feat(acl,domain): cancel the ZGW zaak on document-timeout expiry (S-10c, closes #106) (#109)

## S-10c · Close the ZGW zaak on document-timeout expiry (closes #106)

Completes the S-10a/S-10b boundary flagged in ADR-0017: when a registration's 30-day document term lapses, the domain now cancels the **ZGW zaak** as well as marking the aggregate `Verlopen`, so OpenZaak and the register no longer diverge.

### What it does
On expiry the `ExpireRegistrationWorker` calls the ACL to set the zaak to a distinct, non-terminal **`Geannuleerd`** status with a **`Vervallen`** resultaat (vs the approval `Afgehandeld` + `Geregistreerd`), resolved **by omschrijving** in the ACL — the ACL-first ordering mirrors approval so a failed ZGW call leaves the job for redelivery rather than diverging the two.

**Path:** Flowable P30D timer → `RegistratieVerlopen` job → domain `ExpireRegistrationWorker` → ACL `POST /annuleringen` → ZGW `resultaten` + `statussen` (Geannuleerd) → aggregate `Verlopen`.

### Layers touched (each red→green)
- **ACL gateway** — `SetZaakToCancellationStatusAsync` (Geannuleerd + Vervallen by name); approval now resolves its `Geregistreerd` resultaat by name too (a second resultaattype now exists).
- **ACL service/API** — `AclService.CancelZaakAsync` + `POST /annuleringen`.
- **Domain** — `IAclClient.CancelZaakAsync` + client; expiry worker cancels the zaak before advancing to `Verlopen`, guarded against redelivery double-cancel.
- **Seed** — non-terminal `Geannuleerd` statustype (volgnummer 2; `Afgehandeld` → 3) + `Vervallen` resultaattype, both idempotent by omschrijving and sharing the zaaktype's procestype.
- **Verify/integration** — ACL↔OpenZaak integration test (live `Geannuleerd` + resultaat); `run-domain-check.sh` fires the real P30D timer and asserts the zaak reaches `Geannuleerd` end-to-end; BDD scenario asserts cancel-on-timeout vs untouched-when-in-time.
- **Docs** — ADR-0019 (cancellation modelling decision), demo-script, BACKLOG.

### Design note (ADR-0019)
ZGW allows only one eindstatus per zaaktype, so `Geannuleerd` is modelled as a **non-terminal** status (it records a cancellation status + resultaat but does not set `einddatum`). This follows the issue's explicit "distinct statustype + resultaat" outcome; the shared-eindstatus alternative is recorded in the ADR.

### Tests
Unit + acceptance all green locally (Acl 38, Big 134, Acceptance 17, Bff 33, EventSubscriber 19). Integration + verify-stack run in CI (need live OpenZaak + selectielijst egress).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #109

services/domain/Big.Application/ExpireRegistrationWorker.cs

@@ -9,7 +9,7 @@ namespace Big.Application;
 /// nothing of Flowable. The polling loop that feeds it jobs lives in Infrastructure. Mirrors
 /// <see cref="OpenZaakWorker"/>.
 /// </summary>
-public sealed class ExpireRegistrationWorker(IRegistrationStore store)
+public sealed class ExpireRegistrationWorker(IRegistrationStore store, IAclClient acl)
 {
     /// <summary>
     /// Process the job. Idempotent and tolerant of races (§8.6, at-least-once delivery): a job whose
@@ -31,6 +31,14 @@ public sealed class ExpireRegistrationWorker(IRegistrationStore store)
         if (registration.Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))
             return;
 
+        // Cancel the ZGW zaak before advancing the aggregate (mirrors the approval path): if the ACL
+        // call fails it throws, the aggregate stays open, and the job is redelivered (§8.6) — rather
+        // than leaving the aggregate VERLOPEN while the zaak stays open. The status guard above stops a
+        // redelivered job from cancelling the zaak twice (a second resultaat would be a 400). A
+        // registration expired before its zaak was opened has nothing to cancel.
+        if (registration.ZaakUrl is not null)
+            await acl.CancelZaakAsync(registration.ZaakUrl, ct);
+
         registration.Expire();
         await store.SaveAsync(registration, ct);
     }

services/domain/Big.Application/Ports.cs

@@ -59,6 +59,12 @@ public interface IAclClient
     /// zaak (§8.1). Returns the stored document's URL.
     /// </summary>
     Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default);
+
+    /// <summary>
+    /// Cancel the zaak on document-timeout expiry (S-10c): the 30-day document term lapsed, so the ACL
+    /// translates this to the ZGW cancellation status/resultaat. The domain never names statustypen.
+    /// </summary>
+    Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default);
 }
 
 /// <summary>

services/domain/Big.Infrastructure/AclHttpClient.cs

@@ -31,6 +31,15 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
         response.EnsureSuccessStatusCode();
     }
 
+    public async Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        using var response = await http.PostAsJsonAsync(
+            new Uri(options.BaseUrl, "annuleringen"), new CancelZaakRequest(zaakUrl.ToString()), ct);
+        response.EnsureSuccessStatusCode();
+    }
+
     public async Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(zaakUrl);
@@ -56,6 +65,8 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
 
     private sealed record SetStatusRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
 
+    private sealed record CancelZaakRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
+
     private sealed record StoreDocumentRequest(
         [property: JsonPropertyName("zaakUrl")] string ZaakUrl,
         [property: JsonPropertyName("contentBase64")] string ContentBase64,

services/domain/Big.Tests/ExpireRegistrationWorkerTests.cs

@@ -10,10 +10,13 @@ public class ExpireRegistrationWorkerTests
 {
     private const string Bsn = "123456782";
 
-    private static Registration Submitted(string processInstanceId = "proc-1")
+    // By the time the 30-day document timer fires, the zaak was opened long ago (OpenZaakAanmaken runs
+    // early in the flow), so a timed-out registration carries a zaak the worker can cancel.
+    private static Registration Submitted(string processInstanceId = "proc-1", Uri? zaakUrl = null)
     {
         var registration = Registration.Submit(Bsn);
         registration.RecordProcessStarted(processInstanceId);
+        registration.AttachZaak(zaakUrl ?? FakeAclClient.DefaultZaakUrl);
         return registration;
     }
 
@@ -24,7 +27,7 @@ public class ExpireRegistrationWorkerTests
         var registration = Submitted();
         store.Seed(registration);
 
-        await new ExpireRegistrationWorker(store).HandleAsync(
+        await new ExpireRegistrationWorker(store, new FakeAclClient()).HandleAsync(
             new RegistratieVerlopenJob("job-7", registration.Id));
 
         var saved = await store.GetAsync(registration.Id);
@@ -33,37 +36,60 @@ public class ExpireRegistrationWorkerTests
     }
 
     [Fact]
-    public async Task An_already_verlopen_registration_is_not_persisted_again()
+    public async Task Cancels_the_zaak_via_the_acl_when_expiring_a_still_open_registration()
     {
-        // A redelivered job (§8.6) finds the aggregate already VERLOPEN: a no-op, not saved again.
+        // S-10c: expiring the aggregate is not enough — the ZGW zaak must also be set to its
+        // cancellation status, which the ACL owns (§8.1). The worker hands the ACL the zaak URL.
+        var store = new FakeRegistrationStore();
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/timed-out");
+        var registration = Submitted(zaakUrl: zaak);
+        store.Seed(registration);
+        var acl = new FakeAclClient();
+
+        await new ExpireRegistrationWorker(store, acl).HandleAsync(
+            new RegistratieVerlopenJob("job-7", registration.Id));
+
+        Assert.Equal(1, acl.CancelCallCount);
+        Assert.Equal(zaak, acl.CancelledZaakUrl);
+    }
+
+    [Fact]
+    public async Task An_already_verlopen_registration_is_not_persisted_again_and_the_zaak_is_not_recancelled()
+    {
+        // A redelivered job (§8.6) finds the aggregate already VERLOPEN: a no-op, not saved again — and
+        // the ACL is not asked to cancel the zaak a second time (posting a second resultaat would 400).
         var store = new FakeRegistrationStore();
         var registration = Submitted();
         registration.Expire();
         store.Seed(registration);
+        var acl = new FakeAclClient();
 
-        await new ExpireRegistrationWorker(store).HandleAsync(
+        await new ExpireRegistrationWorker(store, acl).HandleAsync(
             new RegistratieVerlopenJob("job-7", registration.Id));
 
         Assert.Equal(0, store.SaveCount);
+        Assert.Equal(0, acl.CancelCallCount);
         Assert.Equal(RegistrationStatus.Verlopen, (await store.GetAsync(registration.Id))!.Status);
     }
 
     [Fact]
-    public async Task An_already_resolved_registration_is_left_alone_and_the_job_completes()
+    public async Task An_already_resolved_registration_is_left_alone_and_the_zaak_is_not_cancelled()
     {
         // Race with S-11: the citizen withdrew while parked at WachtOpDocumenten, so the aggregate is
         // already terminal (INGETROKKEN) when the timer's job arrives. Expiring it would violate the
         // aggregate's invariant; the worker must instead no-op (and let the job complete), not throw
-        // into a redelivery loop.
+        // into a redelivery loop — and it must not cancel the zaak of a registration it didn't expire.
         var store = new FakeRegistrationStore();
         var registration = Submitted();
         registration.Withdraw();
         store.Seed(registration);
+        var acl = new FakeAclClient();
 
-        await new ExpireRegistrationWorker(store).HandleAsync(
+        await new ExpireRegistrationWorker(store, acl).HandleAsync(
             new RegistratieVerlopenJob("job-7", registration.Id));
 
         Assert.Equal(0, store.SaveCount);
+        Assert.Equal(0, acl.CancelCallCount);
         Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
     }
 
@@ -73,12 +99,12 @@ public class ExpireRegistrationWorkerTests
         var store = new FakeRegistrationStore();
 
         await Assert.ThrowsAsync<InvalidOperationException>(() =>
-            new ExpireRegistrationWorker(store).HandleAsync(
+            new ExpireRegistrationWorker(store, new FakeAclClient()).HandleAsync(
                 new RegistratieVerlopenJob("job-7", RegistrationId.New())));
     }
 
     [Fact]
     public async Task Rejects_a_null_job()
         => await Assert.ThrowsAsync<ArgumentNullException>(() =>
-            new ExpireRegistrationWorker(new FakeRegistrationStore()).HandleAsync(null!));
+            new ExpireRegistrationWorker(new FakeRegistrationStore(), new FakeAclClient()).HandleAsync(null!));
 }

services/domain/Big.Tests/Fakes.cs

@@ -119,4 +119,14 @@ internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
         StoredDiploma = (zaakUrl, content, fileName, contentType);
         return Task.FromResult(DefaultDocumentUrl);
     }
+
+    public Uri? CancelledZaakUrl { get; private set; }
+    public int CancelCallCount { get; private set; }
+
+    public Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        CancelCallCount++;
+        CancelledZaakUrl = zaakUrl;
+        return Task.CompletedTask;
+    }
 }

services/domain/Big.Tests/RegistratieVerlopenProcessorTests.cs

@@ -30,7 +30,7 @@ public class RegistratieVerlopenProcessorTests
         }
     }
 
-    private static ExpireRegistrationWorker Worker(FakeRegistrationStore store) => new(store);
+    private static ExpireRegistrationWorker Worker(FakeRegistrationStore store) => new(store, new FakeAclClient());
 
     [Fact]
     public async Task Acquires_a_job_expires_the_registration_and_completes_the_job()