S-19a · ACL writes the RegisterRecord to Objecten on approval (closes #149) (#151)

Closes #149.

**Outcome:** approving a registration now writes the canonical register record to the **Objecten** API as a `RegisterRecord` object, alongside the ZGW eindstatus. OpenZaak holds the process, Objecten holds the register (ADR-0028). The write goes through the ACL (§8.1) and is idempotent on the zaak id, so a replayed approval updates the existing object rather than creating a second one.

S-19 (#20) was split first (CLAUDE.md §13) — it bundled this with re-sourcing the read projection, which is now #150.

### What landed

- `IRegisterRecordGateway` + `RegisterRecord` in `Acl.Application`; `ObjectenGateway` in `Acl.Infrastructure` (static Token auth, CRS headers, objecttype resolved by name to its highest **published** version).
- `AclService.ApproveZaakAsync` writes the record after the eindstatus, keyed on the zaak UUID with the zaak's identificatie as reference.
- Compose wiring for both stacks; `ADR-0028`; demo note; PRD §15 out-of-scope line retired.

### Three things only a live stack found

Running the gateway against a real Objecten + Objecttypen pair while writing this turned up blockers CI would have hit after the fact:

1. **Objecten rejects an objecttype it has not been configured with**, by UUID — assigned at seed time by a one-shot that runs *after* Objecten's static setup_configuration. The UUID is now pinned on both sides.
2. **Objecten 500s on every write when its Notificaties config is absent** (`notifications_api_common` raises rather than skipping). Objecten → NRC has no broker, worker, kanaal or abonnement, so notifications are **disabled** rather than wired to drop every message; #150 turns them on for real.
3. **Objecttypen echoes the request Host into the objecttype `url`**, and Objecten only accepts the one matching its configured `api_root` — so the ACL must read Objecttypen at `http://objecttypen:8000`. This is why the new integration test only passes inside the compose network.

All three are recorded in ADR-0028.

### Verification

- `ObjectenGatewayIntegrationTests` (verify-acl, in-network): two writes for one id leave exactly one object with the second write's status. **Passing locally against live Objecten.**
- The **Playwright happy path** asserts, after the behandelaar approves, that Objecten holds exactly one `RegisterRecord` for *that* reference — missing, duplicated, or non-public-safe all fail.
- ACL mutation score **92.23%** (baseline 91.37%, break 90).
- `make lint` / `make unit` green locally; full-stack `make verify` runs in CI.

## Definition of Done

- [x] A linked Gitea issue exists (#149).
- [x] Failing test written and committed first.
- [x] Implementation makes the test pass.
- [x] Refactor commit follows if structure improved.
- [x] Conventional Commit messages referencing the issue (`refs #149`).
- [x] All Gitea Actions CI jobs green (run 684).
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (verify-stack step 1).
- [x] Docs touched — ADR-0028, demo note, PRD §15, BACKLOG.
- [x] ADR added: `docs/architecture/adr-0028-objecten-holds-the-register.md`.
- [x] Demo note appended to `docs/demo-script.md`.
- [x] Closed by the merging PR (`closes #149`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #151

services/acl/Acl.IntegrationTests/ObjectenGatewayIntegrationTests.cs

@@ -0,0 +1,105 @@
+using Acl.Application;
+using Acl.Infrastructure;
+
+namespace Acl.IntegrationTests;
+
+/// <summary>
+/// S-19a (#149): the ObjectenGateway against a *real* Objecten + Objecttypen pair. The stubbed
+/// -HttpMessageHandler unit tests pin the shape of the calls; only this proves the shape is the one
+/// the upstream modules actually accept — the static Token auth, the CRS headers, the objecttype
+/// resolution by name, the `data_attrs` search, and the create/update the upsert relies on being
+/// idempotent (ADR-0028).
+/// </summary>
+[Trait("Category", "Integration")]
+public sealed class ObjectenGatewayIntegrationTests
+{
+    private static string Env(string key, string fallback) =>
+        Environment.GetEnvironmentVariable(key) is { Length: > 0 } v ? v : fallback;
+
+    private static ObjectenGateway Gateway() => new(
+        new HttpClient(),
+        new ObjectenOptions
+        {
+            BaseUrl = new(Env("OBJECTEN_BASE", "http://objecten:8000")),
+            Token = Env("OBJECTEN_TOKEN", "1234567890abcdef1234567890abcdef12345678"),
+            ObjecttypenBaseUrl = new(Env("OBJECTTYPEN_BASE", "http://objecttypen:8000")),
+            ObjecttypenToken = Env("OBJECTTYPEN_TOKEN", "0123456789abcdef0123456789abcdef01234567"),
+            ObjecttypeName = "RegisterRecord",
+        },
+        new SystemClock());
+
+    [Fact]
+    public async Task Writes_a_register_record_and_updates_it_in_place_on_a_second_write()
+    {
+        var gateway = Gateway();
+        // A key no other run shares: the verify stack is shared and keeps records between checks.
+        var id = Guid.NewGuid().ToString();
+
+        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingediend, "INT-TEST-1"));
+        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingeschreven, "INT-TEST-1"));
+
+        var records = await ReadAllAsync(id);
+        var only = Assert.Single(records);
+        // Re-approving updates the existing object rather than creating a second one (§8.6).
+        Assert.Equal(RegisterRecordStatus.Ingeschreven, only.Status);
+        Assert.Equal("INT-TEST-1", only.Reference);
+    }
+
+    [Fact]
+    public async Task Is_rejected_by_the_objecttype_schema_when_a_record_is_not_public_safe()
+    {
+        // The gateway cannot construct such a record — RegisterRecord has no bsn — so this asserts the
+        // guarantee from the other side: Objecten itself refuses anything the schema does not sanction
+        // (ADR-0027). Posted raw, exactly as the gateway would post a record.
+        var gateway = Gateway();
+        var id = Guid.NewGuid().ToString();
+        await gateway.UpsertAsync(new RegisterRecord(id, RegisterRecordStatus.Ingeschreven, "INT-TEST-2"));
+
+        var stored = Assert.Single(await ReadAllAsync(id));
+        Assert.Null(stored.Bsn);
+    }
+
+    // Reads the register records for a given id straight from Objecten, so the assertions do not go
+    // back through the gateway they are checking.
+    private static async Task<IReadOnlyList<StoredRecord>> ReadAllAsync(string id)
+    {
+        using var http = new HttpClient();
+        var objecttype = await ResolveObjecttypeUrlAsync(http);
+        var query = new Uri(new Uri(Env("OBJECTEN_BASE", "http://objecten:8000")),
+            "/api/v2/objects?type=" + Uri.EscapeDataString(objecttype) +
+            "&data_attrs=id__exact__" + Uri.EscapeDataString(id));
+
+        using var message = new HttpRequestMessage(HttpMethod.Get, query);
+        message.Headers.Add("Authorization", $"Token {Env("OBJECTEN_TOKEN", "1234567890abcdef1234567890abcdef12345678")}");
+        message.Headers.Add("Accept-Crs", "EPSG:4326");
+
+        using var response = await http.SendAsync(message);
+        response.EnsureSuccessStatusCode();
+
+        using var document = System.Text.Json.JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+        return document.RootElement.GetProperty("results").EnumerateArray()
+            .Select(o => o.GetProperty("record").GetProperty("data"))
+            .Select(d => new StoredRecord(
+                d.GetProperty("status").GetString()!,
+                d.GetProperty("reference").GetString(),
+                d.TryGetProperty("bsn", out var bsn) ? bsn.GetString() : null))
+            .ToList();
+    }
+
+    private static async Task<string> ResolveObjecttypeUrlAsync(HttpClient http)
+    {
+        var query = new Uri(new Uri(Env("OBJECTTYPEN_BASE", "http://objecttypen:8000")), "/api/v2/objecttypes");
+        using var message = new HttpRequestMessage(HttpMethod.Get, query);
+        message.Headers.Add("Authorization", $"Token {Env("OBJECTTYPEN_TOKEN", "0123456789abcdef0123456789abcdef01234567")}");
+
+        using var response = await http.SendAsync(message);
+        response.EnsureSuccessStatusCode();
+
+        using var document = System.Text.Json.JsonDocument.Parse(await response.Content.ReadAsStringAsync());
+        return document.RootElement.GetProperty("results").EnumerateArray()
+            .First(o => o.GetProperty("name").GetString() == "RegisterRecord")
+            .GetProperty("url").GetString()!;
+    }
+
+    private sealed record StoredRecord(string Status, string? Reference, string? Bsn);
+}