feat(event-subscriber): project a status-set as INGESCHREVEN via hoofdObject (refs #75)

Bind the NRC hoofdObject, recognise a zaken/status/create notification, and key the
projection on the zaak (hoofdObject) so the status updates the existing INGEDIEND row
to INGESCHREVEN — without reading OpenZaak (§8.1). Retain the ZGW resource in the log
(new column + migration) so a rebuild reproduces the approved status. Updates the
acceptance fakes for the new IAclClient/IZaakGateway members.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -11,14 +11,23 @@ public sealed record Notification(
     string Kanaal,
     string Resource,
     string Actie,
-    Uri ResourceUrl)
+    Uri ResourceUrl,
+    Uri? HoofdObject = null)
 {
-    /// <summary>The only event the walking-skeleton projection reacts to: a zaak being created.</summary>
+    /// <summary>A zaak being created — projected as INGEDIEND.</summary>
     public bool IsZaakCreated =>
         Kanaal == "zaken" && Resource == "zaak" && Actie == "create";
 
-    /// <summary>The zaak UUID — the trailing path segment of the resource URL — used as the projection key.</summary>
-    public string ZaakId => ResourceUrl.Segments[^1].Trim('/');
+    /// <summary>A status being set on a zaak — the approval, projected as INGESCHREVEN (S-09b). In the
+    /// walking skeleton the only status ever set after creation is the approval, and the subscriber may
+    /// not read OpenZaak (§8.1), so any status-create is taken as the approval.</summary>
+    public bool IsZaakStatusSet =>
+        Kanaal == "zaken" && Resource == "status" && Actie == "create";
+
+    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
+    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
+    /// resource URL) — see the NRC payload note.</summary>
+    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -7,13 +7,15 @@ namespace EventSubscriber.Application;
 /// </summary>
 public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
 {
-    /// <summary>Handle one inbound notification. Ignores anything that is not a zaak-created event.</summary>
+    /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
+    /// status being set (INGESCHREVEN); ignores everything else.</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
-        if (!notification.IsZaakCreated)
+        if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
-        var recorded = new RecordedNotification(notification.IdempotencyKey, notification.Actie, notification.ZaakId);
+        var recorded = new RecordedNotification(
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -31,8 +33,10 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
             await store.UpsertAsync(ToEntry(recorded), ct);
     }
 
-    /// <summary>The minimal projection row for an accepted notification. A zaak-create maps to
-    /// INGEDIEND; bsn/naam are deferred (ADR-0008).</summary>
+    /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
+    /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, RegistrationStatus.Ingediend);
+        => new(recorded.ZaakId, recorded.Resource == "status"
+            ? RegistrationStatus.Ingeschreven
+            : RegistrationStatus.Ingediend);
 }

services/event-subscriber/EventSubscriber.Application/Ports.cs

@@ -19,8 +19,10 @@ public interface INotificationLog
     Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default);
 }
 
-/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its projection row.</summary>
-public sealed record RecordedNotification(string Key, string Actie, string ZaakId);
+/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its
+/// projection row — including the ZGW <c>resource</c>, which distinguishes a zaak-create (INGEDIEND)
+/// from a status-set (INGESCHREVEN) so a rebuild reproduces the right status.</summary>
+public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource);
 
 /// <summary>The read projection store. Owned by the projection bounded context (ADR-0008); the
 /// subscriber writes to it and the projection-api reads it.</summary>

services/event-subscriber/EventSubscriber.Application/RegisterEntry.cs

@@ -17,4 +17,7 @@ public static class RegistrationStatus
 {
     /// <summary>A zaak has been created; the registration is submitted.</summary>
     public const string Ingediend = "INGEDIEND";
+
+    /// <summary>The registration has been approved and entered in the register (S-09b).</summary>
+    public const string Ingeschreven = "INGESCHREVEN";
 }