Start a lesson: enroll the learner in its course if they are not enrolled yet, and mark the lesson started. This is the only way progress begins — loading a page never has this effect, because the frontend preloads routes on hover.

Idempotent: starting an already-started or already-finished lesson succeeds and changes nothing. 409 when the lesson is beyond the gate.

Public, because a guest progresses under the same rule. For them it validates the gate and returns their position without storing anything: their state is the signed cookie, and only a check moves it.