refinement phase 9

server/src/API/Baya.Web.Api/Program.cs

@@ -110,7 +110,7 @@ TypeAdapterConfig.GlobalSettings.Scan(typeof(UserCreateCommand).Assembly,
 
 #region Plugin Services Configuration
 
-builder.Services.ConfigureGrpcPluginServices();
+builder.Services.ConfigureGrpcPluginServices(builder.Environment);
 
 #endregion
 

server/src/API/Plugins/Baya.Web.Plugins.Grpc/GrpcPluginStartup.cs

@@ -1,27 +1,36 @@
-using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
 using Baya.Web.Plugins.Grpc.Services;
 
 namespace Baya.Web.Plugins.Grpc;
 
+/// <summary>
+/// gRPC plugin wiring. The plugin exposes the User service over HTTP/2; the client is HTTP/JSON only, so this is
+/// an internal/optional surface. <b>gRPC reflection is enabled only in Development</b> (refinement-phase-9 §9.5) —
+/// reflection advertises the full service schema and must not be reachable in deployed environments. The endpoint
+/// shares the mixed-protocol Kestrel listener (refinement-phase-5 set <c>Http1AndHttp2</c>), so ALPN negotiates
+/// HTTP/2 for gRPC clients while the REST API keeps HTTP/1.1 — no dedicated port is required.
+/// </summary>
 public static class GrpcPluginStartup
 {
-    public static IServiceCollection ConfigureGrpcPluginServices(this IServiceCollection services)
+    public static IServiceCollection ConfigureGrpcPluginServices(this IServiceCollection services, IHostEnvironment environment)
     {
-     
-        
         services.AddGrpc();
-        services.AddGrpcReflection();
+
+        if (environment.IsDevelopment())
+            services.AddGrpcReflection();
 
         return services;
     }
 
     public static void ConfigureGrpcPipeline(this WebApplication app)
     {
-
         app.MapGrpcService<UserGrpcServices>();
-        app.MapGrpcReflectionService();
+
+        if (app.Environment.IsDevelopment())
+            app.MapGrpcReflectionService();
 
         app.MapGet("/GrpcUser", async context =>
         {
@@ -29,4 +38,4 @@ public static class GrpcPluginStartup
                 "Communication with this gRPC endpoint must be made through a gRPC client.");
         });
     }
-}
+}

server/src/Core/Baya.Application/Contracts/Audit/IAuditLogger.cs

@@ -28,4 +28,17 @@ public interface IAuditLogger
         int page,
         int pageSize,
         CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Retention sweep (refinement-phase-9 §9.4): deletes audit rows past their retention window. Financial /
+    /// compliance entity types (money + verification) keep a longer legal window than everyday rows. Processes the
+    /// oldest rows first, capped at <paramref name="maxRowsPerRun"/> so a large backlog drains across runs without
+    /// loading the whole table. Returns the number of rows deleted.
+    /// </summary>
+    ValueTask<int> PurgeExpiredAsync(
+        int generalRetentionDays,
+        int financialRetentionDays,
+        IReadOnlyCollection<string> financialEntityTypes,
+        int maxRowsPerRun,
+        CancellationToken cancellationToken = default);
 }

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Baya.Infrastructure.CrossCutting.csproj

@@ -7,10 +7,10 @@
 	<ItemGroup>
 		<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
 		<PackageReference Include="Serilog.Sinks.Console" />
+		<PackageReference Include="Serilog.Sinks.File" />
 		<PackageReference Include="Serilog.Sinks.MSSqlServer" />
 		<PackageReference Include="Serilog.Sinks.PeriodicBatching" />
 		<PackageReference Include="Serilog.Exceptions" />
-		<PackageReference Include="Serilog.Sinks.Elasticsearch" />
 		<PackageReference Include="Serilog.Enrichers.Span" />
 	</ItemGroup>
 	<ItemGroup>

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Logging/LoggingConfiguration.cs

@@ -1,8 +1,9 @@
-using System.Data;
+using System.Data;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Hosting;
 using Serilog;
 using Serilog.Enrichers.Span;
+using Serilog.Events;
 using Serilog.Exceptions;
 using Serilog.Formatting.Json;
 using Serilog.Sinks.MSSqlServer;
@@ -13,22 +14,29 @@ public static class LoggingConfiguration
 {
     public static Action<HostBuilderContext, LoggerConfiguration> ConfigureLogger => (context, configuration) =>
     {
-        #region Enriching Logger Context
+        #region Level & enrichment
 
         var env = context.HostingEnvironment;
 
-
-        configuration.Enrich.FromLogContext()
+        // refinement-phase-9 §9.3: deployed environments log Information+ (previously Warning+, which silently
+        // dropped every Information-level audit trail — logins, money-operation context). Framework categories
+        // are held at Warning so raising the floor doesn't flood the sink with ASP.NET/EF request noise.
+        // No PII/secrets are ever logged: the mock SMS sender no longer logs the OTP code, and clinical text /
+        // IBANs / phone numbers are encrypted or masked before they reach any handler that logs.
+        configuration
+            .MinimumLevel.Information()
+            .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
+            .MinimumLevel.Override("Microsoft.AspNetCore", LogEventLevel.Warning)
+            .MinimumLevel.Override("Microsoft.EntityFrameworkCore", LogEventLevel.Warning)
+            .MinimumLevel.Override("System", LogEventLevel.Warning)
+            .Enrich.FromLogContext()
             .Enrich.WithProperty("ApplicationName", env.ApplicationName)
             .Enrich.WithProperty("Environment", env.EnvironmentName)
             .Enrich.WithSpan()
             .Enrich.WithExceptionDetails();
-            
-
 
         #endregion
 
-
         var columnOpts = new ColumnOptions();
         columnOpts.Store.Remove(StandardColumn.Properties);
         columnOpts.Store.Add(StandardColumn.LogEvent);
@@ -39,36 +47,19 @@ public static class LoggingConfiguration
         // Development and Testing (WebApplicationFactory) log locally; the SQL sink is for deployed envs.
         if (!context.HostingEnvironment.IsDevelopment() && !context.HostingEnvironment.IsEnvironment("Testing"))
         {
+            // Retention for the `log.LogEvents` table is an ops/DBA responsibility (a scheduled purge or a
+            // partitioned/rolling table on Baya_Logs) — distinct from application data. Set an OpenTelemetry:Otlp
+            // collector (see OpenTelemetryConfigurations) if you prefer to ship logs off-box instead of the SQL sink.
             configuration.WriteTo
                 .MSSqlServer(
                     connectionString: context.Configuration.GetConnectionString("logDb"),
-                    sinkOptions: new MSSqlServerSinkOptions { TableName = "LogEvents", AutoCreateSqlTable = true, SchemaName = "log",AutoCreateSqlDatabase = true})
-                .MinimumLevel.Warning();
-
+                    sinkOptions: new MSSqlServerSinkOptions { TableName = "LogEvents", AutoCreateSqlTable = true, SchemaName = "log", AutoCreateSqlDatabase = true },
+                    columnOptions: columnOpts);
         }
-
-        else{
-            configuration.WriteTo.Console().MinimumLevel.Information();
-            configuration.WriteTo.File(new JsonFormatter(), "logs/log.json").MinimumLevel.Information();
+        else
+        {
+            configuration.WriteTo.Console();
+            configuration.WriteTo.File(new JsonFormatter(), "logs/log.json");
         }
-
-        #region ElasticSearch Configuration. UnComment if Needed 
-
-
-        //var elasticUrl = context.Configuration.GetValue<string>("Logging:ElasticUrl");
-
-        //if (!string.IsNullOrEmpty(elasticUrl))
-        //{
-        //    configuration.WriteTo.Elasticsearch(
-        //        new ElasticsearchSinkOptions(new Uri(elasticUrl))
-        //        {
-        //            AutoRegisterTemplate = true,
-        //            AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7,
-        //            IndexFormat = "web-logs-{0:yyyy.MM.dd}",
-        //            MinimumLogEventLevel = LogEventLevel.Debug
-        //        });
-        //}
-
-        #endregion
     };
-}
+}

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/LoggingSmsSender.cs

@@ -4,22 +4,24 @@ using Microsoft.Extensions.Logging;
 namespace Baya.Infrastructure.CrossCutting.Seams;
 
 /// <summary>
-/// Mock <see cref="ISmsSender"/>: "delivers" by logging. The OTP code is written to the log so a
-/// developer can complete the login flow; the phone number is never logged in full (PII policy) —
-/// only its last four digits. The real implementation swaps to an Iranian SMS gateway
-/// (Kavenegar/Ghasedak/SMS.ir) behind the same interface via a registration change.
+/// Mock <see cref="ISmsSender"/>: "delivers" by logging. The OTP <b>code is never logged</b> (refinement-phase-9
+/// §9.3 — no secrets/PII in logs, in any environment): a developer retrieves it from the Development-only
+/// <c>GET /api/v1/dev/last_otp/{phone}</c> helper (the <c>DevCapturingSmsSender</c> decorator), never the log.
+/// The phone number is logged only as its last four digits. The real implementation swaps to an Iranian SMS
+/// gateway (Kavenegar/Ghasedak/SMS.ir) behind the same interface via a registration change.
 /// </summary>
 public sealed class LoggingSmsSender(ILogger<LoggingSmsSender> logger) : ISmsSender
 {
     public Task SendOtpAsync(string phone, string code, CancellationToken cancellationToken = default)
     {
-        logger.LogWarning("MOCK SMS — OTP code {OtpCode} for phone ending in {PhoneTail}", code, Tail(phone));
+        // Deliberately does NOT log the OTP code — it is a login secret. Retrieve it via /dev/last_otp in Development.
+        logger.LogInformation("MOCK SMS — OTP issued to phone ending in {PhoneTail}", Tail(phone));
         return Task.CompletedTask;
     }
 
     public Task SendAsync(string phone, string message, CancellationToken cancellationToken = default)
     {
-        logger.LogWarning("MOCK SMS — message to phone ending in {PhoneTail}: {Message}", Tail(phone), message);
+        logger.LogInformation("MOCK SMS — message to phone ending in {PhoneTail}: {Message}", Tail(phone), message);
         return Task.CompletedTask;
     }
 

server/src/Infrastructure/Baya.Infrastructure.Monitoring/Baya.Infrastructure.Monitoring.csproj

@@ -10,13 +10,17 @@
       <PackageReference Include="AspNetCore.HealthChecks.SqlServer" />
       <PackageReference Include="AspNetCore.HealthChecks.UI.Client" />
       <PackageReference Include="AspNetCore.HealthChecks.UI.InMemory.Storage" />
+        <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />
         <PackageReference Include="OpenTelemetry.Exporter.Prometheus.AspNetCore" />
         <PackageReference Include="OpenTelemetry.Extensions.Hosting" />
         <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" />
+        <PackageReference Include="OpenTelemetry.Instrumentation.EntityFrameworkCore" />
         <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" />
-        <PackageReference Include="prometheus-net" />
-        <PackageReference Include="prometheus-net.AspNetCore" />
-        <PackageReference Include="prometheus-net.AspNetCore.HealthChecks" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <!-- The object-storage readiness probe resolves the IObjectStorage seam (Application contract). -->
+      <ProjectReference Include="..\..\Core\Baya.Application\Baya.Application.csproj" />
     </ItemGroup>
 
 </Project>

server/src/Infrastructure/Baya.Infrastructure.Monitoring/Configurations/HealthCheckConfigurations.cs

@@ -1,38 +1,80 @@
-using System.Net.Security;
+using Baya.Infrastructure.Monitoring.HealthChecks;
 using HealthChecks.UI.Client;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Diagnostics.HealthChecks;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Diagnostics.HealthChecks;
 using Microsoft.Extensions.Hosting;
-using Prometheus;
 
 namespace Baya.Infrastructure.Monitoring.Configurations;
 
+/// <summary>
+/// Health checks split into <b>liveness</b> (is the process up?) and <b>readiness</b> (can it serve traffic —
+/// are its dependencies reachable?), refinement-phase-9 §9.2. An orchestrator restarts on a failed liveness
+/// probe but only routes traffic on a passing readiness probe, so a broken log DB or object storage takes the
+/// instance out of rotation without a restart loop.
+/// <list type="bullet">
+///   <item><c>/healthz/live</c> — process only (always healthy while the host runs); never touches a dependency.</item>
+///   <item><c>/healthz/ready</c> — the app DB, the log DB (deployed only), and the object-storage write probe.</item>
+///   <item><c>/HealthCheck</c> — the aggregate (every check), retained for backward compatibility.</item>
+/// </list>
+/// </summary>
 public static class HealthCheckConfigurations
 {
+    private const string Ready = "ready";
+    private const string Live = "live";
+
     public static WebApplicationBuilder ConfigureHealthChecks(this WebApplicationBuilder builder)
     {
-        builder.Services.AddHealthChecks()
-            .AddSqlServer(builder.Configuration.GetConnectionString("SqlServer")!, name: "SQL Server")
-            .ForwardToPrometheus();
+        var checks = builder.Services.AddHealthChecks();
 
-        var currentUrl = builder.Configuration["ASPNETCORE_URLS"]?.Split(';')[0].Replace("+", "localhost");
-        
+        // Liveness: the process answers. Deliberately dependency-free so a dependency outage never restarts a
+        // healthy instance — that is readiness's job.
+        checks.AddCheck("self", () => HealthCheckResult.Healthy(), tags: [Live]);
+
+        // Readiness: the system of record.
+        checks.AddSqlServer(builder.Configuration.GetConnectionString("SqlServer")!, name: "sql-app", tags: [Ready]);
+
+        // The Serilog SQL sink only runs in deployed environments (Development/Testing log to console/file), and
+        // its connection string is a placeholder there — so only gate readiness on it where it is actually used.
+        if (!builder.Environment.IsDevelopment() && !builder.Environment.IsEnvironment("Testing"))
+        {
+            var logDb = builder.Configuration.GetConnectionString("logDb");
+            if (!string.IsNullOrWhiteSpace(logDb))
+                checks.AddSqlServer(logDb, name: "sql-logs", tags: [Ready]);
+        }
+
+        // Object storage (verification docs, avatars, invoice PDFs) — a real write round-trip.
+        checks.AddCheck<ObjectStorageWriteHealthCheck>("object-storage", tags: [Ready]);
+
+        // Redis (ICacheService / IDistributedLock) is single-process today (refinement-phase-7); when it becomes a
+        // real external dependency for a multi-instance deployment, add a "redis" check tagged Ready here.
 
         return builder;
     }
 
     public static WebApplication UseHealthChecks(this WebApplication app)
     {
+        app.MapHealthChecks("/healthz/live", new HealthCheckOptions
+        {
+            Predicate = check => check.Tags.Contains(Live),
+            ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse
+        }).ShortCircuit();
+
+        app.MapHealthChecks("/healthz/ready", new HealthCheckOptions
+        {
+            Predicate = check => check.Tags.Contains(Ready),
+            ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse
+        }).ShortCircuit();
+
+        // Aggregate endpoint (all checks) — retained for backward compatibility with existing probes/dashboards.
         app.MapHealthChecks("/HealthCheck", new HealthCheckOptions
         {
             Predicate = _ => true,
             ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse
-        }).ShortCircuit().DisableHttpMetrics();
-
-        
+        }).ShortCircuit();
 
         return app;
     }
-}
+}

server/src/Infrastructure/Baya.Infrastructure.Monitoring/Configurations/OpenTelemetryConfigurations.cs

@@ -1,14 +1,35 @@
-using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using OpenTelemetry.Metrics;
+using OpenTelemetry.Resources;
+using OpenTelemetry.Trace;
 
 namespace Baya.Infrastructure.Monitoring.Configurations;
 
+/// <summary>
+/// The single OpenTelemetry stack (refinement-phase-9, §9.1). Metrics and traces share one resource
+/// (<c>service.name = Baya.Web.Api</c>). Metrics are scraped by Prometheus (the <c>/metrics</c> endpoint,
+/// wired in <see cref="PrometheusMetricsConfigurations"/>); traces cover ASP.NET Core requests and EF Core
+/// commands so a cross-service money flow (webhook → confirm → ledger) can be followed end to end. The
+/// request's trace id is the <c>ApiResult.RequestId</c> the client sees, so a support ticket maps 1:1 to a
+/// trace.
+/// <para>The prior duplicate prometheus-net stack was removed — OpenTelemetry is now the only metrics source.</para>
+/// <para>OTLP export (traces + metrics) is <b>opt-in</b>: it is wired only when <c>OpenTelemetry:Otlp:Endpoint</c>
+/// is configured, so an MVP deployment with Prometheus alone runs unchanged and no exporter spams connection
+/// errors against an absent collector.</para>
+/// </summary>
 public static class OpenTelemetryConfigurations
 {
+    public const string ServiceName = "Baya.Web.Api";
+
     public static WebApplicationBuilder SetupOpenTelemetry(this WebApplicationBuilder builder)
     {
+        var otlpEndpoint = builder.Configuration["OpenTelemetry:Otlp:Endpoint"];
+        var hasOtlp = !string.IsNullOrWhiteSpace(otlpEndpoint);
+
         builder.Services.AddOpenTelemetry()
+            .ConfigureResource(resource => resource.AddService(ServiceName))
             .WithMetrics(metricsBuilder =>
             {
                 metricsBuilder.AddRuntimeInstrumentation()
@@ -17,12 +38,26 @@ public static class OpenTelemetryConfigurations
                         , "Microsoft.AspNetCore.Server.Kestrel"
                         , "System.Net.Http"
                         , "Baya.Web.Api"
-                        , "ControllerMetrics")
+                        , "ControllerMetrics"
+                        // The mediator request-duration histogram (MetricsBehaviour) — captured here so the one
+                        // metrics stack actually exports it (the removed prometheus-net stack never did).
+                        , "mediator_meter")
                     .AddPrometheusExporter();
+
+                if (hasOtlp)
+                    metricsBuilder.AddOtlpExporter(options => options.Endpoint = new Uri(otlpEndpoint!));
+            })
+            .WithTracing(tracingBuilder =>
+            {
+                tracingBuilder.AddAspNetCoreInstrumentation()
+                    .AddEntityFrameworkCoreInstrumentation();
+
+                if (hasOtlp)
+                    tracingBuilder.AddOtlpExporter(options => options.Endpoint = new Uri(otlpEndpoint!));
             });
 
         builder.Services.AddMetrics();
-        
+
         return builder;
     }
-}
+}

server/src/Infrastructure/Baya.Infrastructure.Monitoring/Configurations/PrometheusMetricsConfigurations.cs

@@ -1,15 +1,17 @@
-using Microsoft.AspNetCore.Builder;
-using Prometheus;
+using Microsoft.AspNetCore.Builder;
 
 namespace Baya.Infrastructure.Monitoring.Configurations;
 
 public static class PrometheusMetricsConfigurations
 {
+    /// <summary>
+    /// Exposes the single OpenTelemetry metrics stack for Prometheus scraping at <c>/metrics</c>
+    /// (refinement-phase-9, §9.1 — replaces the removed prometheus-net <c>UseMetricServer</c>/
+    /// <c>UseHttpMetrics</c> stack; HTTP request metrics now come from the OTel ASP.NET Core instrumentation).
+    /// </summary>
     public static WebApplication UseMetrics(this WebApplication app)
     {
-
-        app.UseMetricServer();
-        app.UseHttpMetrics();
+        app.UseOpenTelemetryPrometheusScrapingEndpoint();
         return app;
     }
-}
+}

server/src/Infrastructure/Baya.Infrastructure.Monitoring/HealthChecks/ObjectStorageWriteHealthCheck.cs

@@ -0,0 +1,41 @@
+#nullable enable
+using System.Text;
+using Baya.Application.Contracts.Common;
+using Microsoft.Extensions.Diagnostics.HealthChecks;
+
+namespace Baya.Infrastructure.Monitoring.HealthChecks;
+
+/// <summary>
+/// Readiness probe for the <see cref="IObjectStorage"/> seam (verification documents, avatars, invoice PDFs):
+/// a deploy can pass a DB-only health check while uploads are broken. This does a real round-trip —
+/// write a tiny probe blob, read it back, delete it — so a misconfigured bucket / unreachable endpoint /
+/// missing write permission surfaces as <see cref="HealthStatus.Unhealthy"/> rather than a first-user 500.
+/// The probe key is namespaced and deleted every run, so it never accumulates.
+/// </summary>
+internal sealed class ObjectStorageWriteHealthCheck(IObjectStorage objectStorage) : IHealthCheck
+{
+    private const string ProbeKey = "healthz/object-storage-probe";
+    private static readonly byte[] ProbePayload = Encoding.UTF8.GetBytes("ok");
+
+    public async Task<HealthCheckResult> CheckHealthAsync(
+        HealthCheckContext context,
+        CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await using (var writeStream = new MemoryStream(ProbePayload, writable: false))
+                await objectStorage.PutAsync(ProbeKey, writeStream, "text/plain", cancellationToken);
+
+            await using var readStream = await objectStorage.GetAsync(ProbeKey, cancellationToken);
+            if (readStream is null)
+                return HealthCheckResult.Unhealthy("Object storage write succeeded but the probe blob was not readable.");
+
+            await objectStorage.DeleteAsync(ProbeKey, cancellationToken);
+            return HealthCheckResult.Healthy();
+        }
+        catch (Exception ex)
+        {
+            return HealthCheckResult.Unhealthy("Object storage round-trip failed.", ex);
+        }
+    }
+}

server/src/Infrastructure/Baya.Infrastructure.Persistence/ApplicationDbContext.cs

@@ -179,5 +179,15 @@ public class ApplicationDbContext: IdentityDbContext<User, Role, int, UserClaim,
         {
             builder.Property(c => c.SettlementIban).HasConversion(encrypted);
         });
+
+        // refinement-phase-9 §9.5: ticket message bodies are the refund/dispute paper trail — users type phone
+        // numbers, addresses and clinical detail into them — so they are encrypted at rest through the same seam.
+        // The plaintext-length limit (4000) stays a boundary-validation rule; the stored ciphertext column is
+        // widened to nvarchar(max) in TicketMessageConfig. Body is never a search/filter predicate (the admin
+        // thread read decrypts per row), so losing SQL-searchability on it is an accepted trade-off.
+        modelBuilder.Entity<Baya.Domain.Entities.Messaging.TicketMessage>(builder =>
+        {
+            builder.Property(m => m.Body).HasConversion(encrypted);
+        });
     }
 }

server/src/Infrastructure/Baya.Infrastructure.Persistence/Configuration/ConfigurationConfig/PlatformConfigConfig.cs

@@ -52,6 +52,11 @@ internal sealed class PlatformConfigConfig : IEntityTypeConfiguration<PlatformCo
             (21, "refund_assume_nurse_paid", "false", ConfigDataType.Bool, "Ops/testing override that forces the post-payout clawback path for refunds (b11); b13 replaces the derivation."),
             (22, "payout_satna_threshold_irr", "1000000000", ConfigDataType.Decimal, "IRR net-amount threshold above which a payout is routed via SATNA (real-time) instead of PAYA (batch) (b13)."),
             (23, "require_bnpl_settlement_for_payout", "false", ConfigDataType.Bool, "When on, a BNPL-paid booking is payout-eligible only after its provider settlement is received (b13; default off — the DEFERRED settled_at guard)."),
+            // refinement-phase-9 §9.4: two-tier audit-log retention. Financial/verification rows keep a long legal
+            // window; everyday rows a shorter one; the retention sweep runs on the cadence key.
+            (24, "audit_retention_general_days", "730", ConfigDataType.Int, "Retention (days) for everyday audit rows before the retention sweep deletes them (~2 years)."),
+            (25, "audit_retention_financial_days", "2555", ConfigDataType.Int, "Retention (days) for financial/verification audit rows (refunds/clawbacks/payouts/verification/config/partner-center) — the long legal window (~7 years)."),
+            (26, "audit_retention_scan_cadence_hours", "24", ConfigDataType.Int, "Hours between audit-log retention sweeps."),
         ];
 
         return rows

server/src/Infrastructure/Baya.Infrastructure.Persistence/Configuration/MessagingConfig/TicketMessageConfig.cs

@@ -15,7 +15,10 @@ internal sealed class TicketMessageConfig : IEntityTypeConfiguration<TicketMessa
     {
         builder.ToTable("TicketMessages", "messaging");
 
-        builder.Property(m => m.Body).HasMaxLength(4000).IsRequired();
+        // Body is encrypted at rest (converter wired in ApplicationDbContext, refinement-phase-9 §9.5), so the
+        // stored column holds base64 ciphertext (longer than the plaintext) — nvarchar(max), no length cap here.
+        // The 4000-char plaintext limit is enforced at the boundary (Open/PostMessage validators).
+        builder.Property(m => m.Body).IsRequired();
         builder.Property(m => m.IsInternal).HasDefaultValue(false);
         builder.Property(m => m.ClientMessageId).HasMaxLength(100);
 

server/src/Infrastructure/Baya.Infrastructure.Persistence/Migrations/20260713184239_RefinementPhase9TicketBodyEncryptionAndAuditRetention.cs

@@ -0,0 +1,70 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
+
+namespace Baya.Infrastructure.Persistence.Migrations
+{
+    /// <inheritdoc />
+    public partial class RefinementPhase9TicketBodyEncryptionAndAuditRetention : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "Body",
+                schema: "messaging",
+                table: "TicketMessages",
+                type: "nvarchar(max)",
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "nvarchar(4000)",
+                oldMaxLength: 4000);
+
+            migrationBuilder.InsertData(
+                schema: "ops",
+                table: "PlatformConfigs",
+                columns: new[] { "Id", "CreatedAt", "CreatedById", "DataType", "Description", "Key", "ModifiedAt", "ModifiedById", "Value" },
+                values: new object[,]
+                {
+                    { 24L, new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)), null, "int", "Retention (days) for everyday audit rows before the retention sweep deletes them (~2 years).", "audit_retention_general_days", null, null, "730" },
+                    { 25L, new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)), null, "int", "Retention (days) for financial/verification audit rows (refunds/clawbacks/payouts/verification/config/partner-center) — the long legal window (~7 years).", "audit_retention_financial_days", null, null, "2555" },
+                    { 26L, new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)), null, "int", "Hours between audit-log retention sweeps.", "audit_retention_scan_cadence_hours", null, null, "24" }
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                schema: "ops",
+                table: "PlatformConfigs",
+                keyColumn: "Id",
+                keyValue: 24L);
+
+            migrationBuilder.DeleteData(
+                schema: "ops",
+                table: "PlatformConfigs",
+                keyColumn: "Id",
+                keyValue: 25L);
+
+            migrationBuilder.DeleteData(
+                schema: "ops",
+                table: "PlatformConfigs",
+                keyColumn: "Id",
+                keyValue: 26L);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Body",
+                schema: "messaging",
+                table: "TicketMessages",
+                type: "nvarchar(4000)",
+                maxLength: 4000,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "nvarchar(max)");
+        }
+    }
+}

server/src/Infrastructure/Baya.Infrastructure.Persistence/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -1300,6 +1300,33 @@ namespace Baya.Infrastructure.Persistence.Migrations
                             Description = "When on, a BNPL-paid booking is payout-eligible only after its provider settlement is received (b13; default off — the DEFERRED settled_at guard).",
                             Key = "require_bnpl_settlement_for_payout",
                             Value = "false"
+                        },
+                        new
+                        {
+                            Id = 24L,
+                            CreatedAt = new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)),
+                            DataType = "int",
+                            Description = "Retention (days) for everyday audit rows before the retention sweep deletes them (~2 years).",
+                            Key = "audit_retention_general_days",
+                            Value = "730"
+                        },
+                        new
+                        {
+                            Id = 25L,
+                            CreatedAt = new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)),
+                            DataType = "int",
+                            Description = "Retention (days) for financial/verification audit rows (refunds/clawbacks/payouts/verification/config/partner-center) — the long legal window (~7 years).",
+                            Key = "audit_retention_financial_days",
+                            Value = "2555"
+                        },
+                        new
+                        {
+                            Id = 26L,
+                            CreatedAt = new DateTimeOffset(new DateTime(2026, 1, 1, 0, 0, 0, 0, DateTimeKind.Unspecified), new TimeSpan(0, 0, 0, 0, 0)),
+                            DataType = "int",
+                            Description = "Hours between audit-log retention sweeps.",
+                            Key = "audit_retention_scan_cadence_hours",
+                            Value = "24"
                         });
                 });
 
@@ -3035,8 +3062,7 @@ namespace Baya.Infrastructure.Persistence.Migrations
 
                     b.Property<string>("Body")
                         .IsRequired()
-                        .HasMaxLength(4000)
-                        .HasColumnType("nvarchar(4000)");
+                        .HasColumnType("nvarchar(max)");
 
                     b.Property<string>("ClientMessageId")
                         .HasMaxLength(100)

server/src/Infrastructure/Baya.Infrastructure.Persistence/ServiceConfiguration/ServiceCollectionExtensions.cs

@@ -72,6 +72,8 @@ public static class ServiceCollectionExtensions
         services.AddSingleton<IRecurringJob, WeeklyPayoutGenerationJob>();
         // refinement-phase-8 (6.5): walk pending/submitted سامانه مودیان invoices toward their registered reference.
         services.AddSingleton<IRecurringJob, MoadianReconciliationJob>();
+        // refinement-phase-9 (§9.4): two-tier retention sweep over the append-only audit_logs table.
+        services.AddSingleton<IRecurringJob, AuditLogRetentionJob>();
         services.AddHostedService<RecurringJobSchedulerHostedService>();
 
         // Search (backend-phase-7). The index maintainer keeps nurse_search_index consistent inline inside

server/src/Infrastructure/Baya.Infrastructure.Persistence/Services/Audit/AuditLogger.cs

@@ -77,4 +77,37 @@ internal sealed class AuditLogger(
 
         return new PagedResult<AuditLogDto>(items, total, page, pageSize);
     }
+
+    public async ValueTask<int> PurgeExpiredAsync(
+        int generalRetentionDays,
+        int financialRetentionDays,
+        IReadOnlyCollection<string> financialEntityTypes,
+        int maxRowsPerRun,
+        CancellationToken cancellationToken = default)
+    {
+        var now = dateTimeProvider.UtcNow;
+        var generalCutoff = now.AddDays(-generalRetentionDays);
+        var financialCutoff = now.AddDays(-financialRetentionDays);
+
+        // Oldest-first (Id is monotonic with OccurredAt), capped. The age comparison is done in memory — the
+        // SQLite test provider can't translate a DateTimeOffset predicate — and the delete is a single id-keyed
+        // statement that translates on every provider. A financial/compliance row survives until the longer window.
+        var candidates = await db.Set<AuditLog>().AsNoTracking()
+            .OrderBy(a => a.Id)
+            .Select(a => new { a.Id, a.EntityType, a.OccurredAt })
+            .Take(maxRowsPerRun)
+            .ToListAsync(cancellationToken);
+
+        var expiredIds = candidates
+            .Where(a => a.OccurredAt < (financialEntityTypes.Contains(a.EntityType) ? financialCutoff : generalCutoff))
+            .Select(a => a.Id)
+            .ToList();
+
+        if (expiredIds.Count == 0)
+            return 0;
+
+        return await db.Set<AuditLog>()
+            .Where(a => expiredIds.Contains(a.Id))
+            .ExecuteDeleteAsync(cancellationToken);
+    }
 }

server/src/Infrastructure/Baya.Infrastructure.Persistence/Services/Scheduling/Jobs/AuditLogRetentionJob.cs

@@ -0,0 +1,68 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Baya.Application.Contracts.Audit;
+using Baya.Application.Contracts.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace Baya.Infrastructure.Persistence.Services.Scheduling.Jobs;
+
+/// <summary>
+/// Retention/archival policy for the append-only <c>ops.AuditLogs</c> table (refinement-phase-9 §9.4). The audit
+/// trail is never pruned by the application except here, on a schedule, and even then a two-tier policy protects
+/// the legally-sensitive rows: <b>financial &amp; verification</b> entity types (refunds, clawbacks, payouts,
+/// payout batches, verification decisions, config changes, partner centers) keep a long window
+/// (<c>audit_retention_financial_days</c>, default ~7 years); everyday operational rows keep a shorter one
+/// (<c>audit_retention_general_days</c>, default ~2 years). Idempotent: a re-run simply finds nothing new to
+/// delete. Runs on the <c>audit_retention_scan_cadence_hours</c> cadence.
+/// </summary>
+internal sealed class AuditLogRetentionJob(ILogger<AuditLogRetentionJob> logger) : IRecurringJob
+{
+    // Bound the per-run working set so a large backlog drains across successive runs without loading the whole table.
+    private const int MaxRowsPerRun = 20_000;
+
+    /// <summary>
+    /// The <c>IAuditable</c> entity types whose audit rows carry money- or verification-legal weight. Their
+    /// <c>EntityType</c> is the CLR type name written by <c>AuditFieldInterceptor</c>. Everything else uses the
+    /// shorter general window.
+    /// </summary>
+    private static readonly IReadOnlyCollection<string> FinancialEntityTypes =
+    [
+        "Refund",
+        "NurseClawback",
+        "NursePayout",
+        "NursePayoutBatch",
+        "NurseVerification",
+        "PlatformConfig",
+        "PartnerCenter"
+    ];
+
+    public string Name => "audit_log_retention";
+
+    public async ValueTask<TimeSpan> GetIntervalAsync(IServiceProvider services, CancellationToken cancellationToken)
+    {
+        var config = services.GetRequiredService<IPlatformConfig>();
+        var hours = await config.GetConfig<int>("audit_retention_scan_cadence_hours", cancellationToken);
+        return TimeSpan.FromHours(hours);
+    }
+
+    public async ValueTask RunAsync(IServiceProvider services, CancellationToken cancellationToken)
+    {
+        var config = services.GetRequiredService<IPlatformConfig>();
+        var audit = services.GetRequiredService<IAuditLogger>();
+
+        var generalDays = await config.GetConfig<int>("audit_retention_general_days", cancellationToken);
+        var financialDays = await config.GetConfig<int>("audit_retention_financial_days", cancellationToken);
+
+        var deleted = await audit.PurgeExpiredAsync(
+            generalDays, financialDays, FinancialEntityTypes, MaxRowsPerRun, cancellationToken);
+
+        if (deleted > 0)
+            logger.LogInformation(
+                "Audit retention purged {Count} audit row(s) (general>{GeneralDays}d, financial>{FinancialDays}d)",
+                deleted, generalDays, financialDays);
+    }
+}

server/src/Tests/Baya.Test.Api/HealthCheckApiTests.cs

@@ -0,0 +1,21 @@
+using System.Net;
+
+namespace Baya.Test.Api;
+
+/// <summary>
+/// refinement-phase-9 §9.2: liveness is split from readiness. <c>/healthz/live</c> reports only the process
+/// (dependency-free) so a dependency outage never triggers a restart loop; it must answer healthy even in the
+/// test host, whose readiness dependencies (a real SQL Server) are absent.
+/// </summary>
+public class HealthCheckApiTests(BayaApiFactory factory) : IClassFixture<BayaApiFactory>
+{
+    [Fact]
+    public async Task Liveness_IsHealthy_WithoutTouchingDependencies()
+    {
+        var client = factory.CreateClient();
+
+        var response = await client.GetAsync("/healthz/live");
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+    }
+}

server/src/Tests/Baya.Test.Foundation/Audit/AuditLogRetentionTests.cs

@@ -0,0 +1,88 @@
+using Baya.Application.Contracts.Common;
+using Baya.Domain.Entities.Audit;
+using Baya.Infrastructure.Persistence;
+using Baya.Infrastructure.Persistence.Services.Audit;
+using Baya.Tests.Setup.Setups;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+
+namespace Baya.Test.Foundation.Audit;
+
+/// <summary>
+/// refinement-phase-9 §9.4: the two-tier audit-log retention sweep. Everyday rows are deleted past the general
+/// window; financial/verification rows survive until the longer legal window. The sweep is idempotent.
+/// </summary>
+public sealed class AuditLogRetentionTests : IDisposable
+{
+    private static readonly DateTimeOffset Now = new(2026, 8, 10, 10, 0, 0, TimeSpan.Zero);
+    private const int GeneralDays = 730;
+    private const int FinancialDays = 2555;
+    private static readonly string[] FinancialTypes = ["Refund", "NursePayout", "NurseVerification", "PlatformConfig"];
+
+    private readonly SqliteConnection _connection;
+    private readonly ApplicationDbContext _db;
+    private readonly AuditLogger _audit;
+
+    public AuditLogRetentionTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+        var options = new DbContextOptionsBuilder<ApplicationDbContext>().UseSqlite(_connection).Options;
+        _db = new ApplicationDbContext(options, TestFieldEncryptor.Instance);
+        _db.Database.EnsureCreated();
+
+        var clock = Substitute.For<IDateTimeProvider>();
+        clock.UtcNow.Returns(Now);
+        _audit = new AuditLogger(_db, Substitute.For<ICurrentUser>(), clock);
+    }
+
+    private void Seed(string entityType, int ageDays)
+    {
+        _db.Set<AuditLog>().Add(new AuditLog
+        {
+            EntityType = entityType,
+            EntityId = $"{entityType}-{ageDays}",
+            Action = AuditAction.Updated,
+            OccurredAt = Now.AddDays(-ageDays)
+        });
+        _db.SaveChanges();
+    }
+
+    [Fact]
+    public async Task Purge_deletes_expired_general_rows_and_keeps_recent_and_financial()
+    {
+        Seed("SomeEntity", ageDays: 800);       // general, past 730 → deleted
+        Seed("SomeEntity", ageDays: 700);       // general, within 730 → kept
+        Seed("Refund", ageDays: 800);           // financial, within 2555 → kept
+        Seed("NursePayout", ageDays: 3000);     // financial, past 2555 → deleted
+
+        var deleted = await _audit.PurgeExpiredAsync(GeneralDays, FinancialDays, FinancialTypes, maxRowsPerRun: 1000, CancellationToken.None);
+
+        Assert.Equal(2, deleted);
+        var survivors = await _db.Set<AuditLog>().AsNoTracking().Select(a => a.EntityId).ToListAsync();
+        Assert.Equal(2, survivors.Count);
+        Assert.Contains("SomeEntity-700", survivors);
+        Assert.Contains("Refund-800", survivors);
+    }
+
+    [Fact]
+    public async Task Purge_is_idempotent_when_nothing_is_expired()
+    {
+        Seed("SomeEntity", ageDays: 10);
+        Seed("Refund", ageDays: 100);
+
+        var first = await _audit.PurgeExpiredAsync(GeneralDays, FinancialDays, FinancialTypes, maxRowsPerRun: 1000, CancellationToken.None);
+        var second = await _audit.PurgeExpiredAsync(GeneralDays, FinancialDays, FinancialTypes, maxRowsPerRun: 1000, CancellationToken.None);
+
+        Assert.Equal(0, first);
+        Assert.Equal(0, second);
+        Assert.Equal(2, await _db.Set<AuditLog>().CountAsync());
+    }
+
+    public void Dispose()
+    {
+        _db.Dispose();
+        _connection.Dispose();
+    }
+}

server/src/Tests/Baya.Test.Foundation/Messaging/TicketMessageEncryptionTests.cs

@@ -0,0 +1,83 @@
+using Baya.Domain.Entities.Messaging;
+using Baya.Domain.Entities.User;
+using Baya.Infrastructure.Persistence;
+using Baya.Tests.Setup.Setups;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Baya.Test.Foundation.Messaging;
+
+/// <summary>
+/// refinement-phase-9 §9.5: ticket message bodies (the refund/dispute paper trail — phone numbers, addresses,
+/// clinical detail) are encrypted at rest through the <c>IFieldEncryptor</c> seam. The stored column holds
+/// ciphertext, never the plaintext; a normal read still returns the plaintext (EF applies the converter).
+/// </summary>
+public sealed class TicketMessageEncryptionTests : IDisposable
+{
+    private static readonly DateTimeOffset Now = new(2026, 8, 10, 10, 0, 0, TimeSpan.Zero);
+
+    private readonly SqliteConnection _connection;
+    private readonly ApplicationDbContext _db;
+
+    public TicketMessageEncryptionTests()
+    {
+        _connection = new SqliteConnection("DataSource=:memory:");
+        _connection.Open();
+        var options = new DbContextOptionsBuilder<ApplicationDbContext>().UseSqlite(_connection).Options;
+        _db = new ApplicationDbContext(options, TestFieldEncryptor.Instance);
+        _db.Database.EnsureCreated();
+    }
+
+    private long SeedMessage(string body)
+    {
+        var sender = new User { UserName = "u1", PhoneNumber = "09120000001", Gender = "male", Name = "علی", FamilyName = "رضایی", IsActive = true };
+        _db.Users.Add(sender);
+        _db.SaveChanges();
+
+        var ticket = new Ticket { ReferenceCode = "TKT-ENC001", Category = TicketCategory.Support, OpenedById = sender.Id };
+        _db.Set<Ticket>().Add(ticket);
+        _db.SaveChanges();
+
+        var message = new TicketMessage { TicketId = ticket.Id, SenderId = sender.Id, Body = body, IsInternal = false, SentAt = Now };
+        _db.Set<TicketMessage>().Add(message);
+        _db.SaveChanges();
+        return message.Id;
+    }
+
+    [Fact]
+    public async Task Body_is_stored_encrypted_at_rest()
+    {
+        const string plaintext = "patient at 09121234567, unit 4B — chest pain";
+        var id = SeedMessage(plaintext);
+
+        await using var command = _connection.CreateCommand();
+        command.CommandText = "SELECT Body FROM TicketMessages WHERE Id = $id";
+        command.Parameters.AddWithValue("$id", id);
+        var stored = (string?)await command.ExecuteScalarAsync();
+
+        Assert.NotNull(stored);
+        Assert.NotEqual(plaintext, stored);
+        Assert.Equal(TestFieldEncryptor.Instance.Encrypt(plaintext), stored);
+        Assert.DoesNotContain("09121234567", stored);
+    }
+
+    [Fact]
+    public async Task Body_round_trips_to_plaintext_on_read()
+    {
+        const string plaintext = "please confirm the visit address";
+        var id = SeedMessage(plaintext);
+
+        // Fresh context so the value comes from the store, not the change tracker.
+        var options = new DbContextOptionsBuilder<ApplicationDbContext>().UseSqlite(_connection).Options;
+        await using var freshDb = new ApplicationDbContext(options, TestFieldEncryptor.Instance);
+        var body = await freshDb.Set<TicketMessage>().Where(m => m.Id == id).Select(m => m.Body).SingleAsync();
+
+        Assert.Equal(plaintext, body);
+    }
+
+    public void Dispose()
+    {
+        _db.Dispose();
+        _connection.Dispose();
+    }
+}