Plan: ADH IPV-not-established reprocesses the over-issuance as a non-fraud (IHE) claim (#981)

record_decision becomes transactional (outbox). It currently runs bare state.db.inner() calls and takes no Publisher. Refactor it to a single tx + inject Extension<Publisher> and stage the event in the same tx (mirroring impose_disqualification, ipv/api.rs:482), so the cleared write + the event commit atomically. This forces store surgery: store::record_adh_decision (ipv/store.rs:136) and store::clear_ipv_case (ipv/store.rs:202) are &PgPool-only — convert both to <'e, E: sqlx::PgExecutor<'e>> (their only caller is ipv/api.rs; &PgPool still satisfies PgExecutor, so nothing else breaks). get_ipv_case stays pool-based for the post-commit re-fetch.

Guard + convert the amount in one helper. overissuance_amount is Option<Decimal> dollars; create_claim rejects ≤ 0. A pure overissuance_to_cents(Option<Decimal>) → Option<i64> whose contract is the guard: Some(cents) only when cents > 0, else None — so None input, a ≤0 amount, AND a sub-cent amount (0 < d < 0.01 → truncates to 0) all yield None. Truncating saturating cast (d * Decimal::from(100)).to_i64().unwrap_or(i64::MAX) (idiom at services/canopy-appeals/src/api/mod.rs:567-580) then drop ≤0. The call site is if let Some(cents) = overissuance_to_cents(case.overissuance_amount) { publish… } — no separate >0 check.

Program slug is canonicalized on the wire (producer side). The referral stores req.program verbatim (ipv/api.rs:92) and the contract doc example wrongly shows "SNAP", so a caller could store an uppercase program; the consumer keys on lowercase "snap". normalize_program lowercases at publish time; the consumer additionally compares case-insensitively (defense in depth).

The snap subscriber opens the claim AND emits the notice. After create_claim (ClaimBasis::InadvertentHouseholdError, error_type = "ipv_not_established", determination_id: None — IPV cases have none), it publishes snap.overpayment_claimed in the same tx, routing through manifest.toml:404 to the overpayment_notice. Three mechanics the named templates get subtly wrong:

The journey is service-driven; the notice is the portal read-back. No ADH UI exists, so the spec drives the flow via a new TS IPV given-helper (service-caller token). Oracles: pollOverpaymentClaim (the IHE claim — claim_basis == "inadvertent_household_error", error_type == "ipv_not_established", claim_amount_cents == the over-issuance in cents) + pollNoticeMatching (the specific overpayment demand notice on the worker Notices tab, matched by subject text, not a bare count). No screenshots (walkthrough is blocked).

rust_decimal is serde-str workspace-wide, so overissuance_amount (de)serializes as a JSON string — the TS helper must send "1200", not the number 1200 (a number 4xx’s the referral).

program must be lowercase "snap" on the referral (the subscriber filter is case-sensitive at the DB layer; mirror appeals_test.rs’s `"snap", not the contract doc’s "SNAP").

B1 (route modules >500 LOC, locked 18) — edits are in src/ipv/api.rs + src/main.rs, not services//src/api/.rs, so B1 is unaffected.

B2 (fns >100) — keep record_decision ≤100 (extract a reprocess_not_established helper if needed).

B3a (serde_json::Value literal in src, locked 745) — the snap subscriber reads envelope.payload["…"] untyped (mirrors the appeal subscriber; no literal serde_json::Value text) and the appeals publisher uses serde_json::json! — neither adds to the count.

Add pure overissuance_to_cents(Option<Decimal>) → Option<i64> per the guard contract above; add a J7 comment justifying unwrap_or(i64::MAX) saturation.

Add Extension(publisher): Extension<Publisher> to record_decision; wrap its writes in one state.db.inner().begin() tx (mirror impose_disqualification). On ipv_not_confirmed, after clear_ipv_case + the cleared timeline event, if let Some(cents) = overissuance_to_cents(case.overissuance_amount), call events::publish_ipv_not_established(&mut tx, &publisher, …) with the case’s household_id/person_id/program; commit. Keep the fn ≤100 LOC.

Convert store::record_adh_decision and store::clear_ipv_case to <'e, E: sqlx::PgExecutor<'e>>.

Clean-skip ONLY on program mismatch — if !payload["program"].as_str().is_some_and(|p| p.eq_ignore_ascii_case("snap")) { return Ok(()); }.

Error (not skip) on malformed required fields — missing person_id/household_id or amount_cents ≤ 0 is a producer bug on an internal event, so return Err → retry/DLQ.

create_claim(&mut **tx, …InadvertentHouseholdError, error_type="ipv_not_established", determination_id: None…)? then events::publish_overpayment_claimed(&mut *tx, publisher, &OverpaymentClaimedEvent{ …, overpayment_amount: format!("${}", Decimal::new(cents, 2)), claim_basis: "inadvertent_household_error" })? (derefs + error-propagation per the Design decision).

Wiring: clone boot.publisher before .layer(axum::Extension(boot.publisher)) (snap/src/main.rs:197); beside the appeal.overpayment_assessed subscription, subscribe("canopy-snap.ipv-not-established", &["ipv.not_established"], …, 5, move |envelope, tx| { let publisher = ipv_ihe_publisher.clone(); Box::pin(async move { handle_ipv_not_established(&mut *tx, &publisher, &envelope.payload).await }) }).

proptest (mandatory — numeric logic) for overissuance_to_cents over a bounded whole-cent strategy cents in 1i64..=100_000_000_00; let d = Decimal::new(cents, 2) ⇒ overissuance_to_cents(Some(d)) == Some(cents), never panics. Plus example cases: None, "0.00", "-5", "0.004" → None; "1200.00" → Some(120000).

normalize_program unit: "SNAP" → "snap".

Appeals integration: a new ipv_not_confirmed case (create → schedule → send-notice → record-decision with overissuance_amount) asserting status flips to cleared (extend ipv_record_decision_sets_outcome).

SNAP handler test (the riskiest surface): (a) valid SNAP payload → one inadvertent_household_error claim + a staged snap.overpayment_claimed outbox row; (b) non-SNAP program → clean no-op (Ok, no claim); (c) malformed (missing person_id / amount_cents ≤ 0) → Err.

driveAdhNotEstablished(householdId, personId, {overissuanceAmount}) mirroring the appeals_test.rs sequence (NOT the stale AppealsClient doc-comment): POST /v1/ipv/cases (all required fields — program: "snap" lowercase, overissuance_amount: String(overissuanceAmount) as a string) → PUT …/schedule-adh {adh_date: today+45d} → PUT …/send-notice {} → PUT …/record-decision {decision:"ipv_not_confirmed"}. Returns ipv_case_id + amount; null on devstack-down; loud throw on non-2xx. Export from given/index.ts.

Journey spec journey-snap-adh-not-established-ihe-claim.spec.ts — mirror only the #980 skeleton’s doc-header / describe / test.skip(build()===null); DROP all screenshot scaffolding. describe: journey: an ADH that finds no IPV reprocesses the over-issuance as a non-fraud IHE claim. Oracles: pollOverpaymentClaim(householdId, {errorType:'ipv_not_established'}) (basis/amount/status) + pollNoticeMatching(page, {householdId, program:'snap', textContains:'Overpayment'}).

pollNoticeMatching(page, {householdId, program, textContains, timeoutMs?}) in helpers.ts — opens the case Notices tab (reuse openCaseTab) and polls until a table.data-table tbody tr row’s text contains textContains; throws on timeout.

snap.toml row :2455 — kind = "e2e-spec" (file + describe verbatim) and walkthrough_blocked_by = ["#<new UI issue>"] (no walkthrough binding). Row → Covered [Journey].

CHANGELOG.adoc == Unreleased / === Added: the reprocessing (appeals event + snap subscriber + demand notice), the TS helper + journey, the binding + block; note the deliberate divergence from the notice-silent appeal pattern (#994’s gap).

services.adoc — add ipv.not_established to the canopy-appeals Publishes list (:245) AND update the canopy-snap paragraph (~:264) to record it now subscribes ipv.not_established and publishes snap.overpayment_claimed.