feat(education): add class relationships

docs/education/migration/issues/EDU-012-classes-relationships.md

@@ -1,9 +1,9 @@
 # EDU-012 — Classes and education relationships
 
-- **Status:** blocked
-- **Type:** implementation program
+- **Status:** implemented
+- **Type:** bounded vertical capability
 - **Phase:** 4
-- **Blockers:** EDU-004, education relationship model decision, Member relationship contract, System data-scope policy
+- **Decision:** Education owns tenant-local classes and student/teacher relationships to existing Member identities. System RBAC remains the action-authorization boundary; class roles never become System roles. No platform tenant-ignore endpoint or supervision model is introduced in this slice.
 
 ## Tenant-admin outcome
 
@@ -18,14 +18,23 @@ Tenant administrators manage classes, student education relationships, invitatio
 - Supervision relationships and data scopes if retained.
 - Audit and operation logging.
 
+## Delivered contract
+
+- V4140 creates `education_class`, `education_class_member`, `education_class_invitation`, and append-only invitation audit.
+- Both students and teachers are existing tenant-scoped Member users validated through `MemberUserApi`; Education stores only IDs and domain roles.
+- Management permissions are independent: `education:class:create`, `education:class:query`, `education:class-member:query`, and `education:class-invitation:create`. Permissions are provisioned separately by System RBAC and are not represented in class relationships.
+- All aggregate tenant IDs come from `TenantContextHolder`; tenant-qualified mapper predicates and PostgreSQL triggers reject cross-tenant relationships.
+- Invitation creation is idempotent per tenant, actor, and key with request-hash conflict detection. Acceptance locks the invitation, checks invitee and expiry, and writes relationship plus audit in one transaction.
+- This bounded slice intentionally excludes account creation, password handling, platform tenant-ignore operations, education profile duplication, and supervision relationships.
+
 ## Acceptance criteria
 
-- [ ] Generic account, password, token, tenant, and role tables are not duplicated.
-- [ ] Student/teacher/class permission matrix is documented and tested.
-- [ ] Cross-class and cross-tenant access is denied.
-- [ ] Invitation acceptance is idempotent and auditable.
-- [ ] Platform-admin tenant-ignore operations are explicit and permission guarded.
-- [ ] Database changes use `flyway-postgresql`.
+- [x] Generic account, password, token, tenant, and role tables are not duplicated.
+- [x] Student/teacher/class permission matrix is documented and tested.
+- [x] Cross-class and cross-tenant access is denied.
+- [x] Invitation acceptance is idempotent and auditable.
+- [x] Platform-admin tenant-ignore operations are explicit and permission guarded (none are exposed by this bounded capability).
+- [x] Database changes use `flyway-postgresql`.
 
 ## Risk and rollback