backend phase 1: config, reference & platform signals

Lay the cross-cutting platform backbone every later phase reads from. Adds
the first marketplace EF migration baseline (new `ops` schema) and the
mechanisms b2..b15 reuse: typed runtime config, an append-only audit trail,
an analytics event log, the holiday/bank-closure calendar, in-app
notifications, and the internal support-alert worklist.

Schema & migration
- New `ops` schema + migration InitialMarketplaceBaseline with 6 tables:
  PlatformConfigs (IAuditable), AuditLogs (append-only), SystemEvents,
  IranianHolidays, Notifications, SupportAlerts — with indexes/uniques and
  FKs to usr.Users. Seeded 12 config keys + 7 sample holidays via HasData.

Domain / Application
- IAuditable marker + [AuditRedacted] attribute; entities + string-code
  constant holders (config data_type, holiday type, alert type/severity/status).
- Facade contracts: IPlatformConfig, IHolidayCalendar, IAnalyticsSink,
  IAuditLogger, INotificationService, ISupportAlertService; DTOs +
  PagedResult<T>; evolved the INotificationDispatcher.Notification record to
  carry Type + DataJson; Pagination helper.
- 14 CQRS commands/queries (+ validators) wiring the endpoints to the facades.

Infrastructure
- DB-backed facade implementations in Persistence/Services/; real in-app
  INotificationDispatcher (removes the b0 log stub); notification-retention
  hosted service (purge is_read=1 AND age>90d).
- Extended AuditFieldInterceptor to also append an old/new-diff audit_logs row
  for every IAuditable change in the same transaction (PII redacted).
- Registered all facades + hosted service in AddPersistenceServices; removed
  the dispatcher registration from AddCrossCuttingSeams.

API
- 5 controllers: admin PlatformConfig/Holidays/Audit/SupportAlerts
  ([Authorize(DynamicPermission)]) + current-user Notifications ([Authorize]),
  all tenant-scoped and paginated. 16 Swagger paths total.

Money-correctness & safety rules honoured
- Config read at compute time (cached, parsed by data_type), never hardcoded;
  every config change is audited in the same transaction; audit_logs is
  append-only (no update/delete path); support alerts are admin-only;
  notifications are tenant-scoped; analytics is fire-and-forget.

Tests & docs
- 18 new foundation tests over in-memory SQLite (config typing + audit,
  holidays, notifications + tenancy + retention, support alerts, analytics);
  build clean (0 new code warnings), 22 tests green; migration applied to the
  dev DB and swagger.v1.json refreshed.
- Updated server Project map + CONVENTIONS, product data-model doc 12 (seeded
  config defaults), config-reference contract, mock registry, backend handoff/
  STATUS/report.

Follow-ups: add FK constraints for SupportAlerts.BookingId (b9) and ReviewId
(b14) when those tables land.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dev/shared-working-context/reports/backend-phase-1-report.md

@@ -0,0 +1,78 @@
+# Backend Phase 1 — Config, reference & platform signals — Report (2026-07-02)
+
+## What was built
+- **First marketplace migration baseline** `20260701193257_InitialMarketplaceBaseline` (on top of b0's
+  `InitialBaseline`) creating a new **`ops` schema** with six tables:
+  - `PlatformConfigs` (unique `Key`, audit fields, `IAuditable`), `AuditLogs` (append-only; indexes on
+    `(EntityType,EntityId)` + `OccurredAt`; nullable FK → `usr.Users`), `SystemEvents` (append-only;
+    indexes on `Name`/`OccurredAt`/`UserId`), `IranianHolidays` (unique `HolidayDate`), `Notifications`
+    (index `(UserId,IsRead,CreatedAt)`; FK → Users), `SupportAlerts` (indexes on `Status`/`Type`;
+    nullable `BookingId`/`ReviewId` columns **without FK yet**; FK → Users on `OwnerUserId`).
+  - Seeded via `HasData`: 12 `platform_configs` keys and 7 sample holidays (Nowruz block + Revolution
+    Day + Nature Day + a religious day).
+- **Domain:** entities under `Configuration/Audit/Analytics/Holidays/Notifications/SupportAlerts`; the
+  `IAuditable` marker + `[AuditRedacted]` attribute (`Domain/Common`); string-code constant holders
+  (`ConfigDataType`, `AuditAction`, `HolidayType`, `SupportAlertType/Severity/Status`).
+- **Application:** facade contracts `IPlatformConfig`/`IHolidayCalendar`/`IAnalyticsSink`/`IAuditLogger`/
+  `INotificationService`/`ISupportAlertService`; DTOs + `PagedResult<T>`; evolved the
+  `INotificationDispatcher.Notification` record to carry `Type` + `DataJson`; a `Pagination.Normalize`
+  helper; **14 CQRS commands/queries** (+ validators) wiring the endpoints to the facades.
+- **Persistence (`Services/`):** DB-backed implementations of every facade; the real
+  `InAppNotificationDispatcher` (supersedes and **removes** the b0 `LogNotificationDispatcher`);
+  `NotificationRetentionHostedService` (interval `BackgroundService`). The `AuditFieldInterceptor` was
+  **extended** (not duplicated) to append an `audit_logs` row with an old/new diff for every `IAuditable`
+  change, in the same transaction, redacting `[AuditRedacted]` properties. Registered all facades +
+  hosted service in `AddPersistenceServices`; removed the `INotificationDispatcher` registration from
+  `AddCrossCuttingSeams`.
+- **API:** 5 sealed `BaseController` controllers — admin `PlatformConfigController`/`HolidaysController`/
+  `AuditController`/`SupportAlertsController` (`[Authorize(DynamicPermission)]`) and current-user
+  `NotificationsController` (`[Authorize]`).
+
+## What is now testable (and exactly how)
+`dotnet test Baya.sln` → **22 pass** (4 identity + 18 new foundation), build clean (0 new code warnings;
+only pre-existing NU1903/NU1510 package advisories remain). Foundation tests run against a real
+`ApplicationDbContext` over in-memory SQLite (`OpsTestHost`, seed applied via `EnsureCreated`):
+1. **Typed config** — `GetConfig<decimal>("vat_rate")==0.10`, `<int>("dispute_window_hours")==72`,
+   `<int>("booking_payment_deadline_minutes")==30`; cache hit on re-read.
+2. **Config change is audited** — `SetConfig("platform_fee_rate","0.18")` → new value read back (cache
+   evicted) + one `audit_logs` row (`updated`, actor, old `0.15`/new `0.18`); missing key → `false`.
+3. **Holidays** — `IsBankClosed(2026-03-21)==true`, `IsHoliday(non-holiday)==false`,
+   `NextBusinessDay(2026-03-21)` → a later open, non-Friday day; upsert/delete round-trip.
+4. **Notifications** — dispatch → list unread-first → unread count 1 → mark read → 0; tenancy (another
+   user sees nothing and cannot mark your row); **retention** deletes only read >90d (unread >90d and
+   read <90d survive).
+5. **Support alerts** — raise (`low_rating`,`review`,`42`) → list open → assign → resolve; resolved is
+   terminal.
+6. **Analytics** — `EmitAsync` inserts a `system_events` row.
+
+**Live:** the migration was applied to the dev DB (`Server=87.107.152.16`); the API boots with all 16
+Swagger paths present, and the notification-retention hosted service runs its purge query on startup.
+Swagger snapshot refreshed at `dev/contracts/openapi/swagger.v1.json` (fetched over HTTP/2 — the gRPC
+plugin makes the REST port HTTP/2-only, so a browser or HTTP/2 client is needed to hit Swagger by hand).
+
+## What is mocked / waiting on a real service
+See `reports/mocks-registry.md`. New/changed 🟡: `IHolidayCalendar` (seeded table → real feed/sync),
+`IAnalyticsSink` (system_events row → warehouse), retention `IJobScheduler`
+(`NotificationRetentionHostedService` interval runner → Hangfire/Quartz), `INotificationDispatcher`
+(now **real in-app write**; SMS/push channels deferred). Selection is by registration, never `if(mock)`.
+
+## Contracts produced
+`dev/contracts/domains/config-reference.md` (live as of b1; consumers f14/f15) + refreshed
+`openapi/swagger.v1.json`.
+
+## Decisions recorded (were not pinned by product docs)
+Seeded config defaults marked _provisional_ in `product/data-model/12-audit-config-and-reference.md`:
+`platform_fee_rate` 0.15, `nurse_response_deadline_hours` 24, `evv_location_tolerance_meters` 200,
+`min_rating_for_support_alert` 2, `bnpl_provider_commission_rate` 0.07, `bnpl_settlement_timing`
+immediate, and a 3-tier `cancellation_tiers` default. Confirm before launch — all are config-driven.
+
+## Follow-ups for later phases
+- **b9 / b14:** add the FK constraints `SupportAlerts.BookingId → Bookings` and
+  `SupportAlerts.ReviewId → Reviews` when those tables land (columns already exist).
+- List orderings use the monotonic `Id` (newest-first, deterministic, cross-provider) rather than the
+  `DateTimeOffset` column — SQLite can't `ORDER BY`/compare `DateTimeOffset`; equivalent on SQL Server.
+- Notification retention filters the age cutoff in memory (after a server-side `IsRead` filter) so the
+  bulk delete translates on every provider; fine for a bounded, off-peak job.
+- **Integration tests** (`WebApplicationFactory<Program>`, CONVENTIONS §10) still not scaffolded — the
+  HTTP pipeline (auth 401/403, envelope) is covered by the live Swagger boot but not automated; add the
+  project when convenient.

dev/shared-working-context/reports/mocks-registry.md

@@ -20,7 +20,9 @@ Status legend: 🔴 not built · 🟡 mocked (seam + fake impl in place) · 🟢
 | `IBnplProvider` | backend-phase-12 | BNPL — drives state machine, fake settle/revert | _tbd_ | SnappPay/Digipay OAuth + verb set; encrypted creds in `payment_gateways.config_json` | 🔴 |
 | `ICurrencyNormalizer` | backend-phase-12 | Toman↔IRR — ×10 | _tbd_ | Config-driven per provider boundary | 🔴 |
 | `IBankTransferProvider` | backend-phase-13 | PAYA/SATNA payout — fake transfer ref | _tbd_ | Jibit/Vandar/Sadad payout; source account; PAYA vs SATNA | 🔴 |
-| `IHolidayCalendar` | backend-phase-1 | Bank holidays — seeded static table | _tbd_ | Iranian banking-holiday feed / sync job | 🔴 |
+| `IHolidayCalendar` | backend-phase-1 | Bank holidays — reads the seeded `ops.IranianHolidays` table; lookups cached (`HolidayCalendarService`, `Persistence/Services/Holidays/`); Iranian banking weekend = Friday | _none_ | Add a sync job/feed that maintains the (partly lunar-Hijri) calendar table; the read interface stays | 🟡 |
+| `IAnalyticsSink` | backend-phase-1 | Behavioural events — inserts an `ops.SystemEvents` row, fire-and-forget (`AnalyticsSink`, `Persistence/Services/Analytics/`) | _none_ | Pipe to a warehouse/stream (e.g. Kafka→ClickHouse); keep fire-and-forget semantics | 🟡 |
+| `IJobScheduler` (retention) | backend-phase-1 | Scheduling — in-process interval `BackgroundService` running `PurgeOldReadNotifications` daily (`NotificationRetentionHostedService`, `Persistence/Services/Notifications/`) | _none_ | Swap to Hangfire/Quartz; register the job there; keep the purge predicate (`is_read=1 AND age>90d`) | 🟡 |
 | `IShahkarVerifier` | backend-phase-6 | Phone↔national-id match — fake pass | _tbd_ | Real Shahkar/KYC vendor; persist `external_response_json` | 🔴 |
 | `IIdentityKycProvider` | backend-phase-6 | National-ID + liveness — fake pass | _tbd_ | Finnotech/U-ID/Jibbit/Verify liveness+OCR | 🔴 |
 | `ICredentialVerifier` | backend-phase-6 | MoH/INO/criminal-record — manual/fake | _tbd_ | Manual admin today; API when a portal appears (`verification_method=api`) | 🔴 |
@@ -29,7 +31,7 @@ Status legend: 🔴 not built · 🟡 mocked (seam + fake impl in place) · 🟢
 | `IMoadianClient` | backend-phase-11 | سامانه مودیان e-invoice — leaves ref pending | _tbd_ | Real مودیان submission → 22-digit ref | 🔴 |
 | `IReviewModerationService` | backend-phase-14 | AI moderation — keyword/pass-through | _tbd_ | Real classifier/LLM endpoint | 🔴 |
 | `IFieldEncryptor` | backend-phase-0 | PII encryption — AES-256-CBC + HMAC hash from a local symmetric key (`SymmetricFieldEncryptor`, `Baya.Infrastructure.CrossCutting/Seams/`) | `Seams:FieldEncryption:Key`, `Seams:FieldEncryption:HashKey` | KMS / column encryption / Key Vault / HSM | 🟡 |
-| `INotificationDispatcher` | backend-phase-0/15 | Notification channels — logs/no-op (`LogNotificationDispatcher`, `Baya.Infrastructure.CrossCutting/Seams/`); no write yet | _none_ | Add the in-app `notifications` write (b15) + SMS/push (FCM); polling → Redis pub/sub or SignalR later | 🟡 |
+| `INotificationDispatcher` | backend-phase-0/**1** | Notification channels — **in-app write is now real** (`InAppNotificationDispatcher`, `Persistence/Services/Notifications/`, writes an `ops.Notifications` row); b0 log stub removed. SMS/push channels still deferred (no-op) behind the same seam | _none_ | Add SMS (`ISmsSender`) / push (FCM) channels; polling → Redis pub/sub or SignalR later | 🟡 |
 | `ILicenseVerificationService` | backend-phase-15 | eNamad / MoH establishment-permit — manual approve | _tbd_ | Real registry/API | 🔴 |
 
 > Exact config keys and file paths get filled in by the phase that builds each seam. Keep the