docs(phase3b): document the learning and assessment engine

New docs/PHASE3B_LEARNING_AND_ASSESSMENT.md covers the attempt/learning-record model,
progressive hints (including the Gateway response-rewrite mechanism), curriculum completion
rules, the assessment/exam engine and its timer/draw integrity guarantees, the RootNode
Capstone design, achievement records, the deliberately minimal versioning model, instructor
analytics, the Phase 3B RBAC matrix, security/integrity assumptions, dev/test commands, known
limitations, and the Phase 4 boundary.

Updates ENGINEERING_SOP.md (roadmap items 2/7/8 now done, new section 12, corrects a stale
capstone-placeholder description in section 4), LAB_ARCHITECTURE.md's status line,
README.md (corrects the 'Lab image unmodified' claim now that its frontend bundle carries
Phase 3B UX, plus new platform properties), platform/README.md, and platform/api/README.md.

README.md

@@ -127,27 +127,35 @@ Everything runs inside one image managed by `scripts/entrypoint.sh`.
 
 ## Multi-Student Deployment (RootNode Academy addition)
 
-The upstream project assumes one learner, one container — this image is still exactly that,
-unmodified except for a node-pty build fix (see `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §1).
-RootNode Academy multiplies it into a real platform via separate provisioning and gateway
-layers rather than changing the image itself:
+The upstream project assumes one learner, one container — this image is still exactly that.
+Its backend/entrypoint/Dockerfile are unmodified except for a node-pty build fix (see
+`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §1); its frontend bundle gained progressive-hint
+controls and an assessment-mode indicator in Phase 3B (`docs/PHASE3B_LEARNING_AND_ASSESSMENT.md`
+§10–11) — additive UI, not a rewrite of the Lab experience. RootNode Academy multiplies the
+image into a real platform via separate provisioning and gateway layers rather than changing
+its core:
 
 - `platform/provisioner/` — Postgres-backed environment registry, per-student Docker
   networking, firewall-enforced egress, idle reaper (`docs/PHASE1_PLATFORM_FOUNDATION.md`).
-- `platform/api/` — lightweight Platform API: students, cohorts, curriculum, progress,
-  scenario attempts, persistent student/instructor sessions, per-instructor accounts (RBAC:
-  owner/admin/instructor), audit log, instructor/admin control plane. No k3s, no `--privileged`
-  (`docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md`, `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`).
+- `platform/api/` — lightweight Platform API: students, cohorts, curriculum, progress, detailed
+  scenario attempt telemetry, progressive hints, assessment/capstone engine, achievements,
+  persistent student/instructor sessions, per-instructor accounts (RBAC: owner/admin/
+  instructor), audit log, instructor/admin control plane. No k3s, no `--privileged`
+  (`docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md`, `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`,
+  `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md`).
 - `platform/gateway/` — the only student-facing path to a Lab: resolves identity from a
   server-controlled, persistent session cookie (not a client-suppliable header/param), proxies
-  HTTP/WebSocket into that one student's container, never a raw container IP/port
-  (`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`, session model in
-  `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md` §3).
-- The student flow (roster login → curriculum dashboard → Launch Lab → Lab session →
-  Reset/Recreate) lives in `frontend/src/platform/`; the instructor/admin portal (per-instructor
-  login, cohorts, students, instructor accounts, audit log, classroom "Prepare Labs,"
-  environment controls) lives in `frontend/src/admin/` at the `/admin` route — both small
-  additions alongside the existing, unmodified Lab UI, not a rewrite of it.
+  HTTP/WebSocket into that one student's container, never a raw container IP/port, and
+  server-gates progressive hint reveal by stripping the Lab's own hint payload before it reaches
+  the browser (`docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`, session model in
+  `docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md` §3, hint gating in
+  `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` §3).
+- The student flow (roster login → curriculum dashboard → Launch Lab → practice/assessments/
+  capstone → achievements) lives in `frontend/src/platform/`; the instructor/admin portal
+  (per-instructor login, cohorts, students, instructor accounts, audit log, classroom
+  "Prepare Labs," environment controls, learning analytics, assessment/capstone management)
+  lives in `frontend/src/admin/` at the `/admin` route — both additions alongside the existing
+  Lab UI, not a rewrite of it.
 
 **Never publish the raw privileged container** — front it with isolation (that's what the
 Gateway is). The one-container `docker run --privileged -p 7554:80 ...` command above stays
@@ -171,6 +179,12 @@ Key properties of the platform (not this image):
   recorded in an audit log.
 - Sessions (student and instructor) are Postgres-backed and survive a Platform API restart —
   verified by actually restarting it mid-session and confirming access still works.
+- Every validation attempt, hint reveal, curriculum stage completion, exam, and Capstone
+  attempt is recorded in Postgres, not the disposable Lab — a Lab reset or recreate never loses
+  attempt telemetry, hint progress, or an in-progress assessment's timer. Verified live:
+  reset a Lab mid-assessment, timer and drawn scenario set were unchanged afterward.
+- Exams and the RootNode Capstone use a server-authoritative timer and a server-drawn,
+  server-stored scenario set — nothing the browser sends can change either.
 - CPU/memory/PID/storage limits are enforced per container, config-driven.
 - Egress is restricted to an allowlisted proxy at the firewall layer, not left open.
 - Idle/abandoned environments are automatically cleaned up, and a student can launch a fresh
@@ -178,7 +192,7 @@ Key properties of the platform (not this image):
 
 Production topology and what's built vs. not yet: `docs/LAB_ARCHITECTURE.md`,
 `docs/PHASE1_PLATFORM_FOUNDATION.md`, `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md`,
-`docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`.
+`docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md`, `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md`.
 
 ---