refinement phase 7

dev/post-phase/server/runtime-services.md

@@ -19,7 +19,7 @@ is invented; "not needed" claims are backed by the absence of the package/code.
 | 4 | **Prometheus** (+ Grafana) | Scrapes `/metrics`; health forwarded to gauges | `UseMetricServer` + OTel exporter | **Recommended now** | — |
 | 5 | **Redis** | `ICacheService` + `IDistributedLock` (money-path mutex) | `Seams:*` (keys TBD; none today) | Before >1 API instance | rows 14, 42 |
 | 6 | **MinIO / S3 / ArvanCloud** | `IObjectStorage` — verification docs, avatars (REQ-006), invoice PDFs | `Seams:ObjectStorage:*` | Before real verification | row 13 |
-| 7 | **Job scheduler** (Hangfire/Quartz, in-app on SQL) | The deferred crons: payout batch, expiry scan, no-show, Moadian poll | hosted services (no interface exists) | Before unattended ops | row 26 |
+| 7 | **Job scheduler** — in-process, SQL only (refinement-phase-7 **done**) | The recurring crons: booking-expiry, notification-retention, credential-expiry scan, no-show sweep, weekly payout-batch generation (Moadian/refund-settlement poll = Phase 8) | `RecurringJobSchedulerHostedService` + `IRecurringJob`s | **Done for single instance** (no new infra) | row 26 |
 | 8 | **SMS gateway** (Kavenegar·Ghasedak·SMS.ir) | `ISmsSender` — OTP delivery (login is impossible without it) | `Seams:Sms:*` (to be added) | **Launch-critical** | row 12 |
 | 9 | **PSP / IPG + Shaparak** (ZarinPal·Sadad·Vandar·Jibit) | `IPaymentProvider` + `IWebhookVerifier` + `ISettlementSplitProvider` (تسهیم) | encrypted `payment_gateways.config_json` | Real payments | rows 39–41 |
 | 10 | **BNPL providers** (SnappPay·Digipay) | `IBnplProvider` / `IBnplProviderResolver` / `ICurrencyNormalizer` | `Seams:Bnpl:*`, `Seams:Currency:*`, gateway config | Optional at launch | rows 46–47 |
@@ -262,18 +262,22 @@ flowchart LR
 
 ## Deployment notes (from the code, not aspiration)
 
-1. **Boot = migrate + seed.** Every non-Testing start applies EF migrations and seeds roles, the
-   `admin`/`qw123321` user, and an **active sandbox ZarinPal gateway** (`Program.cs:99-104`). Until plan
-   §1.3/§1.4/§4.3 land: single-instance start-up, DDL-privileged login, and clean up the seeded credentials
-   per environment.
+1. **Boot ≠ migrate (refinement-phase-7).** DDL is a separate deploy step — `dotnet run -- migrate` applies
+   migrations + idempotent seeders then exits. **Development** boot still migrates + seeds (incl. the
+   Development-only sandbox gateway + demo world) for convenience; **deployed** boot only *checks* the schema is
+   current (`EnsureSchemaUpToDateAsync`, fail-fast on a pending migration) and seeds roles/break-glass admin. So
+   multi-instance boots no longer race on DDL and the runtime login needs no permanent DDL rights (plan §1.3/§1.4
+   also landed — no committed `admin`/`qw123321`; sandbox gateway is Development-only).
 2. **Environment files:** `appsettings.json` ≡ `appsettings.Development.json` (byte-identical); **no
    Production/Staging file exists.** All non-secret env differences ride on ~14 `Seams:*` groups whose
    defaults live in code (`SeamOptions.cs`), not in config files.
 3. **HTTP posture:** HTTP/2-only Kestrel default (plan §1.5), gRPC plugin + reflection always on
    (plan §7.5), TLS required for JWE sanity.
-4. **Single-instance constraints today:** in-memory cache, in-proc money lock, in-proc sweeps, per-instance
-   rate-limit buckets. Scaling past one instance requires plan §4.2 (Redis) + §4.3 (migrations) first — the
-   DB uniques keep money *correct* either way, but locks/cache/limits silently degrade.
+4. **Single-instance constraints today:** in-memory cache, in-proc money lock, the in-proc recurring-job
+   scheduler (refinement-phase-7 — its per-tick lock is that same in-proc seam), per-instance rate-limit buckets.
+   §4.3 (migrations split from boot) **landed**; scaling past one instance still requires §4.2 (Redis for the
+   shared cache + the cross-instance lock the scheduler/money path use) first — the DB uniques keep money
+   *correct* either way, but locks/cache/limits/scheduler-de-dup silently degrade.
 5. **Logs:** deployed envs write Warning+ to `Baya_Logs` only (Information dropped — plan §7.3); dev writes
    console + `logs/log.json`.
 6. **Client:** the Next.js app needs `NEXT_PUBLIC_API_URL` pointing at the proxy; wire casing camelCase;