ADR-056: SG/NRSG (UAS 552/550) Guardianship-Subsidy Flow — Two-Step Enrollment, Witnessed Activation, Payments-Begin Boundary

POST /v1/financial/subsidy-agreements is ONE program-tagged request (#[serde(tag = "program")]): the err arm is the #1069 one-shot body VERBATIM (its untagged serialization — and therefore every persisted F8 canonical hash — is unchanged; the wire gains only the tag), the sg/nrsg arms share the guardianship body, and the four closed cohorts refuse with the named closed-program problem (the #1071 import is their only path). Mixed producer/consumer versions are a recorded pre-1.0 non-goal: deploy the BFF and financial together.

The guardianship arms mint a PENDING agreement whose interval and revision-1 terms open at signed_at. ALL attribution flows from a county-floor ApprovalAction::CreatePending proof — the stamp-based generic create_agreement was DELETED outright (partial de-stamping would have left status/terms dates, anchors, and names forgeable by any store caller); only the #1071 import remains stamp-based, for historical approvals no session can re-authorize. Creation takes BOTH family history locks in a fixed order and enforces family exclusivity (one OPEN sg-or-nrsg enrollment per child — they are alternative classifications, not parallel programs; a partial unique index is the backstop), guardianship-family-only predecessor lineage (the ERR→SG handoff deliberately carries NO predecessor link — it is a program handoff, not a re-application), and the U3 classification rule: the caller chooses sg vs nrsg (no authoritative relationship source exists — kinship placements include fictive kin), with the TANF degree-of-relationship evidence reference REQUIRED for sg and optional for nrsg. The anchoring placement must exist and be ACTIVE (S2S-verified): the placement IS the residence-under-supervision evidence; deliberately NO placement-type constraint and NO residence floor at create (the floor binds where the transfer exists — activation). Citizenship/residency, child income, funding availability, and caregiver-identity-on-placement linkage are RECORDED UNVERIFIED manual preconditions (attestations; #1114 tracks hard checks).

POST /v1/financial/subsidy-agreements/{id}/activate performs pending → active at business_date = transfer_on, where the transfer date is DERIVED — the anchoring placement’s Eastern-projected end date from the S2S read — never operator-typed. Witnesses, API-side fail-closed: the placement ended with end_reason = guardianship, child match, permanency goal ≠ reunification (the non-reunification-order proxy, ⁂), plus the REQUIRED court-order evidence reference and the OPTIONAL past-dated TANF-termination attestation. The STORE re-derives every DB-side rule from the locked row: strict signed_at < transfer_on (F1 — same-day is refused; the pending interval would be empty, and the literal text says "before"; also a DB CHECK), the residence floor from the stored placement_started_on snapshot (clamped calendar-month arithmetic — the S2S check is advisory UX, the store check is the guarantee), never-future dates, and the −12-month reconcile floor (older transfers need the #1115 backpay path).

Authority is ApprovalAction::ActivateGuardianship (county floor — the County Director approval the policy names), whose mint-time binding admits exactly its own action AND the one Transition{Pending→Active} shape it writes (the enforcement-leg precedent). The PUBLIC transition path refuses native-family pending → active outright (the F4 belt); imported pending rows have NO activation path (#1116 — decided by #1071/ADR-057: open-pending imports are unrepresentable at the store, so this refusal is belt-only).

Replay honesty (F4): an exact retry after success — Active with the SAME derived transfer — is a recognized replay (200, zero writes, no event); any other non-pending state is an honest CAS-class 409, never the F5 bypass-guard message a fall-through would produce. Activation refuses while ANY other paying-capable (active/suspended) agreement exists for the child (U2): the predecessor ERR terminates FIRST, so the handoff order is deterministic and the generator never sees two payable programs (its MultiProgram fail-closed arbitration remains the backstop).

Activation derives and STORES payments_begin_month = max(first-of-month-after(transfer_on), first-of-month-after(tanf_terminated_on)). The generator’s single month judgment gains one rule — AFTER per-diem exclusivity, BEFORE the active-as-of rule: a month before the boundary skips with the named BeforePaymentsBegin reason, counts, and voids stray undisbursed rows (subsidy_reconciliation). Placement ahead of the active-as-of rule is the point: a transfer ON the 1st leaves the agreement ACTIVE at month start while the strict "month after transfer" text still forbids payment. The rule keys on the flow-written FACT: legacy/imported rows carry a NULL boundary and keep the pre-#1070 judgment. Consequence, recorded prominently (⁂ #1073 item 5): a 1st-of-month transfer leaves that month unpaid by BOTH programs — the truth-dated ERR is inactive at month start and the SG sits behind its boundary; mid-month transfers keep ERR’s full final month (standing whole-month semantics).

22.9 runs review clocks from the initial or most recent APPROVAL — never from the transfer. Creation writes PROVISIONAL anchors (the create act’s business date +12/+6 months); activation — itself a county-director approval act — re-derives both anchors from ITS date before maintain_chain_after_transition materializes the cycle-1 slots. This is the ONE permitted anchor rewrite: in-tx, on exactly the pending → active edge, guarded by a zero-review-rows assertion (a bypass row would be silently orphaned — refused instead), audited by the transitioned event + the interval’s approval stamp. Dues therefore can never pre-date activation, and long pendencies have DEFINED behavior.

placement.ended now rides a shared typed contract (PlacementEndedPayload — the producer’s ad-hoc json! and the consumer’s reason-blind local mirror are gone). The financial consumer branches its WARN arms on the reason: a guardianship ending names the handoff steps for a stranded active ERR and the ready-to-activate pending family agreement (or the support gap when none exists); a non-guardianship ending with a pending family agreement names withdraw/decline. WARNs only — automation is deferred with its own consent knob (#1113, U5). The new guardianship_finalized termination reason is ERR-only at the store (anchored placement required), county floor (finalization is the EXPECTED permanency outcome — guardianship_dissolved stays regional as the exceptional reversal), and the API witnesses it S2S: the anchored placement ended by guardianship, child match, and business_date REQUIRED to equal the derived end date (truth-dated; a typed refusal names the expected date).

CRAIG_FINANCIALSUBSIDY_SGENABLED (default OFF; ONE knob for the family — sg and nrsg are one A&A flow and one money-policy family) gates the create arms and the activate endpoint ONLY. Existing agreements' lifecycle — generator, ALL transitions including the corrective guardianship_finalized, reviews, sweep — is deliberately grandfathered: a knob-off flip must never strand owed money or block the corrective ERR termination. The refusal direction is test-pinned (typed 403 naming the knob); the grandfather direction is STRUCTURAL — no lifecycle handler extracts the gate (a gate-off lifecycle pin would need a per-test env flip on the shared devstack; recorded, not faked). Enabling is the operator’s recorded consent to the ⁂ #1073 readings (the twelve-item list rides #1073): the 6-month residence floor, strict pre-transfer signing, transfer = the placement’s end date, the TANF-shifted boundary with the attestation posture, the 1st-of-month gap month, approval-anchored dues, the county-floor handoff reason, the family knob itself, no placement-type constraint at create, the reunification-goal proxy, the unverified manual preconditions, and the per-program relationship-evidence rule.