docs(phase6a): document RootNode course foundation

COURSE_AUTHORING_STANDARD.md — the standard every future lesson/module
must follow (target learner, prerequisites, measurable objectives,
concept-before-lab, instructor notes, terminology, versioning, review
requirements), grounded in the gold-standard module as the reference
implementation.

PHASE6A_ROOT_COURSE_FOUNDATION.md — the phase summary: youth-ladder
context, the Google Workspace status already recorded in Phase 5C's own
docs, architecture/build summary, honest content states, test results,
explicit non-goals, and known limitations/Phase 6B recommendations.

Updated ENGINEERING_SOP.md (new Phase 6A section + a curriculum-content
cross-reference), REMOTE_AND_SELF_PACED_ARCHITECTURE.md (a 7th
closed gap: self-paced enrollment now resolves to a real course tree,
not just a scenario list), LAB_ARCHITECTURE.md (Phase 6A reuses the
disposable Lab unmodified, verified by a real rehearsal), and
platform/README.md (course model in the api/ summary, new e2e suite
descriptions for 5A/5B/5C/6A which were missing entirely, and the
real-Lab rehearsal script).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

platform/README.md

@@ -13,7 +13,8 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
   instructor sessions, RBAC, audit logging, real student credentials + remote classrooms
   (Phase 5A), self-paced programs/enrollment + the website integration boundary (Phase 5B), and
   a provider-neutral enrollment-communications pipeline (activation/enrollment-confirmation/
-  password-reset email, Phase 5C), and the instructor/admin control plane. No k3s, no
+  password-reset email, Phase 5C), the ROOT_ course/module/activity content model layered over
+  curriculum/assessments (Phase 6A), and the instructor/admin control plane. No k3s, no
   `--privileged` — this replaced Phase 2A's "identity" instance, which was a full Lab image
   booting an unused k3s cluster just to serve these APIs. Design:
   `docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md` (split + Postgres migration),
@@ -21,8 +22,9 @@ entrypoint/Dockerfile unmodified; frontend bundle gained Phase 3B learning UX, s
   `docs/PHASE3B_LEARNING_AND_ASSESSMENT.md` (learning/assessment engine),
   `docs/PHASE5A_STUDENT_IDENTITY_REMOTE_CLASSROOM.md` (student credentials, remote classroom),
   `docs/PHASE5B_SELF_PACED_ENROLLMENT.md` (programs, enrollment, website integration boundary),
-  `docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md` (notifications, email delivery). Operational
-  reference: `api/README.md`.
+  `docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md` (notifications, email delivery),
+  `docs/PHASE6A_ROOT_COURSE_FOUNDATION.md` (course/module/activity content model, gold-standard
+  module). Operational reference: `api/README.md`.
 - `gateway/` — the only student-facing path to a Lab (HTTP + WebSocket proxy, environment-aware
   routing derived from a server-controlled session — not a client-suppliable header/param — and,
   as of Phase 3B, server-side gating of progressive hint reveal). Design:
@@ -74,13 +76,27 @@ further instructor accounts from the Instructors tab).
   Lab reset, curriculum stage/Capstone lock-unlock, the exam engine (random draw, server
   timer, expiry, restart persistence), the Capstone workflow end to end, two-student assessment
   isolation, and instructor learning analytics/RBAC.
+- `test/e2e-phase5a.js` — real student credentials (activation/password reset/login), remote
+  classroom sessions (join/heartbeat/announcements/help requests), and instructor conversion of
+  a pilot student to a credentialed account.
+- `test/e2e-phase5b.js` — programs/enrollment, entitlement gating (pending/future/expired/
+  cancelled), server-derived completion, disposable-Lab persistence across destroy/recreate, and
+  the website/commerce integration boundary (idempotency, concurrency, RBAC).
+- `test/e2e-phase5c.js` — the notification lifecycle (queue/retry/failure/exhaustion),
+  activation/enrollment-confirmation/password-reset email delivery via the deterministic dev
+  provider, minor/no-email contact-email resolution, and admin notification RBAC.
+- `test/e2e-phase6a.js` — course/module/activity hierarchy and ordering, prerequisite-based
+  locking, all three completion behaviors (manual marker/scenario/assessment-derived), resume,
+  cross-student isolation, RBAC for self-paced (no-cohort) students, and draft-content hiding.
 
-All four e2e suites need `OWNER_EMAIL` / `OWNER_PASSWORD` set to a real bootstrapped instructor
+All e2e suites need `OWNER_EMAIL` / `OWNER_PASSWORD` set to a real bootstrapped instructor
 account (see "Running the full stack locally" above) — the old `ADMIN_PASSWORD` mechanism is
 gone. They're slow (real k3s boots, `e2e-phase3b.js` also runs a real API restart) and need the
 full stack up. None of them substitute for the manual real-Lab-image checks (node-pty, terminal
 WebSocket, `kubectl`, scenario validation) in `docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md` §8 —
-those need a browser-equivalent client and aren't automated here.
+those need a browser-equivalent client and aren't automated here. The one exception is Phase
+6A's gold-standard module, which DOES get a real-Lab dress rehearsal —
+`infra/scripts/drills/run-phase6a-course-rehearsal.sh`.
 
 ## Known limitations