UpdateProfile

Editable profile fields (control plane; empty until the user sets them). email and status above stay read-only — email is the IdP's, status is admin-managed.

Kept wire-identical with concierge.v1.UserProfile (the cabinet TS is aliased to the concierge shape). The identity plane OWNS kyc/role; the money plane mirrors them for gating but does not re-serve them on its self-service GetMe, so these stay default here — the fields exist for cross-plane wire parity.

The tier ladder, written down here because the money plane is what ENFORCES it and no authoritative range was stated in either plane before this: 0 — registered. Sign-up plus a confirmed email address; nothing else is verified. No deposit address is issued and no withdrawal is accepted. 1 — verified. Identity document, liveness, a face match against the document, and a passed sanctions/PEP screen. Deposits and withdrawals are permitted. 2 — enhanced. Everything in 1 plus proof of address and source of funds. Carries raised transaction limits (the limits themselves are not modelled yet). 3 — elevated. Enhanced due diligence; set only by a human reviewer, never automatically. Banking gates BOTH directions of money movement on >= 1. The value is set by an admin in the identity plane and mirrored onto the money plane by the one-way lifecycle bridge; banking never authors it.

True when role above came from concierge's OWNER_SUBJECTS emergency allowlist rather than from users.role. Carried here only for wire parity — the money plane has no allowlist of its own and never sets it.

WHY the account is disabled, and therefore who may undo it — concierge splits the old blocking verb into a lapsing admin_hold and a ratified governance verdict, and an empty string is a THIRD case: an account suspended before the field existed, which keeps the one-act, never-lapsing semantics it was actually suspended under.

Carried here only for wire parity, like role_is_break_glass above: the money plane learns of a freeze through the one-way lifecycle bridge's SUSPENDED/REINSTATED events, never by reading this, and never sets it. Absent them the parity round trip in cabinet/backend/tests/concierge_parity.rs re-encodes short and fails, which is exactly the drift that test exists to catch.

Parity with concierge.v1.UserProfile.username, like the two above.