docs: record configurable cron schedule

REFACTORING-AUDIT.md

@@ -209,6 +209,121 @@ Global config removal remains the separate follow-up `C002`.
 - Wallet vet remains limited to three findings reproduced in the untouched baseline: logger unreachable code, alert timeout cancel, and protobuf lock copying in queue JSON marshaling.
 - Wallet commit: `7958530 refactor(wallet): move config loading to infrastructure`.
 
+### `C004` — wallet configuration injection
+
+- Configuration is loaded once by each Cobra command and carried explicitly through command context into repository setup, service constructors, gRPC listeners, profiling, availability monitoring, ledger and transaction-event workers, cron jobs, and Stellar initialization.
+- Repository, domain/use-case, market, alert, wallet lifecycle, financial, SMS, logger, and Stellar dependencies now receive either the full configuration or narrow values at construction/call boundaries.
+- Stellar transaction fees, network passphrase, gas policy, deterministic key material, and distributor secret are injected into the adapter; focused tests verify the initialized client retains every supplied value.
+- Removed the temporary `wallet/config` compatibility facade and its process-global `Cfg`; production source has no active global configuration reads or legacy config imports.
+- Full `go test ./...`, `go test -race ./...`, `go vet ./...`, and `go build ./...` pass with the isolated Go cache.
+- Wallet implementation was committed in reviewable slices from `f507637` through `4d192a6`, including final Stellar (`53df96a`), logger (`1b3ffc8`), and command-root (`4d192a6`) injection commits.
+
+### `C005`/`C006` — API configuration ownership and injection
+
+- Moved API configuration types and pure koanf/TOML loading into `api/infrastructure/config`, preserving the default IPG callback and UI error URLs and file-overrides-default behavior.
+- The command boundary loads configuration once and passes it into logger, gRPC service composition, HTTP handlers, middleware, Swagger selection, profiling, and upstream clients.
+- Removed the API `config.Cfg` singleton and legacy `gateway/config` package; source scans show no active global configuration reads or legacy imports.
+- API `go test ./...`, `go test -race ./...`, `go vet ./...`, and `go build ./...` pass. Existing unrelated Swagger and module-file work remains uncommitted and preserved.
+- API commit: `44d56d3 refactor(api): move and inject configuration`.
+
+### `L009`/`L010` — GL reconciliation and recovery verification
+
+- GL provides read-only reconciliation over sealed journals, detecting invalid journals and duplicate source transaction/version identities without mutating ledger state.
+- External settlement evidence can be compared repeatedly against GL journals to report missing evidence, duplicate evidence, and blockchain network/hash mismatches.
+- The read-only explorer reconstructs account and holder balances from immutable entries and exposes journal, transaction-hash, account, and balance reads for disaster recovery.
+- Replay is bounded and idempotent; immutable journal validation, canonical payload hashes, transactional rollback, sealed-journal checks, and database uniqueness constraints prevent duplicate or partial postings.
+- Conservation and concurrent transfer behavior are exercised by the fixed redistribution load scenario; GL full tests, race tests, vet, and build pass. The sandbox initially blocked localhost sockets for an existing `httptest` test; the same verification passed with localhost access enabled.
+- GL implementation commits: `3f5fd86`, `b14c5e2`, and `d5c9b33`; verification completed on `2026-08-30`.
+
+### Auth periodic identity validation extension
+
+- Added `Identity.LastChecked` for the biweekly phone/national-ID validation and `Identity.LastBirthDateChecked` for the monthly national-ID/birthdate validation; Auth's existing startup auto-migration adds the indexed columns.
+- Added a local-midnight scheduler job with configurable cron expression and independent validation intervals (defaults: 14 days and 30 days).
+- The job retries failed people on a later run by updating timestamps only after successful validation and refresh; it reports checked, skipped, and failed counts without disabling or overwriting an identity on a failed provider check.
+- `DISABLE_PRIODICAL_IDENTITY_VALIDATION=1` (the requested spelling; `0`, `true`, and `false` are also accepted) disables the job. The nested `periodic-identity-validation` config section controls schedule, intervals, and the file-level disabled flag.
+- Auth full tests, race tests, vet, and build pass; implementation committed as `9bc9cca`.
+
+### `A001` — Auth RPC and dependency migration map
+
+| RPC / operation | Current operation | Persistence / external dependencies | Target application boundary |
+|---|---|---|---|
+| `AuthorizationSrvHealth`, `InternalAuthorizationSrvHealth` | readiness check | PostgreSQL ping | health use case + gRPC adapter |
+| `CheckIAM` | authenticate request identity and load roles/identity | User, Identity, Role, RolePermission, Redis cache | authorization use case |
+| `SendLoginOTP`, `LoginWithOTP`, `GetAccessTokenByRefreshToken` | OTP issuance, login, refresh-token rotation | User, Session, OTP templates, Redis, Kavenegar, JWT keys | authentication/OTP use cases |
+| `GetUserPermission`, `InitPermissionsForRoutes`, `InitAdminRole` | route/role/permission bootstrap and lookup | Permission, Role, RolePermission, User, Redis | permission use case |
+| `GetIdentity`, `UpdateIdentity`, `GetUserIdentityBasic`, `GetUserIAM`, `GetUser` | identity read/update and IAM projection | User, Identity, Redis, Shahkar provider, Pecco/Zohal/Ehraz, Internal Wallet | identity use case |
+| `GetBankInfoList`, `UpdateBankInfo`, `RemoveBankInfo` | IBAN verification and bank-info lifecycle | BankInfo, Identity, transaction boundary, Zohal | bank-information use case |
+| `ProcessTFAReq`, `InitTFAReq`, `CheckTFACode` | TFA state/code lifecycle | Session, Redis, Kavenegar, OTP templates | TFA use case |
+| `LookUpName` | resolve mobile/national ID/public key to recipient | direct SQL join of User/Identity | recipient lookup use case |
+| `FetchBasicUserInfoList` | list basic user identities for internal consumers | User, Identity | internal user-query use case |
+| `DeleteCache` | invalidate authorization/identity cache | Redis | cache management operation |
+| periodic identity validation | scheduled phone/national-ID and national-ID/birthdate refresh | User, Identity, Shahkar/person providers | scheduled identity-validation use case |
+
+The current composition root is `cmd/serve.go`; `repository.System` aggregates PostgreSQL, Redis, and upstream service ports, while `usecase.useCase` currently implements both generated gRPC server interfaces. External provider selection is configuration-driven (`ShahkarProvider`), and the Wallet/Notification clients are gRPC dependencies. This map is the baseline for A002–A008 package extraction.
+
+### `A002` — Auth domain entities and repository ports
+
+- Added `auth/domain/model` with transport/persistence-independent User, Identity, Session, Permission, Role, RolePermission, and BankInfo entities.
+- Added validated `NationalID`, `MobileNumber`, and `BirthDate` value objects plus domain-level user status values.
+- Added stable domain error vocabulary independent of gRPC status codes.
+- Added `auth/domain/ports` repository and cache interfaces using only standard library types and domain models.
+- Focused value-object/domain tests and the full Auth test suite pass; commits `32f182b` and `d292822`.
+- Existing `domain/db` remains the legacy persistence mapping until A003 introduces explicit infrastructure mappings.
+
+### `A003` — Auth persistence migration checkpoint
+
+- Added `auth/infrastructure/persistence` with explicit User and Identity mappings between legacy GORM records and the pure domain model.
+- Mapping validates domain value objects at the boundary and preserves timestamps, roles, public keys, identity validation timestamps, and birth-date representation.
+- Focused mapping tests and the full Auth test suite pass; commit `58f6a43`.
+- A003 remains in progress: PostgreSQL/Redis adapter ownership and use-case integration still need to move out of the legacy `repository/db` composition.
+- Added `auth/infrastructure/postgres` and `auth/infrastructure/redis` composition boundaries and switched `cmd/serve.go` to use them; the legacy adapters remain wrapped behind these boundaries pending per-repository port integration (`8ce3727`).
+- Added domain-port adapters for User, Identity, and Cache that translate legacy repository records at the infrastructure edge and satisfy `domain/ports`; mapping, full tests, and infrastructure vet pass in `7d9dd25`.
+- Added mappings and domain-port adapters for Session, Permission, Role, RolePermission, BankInfo, and OTPTemplate, completing the explicit persistence boundary coverage; full Auth tests pass in `e6e8e34`.
+- Relocated the concrete PostgreSQL and Redis implementations from `repository/db/*` into `infrastructure/postgres` and `infrastructure/redis`, removed the temporary forwarding wrappers and empty unreferenced Mongo placeholder, and confirmed no runtime imports of the legacy implementation paths remain. Full tests, race tests, vet, and build pass in `1323aa4`; A003 is complete.
+
+### `A004` — OTP application checkpoint
+
+- Extracted OTP code generation and the default expiration into the transport-independent `application/otp` package while preserving the existing disabled-code and six-digit behavior; focused and full Auth tests pass in `0c92b14`.
+- Extracted OTP template parameter decoding into the same application package and kept persistence JSON types at the infrastructure boundary; full Auth tests pass in `62fb1b1`.
+- Extracted the three-attempt retry and already-used verification policy into `application/otp`; the gRPC use-case retains compatible status/error mapping and full tests pass in `133fcc3`.
+- Added explicit OTP `Store` and `Sender` application contracts, isolating persistence and delivery concerns for the next adapter migration; full Auth tests pass in `8fbfcff`.
+- Added concrete infrastructure adapters for the Redis OTP store and Kavenegar sender while preserving existing key/TTL behavior; full Auth tests pass in `cde73ef`.
+- Wired the OTP adapters into runtime composition and generation, delivery, verification, and deletion paths while retaining compatibility fallback; full Auth tests pass in `c951875`.
+- Wired the OTP template repository port and adapter into runtime composition and TFA processing; legacy fallback remains for compatibility and full Auth tests pass in `741415b`.
+- Added thin Auth and internal Auth gRPC registration adapters and routed server registration through them; full Auth tests pass in `b56d54c`. A004 is complete; remaining legacy fallback removal is tracked under A008.
+
+### `A005` — authentication/JWT checkpoint
+
+- Extracted HTTP bearer-token normalization into `application/auth` and kept JWT verification/error mapping behavior unchanged; focused and full Auth tests pass in `1d72faa`.
+- Extracted refresh-token marker validation into `application/auth` while preserving refresh-flow behavior; full Auth tests pass in `4225332`.
+- Added access/refresh JWT verifier contracts and an infrastructure adapter delegating to the existing parser; full Auth tests pass in `ad6f5cc`. Runtime injection into all auth flows remains.
+- Injected the verifier into IAM and refresh-token flows through runtime composition, retaining fallback for compatibility; full Auth tests pass in `6c5b8cc`.
+- Extracted active/expiry session policy into `application/auth` with focused tests; integration into IAM/session retrieval remains for the next checkpoint (`424741c`).
+- Added a domain-session `SessionStore` contract, infrastructure adapter over the legacy cache/persistence composition, and runtime wiring for IAM retrieval; full Auth tests pass in `d744ffc`. The adapter deliberately preserves existing Redis-expiry semantics without activating stricter status checks during the refactor.
+- Routed login and refresh-session persistence through the same application boundary with legacy fallback retained; full Auth tests and vet pass in `c15bcff`.
+- Added a distinct persistent `BySubject` session lookup and routed refresh-token rotation through it, deliberately keeping it separate from access-token Redis lookup so refresh validity is not capped by access expiry; full Auth tests and vet pass in `016d705`. A005 is complete; compatibility fallback removal remains under A008.
+
+### `A006` — identity and permission checkpoint
+
+- Extracted case-insensitive route/method evaluation and privileged-role detection into `application/permission`, retaining development-mode bypass and existing gRPC error mapping; focused and full Auth tests pass in `9f97cec`.
+- Runtime-wired the permission repository adapter and routed permission initialization lookup/creation plus super-admin listing through the domain port, retaining legacy fallback; full Auth tests pass in `5b61adf`.
+- Added an application role-permission reader and infrastructure adapter over the existing Redis/Postgres cache-aside path, then routed standard-user permission reads through it; full Auth tests pass in `24722cb`.
+- Added an application identity store and infrastructure adapter over the existing identity cache/persistence composition, then routed identity reads/writes through pure domain mappings; full Auth tests pass in `113faef`.
+- Extracted identity request normalization/validation into `application/identity`, preserving Persian-digit conversion and existing validation behavior while leaving protobuf mutation at the interface boundary; full Auth tests pass in `2d5ab3d`.
+- Added identity ownership/person-verification application contracts and infrastructure adapters, runtime-wired both real and configured fake-provider paths, and preserved existing error mapping; full Auth tests and vet pass in `75c2e0d`. A006 is complete.
+
+### `A007` — explicit Auth composition
+
+- Replaced the eleven-argument positional constructor with a typed `Dependencies` graph assembled in `cmd/serve.go`, making OTP, JWT/session, permission, and identity infrastructure wiring explicit at bootstrap.
+- The legacy two-argument constructor remains only as an A008 compatibility shim; full Auth tests and vet pass in `7d7871b`. A007 is complete.
+
+### `A008` — Auth compatibility cleanup
+
+- Removed the legacy two-argument constructor and all nil-dependent fallback implementations superseded by the explicit OTP, JWT/session, permission, and identity dependency graph.
+- The remaining legacy repository methods are still active consumers for Auth operations outside the extracted paths and are therefore not dead/superseded code; full tests, race tests, and vet pass in `a9b11a3`. A008 and the Auth architecture phase are complete.
+- A006 remains in progress: permission repository wiring and identity application orchestration still need extraction.
+- A005 remains in progress: JWT validation, session checks, refresh-token flow, and broader authentication orchestration still need application ports and adapters.
+
 ### `I001` — publisher-backed ICO purchase map
 
 - Compatibility entrypoints remain `WalletService.CalcBuyAsset` and `WalletService.BuyAsset`; API routes and existing request fields do not move.
@@ -220,3 +335,165 @@ Global config removal remains the separate follow-up `C002`.
 - `BuyAsset` delegates the pinned agreement to market. Market creates a taker/buy order owned by the buyer and calls the same synchronous `settleOrder` operation used by market matching.
 - Existing market confirmation keeps asynchronous behavior, while the ICO endpoint waits for settlement so `BuyAssetRes.success` reflects the actual result and hashes can be returned when available.
 - Discounts are not applied to publisher orders: quote and settlement use the existing market-taker commission model, eliminating divergence between displayed and settled values.
+### `W001` — Wallet process and dependency migration map
+
+All six runtime modes currently call `cmd/helper.SetupRepository*`, which constructs PostgreSQL, Redis, internal/external service clients, the GL/Kuknos availability gate, the GL outbox dispatcher, the global Stellar client, and optional profiling. `wallet`, `market`, `alert`, and `internal_wallet` use safe/lazy peer connection; `cron` and `stream` use strict peer connection. This shared bootstrap is a primary W003/W010/W011 separation point.
+
+| Process / operation family | Current implementation | Persistence and cache | Queue / async | Internal and external dependencies | Stellar / availability |
+|---|---|---|---|---|---|
+| Wallet reads: health, assets/prices/commissions, networks, wallets/balances, transactions, BNPL, redeem/referral lists | `core/walletImp` (`health.go`, `asset.go`, `network.go`, `wallet.go`, `transaction.go`, `bnpl.go`, `redeem.go`, `commission.go`) | PostgreSQL Asset, Commission, Network, Wallet, Transaction, BNPL, Redeem, Federation, whitelist; repository cache helpers where invoked | None directly | Internal Authorization for identity/user data on selected operations | Availability gate for health; Stellar balance reads for synchronized wallet/balance operations |
+| Wallet initialization and federation | `UserInitWallet`, `GetOrInitWallet`, `SyncUserWalletBalance`, `UserCreateFederation`, `UserGetFederation`, `GetPublicKeyByNationalID` | PostgreSQL TX, Wallet, Asset, Federation, Transaction, whitelist | GL ledger outbox may be enqueued in transactional paths | Internal Authorization; system encryption/key derivation | Recover/generate keys, activate accounts, create trustlines, query balances; Kuknos/GL gate at RPC boundary |
+| Wallet transfers and locking | `InternalTransferAsset`, `ExternalTransferAsset`, `LockAsset`, release helpers, transaction tracking | PostgreSQL TX, Wallet, Transaction, LedgerOutbox | GL journals/events via transactional outbox | Authorization/InternalAuthorization for IAM/TFA/recipient resolution | Stellar balance, trustline checks, transfers, Horizon transaction tracking; availability interceptor |
+| Asset buy and contracts | `CalcBuyAsset`, `BuyAsset`, `GenerateBuyContract`, `DeclineBuyContract`, discount helpers | PostgreSQL TX, Asset, Wallet, Transaction, Contract, Discount, buy whitelist (legacy Sale references remain in code) | GL/transaction event outbox through transaction paths | Market RPC; Authorization for agreement/IAM checks | Settlement delegates to wallet/market transfer paths; availability interceptor |
+| IRT/IPG/accounting | `DepositIRT`, withdrawal init/confirm, `IPGGetToken`, `IPGConfirm`, `GetIPGLog` | PostgreSQL Accounting, WithdrawLog/IPGLog, Asset, Transaction, Wallet (legacy Sale references remain) | Notification calls are asynchronous at provider/RPC level; transaction/GL outboxes on financial paths | Authorization/InternalAuthorization, Notification, configured PSP (`Mellat`/`Vandar`), API gateway callback client | Stellar server/user transfers for IRT settlement; availability interceptor |
+| Redeem, commission, referral and BNPL mutations | Redeem calculation/settlement, commission collect/refund/claim, BNPL submit/update/cancel/payment generation | PostgreSQL TX, Redeem, Asset, Wallet, Transaction, Commission, Discount, BNPL; Redis distributed mutex for commission claims | GL/transaction event outbox where financial transaction helpers are used | Authorization/InternalAuthorization as required | Stellar transfers for redeem/commission settlement; availability interceptor |
+| Transaction-event pipeline (wallet process only) | `cmd/cmdServe/transaction_events.go`, `application/transactionevents` | PostgreSQL TransactionEventOutbox/Inbox/Deadbox and Transaction | Active RabbitMQ/Watermill publisher, subscriber, retry router, dispatcher; explicit startup/shutdown | Direct gRPC notifier to InternalAuthorization and Alert | Handler receives availability gate; financial event processing delegates to wallet service |
+| Market reads and order lifecycle | `core/marketImp/market.go`: lists/details/history, calculate/new/cancel order | PostgreSQL Market, Asset, Commission, Contract, Transaction, TX; Redis mutex for order settlement | No active legacy market AMQP consumer (commented out) | Authorization/InternalAuthorization, Wallet/InternalWallet, Notification | Key generation and two-leg Stellar asset/IRT settlement with refund path; availability interceptor |
+| ICO marketplace and market contracts | `core/marketImp/ico.go`, `contract.go`, `irt.go` | PostgreSQL Market, Contract, Asset | Uses wallet transaction/event mechanisms indirectly through internal RPCs | InternalAuthorization, Authorization, InternalWallet/Wallet | Settlement delegates to wallet and uses shared availability gate |
+| Alert | `core/alertImp.Emit` | No domain persistence | Per-request goroutine; email retry group and parallel SMS | SMTP mail adapter and Kavenegar SMS adapter | No Stellar/availability interceptor |
+| Internal-wallet RPC | Same `core/walletImp.walletSrv`, registered as `InternalWalletSrvServer` | Same PostgreSQL/Redis aggregates as invoked internal methods | Same GL/transaction outbox mechanisms | Primarily internal callers; Authorization/InternalAuthorization as operation requires | Same global Stellar client and availability interceptor |
+| Cron | `core/cronJobs`: vacuum expired transactions and expire stale market orders, hourly at minute 1 with retry | PostgreSQL Transaction and Market | robfig cron scheduler; no RabbitMQ | Strict initialization currently connects all peers even though jobs only require persistence/config | Shared setup unnecessarily starts availability monitor, GL dispatcher, and Stellar client; W010 must narrow this |
+| Stream | `port/stellar.StreamPayments` | Reads/writes through the full repository passed into streamer, including user/asset/transaction lookup paths | Horizon streaming callback loop; no RabbitMQ | Strict initialization currently connects all configured peers | Direct global Stellar/Horizon stream client; shared setup also starts availability/GL infrastructure |
+
+Repository ownership map for migration:
+
+- PostgreSQL adapters: Accounting/IPG/withdraw logs, Asset and buy/sell whitelists, Wallet, Federation, Transaction, TransactionEvent outbox/inbox/deadbox, LedgerOutbox, Discount, Commission, Contract/agreement, Redeem, BNPL, Network, Market, and transaction manager.
+- Redis adapter: JSON cache primitives, key scan/delete, pub/sub (currently no active core consumer found), and distributed mutexes used by market and commission operations.
+- Queue adapters: active RabbitMQ Watermill transaction-event bus plus PostgreSQL outbox/inbox/deadbox; the older market AMQP consumer is commented and must not be migrated as active behavior.
+- Internal gRPC peers: Wallet, InternalWallet, Market, Authorization, InternalAuthorization, Notification, API gateway callback, and GL ledger/health clients.
+- External adapters: SMTP, Kavenegar SMS, Mellat/Vandar PSP, Kuknos Horizon health, Horizon streaming, and Stellar account/trustline/balance/transfer operations.
+- Cross-cutting bootstrap: configuration, logger/APM/Prometheus/reflection, system cryptography, profiling, availability gate, GL dispatcher, Stellar global initialization, and graceful shutdown.
+
+Migration order implied by the map: isolate shared infrastructure constructors (W003), extract read-only wallet paths first (W004), then initialization/trustline (W005), financial transaction/event paths (W006), market/alert/internal RPCs (W007-W009), and finally give cron/stream minimal process-specific dependency graphs (W010) before the unified explicit composition cleanup (W011-W012).
+
+### `W002` — Wallet domain foundation
+
+- Added pure `domain/model` entities for Asset, Wallet, Federation, Network, Transaction, MarketOrder, Commission, Redeem, Accounting, and BNPL, using the existing exact fixed-point `money.Amount` value object rather than protobuf numeric fields.
+- Added domain-owned status/side types, filters, AssetCode/TrackingCode normalization, wallet available-balance behavior, and focused tests.
+- Added transport-independent domain errors and inward-facing repository, cache/lock, unit-of-work, blockchain, identity, notification, payment-gateway, and event-publisher ports.
+- Verified the new packages contain no generated stub, GORM, repository, infrastructure, or database imports. Focused tests/vet and the full Wallet test suite pass in `ac649d2`; W002 is complete.
+
+### `W003` — infrastructure adapter migration checkpoint
+
+- Relocated every Wallet PostgreSQL repository implementation and its tests from `repository/db/postgres` to `infrastructure/postgres`, and every Redis implementation/test from `repository/db/redis` to `infrastructure/redis`.
+- Updated `cmd/helper` to construct the infrastructure-owned adapters; no runtime import of the old PostgreSQL/Redis implementation paths remains. Full Wallet tests pass in `d2580cd`.
+- RabbitMQ/Watermill was already under `infrastructure/eventbus`; external service clients now live under `infrastructure/service` (Darano, Kavenegar, Mellat, and Vandar), and Stellar/Horizon operations now live under `infrastructure/stellar`.
+- Wallet, market, stream, and bootstrap call sites no longer import legacy implementation paths under `repository/db`, `repository/service`, or `port/stellar`. Temporary/non-Go artifacts left under the old service directory are not runtime implementations.
+- Full Wallet tests, race tests, vet, and build pass after the migration (`d121fc9`); W003 is complete.
+
+### `W004` — read-only wallet application boundary checkpoint
+
+- Added `application/walletread`, with transport-independent catalog, commission, network, and balance reader ports and use-case methods.
+- gRPC methods for asset list/get, asset commissions, asset price, network list, health, balance, and check-balance now delegate through the application boundary; protobuf conversion and existing error mapping remain in `core/walletImp`.
+- Transaction-list querying and blockchain balance reads now delegate through the application reader as well. Wallet listing consumes the application catalog; its database synchronization remains an explicit mutation in the service and is deferred to later wallet work. Full Wallet tests pass in `5b17c82`; W004 is complete.
+
+### `W005` — wallet initialization boundary checkpoint
+
+- Added `application/walletinit` for the identity precondition and exact Stellar trustline-limit policy.
+- `UserInitWallet` delegates those rules and the key-recovery/trustline adapter while retaining the existing database transaction, wallet creation, transaction recording, and rollback behavior.
+- Wallet-code generation is also application-owned and tested. Full Wallet tests pass in `c09fdf8`; orchestration extraction remains in progress.
+- Wallet draft construction (user, asset, federation, code, and timestamps) is application-owned and tested; repository lookup/insertion remains at the service boundary. Full Wallet tests pass in `28d0846`; orchestration extraction remains in progress.
+- Repository-backed wallet/federation find-or-create orchestration is now application-owned with injected repositories and federation creation callback; `UserInitWallet` delegates it while retaining transaction scope. Full Wallet tests pass in `63d4d52`; transaction recording and rollback policy extraction remains.
+- Trustline transaction construction is now application-owned and tested; the service still performs the insert and rollback decisions at the transaction boundary. Full Wallet tests pass in `1999ec0`; rollback policy extraction remains.
+- `UserInitWallet` now uses named-return transaction finalization: successful execution commits, while any returned error rolls back (including failures after key recovery or trustline submission). Full Wallet tests pass in `4e4f2af`; broader integration coverage remains before W005 completion.
+- Commit-on-success and rollback-on-error behavior is covered by focused application tests in addition to the service wiring. Full Wallet tests pass in `3bc9591`; broader integration coverage remains before W005 completion.
+- Existing-wallet and federation-create wallet paths are covered with repository fakes, alongside transaction finalization tests. Full Wallet tests pass in `15200dc`; broader integration coverage remains before W005 completion.
+
+### Federation removal investigation (`A009` / `W013`)
+
+- Federation is not currently safe to delete outright: wallet persistence links `wallet.federation_id`, transaction records expose nullable `from_federation_id`/`to_federation_id`, generated wallet APIs expose federation messages, and wallet code still has federation lookup/creation paths.
+- Auth has no active federation implementation; its wallet federation client is commented/dead code. Auth’s identity service should remain the owner of identity and national-ID data.
+- The proposed target is reasonable only after consumers are migrated: `user_id → identity_id → wallet_id`, with `wallet_id` still scoped to `asset_id` and Stellar key derivation/custody explicitly preserved. W013 must first identify whether federation addresses or transaction routing are actually supported in production, then remove or retain the model based on evidence and a data/API compatibility plan.
+- Per the requested migration, federation is fully removed from active Wallet/Auth/API code and the shared wallet protobuf: no federation creation/lookup, persistence adapter/model, wallet field, transaction field/filter, generated message, stale API route, or runtime reference remains. New wallet creation uses user/asset identity; wallet records remain asset-scoped. Wallet/Auth/API contracts were regenerated and all service tests pass. The database must be migrated separately to drop legacy federation columns/tables in deployed environments.
+
+### `W006` — deposit/withdrawal/transaction boundary checkpoint
+
+- Added `application/withdrawal` with the IRT amount reconciliation policy and focused tests for the one-unit balance threshold.
+- `WithdrawIRTInit` continues to own the gRPC/payment flow but delegates amount policy through the application package; full Wallet tests pass in `16ebd2d`.
+- IPG Toman/Rial conversion, positivity, rounding, and exactness checks now live in `application/deposit`; the gRPC/payment flow delegates through wrappers and remains response-compatible. Full Wallet tests pass in `a565ce0`.
+- Transfer display-to-raw amount conversion and positive/exactness validation now live in `application/transfer`; the gRPC service retains protocol-specific error mapping. Full Wallet tests pass in `1e5b977`.
+- Settled IPG deposits now use `application/deposit.RawSettlementAmount` for Rial→Toman→raw conversion, retaining exactness checks before Stellar transfer. Full Wallet tests pass in `08c2d7b`.
+- Transaction status-update construction now lives in `application/transaction`; Stellar polling remains at the infrastructure-facing service while persistence update shape is application-owned. Full Wallet tests pass in `7941966`.
+- Transaction-event type support is centralized in `application/transactionevents`, removing the duplicate wallet-server policy. Full Wallet tests pass in `4d03adb`.
+- IPG payer-ID derivation is now application-owned with short/invalid input protection and deterministic tests; the gRPC service delegates through a compatibility wrapper. Full Wallet tests pass in `f12752d`.
+- Pending IRT deposit and withdrawal transaction-record construction is now application-owned and tested; persistence insertion remains at the gRPC/service boundary. Full Wallet tests pass in `0efc199`.
+- Pending internal and external transfer transaction-record construction is now application-owned and tested; repository insertion and transfer execution remain at the gRPC/service boundary. Full Wallet tests pass in `98753f7`.
+- The active IRT deposit creation path now also uses the shared `application/transaction.PendingDeposit` policy; repository insertion and IPG orchestration remain at the service boundary. Focused Wallet tests pass in `b009837`.
+- Successful commission and referral-commission transaction records now use the shared `application/transaction.SuccessfulTransfer` policy; Stellar execution and repository insertion remain at the service boundary. Full Wallet tests pass in `a4717d9`.
+- IPG settlement success updates now use the shared `application/transaction.SettlementUpdate` policy for hash, status, and settled amount; repository update and external transfer remain at the service boundary. Focused Wallet tests pass in `f9b3c46`.
+- IRT dev-mode completion updates now use the shared `application/transaction.HashStatusUpdate` policy; insert-vs-update branching and repository persistence remain at the service boundary. Focused Wallet tests pass in `926ea23`.
+- IRT dev-mode successful-deposit creation now uses the shared `application/transaction.SuccessfulDeposit` policy; insert error handling and completion orchestration remain at the service boundary. Focused Wallet tests pass in `89027b4`.
+- Redeem transaction creation now uses the shared `application/transaction.PendingRedeem` policy; repository insertion and Stellar transfer orchestration remain at the service boundary. Focused Wallet tests pass in `e8fa40d`.
+- Redeem completion status/hash/error updates now use the shared `application/transaction.CompletionUpdate` policy; repository update and transfer error orchestration remain at the service boundary. Focused Wallet tests pass in `af880c5`.
+- Transaction-list balance-change classification now uses the shared `application/transaction.BalanceChange` policy with focused coverage for increases, decreases, and non-balance transaction types. Full Wallet tests pass in `ca7ae43`.
+- Internal transfer and sell insufficient-balance transitions now use the shared `application/transaction.FailureUpdate` policy; atomic wallet/transaction persistence and rollback behavior remain unchanged. Focused Wallet tests pass in `d10ff42`.
+- Internal transaction consumers now acquire distinct sender/recipient wallet locks through deterministic `application/transaction.LockUserIDs` ordering, preventing reverse-transfer lock-order deadlocks. Focused Wallet tests pass in `a43a758`.
+- Transaction persistence atomically enqueues ledger and transaction-event outbox records; deterministic idempotency keys, duplicate/conflict handling, retry claims, and dead-letter behavior are implemented and covered by infrastructure/application tests. Remaining W006 work is balance coordination and business-level failure/refund orchestration in deposit, withdrawal, transfer, and redeem flows.
+
+### `W007` — market boundary checkpoint
+
+- ICO agreement amount tolerance is now application-owned in `application/market.AgreementAmountMatches`, using the existing fixed-point money type and preserving the 0.5-unit tolerance. The market gRPC package delegates through a compatibility wrapper; focused market tests pass in `3d9e1af`.
+- Pricing, order lifecycle, settlement, contract generation, and external adapter composition remain for subsequent W007 increments.
+- ICO available-amount validation now uses `application/market.ValidateAvailableAmount` with application-level sentinel errors mapped to existing gRPC error codes by the market adapter. Focused market tests pass in `bbb3443`.
+- Market display-to-raw amount conversion now uses `application/market.RawAmount`, preserving exact fixed-point conversion and positive-amount checks. Focused market tests pass in `d217623`.
+- Market pricing arithmetic now uses typed `application/market.CalculationInput`/`CalculationResult`; the gRPC adapter maps commission persistence values and protobuf fields at the boundary. Existing maker/taker and base/asset side behavior is covered by focused market tests in `e21ecf2`.
+- Market order amount and maker unit-price positivity checks now use `application/market.PositiveAmount`, with existing zero-amount gRPC mapping retained. Focused market tests pass in `192dff4`.
+- Market order status-to-error-code policy now uses `application/market.OrderStatusCode`; the adapter retains existing `allowed` metadata formatting. Focused market tests pass in `9f70b21`.
+- ICO publisher role/participant/side/counter-asset validation now uses `application/market.ValidatePublisherICO`, with existing access-denied and invalid-argument mappings retained. Focused market tests pass in `4ea1f5a`.
+- Market settlement now synchronously acquires the stream transaction-hash mutex; the previous goroutine lock returned immediately and did not serialize settlement against stream processing. Focused market tests pass in `3004bb9`.
+
+### `W008` — alert boundary checkpoint
+
+- Alert level and source presentation labels now use `application/alert.LevelLabel` and `SourceLabel`; asynchronous email/SMS delivery, five-retry behavior, and error propagation remain at the alert adapter. Focused Wallet tests pass in `085cb25`.
+- Alert subject formatting now uses `application/alert.Subject`, preserving timestamp and localized level/source labels while delivery remains adapter-owned. Focused Wallet tests pass in `be29c11`.
+- Alert `Emit` now rejects nil events synchronously instead of panicking in its delivery goroutine; valid event delivery behavior is unchanged. Focused alert tests pass in `4fc4726`.
+- Alert `Emit` now also rejects events without IAM/user data before starting the delivery goroutine, preventing nil dereferences. Focused alert tests pass in `b3e1dbc`.
+
+### `W010` — cron/stream bootstrap checkpoint
+
+- Cron retry behavior now uses `application/cron.Retry`; scheduler registration, skip/recover middleware, and job dependencies remain in `core/cronJobs`. Focused Wallet tests pass in `8e27342`.
+- Stellar payment stream lookup classification now uses `application/stream.IsNew`, preserving not-found and invalid empty-result behavior while keeping Horizon/database access in infrastructure. Focused Wallet tests pass in `6c3243c`.
+- Cron command now uses `SetupCronRepository`, avoiding unnecessary strict service peers, availability monitor, Stellar client, profiling server, and ledger dispatcher initialization; cron jobs receive only PostgreSQL-backed repository dependencies. Focused command tests pass in `08f3225`.
+- Stellar stream external-deposit transaction construction now uses `application/transaction.SuccessfulExternalDeposit`; network parsing, deduplication, locking, and repository insertion remain infrastructure-owned. Focused stream/transaction tests pass in `61768e7`.
+- Stream command now uses a dedicated setup path that retains required service/Redis/availability/Stellar dependencies while skipping the ledger dispatcher and profiling server; shared repository setup is option-driven for later process composition. Command tests pass in `db52f89`.
+
+### `W009` — internal-wallet boundary checkpoint
+
+- Lock/release balance mutation policy now uses `application/walletlock.Lock` and `Release`, preserving available/frozen balance rules while keeping transaction scope, ledger journal creation, persistence, and gRPC error mapping in `core/walletImp`. Focused Wallet tests pass in `382fd79`.
+
+### `W011` — explicit process composition checkpoint
+
+- Alert command now uses `SetupAlertRepository`, which initializes only lazy service clients required for mail/SMS delivery and no longer starts PostgreSQL, Redis, availability, Stellar, ledger-dispatch, or profiling infrastructure. Command tests pass in `da074f9`.
+- Market command now uses `SetupMarketRepository`, retaining PostgreSQL/Redis/services/availability/Stellar while skipping ledger-dispatch and profiling startup. Command and market tests pass in `0132734`.
+- Internal-wallet command now uses `SetupInternalWalletRepository`, retaining PostgreSQL/Redis/services/Stellar while skipping availability, ledger-dispatch, and profiling startup. Command and wallet tests pass in `f46df4c`.
+- Main wallet command now uses the explicit `SetupWalletRepository` entry point for its full dependency profile, completing named setup entry points for all five service modes. Command and wallet tests pass in `cf13a58`.
+
+### `W012` — superseded implementation cleanup checkpoint
+
+- Removed the now-redundant `core/marketImp/amount.go` shim and routed market settlement directly to `application/market.RawAmount`; focused market tests pass in `085140c`.
+- Removed the redundant `agreementAmountMatches` wrapper and routed ICO agreement checks/tests directly to `application/market.AgreementAmountMatches`; focused market tests pass in `261c6a1`.
+- Removed the redundant `core/walletImp/ipg_amount.go` shim and routed IPG Toman/Rial conversion callers/tests directly to `application/deposit`; focused Wallet tests pass in `1493486`.
+- Removed the redundant `nationalIdToPayerID` wrapper and routed IPG payer-ID generation directly to `application/deposit.PayerID`; focused Wallet tests pass in `c710cdc`.
+- Discount amount calculation (percentage + static amount with max cap) now uses `application/discount.CalculateAmount`; wallet callers/tests route directly to the application policy. Focused Wallet tests pass in `ccff76e`.
+- Referral commission splitting and claimed/unclaimed aggregation now use `application/referral`; the old `core/walletImp` arithmetic implementation was removed and callers/tests route directly to application policies. Focused Wallet tests pass in `37612bf`.
+- Redeem lot reconstruction, FIFO allocation, and ceiling-day profit calculation now use `application/redeem`; the old core implementation and internal result types were removed, with service/tests adapted to exported application allocations. Focused Wallet tests pass in `bd8d07d`.
+- Contract percentage rounding now uses `application/contract.RoundTo`; duplicate wallet/market helpers were removed. Focused contract, wallet, and market tests pass in `ab4091e`.
+- Agreement identifier derivation now uses the deterministic `application/contract.AgreementID` policy for both ICO and market contracts; duplicate service implementations were removed. Focused contract, wallet, and market tests pass in `dc0bdf4`.
+
+### `W005` initialization checkpoint
+
+- Wallet initialization now propagates transaction commit failures through the application `FinalizeTransaction` policy instead of silently discarding them; focused wallet-init and wallet service tests pass in `f9a0262`.
+
+### `W006` transaction boundary checkpoint
+
+- Internal transaction event processing now rejects nil/invalid event IDs before repository access and explicitly rolls back when an unsupported transaction type is received; focused wallet transaction tests pass in `66d271e`.
+
+### `W009` internal-wallet boundary checkpoint
+
+- Lock and release RPC handlers now reject nil or incomplete IAM requests before dereferencing user fields; focused wallet lock tests pass in `36b4d67`.
+- Successful lock and release operations now return an explicit `StatusRes{Success:true}` instead of a nil response; focused wallet lock tests pass in `0920702`.
+
+### `W010` cron boundary checkpoint
+
+- Cron retry execution now emits error telemetry only when a job ultimately fails, avoiding nil error logs on successful runs; focused cron tests pass in `ba14ce1`.
+- Cron registration now reads a configurable `Cron.Schedule` value, retaining `1 * * * *` as the default; config and cron tests pass in `5f37e56`.

REFACTORING-TODO.md

@@ -42,9 +42,9 @@ This is the authoritative execution tracker for the refactor. Work is performed
 | C001 | `DONE` | Refactor `auth` config loading into `infrastructure/config`. | Koanf loader/facade tests, race tests, generation, full tests, and build pass; committed as `29b7e07`. |
 | C002 | `DONE` | Replace `auth` global config reads with constructor injection. | No global/legacy reads remain; tests, race tests, generation, tidy, and build pass; committed as `1bd5559`. |
 | C003 | `DONE` | Refactor `wallet` config loading into `infrastructure/config`. | Fig defaults and all five configs verified; tests/race/build pass; committed as `7958530`. |
-| C004 | `CHANGED` | Replace `wallet` global config reads with constructor injection. | Priority changed by the GL requirement after dependency inventory; resume as a new tracked task after the ledger adapter boundary stabilizes. |
+| C004 | `DONE` | Replace `wallet` global config reads with constructor injection. | Config is injected through commands, services, repositories, use cases, adapters, cron, logger, and Stellar; the legacy facade is removed; full tests/race/vet/build pass; completed in the series ending at `4d192a6`. |
-| C005 | `TODO` | Move `api` config loading into `infrastructure/config`. | Koanf behavior and baked-in defaults remain compatible. |
+| C005 | `DONE` | Move `api` config loading into `infrastructure/config`. | Pure koanf/TOML loading and baked-in defaults are preserved under `infrastructure/config`; loader tests pass; completed in `44d56d3`. |
-| C006 | `TODO` | Replace `api` global config reads with constructor injection. | Server, middleware, Swagger, profiling, and clients receive explicit config. |
+| C006 | `DONE` | Replace `api` global config reads with constructor injection. | Command, logger, middleware, handlers, services, Swagger, profiling, and clients receive explicit config; no legacy global reads/imports remain; tests/race/vet/build pass; completed in `44d56d3`. |
 
 ## Priority workstream — General Ledger (`GL`)
 
@@ -58,8 +58,8 @@ This is the authoritative execution tracker for the refactor. Work is performed
 | L006 | `DONE` | Add a wallet-owned ledger port and GL gRPC adapter. | Wallet owns transport-neutral journal/event types; adapter maps them to generated GL messages with deadlines/TLS options and tests; committed as `9d91f8f`. |
 | L007 | `DONE` | Add a durable wallet outbox for ledger delivery. | Transactional enqueue, locked claiming, stale recovery, retry/backoff, quarantine/replay, dispatcher, and commit/rollback tests pass; committed as `379dbc2`. |
 | L008 | `CHANGED` | Integrate ledger recording into every wallet transaction path. | Scope split after implementation: all Wallet-owned deposit, withdrawal, transfer, buy, redeem, commission, market, IPG, stream, lock/release, and lifecycle paths are mapped and dispatched (`ff31c87`, `d1aa339`); AdminPanel direct writes remain under `P006`/`P008`. |
-| L009 | `TODO` | Implement reconciliation and disaster-read tooling. | Missing/duplicate/mismatched blockchain records are detectable; ledger can reconstruct account/asset balances deterministically. |
+| L009 | `DONE` | Implement reconciliation and disaster-read tooling. | Read-only journal integrity scans, external settlement evidence comparison, duplicate detection, account/balance reconstruction, and explorer reads are implemented and tested; commits `3f5fd86`, `b14c5e2`, and `d5c9b33`. |
-| L010 | `TODO` | Run outage, replay, ordering, concurrency, and recovery verification. | No committed wallet transaction is lost; duplicates do not double-post; unbalanced journals never commit. |
+| L010 | `DONE` | Run outage, replay, ordering, concurrency, and recovery verification. | Replay/idempotency, rollback, ordering, conservation, concurrent load scenarios, and recovery behavior are covered by GL tests/load tests; full tests/race/vet/build pass. |
 
 ## Priority workstream — Publisher-backed ICO purchases
 
@@ -104,31 +104,33 @@ This is the authoritative execution tracker for the refactor. Work is performed
 
 | ID | Status | Task | Acceptance check / note |
 |---|---|---|---|
-| A001 | `TODO` | Map every auth RPC to business operations and dependencies. | Method-level migration map exists before package moves. |
+| A001 | `DONE` | Map every auth RPC to business operations and dependencies. | Method-level migration map is recorded in `REFACTORING-AUDIT.md`; completed on `2026-08-30`. |
-| A002 | `TODO` | Introduce auth domain entities, value objects, errors, and repository ports. | Domain packages contain no gRPC, GORM, Redis, or framework imports. |
+| A002 | `DONE` | Introduce auth domain entities, value objects, errors, and repository ports. | Added pure Auth entities/value objects, domain errors, and inward-facing repository/cache ports with no gRPC, GORM, Redis, or framework imports; committed as `32f182b`/`d292822`. |
-| A003 | `TODO` | Move auth persistence and Redis implementations into infrastructure. | Explicit persistence/domain mappings exist and repository tests pass. |
+| A003 | `DONE` | Move auth persistence and Redis implementations into infrastructure. | PostgreSQL and Redis implementations now live directly under `infrastructure`; legacy implementation packages and the unused Mongo placeholder are removed; full tests/race/vet/build pass. |
-| A004 | `TODO` | Extract OTP application use cases and thin gRPC adapters. | OTP behavior and status mapping remain compatible. |
+| A004 | `DONE` | Extract OTP application use cases and thin gRPC adapters. | OTP primitives, persistence/provider adapters, runtime/template wiring, and thin gRPC registration adapters are in place; full Auth tests pass. |
-| A005 | `TODO` | Extract authentication/JWT application use cases and adapters. | Token behavior, validation, and status mapping remain compatible. |
+| A005 | `DONE` | Extract authentication/JWT application use cases and adapters. | Token policies, JWT verification, cached/persistent session reads, and session writes are extracted and runtime-wired while preserving access/refresh expiry semantics. |
-| A006 | `TODO` | Extract identity and permission use cases and adapters. | Public and internal authorization services pass tests. |
+| A006 | `DONE` | Extract identity and permission use cases and adapters. | Permission policy/read paths and identity storage, validation, and external verification boundaries are extracted/runtime-wired; full tests and vet pass. |
-| A007 | `TODO` | Replace auth bootstrap with explicit dependency composition. | Dependency direction is enforced and the service builds. |
+| A007 | `DONE` | Replace auth bootstrap with explicit dependency composition. | Auth bootstrap constructs a typed dependency graph for OTP, JWT/session, permission, and identity boundaries; full tests and vet pass. |
-| A008 | `TODO` | Remove superseded auth packages and compatibility shims. | No dead imports or duplicate implementations remain. |
+| A008 | `DONE` | Remove superseded auth packages and compatibility shims. | Removed the legacy constructor and all runtime nil/fallback branches superseded by explicit OTP, JWT/session, permission, and identity dependencies; full tests/race/vet pass. |
+| A009 | `DONE` | Audit and remove auth-side federation coupling. | Confirmed federation has no live Auth responsibility and removed the commented/dead wallet federation client; identity remains the owner of identity and national-ID data. |
 
 ## Phase 3 — `wallet` architecture
 
 | ID | Status | Task | Acceptance check / note |
 |---|---|---|---|
-| W001 | `TODO` | Map wallet, market, alert, internal-wallet, cron, stream, DB, Redis, queue, and Stellar dependencies. | Method/process-level migration map exists. |
+| W001 | `DONE` | Map wallet, market, alert, internal-wallet, cron, stream, DB, Redis, queue, and Stellar dependencies. | Process/operation-family map, repository ownership, active queue topology, peer/provider dependencies, Stellar coupling, and migration order are recorded in `REFACTORING-AUDIT.md`. |
-| W002 | `TODO` | Introduce wallet domain entities, value objects, errors, and repository ports. | Domain packages have no transport or infrastructure dependencies. |
+| W002 | `DONE` | Introduce wallet domain entities, value objects, errors, and repository ports. | Added transport/persistence-independent wallet entities, filters, value objects, domain errors, repositories, cache/UoW, blockchain, identity, notification, PSP, and event ports; focused/full tests and focused vet pass. |
-| W003 | `TODO` | Move PostgreSQL, Redis, RabbitMQ, external client, and Stellar adapters into infrastructure. | Existing behavior remains available behind inward-facing ports. |
+| W003 | `DONE` | Move PostgreSQL, Redis, RabbitMQ, external client, and Stellar adapters into infrastructure. | PostgreSQL/Redis, RabbitMQ Watermill, external service, and Stellar/Horizon implementations are infrastructure-owned; legacy implementation imports are removed; full tests, race tests, vet, and build pass. |
-| W004 | `TODO` | Extract read-only wallet use cases and gRPC adapters. | Responses and error mapping remain compatible. |
+| W004 | `DONE` | Extract read-only wallet use cases and gRPC adapters. | Asset, commission, network, price, health, balance, check-balance, transaction-list, asset-catalog, and blockchain-balance reads delegate through `application/walletread`; protobuf conversion and error mapping remain compatible. Wallet-balance synchronization is an explicit mutation deferred to later wallet work. |
-| W005 | `TODO` | Extract wallet initialization and asset/trustline use cases. | Transactions, key generation, trustlines, and rollback behavior are tested. |
+| W005 | `STARTED` | Extract wallet initialization and asset/trustline use cases. | Initialization preconditions and trustline-limit policy now use `application/walletinit`; transaction, key-generation, trustline, and rollback orchestration remains in progress. |
-| W006 | `TODO` | Extract deposit, withdrawal, and transaction use cases. | Idempotency, balances, queues, and failure behavior are tested. |
+| W006 | `STARTED` | Extract deposit, withdrawal, and transaction use cases. | Deposit, withdrawal, transfer, and transaction policies use application packages; transaction persistence and outbox/idempotency infrastructure are in place, while balance coordination and business failure behavior remain in progress. |
-| W007 | `TODO` | Extract market use cases and adapters. | Pricing and market operations remain compatible. |
+| W007 | `STARTED` | Extract market use cases and adapters. | Agreement amount tolerance now uses `application/market`; pricing, order lifecycle, settlement, and adapter boundaries remain. |
-| W008 | `TODO` | Extract alert use cases and adapters. | Alert persistence, delivery, and error behavior remain compatible. |
+| W008 | `STARTED` | Extract alert use cases and adapters. | Alert level/source presentation now uses `application/alert`; delivery, retry, persistence, and adapter boundaries remain. |
-| W009 | `TODO` | Extract internal-wallet use cases and adapters. | Internal RPC contracts remain compatible. |
+| W009 | `STARTED` | Extract internal-wallet use cases and adapters. | Lock/release balance mutation policy now uses `application/walletlock`; transaction, ledger, persistence, and RPC adapter boundaries remain. |
-| W010 | `TODO` | Separate cron and stream bootstrap from business operations. | Both modes start and stop correctly through explicit dependencies. |
+| W010 | `STARTED` | Separate cron and stream bootstrap from business operations. | Cron and stream now have dedicated repository setup paths; cron uses PostgreSQL only and stream skips ledger-dispatcher/profiling startup. Remaining process composition work remains. |
-| W011 | `TODO` | Replace wallet bootstrap with explicit dependency composition. | All five sub-services work independently and together. |
+| W011 | `STARTED` | Replace wallet bootstrap with explicit dependency composition. | All five service modes have named setup paths; dependency internals and superseded bootstrap cleanup remain. |
-| W012 | `TODO` | Remove superseded `core/*Imp` packages and shims. | No duplicate business implementations remain. |
+| W012 | `STARTED` | Remove superseded `core/*Imp` packages and shims. | Removed the superseded market raw-amount shim; broader duplicate implementation cleanup remains. |
+| W013 | `DONE` | Remove redundant wallet federation creation/model. | Removed federation creation and lookup, wallet federation fields, federation persistence/repository adapters, transaction federation fields/filters, federation protobuf messages, and API documentation/routes. Wallet/Auth/API contracts regenerate and tests pass. |
 
 ## Phase 4 — `api` architecture
 
@@ -273,3 +275,60 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-15 | T008 | `STARTED` | `DONE` | GL built successfully as `darano-gl:go1.26`; API/Auth/Wallet independently reproduced Darano registry gateway timeouts before compilation, with no proxy fallback or source changes introduced. |
 | 2026-08-15 | T009 | `TODO` | `STARTED` | Began adapting the established Go-service Gitea actions and three environment workflows for GL. |
 | 2026-08-15 | T009 | `STARTED` | `DONE` | Added local build/login/deploy/notify actions plus main/dev/stage workflows; YAML parsing and the exact cached buildx command pass; committed in GL as `675def5`. |
+| 2026-08-30 | C004 | `CHANGED` | `STARTED` | Resumed Wallet constructor injection after the GL adapter boundary stabilized. |
+| 2026-08-30 | C004 | `STARTED` | `DONE` | Removed all active global config reads and the legacy facade; injected configuration through every runtime boundary; full tests/race/vet/build pass in the commit series ending at `4d192a6`. |
+| 2026-08-30 | C005 | `TODO` | `STARTED` | Began API configuration ownership migration. |
+| 2026-08-30 | C005 | `STARTED` | `DONE` | Moved the pure koanf/TOML loader and compatibility-preserving defaults to `api/infrastructure/config`; loader and full verification pass in `44d56d3`. |
+| 2026-08-30 | C006 | `TODO` | `STARTED` | Began API global configuration dependency migration. |
+| 2026-08-30 | C006 | `STARTED` | `DONE` | Removed the API `Cfg` singleton and legacy config package; injected configuration through runtime boundaries; full tests/race/vet/build pass in `44d56d3`. |
+| 2026-08-30 | L009 | `TODO` | `STARTED` | Began GL reconciliation and disaster-read completion review. |
+| 2026-08-30 | L009 | `STARTED` | `DONE` | Verified read-only reconciliation, external evidence comparison, duplicate detection, explorer balance reconstruction, and focused tests; implementation commits are `3f5fd86`, `b14c5e2`, and `d5c9b33`. |
+| 2026-08-30 | L010 | `TODO` | `STARTED` | Began GL outage, replay, ordering, concurrency, and recovery verification. |
+| 2026-08-30 | L010 | `STARTED` | `DONE` | Full GL tests, race tests, vet, and build pass; replay/idempotency, rollback, conservation/load, ordering, and recovery paths are covered. |
+| 2026-08-30 | A001 | `TODO` | `STARTED` | Began the method-level Auth RPC and dependency migration map before package moves. |
+| 2026-08-30 | A001 | `STARTED` | `DONE` | Mapped every public/internal RPC to its use-case operation, persistence ports, external providers, cache, wallet, notification, and configuration dependencies in `REFACTORING-AUDIT.md`. |
+| 2026-08-30 | A002 | `TODO` | `STARTED` | Began the pure Auth domain model and port foundation. |
+| 2026-08-30 | A002 | `STARTED` | `DONE` | Added transport/persistence-independent entities, NationalID/Mobile/BirthDate value objects, domain errors, and repository/cache ports; focused and full Auth tests pass in `32f182b`/`d292822`. |
+| 2026-08-30 | A003 | `TODO` | `STARTED` | Added infrastructure persistence mappings between legacy database records and the new Auth domain entities; mapping tests and full Auth tests pass in `58f6a43`. |
+| 2026-08-30 | A003 | `STARTED` | `STARTED` | Added remaining persistence mappings and domain-port adapters for sessions, permissions, roles, role-permissions, bank information, and OTP templates; full Auth tests pass in `e6e8e34`. Legacy repository implementations still require relocation/integration. |
+| 2026-08-30 | A004 | `TODO` | `STARTED` | Extracted OTP code generation and expiration constant into `application/otp`, retained compatible use-case behavior, and added focused tests in `0c92b14`. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Extracted OTP template parameter decoding into `application/otp`; full Auth tests pass in `62fb1b1`. Legacy template lookup and delivery composition remain. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Extracted OTP retry/verification policy into `application/otp`; full Auth tests pass in `133fcc3`. Legacy persistence and gRPC composition remain. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Added transport-independent OTP store and sender contracts in `application/otp`; full Auth tests pass in `8fbfcff`. Concrete Redis/provider adapters remain. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Added concrete Redis-backed OTP store and Kavenegar sender adapters under `infrastructure/otp`; full Auth tests pass in `cde73ef`. Runtime wiring and gRPC adapter extraction remain. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Wired OTP store/sender adapters into Auth runtime and use-case paths with legacy fallback retained; full Auth tests pass in `c951875`. |
+| 2026-08-30 | A004 | `STARTED` | `STARTED` | Wired the OTP template repository port and infrastructure adapter into runtime composition and TFA processing; full Auth tests pass in `741415b`. |
+| 2026-08-30 | A004 | `STARTED` | `DONE` | Added thin gRPC registration adapters and routed Auth service registration through them; full Auth tests pass in `b56d54c`. |
+| 2026-08-30 | A005 | `TODO` | `STARTED` | Extracted bearer-token normalization into `application/auth`; full Auth tests pass in `1d72faa`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Extracted refresh-token marker validation into `application/auth`; full Auth tests pass in `4225332`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Added application JWT verifier contract and infrastructure adapter for access/refresh claims; full Auth tests pass in `ad6f5cc`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Injected the JWT verifier into IAM and refresh-token flows with compatibility fallback; full Auth tests pass in `6c5b8cc`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Extracted active/expiry session policy into `application/auth`; focused and full Auth tests pass in `424741c`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Added and runtime-wired the authentication session-store boundary for IAM retrieval while preserving Redis-expiry behavior; full Auth tests pass in `d744ffc`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Routed login and refresh session writes through the authentication session-store boundary with compatibility fallback; full Auth tests and vet pass in `c15bcff`. |
+| 2026-08-30 | A005 | `STARTED` | `DONE` | Routed refresh lookup through the persistent session boundary (distinct from access-session cache lookup); full Auth tests and vet pass in `016d705`. |
+| 2026-08-30 | A006 | `TODO` | `STARTED` | Extracted case-insensitive route/method and privileged-role permission policy into `application/permission`; full Auth tests pass in `9f97cec`. |
+| 2026-08-30 | A006 | `STARTED` | `STARTED` | Runtime-wired the permission repository port for route lookup/creation and super-admin permission listing; full Auth tests pass in `5b61adf`. |
+| 2026-08-30 | A006 | `STARTED` | `STARTED` | Added and runtime-wired a role-permission reader preserving the existing Redis/Postgres behavior; full Auth tests pass in `24722cb`. |
+| 2026-08-30 | A006 | `STARTED` | `STARTED` | Added and runtime-wired an identity store over existing cache/persistence behavior, routing identity reads and writes through pure domain models; full Auth tests pass in `113faef`. |
+| 2026-08-30 | A006 | `STARTED` | `STARTED` | Extracted identity Persian-digit normalization plus birth-date, national-ID, postal-code, and email validation into `application/identity`; full Auth tests pass in `2d5ab3d`. |
+| 2026-08-30 | A006 | `STARTED` | `DONE` | Added and runtime-wired identity ownership/person-verification boundaries with real/fake provider selection preserved; full Auth tests and vet pass in `75c2e0d`. |
+| 2026-08-30 | A007 | `TODO` | `DONE` | Replaced the positional Auth constructor with a typed dependency graph assembled explicitly in bootstrap; full Auth tests and vet pass in `7d7871b`. |
+| 2026-08-30 | A008 | `TODO` | `DONE` | Removed the legacy constructor and superseded runtime fallback implementations across OTP, JWT/session, permission, and identity paths; full Auth tests/race/vet pass in `a9b11a3`. |
+| 2026-08-30 | A003 | `STARTED` | `DONE` | Relocated all PostgreSQL and Redis implementation files from `repository/db` into `infrastructure`, removed wrapper indirection and the empty Mongo placeholder, and verified no legacy implementation imports remain; full tests/race/vet/build pass in `1323aa4`. |
+| 2026-08-30 | W001 | `TODO` | `DONE` | Mapped all six wallet runtime modes and their PostgreSQL, Redis, RabbitMQ/outbox, internal/external client, Stellar, availability, cryptography, observability, and shutdown dependencies in `REFACTORING-AUDIT.md`. |
+| 2026-08-30 | W002 | `TODO` | `DONE` | Added pure wallet entities/value objects, domain errors, filters, repository/cache/UoW ports, and blockchain/internal/external adapter boundaries; focused and full tests plus focused vet pass in `ac649d2`. |
+| 2026-08-30 | W003 | `TODO` | `STARTED` | Relocated all wallet PostgreSQL and Redis adapter implementations (including tests) from `repository/db` into `infrastructure/postgres` and `infrastructure/redis`; updated bootstrap imports and full Wallet tests pass in `d2580cd`. RabbitMQ, external service, and Stellar adapters remain. |
+| 2026-08-30 | W003 | `STARTED` | `DONE` | Relocated external service clients to `infrastructure/service` and Stellar/Horizon adapters to `infrastructure/stellar`; updated wallet, market, stream, and bootstrap imports; no legacy implementation imports remain; full tests, race tests, vet, and build pass in `d121fc9`. |
+| 2026-08-30 | W004 | `STARTED` | `DONE` | Added the `application/walletread` boundary and routed asset, commission, network, price, health, balance, check-balance, transaction-list, asset-catalog, and blockchain-balance reads through it; protobuf conversion and error mapping remain compatible; full Wallet tests pass in `5b17c82`. Wallet-balance synchronization is a mutation deferred to later wallet work. |
+| 2026-08-30 | W005 | `TODO` | `STARTED` | Added `application/walletinit` for identity preconditions, trustline-limit calculation, key recovery, trustline submission, wallet-code generation, wallet-draft construction, repository-backed find-or-create orchestration, trustline transaction construction, and tested commit/rollback plus existing/create wallet paths; initialization now propagates commit failures; focused Wallet tests pass in `f9a0262`. |
+| 2026-08-30 | A009 | `TODO` | `DONE` | Removed Auth's commented/dead wallet federation client; Auth tests pass with writable cache in `508a239`. |
+| 2026-08-30 | W013 | `TODO` | `STARTED` | Removed automatic federation creation and federation lookup from wallet initialization; new wallet records no longer receive a federation assignment; full Wallet tests pass in `97dd9d9`. Remaining schema/API/transaction-field cleanup is pending. |
+| 2026-08-30 | W013 | `STARTED` | `DONE` | Removed federation persistence/model code, wallet and transaction federation fields, federation protobuf messages, stale API route/docs, and remaining runtime references; regenerated Wallet contracts for Wallet/Auth/API; Wallet, Auth, and API tests pass. Wallet `a38501d`/`7ae90cc`, Auth `446e875`, API `c450264`/`c2c076c`. |
+| 2026-08-30 | W006 | `TODO` | `STARTED` | Added `application/withdrawal`, `application/deposit`, `application/transfer`, and `application/transaction`; routed IRT reconciliation, IPG conversion/settlement/payer identity, transfer validation, transaction construction/completion, balance-change display policy, deterministic wallet-lock ordering, insufficient-balance failure policy, Stellar status updates, and transaction-event support through application boundaries; invalid event inputs and unsupported transaction types now close safely; focused Wallet tests pass in `66d271e`. Business failure/refund orchestration remains. |
+| 2026-08-30 | W007 | `TODO` | `STARTED` | Added typed `application/market` policies for agreement tolerance, available amount, raw conversion, positive order inputs, ICO publisher validation, order status codes, and market pricing calculation; market ICO/order validation and calculation delegate through compatibility mapping. Synchronous settlement/stream locking fixed in `3004bb9`; order lifecycle, settlement, contract generation, and adapter extraction remain. |
+| 2026-08-30 | W008 | `TODO` | `STARTED` | Added `application/alert` level/source label and subject policies plus nil/incomplete-event validation; alert delivery keeps existing asynchronous email/SMS retry behavior. Focused Wallet tests pass in `b3e1dbc`. Delivery, retry, persistence, and adapter extraction remain. |
+| 2026-08-30 | W010 | `TODO` | `STARTED` | Added `application/cron.Retry`, `application/stream.IsNew`, stream external-deposit transaction policy, and dedicated `SetupCronRepository`/`SetupStreamRepository` paths; cron now avoids nil error telemetry on successful jobs and reads configurable `Cron.Schedule` timing. Focused Wallet tests pass in `5f37e56`. Remaining process composition work remains. |
+| 2026-08-30 | W009 | `TODO` | `STARTED` | Added `application/walletlock` lock/release mutation policies with frozen/available balance tests; internal RPC retains transaction scope, ledger journaling, persistence, and error mapping, validates incomplete IAM requests safely, and returns explicit success statuses. Focused Wallet tests pass in `0920702`. Remaining internal-wallet operations stay at the service boundary. |
+| 2026-08-30 | W011 | `TODO` | `STARTED` | Added dedicated alert, market, internal-wallet, stream, cron, and wallet repository setup entry points; each mode now declares its bootstrap profile. Command/core tests pass in `cf13a58`. Dependency internals and superseded bootstrap cleanup remain. |
+| 2026-08-30 | W012 | `TODO` | `STARTED` | Removed redundant market amount/agreement, IPG amount/payer-ID, referral-commission, redeem-allocation, contract-rounding, and agreement-ID implementations; discount, referral, redeem arithmetic, and contract policies now live in application packages. Focused Wallet tests pass in `dc0bdf4`. Remaining core implementation cleanup is pending. |