[steven-kid]

Goal and delivered outcome

An owner can read a team's report in LoopX but cannot save that displayed source for offline use or handoff. Download source now saves the exact displayed UTF-8 bytes from the shared report reader, including accepted team results, conversation results and evidence views. It adds no network call, validation run, adoption record or Goal mutation.

This is a bounded S5 artifacts-and-return usability contribution, separate from command-palette navigation and completed-history search. It reuses the stored-version result owner described in the App conversation contract and the existing frontend-delivery artifact preview/download journey. It does not claim completion of S5 or installed-App qualification.

Author and scope

Written by: model_agent — OpenAI Codex, GPT-6 family.
Fresh upstream/specification base: b285c7c1b38bb1d426fca2ef6bd8ddfce177959a.
Final head: f4e7ffe6cc47304112224f5c654e930302ab4faf. Product build/screenshots: cbaa6dcc95b4547ad672d7d1156fa5b52894f8f6; subsequent commits only repair fixture packaging and whitespace.
Target: loopx-project/loopx:main.

Complete within displayed text-report download scope. Existing owners continue to decide which report can be read and what acceptance/adoption it carries. Download is a local copy of that readback, not a promise of continuing acceptance. No new provider, capability, backend endpoint, storage or domain vocabulary.

Filenames use a sanitized leaf name, a 12-character version prefix and a text extension; unknown extensions become .txt. Unicode/CRLF content is preserved without formatting or added metadata. Temporary object URLs are released after the browser consumes them. A failed browser download initiation gives an in-place retry message. Controls wrap on narrow screens.

Acceptance and validation

Criterion / check	Actual result
Save the displayed version unchanged	Packaged browser downloads from real SQLite/CLI/HTTP report owner match both source bytes and canonical SHA-256
Repeated, interrupted and keyboard flows	Passed repeated exports, keyboard activation, simulated object-URL failure/retry, and cleanup after interrupted initiation
Scope and unavailable reports	Passed Goal switch isolation; tampering with disposable source withdraws download after reread, restoration makes it available again
No unexpected writes/execution	Real fixture reports unchanged canonical tasks and restored original report digest; zero POSTs, action applies and model requests; downloads add no report reads
Filename/content unit tests	2 passed: Unicode/CRLF, path/control-character/executable-extension inputs, bounded names, version replacement and URL cleanup
Production build	Strict TypeScript, dashboard and Chat bundle build passed; existing bundle-size advisory remains
Packaged regressions	report-download, managed-goal-results and the existing team-evidence conversation/evidence journey passed on committed head; existing stale/malformed read handling remains intact
Standard premerge	15/16 selected checks passed on initial product head and fixture-fix head; one baseline lifecycle failure below. Fixture-fix run additionally caught trailing EOF whitespace, fixed afterward
Final quick premerge	4/4 selected checks and all direct/compile checks passed; two independent image-review holds remain
Runtime-only fixture qualification	Final-head packaged download flow passed using a separately prepared Python virtualenv in the same cloud environment with LoopX installed and no pytest; 19 shared-fixture tests and 2 download unit tests passed
Changed Python Ruff / diff hygiene	Passed
Semantic advisory	No supported carriers found; the tool excludes frontend source paths, so this is not semantic coverage of the new TypeScript helper

The sole failing selected standard-premerge smoke is cli-project-lifecycle-command-modularization-smoke.py: its legacy dry-run refresh expects success but receives canonical_authority_required. It independently fails at the same assertion on untouched exact base b285c7c1 in the same environment. No assertion or infrastructure was weakened. An earlier premerge run overlapped author edits and was discarded. The table distinguishes the completed standard runs from final quick policy validation.

Initial-head CI exposed a related regression: the new browser fixture imported pytest through a test module, but release/browser runtime installs do not include pytest. The shared synthetic fixture now lives in the example support code; no workflow dependencies or assertions were relaxed. Runtime-only browser qualification above verifies the repair. Final-head CI is pending; full CI green is not claimed.

The initial Windows job also failed test_original_task_revalidation_repairs_output_without_repeating_host[sqlite] waiting for a turn_returned operation to finish. The exact test passes on both untouched base and candidate in this Linux environment; that does not reproduce or clear the native Windows failure. It remains unclassified pending the final-head Windows run. Native desktop download handling and installed-App acceptance were not tested locally. Two binary-image independent exact-head review holds remain; author pixel inspection and empty PNG metadata do not clear them.

Visual evidence

Compiled candidate, synthetic fixtures, desktop 1512×982 and narrow 390×844. These images use the existing mocked report inventory for readable composition; the separate download acceptance above uses the real disposable SQLite/HTTP report owner. The report retains its existing source/version disclosure, with Download source adjacent to View source. The narrow capture is scrolled to the report controls; its wide table retains existing horizontal scrolling. No persistent preview service is published.

Signed-off commit; source, bilingual user guidance and targeted validation included. No merge or deployment authority is requested.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | reasoning_effort=max | declaration_source=runtime_reported

结论：APPROVE。已审读完整 base b285c7c1b38bb1d426fca2ef6bd8ddfce177959a → head f4e7ffe6cc47304112224f5c654e930302ab4faf；未发现新增阻断问题，独立合并门与未测边界如下。

动机

需要离线阅读或转交已打开团队报告的用户，是这项改动的直接使用者。原先在成果、对话或证据视图能读报告，却没有保存所读原文的入口，只能自行复制文本；新增按钮直接保存同一显示版本。已验证下载字节及摘要与报告读回一致，重复下载、键盘操作、下载启动失败后重试、来源撤回恢复和切换 Goal 都经过实际打包入口。

下载只产生本地文件副本，不重新运行模型、检查或采用，不修改 Goal，也不承诺保存后原版本继续有效。这是已有报告读取旅程的一项完整补充；原生桌面下载接管、安装版采用和整个团队结果交付仍保留各自验收。

改动思路

下载应属于现有报告展示组件：输入已经由原报告 owner 读回，浏览器只编码当前文本并保存。重读服务、后台导出任务或另一套采纳状态都没有必要。

本 PR 的边界是保存当前显示版本及原地失败恢复；保留原读取、来源与验收 owner，不扩展远端权限或安装承诺。

旧：读报告 → 手工复制。新：读相同版本 → 点击下载 → 本地原文；来源读失败仍回原 reader 重试。 这条说明来自所审源码与实际流程；没有另行渲染 Mermaid 图。

具体改动

先以不可变已接受规范 docs/architecture/rfcs/app-conversation-and-async-inbox-v0.md、版本 b285c7c1b38bb1d426fca2ef6bd8ddfce177959a 为依据，并核对既有 task-first artifact/整页阅读合同。修改规范本身不构成独立验收；以下条目对照修改前的义务和本次实际产品结果。

已接受规范中的条目	本提交判断
Result	implemented：保存原 reader 所读版本；实际文件字节和摘要一致，读失败仍走读取恢复，无模型重跑。
Scope	implemented：切换 Goal 不保留前一份可下载报告；撤回来源并刷新后无下载控件，恢复来源可再次下载。
Authority	implemented：复制现有读回没有新权限；捕获到的 POST、action apply、模型请求均为零，原任务权威摘要不变。
Packaging	deferred：源码与实际打包 UI 已验，原生桌面下载接管及安装版旅程由原交付 owner 继续资格验证。

关键代码讲解

1. reportDownloadName 从引用提取叶子名，清理路径、控制字符并限制长度，附12位版本摘要。只有 Markdown、JSON、文本扩展名保留，其余按惰性文本保存；这个名字不用于访问本机路径。
2. downloadReport 直接用当前 text 建 UTF-8 Blob，不经过 Markdown 渲染或 JSON 重排。创建临时链接启动一次下载，finally 移除链接并延迟释放对象 URL；下载不额外读报告，也不产生服务器请求。
3. TeamArtifactReport 把下载放到原文/阅读控制旁，继续显示原内容与摘要。启动错误在本组件提示重试；报告是否还能出现仍由原成果、对话和证据 reader 决定。

当前完整差异13文件、313增37删。后续提交将既有研究合成数据移到共用夹具，原 fixture 函数 AST 相同，原测试断言保留；浏览器不再导入测试模块。两个生产函数及共享组件、指南和两张公开图，与最初审读版本逐字节一致。仍对新提交重新构建并执行夹具消费者和实际浏览器流程，未继承旧提交结论。

对主干的风险

独立检查了错误对象 URL、重复点击、键盘、390px、源文件被替换、恢复和 Goal 切换。实际报告来自隔离的 SQLite/CLI/HTTP owner，保存文件与该版本完全一致；浏览器失败注入只替代故障，不伪造“文件正确”这个结论。相同正常入口对照在原始基线显示0个下载控件而失败，当前版本通过；说明验证确实走到了新增产品出口。既有 managed-goal-results、team-evidence 两条伴随流程也通过。2项文件名/字节/释放测试及夹具使用方测试通过，生产构建通过。

标准预合并检查仍有一项失败：旧 CLI lifecycle fixture 的 dry-run refresh 被 canonical_authority_required 拒绝。相同命令在不可变基线与当前产品版本的完整诊断、恢复动作和拒绝字段一致，只归一临时目录；失败脚本和因果 owner 未被本 PR 修改。该独立红灯保留为合并门，不能写成全绿，也不要求这个导出改动绕过权威规则。其余选定检查与文本公开边界扫描通过。

两张公开 PNG 的像素、尺寸、来源和元数据已独立检查，未见私人材料；1512px/390px控件可读，窄屏表格仍用原横向滚动。另看过真实后端生成的报告页面；长任务标题是原有展示行为，下载仍可到达。截图只能证明显示，真实文件比对才证明导出。未测试原生桌面接管、安装采用或用户长期收益。

语义与 CI 对齐

复用既有 TeamArtifact、来源与验收语义；文件名清理是本地呈现，未创建共享状态词汇。 行为变化已在指南/设计说明披露。有限 carrier 的语义探针不是前端全覆盖证明；本评审用完整差异、真实调用方、基线/当前与反例补足。未查询、等待或调度远端 CI；上述结果仅是当前仓库本地验证，不声称 CI 全绿。

我的整体评价

这是比例合适的已有旅程补充：少量本地 TS/React/CSS，无新 endpoint、持久状态、provider、能力配置或后台任务。重复文件名/URL样板未升级成通用框架；共用夹具提取改善实际两个消费者的维护。long_horizon=preserved：原结果、任务、重试和后续采用 owner 不变；user_experience=improved：用户可直接拿到所读文件，不必再复制和整理，也无新增强制确认。当前支持 APPROVE，未发现新增阻断问题。旧 lifecycle 红灯、安装版下载资格及后续版本有效性仍是独立边界；这不是合并、发布或采用授权。

English verdict: APPROVE for the complete exact head above. The real packaged source journey and negative controls support this bounded UI change; existing validation holds and installed-App qualification remain separate.