diff --git a/docs/course/glossary.md b/docs/course/glossary.md
index 2fbb5c2..c3cbf45 100644
--- a/docs/course/glossary.md
+++ b/docs/course/glossary.md
@@ -1,10 +1,14 @@
 # Glossary
 
-Use this glossary as a quick lookup while working through the lessons and labs. The definitions favor practical Linux operations over academic precision.
+Use this glossary as a quick lookup while working through the lessons and labs. The definitions favor practical Linux operations over academic precision. When a term appears in a lesson and the meaning is not clear from context, look it up here.
 
-**ACL**: Access control list. An extension to traditional Unix permissions that can grant or deny access for specific users or groups.
+---
 
-**Apt**: Debian and Ubuntu package-management tooling used to install, update, remove, and inspect software packages.
+**ACL**: Access control list. An extension to traditional Unix permissions that can grant or deny access for specific users or groups beyond owner/group/other.
+
+**Apt**: Debian and Ubuntu package-management tooling used to install, update, remove, and inspect software packages. Core commands: `apt install`, `apt update`, `apt upgrade`.
+
+**Bash**: The Bourne Again Shell; the default command interpreter on most Linux systems. Scripts ending in `.sh` typically run in Bash.
 
 **BIND**: A common DNS server implementation used to host authoritative zones and recursive resolvers.
 
@@ -12,94 +16,126 @@ Use this glossary as a quick lookup while working through the lessons and labs.
 
 **CIDR**: Classless inter-domain routing notation such as `192.0.2.0/24`, used to describe IP networks and address ranges.
 
-**CI/CD**: Continuous integration and continuous delivery or deployment. The practice of building, testing, and shipping changes through repeatable pipelines.
+**CI/CD**: Continuous integration and continuous delivery or deployment. The practice of building, testing, and shipping changes through repeatable automated pipelines.
+
+**Container**: A lightweight, isolated process environment that shares the host kernel. Docker and Podman are common container runtimes.
 
-**Daemon**: A background process that provides a service.
+**Cron**: A time-based job scheduler. Cron jobs run commands on a schedule defined in a `crontab` file.
+
+**Daemon**: A background process that provides a service. Examples: `sshd` (SSH), `nginx` (web), `systemd` (init).
 
 **Default gateway**: The router a host uses when traffic is destined for a network that is not directly connected.
 
+**DHCP**: Dynamic Host Configuration Protocol. Automatically assigns IP addresses, gateway, and DNS server information to network clients.
+
 **Dnf**: Modern Fedora, Rocky Linux, AlmaLinux, and RHEL-family package-management tooling used to install, update, remove, and inspect software packages.
 
 **DNS**: Domain Name System. The distributed naming system that maps names such as `example.com` to records such as IP addresses, mail exchangers, and service metadata.
 
+**Environment variable**: A named value available to processes in a shell session. Set with `export VAR=value`; read with `echo $VAR`.
+
+**Filesystem**: The structure an operating system uses to organize, store, and retrieve files on a storage device. Common Linux filesystems: ext4, XFS, Btrfs, ZFS.
+
+**Firewall**: Software or hardware that filters network traffic according to rules. Linux labs commonly use `nftables`, `firewalld`, or `ufw`.
+
 **FQDN**: Fully qualified domain name, such as `www.example.com`, that identifies a host or service within the DNS hierarchy.
 
-**Filesystem**: The structure an operating system uses to store and retrieve files.
+**GRUB**: Grand Unified Bootloader. Loads the Linux kernel at startup; its configuration lives in `/boot/grub/`.
 
-**Firewall**: Software or hardware that filters network traffic according to rules. Linux labs commonly use tools such as `nftables`, `firewalld`, or `ufw`.
+**Hostname**: The human-readable name assigned to a machine on a network. Set with `hostnamectl set-hostname`.
 
-**GRUB**: Grand Unified Bootloader. A bootloader used by many Linux distributions to choose and start kernels.
+**IaC**: Infrastructure as Code. Managing servers and configuration through version-controlled files rather than manual steps. Tools include Ansible, Terraform, and Salt.
 
 **Idempotent**: Safe to apply repeatedly with the same intended result. Configuration-management tools aim for idempotent changes.
 
-**Init system**: The first user-space process and service manager. On most current Linux distributions, this is systemd.
+**Init system**: The first user-space process and service manager (PID 1). On most current Linux distributions, this is `systemd`.
 
 **Inode**: Filesystem metadata that tracks a file's ownership, permissions, timestamps, size, and data-block locations.
 
 **IP address**: A numeric network address assigned to an interface. IPv4 examples look like `192.0.2.10`; IPv6 examples look like `2001:db8::10`.
 
-**Journal**: The systemd logging system queried with `journalctl`.
+**Journal**: The systemd logging system queried with `journalctl`. Stores structured log entries from services and the kernel.
+
+**Kernel**: The core of the operating system. Manages hardware, memory, processes, and system calls. The Linux kernel is the `vmlinuz` file in `/boot/`.
 
-**Kernel**: The core of the operating system that manages hardware, processes, memory, and system calls.
+**Least privilege**: The practice of granting only the permissions needed to do a specific task, nothing more.
 
-**Least privilege**: The practice of granting only the access needed to do a task.
+**LDAP**: Lightweight Directory Access Protocol. A standard for directory services used for centralized authentication (user accounts, group membership).
 
 **Load average**: A summary of runnable and waiting work on a system over 1, 5, and 15 minutes. Interpret it with CPU count and workload context.
 
 **LVM**: Logical Volume Manager. A Linux storage layer that can group disks, create flexible logical volumes, and resize storage more easily than raw partitions.
 
-**Mount point**: The directory where a filesystem is attached to the running file tree.
+**MFA**: Multi-Factor Authentication. Requiring two or more verification methods (password + one-time code) to authenticate a user.
 
-**NAT**: Network address translation. A technique that rewrites packet addresses, commonly used for private networks that share public connectivity.
+**Mount point**: The directory where a filesystem is attached to the running file tree. `/` is always mounted; `/home`, `/var`, and `/boot` are common separate mount points.
+
+**NAT**: Network Address Translation. Rewrites packet source or destination addresses; commonly used for private networks that share public connectivity.
 
 **NFS**: Network File System. A Unix-oriented protocol for sharing filesystems over a network.
 
+**Package**: A compressed archive containing software binaries, libraries, and metadata managed by a package manager.
+
+**Package manager**: A tool that installs, updates, and removes software packages and resolves their dependencies automatically (apt, dnf, pacman).
+
 **Package repository**: A trusted source of installable software packages and metadata for tools such as `apt` and `dnf`.
 
 **PATH**: The shell variable that lists directories searched when you run a command without typing its full path.
 
-**PID**: Process identifier. A numeric ID assigned to a running process.
+**PID**: Process identifier. A unique integer the kernel assigns to every running process. View with `ps aux` or `top`.
 
 **Pipeline**: A shell pattern that connects one command's output to another command's input with `|`, or a CI/CD workflow that moves changes through build, test, and deploy stages.
 
-**Port**: A numeric endpoint used by TCP or UDP services. For example, SSH commonly listens on TCP port 22.
+**Port**: A numeric endpoint (0–65535) used by TCP or UDP services. Well-known ports: 22 (SSH), 80 (HTTP), 443 (HTTPS).
+
+**Process**: A running instance of a program. Each process has its own PID, memory space, and set of open files.
+
+**Protocol**: A defined set of rules for communication between networked systems. Examples: TCP, UDP, HTTP, SSH, SMTP.
 
-**RAID**: Redundant array of independent disks. A storage technique that combines disks for redundancy, performance, or both.
+**RAID**: Redundant Array of Independent Disks. A storage technique that combines disks for redundancy, performance, or both. Levels 0, 1, 5, and 6 are most common.
 
 **Resolver**: The client-side or server-side DNS component that looks up DNS records on behalf of applications or users.
 
 **Rollback**: A planned way to return a system to a known-good state after a change fails or produces unexpected behavior.
 
-**Runbook**: A written operational procedure for performing or recovering a task.
+**Root**: The superuser account with unrestricted access to the system. Also the top of the filesystem hierarchy (`/`). Avoid running as root unless necessary.
 
-**Service unit**: A systemd configuration object that controls a daemon or service.
+**Runbook**: A written operational procedure for performing or recovering a task. Runbooks are the written evidence of operational knowledge.
 
-**Shell**: A command interpreter such as Bash or Zsh.
+**Service unit**: A systemd configuration file (ending in `.service`) that defines how a daemon starts, stops, and restarts.
+
+**Shell**: A command interpreter such as Bash or Zsh that reads user commands and passes them to the kernel.
 
 **Signal**: A process-control notification such as `SIGTERM` or `SIGKILL`. Signals are used to request process shutdown, reload, stop, or other behavior.
 
-**SLA**: Service-level agreement. A formal or informal promise about service behavior such as availability, response time, or support handling.
+**SLA**: Service-level agreement. A formal commitment on availability, response time, or performance of a service.
 
 **SMB**: Server Message Block. A file-sharing protocol commonly used by Windows systems and implemented on Unix-like systems with Samba.
 
-**Snapshot**: A saved VM or storage state that can be restored after a mistake.
+**Snapshot**: A saved point-in-time state of a VM or storage volume. Restore it to undo changes after a mistake.
 
-**SSH**: Secure Shell. The standard encrypted remote-login and remote-command protocol for Linux administration.
+**SSH**: Secure Shell. The standard encrypted remote-login and remote-command protocol for Linux administration. The `ssh` client connects to `sshd` on port 22.
 
-**Sudo**: A tool that lets authorized users run specific commands with elevated privileges while preserving accountability.
+**Sudo**: A tool that lets authorized users run specific commands with elevated privileges while preserving accountability. Configured in `/etc/sudoers`.
 
 **Swap**: Disk-backed space the kernel can use when memory pressure is high. Swap is slower than RAM and should be interpreted as a symptom source during performance analysis.
 
-**systemd**: A Linux init system and service manager that also provides logging, timers, sockets, and unit dependency management.
+**Systemd**: A Linux init system and service manager that also provides logging, timers, sockets, and unit dependency management.
 
 **Tarball**: An archive file, often ending in `.tar`, `.tar.gz`, or `.tgz`, used to bundle files for transfer or backup.
 
-**TTL**: Time to live; in DNS, the cache duration for a record.
+**Terminal**: A text interface for interacting with a shell. Can be a physical TTY, a virtual console (`Ctrl+Alt+F2`), or a terminal emulator application.
+
+**TTL**: Time to live. In DNS, how long a resolver may cache a record before re-querying the authoritative server.
 
 **Unit file**: A systemd configuration file that describes a service, timer, socket, mount, or other managed object.
 
-**Virtual machine**: A complete guest operating system running on virtualized hardware provided by a hypervisor.
+**Uptime**: How long a system has been running without a reboot. Check with `uptime` or `systemctl show --property=ActiveEnterTimestamp`.
+
+**Virtual machine (VM)**: A complete guest operating system running on virtualized hardware provided by a hypervisor. Provides strong isolation; the recommended lab environment for this course.
 
 **Volume**: A storage object presented to a system or application. Depending on context, it may refer to a disk, partition, logical volume, filesystem, container volume, or cloud block device.
 
+**VPN**: Virtual Private Network. Creates an encrypted tunnel between a client and a server, extending a private network over the internet.
+
 **Zone file**: A DNS data file that defines records for a domain or reverse-lookup zone.
diff --git a/docs/course/overview.md b/docs/course/overview.md
index 820e94b..89f769d 100644
--- a/docs/course/overview.md
+++ b/docs/course/overview.md
@@ -1,6 +1,6 @@
 # Course Overview
 
-Learn Linux is structured as a full operator path, not a command glossary. The goal is to help you build judgment around real systems.
+Learn Linux is structured as a full operator path, not a command glossary. The goal is to help you build judgment around real systems — not just memorize commands, but understand *why* those commands matter and *what to check next* when something goes wrong.
 
 Use the course to practice the same loop you will use on production work:
 
@@ -14,14 +14,27 @@ Use the course to practice the same loop you will use on production work:
 
 This course is for:
 
-- New Linux learners who want a practical path.
+- New Linux learners who want a practical, structured path from zero.
 - Help desk and support technicians moving toward infrastructure work.
 - Software engineers who need stronger production literacy.
-- Cloud, DevOps, SRE, and cybersecurity learners who need Linux foundations.
+- Cloud, DevOps, SRE, and cybersecurity learners who need solid Linux foundations.
+
+If you can open a terminal and type, you have enough background to start.
 
 ## Prerequisites
 
-You should be comfortable using a keyboard, browser, and terminal window. No prior Linux administration experience is assumed.
+You should be comfortable using a keyboard, browser, and terminal window. No prior Linux administration experience is assumed. If you encounter an unfamiliar term, check the [Glossary](glossary.md) first.
+
+## Time expectations
+
+| Goal | Estimated pace |
+| --- | --- |
+| One lesson | 20–40 minutes |
+| One chapter | 2–5 hours |
+| Full course (all 31 chapters) | 80–120 hours |
+| Capstone project | 4–8 hours additional |
+
+These are loose estimates. Move faster through topics you already know; slow down and repeat labs for topics that feel unfamiliar.
 
 You will get more from the lessons if you keep a disposable lab nearby. See [Lab Setup](lab-setup.md) before running commands that install packages, edit service files, change accounts, touch storage, or alter networking.
 
@@ -48,6 +61,22 @@ Each lesson should answer five questions:
 
 When a lesson includes commands, prefer read-only inspection first. Commands such as `ip addr`, `ss -tulpen`, `systemctl status`, `journalctl -u`, `df -h`, `lsblk`, and `findmnt` are usually safer starting points than commands that restart services, rewrite files, or delete data.
 
+## The operator loop
+
+Every lesson reinforces a five-step habit that professional Linux operators use on real systems:
+
+```
+Inspect → Change → Verify → Document → Automate
+```
+
+1. **Inspect** — Read the current state before touching anything. What does the system say right now?
+2. **Change** — Make one targeted change. Prefer the smallest possible intervention.
+3. **Verify** — Confirm the change had the intended effect with evidence (command output, logs, metrics).
+4. **Document** — Write down what you did, what you saw, and what it means — clearly enough for a teammate.
+5. **Automate** — Once a procedure is reliable and documented, encode it so it never needs to be done manually again.
+
+This loop appears in every chapter. By the end of the course it should be instinct.
+
 ## How to Work Through a Chapter
 
 For each chapter:
diff --git a/docs/index.md b/docs/index.md
index 82b6508..7b898d7 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -51,6 +51,42 @@ By the end, you should be able to:
 - Build safe labs with VMs or containers before touching production systems.
 - Document findings clearly enough for a teammate to continue the work.
 
+## Where to begin
+
+Not sure where to jump in? Pick the description that fits you best.
+
+<div class="course-grid" markdown>
+
+<div class="course-card" markdown>
+### Absolute beginner
+No Linux experience yet. Start at Chapter 1 and work forward. Every concept is introduced before it is used.
+
+[Start at Chapter 1](lessons/01_where_to_start/README.md){ .md-button }
+</div>
+
+<div class="course-card" markdown>
+### Help desk / support tech
+You know the basics. Jump to Chapter 4 (processes), Chapter 8 (users), or Chapter 10 (logging) for day-to-day operational skills.
+
+[Jump to Chapter 4](lessons/04_process_control/README.md){ .md-button }
+</div>
+
+<div class="course-card" markdown>
+### Software engineer
+You write code but want production confidence. Focus on Chapters 9–13 (cloud, kernel, networking) then Chapters 23–26 (config management, containers, CI/CD).
+
+[Jump to Chapter 9](lessons/09_cloud_computing/README.md){ .md-button }
+</div>
+
+<div class="course-card" markdown>
+### Cloud / DevOps / SRE learner
+You already use Linux but want depth. Head straight to the Operations track: Chapters 20–29 cover storage, security, monitoring, and performance.
+
+[Jump to Chapter 20](lessons/20_storage/README.md){ .md-button }
+</div>
+
+</div>
+
 ## Learning rhythm
 
 1. Read the concept.
@@ -59,5 +95,8 @@ By the end, you should be able to:
 4. Complete the checkpoint questions.
 5. Revisit the field story and decide what you would do first during a real incident.
 
+!!! tip "New to Linux?"
+    Start with the [Glossary](course/glossary.md) to get familiar with common terms, then read [Lab Setup](course/lab-setup.md) before running any commands.
+
 !!! warning "Use a lab"
     Many Linux commands can change system state. Run exercises in a VM, container, cloud sandbox, or spare machine unless you are certain the command is read-only.
diff --git a/docs/lessons/01_where_to_start/README.md b/docs/lessons/01_where_to_start/README.md
index 8686ab9..d15a934 100644
--- a/docs/lessons/01_where_to_start/README.md
+++ b/docs/lessons/01_where_to_start/README.md
@@ -23,7 +23,7 @@ Use a disposable lab system for experimentation. Chapter 01 is mostly orientatio
 - [1.02 Suggested Background](1.02_suggested_background.md)
 - [1.03 Linux Distributions](1.03_linux_distributions.md)
 - [1.04 Example Systems Used in This Book](1.04_example_systems_used_in_this_book.md)
-- [Subchapter 1.05: Notation and Typographical Conventions](1.05_notation_and_typographical_conventions.md)
+- [1.05 Notation and Typographical Conventions](1.05_notation_and_typographical_conventions.md)
 - [1.06 Units](1.06_units.md)
 - [1.07 Man Pages and Other On-line Documentation](1.07_man_pages_and_other_on-line_documentation.md)
 - [1.08 Other Authoritative Documentation](1.08_other_authoritative_documentation.md)
diff --git a/mkdocs.yml b/mkdocs.yml
index 0b2ee6b..730a2df 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -29,14 +29,18 @@ theme:
         icon: material/weather-sunny
         name: Switch to light mode
   features:
+    - navigation.instant
+    - navigation.instant.progress
     - navigation.tabs
     - navigation.sections
     - navigation.indexes
+    - navigation.path
     - navigation.top
     - navigation.footer
     - toc.follow
     - search.suggest
     - search.highlight
+    - search.share
     - content.code.copy
     - content.tabs.link
     - content.action.edit