T1-9 — IEVS Resolution → Worker Accept/Reject → Verified Income Write-Back (#677)

crates/canopy-contracts-snap/src/verification.rs: add [serde(default)] resolved_by_sub: Option<String> to ResolveDiscrepancyRequest + relax resolved_by to [serde(default)] Option<PersonId> (no current caller sends a meaningful worker PersonId); add resolved_by_sub to IevsDiscrepancyRow / IevsDiscrepancy / From<Row>. New migration services/canopy-snap/migrations/20260620000000_add_ discrepancy_resolved_by_sub.sql (later than the latest 20260518004851): ALTER TABLE ievs_discrepancies ADD COLUMN IF NOT EXISTS resolved_by_sub TEXT (nullable; ADR-016 expand-step). Change store::verification::resolve_discrepancy to take &mut Transaction + resolved_by_sub: Option<&str>. New events.rs helper publish_ievs_discrepancy_resolved staging EventEnvelope::new(SOURCE, "ievs.discrepancy_resolved", json!{ "author": {"author_type":"worker","sub":…}, "discrepancy_id", "application_id", "person_id", "resolution_status", "income_type", "program":"snap" }) — no dollar amount. The handler (api/verification_handler.rs) gains Extension<Publisher>, opens a tx, flips + stages + commits; valid_statuses gains accepted_verified + rejected. A unit test asserts the event payload carries no restricted fields (mirror abawd_event_payload_has_no_restricted_fields).

New services/canopy-web/src/api/ievs.rs (mod ievs; in api/mod.rs), mirroring income.rs and reusing the fact_editor helpers. Two POST routes /actions/ievs/accept + /actions/ievs/reject. AcceptDiscrepancyForm (household_id, person_id, program, discrepancy_id, income_type, verified_amount [visible, default = the IEVS amount, worker-overridable], frequency [hidden, default monthly], effective_date [hidden, default today via chrono::Utc::now().date_naive()], employer_name, income_id [matched fact_id or empty], target_section); RejectDiscrepancyForm (… + resolution_notes). A sibling body builder mirrors income_claim_body with source:"ievs"
origin:"ievs:{discrepancy_id}" (no proposed_value).

accept_discrepancy: deny_unless_in_scope(&worker, &form.program, &form.household_id)? → with_service_identity → resolve the target fact_id idempotently (matched income_id; else an existing income fact in /full with provenance.origin == "ievs:{discrepancy_id}"; else new — origin is on the /full wire but ProvenanceView doesn’t parse it today, so read the raw Value or extend ProvenanceView) → POST /v1/persons/{id}/income/claims → then clients.snap.put /v1/verification/discrepancies/{id}/resolve (accepted_verified, resolved_by_sub = worker.worker_id) → redirect_to_case. reject_discrepancy: gate → clients.snap.put /resolve (rejected, notes, resolved_by_sub) → redirect; no persons write. Ordering = persons-first (the verified fact is the load-bearing determination input; the origin-based fact resolution makes a retry idempotent).

render_income_tab (case_detail.rs:1953): add discrepancy_id (from d["id"])
ievs_verified_raw (from d["verified_monthly_income"]) to IncomeRow (and every construction site + test fixture — the T1-8 fan-out lesson), populated in both merge branches. Auto-pair a discrepancy to a self-report income_id only when exactly one same-type self-report exists; multiple → accept-to-new-fact (income_id empty) + a note. Change the dead resolution_status == "resolved" check (:2030/:2089): open (is_disc) only while pending/absent; accepted_verified → is_verified (✓ Verified pill); rejected → is_rejected (neutral pill); only PENDING discrepancies synthesize an unreported-hit row. templates/cases/tab_income.html: on discrepancy rows ({% if !income.discrepancy_id.is_empty() %}) an Accept <details> form (hidden _csrf/context/income_id/frequency/effective_date, one visible verified_amount defaulting to {{ income.ievs_verified_raw }}) + a Reject form (optional resolution_notes).

Integration (devstack, mirror services/canopy-persons/tests/fact_version_writes_ test.rs): accept-new-fact → AcceptedVerified + claim_source='ievs'
origin='ievs:{id}' + appears in /v1/households/{id}/full, with proposed_value NULL (no figure in persons); accept-as-correction supersedes the self-report; double-accept of an unreported hit → exactly one income fact (idempotent); snap resolve flips status + records resolved_by_sub, reject stages ievs.discrepancy_resolved with author.sub + no figure + no income_versions row; a 403 gate-deny on an out-of-scope worker (both handlers). Render units (case_detail.rs): the accept/reject forms wire on a discrepancy row; an accepted_verified row shows ✓ Verified not Discrepancy; ambiguous same-type → accept-as-new-fact. E2E tests/e2e/specs/worker-ievs-resolution.spec.ts (mirror worker-fact-editors.spec.ts + gotoWorkerCaseSection; the noop adapter yields a discrepancy for the high-wages SSN-suffix band 30–49; test.skip if the seed exposes none). Docs: api/canopy-web.adoc (new /actions/ievs/* + cross-service path + 403), api/canopy-snap.adoc (resolved_by_sub + the event); this plan’s MR1 cells → Done; CHANGELOG.adoc == Unreleased; master-plan T1-9 row → In progress.

services/canopy-web/src/dashboard/panels/ievs_alerts.rs + its template: change the per-row deep-link to /cases/{household_id}?program=snap&focus_section=income so the worker lands on the income tab where MR1’s accept/reject forms live. Panel source/producer unchanged (noop IEVS tests stay green). Update the panel render test for the new query.

Add a snap_url to the CLI profile config (tools/canopy-cli/src/config.rs — it has no snap URL today). New tools/canopy-cli/src/cmd/verification.rs + a Verification subcommand in main.rs: list-discrepancies (snap GET), accept (composes persons /claims source:ievs + snap /resolve accepted_verified), reject (snap /resolve rejected). ApiClient::put already exists. A CLI accept + reject roundtrip test.

Antora api pages; this plan Status → Done + an As-built note (the ADR-004-clean realization, the partial-failure bounded limitation, the resolved_by_sub ADR-019 bridge); master-plan T1-9 row → Done (YYYY-MM-DD) — <sha> + reconcile its Design note (accept = worker-verified version source=ievs + origin, the figure stays snap-local; reject = snap flip + attributed event; noop adapter untouched); CHANGELOG Changed entry. No .claude/CLAUDE.md change (only the final MR of the epic flips its status tables; T1-9 is not the last epic unit). Close #677 with the mandatory closing comment.