Conner512 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/docs/README.md b/docs/README.md
@@ -39,6 +39,7 @@ Start with the local API, then choose an adapter. A deployment guide or versione
 - [Memory-first modules](memory-first-v0.1/README.md): independent memory, private storage, revisions, provider contracts, leased workers, source-grounded summaries and optional vector search. Model/vector services remain opt-in; synthetic tests are not production acceptance.
 - [ChatGPT core foundation](chatgpt-core-foundation-v0.1.md) and [core correctness](core-correctness-v0.2.md).
 - [Core optimization release notes](core-optimization-v0.2/release-notes.md), [retrieval design](core-optimization-v0.2/retrieval-decision.md), and [acceptance cases](core-optimization-v0.2/ACCEPTANCE_TESTS.md).
+- [Console feature standard](console-feature-standard.md) (Chinese): the console feature map, feature statuses and the checklist for turning a planned console feature into a live one.
 - [Core review v0.3](core-review-v0.3/README.md): mixed-script retrieval, search readiness, and strict event acceptance receipts; that core-only review did not include OAuth.
 - [Optional OAuth and HTTP MCP](chatgpt-web-oauth-v0.1/README.md): separate authorization and read-only gateway, [dependency choices](chatgpt-web-oauth-v0.1/dependency-decision.md), and [verification scope](chatgpt-web-oauth-v0.1/implementation-report.md).
 

diff --git a/docs/architecture/account-ownership.json b/docs/architecture/account-ownership.json
@@ -2,7 +2,7 @@
   "schema_version": "account-ownership-inventory-v1",
   "core": {
     "connection_and_owner": ["cloud_memory_bindings","cloud_memory_operations"],
-    "user_id": ["audit_events","checkpoints","credentials","events","handoff_drain_resumes","memories","memory_annotations","memory_category_overrides","memory_create_operations","memory_fingerprints","memory_index_outbox","memory_job_items","memory_jobs","memory_owner_model_usage","memory_owner_vector_usage","memory_privacy","memory_processing_outbox","memory_revisions","memory_source_links","memory_source_pins","memory_sources","memory_summaries","memory_summary_dependencies","memory_vector_documents","memory_vector_points","memory_web_grants","projects","resolver_selections","resume_delivery_receipts","resume_injection_events","resumes","task_bootstrap_previews","task_canonical_revisions","task_reconciliation_proposals","tasks","console_operations","console_models","console_imports","console_vector_requests","console_settings","memory_vector_owners","memory_vector_owner_active"],
+    "user_id": ["audit_events","checkpoints","credentials","events","handoff_drain_resumes","memories","memory_annotations","memory_category_overrides","memory_create_operations","memory_fingerprints","memory_index_outbox","memory_job_items","memory_jobs","memory_owner_model_usage","memory_owner_vector_usage","memory_privacy","memory_processing_outbox","memory_revisions","memory_source_links","memory_source_pins","memory_sources","memory_summaries","memory_summary_dependencies","memory_vector_documents","memory_vector_points","memory_web_grants","memory_web_policy","projects","resolver_selections","resume_delivery_receipts","resume_injection_events","resumes","task_bootstrap_previews","task_canonical_revisions","task_reconciliation_proposals","tasks","console_operations","console_models","console_imports","console_vector_requests","console_settings","memory_vector_owners","memory_vector_owner_active"],
     "summary_parent": ["memory_derived_outbox","memory_summary_claims"],
     "memory_parent_fts_internal": ["memory_search_docs","memory_search_fts","memory_search_fts_config","memory_search_fts_data","memory_search_fts_docsize","memory_search_fts_idx"],
     "operator_only_infrastructure": ["handoff_module_state","memory_model_budget","memory_profile_state","memory_search_state","memory_vector_active","memory_vector_calls","memory_vector_generations","settings"]

diff --git a/docs/chatgpt-web-oauth-v0.1/web-memory-review.md b/docs/chatgpt-web-oauth-v0.1/web-memory-review.md
@@ -27,6 +27,16 @@ table starts empty. Memory updates/revisions and privacy changes revoke grants.
 Changing a public classification is a separate local operation, not a grant
 revocation. Core local readers keep their original owner/scope behavior.
 
+An owner can instead switch ChatGPT reads to **all** of their records with the
+console action `memory.web_policy` (Privacy & retention → ChatGPT read scope). While
+`memory_web_policy.read_all` is on, every `internal` and `sensitive` record of that
+account is readable, including records added or corrected later, without per-revision
+grants. `secret` and unknown classifications stay invisible, and other accounts are
+unaffected. The switch is versioned (`expected_revision`, conflicts return
+`SETTINGS_VERSION_CHANGED`), idempotent per operation ID and audited as
+`memory.web_policy`. Switching it off restores the explicit-grant rule; existing grants
+are kept.
+
 Filtering occurs before lexical candidate limits, counters and conflict creation,
 and again after awaited vector requests. Details and historical lifecycle records
 apply the same rule. A summary requires **every dependency**, including omitted

diff --git a/docs/console-design.md b/docs/console-design.md
@@ -0,0 +1,86 @@
+# Console design: Ink Archive
+
+The console presents memories like a personal archive: paper, ink and a single seal-red accent. Every
+memory is a catalogued record with a source and a revision; the interface stays calm and quiet so that
+content, provenance and permission boundaries carry the page.
+
+## Files
+
+- `web/console/styles.css`: design tokens, layout and components.
+- `web/console/controls.css`: native-select enhancement, write dialogs and connections.
+- `web/console/visuals.mjs`: page views, the escaping `html` template tag and the fixed local icon set.
+
+The server bundles the files listed in `STYLESHEETS` (`web/console/render.mjs`) into the single
+`/assets/styles.css` response, so CSP and ingress rules are unchanged. There are no decorative skin layers.
+
+Browsers may load only the asset paths the public ingress allows (see
+[`console-ingress.example.yml`](console-ingress.example.yml)): `styles.css`, `favicon.svg` and seven modules. A new browser module
+must either be folded into an existing one or ship together with a matching ingress route; otherwise the
+module graph fails behind the tunnel and pages stay on "Loading". A test walks the browser import graph and
+checks it against that allowlist.
+
+## Logo
+
+A seal inside a pair of corner quotes 「■」: the quotes cite the source, the seal is the memory kept on record.
+It carries the product's core promise — every memory keeps its provenance — and reuses the accent's meaning of
+"current, confirmed".
+
+- 48×48 grid. Quotes: `M5 19V5h14` and `M43 29v14H29`, square caps, mitred corners. Seal: an 18×18 square at 15,15.
+- Quote stroke 4 at display sizes, 4.5 in the 34px sidebar/sign-in mark, 5–6 at 32px and below.
+- Colours: quotes follow the text colour (`--text`; paper on dark backgrounds), the seal follows `--accent`.
+  The wordmark is set in the serif face next to the mark.
+- `web/console/favicon.svg` uses a fixed vermilion seal and switches its quotes to paper colour under
+  `prefers-color-scheme: dark`. It is served at `/assets/favicon.svg`, so the page CSP stays `img-src 'self'`.
+
+## Tokens
+
+All tokens live in `:root`. There is one light palette with a single vermilion accent and no theme
+switching:
+
+| Token | Value | Use |
+| --- | --- | --- |
+| `--bg` | `#F5F1E8` paper | Page background, sidebar, top bar |
+| `--surface` | `#FFFDF8` card stock | Cards, detail pane, sign-in form |
+| `--surface-2` | `#F0EADD` | Tracks, quiet fills |
+| `--soft` | `#EBE3D1` sand | Current page, selected row, focus halo |
+| `--border` / `--line` | `#DCD4C3` / `#CFC6B3` | Hairline rules / quiet outlines |
+| `--muted` | `#5F5A50` | Secondary text, icons, form-control borders |
+| `--text` | `#1C1B18` ink | Body text, primary buttons, strong rules |
+| `--accent` | `#AE3F2C` vermilion | Current marker, confirmations |
+| `--good` / `--warn` / `--bad` | `#3B6B4F` / `#8A5A12` / `#9B2C1F` | Verified / in progress / danger |
+
+Geometry: `--radius` 2px everywhere, 36–38px controls, 1px hairlines with a 1.5px ink rule above
+section headings, table heads and stat tiles. No gradients, glow, blur or glass.
+
+There is no dark mode and no appearance page. The only display preference is the interface language: a
+compact select in the top bar and on the sign-in pages, saved per account in the browser.
+
+## Type
+
+- Headings, wordmark and figures: serif (`--font-serif`, system Songti / Palatino / Iowan).
+- Body and controls: system sans (`--font-sans`, PingFang SC / Segoe UI / Microsoft YaHei).
+- IDs, times, counts and small labels: monospace (`--font-mono`).
+
+System fonts only: the CSP allows no external font source, and CJK web fonts are large.
+
+## Components
+
+- **Navigation**: icon + label, grouped under small monospace labels. The current page gets a sand
+  background, bold label and an accent icon. No route codes.
+- **Buttons**: primary = ink fill; secondary = ink outline; quiet = text only. The submit button of an
+  explicit operation dialog, and OAuth consent, use the accent (a "seal" confirming the action).
+  Revoke, retract, disable and cancel actions use the danger colour.
+- **Status**: shape and words carry the meaning, colour only supports it — filled square for active,
+  hollow square for superseded or in progress, a dash and strike-through for retracted.
+- **Notices and policy boxes**: a 1.5px ink rule on top, no coloured side bars.
+- **Icons**: 24px grid, 1.5px stroke, square caps and mitred joins (`visuals.mjs`).
+- **Feature status**: the same shape language — filled square for live, hollow for planned, half-filled for a
+  partly live page, a dash for features deliberately not offered on the web. Planned features render as dashed
+  cards with a disabled wireframe and collapsed developer notes; nothing in a placeholder can trigger a request.
+  What each page offers or will offer is listed in the feature map; see
+  [console-feature-standard.md](console-feature-standard.md) for the development rules.
+
+All motion stops under `prefers-reduced-motion`.
+
+The design canvas with the full set of screens (library, overview, connections, security, sign-in,
+registration, authenticator, recovery codes and OAuth consent) is kept outside the repository.