ecr: ECR-013B
capability: AccountLifecycle
bounded_context: Identity_Profile
parent: WAVE0-FROZEN
predecessor: ECR-013A
change:
  type: additive
breaking_change: false
migration_required: true
compatibility_notes: >
  users.status already exists (default active).
  Non-active users begin to be rejected by DeviceAuth/Bearer (behavior tightening).
  New table account_state_transitions (append-only).
  RBAC catalog additive: admin.users.status.write seeded to super_admin.

entities:
  - name: UserStatus
    before:
      fields: [status string on users]
      notes: no enforced transitions
    after:
      values: [active, disabled, banned, suspended]
      machine: enforced edges
  - name: AccountStateTransition
    before: null
    after:
      fields: [id, user_id, from_status, to_status, admin_id, reason, created_at]
  - name: AdminPermission
    before:
      catalog_ref: ECR-013A
    after:
      catalog_additive:
        - admin.users.status.write

apis:
  - method: POST
    path: /api/v1/admin/users/{id}/status
    change: added
  - method: GET
    path: /api/v1/admin/users/{id}/status-transitions
    change: added

security_impact:
  - "C-end reject when User.status != active"
  - "RequirePermission admin.users.status.write on POST status"
  - "403 + AuditLog on deny"

observability_impact:
  - "AuditLog users.status.transition"
  - "account_state_transitions append-only"