merge: 合入本地 Ops 扩展与 origin/main（ECR-009–016）

保留远程用户侧 ECR-009–016 与本地 Ops 目录/RBAC/CMS/危机等能力；文档标注分叉期间 ECR 编号冲突。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 01:45:53 +08:00
parent 89756f65b4 1026cd0596
commit 4889ff5916
593 changed files with 21918 additions and 328 deletions
@@ -0,0 +1,107 @@
+# Backend Design: ECR-012 星座对齐收口
+
+> Architect 产出；Engineer 只消费本文件。  
+> 实现纪律：`$ESS_ROOT/technology-governance/BACKEND_STANDARD.md`  
+> 项目分层权威：`.ai/architecture.md`
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-012 |
+| ECR | ECR-012 |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Low |
+
+---
+
+## Context
+
+- 问题 / 目标：星座/合盘主路径已落地，需 Spec 对齐、H5/报告页一致、测试加厚；默认 **不改表结构**。  
+- 非目标：真支付、新模块、换星历、Ops。  
+- 相关 Spec：`star-profile.md`；前序 ECR-003（fortune→outlook）。
+
+## Architecture Change
+
+- 是否改变分层边界：**No**  
+- 受影响层：Application（`internal/star` 仅按需）· API 文档 · UI（user-h5）
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| `internal/star` / `outlook` / `synastry` | Domain/App | 仅修偏离 Spec 的 summary/detail 键或文案 | 新表；换 ephemeris |
+| `handler` reports/synastry | API | 契约不变则不动；OpenAPI 描述可补 | Handler SQL |
+| `user-h5` star/synastry/report | UI | 对齐面板、卫生、分享、测试 | 直连 DB；真支付 |
+| packages/types · sdk | Shared | 仅当 OpenAPI/DTO 需同步 | 发明新领域同义词 |
+
+## Data Flow
+
+```text
+Profile(birth*)
+  → POST /reports/star | /reports/synastry
+  → star engine / synastry.BuildReport
+  → GrowthReport summary(outlook, charts, …) + gated detail
+  → H5 StarProfilePage | Synastry* | ReportPage
+  →（可选）pay-mock deep_access → detail 可见
+```
+
+## API Changes
+
+- 契约：`proto/openapi.yaml`  
+- 变更：**默认 None**（路径与语义保持）；允许描述/`$ref` 补强  
+- 兼容：禁止重新引入 summary.`fortune`
+
+## Database Changes
+
+- 表 / 字段：**无**  
+- Migration Required：**NO**
+
+## Migration Plan
+
+- Required：NO  
+- 回滚：代码回滚即可  
+
+## Failure Handling
+
+- 无档案 / 缺生日：Empty 表单（现有）  
+- detail 无权益：服务端剥离（现有，须保持测试）  
+- 旧报告缺 outlook：H5 空态，不伪造 fortune  
+
+## Test Plan
+
+- Unit：outlook bundle keys；H5 fortuneBundleFrom  
+- Integration：`TestFlowStarDeepAccess` · synastry charts keys · 禁用词  
+- E2E：p2 star 路径 mock 含 outlook  
+
+## Rollback Plan
+
+- git revert 本 ECR；无数据迁移  
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: star/synastry Spec alignment (mostly H5 + tests; optional star package hygiene)
+
+Affected:
+  Domain: StarProfile / Synastry (existing)
+  Application: internal/star* (optional)
+  Infrastructure: none (no migration)
+  API: OpenAPI docs only (default)
+  Migration: Not required
+  Tests: integration + H5 + e2e
+  Risk: Low
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] 不改鉴权面  
+- [ ] 未引入非默认中间件 / 新星历依赖  
+- [ ] 未简化分层  
+- [ ] 无 summary.`fortune` 回归  
@@ -0,0 +1,98 @@
+# Backend Design: ECR-013A Admin RBAC
+
+> Architect 产出；**Contract Definition** — Status Draft；Approve 前禁止实现。  
+> Parent: WAVE0-FROZEN
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-013A |
+| ECR | ECR-013A |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） · Coding authorized |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Medium |
+
+---
+
+## Context
+
+- 目标：管理员角色/权限点 + API 强制鉴权 + 审计  
+- 非目标：UserStatus(013B)；真支付；UGC  
+- Spec：`ops-rbac.md` · boundary-rules `Admin_RBAC`
+
+## Architecture Change
+
+- 分层边界：**No**  
+- 受影响层：API · Application(`service/admin`) · Infrastructure(repo+migration) · UI(admin-h5 最小)
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| admin repo/service | App/Infra | roles · permissions · account.role_id | 改 users.status |
+| middleware | API | RequirePermission | DeviceAuth 混用 |
+| admin handlers | API | /roles* · /me 扩展 | Handler SQL |
+| admin-h5 | UI | 读 permissions | 直连 DB |
+
+## Data Flow
+
+```text
+Admin login → AdminSession
+  → load AdminAccount + Role + Permissions
+  → request + RequirePermission(code)
+       → allow → service → audit
+       → deny  → 403 + audit
+```
+
+## API Changes
+
+- 契约意图见 Spec；实现轮写 `proto/openapi.yaml`  
+- 兼容：additive；旧 admin 账号迁移到 `super_admin`
+
+## Database Changes
+
+- Migration **Required: YES**（实现轮）  
+- 表：`admin_roles` · `admin_role_permissions`（或等价）· `admin_accounts.role_id`  
+- Wave 0 / Contract 轮：**不写 migration 文件**
+
+## Failure Handling
+
+- 无权限：403  
+- 无会话：401  
+- 删 super_admin：4xx  
+
+## Test Plan
+
+- Integration：AC-F/S/O；AC-P-01 本机抽样  
+- 禁止跳过 Security AC  
+
+## Rollback Plan
+
+- down migration；middleware 开关（实现轮详写）
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: Admin RBAC roles + permission gates
+
+Affected:
+  Domain: AdminRole, AdminPermission
+  Application: service/admin
+  Infrastructure: admin_repo + migration (implement phase)
+  API: /admin/roles* , /admin/me
+  Migration: Required at implement — NOT in contract phase
+  Tests: integration admin RBAC
+  Risk: Medium
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] Admin / Device 鉴权隔离  
+- [ ] 不拥有 UserStatus / Membership 写  
+- [ ] 符合 Admin_RBAC boundary-rules  
@@ -0,0 +1,107 @@
+# Backend Design: ECR-013B AccountLifecycle
+
+> Architect 产出；**Approved** + Coding Start Authorization 2026-08-07。  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-013A Closed
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-013B |
+| ECR | ECR-013B |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） · Coding authorized |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Medium |
+
+---
+
+## Context
+
+- 目标：UserStatus 状态机 + 运营迁移 + C 端拒绝非 active  
+- 非目标：soft-delete；UGC；真支付；AdminAccount 启停深化  
+- Spec：`ops-account-lifecycle.md` · boundary-rules `Identity_Profile`
+
+## Architecture Change
+
+- 分层边界：**No**  
+- 受影响层：API(admin) · Application(account/lifecycle 或 admin 协作服务) · Middleware(DeviceAuth) · Infrastructure(repo+migration) · UI(admin-h5 最小)
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| account / user status service | App | 迁移 + 边校验 + 事务 | soft-delete |
+| DeviceAuth / session | API | 拒绝非 active | 改 Visitor 创建语义 |
+| admin handlers | API | POST status · GET transitions | Handler SQL |
+| admin_rbac seed | Infra | additive permission | 重做 RBAC |
+| admin-h5 | UI | 用户详情 CTA | 直连 DB |
+
+## Data Flow
+
+```text
+Admin POST /users/:id/status
+  → RequirePermission(admin.users.status.write)
+  → validate edge
+  → tx: UPDATE users.status + INSERT transition + AuditLog
+  → 200
+
+C-end request
+  → DeviceAuth / Bearer resolve user
+  → if status != active → 401/403
+```
+
+## API Changes
+
+- 契约意图见 Spec；实现轮写 `proto/openapi.yaml`  
+- 兼容：additive；既有 status 字段语义收紧（非 active 开始拒绝）
+
+## Database Changes
+
+- Migration **Required: YES**（实现轮）  
+- 表：`account_state_transitions`  
+- Permission 种子：`admin.users.status.write`  
+- Wave 0 / Contract 轮：**不写 migration 文件**
+
+## Failure Handling
+
+- 非法边 / 同状态：400  
+- 无权限：403  
+- 无会话：401  
+- 用户不存在：404  
+
+## Test Plan
+
+- Integration：AC-F/S/O；AC-P-01 本机抽样  
+- 禁止跳过 Security AC（含 C 端拒绝）  
+
+## Rollback Plan
+
+- down migration；DeviceAuth 去掉 status 检查；permission 行可留（无害）
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: UserStatus transitions + C-end reject non-active
+
+Affected:
+  Domain: UserStatus, AccountStateTransition
+  Application: account lifecycle service
+  Infrastructure: migration + repo
+  API: /admin/users/:id/status*
+  Middleware: DeviceAuth / session gate
+  Migration: Required at implement — NOT in contract phase
+  Tests: integration admin status + device reject
+  Risk: Medium
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] Admin / Device 鉴权隔离  
+- [ ] UserStatus 归属 Identity_Profile  
+- [ ] 不拥有 Payment / UGC  
+- [ ] 符合 boundary-rules  
@@ -0,0 +1,23 @@
+# Backend Design: ECR-014 MembershipPlan
+
+| ID | BD-2026-014 |
+| ECR | ECR-014 |
+| Status | Approved |
+| Coding | Authorized（Loop） |
+| Change Level | L2 |
+| Risk | Low |
+
+## Change Boundary
+
+```text
+Domain: MembershipPlan
+App: admin + membership CreateOrder amount/days
+Infra: migration + repo
+API: /admin/membership-plans*
+Migration: YES
+Tests: integration
+```
+
+## Rollback
+
+down migration；回退硬编码 planDays/amount
@@ -0,0 +1,17 @@
+# Backend Design: ECR-015 RedemptionCode
+
+| ID | BD-2026-015 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+
+## Boundary
+
+```text
+Domain: RedemptionBatch, RedemptionCode
+App: admin + membership.Redeem
+API: /admin/redemption-* , POST /membership/redeem
+Migration: YES 000018
+```
+
+Rollback: down migration
@@ -0,0 +1,24 @@
+# Backend Design: ECR-016 UserIntelligence
+
+| ID | BD-2026-016 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: UserInsight read model (BehaviorSnapshot · PsychologicalTagSet derived)
+App: AdminHandler → admin.Service → AdminRepo aggregates
+API: GET /api/v1/admin/users/{id}/insight
+Permission: admin.users.read
+Migration: NO
+UI: admin-h5 UserDetail「洞察」Tab
+```
+
+## Out of boundary
+
+Write tags · new tables · Ask body edit · UGC · true payment
+
+Rollback: remove route + UI tab（无 schema）
@@ -0,0 +1,24 @@
+# Backend Design: ECR-017 AskOperations
+
+| ID | BD-2026-017 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000019（权限 only） |
+
+## Backend Change Boundary
+
+```text
+Domain: AskSessionView (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /api/v1/admin/ask/threads[+/:id]
+Permission: admin.ask.read
+Migration: 000019 grant to super_admin
+UI: admin-h5 /ask
+```
+
+## Out of boundary
+
+Message write/delete · SystemPrompt · Knowledge* · QualityFeedback write · UGC · Payment
+
+Rollback: down migration revoke permission + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-018 Entitlement
+
+| ID | BD-2026-018 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: Entitlement read model (Membership ∪ DeepAccess ∪ ask quotas)
+App: AdminHandler → admin.Service → AdminRepo + ReportRepo.GetMembership
+API: GET /api/v1/admin/users/{id}/entitlements
+Permission: admin.users.read
+Migration: NO
+UI: admin-h5 UserDetail「权益」Tab
+```
+
+## Out of boundary
+
+Payment gateway · new entitlement matrix table · order mutation · UGC
+
+Rollback: remove route + UI tab（无 schema）
@@ -0,0 +1,25 @@
+# Backend Design: ECR-019 ContentSafety
+
+| ID | BD-2026-019 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000020 |
+
+## Backend Change Boundary
+
+```text
+Domain: FilterRule (read) + evaluate (no ModerationCase write)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/filter-rules[+/:id]
+     POST /admin/content-safety/evaluate
+Permission: admin.content_safety.read
+Migration: 000020 table + seed + perm
+UI: admin-h5 /safety
+```
+
+## Out of boundary
+
+ModerationCase · CrisisPolicy write · UGC · Payment · external moderation vendor
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,26 @@
+# Backend Design: ECR-020 QualityFeedback
+
+| ID | BD-2026-020 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000021 |
+
+## Backend Change Boundary
+
+```text
+Domain: QualityFeedback
+App: AdminHandler + AskHandler → services → repos
+API: GET /admin/ask/feedback
+     POST /admin/ask/threads/{id}/feedback
+     POST /ask/threads/{id}/feedback
+Permission: admin.ask.read · admin.ask.feedback.write
+Migration: 000021
+UI: admin-h5 /ask feedback panel
+```
+
+## Out of boundary
+
+Message mutation · SystemPrompt · UGC plaza · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-021 AICoreConfig
+
+| ID | BD-2026-021 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000022 |
+
+## Backend Change Boundary
+
+```text
+Domain: SystemPrompt (read catalog)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/system-prompts[+/:id]
+Permission: admin.ai_config.read
+Migration: 000022 table + seed ask_default + perm
+UI: admin-h5 /ai
+```
+
+## Out of boundary
+
+Prompt write/publish · Knowledge* · ToolDefinition · runtime engine swap · UGC · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,25 @@
+# Backend Design: ECR-022 CrisisCare
+
+| ID | BD-2026-022 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000023 |
+
+## Backend Change Boundary
+
+```text
+Domain: CrisisPolicy (read) + evaluate (no CrisisEvent write)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/policies[+/:id]
+     POST /admin/crisis/evaluate
+Permission: admin.crisis.read
+Migration: 000023
+UI: admin-h5 /crisis
+```
+
+## Out of boundary
+
+CrisisEvent write · InterventionOutcome · policy publish · medical diagnosis · UGC · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-023 KnowledgeSource
+
+| ID | BD-2026-023 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000024 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeSource (read catalog only)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-sources[+/:id]
+Permission: admin.ai_config.read (reuse; no new perm)
+Migration: 000024 knowledge_sources + seed ask_grounding
+UI: admin-h5 /ai KnowledgeSource panel
+```
+
+## Out of boundary
+
+KnowledgeChunk · Embedding · upload/publish · ToolDefinition · UGC · Payment · runtime RAG wiring
+
+Rollback: down migration + remove routes/UI panel
@@ -0,0 +1,23 @@
+# Backend Design: ECR-024 Banner
+
+| ID | BD-2026-024 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000025 |
+
+## Backend Change Boundary
+
+```text
+Domain: Banner (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/banners; GET /admin/cms/banners/{id}
+Permission: admin.cms.read
+Migration: 000025
+```
+
+## Out of boundary
+
+Banner 写发布 · FeedSlot · ScheduledPublication · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-025 FeedSlot
+
+| ID | BD-2026-025 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000026 |
+
+## Backend Change Boundary
+
+```text
+Domain: FeedSlot (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/feed-slots; GET /admin/cms/feed-slots/{id}
+Permission: admin.cms.read
+Migration: 000026
+```
+
+## Out of boundary
+
+FeedSlot 写发布 · ScheduledPublication · UGC · 真支付 · Banner 写
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-026 ScheduledPublication
+
+| ID | BD-2026-026 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000027 |
+
+## Backend Change Boundary
+
+```text
+Domain: ScheduledPublication (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/publications; GET /admin/cms/publications/{id}
+Permission: admin.cms.read
+Migration: 000027
+```
+
+## Out of boundary
+
+定时发布写操作 · UGC · 真支付 · Banner/FeedSlot 写
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-027 KnowledgeChunk
+
+| ID | BD-2026-027 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000028 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeChunk (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-chunks; GET /admin/ai/knowledge-chunks/{id}
+Permission: admin.ai_config.read
+Migration: 000028
+```
+
+## Out of boundary
+
+Embedding · 上传切块 · 运行时 RAG 接线 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-028 ToolDefinition
+
+| ID | BD-2026-028 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000029 |
+
+## Backend Change Boundary
+
+```text
+Domain: ToolDefinition (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/tools; GET /admin/ai/tools/{id}
+Permission: admin.ai_config.read
+Migration: 000029
+```
+
+## Out of boundary
+
+工具在线编辑 · 运行时绑定 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-029 BlockPolicy
+
+| ID | BD-2026-029 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000030 |
+
+## Backend Change Boundary
+
+```text
+Domain: BlockPolicy (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/block-policies; GET /admin/content-safety/block-policies/{id}
+Permission: admin.content_safety.read
+Migration: 000030
+```
+
+## Out of boundary
+
+策略写发布 · 用户侧硬拦截上线 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-030 ModerationCase
+
+| ID | BD-2026-030 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000031 |
+
+## Backend Change Boundary
+
+```text
+Domain: ModerationCase (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/cases; GET /admin/content-safety/cases/{id}
+Permission: admin.content_safety.read
+Migration: 000031
+```
+
+## Out of boundary
+
+审核写回 · 真 NLP 厂商 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-031 CrisisEvent
+
+| ID | BD-2026-031 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000032 |
+
+## Backend Change Boundary
+
+```text
+Domain: CrisisEvent (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/events; GET /admin/crisis/events/{id}
+Permission: admin.crisis.read
+Migration: 000032
+```
+
+## Out of boundary
+
+事件写入工单流 · 医疗诊断 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-032 InterventionOutcome
+
+| ID | BD-2026-032 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000033 |
+
+## Backend Change Boundary
+
+```text
+Domain: InterventionOutcome (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/interventions; GET /admin/crisis/interventions/{id}
+Permission: admin.crisis.read
+Migration: 000033
+```
+
+## Out of boundary
+
+干预写回 · 医疗诊断 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-033 HandoffCase
+
+| ID | BD-2026-033 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000034 |
+
+## Backend Change Boundary
+
+```text
+Domain: HandoffCase (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ask/handoffs; GET /admin/ask/handoffs/{id}
+Permission: admin.ask.read
+Migration: 000034
+```
+
+## Out of boundary
+
+转人工写流 · 顾问执业 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-034 PrivacyRequest
+
+| ID | BD-2026-034 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000035 |
+
+## Backend Change Boundary
+
+```text
+Domain: PrivacyRequest (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/privacy/requests; GET /admin/privacy/requests/{id}
+Permission: admin.privacy.read
+Migration: 000035
+```
+
+## Out of boundary
+
+隐私请求履约写 · soft-delete · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-035 StarConfig
+
+| ID | BD-2026-035 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000036 |
+
+## Backend Change Boundary
+
+```text
+Domain: StarConfig (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/star-configs; GET /admin/explore/star-configs/{id}
+Permission: admin.explore.read
+Migration: 000036
+```
+
+## Out of boundary
+
+配置写发布 · 引擎改分层 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-036 RhythmConfig
+
+| ID | BD-2026-036 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000037 |
+
+## Backend Change Boundary
+
+```text
+Domain: RhythmConfig (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/rhythm-configs; GET /admin/explore/rhythm-configs/{id}
+Permission: admin.explore.read
+Migration: 000037
+```
+
+## Out of boundary
+
+配置写发布 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-037 ImageCardDeck
+
+| ID | BD-2026-037 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000038 |
+
+## Backend Change Boundary
+
+```text
+Domain: ImageCardDeck (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/image-card-decks; GET /admin/explore/image-card-decks/{id}
+Permission: admin.explore.read
+Migration: 000038
+```
+
+## Out of boundary
+
+牌组写发布 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-038 ReportTemplate
+
+| ID | BD-2026-038 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000039 |
+
+## Backend Change Boundary
+
+```text
+Domain: ReportTemplate (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/growth/report-templates; GET /admin/growth/report-templates/{id}
+Permission: admin.growth.read
+Migration: 000039
+```
+
+## Out of boundary
+
+模板写发布 · 广告投放 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-039 FunnelDefinition
+
+| ID | BD-2026-039 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000040 |
+
+## Backend Change Boundary
+
+```text
+Domain: FunnelDefinition (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/analytics/funnel-definitions; GET /admin/analytics/funnel-definitions/{id}
+Permission: admin.analytics.read
+Migration: 000040
+```
+
+## Out of boundary
+
+漏斗写配置 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-040 ScaleDefinition
+
+| ID | BD-2026-040 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: ScaleDefinition (read projection of scales)
+App: AdminHandler → admin.Service → ScaleRepo
+API: GET /admin/explore/scales[+/:id]
+Permission: admin.explore.read
+UI: admin-h5 /catalogs
+```
+
+## Out of boundary
+
+PATCH status · 题干编辑 · UGC · Payment
+
+Rollback: remove routes/UI
@@ -2,30 +2,34 @@

 ## 2026-08-13

+- **Merge：** `merge/ops-local-into-main` — 合并本地 Ops 目录扩展（ECR-013A…040）与远程 main（ECR-009…016）  
+  注意：分叉期间 ECR-012/014/015/016 编号在两边含义不同，以 TRACEABILITY 双列说明为准  
 - **Git host：** 远程改为 `https://git.jackyu66.com/jack/digital-psychology.git`；删除 `.github/workflows`（不再使用 GitHub Actions）  
- **ECR-016 Closed（RETRO）**：MBTI OEJTS lite/full · 自主 Loop  
- **ECR-015 Closed（RETRO）**：头像 · CODE_REVIEW Approve  
- **ECR-015 Implemented（RETRO）**：头像单测 + OpenAPI 说明 · TEST_REPORT → reviewer  
- **ECR-015 Approved（RETRO）**：账号头像 · Architect→Engineer；Scope freeze 不含 OpenLogin/题库/014  
- **ECR-014 Closed（RETRO）**：时效刷新 FE/BE · CODE_REVIEW Approve（记 Process debt）  
- **ECR-014 Implementing（RETRO）**：时效刷新 FE/BE · OpenAPI HomeDailyTips · TEST_REPORT → reviewer  
- **ESS 0.2.0-intake FROZEN：** Implementation Complete / Validation Pending；下一步 Real L2 Pressure（A/B/C），不开 PR2/Loop  
- **ESS Intake G0：** `$ESS_ROOT` · `SESSION_BOOTSTRAP`；本仓 `ess_intake: strict` · `AGENTS.md` §0 Mode 块  
- **ECR-013 Closed**：探索 curated 题库 A 集 · R8 回看 · OpenAPI `/scale-bank/*` · CODE_REVIEW Approve  
- **ECR-012 Closed**：文字输入合规 textsafe / 40060 · CODE_REVIEW Approve  
+- **ECR-016 Closed（RETRO · main）：** MBTI OEJTS lite/full · 自主 Loop  
+- **ECR-015 Closed（RETRO · main）：** 头像 · CODE_REVIEW Approve  
+- **ECR-014 Closed（RETRO · main）：** 时效刷新 FE/BE · CODE_REVIEW Approve  
+- **ECR-013 Closed（main）：** 探索 curated 题库 A 集 · R8 回看 · OpenAPI `/scale-bank/*`  
+- **ECR-012 Closed（main）：** 文字输入合规 textsafe / 40060 · CODE_REVIEW Approve  
+- **ESS 0.2.0-intake FROZEN / Intake G0**  

 ## 2026-08-12

 - **ECR-011 Closed**：integration TestECR011 PASS；CODE_REVIEW Approve  
 - **ECR-011 Implemented**：昵称 · 首页 daily-tips · Self 唯一/合盘交叉校验  
-  migration `000017` · PATCH `/auth/me` · GET `/home/daily-tips` · 40902  
-  TEST_REPORT · HANDOFF→reviewer · STATE phase=review  
- **ECR-011 Approved**（Human）：进入 coding / 收敛 WIP  
+
+## 2026-08-08
+
+- **ECR-040…021 Closed（local Ops loop）：** ExploreConfig / GrowthInsights / Crisis / CMS / AI / Safety 只读目录扩展  

 ## 2026-08-07

- **ECR-009 Implementing**：Ops-D 订单筛选 · 展示价 · 退款只读（LOOP-RUN-002）  
-  Spec `ops-commerce.md` · BD-2026-009 · migration `000015`  
+- **ECR-020…013A Closed（local）：** QualityFeedback · ContentSafety · Entitlement · AskOps · UserIntelligence · Redemption · MembershipPlan · AccountLifecycle · Admin RBAC · WAVE0 FREEZE  
+- **ECR-012（local · 星座对齐）Implemented** — 与 main 线 ECR-012（合规）编号冲突，见 TRACEABILITY  
+- **ECR-009 Implementing（main）：** Ops-D 订单筛选 · 展示价 · 退款只读  
+- **ECR-007/008 Closed / P1 修复**  
+
+## 2026-08-07 (continued from pre-merge)
+
 - **ECR-008 P1 修复**：审计同事务 · 宫格 move 保留 row_index · Analytics nil 守卫  
 - **ECR-008 Implemented**：Ops-C 首页宫格 CMS + 测评上下架  
  migration `000014` · `/home/tools` · admin「内容」· TEST_REPORT/CODE_REVIEW  
@@ -24,4 +24,13 @@ Date: 2026-08-07

 - ingest 逐条 INSERT（量上来再批量 COPY / 日汇总表）  
 - admin「数据」未进 `@yuxingu/sdk`（与 Ops-A 一致用 thin client）  
- Ops-C/D/E 另开 ECR  
+- Ops-D/E 另开 ECR  
+
+## Closed decision（2026-08-07）
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Evidence: TEST_REPORT/ECR-007.md · Acceptance 全勾 · ess-validate --phase review PASS
+Residual: 上列不阻断；部署属 RELEASE_MANAGER + Human
+```  
@@ -32,3 +32,12 @@ Date: 2026-08-07 · Reviewer pass → P1 fixed
 - [x] Admin / Device 鉴权隔离  
 - [x] 未引入非默认中间件  
 - [x] 审计与写操作同事务  
+
+## Closed decision（2026-08-07）
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Evidence: TEST_REPORT/ECR-008.md · P1 已修 · Acceptance 全勾 · ess-validate --phase review PASS
+Residual: P2 可跟进项不阻断 Closed；部署属 RELEASE_MANAGER + Human
+```  
@@ -0,0 +1,45 @@
+# CODE_REVIEW — ECR-013A
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Reviewer（Human Authorize Approve）
+
+## Checklist
+
+- [x] Handler → Service → Repository；AdminAuth ≠ DeviceAuth
+- [x] Feature Spec Active + BD-2026-013A Approved + Coding auth
+- [x] OpenAPI `/admin/roles*` · `AdminMe.permissions`
+- [x] Migration `000015_admin_rbac` · seed `super_admin`
+- [x] 既有写路径 RequirePermission；403 + AuditLog
+- [x] AC-F/S/P/O 在 TEST_REPORT 有证据
+- [x] 无 UserStatus / 013B / 真支付 / UGC
+
+## Backend Review
+
+```text
+□ Design Compliance — PASS（对齐 BD-2026-013A）
+□ Layer boundary respected — PASS
+□ Repository used — PASS
+□ API contract additive — PASS
+□ Migration exists — PASS 000015
+□ Observability — PASS AuditLog deny/update
+□ Tests included — PASS TestAdminRBAC
+□ Rollback — PASS down migration
+□ No architecture regression — PASS
+□ Matches Change Boundary L2 — PASS
+```
+
+## Architecture Regression
+
+- [x] 无 Handler 直连 DB
+- [x] Admin / Device 鉴权隔离
+- [x] 符合 `boundary-rules` Admin_RBAC
+- [x] 文件/函数体量可接受（RBAC 拆分独立文件）
+
+## Closed decision
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Next: ECR-013B AccountLifecycle — Contract Definition（另 Start Authorization）
+```
@@ -0,0 +1,37 @@
+# CODE_REVIEW — ECR-013B
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Reviewer（Loop continuous · Human delegated no per-gate confirm）
+
+## Checklist
+
+- [x] Handler → Service → Repository；状态迁移同事务（status + transition + audit）
+- [x] Feature Spec Active + BD-2026-013B Approved + Coding auth
+- [x] OpenAPI status paths
+- [x] Migration `000016_account_lifecycle`
+- [x] DeviceAuth 非 active 拒绝；Admin 权限门控
+- [x] AC-F/S/P/O 在 TEST_REPORT 有证据
+- [x] 无 soft-delete / UGC / 真支付
+
+## Backend Review
+
+```text
+□ Design Compliance — PASS
+□ Layer boundary — PASS
+□ Repository used — PASS
+□ Migration — PASS 000016
+□ Observability — PASS
+□ Tests — PASS TestAccountLifecycle
+□ Rollback — PASS down migration
+□ Change Boundary L2 — PASS
+```
+
+## Closed decision
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Loop: continuous Ops D+ authorized (no per-gate Human confirm)
+Next: ECR-014 CommerceEntitlement / MembershipPlan（薄切片）
+```
@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-017
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- Additive AskSessionView 只读；migration 000019 仅权限  
+- Handler → Service → Repository；无消息写 / UGC / 真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-018
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- Additive Entitlement 读模型；Migration NO  
+- Handler → Service → Repository；无真支付/UGC  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-019
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- FilterRule 表 + 只读/试匹配；无 ModerationCase 写  
+- Handler → Service → Repository；无 UGC / 真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-020
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- QualityFeedback 表 + admin/user API；无消息改写  
+- Audit on admin create · Integration AC mapped
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-021
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- SystemPrompt 目录只读；未改 Ask 运行时组装  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-022
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- CrisisPolicy 只读 + evaluate；无 CrisisEvent 写  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-023
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeSource 只读；无 Chunk/Embedding/UGC  
+- Integration AC mapped · OpenAPI updated · 复用 admin.ai_config.read
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-024
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- Banner 只读；无 UGC/写发布  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-025
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- FeedSlot 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-026
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ScheduledPublication 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-027
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeChunk 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-028
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ToolDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-029
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- BlockPolicy 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-030
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ModerationCase 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-031
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- CrisisEvent 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-032
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- InterventionOutcome 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-033
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- HandoffCase 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-034
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- PrivacyRequest 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-035
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- StarConfig 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-036
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- RhythmConfig 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-037
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ImageCardDeck 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-038
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ReportTemplate 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-039
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- FunnelDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-040
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ScaleDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated
@@ -0,0 +1,59 @@
+ecr: ECR-013A
+capability: AdminGovernance
+bounded_context: Admin_RBAC
+parent: WAVE0-FROZEN
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Additive RBAC tables and AdminAccount.role_id.
+  Existing admin accounts migrate to seeded super_admin.
+  GET /admin/me gains permissions[]; old clients ignore unknown fields.
+
+entities:
+  - name: AdminRole
+    before: null
+    after:
+      fields: [id, name, system, created_at]
+  - name: AdminPermission
+    before: null
+    after:
+      fields: [code]
+      catalog:
+        - admin.users.read
+        - admin.users.membership.grant
+        - admin.users.ask_quota.grant
+        - admin.orders.read
+        - admin.audit.read
+        - admin.analytics.read
+        - admin.content.write
+        - admin.roles.read
+        - admin.roles.write
+  - name: AdminAccount
+    before:
+      fields: [id, username, password_hash, status]
+    after:
+      fields: [id, username, password_hash, status, role_id]
+
+apis:
+  - method: GET
+    path: /api/v1/admin/roles
+    change: added
+  - method: GET
+    path: /api/v1/admin/roles/{id}
+    change: added
+  - method: PUT
+    path: /api/v1/admin/roles/{id}/permissions
+    change: added
+  - method: GET
+    path: /api/v1/admin/me
+    change: modified
+    response_delta: "add role + permissions[]"
+
+security_impact:
+  - "RequirePermission on mutating admin routes"
+  - "403 + AuditLog on deny"
+
+observability_impact:
+  - "AuditLog on roles.permissions.update and permission denials"
@@ -0,0 +1,50 @@
+ecr: ECR-013B
+capability: AccountLifecycle
+bounded_context: Identity_Profile
+parent: WAVE0-FROZEN
+predecessor: ECR-013A
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  users.status already exists (default active).
+  Non-active users begin to be rejected by DeviceAuth/Bearer (behavior tightening).
+  New table account_state_transitions (append-only).
+  RBAC catalog additive: admin.users.status.write seeded to super_admin.
+
+entities:
+  - name: UserStatus
+    before:
+      fields: [status string on users]
+      notes: no enforced transitions
+    after:
+      values: [active, disabled, banned, suspended]
+      machine: enforced edges
+  - name: AccountStateTransition
+    before: null
+    after:
+      fields: [id, user_id, from_status, to_status, admin_id, reason, created_at]
+  - name: AdminPermission
+    before:
+      catalog_ref: ECR-013A
+    after:
+      catalog_additive:
+        - admin.users.status.write
+
+apis:
+  - method: POST
+    path: /api/v1/admin/users/{id}/status
+    change: added
+  - method: GET
+    path: /api/v1/admin/users/{id}/status-transitions
+    change: added
+
+security_impact:
+  - "C-end reject when User.status != active"
+  - "RequirePermission admin.users.status.write on POST status"
+  - "403 + AuditLog on deny"
+
+observability_impact:
+  - "AuditLog users.status.transition"
+  - "account_state_transitions append-only"
@@ -0,0 +1,36 @@
+ecr: ECR-014
+capability: CommerceEntitlement
+bounded_context: Membership_Orders
+parent: WAVE0-FROZEN
+predecessor: ECR-013B
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  New membership_plans table seeded with month/quarter/year.
+  Grant/CreateOrder read duration/amount from table with hardcoded fallback.
+  Additive RBAC permissions.
+
+entities:
+  - name: MembershipPlan
+    before: null
+    after:
+      fields: [code, title, duration_days, amount_cents, active, updated_at]
+      codes: [month, quarter, year]
+
+apis:
+  - method: GET
+    path: /api/v1/admin/membership-plans
+    change: added
+  - method: GET
+    path: /api/v1/admin/membership-plans/{code}
+    change: added
+  - method: PUT
+    path: /api/v1/admin/membership-plans/{code}
+    change: added
+
+security_impact:
+  - "admin.membership.plans.read/write"
+observability_impact:
+  - "AuditLog membership.plans.update"
@@ -0,0 +1,28 @@
+ecr: ECR-015
+capability: CommerceEntitlement
+bounded_context: Membership_Orders
+parent: WAVE0-FROZEN
+predecessor: ECR-014
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  New redemption_batches / redemption_codes.
+  C-end POST /membership/redeem extends membership without payment.
+  Additive RBAC admin.membership.codes.read/write.
+
+entities:
+  - name: RedemptionBatch
+    before: null
+    after: { fields: [id, label, plan_code, quantity, created_by, created_at] }
+  - name: RedemptionCode
+    before: null
+    after: { fields: [id, batch_id, code, plan_code, status, redeemed_by, redeemed_at] }
+
+apis:
+  - { method: POST, path: /api/v1/admin/redemption-batches, change: added }
+  - { method: GET, path: /api/v1/admin/redemption-batches, change: added }
+  - { method: GET, path: /api/v1/admin/redemption-batches/{id}/codes, change: added }
+  - { method: POST, path: /api/v1/admin/redemption-codes/{id}/disable, change: added }
+  - { method: POST, path: /api/v1/membership/redeem, change: added }
@@ -0,0 +1,17 @@
+ecr: ECR-016
+capability: UserIntelligence
+bounded_context: Identity_Profile
+parent: WAVE0-FROZEN
+predecessor: ECR-015
+change:
+  type: additive
+breaking_change: false
+migration_required: false
+compatibility_notes: >
+  Additive read API GET /admin/users/{id}/insight.
+  No schema change; aggregates existing tables.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/users/{id}/insight
+    change: added
@@ -0,0 +1,23 @@
+ecr: ECR-017
+capability: AskOperations
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-016
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Additive admin read APIs for AskSessionView.
+  Migration 000019 only grants admin.ask.read to super_admin.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ask/threads
+    change: added
+  - method: GET
+    path: /api/v1/admin/ask/threads/{id}
+    change: added
+perms:
+  - code: admin.ask.read
+    change: added
@@ -0,0 +1,17 @@
+ecr: ECR-018
+capability: CommerceEntitlement
+bounded_context: Membership_Orders
+parent: WAVE0-FROZEN
+predecessor: ECR-017
+change:
+  type: additive
+breaking_change: false
+migration_required: false
+compatibility_notes: >
+  Additive read API GET /admin/users/{id}/entitlements.
+  Aggregates memberships + deep_accesses + ask quotas; no schema change.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/users/{id}/entitlements
+    change: added
@@ -0,0 +1,26 @@
+ecr: ECR-019
+capability: ContentSafety
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-018
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds filter_rules table with system seeds and read/evaluate admin APIs.
+  No ModerationCase / Crisis write paths.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/content-safety/filter-rules
+    change: added
+  - method: GET
+    path: /api/v1/admin/content-safety/filter-rules/{id}
+    change: added
+  - method: POST
+    path: /api/v1/admin/content-safety/evaluate
+    change: added
+perms:
+  - code: admin.content_safety.read
+    change: added
@@ -0,0 +1,26 @@
+ecr: ECR-020
+capability: AskOperations
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-019
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ask_quality_feedback and admin/user feedback APIs.
+  No message body mutation.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ask/feedback
+    change: added
+  - method: POST
+    path: /api/v1/admin/ask/threads/{id}/feedback
+    change: added
+  - method: POST
+    path: /api/v1/ask/threads/{id}/feedback
+    change: added
+perms:
+  - code: admin.ask.feedback.write
+    change: added
@@ -0,0 +1,23 @@
+ecr: ECR-021
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-020
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds system_prompts catalog with ask_default seed and read-only admin APIs.
+  Does not change Ask runtime prompt assembly in this slice.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/system-prompts
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/system-prompts/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: added
@@ -0,0 +1,26 @@
+ecr: ECR-022
+capability: CrisisCare
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-021
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds crisis_policies catalog with system seeds and read/evaluate admin APIs.
+  Does not write CrisisEvent.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/crisis/policies
+    change: added
+  - method: GET
+    path: /api/v1/admin/crisis/policies/{id}
+    change: added
+  - method: POST
+    path: /api/v1/admin/crisis/evaluate
+    change: added
+perms:
+  - code: admin.crisis.read
+    change: added
@@ -0,0 +1,23 @@
+ecr: ECR-023
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-022
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds knowledge_sources catalog with system seed ask_grounding and read admin APIs.
+  Reuses admin.ai_config.read. Does not introduce KnowledgeChunk or embeddings.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-024
+capability: OpsCMS
+bounded_context: Ops_CMS_NoUGC
+parent: WAVE0-FROZEN
+predecessor: ECR-023
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds Banner read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/cms/banners
+    change: added
+  - method: GET
+    path: /api/v1/admin/cms/banners/{id}
+    change: added
+perms:
+  - code: admin.cms.read
+    change: added
@@ -0,0 +1,22 @@
+ecr: ECR-025
+capability: OpsCMS
+bounded_context: Ops_CMS_NoUGC
+parent: WAVE0-FROZEN
+predecessor: ECR-024
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds FeedSlot read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/cms/feed-slots
+    change: added
+  - method: GET
+    path: /api/v1/admin/cms/feed-slots/{id}
+    change: added
+perms:
+  - code: admin.cms.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-026
+capability: OpsCMS
+bounded_context: Ops_CMS_NoUGC
+parent: WAVE0-FROZEN
+predecessor: ECR-025
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ScheduledPublication read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/cms/publications
+    change: added
+  - method: GET
+    path: /api/v1/admin/cms/publications/{id}
+    change: added
+perms:
+  - code: admin.cms.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-027
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-026
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds KnowledgeChunk read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-chunks
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-chunks/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-028
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-027
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ToolDefinition read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/tools
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/tools/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-029
+capability: ContentSafety
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-028
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds BlockPolicy read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/content-safety/block-policies
+    change: added
+  - method: GET
+    path: /api/v1/admin/content-safety/block-policies/{id}
+    change: added
+perms:
+  - code: admin.content_safety.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-030
+capability: ContentSafety
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-029
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ModerationCase read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/content-safety/cases
+    change: added
+  - method: GET
+    path: /api/v1/admin/content-safety/cases/{id}
+    change: added
+perms:
+  - code: admin.content_safety.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-031
+capability: CrisisCare
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-030
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds CrisisEvent read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/crisis/events
+    change: added
+  - method: GET
+    path: /api/v1/admin/crisis/events/{id}
+    change: added
+perms:
+  - code: admin.crisis.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-032
+capability: CrisisCare
+bounded_context: Content_Safety
+parent: WAVE0-FROZEN
+predecessor: ECR-031
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds InterventionOutcome read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/crisis/interventions
+    change: added
+  - method: GET
+    path: /api/v1/admin/crisis/interventions/{id}
+    change: added
+perms:
+  - code: admin.crisis.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-033
+capability: AskOperations
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-032
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds HandoffCase read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ask/handoffs
+    change: added
+  - method: GET
+    path: /api/v1/admin/ask/handoffs/{id}
+    change: added
+perms:
+  - code: admin.ask.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-034
+capability: AdminGovernance
+bounded_context: Admin_Auth_Audit
+parent: WAVE0-FROZEN
+predecessor: ECR-033
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds PrivacyRequest read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/privacy/requests
+    change: added
+  - method: GET
+    path: /api/v1/admin/privacy/requests/{id}
+    change: added
+perms:
+  - code: admin.privacy.read
+    change: added
@@ -0,0 +1,22 @@
+ecr: ECR-035
+capability: ExploreConfig
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-034
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds StarConfig read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/explore/star-configs
+    change: added
+  - method: GET
+    path: /api/v1/admin/explore/star-configs/{id}
+    change: added
+perms:
+  - code: admin.explore.read
+    change: added
@@ -0,0 +1,22 @@
+ecr: ECR-036
+capability: ExploreConfig
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-035
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds RhythmConfig read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/explore/rhythm-configs
+    change: added
+  - method: GET
+    path: /api/v1/admin/explore/rhythm-configs/{id}
+    change: added
+perms:
+  - code: admin.explore.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-037
+capability: ExploreConfig
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-036
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ImageCardDeck read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/explore/image-card-decks
+    change: added
+  - method: GET
+    path: /api/v1/admin/explore/image-card-decks/{id}
+    change: added
+perms:
+  - code: admin.explore.read
+    change: unchanged
@@ -0,0 +1,22 @@
+ecr: ECR-038
+capability: GrowthInsights
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-037
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds ReportTemplate read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/growth/report-templates
+    change: added
+  - method: GET
+    path: /api/v1/admin/growth/report-templates/{id}
+    change: added
+perms:
+  - code: admin.growth.read
+    change: added
@@ -0,0 +1,22 @@
+ecr: ECR-039
+capability: GrowthInsights
+bounded_context: Analytics_OpsB
+parent: WAVE0-FROZEN
+predecessor: ECR-038
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds FunnelDefinition read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/analytics/funnel-definitions
+    change: added
+  - method: GET
+    path: /api/v1/admin/analytics/funnel-definitions/{id}
+    change: added
+perms:
+  - code: admin.analytics.read
+    change: unchanged
@@ -0,0 +1,23 @@
+ecr: ECR-040
+capability: ExploreConfig
+bounded_context: Explore_Reports
+parent: WAVE0-FROZEN
+predecessor: ECR-039
+change:
+  type: additive
+breaking_change: false
+migration_required: false
+compatibility_notes: >
+  Adds ScaleDefinition read projection over existing scales table.
+  Requires admin.explore.read. Does not add PATCH.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/explore/scales
+    change: added
+  - method: GET
+    path: /api/v1/admin/explore/scales/{id}
+    change: added
+perms:
+  - code: admin.explore.read
+    change: unchanged
@@ -0,0 +1,10 @@
+# CONTRACT_DIFF
+
+Per-implement-ECR instances live here.
+
+| File | ECR | Phase |
+|------|-----|-------|
+| [ECR-013A.yaml](ECR-013A.yaml) | ECR-013A | Contract Definition（Draft） |
+
+Template: `docs/WAVE0/contracts/contract_diff.template.yaml`  
+P0：无 contract_diff 不得 Approve coding。
@@ -1,9 +1,10 @@
 # ECR-007

 **Title:** 运营行为分析 Ops-B（自有埋点采集 · 管理端数据看板）  
-**Status:** Approved  
+**Status:** Closed  
 **Date:** 2026-08-07  
 **Approved:** 2026-08-07（Human）  
+**Closed:** 2026-08-07（Reviewer · Approve + ess-validate review PASS）  
 **Change Level:** L2（新能力；栈与分层不变）  

 ## Change
@@ -50,8 +51,9 @@
 - [x] Integration：H5 形态上报 → DB → admin analytics GET 非空且量级一致  
 - [x] `go test` 相关包绿；`npm run build:h5` · `build:admin` 绿  
 - [x] OpenAPI / TRACEABILITY / STATE / TEST_REPORT / CODE_REVIEW  
- [ ] `python scripts/ess-validate.py --phase review --ecr ECR-007`（Reviewer 门禁）  
+- [x] `python3 scripts/ess-validate.py --phase review --ecr ECR-007`（Reviewer 门禁 PASS）  
 - [x] Docs + CHANGELOG  
+- [x] Reviewer Closed（STATE · TRACEABILITY）  

 ## Rollback

@@ -1,9 +1,10 @@
 # ECR-008

 **Title:** 运营内容配置 Ops-C（首页宫格 CRUD · 测评上下架）  
-**Status:** Approved  
+**Status:** Closed  
 **Date:** 2026-08-07  
 **Approved:** 2026-08-07（Human）  
+**Closed:** 2026-08-07（Reviewer · Approve + ess-validate review PASS）  
 **Change Level:** L2（新能力；栈与分层不变）  

 ## Change
@@ -48,8 +49,9 @@
 - [x] Integration：PUT tools → GET home/tools；PATCH scale draft → ListPublished 不含  
 - [x] `go test` · `build:h5` · `build:admin` 绿  
 - [x] OpenAPI / TRACEABILITY / STATE / TEST_REPORT / CODE_REVIEW  
- [x] `ess-validate --phase review`  
+- [x] `python3 scripts/ess-validate.py --phase review --ecr ECR-008`（PASS）  
 - [x] Docs + CHANGELOG  
+- [x] Reviewer Closed（STATE · TRACEABILITY）  

 ## Rollback

@@ -0,0 +1,80 @@
+# ECR-012
+
+**Title:** 星座对齐收口（星盘 · 运势 outlook · 合盘）  
+**Status:** Approved  
+**Date:** 2026-08-07  
+**Approved:** 2026-08-07（Human）  
+**Change Level: L2**（可见体验/契约文档对齐；栈与分层不变）
+
+## Change
+
+在已有 P2 星座/合盘实现上做 **Spec ↔ 实现对齐收口**（非真支付、非新探索模块）：
+
+1. 修订 Active Feature Spec：`.ai/product/feature-spec/star-profile.md`（Gaps · §12 用词 · Implementation Notes）  
+2. H5：`/star` · `/reports/:id`(type=star) · `/synastry*` 体验与文案对齐 Spec §5–12  
+3. 清理 ECR-003 残留：类型/组件内 `lucky` 字段、内部仍混用的 `fortune` JSON 读路径（**用户可见 Tab 文案「运势」保留**）  
+4. 报告页星座面板与星座主页运势信息密度对齐（dims / boost / caution / 日–一生）  
+5. 补强测试：integration/H5/e2e 对 outlook · 轮盘 · 合盘五主盘键的断言；lexicon 禁用词扫描覆盖合盘路径  
+6. 更新 `feature-map` / `P2-BACKLOG`：星座由「对齐中」→ 本 ECR Closed 后标 Done  
+
+## Motivation
+
+P2-BACKLOG 已写「星盘/运势/合盘对齐中」：主路径可跑，但 Spec 验收措辞、报告页与主页体验、H5 命名卫生与 e2e mock 偏薄，导致无法宣称星座模块 Feature Complete。
+
+## Scope
+
+### Allowed
+
+- 上列 Spec / H5 /（必要时）`internal/star` 文案或 summary 键卫生 · OpenAPI 描述补强  
+- 埋点：保持 `portrait_completed{source:star}` 与 Spec「`star_completed` / portrait_completed source=star」等价；若补 `star_completed` 别名须同步 analytics 白名单  
+- 分享：星座结果分享 payload 类型/标题与 lexicon 一致（若现用 `portrait` 类型属偏差则修正）  
+- TRACEABILITY · STATE · TEST_REPORT · CODE_REVIEW · CHANGELOG  
+
+### Forbidden（Non-goals）
+
+- **真支付网关**（支付仍 mock；另开 ECR，排期最后）  
+- 微信 OAuth / 短信 OTP · 原生分享 SDK · 短链服务  
+- 达人 / 消息 / UGC / 独立运势 Feed  
+- 换星历引擎、改宫位制（Whole Sign 冻结）、新表 migration（本 ECR **默认无 migration**）  
+- 身心节律 / 意象卡片 / Ops-D+ / 小程序业务  
+
+## Risk
+
+| Risk | Mitigation |
+|------|------------|
+| 改 Tab 内部 key 破坏深链 | 用户可见「运势」不变；URL/query 变更须兼容或写清迁移 |
+| 过度改 JSON 破坏旧报告 | 只读 `outlook`；禁止写回 `fortune`；旧库报告无 outlook 时 H5 降级空态 |
+| 文案踩 lexicon | 合盘免责已有；扫「占卜/算命」恐吓；允许运势分与匹配指数 |
+| 范围膨胀成内容大修 | 深度版长文「明显缺段」才补；不重写整包星盘文案库 |
+
+## Acceptance Criteria
+
+- [x] Spec `star-profile.md` §12 用例可映射到测试；§14 Gaps 反映本 ECR 收口结果  
+- [x] `/star`：Empty 生日表单 → Normal（轮盘 + outlook 日/周/月/年/一生 + 行运）+ Locked 深度墙；无禁用恐吓词  
+- [x] `/reports/:id` type=star：运势面板信息密度不低于主页基础层（score/label/tip + dims 或显式降级说明）  
+- [x] `/synastry`：三指数 + `charts` 五主盘 + 三推运 key 可见（无权益时 detail 剥离）  
+- [x] JSON summary **无** `fortune` 键；H5 **不读** `lucky`  
+- [x] Integration：`TestFlowStarDeepAccess` + synastry charts 键保持绿；必要时增补断言  
+- [x] H5 单测 / e2e（p2 star 路径）mock 含 outlook 最小字段  
+- [x] OpenAPI / TRACEABILITY / STATE / TEST_REPORT（CODE_REVIEW 待 Reviewer）  
+- [ ] `python3 scripts/ess-validate.py --phase review --ecr ECR-012`（Reviewer）  
+- [x] Docs + CHANGELOG；P2-BACKLOG 星座行更新  
+
+## Rollback
+
+- 回滚本 ECR 提交；不涉及 DB down migration  
+- 若仅文档 Closed 前中止：将 STATE 标 Rejected / 搁置  
+
+## Risk Review
+
+- Path: N/A（非交易）
+
+## Linked
+
+- Feature Spec: `.ai/product/feature-spec/star-profile.md`  
+- PRODUCT_SPEC: `docs/PRODUCT_SPEC/ECR-012-star-alignment.md`  
+- ENGINEERING_SPEC: `docs/ENGINEERING_SPEC/ECR-012-star-alignment.md`  
+- BACKEND_DESIGN: `docs/BACKEND_DESIGN/BD-2026-012-star-alignment.md`（BD-2026-012）  
+- HANDOFF / TASK / STATE：同号前缀  
+- 前序：ECR-003 outlook 卫生 · ECR-004/005 拆分 · P2 星座已落地  
+- 明确后置：真支付 ECR（最后）  
@@ -0,0 +1,75 @@
+# ECR-013A
+
+**Title:** Admin RBAC（角色 · 权限点 · API 强制鉴权）  
+**Status:** **Closed**  
+**Date:** 2026-08-07  
+**Approved:** 2026-08-07（Human）  
+**Coding Start Authorization:** 2026-08-07（Human）  
+**Closed:** 2026-08-07（Reviewer Approve）  
+**Parent:** WAVE0-FROZEN (`27f27a1`)  
+**Change Level: L2**（行为：管理员授权模型；栈与分层不变）  
+
+## Change
+
+1. Active Feature Spec：`.ai/product/feature-spec/ops-rbac.md`  
+2. Domain：`AdminRole` · `AdminPermission`；`AdminAccount.role_id`  
+3. API 意图：`GET/PUT /api/v1/admin/roles*` · 扩展 `GET /me` permissions  
+4. 既有 admin 写路径挂 permission；缺权 403 + AuditLog  
+5. **contract_diff**：`docs/CONTRACT_DIFF/ECR-013A.yaml`（P0）  
+6. **不含** UserStatus / 账户启停（ECR-013B）
+
+## Motivation
+
+Ops-A 管理员权限扁平；进入多运营角色与 M1+ 前必须有可审计的最小权限模型。
+
+## Scope
+
+### Allowed
+
+- 上列 Spec / Domain / API 意图 / BD Draft / AC（四类）  
+- feature-map §7 · TRACEABILITY · STATE · TASK（architect）  
+
+### Forbidden（Non-goals）
+
+- ECR-013B AccountLifecycle（另 Start Authorization）  
+- 真支付 · UGC · Prompt · 兑换码 · Crisis · 完整角色编辑 UI（本切片 API-first + me 最小展示）  
+
+## Risk
+
+| Risk | Mitigation |
+|------|------------|
+| 锁死全部管理员 | 种子 `super_admin` 不可删；bootstrap 保留 |
+| 权限码膨胀 | 本切片冻结 catalog；新增须新 ECR |
+| 与 Ops-B/C 路由遗漏挂权 | ENGINEERING_SPEC 列清单；integration 覆盖 grant/content |
+
+## Acceptance Criteria
+
+见 Spec `ops-rbac.md` L4：AC-F-01..03 · AC-S-01..04 · AC-P-01 · AC-O-01..02（实现轮勾选）
+
+契约 / 实现完成标准：
+
+- [x] L0–L4 填满  
+- [x] contract_diff 已交  
+- [x] BD Draft + HANDOFF  
+- [x] Human **Approve** ECR+BD + Coding Start Authorization  
+- [x] Migration + middleware + roles API + TEST_REPORT  
+- [x] Reviewer Approve → **Closed**  
+
+## Rollback
+
+- down migration `000015` + 回退 permission middleware  
+
+## Risk Review
+
+- Path: N/A  
+
+## Linked
+
+- Feature Spec: `.ai/product/feature-spec/ops-rbac.md`  
+- PRODUCT_SPEC: `docs/PRODUCT_SPEC/ECR-013A-admin-rbac.md`  
+- ENGINEERING_SPEC: `docs/ENGINEERING_SPEC/ECR-013A-admin-rbac.md`  
+- BACKEND_DESIGN: `docs/BACKEND_DESIGN/BD-2026-013A-admin-rbac.md`  
+- CONTRACT_DIFF: `docs/CONTRACT_DIFF/ECR-013A.yaml`  
+- TEST_REPORT: `docs/TEST_REPORT/ECR-013A.md`  
+- CODE_REVIEW: `docs/CODE_REVIEW/ECR-013A.md`  
+- Parent: WAVE0-FROZEN  
@@ -0,0 +1,72 @@
+# ECR-013B
+
+**Title:** AccountLifecycle（UserStatus 状态机 · 运营启停/封禁 · C 端拒绝）  
+**Status:** **Closed**  
+**Date:** 2026-08-07  
+**Approved:** 2026-08-07（Human）  
+**Coding Start Authorization:** 2026-08-07（Human）  
+**Closed:** 2026-08-07（Reviewer · Loop continuous）  
+**Parent:** WAVE0-FROZEN (`27f27a1`)  
+**Predecessor:** ECR-013A **Closed**  
+**Change Level: L2**（行为：账户状态强制；栈与分层不变）  
+
+## Change
+
+1. Active Feature Spec：`.ai/product/feature-spec/ops-account-lifecycle.md`  
+2. Domain：落实 `UserStatus` · `AccountStateTransition`  
+3. API 意图：`POST /admin/users/:id/status` · `GET .../status-transitions`  
+4. C 端：非 `active` → DeviceAuth/Bearer **拒绝**  
+5. RBAC additive：`admin.users.status.write`  
+6. **contract_diff**：`docs/CONTRACT_DIFF/ECR-013B.yaml`（P0）  
+7. **不含** soft-delete / UGC / 真支付  
+
+## Motivation
+
+`users.status` 已存在但无运营迁移与会话阻断；013A 权限门禁就绪后可落地最小风控闭环。
+
+## Scope
+
+### Allowed
+
+- Spec L0–L4 · Domain 对齐 · BD Draft · AC · feature-map §7 · TRACEABILITY · STATE · TASK  
+
+### Forbidden（Non-goals）
+
+- （实现轮已授权）soft-delete 仍禁；真支付 · UGC · Prompt  
+- soft-delete · GDPR 擦除  
+- 真支付 · UGC · Prompt · Crisis 深化  
+
+## Risk
+
+| Risk | Mitigation |
+|------|------------|
+| 误封超级用户/自测号 | reason 必填；Audit + transitions；可回迁 active |
+| 与 session 缓存不一致 | 每次请求读 User.status（本切片不引入长缓存） |
+| 权限码遗漏种子 | migration 写入 super_admin；integration 覆盖 |
+
+## Acceptance Criteria
+
+见 Spec `ops-account-lifecycle.md` L4：AC-F-01..04 · AC-S-01..04 · AC-P-01 · AC-O-01..02
+
+契约轮完成标准：
+
+- [x] L0–L4 填满  
+- [x] contract_diff 已交  
+- [x] BD Draft + HANDOFF（禁 coding）  
+- [x] Human **Approve** ECR+BD + Coding Start Authorization  
+- [x] Implemented + TEST_REPORT  
+- [x] Reviewer Closed  
+
+## Rollback
+
+- 契约轮：废弃 Draft  
+- 实现轮：down migration + 回退 DeviceAuth 检查  
+
+## Linked
+
+- Feature Spec: `.ai/product/feature-spec/ops-account-lifecycle.md`  
+- PRODUCT_SPEC: `docs/PRODUCT_SPEC/ECR-013B-account-lifecycle.md`  
+- ENGINEERING_SPEC: `docs/ENGINEERING_SPEC/ECR-013B-account-lifecycle.md`  
+- BACKEND_DESIGN: `docs/BACKEND_DESIGN/BD-2026-013B-account-lifecycle.md`  
+- CONTRACT_DIFF: `docs/CONTRACT_DIFF/ECR-013B.yaml`  
+- Parent: WAVE0-FROZEN · Predecessor: ECR-013A  
@@ -0,0 +1,29 @@
+# ECR-014
+
+**Title:** MembershipPlan（会员套餐配置薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN (`27f27a1`)  
+**Predecessor:** ECR-013B **Closed**  
+**Change Level: L2**
+
+## Change
+
+1. Spec `ops-membership-plan.md`  
+2. Entity `MembershipPlan` 表 + 种子 month/quarter/year  
+3. Admin GET/PUT `/membership-plans*`  
+4. Grant / CreateOrder(membership) 读表  
+5. `docs/CONTRACT_DIFF/ECR-014.yaml`  
+6. **不含** 真支付 · 兑换码 · Entitlement · ask_pack
+
+## Scope Forbidden
+
+UGC · 真支付 · soft-delete User · 新建 plan code（本切片冻结三码）
+
+## Acceptance
+
+见 Spec L4。
+
+## Linked
+
+- Spec / PRODUCT / ENGINEERING / BD-2026-014 / CONTRACT_DIFF / HANDOFF / STATE / TASK
@@ -0,0 +1,19 @@
+# ECR-015
+
+**Title:** RedemptionCode（兑换码薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-014 Closed  
+**Change Level:** L2  
+
+## Change
+
+批次生成兑换码 → C 端兑码延长 MembershipPlan 对应时长 · 可作废 · 审计  
+
+## Forbidden
+
+真支付 · UGC · ask_pack 兑换 · soft-delete  
+
+## Linked
+
+Spec `ops-redemption-code.md` · BD-2026-015 · CONTRACT_DIFF/ECR-015.yaml
@@ -0,0 +1,19 @@
+# ECR-016
+
+**Title:** UserIntelligence（用户洞察只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-015 Closed  
+**Change Level:** L2  
+
+## Change
+
+`GET /admin/users/:id/insight` 聚合报告/标签/行为快照；admin-h5 用户详情「洞察」区。  
+
+## Forbidden
+
+新表 · 写标签 · Ask 正文编辑 · 真支付 · UGC  
+
+## Linked
+
+Spec `ops-user-intelligence.md` · BD-2026-016 · CONTRACT_DIFF/ECR-016.yaml · TEST_REPORT/ECR-016.md
@@ -0,0 +1,19 @@
+# ECR-017
+
+**Title:** AskOperations（问答会话只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-016 Closed  
+**Change Level:** L2  
+
+## Change
+
+`GET /admin/ask/threads` · `GET /admin/ask/threads/:id`（AskSessionView）；权限 `admin.ask.read`；admin-h5「问答」页。  
+
+## Forbidden
+
+改消息 · Prompt/Knowledge 配置 · QualityFeedback 写 · 真支付 · UGC  
+
+## Linked
+
+Spec `ops-ask-operations.md` · BD-2026-017 · CONTRACT_DIFF/ECR-017.yaml · TEST_REPORT/ECR-017.md
@@ -0,0 +1,19 @@
+# ECR-018
+
+**Title:** Entitlement（用户权益只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-017 Closed  
+**Change Level:** L2  
+
+## Change
+
+`GET /admin/users/:id/entitlements` 聚合 Membership/DeepAccess/问答额度；admin-h5 用户详情「权益」区。  
+
+## Forbidden
+
+真支付 · 新权益表 · 改订单 · UGC  
+
+## Linked
+
+Spec `ops-entitlement.md` · BD-2026-018 · CONTRACT_DIFF/ECR-018.yaml · TEST_REPORT/ECR-018.md
@@ -0,0 +1,19 @@
+# ECR-019
+
+**Title:** ContentSafety · FilterRule（只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-07（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-018 Closed  
+**Change Level:** L2  
+
+## Change
+
+`filter_rules` + `GET /admin/content-safety/filter-rules*` · `POST .../evaluate`；权限 `admin.content_safety.read`；admin-h5「安全」页。  
+
+## Forbidden
+
+ModerationCase 写 · Crisis 配置写 · UGC · 真支付 · 厂商审核接入  
+
+## Linked
+
+Spec `ops-content-safety.md` · BD-2026-019 · CONTRACT_DIFF/ECR-019.yaml · TEST_REPORT/ECR-019.md
--- a/Show More
+++ b/Show More