ADR-055: ERR (UAS 542) Kinship-Subsidy Flow — One-Shot Enrollment, Month Judgment, Per-Diem Handoff

Authority (F3): ApprovalAction::CreateActive is its own proof kind at the county floor — a transition proof can never mint an agreement, and vice versa (M0’s action-bound proofs).

Derivations, never inputs: case_id and assigned_worker_sub come from the placement record; renewal_review_due = effective_from + 12 months; foster_home_approval_due = placement_started_on + policy.clock_days. Evidence keys are honestly named UNVERIFIED references.

Backdating floor (F2): coverage below current month − 12 is refused naming the floor — the generator’s reach ends there, and an approved but never-payable agreement is a lie.

Placement S2S: craig-placement’s minimal GET /v1/placement/placements/{id}/subsidy-eligibility returns the six fields creation needs; started_on is computed PLACEMENT-side via the Eastern business clock so financial never converts timestamps. Transport failure is a fail-closed 503; service-scoped narrowing is #1107.

Policy seam (U1): the fail-closed policy lookup (None → 400); Georgia carries calendar-day proration, the 120-day clock, and the kinship-only qualifying set. As-built after the #1072 lift: the constants live in the GeorgiaBundle’s subsidy_policy() (craig-state-bundle SubsidyPolicySpec), boot-resolved by craig_financial::subsidy::bundle and consulted through SubsidyJurisdictionReference::policy_for — same fail-closed contract, now also refusing on a bundle↔jurisdiction mismatch.

Scan shape: ERR agreements with an ACTIVE or SUSPENDED open head that began before as_of, joined to the child’s EARLIEST live placement-origin payment with period_start ∈ [head start, as_of] — deterministic (period_start, id) evidence, pinned (payment + head interval) in the candidate, served by the idx_payments_perdiem_by_child partial index (EXPLAIN-pinned: the index order IS the earliest contract).

Same-placement witness (F7): only a per diem on the agreement’s OWN anchor placement is a handoff. A different placement (or a missing anchor) is a MOVED-CHILD report — counted, previewed, never auto-terminated (the operator acts via child_no_longer_in_home).

Truth-dating (F6): the termination’s business_date = max(perdiem_started_on, head start + 1 day) — the money and status ledgers agree, and the transition primitive enqueues the overlap months for reconciliation naturally. This is the ONE exception to ADR-053’s enforcement-dates-are-today rule, and it is an exception because the date is a recorded FACT, not a policy choice.

Precedence: handoff candidates are excluded from legs 1/2 unconditionally — suspending an agreement whose coverage already ended at the truth date would write a wrong interval on top of it. With the knob off, the backlog waits visibly for the operator.

Enforcement: per-agreement transaction under the pay-exclusion child lock (every per-diem writer takes it, including the placement.ended void handler — a void serializes to drift-before or correction-after, never mid-flight), with an in-tx re-verify of the pinned evidence (void, backdated earlier row, or re-point → drift skip, never force). Authority is the third enforcement leg (auto_per_diem_handoff, default OFF), bound to exactly the per_diem_begins termination shape — reason-disjoint from leg 2.

Known scan limit (recorded): the window is [head start, as_of], so a per diem that began BEFORE a later manual suspension head is invisible to the sweep — the store’s manual per_diem_begins witness shares the same window. The manual path (operator terminates with the evidence in view) remains; widening the window would let a prior placement’s trailing billing masquerade as a handoff.