feat(domain): withdrawal cancels the registratie process (S-11b, refs #12) (#89)

## What & why

Second sub-slice of **S-11 · Withdrawal (Flow 3)** (#12). S-11a (#88) made a withdrawal advance the aggregate to INGETROKKEN; this sub-slice **cancels the running Flowable process** so the withdrawn case leaves the behandelaar's werkbak.

- **BPMN** (`registratie.bpmn`): an interrupting message boundary event (`RegistratieIngetrokken`) on the `Beoordelen` task, routing to a dedicated "Registratie ingetrokken" end event.
- **Workflow Client**: `WithdrawBeoordelingAsync(executionId)` delivers `messageEventReceived` to the task's execution (PUT); `BeoordelingTask` now carries its `executionId`.
- **`WithdrawRegistration` handler**: after the domain transition, finds the open `Beoordelen` task for the registration and delivers the withdrawal message — best-effort, mirroring how the beoordeling completes its task.
- **Werkbak**: also filters out registrations that are no longer open, so a withdrawn case never surfaces even in the brief window before cancellation lands.
- **ADR-0014** records the decision (message event in BPMN vs. deleting the instance from code).
- **verify (`run-domain-check.sh`)**: a second registration parks at `Beoordelen`, is withdrawn via the domain, and the check asserts its `Beoordelen` task disappears — so verify-stack validates the live Flowable message correlation.

Refs #12 (S-11c — the BFF + self-service "trek aanvraag in" button + e2e — closes it).

## Definition of Done

- [x] Linked Gitea issue (#12).
- [x] Failing tests committed before the implementation (red → green per commit).
- [x] Implementation makes the tests pass.
- [x] Conventional Commits referencing the issue (`refs #12`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` unaffected (BPMN redeploys on a fresh CI DB via flowable-init).
- [x] ADR added (ADR-0014).
- [x] Docs — the user-visible demo note lands with S-11c.

## Notes for reviewers

- Verified locally: `Big.Tests` 94/94 pass; `Big.Api` builds; `registratie.bpmn` is well-formed.
- The Flowable message-correlation REST shape is validated **live** by verify-stack (the Workflow Client unit tests stub the exchange and assert only the request shape, per ADR-0009) — the new `run-domain-check.sh` withdrawal step is that live check.
- Known gap (ADR-0014): a withdrawal that races ahead of the process reaching `Beoordelen` finds no task to cancel; the aggregate is still INGETROKKEN and the werkbak filter hides it, but that instance parks unattended. A process-level event subprocess would close the gap — deferred.

Reviewed-on: #89

services/domain/Big.Application/Ports.cs

@@ -15,6 +15,14 @@ public interface IWorkflowClient
     /// aggregate. Returns the process instance id.
     /// </summary>
     Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default);
+
+    /// <summary>
+    /// Cancel a running <c>registratie</c> process on withdrawal (S-11): correlate the
+    /// <c>RegistratieIngetrokken</c> message to the instance, tripping the interrupting message event
+    /// that ends it (ADR-0014). Best-effort — if the instance is not waiting on that message (already
+    /// ended, or not yet parked) it is a no-op; the aggregate is INGETROKKEN regardless.
+    /// </summary>
+    Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default);
 }
 
 /// <summary>

services/domain/Big.Application/Werkbak.cs

@@ -1,3 +1,5 @@
+using Big.Domain;
+
 namespace Big.Application;
 
 /// <summary>One row of the behandelaar's werkbak: a registration awaiting beoordeling, with the
@@ -8,7 +10,8 @@ public sealed record WerkbakItem(string RegistrationId, string Bsn, string Statu
 /// The werkbak query (S-12c): the registrations awaiting a behandelaar's beoordeling. It reads the
 /// open <c>Beoordelen</c> tasks from the workflow engine (§8.2, via <see cref="IUserTaskClient"/>) —
 /// the authoritative set of work items — and enriches each with its aggregate (bsn + status). A task
-/// whose registration the domain doesn't know is skipped rather than invented.
+/// whose registration the domain doesn't know, or whose registration is no longer open for beoordeling
+/// (e.g. withdrawn — S-11 — while its task lingers until the workflow cancels it), is skipped.
 /// </summary>
 public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
 {
@@ -20,7 +23,7 @@ public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
         foreach (var task in open)
         {
             var registration = await store.GetAsync(task.RegistrationId, ct);
-            if (registration is null)
+            if (registration is null || !IsOpenForBeoordeling(registration.Status))
                 continue;
 
             items.Add(new WerkbakItem(
@@ -29,4 +32,9 @@ public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
 
         return items;
     }
+
+    // Only registrations still open for a decision belong in the werkbak; a terminal one (decided or
+    // withdrawn — S-11) whose Beoordelen task has not yet been cleared must not surface to a behandelaar.
+    private static bool IsOpenForBeoordeling(RegistrationStatus status)
+        => status is RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling;
 }

services/domain/Big.Application/WithdrawRegistration.cs

@@ -7,13 +7,14 @@ public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId);
 
 /// <summary>
 /// The withdrawal use case (S-11): a zorgprofessional pulls a still-open registration back. It
-/// advances the aggregate to INGETROKKEN and persists it. Idempotent — a repeated or redelivered
-/// withdrawal of an already-withdrawn registration is a no-op (the aggregate is not persisted again).
-/// Cancelling the running Flowable process (so the case leaves the behandelaar's werkbak) is a later
-/// sub-slice (S-11b, via a BPMN message event); this sub-slice owns the domain transition only —
-/// mirroring how the beoordeling's rejection deferred its zaak propagation.
+/// advances the aggregate to INGETROKKEN, persists it, then cancels the running registratie process
+/// by correlating the withdrawal message to its instance (ADR-0014), so the case leaves the
+/// behandelaar's werkbak. Idempotent — a repeated or redelivered withdrawal of an already-withdrawn
+/// registration is a no-op (not persisted or cancelled again). Cancelling is best-effort: if the
+/// registration never started a process the withdrawal still stands (the process cancel is skipped),
+/// mirroring how <see cref="BeoordeelRegistratie"/> completes its task best-effort.
 /// </summary>
-public sealed class WithdrawRegistration(IRegistrationStore store)
+public sealed class WithdrawRegistration(IRegistrationStore store, IWorkflowClient workflow)
 {
     public async Task HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
     {
@@ -22,11 +23,15 @@ public sealed class WithdrawRegistration(IRegistrationStore store)
         var registration = await store.GetAsync(command.RegistrationId, ct)
             ?? throw new InvalidOperationException($"No registration {command.RegistrationId} to withdraw.");
 
-        // A repeated withdrawal is a no-op: don't persist the already-withdrawn aggregate again.
+        // A repeated withdrawal is a no-op: don't persist or cancel the already-withdrawn one again.
         if (registration.Status == RegistrationStatus.Ingetrokken)
             return;
 
         registration.Withdraw();
         await store.SaveAsync(registration, ct);
+
+        // Cancel the running process (if one was started) so its Beoordelen task leaves the werkbak.
+        if (registration.ProcessInstanceId is not null)
+            await workflow.WithdrawProcessAsync(registration.ProcessInstanceId, ct);
     }
 }

services/domain/Big.Infrastructure/FlowableWorkflowClient.cs

@@ -23,6 +23,7 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
     private const string RegistrationIdVariable = "registrationId";
     private const string ZaakUrlVariable = "zaakUrl";
     private const string BesluitVariable = "besluit";
+    private const string IngetrokkenMessage = "RegistratieIngetrokken";
 
     public async Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
@@ -85,6 +86,35 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         response.EnsureSuccessStatusCode();
     }
 
+    public async Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
+    {
+        // Correlate the withdrawal message to the instance: find the execution subscribed to it (the
+        // interrupting message event's own execution — NOT the user task's), then deliver
+        // messageEventReceived to that execution so the process ends (ADR-0014). If nothing is
+        // subscribed (the process is not parked at Beoordelen) this is a best-effort no-op.
+        var subscribed = await GetAsync<ExecutionQueryResult>(
+            $"service/runtime/executions?messageEventSubscriptionName={IngetrokkenMessage}&processInstanceId={processInstanceId}",
+            ct);
+
+        var execution = subscribed?.Data?.FirstOrDefault();
+        if (execution is null)
+            return;
+
+        var request = new MessageEventRequest("messageEventReceived", IngetrokkenMessage);
+        using var response = await SendAsync(
+            $"service/runtime/executions/{execution.Id}", request, ct, HttpMethod.Put);
+        response.EnsureSuccessStatusCode();
+    }
+
+    private async Task<TResponse?> GetAsync<TResponse>(string path, CancellationToken ct)
+    {
+        var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, path));
+        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
+        using var response = await http.SendAsync(message, ct);
+        response.EnsureSuccessStatusCode();
+        return await response.Content.ReadFromJsonAsync<TResponse>(ct);
+    }
+
     private async Task<TResponse?> PostAsync<TRequest, TResponse>(string path, TRequest body, CancellationToken ct)
     {
         using var response = await SendAsync(path, body, ct);
@@ -92,9 +122,9 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         return await response.Content.ReadFromJsonAsync<TResponse>(ct);
     }
 
-    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct)
+    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct, HttpMethod? method = null)
     {
-        var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
+        var message = new HttpRequestMessage(method ?? HttpMethod.Post, new Uri(options.BaseUrl, path))
         {
             Content = JsonContent.Create(body),
         };
@@ -132,6 +162,10 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         [property: JsonPropertyName("action")] string Action,
         [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
 
+    private sealed record MessageEventRequest(
+        [property: JsonPropertyName("action")] string Action,
+        [property: JsonPropertyName("messageName")] string MessageName);
+
     private sealed record TaskQueryResult(
         [property: JsonPropertyName("data")] IReadOnlyList<UserTaskDto>? Data);
 
@@ -154,6 +188,11 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
 
     private sealed record ProcessInstance([property: JsonPropertyName("id")] string Id);
 
+    private sealed record ExecutionQueryResult(
+        [property: JsonPropertyName("data")] IReadOnlyList<ExecutionDto>? Data);
+
+    private sealed record ExecutionDto([property: JsonPropertyName("id")] string Id);
+
     private sealed record AcquiredJob(
         [property: JsonPropertyName("id")] string Id,
         [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables)

services/domain/Big.Tests/Fakes.cs

@@ -32,6 +32,7 @@ internal sealed class FakeWorkflowClient(string processInstanceId = "proc-1", Ac
     : IWorkflowClient
 {
     public RegistrationId? StartedFor { get; private set; }
+    public string? WithdrawnProcessInstanceId { get; private set; }
 
     public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
@@ -39,6 +40,12 @@ internal sealed class FakeWorkflowClient(string processInstanceId = "proc-1", Ac
         StartedFor = registrationId;
         return Task.FromResult(processInstanceId);
     }
+
+    public Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
+    {
+        WithdrawnProcessInstanceId = processInstanceId;
+        return Task.CompletedTask;
+    }
 }
 
 /// <summary>A fake user-task client for the werkbak/decision use cases: returns a scripted set of

services/domain/Big.Tests/FlowableWorkflowClientTests.cs

@@ -242,6 +242,61 @@ public class FlowableWorkflowClientTests
         Assert.Contains($"\"value\":\"{expected}\"", capture.Body);
     }
 
+    [Fact]
+    public async Task Withdraw_process_correlates_the_message_to_the_subscribed_execution()
+    {
+        HttpRequestMessage? getReq = null;
+        HttpRequestMessage? putReq = null;
+        string? putBody = null;
+        var client = Client(new StubHandler(async req =>
+        {
+            if (req.Method == HttpMethod.Get)
+            {
+                getReq = req;
+                return new HttpResponseMessage(HttpStatusCode.OK)
+                {
+                    Content = new StringContent("""{"data":[{"id":"exec-9"}]}""", Encoding.UTF8, "application/json"),
+                };
+            }
+            putReq = req;
+            putBody = await req.Content!.ReadAsStringAsync();
+            return new HttpResponseMessage(HttpStatusCode.OK);
+        }));
+
+        await client.WithdrawProcessAsync("pi-1");
+
+        // 1. Find the execution subscribed to the withdrawal message for this instance.
+        Assert.Equal(HttpMethod.Get, getReq!.Method);
+        Assert.Contains("service/runtime/executions", getReq.RequestUri!.ToString());
+        Assert.Contains("messageEventSubscriptionName=RegistratieIngetrokken", getReq.RequestUri!.Query);
+        Assert.Contains("processInstanceId=pi-1", getReq.RequestUri!.Query);
+        // 2. Deliver messageEventReceived to that execution (PUT), tripping the interrupting event.
+        Assert.Equal(HttpMethod.Put, putReq!.Method);
+        Assert.Equal("http://flowable/flowable-rest/service/runtime/executions/exec-9",
+            putReq.RequestUri!.ToString());
+        Assert.Contains("\"action\":\"messageEventReceived\"", putBody);
+        Assert.Contains("\"messageName\":\"RegistratieIngetrokken\"", putBody);
+    }
+
+    [Fact]
+    public async Task Withdraw_process_is_a_no_op_when_no_execution_is_subscribed()
+    {
+        var methods = new List<HttpMethod>();
+        var client = Client(new StubHandler(req =>
+        {
+            methods.Add(req.Method);
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent("""{"data":[]}""", Encoding.UTF8, "application/json"),
+            });
+        }));
+
+        await client.WithdrawProcessAsync("pi-1");
+
+        // No subscribed execution → no message delivered (best-effort), no throw.
+        Assert.DoesNotContain(HttpMethod.Put, methods);
+    }
+
     [Fact]
     public async Task Complete_beoordeling_throws_when_flowable_rejects_the_request()
     {

services/domain/Big.Tests/WerkbakTests.cs

@@ -46,4 +46,19 @@ public class WerkbakTests
 
         Assert.Empty(await werkbak.GetAsync());
     }
+
+    [Fact]
+    public async Task Skips_a_task_whose_registration_is_no_longer_open()
+    {
+        // A withdrawn registration (S-11) may still have a Beoordelen task lingering until the workflow
+        // cancels it; the werkbak lists only registrations still open for beoordeling, so it drops off.
+        var store = new FakeRegistrationStore();
+        var registration = Registration.Submit("123456782");
+        registration.Withdraw();
+        store.Seed(registration);
+        var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", registration.Id)]);
+        var werkbak = new Werkbak(tasks, store);
+
+        Assert.Empty(await werkbak.GetAsync());
+    }
 }

services/domain/Big.Tests/WithdrawRegistrationTests.cs

@@ -5,13 +5,20 @@ namespace Big.Tests;
 
 public class WithdrawRegistrationTests
 {
+    private static Registration Submitted(string processInstanceId = "proc-1")
+    {
+        var registration = Registration.Submit("123456782");
+        registration.RecordProcessStarted(processInstanceId);
+        return registration;
+    }
+
     [Fact]
     public async Task Withdrawing_marks_the_registration_ingetrokken_and_persists_it()
     {
         var store = new FakeRegistrationStore();
-        var registration = Registration.Submit("123456782");
+        var registration = Submitted();
         store.Seed(registration);
-        var handler = new WithdrawRegistration(store);
+        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
 
         await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
 
@@ -20,11 +27,43 @@ public class WithdrawRegistrationTests
         Assert.Equal(1, store.SaveCount);
     }
 
+    [Fact]
+    public async Task Withdrawing_cancels_the_running_process()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted("proc-42");
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var handler = new WithdrawRegistration(store, workflow);
+
+        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+
+        // The process the registration recorded at submit is cancelled (ADR-0014).
+        Assert.Equal("proc-42", workflow.WithdrawnProcessInstanceId);
+    }
+
+    [Fact]
+    public async Task Withdrawing_before_a_process_was_started_still_marks_ingetrokken()
+    {
+        // A registration with no recorded process (e.g. start never happened) can still be withdrawn;
+        // there is simply no process to cancel.
+        var store = new FakeRegistrationStore();
+        var registration = Registration.Submit("123456782"); // no RecordProcessStarted
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var handler = new WithdrawRegistration(store, workflow);
+
+        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+
+        Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
+        Assert.Null(workflow.WithdrawnProcessInstanceId);
+    }
+
     [Fact]
     public async Task Rejects_a_null_command_without_touching_the_store()
     {
         var store = new FakeRegistrationStore();
-        var handler = new WithdrawRegistration(store);
+        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
 
         await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
         Assert.Equal(0, store.SaveCount);
@@ -34,7 +73,7 @@ public class WithdrawRegistrationTests
     public async Task Withdrawing_an_unknown_registration_throws()
     {
         var store = new FakeRegistrationStore();
-        var handler = new WithdrawRegistration(store);
+        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(
             () => handler.HandleAsync(new WithdrawRegistrationCommand(RegistrationId.New())));
@@ -46,9 +85,10 @@ public class WithdrawRegistrationTests
     public async Task Re_withdrawing_an_already_ingetrokken_registration_is_idempotent()
     {
         var store = new FakeRegistrationStore();
-        var registration = Registration.Submit("123456782");
+        var registration = Submitted();
         store.Seed(registration);
-        var handler = new WithdrawRegistration(store);
+        var workflow = new FakeWorkflowClient();
+        var handler = new WithdrawRegistration(store, workflow);
 
         await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
         await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));