updated and tested till end of lesson 4

COURSE.md

@@ -8,6 +8,8 @@ You will build a small vending backend and a Go device simulator, then use that
 
 This is the requested course and implementation checklist. It does not require another round of sprint planning. Ask the tutor to start a numbered exercise when ready; full solutions should wait until you have attempted it or requested one.
 
+Start with [Lesson 0 — The broker, Go backend, and device lifecycle](lessons/00-system-lifecycle.md) for the end-to-end story. Lessons 1–8 now begin with the system story and a guiding question before each implementation step.
+
 All implementation belongs in `/home/ryan/Media/Code/Code/robot-market/mqtt-5-learning`. Use a dedicated local broker, synthetic data, lab credentials, and simulated devices. Reference the existing backend read-only.
 
 ## How this course matches your backend
@@ -53,13 +55,15 @@ The future delivered backend must be inspected again. Do not assume it will use
 
 Detailed lesson: [Section 1 instructions and examples](lessons/01-lab-setup.md).
 
+Start with the broker's role and setup: which configuration belongs to Mosquitto, how client accounts are supplied, and what local CLI evidence confirms the broker is ready for Go clients.
+
 **Outcome:** A local MQTT 5 broker you can reach, plus a recorded toolchain and dependency choice.
 
 1. [ ] Check your Go and Docker installation. Record `go version`, `docker version`, and `docker compose version`. If Docker is unavailable, establish an equivalent isolated local Mosquitto setup before continuing.
 2. [ ] Read the local Paho README and the basics example. Identify which responsibilities belong to AutoPaho and which belong to the underlying Paho client. Check a tagged release's Go requirement and release notes before pinning it.
 3. [ ] Initialize a Go module in this learning project. Record the selected Go, Paho, and Mosquitto versions; avoid floating `latest` versions for reproducible exercises.
 4. [ ] Create a Compose definition with a project-specific name and a broker listener published only on loopback, using an unused lab port such as `127.0.0.1:18883`. Use a separate persistence volume and configuration directory.
-5. [ ] Disable anonymous access. Create distinct lab backend and simulator credentials and an initial ACL allowing only the lab topic namespace. Keep passwords and generated secrets out of version control.
+5. [ ] Disable anonymous access. Create distinct lab backend and simulator usernames and an initial ACL allowing only the lab topic namespace. For this disposable local test lab, store the shared password in `configs/lab.toml`; never reuse a real credential.
 6. [ ] Use Mosquitto CLI tools with MQTT version 5 explicitly selected to subscribe and publish a synthetic message. Check the installed tools' help for version and authentication flags. Repeat with incorrect credentials.
 
 **Initial commands:** `docker compose -p mqtt5-learning config`, then `docker compose -p mqtt5-learning up -d`, `docker compose -p mqtt5-learning ps`, and `docker compose -p mqtt5-learning logs --tail=50`. Run these after you have written the lab files; never use a production Compose directory. Do not share resolved Compose output if it contains secrets.
@@ -72,6 +76,8 @@ Detailed lesson: [Section 1 instructions and examples](lessons/01-lab-setup.md).
 
 Detailed lesson: [Section 2 connection lifecycle and code](lessons/02-go-connection.md).
 
+Follow the backend from configuration through AutoPaho, Paho, CONNECT, and CONNACK. The story question is what proves connection acceptance and how startup differs from a running process.
+
 **Outcome:** A small executable that connects, reports connection state, and exits cleanly.
 
 1. [ ] Create `cmd/backend/main.go` and use AutoPaho with a unique, explicit client ID. Explain the MQTT 5 CONNECT/CONNACK exchange and inspect failure reasons exposed by the selected API.
@@ -88,6 +94,8 @@ Detailed lesson: [Section 2 connection lifecycle and code](lessons/02-go-connect
 
 Detailed lesson: [Section 3 TOML and koanf implementation](lessons/03-typed-configuration.md).
 
+Trace how each Go process gets its own identity and credentials, how configuration sources merge, and when validation must finish before MQTT startup.
+
 **Outcome:** Both executables can be configured predictably without editing Go code.
 
 1. [ ] Add typed TOML + koanf configuration for broker URL, client ID, credential inputs, timeouts, log level, and simulator identity.
@@ -102,6 +110,8 @@ Detailed lesson: [Section 3 TOML and koanf implementation](lessons/03-typed-conf
 
 Detailed lesson: [Section 4 Paho transport, backend, and simulator](lessons/04-publish-subscribe-simulator.md).
 
+Start with the story of how the backend and simulator connect, subscribe, exchange a command, and report a device-level response before building the transport helper.
+
 **Outcome:** Two Go processes exchange messages through the broker.
 
 1. [ ] Create a simulator with its own identity and client ID. Give the backend and simulator different topic permissions.