feat(ECR-013B): AccountLifecycle Closed；启用 Loop 连续执行

UserStatus 迁移、DeviceAuth 拒绝非 active、admin-h5 CTA；
Reviewer Closed。Human 授权 LOOP_AUTHORIZATION（免逐闸确认）。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/HANDOFF/ECR-013B-architect-to-engineer.md

@@ -5,11 +5,8 @@
 **Parent:** WAVE0-FROZEN (`27f27a1`)  
 **Predecessor:** ECR-013A **Closed**
 
-**Start Authorization: 2026-08-07（Human）→ Contract Definition only**  
-**ECR-013B + BD-2026-013B = Draft** — **禁止改 `apps/`** 直至：
-
-1. Human **Approve** ECR-013B + BD-2026-013B  
-2. 另发 **coding Start Authorization**
+**ECR-013B + BD-2026-013B = Approved（2026-08-07 Human）**  
+**Coding Start Authorization: 2026-08-07（Human）→ Engineer 可改 `apps/`。**
 
 ## Consume
 
@@ -17,7 +14,7 @@
 2. ECR / PRODUCT / ENGINEERING / BD / `docs/CONTRACT_DIFF/ECR-013B.yaml`  
 3. `.ai/domain/boundary-rules.md` · `glossary.yaml` · `entity-catalog.md`  
 
-## Do（仅 Approve + coding auth 后）
+## Do
 
 按 ENGINEERING_SPEC Implement order。
 

docs/HANDOFF/ECR-013B-engineer-to-reviewer.md

@@ -0,0 +1,20 @@
+# HANDOFF — ECR-013B Engineer → Reviewer
+
+## Done
+
+- Migration `000016`：`account_state_transitions` + `admin.users.status.write` 种子
+- Admin API：`POST /users/:id/status` · `GET .../status-transitions`
+- DeviceAuth / Bearer：非 `active` → **401**（code 40113）
+- Auth OpenLogin 拒绝非 active 账户发 session
+- admin-h5 用户详情：状态 CTA + 迁移列表（权限门控）
+- Integration `TestAccountLifecycle` 映射 AC-F/S/P/O
+- `docs/TEST_REPORT/ECR-013B.md`
+
+## Evidence
+
+`docs/TEST_REPORT/ECR-013B.md` · Spec `ops-account-lifecycle.md`
+
+## Ask
+
+Reviewer 勾选 `docs/CODE_REVIEW/ECR-013B.md`；Approve 后 Closed。  
+勿自动开下一 ECR。