docs: define managed team result readback boundary

docs/architecture/rfcs/live-team-workspace-v0.md

@@ -1,7 +1,7 @@
 # RFC: Live Team Workspace v0
 
 - **RFC status:** Draft; proposed product and presentation decisions.
-- **Delivery maturity:** Partial implementation: bounded team inspection is shipped; the readable result/comparison slice is proposed in [#4828](https://github.com/loopx-project/loopx/pull/4828). Spatial streaming remains a design, not production qualification.
+- **Delivery maturity:** Partial implementation: bounded team inspection and the Goal Chat readable result/comparison slice in merged [#4828](https://github.com/loopx-project/loopx/pull/4828) are shipped. Managed non-Chat result readback and spatial streaming remain unqualified.
 - **Owners:** existing workspace presentation, collaboration and runtime owners.
 - **Created / normative revision:** 2026-09-20.
 - **Implementation baseline:** `e7ef75c08`.
@@ -327,6 +327,47 @@ stack the reader below it. Explicit artifact choices survive delivery refresh an
 are revalidated by operation, reference and hash; automatic reads do not take
 keyboard focus. Acceptance and requester adoption remain separate in details.
 This qualifies report readback, not mixed-team launch or stop/recovery.
+
+**Managed runs need a separate result readback.** The original Goal Chat report
+reader is requester-scoped to a delegation operation. A managed non-Chat Turn
+has no such conversation, and a run-history entry or completed Todo alone does
+not identify a readable, currently accepted deliverable. The managed result
+slot in Goal Files must remain empty for a Todo without a verified output;
+it must not turn a run observation into a file or attach an unrelated open
+Todo to it.
+
+The managed result slice captures a bounded, public-safe result reference
+at the managed Todo completion and acceptance boundary: Goal, accountable
+producer, exact output reference and digest, current acceptance identity, and
+the requester/audience allowed to read it. A read-only Goal result projection
+should expose that reference to both CLI and the packaged workspace, then
+revalidate the output and acceptance on read. The presenter may show a readable
+report and its source/acceptance trail only after that readback succeeds. A
+missing source, changed digest, revoked acceptance, unreadable page or failed
+provider read must clear the earlier report and show the specific unverified
+scope. The reader must not infer a report from filesystem discovery, completion
+text, run history or a Chat session belonging to another requester. Reuse the
+existing authority and artifact-read boundaries; do not create a second result
+writer or broaden Goal access as a side effect of presentation.
+
+[PR #4978](https://github.com/loopx-project/loopx/pull/4978) proposes that first
+local producer and reader. `todo complete --result-file` binds declared output
+bytes and their digest to the canonical completion/acceptance receipt under the
+existing Goal/Todo writer; `todo result-read` verifies the current acceptance
+basis and exact bytes. A loopback-only Goal-scoped API revalidates each requested
+page and exact read, and the packaged Goal Files view opens a readable report.
+Missing, changed or stale output is withheld and clears an earlier displayed
+body. Completion without a declared, currently verified output creates no
+result row. This proposal does not grant a remote audience or create a second
+writer.
+
+Local File/SQLite producer and CLI readback, packaged desktop/mobile Files
+readback, stale/rejected output and bounded pagination have focused validation
+on the proposed head. Maintainer review and exact-head CI remain open. The
+original requester conversation still lacks a return route for managed runs;
+that route needs its own audience identity, restart and unauthorized-read
+qualification. Neither this local Files reader nor acceptance of one Todo
+proves requester adoption, mixed-team launch or whole-team stop/recovery.
 Merged [#4814](https://github.com/loopx-project/loopx/pull/4814) adds confirmation
 of one canonical team plan from manager and Goal Lark cards. Authenticated card
 bindings and the shared decision owner prevent a second click from creating a

docs/architecture/rfcs/live-team-workspace-v0.zh-CN.md

@@ -1,7 +1,7 @@
 # RFC：团队实时工作区 v0
 
 - **RFC 状态：** Draft；产品与展示决策提案。
-- **交付成熟度：** 部分实现：有界团队检查已交付；可读成果/对照切片在 [#4828](https://github.com/loopx-project/loopx/pull/4828) 提案中。空间流式展示仍是设计，不代表生产资格已完成。
+- **交付成熟度：** 部分实现：有界团队检查及已合并 [#4828](https://github.com/loopx-project/loopx/pull/4828) 的 Goal 对话可读成果/对照切片已交付。托管非 Chat 成果回读与空间流式展示仍未完成资格验证。
 - **Owner：** 既有工作区展示、协作与 runtime owner。
 - **创建 / 规范修订：** 2026-09-20。
 - **实现基线：** `e7ef75c08`。
@@ -264,6 +264,34 @@ Codex MCP 执行与真实模型纠偏/验收/采用资格，原工具审批阻
 用户所选产物在交付刷新后保留，并按操作、引用和哈希重新核验；自动读取不抢夺
 键盘焦点。验收与请求方采用在详情中分别呈现。该切片验证报告回读，不代表混合
 团队启动或停止恢复已完成。
+
+**托管运行需要独立的成果回读。** 原 Goal 对话的报告阅读器按委派操作限定请求方
+范围。托管非 Chat Turn 没有这样的对话；仅凭运行历史或已完成 Todo，无法指向
+一份可读且当前验收有效的成果。没有可核验输出的 Todo，在 Goal「文件」中的
+托管成果位置必须为空，不能把运行观测伪装成文件，或挂上一条无关的未完成 Todo。
+
+托管成果切片在 Todo 的完成与验收边界记录有界、可公开安全展示的结果
+引用：Goal、负责的产出者、精确产物引用与摘要、当前验收身份，以及允许读取的
+请求方 / 受众。只读 Goal 成果投影同时供 CLI 与打包工作区使用，读取时重新核验
+产物和验收。只有回读成功，展示层才能呈现可读报告及其来源、验收关系。来源丢失、
+摘要变化、验收撤销、页面不可读或 provider 读取失败时，必须清除旧报告并说明
+无法核验的范围。阅读器不能从文件系统扫描、完成文案、运行历史或其他请求方的
+Chat 会话推断报告。复用现有 authority 与产物读取边界，不另建成果写入 owner，
+也不因展示而扩大 Goal 访问权限。
+
+[PR #4978](https://github.com/loopx-project/loopx/pull/4978) 提议首个本地产出与
+读取路径：`todo complete --result-file` 在既有 Goal/Todo 写入 owner 下，将声明的
+输出字节与摘要绑定到 canonical 完成 / 验收回执；`todo result-read` 复核当前
+验收基线与精确字节。仅本机回环可用的 Goal 范围 API 对每个请求页面和精确读取
+重新核验，打包工作区的 Goal「文件」可展开可读报告。来源丢失、变化或过期时
+不显示结果，并清除先前正文。没有声明且当前有效的输出，完成也不产生成果行。
+这一提案不扩大远程受众，也不新增第二个写入 owner。
+
+提议版本已对本地 File/SQLite 产出及 CLI 回读、打包桌面 / 手机「文件」读取、
+过期 / 驳回结果和有界分页完成针对性验证；维护者评审与精确版本 CI 仍待完成。
+托管运行仍缺少向原请求方对话回送的路径；它需要独立的受众身份、重启和越权
+读取验收。本地「文件」阅读器和一条 Todo 的验收，都不能证明请求方采用、
+混合团队启动或整队停止 / 恢复。
 已合并 [#4814](https://github.com/loopx-project/loopx/pull/4814) 支持从管家和 Goal
 飞书卡片确认同一份 canonical 团队计划。认证的卡片绑定和共享决策 owner 防止第二次
 点击重复分配。这加强可选请求/干预入口；真实双卡点击仍需安装后验收，不能证明

docs/architecture/rfcs/loopx-overall-roadmap-v0.md

@@ -457,6 +457,14 @@ including independent objection and useful synthesis, remains open.
 This qualifies a local execution-facts readback, not the full R2 ladder: assignment
 receipt integration, provisioning, remote probes, two-cycle continuation and Lark
 qualification remain open under their existing owners.
+For managed non-Chat work, [PR #4978](https://github.com/loopx-project/loopx/pull/4978)
+proposes an accepted, exact-version Goal result readback: canonical Todo
+completion binds local report bytes, the CLI verifies them, and packaged Goal
+Files reads a Goal-scoped loopback projection. The [Live Team Workspace RFC](live-team-workspace-v0.md)
+defines this producer-to-reader boundary. Focused local File/SQLite and
+desktop/mobile checks pass on the proposed head; maintainer review and CI
+remain open. Return to the original requester conversation, mixed-team
+continuation and stop/recovery remain separate unqualified outcomes.
 
 **Live team experience is a core S5 outcome.** The [Live Team Workspace
 RFC](live-team-workspace-v0.md) joins a precise command surface with a spatial

docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md

@@ -391,6 +391,12 @@ executor/profile 检查启动条件。任务准入、当前 pinned 验收绑定
 验收；包含独立异议和有效综合结论的 L1 仍未通过。
 这只验收本地执行事实的读回；计划分配回执
 整合、通用创建、远端探针、两轮持续协作及 Lark 等价仍由原 owner 继续推进。
+对于托管非 Chat 工作，[PR #4978](https://github.com/loopx-project/loopx/pull/4978)
+提议已验收、精确版本的 Goal 成果回读：canonical Todo 完成时绑定本地报告字节，
+CLI 重新核验，打包 Goal「文件」读取按 Goal 限定的本机回环投影。
+[团队实时工作区 RFC](live-team-workspace-v0.zh-CN.md) 定义产出到读取的边界。
+提议版本已通过本地 File/SQLite 和桌面 / 手机的针对性检查；维护者评审与 CI
+仍待完成。向原请求方对话回送、混合团队持续协作及整队停止 / 恢复仍需另行验收。
 
 **团队现场是 S5 核心产品目标。** [团队实时工作区 RFC](live-team-workspace-v0.zh-CN.md)
 融合精确指挥台与空间研究工作室：展示产物交换、有来源的分歧、结论修订、回放与