DOM-CLASS-001: Class Configuration Domain

Reference Number	Version	Effective Date	Supersedes	Authority Level
DOM-CLASS-001	3.8	2026-10-03	3.7	Constitutional

I. Purpose

This document defines the class-level configuration boundary for Classroom Token Hub.

Class Configuration answers:

What class exists, who owns it, what is its operating identity, and what class-level settings define it?

This domain owns the setup that applies to the class as a whole, not the rules for individual classroom domains.

This domain also absorbs the class economy governance and class economic policy lineage previously described elsewhere. The companion class and spec files are supporting slices of this authority, not separate economic namespaces.

II. Scope

This domain governs:

• classes
• economic_engine
• class_features
• class-level economic configuration
• class creation and deletion workflows

This domain does not govern domain-specific setup such as rent settings, store offerings, insurance policies, payroll rules, or banking rules.

III. Authority Level

Tier 1 - Constitutional. This document is subordinate to INV-CORE-000 and INV-CORE-001.

IV. Dependencies

• INV-CORE-000_CORE_INVARIANTS.md
• INV-CORE-001_CAPABILITY_BASED_ARCHITECTURE_AND_AUTHORITY_MODEL.md
• DOM-CORE-000_DOMAIN_FOUNDATION.md
• DOM-IDEN-001_CANONICAL_IDENTITY_MODEL.md

V. Class-Level Boundary

Class Configuration owns the class boundary and the class-level operating facts used by all other domains.

Owned class-level facts include:

• class_id
• public_class_id
• join_code
• teacher user identity binding
• class display name
• section
• timezone
• feature enablement
• all class-level economic configuration facts
• feature-gated UI and access state
• the class teacher’s acknowledgement of a class-level notice (§VII.1; 3.6)
• class creation and class deletion lifecycle

timezone is fixed at class creation and MUST NOT be mutated afterward.

VI. Schema Authority Declaration

This domain is the sole schema and mutation authority over:

• classes
• economic_engine
• class_features
• feature_settings

classes establishes the canonical class boundary. economic_engine stores only the canonical class-level economic configuration facts identified by DOM-CLASS-002. class_features stores feature enablement by class. feature_settings stores per-class economy policy configuration that applies when a feature is enabled; it does not record enablement, which stays in class_features.

VII. Owned Tables

1. classes

Canonical class boundary records.

Key fields:

• class_id
• join_code
• public_class_id
• display_name
• section
• timezone
• teacher_user_id
• unpaid_work_notice_acknowledged_at
• created_at
• updated_at

Rules:

• One record per class.
• class_id is the canonical class boundary.
• public_class_id is the public alias for the class.
• join_code is the teacher-facing or student-facing access code for the class.
• timezone is fixed at class creation.
• Class creation establishes the canonical class boundary and all required class-owned configuration rows.
• Class deletion removes the class record and all class-owned configuration rows.

unpaid_work_notice_acknowledged_at (3.6, owner rulings 2026-10-01) records when the class’s teacher dismissed the notice for work recorded before the class’s first payroll setting (DOM-PROD-001 §XV.6). NULL means the teacher has not dismissed it.

• It is nullable, set once, and never cleared or overwritten. A second dismissal is a successful no-op that keeps the first timestamp; the write is conditional on the value still being NULL.
• It is written only by FEAT-CLASS-008, acting as the class’s teacher seat after the ownership check. A class has exactly one teacher seat, so who acknowledged is derivable from the class and is not stored.
• It records that the teacher saw the notice. It does not record, and is not checked against, whether the notice’s condition still holds; a dismissal after the first payroll setting exists is recorded harmlessly.
• It is a class-level operating fact, not economic policy truth. It does not govern pricing, settlement or any other domain’s behavior, and DOM-CLASS-003 does not version it.
• It exists only as part of the class row, so it is destroyed with the class (INV-ARC-013) and needs no teardown of its own.

2. economic_engine

Class-level economic setup and projection state.

Rules:

• Append-only versions per class; each version carries the effective_at from which it governs, and the version in force at an instant is the one with the greatest effective_at at or before it (DOM-CLASS-003 §VII; 3.5, operator ruling 2026-09-30). A version is never rewritten.
• Stores canonical class-level economic configuration facts only.
• The exact persisted fields are derived from DOM-CLASS-002 and may be refined during the reconstruction.
• The stored state is configuration truth, not operational execution truth.

3. class_features

Feature enablement by class. Its exact identity and persisted fields are derived from the feature-state facts established during reconstruction; this document does not create a surrogate identifier or freeze a legacy column set.

Rules:

• One row per enabled feature per class.
• Absence of a row means the feature is disabled.
• payroll is enabled when the class is created and is never disabled: payroll cannot be turned off (owner ruling 2026-10-01, recorded in 3.6). A request to disable it is refused.

VIII. Constraints

• This domain stores class-level configuration only.
• It owns feature enablement, class identity, and all class-level economic configuration facts.
• It owns the economic_engine schema and its projection.
• It does not freeze any derived projection field set before the reconstruction is complete.
• It does not own rent settings, store offerings, insurance definitions, payroll rules, or banking rules.
• It does not mutate ledger, attendance, obligations, or entitlement tables.
• All class-level configuration must be scoped by class_id.
• public_class_id and join_code are display/access aliases and must not replace class_id as authority or be used for internal routing or persistence references.
• Feature enablement is class-level capability state, not domain policy state.

IX. Derived / Cross-Domain Rules

• Other domains consume class-level configuration from this domain.
• timezone governs class-level temporal interpretation.
• FEAT orchestration may read class-level configuration, but it does not own it.
• economic_engine is a projection of class-level configuration and must not become independent policy truth.
• economic_engine must not be treated as an immutable legacy schema contract while reconstruction is in progress.
• Class creation and class deletion are class-level mutation workflows.
• Disabling a feature changes access and display state for new use only; it does not rewrite downstream facts, and it does not remove the access needed to resolve surviving downstream state (for rent, DOM-OBL-001 §IX.16).

X. Shared Charge-Funding Configuration

Class Configuration owns the class-scoped overdraft-protection setting and explicitly incorporates SPEC-ECON-003 §4.5.1.1A for its shared charge-funding semantics. Under INV-CORE-000 §III.3 and INV-ARC-009 §V, configuration truth is exposed by pure scoped queries; this domain does not read Ledger balances, move money, or determine another domain’s business eligibility. FEAT-LED-000 coordinates the configuration query and Ledger monetary queries under INV-ARC-021 §V, VII. Banking product rules remain outside this domain; the shared protection setting is a class-level economic configuration fact.

get_banking_directive(class_id, effective_at?, include_fees=False) is a pure Class-owned query returning an immutable BankingDirective: canonical class_id, opaque version_locator, boolean protection_enabled, optional decimal flat_fee, nullable immutable progressive_fee tier/rate pairs, optional decimal cwi, and optional UTC fee_period_start derived from canonical class-local period evaluation. These fields project the effective Class economic configuration; they do not establish business fee applicability, read account balances, move money or resolve Identity. The initiating FEAT passes the directive to Ledger. By default (include_fees=False) the query returns no fee/CWI/period inputs and performs no fee/CWI/period evaluation; corrections use this mode. Only an initiating FEAT with independent fee applicability asks for fee inputs. Missing banking configuration means disabled protection and absent fee configuration, never invented monetary authority. progressive_fee is () when absent or not requested, a tuple of canonical tier/rate pairs when available, and None when configured progressive-fee evidence is unavailable or malformed. This preserves uncertainty without inventing a zero fee. Ledger rejects unavailable/malformed fee evidence only when that fee is independently applicable; NONE authority and fully funded charges do not consult irrelevant progressive-fee inputs. Unsupported/malformed configuration needed by an applicable fee fails closed.

3.7 (2026-10-03) supersedes 3.6 solely to incorporate the universal charge/deduction funding rule: cover the entire checking shortfall from savings or leave savings untouched. Own-account transfers retain sufficient-funds requirements. No runtime configuration or data changes are performed by this amendment.

Terminal Roster Deletion

A teacher deleting the final student Seat triggers class-universe destruction, including the administrative teacher Seat. Count all student Seats (claimed or unclaimed), not visible rows or only currently signed-in students. If this is the teacher’s final class membership, destroy the teacher principal through the account-destruction command. Otherwise preserve sibling classes and clear canonical pointers to the destroyed class.

Preview the complete consequence in the deletion modal. Re-evaluate ownership, selected seats, and whether class/account destruction follows inside the locked execution transaction. An outdated, narrower confirmation must be rejected. Unclaim retains the Seat and does not trigger this rule. Initial empty-class creation remains valid until roster setup; there is no empty-class or stale-class background inference.

XI. Amendment

3.8 (2026-10-03) authorizes the immutable scoped banking-directive projection for FEAT-coordinated Ledger resolution, superseding direct configuration lookup inside Ledger commands without changing charge, transfer or fee applicability.

Revisions to this document must:

1. Increment the version number.
2. Update the Effective Date.
3. Maintain consistency with INV-CORE-000.