feat(domain): withdraw a registration → INGETROKKEN via POST /registrations/{id}/withdraw (refs #12)

Add the Ingetrokken terminal status, Registration.Withdraw() (open-only, idempotent), the

WithdrawRegistration handler, and the domain endpoint. Cancelling the running Flowable process

(so the case leaves the werkbak) and the owner-scoped BFF/self-service action are follow-up

sub-slices (S-11b/S-11c).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -26,6 +26,7 @@ builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
+builder.Services.AddScoped<WithdrawRegistration>();
 builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
@@ -74,6 +75,19 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
     return Results.NoContent();
 });
 
+// Withdraw a registration (S-11): the zorgprofessional pulls their own still-open submission back,
+// advancing it to INGETROKKEN. Idempotent. The BFF reaches this behind a digid token, owner-scoped
+// to the caller's bsn (S-11c); the domain trusts its callers (§8.3). Cancelling the running Flowable
+// process is a later sub-slice (S-11b).
+app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRegistration withdraw, CancellationToken ct) =>
+{
+    if (!Guid.TryParse(id, out var guid))
+        return Results.NotFound();
+
+    await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid)), ct);
+    return Results.NoContent();
+});
+
 // The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
 // Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
 // medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).

services/domain/Big.Application/WithdrawRegistration.cs

@@ -0,0 +1,32 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>A zorgprofessional's request to withdraw their own registration ("trek aanvraag in").</summary>
+public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId);
+
+/// <summary>
+/// The withdrawal use case (S-11): a zorgprofessional pulls a still-open registration back. It
+/// advances the aggregate to INGETROKKEN and persists it. Idempotent — a repeated or redelivered
+/// withdrawal of an already-withdrawn registration is a no-op (the aggregate is not persisted again).
+/// Cancelling the running Flowable process (so the case leaves the behandelaar's werkbak) is a later
+/// sub-slice (S-11b, via a BPMN message event); this sub-slice owns the domain transition only —
+/// mirroring how the beoordeling's rejection deferred its zaak propagation.
+/// </summary>
+public sealed class WithdrawRegistration(IRegistrationStore store)
+{
+    public async Task HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+
+        var registration = await store.GetAsync(command.RegistrationId, ct)
+            ?? throw new InvalidOperationException($"No registration {command.RegistrationId} to withdraw.");
+
+        // A repeated withdrawal is a no-op: don't persist the already-withdrawn aggregate again.
+        if (registration.Status == RegistrationStatus.Ingetrokken)
+            return;
+
+        registration.Withdraw();
+        await store.SaveAsync(registration, ct);
+    }
+}

services/domain/Big.Domain/Registration.cs

@@ -111,7 +111,23 @@ public sealed class Registration
         Status = RegistrationStatus.Afgewezen;
     }
 
-    // A decision is only valid while the registration is still open (INGEDIEND or IN_BEHANDELING).
+    /// <summary>
+    /// Withdraw the registration — the zorgprofessional pulls their own submission back (S-11). Allowed
+    /// while it is still open (INGEDIEND or IN_BEHANDELING) and needs no zaak; a registration that has
+    /// already been decided (INGESCHREVEN/AFGEWEZEN) can no longer be withdrawn. Re-withdrawing one
+    /// already <see cref="RegistrationStatus.Ingetrokken"/> is a no-op.
+    /// </summary>
+    public void Withdraw()
+    {
+        if (Status == RegistrationStatus.Ingetrokken)
+            return;
+
+        RequireOpenForDecision(nameof(Withdraw));
+        Status = RegistrationStatus.Ingetrokken;
+    }
+
+    // A decision (or withdrawal) is only valid while the registration is still open (INGEDIEND or
+    // IN_BEHANDELING).
     private void RequireOpenForDecision(string decision)
     {
         if (Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))

services/domain/Big.Domain/RegistrationStatus.cs

@@ -3,7 +3,8 @@ namespace Big.Domain;
 /// <summary>The lifecycle states a <see cref="Registration"/> moves through. Submission starts in
 /// <see cref="Ingediend"/>; a behandelaar takes it <see cref="InBehandeling"/> and decides it into one
 /// of the terminal states <see cref="Ingeschreven"/> (approved) or <see cref="Afgewezen"/> (rejected).
-/// Withdrawal and herregistratie states arrive in their own slices (S-11+).</summary>
+/// A zorgprofessional can withdraw a still-open registration into <see cref="Ingetrokken"/> (S-11).
+/// The herregistratie state arrives in its own slice.</summary>
 public enum RegistrationStatus
 {
     /// <summary>Submitted by the zorgprofessional; the registratie process has been started.</summary>
@@ -17,4 +18,7 @@ public enum RegistrationStatus
 
     /// <summary>Rejected by the behandelaar. Terminal.</summary>
     Afgewezen,
+
+    /// <summary>Withdrawn by the zorgprofessional before a decision (S-11). Terminal.</summary>
+    Ingetrokken,
 }