diff --git a/HANDOFF-x86-abi-marker.md b/HANDOFF-x86-abi-marker.md
new file mode 100644
index 0000000..c026b59
--- /dev/null
+++ b/HANDOFF-x86-abi-marker.md
@@ -0,0 +1,24 @@
+# Handoff — the ABI marker symbol, so a crossed pair is refused at dlopen
+
+Branch `dev-loop`, from `682cb74`. This closes the serious finding of `HANDOFF-x86-aggregates.md`: a
+redefinition module built by one backend, dlopened into a host built by the other, links and loads and then
+dies with SIGSEGV at the first call into a redefined function that takes or returns a struct. Nothing refused
+it, and `flan build game.flan --x86 --dev` followed by `flan reload game.flan changed.flan` builds exactly that
+pair.
+
+## The plan
+
+A marker symbol, as that handoff recommended.
+
+- `X86.program` defines `flan.abi.x86`; `X86.redefinition` emits a data relocation against it.
+- `Emit.program` defines `flan.abi.llvm`; `Emit.redefinition` emits one against that.
+- Both sides gated on `dev`, so a release build's output is byte-for-byte what it was.
+- The two `dlopen` sites — `test/reload_host.c` and `vendor/agent/flan_agent.c` — recognise a `flan.abi.`
+  failure and say, in a sentence, that the module and the host were built by different backends.
+- `test/test_reload.ml` gains the crossed pair, both directions, asserting the refusal.
+
+`flan reload --x86` is judged out of scope; see below.
+
+## Status
+
+In progress. This file is written early and updated as the work lands.