Plan: ADR-002 Amendment 1 — async/bulk determination variant (mass-change machinery) (#1237, epic &73)

Epic: &73
Issue: #1237 (priority::high)
Branch: feature/1237-adr002-async-bulk

Scale-audit finding H6 (epic &73, 2026-07-25): a determination is only ever triggered by a synchronous, single-attempt, ~30-call HTTP fan-out per household inside one interactive request lifetime (services/canopy-eligibility/src/orchestrator.rs:1398-1412). There is no queued/bulk path and no async trigger, so a mandatory mass change — the canonical case being the annual 7 CFR 273.12(e) COLA rebudgeting of every ongoing SNAP case (canopy-policy pins snap-cola to Oct 1 with grace_days=0; GA ≈ 800K households ≈ 6.7h of saturated synchronous fan-out best-case) — has no contract-level home, and a naive bulk driver would collide with the one-pending-slot invariant (idx_unique_pending_request) and starve live interactive determinations. The bulk re-determination driver (#1213) needs the contract variant specified first so signing/verification semantics survive the async path. This amendment is that keystone; it pairs with the ADR-001 Amendment 1 bulk-read contract (#1235) — bulk determinations were explicitly deferred there to here.

The authoritative contract is ADR-002 Amendment 1 D1–D10; a contextless implementer reads that first.

The amendment governs the determination contract only. Explicitly out of scope (owned by #1133): enrollment’s adjust-in-place vs supersede-under-the-#1130-fence choice, the 7 CFR 273.13 reduction-type adverse-action routing for decreases, lifecycle_revision (#1095) fencing, current-month pending-issuance handling, and the continued-benefits / CB-on-appeal interaction. Two look-alike "409/park" invariants live at different services and MUST NOT be conflated: eligibility’s one-pending-determination-slot (idx_unique_pending_request, handled by #1213) vs enrollment’s one-live-enrollment-per-household #1130 fence (handled by #1133). The amendment may reference #1130 as the reason "emit does not imply enrolled" but does not specify how enrollment resolves the collision.

Endpoint/event/table Antora pages (the determination.requested contract, the async 202 shape, the eligibility 409/deferral doc flip) land in the child implementation MRs, not here.

All decisions resolved. Five user-facing calls were surfaced from the understand-phase synthesis and confirmed: (a) async transport = canopy-eligibility owns producer + bulk consumer, the consumer calls the existing POST /v1/eligibility/determine (the orchestration entry, which fans out to each program’s signed /v1/determine) — smallest ADR-002 delta, JWS path unchanged; (b) the initial-vs-re-determination signal reuses the existing signed previous_determination_id (ADR-028 §57) for the supersession linkage (no new field), with a typed trigger enum as the authoritative classifier since previous_determination_id’s `None is tri-valued; (c) an already-enrolled re-determination is blessed as a first-class contract outcome now, with the enrollment PARK/409 as the bridge until #1133; (d) a bulk member colliding with a live interactive determination defers-and-requeues (interactive always wins the slot); (e) accessed_by for the FTI chain = real originating-worker actor else a reserved system principal encoding the cohort_run/job id. The remaining nine decisions are mechanical defaults recorded in the ADR. Adversarial review corrected the initial draft’s headline supersedes framing: the signed field already exists as ADR-028 §57’s previous_determination_id, so A1 reuses (not owns) it, and the transport endpoint is the orchestrator entry /v1/eligibility/determine, not the program /v1/determine.