diff --git a/services/domain/Big.Domain/Registration.cs b/services/domain/Big.Domain/Registration.cs
index 591d15e..c5d6f8c 100644
--- a/services/domain/Big.Domain/Registration.cs
+++ b/services/domain/Big.Domain/Registration.cs
@@ -7,8 +7,6 @@ namespace Big.Domain;
 /// </summary>
 public sealed class Registration
 {
-    // STUB (red): mutators are no-ops and Submit leaves the bsn empty so the behaviour tests
-    // compile and fail on their assertions. The green commit implements the invariants.
     private Registration(RegistrationId id, string bsn)
     {
         Id = id;
@@ -31,17 +29,37 @@ public sealed class Registration
     public Uri? ZaakUrl { get; private set; }
 
     /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.</summary>
-    public static Registration Submit(string bsn) => new(RegistrationId.New(), string.Empty);
+    public static Registration Submit(string bsn)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(bsn);
+        return new Registration(RegistrationId.New(), bsn);
+    }
 
     /// <summary>Record that the registratie workflow process has been started for this registration.</summary>
     public void RecordProcessStarted(string processInstanceId)
     {
-        // STUB (red).
+        ArgumentException.ThrowIfNullOrWhiteSpace(processInstanceId);
+        ProcessInstanceId = processInstanceId;
     }
 
-    /// <summary>Attach the zaak the ACL opened. Idempotent on the same URL; a conflicting URL is rejected.</summary>
+    /// <summary>
+    /// Attach the zaak the ACL opened. The external-task worker may deliver the same job more than
+    /// once (at-least-once), so re-attaching the identical URL is a no-op; a different URL signals a
+    /// genuine conflict and is rejected. The status stays <see cref="RegistrationStatus.Ingediend"/>:
+    /// opening the zaak does not advance the registration's lifecycle in this slice.
+    /// </summary>
     public void AttachZaak(Uri zaakUrl)
     {
-        // STUB (red).
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        if (ZaakUrl is not null)
+        {
+            if (ZaakUrl != zaakUrl)
+                throw new InvalidOperationException(
+                    $"Registration {Id} already has zaak {ZaakUrl}; cannot attach a different zaak {zaakUrl}.");
+            return;
+        }
+
+        ZaakUrl = zaakUrl;
     }
 }
diff --git a/services/domain/Big.Tests/RegistrationTests.cs b/services/domain/Big.Tests/RegistrationTests.cs
index 43b57f6..85b2e8a 100644
--- a/services/domain/Big.Tests/RegistrationTests.cs
+++ b/services/domain/Big.Tests/RegistrationTests.cs
@@ -21,7 +21,7 @@ public class RegistrationTests
     [InlineData("   ")]
     [InlineData(null)]
     public void Submitting_without_a_bsn_is_rejected(string? bsn)
-        => Assert.Throws<ArgumentException>(() => Registration.Submit(bsn!));
+        => Assert.ThrowsAny<ArgumentException>(() => Registration.Submit(bsn!));
 
     [Fact]
     public void Recording_the_started_process_keeps_its_instance_id()