feat(workflow): document-wait task + 30-day timeout cancellation (S-10a, closes #102) (#105)

## What & why

S-10a, the **workflow/timeout spine** of the (split) document-upload slice: the registratie process
now parks at a **`WachtOpDocumenten`** user task with an **interrupting `P30D` boundary timer**. When
the documents arrive the task completes and the process continues into the diploma routing (S-13) →
Beoordelen; if the 30 days lapse, the timer cancels the wait, runs a `RegistratieVerlopen`
external-worker task, and the domain expires the aggregate to a new terminal status **`Verlopen`**.
Backend only — the real upload trigger (portal → BFF → ACL → Documenten API) is S-10b (#103).

Closes #102

Mechanism recorded in **ADR-0017**; opened as proposal #104. Mirrors the S-14 escalation
(boundary-timer + external-worker) and S-11 withdrawal (interrupting cancel) patterns.

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation (red→green pairs per layer).
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #102`).
- [ ] CI green — all Gitea Actions jobs (pending on this PR).
- [x] `docker compose up` health unaffected (no new services; deploy path unchanged).
- [x] Docs updated (ADR-0017, demo-script, BACKLOG split).
- [x] ADR added (`docs/architecture/adr-0017-document-wait-timeout-cancellation.md`).
- [x] Demo note in `docs/demo-script.md`.

## Notes for reviewers

- **Domain** (`Registration.Expire()` + `Verlopen`), **application** (`ExpireRegistrationWorker`),
  **infra** (`RegistratieVerlopenProcessor`/`Pump`, `IRegistratieVerlopenClient`, Flowable
  acquire/complete + `CompleteDocumentWaitAsync`) — the timeout counterpart to the OpenZaak/escalation
  worker trios; idempotent per §8.6.
- **BPMN** verified live against a `flowable-rest` probe: complete `WachtOpDocumenten` → routes to
  Beoordelen; fire the P30D timer → `RegistratieVerlopen` job (carrying `registrationId`) + the wait
  task cancelled. `verify-domain` exercises both branches in-stack (completes the wait in every existing
  block; fires the timer and asserts `Verlopen` in a new block).
- **Scope boundary:** on expiry the aggregate goes `Verlopen` and the process ends, but the ZGW *zaak*
  is not yet set to a cancellation status — that needs a new ACL method + statustype seeding and is
  folded into S-10b (noted in ADR-0017).
- `CompleteDocumentWaitAsync` is built and HTTP-tested here but not yet called from a domain endpoint;
  S-10b wires the upload trigger to it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #105

tests/acceptance/Features/EenDocumentTermijnVerlopen.feature

@@ -0,0 +1,23 @@
+# language: en
+# Drives S-10a (#102). After the zaak is opened the process parks at WachtOpDocumenten with an
+# INTERRUPTING 30-day boundary timer. If the documents do not arrive in time the timer cancels the
+# task and parks a RegistratieVerlopen job (ADR-0017) which the timeout worker drains, expiring the
+# registration to VERLOPEN. Documents received before the timer fires close the wait, so no expiry
+# happens. This scenario exercises the timeout worker against an in-memory Flowable stand-in; the timer
+# firing live is verify-domain.
+Feature: Een documenttermijn laten verlopen
+  Als registerbeheerder wil ik dat een aanvraag waarvoor de documenten niet binnen 30 dagen binnen zijn
+  automatisch vervalt zodat onvolledige aanvragen niet blijven liggen.
+
+  Scenario: Zonder documenten binnen 30 dagen vervalt de registratie
+    Given a registration parked at the WachtOpDocumenten task
+    When the 30-day document timer fires
+    And the document-timeout worker runs
+    Then the registration is verlopen
+
+  Scenario: Tijdig aangeleverde documenten laten de registratie niet vervallen
+    Given a registration parked at the WachtOpDocumenten task
+    When the documents arrive before the timer fires
+    And the 30-day document timer fires
+    And the document-timeout worker runs
+    Then the registration is not verlopen

tests/acceptance/Steps/EenDocumentTermijnVerlopenSteps.cs

@@ -0,0 +1,52 @@
+using Acceptance.Support;
+using Big.Application;
+using Big.Domain;
+using Big.Infrastructure;
+using Microsoft.Extensions.Logging.Abstractions;
+using Reqnroll;
+using Xunit;
+
+namespace Acceptance.Steps;
+
+/// <summary>Bindings for <c>EenDocumentTermijnVerlopen.feature</c> (S-10a). Drives the timeout worker
+/// (<see cref="RegistratieVerlopenProcessor"/> over the <see cref="ExpireRegistrationWorker"/>) against
+/// an in-memory Flowable stand-in and a shared registration store; one instance per scenario. The
+/// interrupting 30-day timer either cancels the wait and expires the registration, or — if the
+/// documents arrived first — never fires; the scenario asserts on the aggregate's status.</summary>
+[Binding]
+[Scope(Feature = "Een documenttermijn laten verlopen")]
+public sealed class EenDocumentTermijnVerlopenSteps
+{
+    private readonly InMemoryDocumentTimeoutClient _flowable = new();
+    private readonly Support.InMemoryRegistrationStore _store = new();
+    private Registration _registration = null!;
+    private string _processInstanceId = "";
+
+    [Given("a registration parked at the WachtOpDocumenten task")]
+    public async Task GivenARegistrationParkedAtWachtOpDocumenten()
+    {
+        _registration = Registration.Submit("123456782");
+        await _store.SaveAsync(_registration);
+        _processInstanceId = _flowable.ParkWaitingForDocuments(_registration.Id);
+    }
+
+    [When("the 30-day document timer fires")]
+    public void WhenTheDocumentTimerFires() => _flowable.FireDocumentTimer(_processInstanceId);
+
+    [When("the documents arrive before the timer fires")]
+    public void WhenTheDocumentsArriveBeforeTheTimer() => _flowable.ReceiveDocuments(_processInstanceId);
+
+    [When("the document-timeout worker runs")]
+    public async Task WhenTheTimeoutWorkerRuns()
+        => await new RegistratieVerlopenProcessor(
+            _flowable, new ExpireRegistrationWorker(_store),
+            NullLogger<RegistratieVerlopenProcessor>.Instance).PumpOnceAsync(5);
+
+    [Then("the registration is verlopen")]
+    public async Task ThenTheRegistrationIsVerlopen()
+        => Assert.Equal(RegistrationStatus.Verlopen, (await _store.GetAsync(_registration.Id))!.Status);
+
+    [Then("the registration is not verlopen")]
+    public async Task ThenTheRegistrationIsNotVerlopen()
+        => Assert.Equal(RegistrationStatus.Ingediend, (await _store.GetAsync(_registration.Id))!.Status);
+}

tests/acceptance/Support/BffAcceptanceHost.cs

@@ -72,6 +72,9 @@ public sealed class CapturingDomainClient : IDomainClient
     public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
         => Task.FromResult(true);
 
+    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, CancellationToken ct = default)
+        => Task.FromResult(true);
+
     public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
         => Task.FromResult<IReadOnlyList<WerkbakItem>>([]);
 

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -14,6 +14,7 @@ public sealed class InMemoryWorkflowClient : IWorkflowClient
     public RegistrationId? StartedFor { get; private set; }
     public DiplomaOrigin? StartedWithOrigin { get; private set; }
     public string? WithdrawnProcessInstanceId { get; private set; }
+    public string? CompletedDocumentWaitFor { get; private set; }
 
     public Task<string> StartRegistrationProcessAsync(
         RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
@@ -28,6 +29,12 @@ public sealed class InMemoryWorkflowClient : IWorkflowClient
         WithdrawnProcessInstanceId = processInstanceId;
         return Task.CompletedTask;
     }
+
+    public Task CompleteDocumentWaitAsync(string processInstanceId, CancellationToken ct = default)
+    {
+        CompletedDocumentWaitFor = processInstanceId;
+        return Task.CompletedTask;
+    }
 }
 
 /// <summary>An in-memory ACL stand-in: records the bsn it opened a zaak for and returns a fixed URL,
@@ -130,6 +137,57 @@ public sealed class InMemoryEscalatieClient : IBeoordelingEscalatieClient
     }
 }
 
+/// <summary>An in-memory Flowable stand-in for the document-timeout scenario (S-10a): it models one
+/// WachtOpDocumenten wait per process instance — whether it is still open and the registration it
+/// correlates to — and the RegistratieVerlopen jobs the interrupting 30-day boundary timer parks. It
+/// drives the timeout worker's behaviour without a running Flowable; the timer firing live is the
+/// verify-domain check.</summary>
+public sealed class InMemoryDocumentTimeoutClient : IRegistratieVerlopenClient
+{
+    private sealed class Wait
+    {
+        public required RegistrationId RegistrationId { get; init; }
+        public bool IsWaiting { get; set; } = true;
+    }
+
+    private readonly Dictionary<string, Wait> _waits = [];
+    private readonly List<RegistratieVerlopenJob> _parked = [];
+    private int _seq;
+
+    /// <summary>A registration parks at WachtOpDocumenten, waiting for the citizen's documents.</summary>
+    public string ParkWaitingForDocuments(RegistrationId registrationId)
+    {
+        var pid = $"pi-{++_seq}";
+        _waits[pid] = new Wait { RegistrationId = registrationId };
+        return pid;
+    }
+
+    /// <summary>The documents arrive before the timer fires: the wait task closes, so the interrupting
+    /// timer no longer fires (mirrors the Workflow Client completing WachtOpDocumenten).</summary>
+    public void ReceiveDocuments(string processInstanceId) => _waits[processInstanceId].IsWaiting = false;
+
+    /// <summary>The 30-day interrupting boundary timer fires: if still waiting, it cancels the wait and
+    /// parks a RegistratieVerlopen job carrying the correlated registration id. A no-op if the documents
+    /// already arrived (the wait/timer race, §8.6).</summary>
+    public void FireDocumentTimer(string processInstanceId)
+    {
+        var wait = _waits[processInstanceId];
+        if (!wait.IsWaiting)
+            return;
+        wait.IsWaiting = false;
+        _parked.Add(new RegistratieVerlopenJob($"job-{++_seq}", wait.RegistrationId));
+    }
+
+    public Task<IReadOnlyList<RegistratieVerlopenJob>> AcquireRegistratieVerlopenJobsAsync(int maxJobs, CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<RegistratieVerlopenJob>>(_parked.Take(maxJobs).ToList());
+
+    public Task CompleteRegistratieVerlopenJobAsync(string jobId, CancellationToken ct = default)
+    {
+        _parked.RemoveAll(j => j.JobId == jobId);
+        return Task.CompletedTask;
+    }
+}
+
 /// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
 public sealed class InMemoryRegistrationStore : IRegistrationStore
 {

tests/e2e/registration.spec.ts

@@ -1,11 +1,15 @@
 import { expect, test } from '@playwright/test';
 
-// Walking-skeleton happy path (S-08d + S-09 + S-09b + S-12): a zorgprofessional logs in via mock
-// DigiD and submits through the self-service portal → BFF → domain; the entry appears in the openbaar
-// register as INGEDIEND; a behandelaar then logs in to the behandel portal, finds the registration in
-// the werkbak, and approves it (goedkeuren); the decision completes the Flowable Beoordelen task and
-// flows via the ACL → NRC → event-subscriber → projection, and the openbaar register shows INGESCHREVEN.
-test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public INGESCHREVEN', async ({ page }) => {
+// Walking-skeleton happy path (S-08d + S-09 + S-09b + S-12 + S-10a): a zorgprofessional logs in via
+// mock DigiD and submits through the self-service portal → BFF → domain; the entry appears in the
+// openbaar register as INGEDIEND; the citizen supplies the documents the process is waiting for
+// (S-10a); a behandelaar then logs in to the behandel portal, finds the registration in the werkbak,
+// and approves it (goedkeuren); the decision completes the Flowable Beoordelen task and flows via the
+// ACL → NRC → event-subscriber → projection, and the openbaar register shows INGESCHREVEN.
+test('DigiD submit → public INGEDIEND → documenten → behandelaar goedkeurt → public INGESCHREVEN', async ({
+  page,
+  context,
+}) => {
   // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
   await page.goto('/');
 
@@ -26,42 +30,53 @@ test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public ING
   expect(reference, 'the confirmation shows a registration reference').toBeTruthy();
 
   // The openbaar register (anonymous, its own origin) shows the submitted entry once the projection
-  // catches up. The projection updates asynchronously (NRC → event-subscriber), and the register loads
-  // on open, so reload until *this* submission's row appears. We poll on the reference cell (not a
-  // generic INGEDIEND cell): the shared verify stack already holds INGEDIEND rows from earlier checks,
-  // so a status-only poll would short-circuit on a stale row before our row is projected.
-  await page.goto('http://openbaar/');
-  await expect(page.getByRole('heading', { name: /Openbaar BIG-register/i })).toBeVisible();
+  // catches up. We check it on a SEPARATE page so the self-service tab keeps its (in-memory) submitted
+  // state — the "Documenten aanleveren" action below acts on that same session. The projection updates
+  // asynchronously (NRC → event-subscriber), so reload until *this* submission's row appears. We poll
+  // on the reference cell (not a generic INGEDIEND cell): the shared verify stack already holds
+  // INGEDIEND rows from earlier checks, so a status-only poll would short-circuit on a stale row.
+  const staff = await context.newPage();
+  await staff.goto('http://openbaar/');
+  await expect(staff.getByRole('heading', { name: /Openbaar BIG-register/i })).toBeVisible();
 
   // #78: the reference shown in the public register must be the exact one the citizen saw on the
   // submit confirmation — no mismatch between the two portals.
   await expect
     .poll(async () => {
-      await page.reload();
-      return page.getByRole('cell', { name: reference }).count();
+      await staff.reload();
+      return staff.getByRole('cell', { name: reference }).count();
     }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
     .toBeGreaterThan(0);
-  await expect(page.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGEDIEND' }))
+  await expect(staff.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGEDIEND' }))
     .toBeVisible();
 
-  // A behandelaar picks the registration up in the behandel-portal werkbak and approves it
-  // (goedkeuren) — the S-12 flow that replaces the temporary admin endpoint. Navigating here switches
-  // to the medewerker realm (a different Keycloak realm than the citizen's digid session).
-  await page.goto('http://behandel/');
-  await page.locator('#username').fill('merel-behandelaar');
-  await page.locator('#password').fill('test123');
-  await page.locator('#kc-login').click();
+  // Provide the documents the registration is waiting for (S-10a), on the still-open self-service tab.
+  // The process parks at WachtOpDocumenten only after the zaak is opened; the INGEDIEND row above proves
+  // the zaak exists — so the OpenZaak worker has completed and the process is now at the wait — which is
+  // why we supply the documents here rather than right after submit, when the trigger would race the
+  // wait and no-op. (S-10b turns this into a real file upload; here it is the trigger that unblocks
+  // beoordeling.)
+  await page.getByRole('button', { name: /documenten aanleveren/i }).click();
+  await expect(page.getByText(/documenten zijn aangeleverd/i)).toBeVisible();
 
-  await expect(page.getByRole('heading', { name: /Werkbak/i })).toBeVisible();
+  // A behandelaar picks the registration up in the behandel-portal werkbak and approves it (goedkeuren)
+  // — the S-12 flow that replaces the temporary admin endpoint. The staff tab switches to the
+  // medewerker realm (a different Keycloak realm than the citizen's digid session).
+  await staff.goto('http://behandel/');
+  await staff.locator('#username').fill('merel-behandelaar');
+  await staff.locator('#password').fill('test123');
+  await staff.locator('#kc-login').click();
 
-  // The registration parks at the Beoordelen user task only after the worker has opened its zaak, so
+  await expect(staff.getByRole('heading', { name: /Werkbak/i })).toBeVisible();
+
+  // The registration reaches the Beoordelen user task only after its documents are provided (above), so
   // it appears in the werkbak asynchronously — reload until this reference's row shows up. Target the
   // decide button by reference (not a generic "Goedkeuren"): the shared verify stack holds other open
   // tasks, so a positional match could act on someone else's registration.
-  const goedkeuren = page.getByRole('button', { name: `Goedkeuren ${reference}` });
+  const goedkeuren = staff.getByRole('button', { name: `Goedkeuren ${reference}` });
   await expect
     .poll(async () => {
-      await page.reload();
+      await staff.reload();
       return goedkeuren.count();
     }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
     .toBeGreaterThan(0);
@@ -69,7 +84,7 @@ test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public ING
   // Click and wait for the decide POST to finish (204) BEFORE leaving the page. `click()` only
   // dispatches the request; navigating away immediately cancels it in flight (nginx logs a 499) and
   // the decision never reaches the domain — so the registration would stay INGEDIEND.
-  const decided = page.waitForResponse(
+  const decided = staff.waitForResponse(
     (r) =>
       r.url().includes(`/behandel/registrations/${reference}/decide`) &&
       r.request().method() === 'POST',
@@ -79,11 +94,11 @@ test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public ING
 
   // The approval flows back to the projection; back on the openbaar register *our* row (matched by
   // its reference) now shows INGESCHREVEN.
-  await page.goto('http://openbaar/');
+  await staff.goto('http://openbaar/');
   await expect
     .poll(async () => {
-      await page.reload();
-      return page.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGESCHREVEN' }).count();
+      await staff.reload();
+      return staff.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGESCHREVEN' }).count();
     }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
     .toBeGreaterThan(0);
 });