Every enrollment pinned to the course version it started under
Courses carry numbered versions with a publication date and the name of the person who published them. Each enrollment records the exact version that student began on, and the database refuses to delete a version any enrollment still points at. Stage sign-offs are checked against that same version, so a student cannot be advanced through a stage belonging to a different course.
