Five surfaces. One door.
The copilot, the screen reader, the before-and-after, the timeline marker and the written report do not each open their own connection. They call the same function, and the consent check lives inside it — not in the button that started them.
-
The check is at the exit
A surface that forgets to ask is refused anyway. So is one written next year by somebody who never read this page. There is exactly one place where screen content can leave the machine, and the gate is bolted to it.
-
Consent lasts one launch
It is a flag in memory that is deliberately never written to disk. Quit Delta and it is gone; the next launch asks again. Nothing you agreed to last month is still agreed to.
-
Switching it off is awaited
The revoke is waited on rather than fired and forgotten. If the client cannot confirm that the gate closed, it says so — instead of showing you a switch that reads “off” over a gate that is open.
-
The other side is told
The first time AI touches a session, a line arrives in that session’s chat saying so. Disconnect and the next session gets its own notice, so a grant made an hour ago cannot quietly cover a stranger.
