@remembrance-ai/opencode-plugin 0.1.73 → 0.1.76

package/servers/remembrance-mcp.mjs

@@ -5073,6 +5073,18 @@ function pluginLifecycleCheck(pluginHealth, issues) {
       "The native plugin startup and prompt lifecycle is active."
     );
   }
+  if (pluginHealth.status === "pending") {
+    const pending = Array.isArray(pluginHealth.pending_components) ? pluginHealth.pending_components.filter(
+      (component) => component === "tool_observer" || component === "completion_hook"
+    ) : [];
+    const pendingSummary = pending.map(
+      (component) => component === "tool_observer" ? "tool observation" : "completion"
+    ).join(" and ");
+    return info(
+      "plugin_lifecycle",
+      `The native plugin startup and prompt lifecycle is active; ${pendingSummary || "remaining lifecycle"} verification is pending until ${pending.length === 1 ? "that event has" : "those events have"} an opportunity to run.`
+    );
+  }
   if (stringValue(pluginHealth.surface) === "codex" && issues.includes("hook_trust_required")) {
     const hookTrust = record(pluginHealth.hook_trust);
     const allowedEvents = /* @__PURE__ */ new Set([
@@ -5099,7 +5111,7 @@ function pluginLifecycleCheck(pluginHealth, issues) {
     const codex = stringValue(pluginHealth.surface) === "codex";
     return warning(
       "plugin_lifecycle",
-      "The core native lifecycle is active; tool or completion events have not occurred yet.",
+      "The core native lifecycle is active, but a tool-observer or completion event did not run after an observed opportunity.",
       "exercise_plugin_lifecycle",
       codex ? `Use one Remembrance tool, complete one turn, and rerun the doctor. If this warning remains, ${codexHookReviewAction("run_connection_doctor")}` : "Use one Remembrance tool, complete one turn, and rerun the doctor.",
       issues,
@@ -5180,6 +5192,9 @@ function issueCodes(value) {
 function pass(id, summary) {
   return { id, status: "pass", summary, remediation: null };
 }
+function info(id, summary) {
+  return { id, status: "info", summary, remediation: null };
+}
 function notApplicable(id, summary) {
   return { id, status: "not_applicable", summary, remediation: null };
 }
@@ -5555,9 +5570,9 @@ function builtInPreferenceDefinition(key) {
 
 // ../core/src/agent-guidance.ts
 var REMEMBRANCE_QUERY_TOOL_DESCRIPTION = "Call before non-trivial service, API, tool, library, workflow, UI, review, test, security, or deployment work to find relevant Remembrance skills and resources. For short context-dependent follow-ups, infer the concrete task from the full conversation, preserve any plugin-supplied client_context.directive_id/runtime/trigger_reason, and query anyway. Compare each candidate's bounded why_matched evidence and applicability conditions before opening it; discard stated unlikely or corner-case mismatches. High matches should be fetched before custom work; possible and exploratory matches remain optional. Do not use for broad web search or one-off facts.";
-var REMEMBRANCE_CONNECTION_STATUS_TOOL_DESCRIPTION = "Inspect the active Remembrance transport, credential source, and authenticated registry scope without exposing credentials. Call this before diagnosing authentication, checking environment variables, or making anonymous REST/browser probes. Local or bundled MCP can read REMEMBRANCE_API_KEY or ~/.config/remembrance/config.json; hosted MCP cannot read local files and authenticates from its request header. When a declared native lifecycle is degraded, local MCP may submit bounded, content-free health evidence unless REMEMBRANCE_HEALTH_REPORTING=0. Never infer the plugin's scope from REMEMBRANCE_API_KEY alone.";
+var REMEMBRANCE_CONNECTION_STATUS_TOOL_DESCRIPTION = "Inspect the active Remembrance transport, credential source, authenticated registry scope, and content-free recent contribution outcomes for the current installation or API key without exposing credentials or lesson content. Call this before diagnosing authentication, checking environment variables, or making anonymous REST/browser probes. Local or bundled MCP can read REMEMBRANCE_API_KEY or ~/.config/remembrance/config.json; hosted MCP cannot read local files and authenticates from its request header. When a declared native lifecycle is degraded, local MCP may submit bounded, content-free health evidence unless REMEMBRANCE_HEALTH_REPORTING=0. Never infer the plugin's scope from REMEMBRANCE_API_KEY alone.";
 var REMEMBRANCE_CONNECTION_DOCTOR_TOOL_DESCRIPTION = "Run a bounded, non-mutating Remembrance connection diagnostic. It verifies the active transport, a redacted registry destination, authenticated scope, query authorization, a real catalog read, and organization submission capability. Local MCP also checks shared-config permissions, destination consistency, native plugin lifecycle, and signing identity; hosted MCP marks local-only checks unavailable. It never submits content, creates query demand, opens a review item, or returns credentials, absolute paths, private registry URLs, prompts, or repository data.";
-var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = "Remembrance is shared operational memory for agents. Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, satisfied and missed constraints, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. A host privacy or tenant-policy denial happens before Remembrance receives the request. Tell the user: 'Remembrance was blocked by host policy before reaching Remembrance. Nothing was sent. Querying remains available.' Do not retry the blocked content through another transport or claim submission. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces.";
+var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = "Remembrance is shared operational memory for agents. Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, satisfied and missed constraints, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Route memory deliberately: host-local memory is for facts about this human, repository, or machine; Remembrance is for generalized lessons another approved organization agent would otherwise rediscover. A local-memory write does not satisfy organization-shared capture. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. A host privacy or tenant-policy denial happens before Remembrance receives the request. Tell the user: 'Remembrance was blocked by host policy before reaching Remembrance. Nothing was sent. Querying remains available.' Do not retry the blocked content through another transport or claim submission. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces.";
 
 // ../core/src/redaction.ts
 var SECRET_PATTERN_SPECS = [
@@ -5716,6 +5731,20 @@ var PRIVATE_LESSON_TAG_IDENTITY_HINTS = /* @__PURE__ */ new Set([
   "tenant",
   "user"
 ]);
+var PRIVATE_LESSON_TAG_IDENTITY_LABEL_SUFFIXES = /* @__PURE__ */ new Set([
+  "corp",
+  "org",
+  "organization"
+]);
+var PRIVATE_LESSON_TAG_RELATIONAL_PREFIXES = /* @__PURE__ */ new Set([
+  "cross",
+  "inter",
+  "intra",
+  "multi",
+  "per",
+  "single",
+  "sub"
+]);
 var privateLessonCanonicalTagSchema = privateLessonTagSyntaxSchema.superRefine((tag, ctx) => {
   const inspected = inspectPrivateLessonTag(tag);
   if (inspected.tag !== tag || inspected.held_reasons.length > 0) {
@@ -6110,8 +6139,14 @@ function computePrivateLessonRedactorDigest() {
       metadata: {
         correlation_ids: "domain-separated-sha256-v1",
         tag_syntax: PRIVATE_LESSON_TAG_PATTERN.source,
-        tag_safety: "redaction-plus-identity-hints-v1",
+        tag_safety: "redaction-plus-identity-hints-v2",
         tag_identity_hints: [...PRIVATE_LESSON_TAG_IDENTITY_HINTS].sort(),
+        tag_identity_label_suffixes: [
+          ...PRIVATE_LESSON_TAG_IDENTITY_LABEL_SUFFIXES
+        ].sort(),
+        tag_relational_prefixes: [
+          ...PRIVATE_LESSON_TAG_RELATIONAL_PREFIXES
+        ].sort(),
         tag_aliases: PRIVATE_LESSON_SAFE_TAG_ALIASES
       },
       rules: REPLACEMENTS.map(({ category, pattern, hold }) => ({
@@ -6135,7 +6170,10 @@ function inspectPrivateLessonTag(value) {
   const identityHints = new Set(
     aliased.split(/[-_]/u).filter((segment) => PRIVATE_LESSON_TAG_IDENTITY_HINTS.has(segment))
   );
-  if (!privateLessonTagSyntaxSchema.safeParse(aliased).success || redacted.text !== aliased || identityHints.size >= 2) {
+  const segments = aliased.split(/[-_]/u);
+  const isGenericOrganizationRelationship = segments.length === 2 && PRIVATE_LESSON_TAG_RELATIONAL_PREFIXES.has(segments[0] ?? "") && PRIVATE_LESSON_TAG_IDENTITY_LABEL_SUFFIXES.has(segments[1] ?? "");
+  const hasLikelyIdentityLabel = segments.length >= 2 && !isGenericOrganizationRelationship && PRIVATE_LESSON_TAG_IDENTITY_LABEL_SUFFIXES.has(segments.at(-1) ?? "") && segments.slice(0, -1).some((segment) => !PRIVATE_LESSON_TAG_IDENTITY_HINTS.has(segment));
+  if (!privateLessonTagSyntaxSchema.safeParse(aliased).success || redacted.text !== aliased || identityHints.size >= 2 || hasLikelyIdentityLabel) {
     if (held.size === 0) {
       counts.identifier = Math.min(999, (counts.identifier ?? 0) + 1);
       held.add("identifier");
@@ -6162,12 +6200,18 @@ function pseudonymizeCorrelationId(value) {
   return `corr_${digest.slice(0, 48)}`;
 }
 var CURRENT_PRIVATE_LESSON_REDACTOR_DIGEST = computePrivateLessonRedactorDigest();
+var PRIVATE_LESSON_LEGACY_V2_REDACTOR_DIGEST = "sha256:bca83ac50b0124a0401f806b3498bbb1ec977c02c1975d5345cb8d0b85c00b75";
 var PRIVATE_LESSON_SUPPORTED_REDACTOR_PROFILES = Object.freeze({
   [PRIVATE_LESSON_REDACTION_VERSION]: Object.freeze({
     [CURRENT_PRIVATE_LESSON_REDACTOR_DIGEST]: Object.freeze({
       version: PRIVATE_LESSON_REDACTION_VERSION,
       digest: CURRENT_PRIVATE_LESSON_REDACTOR_DIGEST,
       normalization: "unicode-nfc-lf-space-v1"
+    }),
+    [PRIVATE_LESSON_LEGACY_V2_REDACTOR_DIGEST]: Object.freeze({
+      version: PRIVATE_LESSON_REDACTION_VERSION,
+      digest: PRIVATE_LESSON_LEGACY_V2_REDACTOR_DIGEST,
+      normalization: "unicode-nfc-lf-space-v1"
     })
   })
 });
@@ -7595,7 +7639,7 @@ var seedSkills = [
     summary: "Operational setup and troubleshooting workflow for Remembrance across Claude Code, Codex, OpenClaw, Cursor, Gemini, MCP, REST, skill-only installs, enterprise keys, and local agent identity.",
     status: "active",
     visibility: "public",
-    version: "0.1.23",
+    version: "0.1.25",
     domains: ["agent-skills", "mcp", "resource-discovery"],
     tags: [
       "remembrance",
@@ -7646,7 +7690,7 @@ var seedSkills = [
         "gemini",
         "rest"
       ],
-      version: "0.1.23",
+      version: "0.1.25",
       status: "active",
       visibility: "public",
       providers: ["codex", "claude", "cursor", "openclaw", "generic"],
@@ -8001,16 +8045,23 @@ This is the only host-visible network action in the flow. Approve or persist
 approval for this exact action, not every Remembrance write. The server derives
 the organization and private visibility from the authenticated key, verifies a
 signed organization policy plus purpose-bound attestation, and returns a signed
-content-free receipt. The endpoint can never create or automatically propagate
-public content.
+content-free receipt. The action always submits privately and never falls back
+to anonymous or public submission. After an accepted private outcome, a
+separate server-owned process may create a freshly redacted public candidate
+only when the organization admin enabled the **Contribution propagation**
+setting; the submitting agent neither chooses nor sees that process, and the
+derivative must pass the complete public pipeline.
 
 If the host denies the action, no candidate content was sent. The encrypted
 draft remains on the device in \`awaiting_authorization\`; do not retry it
 through REST, hosted MCP, or another transport. Timeouts, 429s, and 5xx
 responses retry with bounded backoff during later plugin lifecycles. A 401,
 403, policy change, or validation failure remains held for explicit repair.
-Drafts never expire or auto-delete. Inspect, retry, or explicitly delete one
-with the local private-lesson tools; deletion requires confirmation.
+Unresolved and terminal drafts never expire or auto-delete. Inspect, retry, or
+explicitly delete one with the local private-lesson tools; deletion requires
+confirmation. After a signed submission receipt is verified, the encrypted
+lesson content is removed immediately and its content-free completion marker
+is automatically deleted after 14 days.
 
 The signed organization policy pins \`private-lesson-redaction-v2\` and its exact
 supported redactor digest. If either is unsupported, the finalized
@@ -10841,7 +10892,7 @@ var toolDefinitions = [
   ),
   tool(
     "submit_private_lesson_candidate",
-    "Submit exactly one canonical, challenge-attested organization-private lesson candidate or one content-free held-safety telemetry event. Local plugin clients normally pass only the draft_id returned by prepare_private_lesson_candidate; raw or hosted clients pass the strict candidate-or-hold union. The action can never create or automatically promote public content. Held telemetry contains no lesson prose and can never enter verification, review, topology, or skill materialization. Exact replay is idempotent; host denial leaves the local draft untouched.",
+    "Submit exactly one canonical, challenge-attested organization-private lesson candidate or one content-free held-safety telemetry event. Local plugin clients normally pass only the draft_id returned by prepare_private_lesson_candidate; raw or hosted clients pass the strict candidate-or-hold union. The action always creates only an organization-private submission and never falls back to anonymous or public submission. Held telemetry contains no lesson prose and can never enter verification, review, topology, or skill materialization. Exact replay is idempotent; host denial leaves the local draft untouched.",
     "/api/v1/agent/private-lessons",
     privateLessonSubmissionToolSchema
   ),
@@ -11053,8 +11104,16 @@ function isAlreadyExistsError(error) {
 }
 
 // src/connection-status.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { createHash as createHash2 } from "node:crypto";
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  lstatSync as lstatSync2,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import { isIP } from "node:net";
 import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
@@ -11349,6 +11408,7 @@ var PLUGIN_HEALTH_COMPONENTS = [
   "tool_observer",
   "completion_hook"
 ];
+var CONNECTION_DOCTOR_PROBE_COMPONENT = "connection_doctor_probe";
 var PLUGIN_HEALTH_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var PLUGIN_HEALTH_MAX_FUTURE_SKEW_MS = 5 * 60 * 1e3;
 var HOST_POLICY_OBSERVATION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -11371,6 +11431,57 @@ var nodeFileSystem2 = {
   mode: secureLocalFileMode,
   list: listSecureLocalDirectory
 };
+function recordConnectionDoctorLifecycleProbe(options = {}) {
+  const env = options.env ?? process.env;
+  const rawSurface = String(env.REMEMBRANCE_PLUGIN_HOST ?? "").trim().toLowerCase();
+  if (!isPluginHostSurface(rawSurface)) return false;
+  const healthDir = env.REMEMBRANCE_PLUGIN_HEALTH_DIR ? String(env.REMEMBRANCE_PLUGIN_HEALTH_DIR) : join3(
+    options.homeDirectory ?? homedir3(),
+    ".cache",
+    "remembrance",
+    "plugin-health"
+  );
+  const path = join3(healthDir, `${rawSurface}.json`);
+  if (!existsSync2(path)) return false;
+  const temporaryPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    const parsed = JSON.parse(
+      readSecureLocalText(path, {
+        maxBytes: MAX_LOCAL_LIFECYCLE_MARKER_BYTES
+      })
+    );
+    if (!isRecord3(parsed) || parsed.surface !== rawSurface) return false;
+    const components = isRecord3(parsed.components) ? parsed.components : {};
+    if (typeof components.session_start !== "string") return false;
+    mkdirSync(healthDir, { recursive: true, mode: 448 });
+    const directoryMetadata = lstatSync2(healthDir);
+    if (directoryMetadata.isSymbolicLink() || !directoryMetadata.isDirectory()) {
+      return false;
+    }
+    chmodSync(healthDir, 448);
+    writeFileSync(
+      temporaryPath,
+      `${JSON.stringify({
+        ...parsed,
+        components: {
+          ...components,
+          [CONNECTION_DOCTOR_PROBE_COMPONENT]: (options.now ?? /* @__PURE__ */ new Date()).toISOString()
+        }
+      })}
+`,
+      { mode: 384, flag: "wx" }
+    );
+    renameSync(temporaryPath, path);
+    chmodSync(path, 384);
+    return true;
+  } catch {
+    try {
+      rmSync(temporaryPath, { force: true });
+    } catch {
+    }
+    return false;
+  }
+}
 function remembranceConfigPath(env = process.env, homeDirectory = homedir3()) {
   const configRoot = env.REMEMBRANCE_PLUGIN_HOST?.trim().toLowerCase() === "openclaw" ? join3(homeDirectory, ".config") : env.XDG_CONFIG_HOME ?? join3(homeDirectory, ".config");
   return join3(configRoot, "remembrance", "config.json");
@@ -11735,6 +11846,20 @@ function localPluginLifecycleHealth(options) {
     }
     if (Number.isFinite(latestMs)) mergedComponents[component] = latestValue;
   }
+  let latestDoctorProbe;
+  let latestDoctorProbeMs = Number.NEGATIVE_INFINITY;
+  for (const entry of cohort) {
+    const components2 = isRecord3(entry.marker.components) ? entry.marker.components : {};
+    const value = components2[CONNECTION_DOCTOR_PROBE_COMPONENT];
+    const valueMs = validLifecycleTimestamp(value, nowMs);
+    if (valueMs > latestDoctorProbeMs) {
+      latestDoctorProbeMs = valueMs;
+      latestDoctorProbe = value;
+    }
+  }
+  if (Number.isFinite(latestDoctorProbeMs)) {
+    mergedComponents[CONNECTION_DOCTOR_PROBE_COMPONENT] = latestDoctorProbe;
+  }
   const marker = {
     ...newestEntry.marker,
     components: mergedComponents,
@@ -11772,6 +11897,7 @@ function localPluginLifecycleHealth(options) {
   const coreLifecycleObserved = components.session_start.observed && components.prompt_hook.observed;
   const hookTrust = normalizedPluginHookTrust(marker.hook_trust);
   const hookTrustReviewEvents = hookTrust?.status === "review_required" ? new Set(hookTrust.review_events) : /* @__PURE__ */ new Set();
+  const pendingComponents = [];
   if (hookTrustReviewEvents.size > 0) {
     issues.push({
       code: "hook_trust_required",
@@ -11780,17 +11906,40 @@ function localPluginLifecycleHealth(options) {
       ])
     });
   }
-  if (coreLifecycleObserved && !components.tool_observer.observed && !hookTrustReviewEvents.has("PostToolUse")) {
-    issues.push({
-      code: "tool_observer_not_observed",
-      action: surface === "codex" ? `Use a Remembrance MCP tool, then call get_connection_status again. If this remains missing, ${codexHookReviewAction("get_connection_status")}` : "No native tool observer has run in this session yet. Use a Remembrance MCP tool, then call get_connection_status again."
-    });
+  if (coreLifecycleObserved && !hookTrustReviewEvents.has("PostToolUse")) {
+    const toolObserverMs = validLifecycleTimestamp(
+      componentRecord.tool_observer,
+      nowMs
+    );
+    const missedProbe = Number.isFinite(latestDoctorProbeMs) && (!Number.isFinite(toolObserverMs) || toolObserverMs < latestDoctorProbeMs);
+    if (missedProbe) {
+      issues.push({
+        code: "tool_observer_not_observed",
+        action: surface === "codex" ? `A prior doctor call completed without a later tool-observer event. ${codexHookReviewAction("get_connection_status")}` : "A prior doctor call completed without a later native tool-observer event. Update or reinstall the plugin, fully restart the host, and retry."
+      });
+    } else if (!components.tool_observer.observed) {
+      pendingComponents.push("tool_observer");
+    }
   }
-  if (coreLifecycleObserved && !components.completion_hook.observed && !hookTrustReviewEvents.has("Stop")) {
-    issues.push({
-      code: "completion_hook_not_observed",
-      action: surface === "codex" ? `Complete one turn, then call get_connection_status again. If this remains missing, ${codexHookReviewAction("get_connection_status")}` : "No native completion hook has run in this session yet. Complete one turn, then call get_connection_status again."
-    });
+  if (coreLifecycleObserved && !hookTrustReviewEvents.has("Stop")) {
+    const promptHookMs = validLifecycleTimestamp(
+      componentRecord.prompt_hook,
+      nowMs
+    );
+    const completionHookMs = validLifecycleTimestamp(
+      componentRecord.completion_hook,
+      nowMs
+    );
+    const completedTurnOpportunity = Number.isFinite(latestDoctorProbeMs) && Number.isFinite(promptHookMs) && promptHookMs > latestDoctorProbeMs;
+    const missedCompletedTurn = completedTurnOpportunity && (!Number.isFinite(completionHookMs) || completionHookMs < latestDoctorProbeMs);
+    if (missedCompletedTurn) {
+      issues.push({
+        code: "completion_hook_not_observed",
+        action: surface === "codex" ? `A new prompt arrived after a prior doctor call without an intervening completion event. ${codexHookReviewAction("get_connection_status")}` : "A new prompt arrived after a prior doctor call without an intervening native completion event. Update or reinstall the plugin, fully restart the host, and retry."
+      });
+    } else if (!components.completion_hook.observed) {
+      pendingComponents.push("completion_hook");
+    }
   }
   const lastSeenMs = validLifecycleTimestamp(marker.last_seen_at, nowMs);
   const lastSeenAt = Number.isFinite(lastSeenMs) ? String(marker.last_seen_at) : null;
@@ -11834,7 +11983,7 @@ function localPluginLifecycleHealth(options) {
   );
   return {
     expected: true,
-    status: issues.length === 0 ? "active" : onlyAwaitingEligibleEvents ? "partial" : "degraded",
+    status: issues.length === 0 ? pendingComponents.length > 0 ? "pending" : "active" : onlyAwaitingEligibleEvents ? "partial" : "degraded",
     surface,
     plugin_version: markerVersion || null,
     host_version: typeof marker.host_version === "string" && marker.host_version ? marker.host_version : null,
@@ -11847,6 +11996,7 @@ function localPluginLifecycleHealth(options) {
     },
     hook_trust: hookTrust,
     components,
+    pending_components: pendingComponents,
     issues,
     explanation: "Each host process session is tracked independently. Turn-specific prompt, tool, and completion observations are combined only when they share the current SessionStart marker."
   };
@@ -12090,7 +12240,7 @@ async function checkClientUpdate(input) {
 }
 
 // src/private-lesson-outbox.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes3 } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import {
   chmod as chmod2,
@@ -12106,7 +12256,7 @@ import { homedir as homedir4 } from "node:os";
 import { dirname as dirname2, join as join4 } from "node:path";
 
 // src/private-lesson-keychain.ts
-import { randomBytes } from "node:crypto";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 var KEYCHAIN_SERVICE = "dev.remembrance.private-lessons";
@@ -12148,7 +12298,7 @@ function resolvePrivateLessonKeychainKey(env, dependencies = defaultDependencies
   if (!keychainEnabled(env, dependencies)) return null;
   const existing = readPrivateLessonKeychainKey(env, dependencies);
   if (existing) return existing;
-  const encoded = dependencies.randomKey ?? randomBytes(32).toString("base64url");
+  const encoded = dependencies.randomKey ?? randomBytes2(32).toString("base64url");
   const generated = decodeKey(encoded);
   if (!generated) return null;
   try {
@@ -12184,9 +12334,11 @@ function decodeKey(encoded) {
 // src/private-lesson-outbox.ts
 var PRIVATE_LESSON_OUTBOX_VERSION = "private-lesson-outbox-v1";
 var PRIVATE_LESSON_OUTBOX_MAX_BYTES = 64 * 1024 * 1024;
+var PRIVATE_LESSON_SUBMITTED_RECORD_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
 var PRIVATE_LESSON_OUTBOX_MIN_BYTES = 1024 * 1024;
 var PRIVATE_LESSON_OUTBOX_MAX_CONFIGURED_BYTES = 1024 * 1024 * 1024;
 var PRIVATE_LESSON_DRAFT_MAX_BYTES = 64 * 1024;
+var PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES = 8 * 1024;
 var PRIVATE_LESSON_OUTBOX_LOCK_STALE_MS = 3e4;
 var PRIVATE_LESSON_OUTBOX_LOCK_WAIT_MS = 5e3;
 var privateLessonOutboxLockContext = new AsyncLocalStorage();
@@ -12254,6 +12406,9 @@ async function readPrivateLessonDraft(draftId, options = {}) {
     if (existsSync4(tombstonePath(outbox.directory, draftId))) {
       throw new Error("Private lesson draft was explicitly deleted.");
     }
+    if (existsSync4(submittedRecordPath(outbox.directory, draftId))) {
+      throw new Error("Private lesson draft was already submitted.");
+    }
     const path = draftPath(outbox.directory, draftId);
     await assertRegularPrivateFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES);
     const serialized = await readBoundedFile(
@@ -12272,10 +12427,77 @@ async function readPrivateLessonDraft(draftId, options = {}) {
     return reconciled;
   });
 }
+async function readPrivateLessonSubmittedRecord(draftId, options = {}) {
+  assertDraftId(draftId);
+  const directory = options.outboxDirectory ?? privateLessonOutboxDirectory(options.env, options.homeDirectory);
+  if (!existsSync4(directory)) return null;
+  assertPrivateLessonPathMetadata(await lstat(directory), "directory");
+  return withPrivateLessonOutboxLock(directory, async () => {
+    await reconcileSubmittedRecordsUnlocked(
+      directory,
+      options.now ?? /* @__PURE__ */ new Date()
+    );
+    if (existsSync4(tombstonePath(directory, draftId))) {
+      throw new Error("Private lesson draft was explicitly deleted.");
+    }
+    const path = submittedRecordPath(directory, draftId);
+    if (!existsSync4(path)) return null;
+    await assertRegularPrivateFile(
+      path,
+      PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+    );
+    return parseSubmittedRecord(
+      await readBoundedFile(path, PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES),
+      draftId
+    );
+  });
+}
+async function readPrivateLessonSubmissionSource(draftId, options = {}) {
+  assertDraftId(draftId);
+  const outbox = await readyOutbox(options);
+  return withPrivateLessonOutboxLock(outbox.directory, async () => {
+    await reconcileSubmittedRecordsUnlocked(
+      outbox.directory,
+      options.now ?? /* @__PURE__ */ new Date()
+    );
+    if (existsSync4(tombstonePath(outbox.directory, draftId))) {
+      throw new Error("Private lesson draft was explicitly deleted.");
+    }
+    const completionPath = submittedRecordPath(outbox.directory, draftId);
+    if (existsSync4(completionPath)) {
+      await assertRegularPrivateFile(
+        completionPath,
+        PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+      );
+      return {
+        kind: "submitted",
+        completion: parseSubmittedRecord(
+          await readBoundedFile(
+            completionPath,
+            PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+          ),
+          draftId
+        )
+      };
+    }
+    return {
+      kind: "draft",
+      draft: await readPrivateLessonDraft(draftId, {
+        ...options,
+        outboxDirectory: outbox.directory,
+        encryption: outbox.encryption
+      })
+    };
+  });
+}
 async function reconcilePrivateLessonOutboxProfiles(options = {}) {
   const outbox = await readyOutbox(options);
   return withPrivateLessonOutboxLock(outbox.directory, async () => {
     await reconcileExplicitDeletionTombstones(outbox.directory);
+    await reconcileSubmittedRecordsUnlocked(
+      outbox.directory,
+      options.now ?? /* @__PURE__ */ new Date()
+    );
     const entries = await secureOutboxEntries(outbox.directory);
     let inspected = 0;
     let terminalized = 0;
@@ -12296,10 +12518,18 @@ async function reconcilePrivateLessonOutboxProfiles(options = {}) {
         encryption: outbox.encryption
       });
       inspected += 1;
+      if (draft.state === "submitted") {
+        await compactLegacySubmittedDraftUnlocked(draft, outbox);
+        continue;
+      }
       if (before !== "superseded_redactor" && draft.state === "superseded_redactor") {
         terminalized += 1;
       }
     }
+    await reconcileSubmittedRecordsUnlocked(
+      outbox.directory,
+      options.now ?? /* @__PURE__ */ new Date()
+    );
     return { inspected, terminalized };
   });
 }
@@ -12313,8 +12543,22 @@ async function listPrivateLessonDrafts(options = {}) {
   const entries = await secureOutboxEntries(outbox.directory);
   const limit = Math.max(1, Math.min(options.limit ?? 50, 200));
   const drafts = [];
-  for (const name of entries.filter((item) => item.endsWith(".lesson.json"))) {
+  for (const name of entries.filter(
+    (item) => item.endsWith(".lesson.json") || item.endsWith(".submitted.json")
+  )) {
     if (drafts.length >= limit) break;
+    if (name.endsWith(".submitted.json")) {
+      const draftId = name.slice(0, -".submitted.json".length);
+      const completion = parseSubmittedRecord(
+        await readBoundedFile(
+          submittedRecordPath(outbox.directory, draftId),
+          PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+        ),
+        draftId
+      );
+      drafts.push(submittedRecordListItem(completion));
+      continue;
+    }
     const draft = await readPrivateLessonDraft(
       name.slice(0, -".lesson.json".length),
       {
@@ -12333,6 +12577,7 @@ async function listPrivateLessonDrafts(options = {}) {
       created_at: draft.created_at,
       updated_at: draft.updated_at,
       submitted_at: draft.submitted_at,
+      completion_expires_at: null,
       terminal_reason: draft.terminal_reason,
       hold_telemetry_status: draft.hold_telemetry_status,
       hold_event_digest: draft.hold_event_digest,
@@ -12360,6 +12605,72 @@ async function updatePrivateLessonDraft(draftId, update, options = {}) {
     return next;
   });
 }
+async function completePrivateLessonSubmission(draftId, input, options = {}) {
+  assertDraftId(draftId);
+  const outbox = await readyOutbox(options);
+  return withPrivateLessonOutboxLock(outbox.directory, async () => {
+    await reconcileSubmittedRecordsUnlocked(
+      outbox.directory,
+      options.now ?? /* @__PURE__ */ new Date()
+    );
+    if (existsSync4(tombstonePath(outbox.directory, draftId))) {
+      throw new Error("Private lesson draft was explicitly deleted.");
+    }
+    const existingPath = submittedRecordPath(outbox.directory, draftId);
+    if (existsSync4(existingPath)) {
+      const completion2 = parseSubmittedRecord(
+        await readBoundedFile(
+          existingPath,
+          PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+        ),
+        draftId
+      );
+      if (completion2.receipt_digest !== input.receipt_digest) {
+        throw new Error("Private lesson submitted receipt digest conflicts.");
+      }
+      return completion2;
+    }
+    const path = draftPath(outbox.directory, draftId);
+    await assertRegularPrivateFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES);
+    const envelope = parseEnvelope(
+      await readBoundedFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES),
+      draftId
+    );
+    const current = decryptDraft(envelope, outbox.encryption, true);
+    if (current.state === "superseded_redactor") {
+      throw new Error("Terminal private lesson drafts cannot be submitted.");
+    }
+    if (current.state === "submitted" && current.receipt_digest !== input.receipt_digest) {
+      throw new Error("Private lesson submitted receipt digest conflicts.");
+    }
+    const submittedAt = input.submitted_at ?? options.now ?? /* @__PURE__ */ new Date();
+    const submittedIso = submittedAt.toISOString();
+    const draft = current.state === "submitted" ? current : validateDraft({
+      ...current,
+      state: "submitted",
+      attempts: Math.min(1e3, current.attempts + 1),
+      next_retry_at: null,
+      last_error_code: null,
+      submitted_at: submittedIso,
+      receipt_digest: input.receipt_digest,
+      updated_at: submittedIso
+    });
+    const completion = submittedRecordFromDraft(draft, {
+      remote_status: input.remote_status,
+      processing_state: input.processing_state
+    });
+    await atomicWritePrivate(
+      submittedRecordPath(outbox.directory, draftId),
+      `${JSON.stringify(completion)}
+`
+    );
+    await unlink(path).catch(() => {
+    });
+    await syncDirectory(outbox.directory).catch(() => {
+    });
+    return completion;
+  });
+}
 async function deletePrivateLessonDraft(draftId, confirmed, options = {}) {
   if (!confirmed) {
     throw new Error(
@@ -12370,7 +12681,19 @@ async function deletePrivateLessonDraft(draftId, confirmed, options = {}) {
   const outbox = await readyOutbox(options);
   return withPrivateLessonOutboxLock(outbox.directory, async () => {
     const path = draftPath(outbox.directory, draftId);
-    await assertRegularPrivateFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES);
+    const completionPath = submittedRecordPath(outbox.directory, draftId);
+    if (!existsSync4(path) && !existsSync4(completionPath)) {
+      throw new Error("Private lesson draft does not exist.");
+    }
+    if (existsSync4(path)) {
+      await assertRegularPrivateFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES);
+    }
+    if (existsSync4(completionPath)) {
+      await assertRegularPrivateFile(
+        completionPath,
+        PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+      );
+    }
     const tombstone = {
       version: "private-lesson-outbox-deletion-v1",
       draft_id: draftId,
@@ -12382,7 +12705,12 @@ async function deletePrivateLessonDraft(draftId, confirmed, options = {}) {
       `${JSON.stringify(tombstone)}
 `
     );
-    await unlink(path);
+    await unlink(path).catch((error) => {
+      if (!isMissingError(error)) throw error;
+    });
+    await unlink(completionPath).catch((error) => {
+      if (!isMissingError(error)) throw error;
+    });
     await syncDirectory(outbox.directory);
     return tombstone;
   });
@@ -12415,6 +12743,15 @@ async function privateLessonOutboxSummary(options = {}) {
       deletionTombstones += 1;
       continue;
     }
+    if (name.endsWith(".submitted.json")) {
+      const draftId = name.slice(0, -".submitted.json".length);
+      parseSubmittedRecord(
+        await readBoundedFile(path, PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES),
+        draftId
+      );
+      counts.submitted += 1;
+      continue;
+    }
     if (!name.endsWith(".lesson.json")) continue;
     const envelope = parseEnvelope(
       await readBoundedFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES),
@@ -12477,6 +12814,11 @@ async function inspectPrivateLessonOutboxHealth(options = {}) {
       outboxDirectory: directory,
       encryption
     });
+  } else {
+    await withPrivateLessonOutboxLock(
+      directory,
+      () => reconcileSubmittedRecordsUnlocked(directory, options.now ?? /* @__PURE__ */ new Date())
+    );
   }
   const entries = await secureOutboxEntries(directory);
   const counts = emptyOutboxCounts();
@@ -12492,6 +12834,15 @@ async function inspectPrivateLessonOutboxHealth(options = {}) {
       deletionTombstones += 1;
       continue;
     }
+    if (name.endsWith(".submitted.json")) {
+      const draftId = name.slice(0, -".submitted.json".length);
+      parseSubmittedRecord(
+        await readBoundedFile(path, PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES),
+        draftId
+      );
+      counts.submitted += 1;
+      continue;
+    }
     if (!name.endsWith(".lesson.json")) continue;
     const envelope = parseEnvelope(
       await readBoundedFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES),
@@ -12559,7 +12910,7 @@ async function resolvePrivateLessonOutboxEncryption(options = {}) {
     encoded = await readConcurrentPrivateLessonFallbackKey(path);
   } catch (error) {
     if (!isMissingError(error)) throw error;
-    encoded = randomBytes2(32).toString("base64url");
+    encoded = randomBytes3(32).toString("base64url");
     try {
       await atomicWritePrivate(path, `${encoded}
 `);
@@ -12691,7 +13042,7 @@ async function withPrivateLessonOutboxLock(directory, operation) {
       if (Date.now() - metadata.mtimeMs > PRIVATE_LESSON_OUTBOX_LOCK_STALE_MS) {
         const stalePath = join4(
           directory,
-          `.outbox.lock.stale-${randomBytes2(12).toString("hex")}`
+          `.outbox.lock.stale-${randomBytes3(12).toString("hex")}`
         );
         try {
           await rename(lockPath, stalePath);
@@ -12741,14 +13092,22 @@ async function reconcileExplicitDeletionTombstones(directory) {
       await readBoundedFile(join4(directory, name), 4 * 1024),
       name.slice(0, -".deleted.json".length)
     );
-    const retainedDraft = draftPath(directory, tombstone.draft_id);
-    if (!existsSync4(retainedDraft)) continue;
-    await assertRegularPrivateFile(
-      retainedDraft,
-      PRIVATE_LESSON_DRAFT_MAX_BYTES
-    );
-    await unlink(retainedDraft);
-    changed = true;
+    const retainedPaths = [
+      {
+        path: draftPath(directory, tombstone.draft_id),
+        maxBytes: PRIVATE_LESSON_DRAFT_MAX_BYTES
+      },
+      {
+        path: submittedRecordPath(directory, tombstone.draft_id),
+        maxBytes: PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES
+      }
+    ];
+    for (const retained of retainedPaths) {
+      if (!existsSync4(retained.path)) continue;
+      await assertRegularPrivateFile(retained.path, retained.maxBytes);
+      await unlink(retained.path);
+      changed = true;
+    }
   }
   if (changed) await syncDirectory(directory);
 }
@@ -12779,7 +13138,7 @@ async function writeDraftUnlocked(draft, outbox, replace, _currentOutboxBytes, a
   if (plaintext.length > PRIVATE_LESSON_DRAFT_MAX_BYTES) {
     throw new Error("Private lesson draft exceeds its local size limit.");
   }
-  const nonce = randomBytes2(12);
+  const nonce = randomBytes3(12);
   const aad = Buffer.from(
     canonicalJson({
       version: "private-lesson-outbox-envelope-v1",
@@ -12947,6 +13306,135 @@ function terminalizeUnsupportedProfile(draft, now) {
     };
   }
 }
+function submittedRecordFromDraft(draft, remote) {
+  if (draft.state !== "submitted" || !draft.submitted_at || !draft.receipt_digest) {
+    throw new Error("Private lesson submission completion is incomplete.");
+  }
+  return parseSubmittedRecord(
+    JSON.stringify({
+      version: "private-lesson-outbox-submitted-v1",
+      draft_id: draft.draft_id,
+      state: "submitted",
+      payload_digest: draft.payload_digest,
+      redaction_version: draft.redaction_version,
+      redactor_digest: draft.redactor_digest,
+      attempts: draft.attempts,
+      created_at: draft.created_at,
+      updated_at: draft.updated_at,
+      submitted_at: draft.submitted_at,
+      expires_at: new Date(
+        Date.parse(draft.submitted_at) + PRIVATE_LESSON_SUBMITTED_RECORD_RETENTION_MS
+      ).toISOString(),
+      receipt_digest: draft.receipt_digest,
+      remote_status: remote.remote_status,
+      processing_state: remote.processing_state
+    }),
+    draft.draft_id
+  );
+}
+async function compactLegacySubmittedDraftUnlocked(draft, outbox) {
+  const completion = submittedRecordFromDraft(draft, {
+    remote_status: null,
+    processing_state: null
+  });
+  const path = submittedRecordPath(outbox.directory, draft.draft_id);
+  try {
+    await atomicWritePrivate(path, `${JSON.stringify(completion)}
+`);
+  } catch (error) {
+    if (!isAlreadyExistsError2(error)) throw error;
+    const existing = parseSubmittedRecord(
+      await readBoundedFile(path, PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES),
+      draft.draft_id
+    );
+    if (existing.payload_digest !== completion.payload_digest || existing.receipt_digest !== completion.receipt_digest) {
+      throw new Error("Private lesson submitted record conflicts.");
+    }
+  }
+  await unlink(draftPath(outbox.directory, draft.draft_id));
+  await syncDirectory(outbox.directory);
+}
+async function reconcileSubmittedRecordsUnlocked(directory, now) {
+  const entries = await secureOutboxEntries(directory);
+  let changed = false;
+  for (const name of entries.filter(
+    (entry) => entry.endsWith(".submitted.json")
+  )) {
+    const draftId = name.slice(0, -".submitted.json".length);
+    const path = submittedRecordPath(directory, draftId);
+    const completion = parseSubmittedRecord(
+      await readBoundedFile(path, PRIVATE_LESSON_SUBMITTED_RECORD_MAX_BYTES),
+      draftId
+    );
+    const retainedDraft = draftPath(directory, draftId);
+    if (existsSync4(retainedDraft)) {
+      await assertRegularPrivateFile(
+        retainedDraft,
+        PRIVATE_LESSON_DRAFT_MAX_BYTES
+      );
+      await unlink(retainedDraft);
+      changed = true;
+    }
+    if (Date.parse(completion.expires_at) <= now.getTime()) {
+      await unlink(path);
+      changed = true;
+    }
+  }
+  if (changed) await syncDirectory(directory);
+}
+function submittedRecordListItem(completion) {
+  return {
+    draft_id: completion.draft_id,
+    state: "submitted",
+    payload_digest: completion.payload_digest,
+    attempts: completion.attempts,
+    next_retry_at: null,
+    last_error_code: null,
+    created_at: completion.created_at,
+    updated_at: completion.updated_at,
+    submitted_at: completion.submitted_at,
+    completion_expires_at: completion.expires_at,
+    terminal_reason: null,
+    hold_telemetry_status: "not_required",
+    hold_event_digest: null,
+    hold_reported_at: null
+  };
+}
+function parseSubmittedRecord(serialized, expectedDraftId) {
+  const value = JSON.parse(serialized);
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "version",
+    "draft_id",
+    "state",
+    "payload_digest",
+    "redaction_version",
+    "redactor_digest",
+    "attempts",
+    "created_at",
+    "updated_at",
+    "submitted_at",
+    "expires_at",
+    "receipt_digest",
+    "remote_status",
+    "processing_state"
+  ]);
+  if (!isRecord4(value) || Object.keys(value).some((key) => !allowedKeys.has(key)) || value.version !== "private-lesson-outbox-submitted-v1" || value.draft_id !== expectedDraftId || value.state !== "submitted" || !isSha256Digest(value.payload_digest) || typeof value.redaction_version !== "string" || !isSha256Digest(value.redactor_digest) || !Number.isInteger(value.attempts) || Number(value.attempts) < 1 || Number(value.attempts) > 1e3 || !isIsoTimestamp(value.created_at) || !isIsoTimestamp(value.updated_at) || !isIsoTimestamp(value.submitted_at) || !isIsoTimestamp(value.expires_at) || !isSha256Digest(value.receipt_digest) || value.remote_status !== null && value.remote_status !== "accepted_private_candidate" && value.remote_status !== "duplicate" || value.processing_state !== null && value.processing_state !== "queued_for_verification" && value.processing_state !== "already_queued") {
+    throw new Error("Private lesson submitted record is invalid.");
+  }
+  const submittedAt = Date.parse(value.submitted_at);
+  if (Date.parse(value.created_at) > submittedAt || Date.parse(value.updated_at) < submittedAt || Date.parse(value.expires_at) !== submittedAt + PRIVATE_LESSON_SUBMITTED_RECORD_RETENTION_MS || value.remote_status === null !== (value.processing_state === null) || value.remote_status === "accepted_private_candidate" && value.processing_state !== "queued_for_verification" || value.remote_status === "duplicate" && value.processing_state !== "already_queued") {
+    throw new Error("Private lesson submitted record is inconsistent.");
+  }
+  return value;
+}
+function isSha256Digest(value) {
+  return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+function isIsoTimestamp(value) {
+  if (typeof value !== "string") return false;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
 function isHoldTelemetryStatus(value) {
   return value === "not_required" || value === "pending" || value === "awaiting_authorization" || value === "retry_scheduled" || value === "submitted" || value === "disabled";
 }
@@ -12994,7 +13482,7 @@ async function atomicReplacePrivate(path, data) {
   await assertRegularPrivateFile(path, PRIVATE_LESSON_DRAFT_MAX_BYTES);
   const temporary = join4(
     dirname2(path),
-    `.${randomBytes2(12).toString("hex")}.tmp`
+    `.${randomBytes3(12).toString("hex")}.tmp`
   );
   try {
     await atomicWritePrivate(temporary, data);
@@ -13056,6 +13544,10 @@ function draftPath(directory, draftId) {
   assertDraftId(draftId);
   return join4(directory, `${draftId}.lesson.json`);
 }
+function submittedRecordPath(directory, draftId) {
+  assertDraftId(draftId);
+  return join4(directory, `${draftId}.submitted.json`);
+}
 function tombstonePath(directory, draftId) {
   assertDraftId(draftId);
   return join4(directory, `${draftId}.deleted.json`);
@@ -13108,7 +13600,7 @@ async function readConcurrentPrivateLessonFallbackKey(path) {
 // src/server.ts
 var MAX_REMOTE_RESPONSE_BYTES = 4 * 1024 * 1024;
 var DOCTOR_PROBE_TIMEOUT_MS = 7500;
-var SERVER_VERSION = true ? "0.1.73" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.76" : "0.0.0-dev";
 var tools = toolDefinitions;
 var doctorCliRequested = process.argv[2] === "doctor";
 var inputBuffer = Buffer.alloc(0);
@@ -13576,6 +14068,13 @@ async function preparePrivateLessonDraft(input) {
 async function inspectPrivateLessonOutbox(input) {
   const summary = await privateLessonOutboxSummary();
   if (input.draft_id) {
+    const completion = await readPrivateLessonSubmittedRecord(input.draft_id);
+    if (completion) {
+      return {
+        draft: privateLessonSubmittedActionResult(completion),
+        outbox: publicOutboxSummary(summary)
+      };
+    }
     const draft = await readPrivateLessonDraft(input.draft_id);
     return {
       draft: privateLessonDraftActionResult(draft),
@@ -13588,7 +14087,13 @@ async function inspectPrivateLessonOutbox(input) {
   };
 }
 async function submitPrivateLessonDraft(draftId, access, allowPolicyRefresh) {
-  let draft = await readPrivateLessonDraft(draftId);
+  const source = await readPrivateLessonSubmissionSource(draftId);
+  if (source.kind === "submitted") {
+    return privateLessonSubmittedActionResult(source.completion, {
+      status: "already_submitted"
+    });
+  }
+  let draft = source.draft;
   if (draft.state === "superseded_redactor") {
     return privateLessonDraftActionResult(draft, {
       status: "superseded_redactor",
@@ -13596,7 +14101,18 @@ async function submitPrivateLessonDraft(draftId, access, allowPolicyRefresh) {
     });
   }
   if (draft.state === "submitted") {
-    return privateLessonDraftActionResult(draft, {
+    if (!draft.receipt_digest) {
+      throw new PrivateLessonPolicySafetyError(
+        "Submitted private lesson draft is missing its receipt digest."
+      );
+    }
+    const migrated = await completePrivateLessonSubmission(draft.draft_id, {
+      receipt_digest: draft.receipt_digest,
+      remote_status: null,
+      processing_state: null,
+      submitted_at: draft.submitted_at ? new Date(draft.submitted_at) : void 0
+    });
+    return privateLessonSubmittedActionResult(migrated, {
       status: "already_submitted"
     });
   }
@@ -13758,23 +14274,43 @@ async function submitPrivateLessonDraft(draftId, access, allowPolicyRefresh) {
       );
     }
     const receiptDigest = hashValue(canonicalJson(receipt));
-    draft = await updatePrivateLessonDraft(draft.draft_id, (current) => ({
-      ...current,
+    const completionProcessingState = processingState === "queued_for_verification" || processingState === "already_queued" ? processingState : null;
+    if (!completionProcessingState) {
+      throw new PrivateLessonPolicySafetyError(
+        "Private lesson submission omitted its processing state."
+      );
+    }
+    const completion = await completePrivateLessonSubmission(draft.draft_id, {
+      receipt_digest: receiptDigest,
+      remote_status: status,
+      processing_state: completionProcessingState
+    });
+    draft = {
+      ...draft,
       state: "submitted",
-      attempts: Math.min(1e3, current.attempts + 1),
+      attempts: completion.attempts,
       next_retry_at: null,
       last_error_code: null,
-      submitted_at: (/* @__PURE__ */ new Date()).toISOString(),
-      receipt_digest: receiptDigest,
-      policy: receiptPolicy
-    }));
+      submitted_at: completion.submitted_at,
+      receipt_digest: completion.receipt_digest,
+      policy: receiptPolicy,
+      updated_at: completion.updated_at
+    };
     return {
-      ...privateLessonDraftActionResult(draft, { status }),
+      ...privateLessonDraftActionResult(draft, {
+        status,
+        completion_expires_at: completion.expires_at
+      }),
       receipt,
       processing_state: processingState
     };
   } catch (error) {
     draft = await persistPrivateLessonFailure(draft, error);
+    if (draft.state === "submitted") {
+      return privateLessonDraftActionResult(draft, {
+        status: "already_submitted"
+      });
+    }
     return privateLessonDraftActionResult(draft, {
       status: "not_submitted",
       action_required: draft.state === "awaiting_authorization" ? "Authorize the exact submit_private_lesson_candidate action, then retry." : null
@@ -14152,13 +14688,37 @@ function privateLessonPolicyBindingConflict(stored, current, allowPolicyRefresh)
   return null;
 }
 async function persistPrivateLessonFailure(draft, error, explicitCode) {
-  return updatePrivateLessonDraft(
-    draft.draft_id,
-    (current) => current.state === "submitted" || current.state === "superseded_redactor" ? current : {
-      ...current,
-      ...privateLessonFailureTransition(current, error, explicitCode)
+  const completed = await readPrivateLessonSubmittedRecord(draft.draft_id);
+  if (completed) return submittedDraftFromCompletion(draft, completed);
+  try {
+    return await updatePrivateLessonDraft(
+      draft.draft_id,
+      (current) => current.state === "submitted" || current.state === "superseded_redactor" ? current : {
+        ...current,
+        ...privateLessonFailureTransition(current, error, explicitCode)
+      }
+    );
+  } catch (updateError) {
+    const racedCompletion = await readPrivateLessonSubmittedRecord(
+      draft.draft_id
+    );
+    if (racedCompletion) {
+      return submittedDraftFromCompletion(draft, racedCompletion);
     }
-  );
+    throw updateError;
+  }
+}
+function submittedDraftFromCompletion(draft, completion) {
+  return {
+    ...draft,
+    state: "submitted",
+    attempts: completion.attempts,
+    next_retry_at: null,
+    last_error_code: null,
+    submitted_at: completion.submitted_at,
+    receipt_digest: completion.receipt_digest,
+    updated_at: completion.updated_at
+  };
 }
 async function persistPrivateLessonHoldFailure(draft, error, explicitCode) {
   return updatePrivateLessonDraft(draft.draft_id, (current) => {
@@ -14250,6 +14810,29 @@ function privateLessonDraftActionResult(draft, extra = {}) {
     ...extra
   };
 }
+function privateLessonSubmittedActionResult(completion, extra = {}) {
+  return {
+    draft_id: completion.draft_id,
+    state: "submitted",
+    payload_digest: completion.payload_digest,
+    redaction_version: completion.redaction_version,
+    redactor_digest: completion.redactor_digest,
+    redaction_counts: {},
+    held_reasons: [],
+    attempts: completion.attempts,
+    next_retry_at: null,
+    last_error_code: null,
+    terminal_reason: null,
+    hold_telemetry_status: "not_required",
+    hold_event_digest: null,
+    hold_receipt_digest: null,
+    hold_reported_at: null,
+    submitted_at: completion.submitted_at,
+    completion_expires_at: completion.expires_at,
+    retained_locally: false,
+    ...extra
+  };
+}
 function publicOutboxSummary(summary) {
   const { directory: _directory, ...safe } = summary;
   return safe;
@@ -14792,6 +15375,9 @@ async function runLocalConnectionDoctor(options, execution = "mcp_tool", access
     policyResult,
     outboxResult
   });
+  if (execution === "mcp_tool") {
+    recordConnectionDoctorLifecycleProbe();
+  }
   return {
     ...report,
     status: report.status === "healthy" && privateLessonAutomation.status !== "ready" && privateLessonAutomation.status !== "not_applicable" ? "attention" : report.status,