docs(phase6b): document curriculum expansion

PHASE6B_ROOT_CURRICULUM_EXPANSION.md — the phase summary: what was
authored per course, the is_required extension, the capstone unlock
fix, verified scenario coverage before/after (44 -> 88 of 98, 89.8%,
by direct query not estimate), and honest known limitations/Phase 6C
recommendations.

ROOT_CAPSTONE_READINESS.md — the readiness module and the server-side
unlock fix in full detail, including why the module's completion and
the real assessment's unlock gate are deliberately independent systems.

Updated ROOT_CURRICULUM_INVENTORY.md (Phase 6B coverage numbers),
ROOT_PROGRAM_ARCHITECTURE.md (ROOT 08/09 PARTIAL, new module lists per
course), COURSE_CONTENT_MODEL.md (is_required completion rule, a new
content-versioning section per this phase's own requirement),
COURSE_AUTHORING_STANDARD.md (classifying near-duplicate/advanced
scenarios), ENGINEERING_SOP.md (new Phase 6B section),
REMOTE_AND_SELF_PACED_ARCHITECTURE.md (cross-reference), and
platform/README.md (e2e-phase6b.js, the Phase 6B rehearsal, isolation-
per-suite regression guidance).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

platform/README.md

@@ -14,7 +14,9 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
   (Phase 5A), self-paced programs/enrollment + the website integration boundary (Phase 5B), and
   a provider-neutral enrollment-communications pipeline (activation/enrollment-confirmation/
   password-reset email, Phase 5C), the ROOT_ course/module/activity content model layered over
-  curriculum/assessments (Phase 6A), and the instructor/admin control plane. No k3s, no
+  curriculum/assessments (Phase 6A) with real teaching content across most of the Kubernetes
+  courses and a server-side capstone unlock enforcement fix (Phase 6B), and the instructor/admin
+  control plane. No k3s, no
   `--privileged` — this replaced Phase 2A's "identity" instance, which was a full Lab image
   booting an unused k3s cluster just to serve these APIs. Design:
   `docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md` (split + Postgres migration),
@@ -24,7 +26,8 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
   `docs/PHASE5B_SELF_PACED_ENROLLMENT.md` (programs, enrollment, website integration boundary),
   `docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md` (notifications, email delivery),
   `docs/PHASE6A_ROOT_COURSE_FOUNDATION.md` (course/module/activity content model, gold-standard
-  module). Operational reference: `api/README.md`.
+  module), `docs/PHASE6B_ROOT_CURRICULUM_EXPANSION.md` (curriculum authoring across ROOT
+  05-10/12/Capstone, the capstone unlock fix). Operational reference: `api/README.md`.
 - `gateway/` — the only student-facing path to a Lab (HTTP + WebSocket proxy, environment-aware
   routing derived from a server-controlled session — not a client-suppliable header/param — and,
   as of Phase 3B, server-side gating of progressive hint reveal). Design:
@@ -88,15 +91,25 @@ further instructor accounts from the Instructors tab).
 - `test/e2e-phase6a.js` — course/module/activity hierarchy and ordering, prerequisite-based
   locking, all three completion behaviors (manual marker/scenario/assessment-derived), resume,
   cross-student isolation, RBAC for self-paced (no-cohort) students, and draft-content hiding.
+- `test/e2e-phase6b.js` — hierarchy for the 13 new modules across ROOT 05-10/12/Capstone,
+  prerequisite chains through the newly-inserted front-door modules, the optional-vs-required
+  (`is_required`) completion rule, and the capstone server-side unlock fix in both directions
+  (a direct bypass attempt rejected, a legitimately unlocked attempt still accepted).
 
 All e2e suites need `OWNER_EMAIL` / `OWNER_PASSWORD` set to a real bootstrapped instructor
 account (see "Running the full stack locally" above) — the old `ADMIN_PASSWORD` mechanism is
 gone. They're slow (real k3s boots, `e2e-phase3b.js` also runs a real API restart) and need the
-full stack up. None of them substitute for the manual real-Lab-image checks (node-pty, terminal
+full stack up. Run each suite against its own freshly-reset stack, not chained one after another
+against the same Postgres — several routes (the admin dashboard's running-lab count, a course's
+percent-complete) read GLOBAL state on purpose, and chaining suites produces false failures from
+shared state, not real regressions (found and documented during Phase 6A's own regression pass).
+None of them substitute for the manual real-Lab-image checks (node-pty, terminal
 WebSocket, `kubectl`, scenario validation) in `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §8 —
-those need a browser-equivalent client and aren't automated here. The one exception is Phase
-6A's gold-standard module, which DOES get a real-Lab dress rehearsal —
-`infra/scripts/drills/run-phase6a-course-rehearsal.sh`.
+those need a browser-equivalent client and aren't automated here. Two exceptions get a real-Lab
+dress rehearsal instead: Phase 6A's gold-standard module
+(`infra/scripts/drills/run-phase6a-course-rehearsal.sh`) and Phase 6B's curriculum expansion,
+including a real `kubectl expose` and a real instructor/classroom narrative
+(`infra/scripts/drills/run-phase6b-root-course-rehearsal.sh`).
 
 ## Known limitations