feat(workflow): document-wait task + 30-day timeout cancellation (S-10a, closes #102) (#105)

## What & why

S-10a, the **workflow/timeout spine** of the (split) document-upload slice: the registratie process
now parks at a **`WachtOpDocumenten`** user task with an **interrupting `P30D` boundary timer**. When
the documents arrive the task completes and the process continues into the diploma routing (S-13) →
Beoordelen; if the 30 days lapse, the timer cancels the wait, runs a `RegistratieVerlopen`
external-worker task, and the domain expires the aggregate to a new terminal status **`Verlopen`**.
Backend only — the real upload trigger (portal → BFF → ACL → Documenten API) is S-10b (#103).

Closes #102

Mechanism recorded in **ADR-0017**; opened as proposal #104. Mirrors the S-14 escalation
(boundary-timer + external-worker) and S-11 withdrawal (interrupting cancel) patterns.

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation (red→green pairs per layer).
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #102`).
- [ ] CI green — all Gitea Actions jobs (pending on this PR).
- [x] `docker compose up` health unaffected (no new services; deploy path unchanged).
- [x] Docs updated (ADR-0017, demo-script, BACKLOG split).
- [x] ADR added (`docs/architecture/adr-0017-document-wait-timeout-cancellation.md`).
- [x] Demo note in `docs/demo-script.md`.

## Notes for reviewers

- **Domain** (`Registration.Expire()` + `Verlopen`), **application** (`ExpireRegistrationWorker`),
  **infra** (`RegistratieVerlopenProcessor`/`Pump`, `IRegistratieVerlopenClient`, Flowable
  acquire/complete + `CompleteDocumentWaitAsync`) — the timeout counterpart to the OpenZaak/escalation
  worker trios; idempotent per §8.6.
- **BPMN** verified live against a `flowable-rest` probe: complete `WachtOpDocumenten` → routes to
  Beoordelen; fire the P30D timer → `RegistratieVerlopen` job (carrying `registrationId`) + the wait
  task cancelled. `verify-domain` exercises both branches in-stack (completes the wait in every existing
  block; fires the timer and asserts `Verlopen` in a new block).
- **Scope boundary:** on expiry the aggregate goes `Verlopen` and the process ends, but the ZGW *zaak*
  is not yet set to a cancellation status — that needs a new ACL method + statustype seeding and is
  folded into S-10b (noted in ADR-0017).
- `CompleteDocumentWaitAsync` is built and HTTP-tested here but not yet called from a domain endpoint;
  S-10b wires the upload trigger to it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #105

services/domain/Big.Application/ExpireRegistrationWorker.cs

@@ -0,0 +1,37 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>
+/// Handles one acquired <c>RegistratieVerlopen</c> external-worker job (S-10a, ADR-0017): load the
+/// registration the job correlates to and expire it to VERLOPEN — the 30-day document-wait timer fired
+/// before the documents arrived, so the case is cancelled. Pure application logic over ports; it knows
+/// nothing of Flowable. The polling loop that feeds it jobs lives in Infrastructure. Mirrors
+/// <see cref="OpenZaakWorker"/>.
+/// </summary>
+public sealed class ExpireRegistrationWorker(IRegistrationStore store)
+{
+    /// <summary>
+    /// Process the job. Idempotent and tolerant of races (§8.6, at-least-once delivery): a job whose
+    /// registration is already resolved — a redelivered expiry (VERLOPEN), or one withdrawn/decided
+    /// while it waited (INGETROKKEN/INGESCHREVEN/AFGEWEZEN) — is a no-op, so the job still completes
+    /// rather than throwing into a redelivery loop. Only a still-open registration is expired. An
+    /// unknown registration is an error: it throws, leaving the job un-completed for Flowable to redeliver.
+    /// </summary>
+    public async Task HandleAsync(RegistratieVerlopenJob job, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(job);
+
+        var registration = await store.GetAsync(job.RegistrationId, ct)
+            ?? throw new InvalidOperationException(
+                $"No registration {job.RegistrationId} for RegistratieVerlopen job {job.JobId}.");
+
+        // Only a still-open registration lapses; an already-resolved one (expired, or withdrawn/decided
+        // while it waited) is left untouched so the job can complete without violating the aggregate.
+        if (registration.Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))
+            return;
+
+        registration.Expire();
+        await store.SaveAsync(registration, ct);
+    }
+}

services/domain/Big.Application/Ports.cs

@@ -25,6 +25,14 @@ public interface IWorkflowClient
     /// ended, or not yet parked) it is a no-op; the aggregate is INGETROKKEN regardless.
     /// </summary>
     Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default);
+
+    /// <summary>
+    /// Signal that the required documents have arrived (S-10a): complete the <c>WachtOpDocumenten</c>
+    /// user task in the instance so the process leaves the 30-day wait state and continues to
+    /// beoordeling (ADR-0017). Best-effort — if the instance is not parked at that task (already
+    /// continued, or timed out) it is a no-op. The upload trigger that calls this is wired in S-10b.
+    /// </summary>
+    Task CompleteDocumentWaitAsync(string processInstanceId, CancellationToken ct = default);
 }
 
 /// <summary>
@@ -95,3 +103,11 @@ public sealed record OpenZaakJob(string JobId, RegistrationId RegistrationId);
 /// once the 14-day boundary timer fires (ADR-0015).
 /// </summary>
 public sealed record EscalatieJob(string JobId, string ProcessInstanceId);
+
+/// <summary>
+/// An acquired <c>RegistratieVerlopen</c> job (S-10a): the Flowable job id and the registration id it
+/// carries as a process variable. The 30-day boundary timer on <c>WachtOpDocumenten</c> spawns it when
+/// the required documents were not supplied in time; expiring the correlated registration to VERLOPEN
+/// cancels the case (ADR-0017).
+/// </summary>
+public sealed record RegistratieVerlopenJob(string JobId, RegistrationId RegistrationId);

services/domain/Big.Application/ProvideDocuments.cs

@@ -0,0 +1,47 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>A zorgprofessional's signal that they have supplied the documents their registration is
+/// waiting for ("documenten aanleveren"). <paramref name="Bsn"/> is the authenticated caller (from the
+/// DigiD token, forwarded by the BFF): only the registration's own bsn may provide its documents.</summary>
+public sealed record ProvideDocumentsCommand(RegistrationId RegistrationId, string Bsn);
+
+/// <summary>The outcome of a provide-documents request.</summary>
+public enum ProvideDocumentsOutcome
+{
+    /// <summary>The documents were accepted; the process's document wait was completed (if any).</summary>
+    Accepted,
+
+    /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone else
+    /// (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
+    NotFound,
+}
+
+/// <summary>
+/// The provide-documents use case (S-10a): a zorgprofessional supplies the documents their registration
+/// is parked waiting for, completing the WachtOpDocumenten task so the registratie process leaves the
+/// 30-day wait and continues to beoordeling (ADR-0017). Owner-scoped by bsn. Completing the wait is
+/// best-effort: if the registration never started a process (or already left the wait), the request
+/// still stands, mirroring how <see cref="WithdrawRegistration"/> cancels best-effort. The actual file
+/// upload and its ZGW storage via the ACL is S-10b; this is the trigger that unblocks the process.
+/// </summary>
+public sealed class ProvideDocuments(IRegistrationStore store, IWorkflowClient workflow)
+{
+    public async Task<ProvideDocumentsOutcome> HandleAsync(ProvideDocumentsCommand command, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+
+        var registration = await store.GetAsync(command.RegistrationId, ct);
+
+        // Unknown, or not the caller's registration: report NotFound either way (don't reveal which).
+        if (registration is null || registration.Bsn != command.Bsn)
+            return ProvideDocumentsOutcome.NotFound;
+
+        // Complete the document wait (if a process is running) so beoordeling can proceed.
+        if (registration.ProcessInstanceId is not null)
+            await workflow.CompleteDocumentWaitAsync(registration.ProcessInstanceId, ct);
+
+        return ProvideDocumentsOutcome.Accepted;
+    }
+}