A critic pass reviews the diff. Only then does material commit into the live wiki layer. Metadata fields such as `supports`, `contradicts`, `supersedes`, and `sources` act as explicit edges between notes instead of hoping prose stays honest.

**Citation trails as schema.** Processed notes start with structured metadata that names sources. Body synthesis ends with a sources section. Links point at originals. The note format becomes the write API: if a claim has no trail, it does not ship into memory.

**A constitution the agent cannot forget.** Files such as `CLAUDE.md` or `AGENTS.md` (standing instruction documents that coding agents load every run) state the rules: never overwrite originals, put source metadata first, cite or stay silent, review before promote. Without that constitution, each chat session renegotiates the rules from scratch.

**Human promotion for gold memory.** Inference can draft. Promotion into trusted memory stays gated. That gate is where trust lives when graphs mix observations and claims that only look like knowledge.

Cheap loops with a critic beat expensive multi-agent graphs that skip the gate. Fancy orchestration that writes straight into live notes often compounds error more expensively.

## Objections

"If the agent cannot rewrite, maintenance stays manual." Maintenance of structure can be automated. Maintenance of truth cannot be fully automated without a verification surface. Sorting an inbox, proposing links, and drafting synthesis are fair agent work. Declaring a claim settled without a source is not.

"Embeddings and RAG fix provenance." Embeddings turn text into vectors for similarity search. RAG (retrieval-augmented generation) pulls candidate passages into a model's context before it answers. Retrieval helps find candidates. It does not invent a trail that was never stored. A vector hit without a source title still fails the test that matters under decision pressure: can the claim be checked against an original passage.

"Fully autonomous paper agents prove the write path is fine." They prove synthesis can be fast. The ones worth studying still ship audit trails and verifiers. One-shot papers without live citation checks are demos, not memory systems.

"Local Markdown already is provenance." Markdown is a good substrate: plain text files that many tools can read. Provenance is a discipline of what may be written where. Local files with free write access and no schema still rot.

## Implications

The market is moving from note apps to persistent intelligence layers. Templates, MCP servers that expose a vault to coding agents (MCP is a protocol for connecting tools and data sources to AI systems), RAG plugins, and "second brain as a service" offerings all point at the same demand: context that survives a chat session. The operators who keep compounding made write access expensive for uncited claims and cheap for grounded appends.

For product design, Follow / Send / Ask maps cleanly onto this constraint set. Follow selects sources. Send delivers finite digests with provenance intact. Ask queries a vault that still knows which originals sit under an answer. Drop the middle and the ask surface becomes confident fog. Drop the source trail and the vault becomes a branded drawer of model opinions.

A practical decision framework for any second-brain or research-agent stack:

1. Where do immutable originals live, and can the agent overwrite them?
2. Does every synthesized claim carry a citation trail back to a passage or URL?
3. Is there a review gate (diff, critic, or human promote) before material becomes trusted memory?
4. Are supports / contradicts / supersedes explicit, or left as vibes in the prose?
5. When retrieval answers, do source titles travel with the answer?

Stacks that fail those tests keep looking busy. Stacks that pass them can compound without quietly rewriting the past.