chore(release): 2026.07.0 (refs #80 )

First CalVer release, marking the end of Iteration 1 (Walking Skeleton). CHANGELOG.md regenerated from Conventional Commits via git-cliff for tag v2026.07.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-14 16:11:34 +02:00
132 changed files with 215 additions and 8358 deletions
@@ -157,7 +157,7 @@ jobs:
      # Log dump must precede teardown (which removes the containers).
      - name: Dump container logs on failure
        if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service 2>&1 || true
      - name: Tear down
        if: always()
        run: make down
@@ -199,25 +199,9 @@ _Split from the original S-09 — scoped to the portal only; the approval flow i

 ### S-10 · Document upload + boundary timer for document timeout (Flow 2)

-Split (issue #11 closed) into two independently-demoable slices per §13 — the original spanned six net-new surfaces including a new ZGW boundary:
+**Outcome:** BPMN extended with a "wacht op documenten" user task with a 30-day boundary timer. Self-service portal supports diploma upload. On timeout the case is cancelled.

-#### S-10a · Document-wait task + 30-day timeout cancellation + provision trigger — #102
-
-**Outcome:** BPMN gains a `WachtOpDocumenten` user task with a 30-day (P30D) interrupting boundary timer. On timeout the case is cancelled — the timer runs to a dedicated cancel end-event and the domain aggregate moves to a new terminal status `Verlopen` via an external-worker (mirrors S-14 escalation / S-11 withdrawal). "Documents received" is wired end-to-end (domain endpoint + BFF + a "Documenten aanleveren" button on the self-service page) so the walking-skeleton e2e stays green — but the document is **not yet stored** in ZGW; that is S-10b.
-
-**Acceptance:** BDD both branches (documents-in-time vs timeout-cancel); live timer-fire via the management-API "move" idiom; the registration e2e provides documents before the behandelaar step.
-
-#### S-10b · Real diploma upload stored via the ACL Documenten API — #103
-
-**Outcome:** the self-service "Documenten aanleveren" action becomes a real file upload; the file (base64-encoded end-to-end) is stored in the ZGW Documenten (DRC) API as an `enkelvoudiginformatieobject` and related to the zaak, with all document calls routed through the ACL (§8.1, ADR-0018). Builds on the S-10a trigger/wait. Depends on #102.
-
-**Acceptance:** ACL Documenten gateway integration test (real OpenZaak); Playwright e2e uploads a real PDF.
-
-#### S-10c · Close the ZGW zaak on document-timeout expiry — #106
-
-**Outcome:** when the 30-day term lapses (S-10a `RegistratieVerlopen`), the ZGW zaak is set to a distinct non-terminal `Geannuleerd` status + `Vervallen` resultaat (not just the domain aggregate → `Verlopen`), resolved by name in the ACL. Adds the cancellation statustype/resultaattype to the seed + an ACL `CancelZaakAsync`/`POST /annuleringen` + expiry-worker wiring. Carved from S-10b (ADR-0017/0018/0019). Depends on #103.
-
-**Acceptance:** ACL↔OpenZaak integration test (cancellation records `Geannuleerd` + a resultaat, live); the domain verify script fires the P30D timer and asserts the zaak reaches `Geannuleerd` end-to-end; BDD asserts the zaak is cancelled on timeout but untouched when documents arrive in time.
+**Acceptance:** BDD scenarios for both branches; integration tests for the timer firing.

 ### S-11 · Withdrawal (Flow 3)

@@ -239,12 +223,6 @@ Split (issue #11 closed) into two independently-demoable slices per §13 — the

 **Outcome:** Boundary timer on beoordeling user task — 14 days. On timeout, reassigns to a teamlead role.

-### S-26 · Self-service — resume an existing registration after refresh — #111
-
-**Outcome:** a signed-in zorgprofessional who reloads the self-service portal (or returns later) gets back to their in-flight registration and its actions (Documenten aanleveren, Trek aanvraag in), instead of a blank submit form with the reference lost. Today all post-submit state lives in in-memory signals, the reference is not in the URL, and there is no self-service read endpoint — so a reload strands the registration. Adds an owner-scoped (DigiD bsn) `GET /self-service/registrations` on the BFF/domain and a load-on-init/route restore in the portal.
-
-**Acceptance:** BDD — resume after refresh shows the existing registration; lookup is owner-scoped (never another citizen's); a user with no in-flight registration still sees the submit form. Playwright e2e reloads mid-flow and asserts the actions remain reachable.
-
 ---

 ## Iteration 3 — Maintenance portal and observability *(milestone: `Iteration 3 — Beheer & Observability`)*
@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
@@ -43,7 +43,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif

-.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-notifications smoke up down local verify-local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help
+.PHONY: ci lint build unit mutation frontend integration verify verify-up verify-acl verify-nrc verify-projection verify-bff verify-domain verify-notifications smoke up down local local-down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down keycloak-up keycloak-smoke keycloak-down flowable-up flowable-smoke flowable-down help

 ## ci: run the full pipeline — lint, build, unit, mutation, frontend, verify (mirrors Gitea Actions)
 ## `verify` is the live-stack stage (full stack up once → ACL + notification checks).
@@ -114,11 +114,6 @@ local:
 	docker compose -f $(LOCAL_COMPOSE) up -d --build
 	WAIT_TIMEOUT=420 bash infra/wait-healthy.sh $(WAIT_SVCS)

-## verify-local: acceptance check for the local stack (S-B04) — a fresh `make local` completes the
-## whole flow (zaaktype seeded + DMN deployed + NRC abonnement) with NO manual seeding.
-verify-local:
-	bash infra/run-local-flow-check.sh
-
 ## local-down: stop and remove the bind-mount stack
 local-down:
 	docker compose -f $(LOCAL_COMPOSE) down --volumes
@@ -1,27 +0,0 @@
-# Multi-stage build for the behandel portal (Angular → nginx).
-# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
-FROM node:24-slim AS build
-WORKDIR /src
-RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
-
-# Restore first (cached unless the manifests change).
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
-RUN pnpm install --frozen-lockfile
-
-# Sources (only what the app + its libs need).
-COPY apps/behandel apps/behandel
-COPY libs libs
-RUN pnpm nx build behandel
-
-FROM nginx:1.27-alpine AS runtime
-COPY apps/behandel/nginx.conf /etc/nginx/conf.d/default.conf
-COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html
-# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
-# service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013).
-RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
-
-EXPOSE 80
@@ -1,34 +0,0 @@
-import nx from '@nx/eslint-plugin';
-import baseConfig from '../../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/angular'],
-  ...nx.configs['flat/angular-template'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts'],
-    rules: {
-      '@angular-eslint/directive-selector': [
-        'error',
-        {
-          type: 'attribute',
-          prefix: 'app',
-          style: 'camelCase',
-        },
-      ],
-      '@angular-eslint/component-selector': [
-        'error',
-        {
-          type: 'element',
-          prefix: 'app',
-          style: 'kebab-case',
-        },
-      ],
-    },
-  },
-  {
-    files: ['**/*.html'],
-    // Override or add rules here
-    rules: {},
-  },
-];
@@ -1,24 +0,0 @@
-server {
-  listen 80;
-  server_name _;
-  root /usr/share/nginx/html;
-  index index.html;
-
-  # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
-  # even before the BFF is up and picks up restarts — instead of failing to load the config.
-  resolver 127.0.0.11 ipv6=off valid=30s;
-
-  # Same-origin API: proxy the behandel endpoint group to the bff service. The api-client uses
-  # relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the
-  # medewerker token (same-origin) is attached by the app's interceptor (ADR-0013).
-  location /behandel/ {
-    set $bff http://bff:8080;
-    proxy_pass $bff;
-    proxy_set_header Host $host;
-  }
-
-  # SPA fallback — Angular client-side routing.
-  location / {
-    try_files $uri $uri/ /index.html;
-  }
-}
@@ -1,80 +0,0 @@
-{
-  "name": "behandel",
-  "$schema": "../../node_modules/nx/schemas/project-schema.json",
-  "projectType": "application",
-  "prefix": "app",
-  "sourceRoot": "apps/behandel/src",
-  "tags": [],
-  "targets": {
-    "build": {
-      "executor": "@angular/build:application",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/apps/behandel",
-        "browser": "apps/behandel/src/main.ts",
-        "tsConfig": "apps/behandel/tsconfig.app.json",
-        "assets": [
-          {
-            "glob": "**/*",
-            "input": "apps/behandel/public"
-          }
-        ],
-        "styles": ["apps/behandel/src/styles.css"]
-      },
-      "configurations": {
-        "production": {
-          "budgets": [
-            {
-              "type": "initial",
-              "maximumWarning": "1mb",
-              "maximumError": "2mb"
-            },
-            {
-              "type": "anyComponentStyle",
-              "maximumWarning": "4kb",
-              "maximumError": "8kb"
-            }
-          ],
-          "outputHashing": "all"
-        },
-        "development": {
-          "optimization": false,
-          "extractLicenses": false,
-          "sourceMap": true
-        }
-      }
-    },
-    "serve": {
-      "continuous": true,
-      "executor": "@angular/build:dev-server",
-      "defaultConfiguration": "development",
-      "configurations": {
-        "production": {
-          "buildTarget": "behandel:build:production"
-        },
-        "development": {
-          "buildTarget": "behandel:build:development"
-        }
-      }
-    },
-    "lint": {
-      "executor": "@nx/eslint:lint"
-    },
-    "test": {
-      "executor": "@angular/build:unit-test",
-      "options": {
-        "watch": false
-      }
-    },
-    "serve-static": {
-      "continuous": true,
-      "executor": "@nx/web:file-server",
-      "options": {
-        "buildTarget": "behandel:build",
-        "staticFilePath": "dist/apps/behandel/browser",
-        "spa": true
-      }
-    }
-  }
-}
@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/medewerker"
-}
@@ -1,73 +0,0 @@
-import { provideHttpClient, withInterceptors } from '@angular/common/http';
-import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
-import { TestBed } from '@angular/core/testing';
-import { BffApiV1Service } from 'api-client';
-import { authInterceptor } from 'auth';
-import { AbstractSecurityStorage, ConfigurationService } from 'angular-auth-oidc-client';
-import { SECURE_API_ROUTES } from './app.config';
-
-// Guards the medewerker token wiring end-to-end. The api-client calls the BFF with RELATIVE URLs, and
-// the angular-auth-oidc-client interceptor attaches the token only when `req.url` starts with a
-// configured secureRoute. A regression to an absolute origin makes the relative URL never match, so
-// the behandel calls go out unauthenticated and the BFF answers 401. This drives the REAL interceptor
-// and the REAL api-client against the REAL production route value (SECURE_API_ROUTES); only the config
-// source and token storage are faked, so the assertion turns on the actual route-matching.
-describe('behandel medewerker token wiring', () => {
-  let http: HttpTestingController;
-  let bff: BffApiV1Service;
-  const token = 'medewerker-access-token';
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      providers: [
-        provideHttpClient(withInterceptors([authInterceptor()])),
-        provideHttpClientTesting(),
-        {
-          provide: ConfigurationService,
-          useValue: {
-            hasAtLeastOneConfig: () => true,
-            getAllConfigurations: () => [{ configId: 'medewerker', secureRoutes: SECURE_API_ROUTES }],
-          },
-        },
-        {
-          // A signed-in session: the storage the interceptor's token lookup reads from.
-          provide: AbstractSecurityStorage,
-          useValue: {
-            read: () => JSON.stringify({ authzData: token, authnResult: { id_token: 'id-token' } }),
-            write: () => undefined,
-            remove: () => undefined,
-            clear: () => undefined,
-          },
-        },
-      ],
-    });
-    http = TestBed.inject(HttpTestingController);
-    bff = TestBed.inject(BffApiV1Service);
-  });
-
-  afterEach(() => http.verify());
-
-  it('attaches the bearer token to the relative werkbak call', () => {
-    bff.getBehandelWerkbak().subscribe();
-
-    const req = http.expectOne('/behandel/werkbak');
-    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
-    req.flush([]);
-  });
-
-  it('attaches the bearer token to the relative decide call', () => {
-    bff.postBehandelRegistrationsIdDecide('reg-1', { besluit: 'goedkeuren' }).subscribe();
-
-    const req = http.expectOne('/behandel/registrations/reg-1/decide');
-    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
-    req.flush(null);
-  });
-
-  it('leaves the anonymous openbaar register call unauthenticated', () => {
-    bff.getOpenbaarRegister().subscribe();
-
-    const req = http.expectOne((r) => r.url === '/openbaar/register');
-    expect(req.request.headers.has('Authorization')).toBe(false);
-    req.flush([]);
-  });
-});
@@ -1,39 +0,0 @@
-import { provideHttpClient, withInterceptors } from '@angular/common/http';
-import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
-import { provideRouter } from '@angular/router';
-import { authInterceptor, provideMedewerkerAuth } from 'auth';
-import { appRoutes } from './app.routes';
-
-/** Environment-specific settings fetched from /config.json at startup (see main.ts). */
-export interface RuntimeConfig {
-  /** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */
-  authority: string;
-}
-
-/**
- * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
- * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on
- * `req.url`, which stays relative, so an absolute origin would never match and the token would go
- * unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
- */
-export const SECURE_API_ROUTES = ['/behandel/'];
-
-/**
- * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
- * redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin.
- */
-export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
-  const origin = typeof window !== 'undefined' ? window.location.origin : '/';
-  return {
-    providers: [
-      provideBrowserGlobalErrorListeners(),
-      provideRouter(appRoutes),
-      provideHttpClient(withInterceptors([authInterceptor()])),
-      provideMedewerkerAuth({
-        authority: runtime.authority,
-        redirectUrl: origin,
-        secureRoutes: SECURE_API_ROUTES,
-      }),
-    ],
-  };
-}
@@ -1 +0,0 @@
-<router-outlet></router-outlet>
@@ -1,7 +0,0 @@
-import { Route } from '@angular/router';
-import { authenticatedGuard } from 'auth';
-import { WerkbakPage } from './werkbak/werkbak-page';
-
-export const appRoutes: Route[] = [
-  { path: '', component: WerkbakPage, canActivate: [authenticatedGuard] },
-];
@@ -1,15 +0,0 @@
-import { provideRouter } from '@angular/router';
-import { render, screen } from '@testing-library/angular';
-import { App } from './app';
-
-describe('App', () => {
-  it('renders the router outlet shell', async () => {
-    const { container } = await render(App, {
-      providers: [provideRouter([])],
-    });
-
-    // The shell is a thin host for routed pages (the WerkbakPage owns the heading).
-    expect(container.querySelector('router-outlet')).toBeTruthy();
-    expect(screen).toBeTruthy();
-  });
-});
@@ -1,12 +0,0 @@
-import { Component } from '@angular/core';
-import { RouterModule } from '@angular/router';
-
-@Component({
-  imports: [RouterModule],
-  selector: 'app-root',
-  templateUrl: './app.html',
-  styleUrl: './app.css',
-})
-export class App {
-  protected title = 'behandel';
-}
@@ -1,64 +0,0 @@
-<main utrecht-document class="utrecht-theme">
-  <utrecht-article>
-    <utrecht-heading-1>Werkbak</utrecht-heading-1>
-    <p utrecht-paragraph>
-      Registraties die wachten op beoordeling. Keur elke registratie goed of wijs deze af.
-    </p>
-
-    @if (loading()) {
-      <p utrecht-paragraph role="status">Bezig met laden…</p>
-    } @else if (failed()) {
-      <p utrecht-paragraph role="alert">
-        Kon de werkbak niet laden. Controleer of je als behandelaar bent ingelogd en probeer het
-        opnieuw.
-      </p>
-    } @else if (loaded() && items().length === 0) {
-      <p utrecht-paragraph role="status">De werkbak is leeg.</p>
-    } @else if (items().length > 0) {
-      <table utrecht-table>
-        <caption>
-          Registraties in behandeling
-        </caption>
-        <thead>
-          <tr>
-            <th scope="col">Referentie</th>
-            <th scope="col">BSN</th>
-            <th scope="col">Status</th>
-            <th scope="col">Actie</th>
-          </tr>
-        </thead>
-        <tbody>
-          @for (item of items(); track item.registrationId) {
-            <tr>
-              <td>{{ item.registrationId }}</td>
-              <td>{{ item.bsn }}</td>
-              <td>{{ item.status }}</td>
-              <td>
-                <button
-                  utrecht-button
-                  appearance="primary-action-button"
-                  type="button"
-                  [attr.aria-label]="'Goedkeuren ' + item.registrationId"
-                  [disabled]="deciding() === item.registrationId"
-                  (click)="decide(item.registrationId, 'goedkeuren')"
-                >
-                  Goedkeuren
-                </button>
-                <button
-                  utrecht-button
-                  appearance="secondary-action-button"
-                  type="button"
-                  [attr.aria-label]="'Afwijzen ' + item.registrationId"
-                  [disabled]="deciding() === item.registrationId"
-                  (click)="decide(item.registrationId, 'afwijzen')"
-                >
-                  Afwijzen
-                </button>
-              </td>
-            </tr>
-          }
-        </tbody>
-      </table>
-    }
-  </utrecht-article>
-</main>
@@ -1,110 +0,0 @@
-import { signal } from '@angular/core';
-import { fireEvent, render, screen } from '@testing-library/angular';
-import { of, throwError } from 'rxjs';
-import { BffApiV1Service, type WerkbakItem } from 'api-client';
-import { AuthService } from 'auth';
-import { axe } from 'vitest-axe';
-import { WerkbakPage } from './werkbak-page';
-
-const sample: WerkbakItem[] = [
-  { registrationId: 'reg-1', bsn: '123456782', status: 'InBehandeling' },
-  { registrationId: 'reg-2', bsn: '111222333', status: 'InBehandeling' },
-];
-
-class FakeAuth extends AuthService {
-  readonly isAuthenticated = signal(true);
-  readonly bsn = signal<string | undefined>(undefined);
-  override readonly roles = signal<readonly string[]>(['behandelaar']);
-  login(): void {
-    /* not exercised here */
-  }
-  logout(): void {
-    /* spied in tests */
-  }
-}
-
-function setup(
-  overrides: {
-    getBehandelWerkbak?: ReturnType<typeof vi.fn>;
-    postBehandelRegistrationsIdDecide?: ReturnType<typeof vi.fn>;
-  } = {},
-) {
-  const getBehandelWerkbak =
-    overrides.getBehandelWerkbak ?? vi.fn().mockReturnValue(of(sample));
-  const postBehandelRegistrationsIdDecide =
-    overrides.postBehandelRegistrationsIdDecide ?? vi.fn().mockReturnValue(of(undefined));
-  return {
-    getBehandelWerkbak,
-    postBehandelRegistrationsIdDecide,
-    providers: [
-      {
-        provide: BffApiV1Service,
-        useValue: { getBehandelWerkbak, postBehandelRegistrationsIdDecide },
-      },
-      { provide: AuthService, useClass: FakeAuth },
-    ],
-  };
-}
-
-describe('WerkbakPage', () => {
-  it('lists the registrations awaiting beoordeling on open', async () => {
-    const { getBehandelWerkbak, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    expect(getBehandelWerkbak).toHaveBeenCalled();
-    expect(await screen.findByText('reg-1')).toBeTruthy();
-    expect(screen.getByText('123456782')).toBeTruthy();
-    expect(screen.getByText('reg-2')).toBeTruthy();
-  });
-
-  it('approves a registration (goedkeuren) and refreshes the werkbak', async () => {
-    const { getBehandelWerkbak, postBehandelRegistrationsIdDecide, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    fireEvent.click((await screen.findAllByRole('button', { name: /goedkeuren/i }))[0]);
-
-    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
-      besluit: 'goedkeuren',
-    });
-    // Reloaded after the decision: once on open, once after deciding.
-    expect(getBehandelWerkbak).toHaveBeenCalledTimes(2);
-  });
-
-  it('rejects a registration (afwijzen) via the decide endpoint', async () => {
-    const { postBehandelRegistrationsIdDecide, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    fireEvent.click((await screen.findAllByRole('button', { name: /afwijzen/i }))[0]);
-
-    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
-      besluit: 'afwijzen',
-    });
-  });
-
-  it('shows an empty state when the werkbak has no items', async () => {
-    const { providers } = setup({ getBehandelWerkbak: vi.fn().mockReturnValue(of([])) });
-    await render(WerkbakPage, { providers });
-
-    expect(await screen.findByText(/werkbak is leeg/i)).toBeTruthy();
-  });
-
-  it('surfaces a load failure instead of swallowing it', async () => {
-    const { providers } = setup({
-      getBehandelWerkbak: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
-    });
-    await render(WerkbakPage, { providers });
-
-    expect(await screen.findByText(/kon de werkbak niet laden/i)).toBeTruthy();
-  });
-
-  it('has no WCAG 2.1 AA violations', async () => {
-    document.documentElement.lang = 'nl';
-    const { container } = await render(WerkbakPage, { providers: setup().providers });
-
-    const results = await axe(container, {
-      runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
-    });
-
-    expect(results.violations).toEqual([]);
-  });
-});
@@ -1,65 +0,0 @@
-import { Component, inject, signal } from '@angular/core';
-import { BffApiV1Service, type WerkbakItem } from 'api-client';
-import { UtrechtComponentsModule } from 'ui';
-
-/** The two decisions a behandelaar can make; the BFF validates these exact values (ADR-0013). */
-type Besluit = 'goedkeuren' | 'afwijzen';
-
-/**
- * The behandel werkbak: a signed-in behandelaar sees the registrations awaiting beoordeling (the open
- * Flowable `Beoordelen` tasks, read through the domain) and decides each — goedkeuren or afwijzen. A
- * decision posts to the BFF, which applies the domain transition and completes the workflow task
- * (ADR-0013; S-12). After a decision the werkbak refreshes so the handled item drops off the list.
- */
-@Component({
-  selector: 'app-werkbak-page',
-  imports: [UtrechtComponentsModule],
-  templateUrl: './werkbak-page.html',
-})
-export class WerkbakPage {
-  private readonly bff = inject(BffApiV1Service);
-
-  protected readonly items = signal<WerkbakItem[]>([]);
-  protected readonly loading = signal(false);
-  protected readonly loaded = signal(false);
-  protected readonly failed = signal(false);
-  protected readonly deciding = signal<string | undefined>(undefined);
-
-  constructor() {
-    this.load();
-  }
-
-  load(): void {
-    this.loading.set(true);
-    this.failed.set(false);
-    this.bff.getBehandelWerkbak().subscribe({
-      next: (rows: WerkbakItem[]) => {
-        this.items.set(rows);
-        this.loading.set(false);
-        this.loaded.set(true);
-      },
-      // Surface the failure (e.g. 403 for a non-behandelaar) instead of swallowing it.
-      error: () => {
-        this.items.set([]);
-        this.loading.set(false);
-        this.loaded.set(true);
-        this.failed.set(true);
-      },
-    });
-  }
-
-  decide(registrationId: string, besluit: Besluit): void {
-    this.deciding.set(registrationId);
-    this.bff.postBehandelRegistrationsIdDecide(registrationId, { besluit }).subscribe({
-      // Refresh so the decided registration drops off the werkbak (its task is now completed).
-      next: () => {
-        this.deciding.set(undefined);
-        this.load();
-      },
-      error: () => {
-        this.deciding.set(undefined);
-        this.failed.set(true);
-      },
-    });
-  }
-}
@@ -1,13 +0,0 @@
-<!doctype html>
-<html lang="nl">
-  <head>
-    <meta charset="utf-8" />
-    <title>Behandelportaal BIG-register</title>
-    <base href="/" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <link rel="icon" type="image/x-icon" href="favicon.ico" />
-  </head>
-  <body>
-    <app-root></app-root>
-  </body>
-</html>
@@ -1,10 +0,0 @@
-import { bootstrapApplication } from '@angular/platform-browser';
-import { App } from './app/app';
-import { appConfig, type RuntimeConfig } from './app/app.config';
-
-// Load environment config before bootstrap so the OIDC authority is set per environment
-// (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d).
-fetch('config.json')
-  .then((response) => response.json() as Promise<RuntimeConfig>)
-  .then((config) => bootstrapApplication(App, appConfig(config)))
-  .catch((err) => console.error(err));
@@ -1,2 +0,0 @@
-/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */
-@import '@utrecht/design-tokens/dist/index.css';
@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": []
-  },
-  "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"]
-}
@@ -1,31 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "strict": true,
-    "noImplicitOverride": true,
-    "noPropertyAccessFromIndexSignature": true,
-    "noImplicitReturns": true,
-    "noFallthroughCasesInSwitch": true,
-    "isolatedModules": true,
-    "target": "es2022",
-    "moduleResolution": "bundler",
-    "emitDecoratorMetadata": false,
-    "module": "preserve"
-  },
-  "angularCompilerOptions": {
-    "enableI18nLegacyMessageIdFormat": false,
-    "strictInjectionParameters": true,
-    "strictInputAccessModifiers": true,
-    "strictTemplates": true
-  },
-  "files": [],
-  "include": [],
-  "references": [
-    {
-      "path": "./tsconfig.app.json"
-    },
-    {
-      "path": "./tsconfig.spec.json"
-    }
-  ]
-}
@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": ["vitest/globals"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.d.ts"]
-}
@@ -17,9 +17,5 @@ FROM nginx:1.27-alpine AS runtime
 COPY apps/openbaar/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /src/dist/apps/openbaar/browser /usr/share/nginx/html
 # No runtime config: the openbaar register is anonymous (no OIDC authority to inject).
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh

 EXPOSE 80
@@ -1,17 +0,0 @@
-#!/bin/sh
-# Point nginx's reverse-proxy `resolver` at THIS container's real DNS server.
-#
-# The portal nginx configs use a variable proxy_pass, which needs a `resolver` so the BFF hostname is
-# resolved at request time (nginx can start before the BFF is up). The config hardcodes Docker's
-# embedded DNS (127.0.0.11) — correct on Docker/Docker Desktop, but rootless podman uses a
-# network-specific address (aardvark, e.g. 10.89.0.1), so proxied calls 502 there. Read the actual
-# nameserver from /etc/resolv.conf and substitute it, so the reverse proxy works on any engine.
-#
-# Runs from the nginx image's /docker-entrypoint.d/ before nginx starts. On Docker the nameserver IS
-# 127.0.0.11, so the substitution is a no-op. Guarded (no `set -e`) so it's safe whether the nginx
-# entrypoint executes or sources it.
-ns="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null)"
-if [ -n "$ns" ] && [ "$ns" != "127.0.0.11" ]; then
-  sed -i "s/resolver 127\.0\.0\.11/resolver $ns/" /etc/nginx/conf.d/default.conf 2>/dev/null || true
-  echo "portal-nginx-resolver: set resolver to $ns"
-fi
@@ -19,9 +19,5 @@ COPY --from=build /src/dist/apps/self-service/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's authority (host-consistent, ADR-0010).
 RUN printf '{ "authority": "http://keycloak:8080/realms/digid" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh

 EXPOSE 80
@@ -3,56 +3,9 @@
    <utrecht-heading-1>Zelfservice — BIG-registratie</utrecht-heading-1>

    @if (submitted()) {
-      @if (withdrawn()) {
-        <p utrecht-paragraph role="status">
-          Uw registratie met referentie {{ reference() }} is ingetrokken.
-        </p>
-      } @else {
-        <p utrecht-paragraph role="status">
-          Uw registratie is ontvangen. Referentie: {{ reference() }}.
-        </p>
-        @if (documentsProvided()) {
-          <p utrecht-paragraph role="status">Uw documenten zijn aangeleverd.</p>
-        } @else {
-          @if (provideDocumentsFailed()) {
-            <p utrecht-paragraph role="alert">
-              Het aanleveren van uw documenten is niet gelukt. Probeer het opnieuw.
-            </p>
-          }
-          <p utrecht-paragraph>Lever uw diploma aan (PDF).</p>
-          <label utrecht-form-label for="diploma">Diploma</label>
-          <input
-            id="diploma"
-            type="file"
-            accept="application/pdf"
-            [disabled]="providingDocuments()"
-            (change)="onFileSelected($event)"
-          />
-          <button
-            utrecht-button
-            appearance="primary-action-button"
-            type="button"
-            [disabled]="providingDocuments() || !selectedFile()"
-            (click)="provideDocuments()"
-          >
-            Documenten aanleveren
-          </button>
-        }
-        @if (withdrawFailed()) {
-          <p utrecht-paragraph role="alert">
-            Het intrekken van uw registratie is niet gelukt. Probeer het opnieuw.
-          </p>
-        }
-        <button
-          utrecht-button
-          appearance="secondary-action-button"
-          type="button"
-          [disabled]="withdrawing()"
-          (click)="withdraw()"
-        >
-          Trek aanvraag in
-        </button>
-      }
+      <p utrecht-paragraph role="status">
+        Uw registratie is ontvangen. Referentie: {{ reference() }}.
+      </p>
    } @else {
      <p utrecht-paragraph>U bent ingelogd met BSN {{ bsn() }}.</p>
      @if (failed()) {
@@ -17,25 +17,12 @@ class FakeAuth extends AuthService {
  }
 }

-function providers(
-  post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-  withdraw = vi.fn().mockReturnValue(of(undefined)),
-  provideDocuments = vi.fn().mockReturnValue(of(undefined)),
-) {
+function providers(post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' }))) {
  return {
    post,
-    withdraw,
-    provideDocuments,
    providers: [
      { provide: AuthService, useClass: FakeAuth },
-      {
-        provide: BffApiV1Service,
-        useValue: {
-          postSelfServiceRegistrations: post,
-          postSelfServiceRegistrationsIdWithdraw: withdraw,
-          postSelfServiceRegistrationsIdDocuments: provideDocuments,
-        },
-      },
+      { provide: BffApiV1Service, useValue: { postSelfServiceRegistrations: post } },
    ],
  };
 }
@@ -69,76 +56,6 @@ describe('RegistrationPage', () => {
    expect(screen.getByRole('button', { name: /indienen/i })).toBeTruthy();
  });

-  it('offers to withdraw after submitting, and withdrawing confirms', async () => {
-    const { withdraw, providers: p } = providers();
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    // The withdrawal is keyed by the reference the submit returned, and the page confirms it.
-    expect(withdraw).toHaveBeenCalledWith('reg-9');
-    expect(await screen.findByText(/ingetrokken/i)).toBeTruthy();
-  });
-
-  // A small PDF file the citizen "uploads"; the component base64-encodes it client-side.
-  const diploma = () => new File([new Uint8Array([1, 2, 3])], 'diploma.pdf', { type: 'application/pdf' });
-
-  it('uploads a chosen diploma after submitting, and doing so confirms', async () => {
-    const { provideDocuments, providers: p } = providers();
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-
-    // Choose the file, then upload it.
-    fireEvent.change(screen.getByLabelText(/diploma/i), { target: { files: [diploma()] } });
-    fireEvent.click(await screen.findByRole('button', { name: /documenten aanleveren/i }));
-
-    // The upload is keyed by the reference and carries the base64 file + its name; the page confirms.
-    expect(await screen.findByText(/documenten.*aangeleverd/i)).toBeTruthy();
-    expect(provideDocuments).toHaveBeenCalledWith(
-      'reg-9',
-      expect.objectContaining({ fileName: 'diploma.pdf', contentType: 'application/pdf', contentBase64: expect.any(String) }),
-    );
-  });
-
-  it('surfaces a diploma-upload failure and keeps the action available', async () => {
-    const { providers: p } = providers(
-      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-      vi.fn().mockReturnValue(of(undefined)),
-      vi.fn().mockReturnValue(throwError(() => new Error('documents rejected'))),
-    );
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-    fireEvent.change(screen.getByLabelText(/diploma/i), { target: { files: [diploma()] } });
-    fireEvent.click(await screen.findByRole('button', { name: /documenten aanleveren/i }));
-
-    expect(await screen.findByRole('alert')).toBeTruthy();
-    expect(screen.queryByText(/aangeleverd/i)).toBeNull();
-    expect(screen.getByRole('button', { name: /documenten aanleveren/i })).toBeTruthy();
-  });
-
-  it('surfaces a withdraw failure and keeps the action available', async () => {
-    const { providers: p } = providers(
-      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-      vi.fn().mockReturnValue(throwError(() => new Error('withdraw rejected'))),
-    );
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    expect(await screen.findByRole('alert')).toBeTruthy();
-    expect(screen.queryByText(/is ingetrokken/i)).toBeNull();
-    expect(screen.getByRole('button', { name: /trek aanvraag in/i })).toBeTruthy();
-  });
-
  it('has no WCAG 2.1 AA violations on the submit page', async () => {
    // The portal is Dutch; the real index.html sets lang. Set it here so the document-level
    // html-has-lang rule reflects the app, not the bare jsdom document.
@@ -6,8 +6,7 @@ import { UtrechtComponentsModule } from 'ui';
 /**
 * The self-service submit page: a signed-in zorgprofessional confirms and submits their BIG
 * registration. The bsn comes from the DigiD token (not a form field), so this is a confirm-and-
- * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c). After
- * submitting they can withdraw it — "trek aanvraag in" — keyed by that reference (S-11c).
+ * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c).
 */
@Component({
  selector: 'app-registration-page',
@@ -23,13 +22,6 @@ export class RegistrationPage {
  protected readonly reference = signal<string | undefined>(undefined);
  protected readonly submitted = signal(false);
  protected readonly failed = signal(false);
-  protected readonly withdrawing = signal(false);
-  protected readonly withdrawn = signal(false);
-  protected readonly withdrawFailed = signal(false);
-  protected readonly providingDocuments = signal(false);
-  protected readonly documentsProvided = signal(false);
-  protected readonly provideDocumentsFailed = signal(false);
-  protected readonly selectedFile = signal<File | undefined>(undefined);

  submit(): void {
    this.submitting.set(true);
@@ -47,74 +39,4 @@ export class RegistrationPage {
      },
    });
  }
-
-  onFileSelected(event: Event): void {
-    const input = event.target as HTMLInputElement;
-    this.selectedFile.set(input.files?.[0] ?? undefined);
-  }
-
-  async provideDocuments(): Promise<void> {
-    const reference = this.reference();
-    const file = this.selectedFile();
-    if (!reference || !file) {
-      return;
-    }
-    this.providingDocuments.set(true);
-    this.provideDocumentsFailed.set(false);
-    let contentBase64: string;
-    try {
-      contentBase64 = await readAsBase64(file);
-    } catch {
-      this.provideDocumentsFailed.set(true);
-      this.providingDocuments.set(false);
-      return;
-    }
-    this.bff
-      .postSelfServiceRegistrationsIdDocuments(reference, {
-        contentBase64,
-        fileName: file.name,
-        contentType: file.type || 'application/pdf',
-      })
-      .subscribe({
-        next: () => {
-          this.documentsProvided.set(true);
-          this.providingDocuments.set(false);
-        },
-        // Surface the failure instead of swallowing it: keep the action so the user can retry.
-        error: () => {
-          this.provideDocumentsFailed.set(true);
-          this.providingDocuments.set(false);
-        },
-      });
-  }
-
-  withdraw(): void {
-    const reference = this.reference();
-    if (!reference) {
-      return;
-    }
-    this.withdrawing.set(true);
-    this.withdrawFailed.set(false);
-    this.bff.postSelfServiceRegistrationsIdWithdraw(reference).subscribe({
-      next: () => {
-        this.withdrawn.set(true);
-        this.withdrawing.set(false);
-      },
-      // Surface the failure instead of swallowing it: keep the action so the user can retry.
-      error: () => {
-        this.withdrawFailed.set(true);
-        this.withdrawing.set(false);
-      },
-    });
-  }
-}
-
-/** Read a file's bytes as a base64 string (without the `data:...;base64,` prefix). */
-function readAsBase64(file: File): Promise<string> {
-  return new Promise<string>((resolve, reject) => {
-    const reader = new FileReader();
-    reader.onload = () => resolve(((reader.result as string) ?? '').split(',', 2)[1] ?? '');
-    reader.onerror = () => reject(reader.error ?? new Error('Could not read the file.'));
-    reader.readAsDataURL(file);
-  });
 }
@@ -1,76 +0,0 @@
-# ADR-0013: Behandel-portal wiring — multi-realm BFF auth, werkbak from Flowable tasks, decision completes the task
-
- **Status:** Accepted
- **Date:** 2026-07-15
- **Deciders:** Respellion engineering
- **Relates to:** #84 (adr-proposal), S-12 (#13); builds on ADR-0010 (BFF OIDC), ADR-0011 (approval status flow), ADR-0009 (external-task worker), ADR-0008 (read projection)
-
-## Context
-
-S-12 adds the behandel-portal: a behandelaar logs in, sees a **werkbak** of registrations awaiting
-beoordeling, and decides each (goedkeuren/afwijzen). Three questions had no obvious answer and shape
-the whole slice.
-
-1. **Which realm authenticates behandelaars, and how does the BFF accept it?** Citizens use the
-   `digid` realm (ADR-0010); staff use a separate `medewerker` realm with roles (`behandelaar`,
-   `teamlead`). Keycloak realms are distinct issuers with distinct signing keys, so the BFF's single
-   `digid`-realm JWT validation rejects a medewerker token outright.
-2. **Where does the werkbak get its data?** The registrations awaiting beoordeling could come from
-   the read projection (status-filtered rows) or from the Flowable `Beoordelen` user tasks (S-12b).
-3. **How does a decision correlate to the workflow?** The process parks at the `Beoordelen` user
-   task; the decision must advance it, and also apply the domain transition (ADR-0011).
-
-## Decision
-
-**The BFF validates a second realm for behandel endpoints; the werkbak is the set of open Flowable
-`Beoordelen` tasks (read through the domain); and a decision both applies the domain transition and
-completes the Flowable task.**
-
- **Multi-realm BFF auth.** The BFF registers a second JWT bearer scheme (`medewerker`, authority =
-  the medewerker realm) alongside the default `digid` scheme. `/behandel/*` endpoints require an
-  authorization policy bound to the `medewerker` scheme **and** the `behandelaar` role. Keycloak puts
-  realm roles in the nested `realm_access.roles` claim, which ASP.NET does not map automatically, so
-  the scheme's `OnTokenValidated` lifts those roles onto the principal as role claims. Self-service
-  keeps the `digid` scheme. Audience validation stays off (ADR-0010's deferred hardening).
- **Werkbak = Flowable user tasks (via the domain).** The domain's `Werkbak` query reads the open
-  `Beoordelen` tasks from the Workflow Client (§8.2, `IUserTaskClient`) and enriches each with its
-  aggregate's bsn + status; `GET /behandel/werkbak` exposes it and the BFF proxies it behind the
-  behandelaar policy. The list **is** the authoritative set of claimable/decidable work items, so a
-  decision acts on a real task with no separate correlation store. The read projection stays the
-  anonymous openbaar model — we do **not** project `IN_BEHANDELING` or populate staff-only personal
-  data (both deferred in ADR-0008) just to render a staff view.
- **Decision completes the task (S-12c-2).** A behandelaar decision applies the domain transition
-  (aggregate + ACL for approval, per ADR-0011) **and** completes the Flowable `Beoordelen` task
-  (looked up by registrationId), so the process advances. Implemented in the next sub-slice; recorded
-  here so the boundary is decided up front.
-
-Delivery is split: **S-12c-1** (this PR) = multi-realm auth + werkbak read; **S-12c-2** = the decide
-endpoint + task completion.
-
-## Consequences
-
-**Positive**
-
- Staff and citizens are cleanly separated by realm; the `behandelaar` role gates the behandel API.
- The werkbak reflects exactly what a behandelaar can act on; claim/decide need no extra correlation.
- No premature projection changes — the openbaar read model stays focused and personal-data-free.
- Only the ACL/Workflow Client talk to their peers; the BFF still fans out only to domain/projection
-  (§8.3).
-
-**Negative / costs**
-
- The BFF now depends on two Keycloak realms being reachable (`Keycloak:MedewerkerAuthority`).
- Rendering the werkbak fans out to Flowable (one task query) plus a store read per task — acceptable
-  for the caseload sizes here; a denormalized staff read model is an additive follow-up if needed.
- Realm separation (distinct issuers/keys) is validated live, not in the BFF unit tests, where issuer
-  validation is off and one test key signs both realms; the tests exercise the role-based authorization.
-
-## Alternatives considered
-
- **Werkbak from the read projection** — rejected for now: needs new plumbing to project
-  `IN_BEHANDELING` and to populate staff-only bsn/naam (deferred, ADR-0008), plus a separate way to
-  find the Flowable task at decide-time. Revisit if a high-volume denormalized staff view is needed.
- **One JWT scheme accepting both realms (issuer validation off)** — rejected: trusting multiple
-  issuers without validation is a security regression; two schemes keep each realm's issuer/key checked.
- **A dedicated behandel BFF/service** — rejected as premature; one BFF with per-endpoint policies is
-  enough at this size and keeps §8.3 simple.
@@ -1,72 +0,0 @@
-# ADR-0014: Withdrawal cancels the registratie process via a BPMN message event
-
- **Status:** Accepted
- **Date:** 2026-07-16
- **Deciders:** Respellion engineering
- **Relates to:** S-11 (#12); builds on ADR-0009 (external-task worker / Workflow Client), ADR-0013
-  (behandel-portal wiring, the Beoordelen user task)
-
-## Context
-
-S-11 lets a zorgprofessional withdraw a still-open registration ("trek aanvraag in"). S-11a already
-advances the aggregate to INGETROKKEN (domain state). But the registratie process is still running in
-Flowable — parked at the `Beoordelen` user task — so without a second step the withdrawn registration
-would linger as work for a behandelaar. The withdrawal must also **cancel the running process**.
-
-Two questions shape this sub-slice.
-
-1. **How does the case get cancelled — in code, or in the BPMN model?**
-2. **How does a withdrawal correlate to the right running process instance?**
-
-## Decision
-
-**The BPMN models the cancellation as an interrupting message boundary event on the `Beoordelen`
-task; the Workflow Client correlates a `RegistratieIngetrokken` message to the task's execution.**
-
- **Modelled in BPMN, not deleted from code.** The `Beoordelen` user task carries an interrupting
-  message boundary event (`RegistratieIngetrokken`) that routes to a dedicated "Registratie
-  ingetrokken" end event. The process's own model says *how* a withdrawal ends it — the Workflow
-  Client only delivers the message; it never reaches into Flowable to delete an instance. This keeps
-  the workflow's control flow in the workflow (§8.2) and leaves an audit trail in Flowable history
-  (the process ended via the ingetrokken path, not a raw delete).
- **Correlated by the registration's own process instance.** The aggregate records its Flowable
-  process instance id at submit, so the `WithdrawRegistration` handler correlates directly by that
-  id — no task lookup. The Workflow Client asks Flowable for the execution **subscribed to** the
-  `RegistratieIngetrokken` message in that instance and delivers `messageEventReceived` to it.
-  Targeting the subscribed execution (not the user task's execution — a message boundary event's
-  subscription lives on its own execution) is what makes the correlation land.
- **Best-effort, mirroring the beoordeling.** If no open `Beoordelen` task is found (the process has
-  not yet parked there — the `OpenZaakAanmaken` window — or has already ended), the withdrawal still
-  stands: the aggregate is INGETROKKEN and the werkbak filters it out regardless (S-11b). We complete
-  the domain transition first and cancel the workflow best-effort, exactly as `BeoordeelRegistratie`
-  completes its task best-effort.
-
-## Consequences
-
-**Positive**
-
- The cancellation path is visible in `registratie.bpmn`; the Workflow Client stays the only code
-  that talks to Flowable and does not delete instances behind the model's back.
- Reuses the existing task-query correlation — no new plumbing, no correlation store.
- A withdrawn case leaves the werkbak (its `Beoordelen` task is cancelled), and the werkbak also
-  filters non-open registrations as a belt-and-braces for the brief window before cancellation lands.
-
-**Negative / costs**
-
- A withdrawal raced ahead of the process reaching `Beoordelen` (during `OpenZaakAanmaken`, seconds)
-  finds no task to cancel, so that process instance runs on to `Beoordelen` and parks there with no
-  one to act on it (it is hidden from the werkbak by the status filter). Acceptable for this
-  reference at these volumes; a process-level interrupting event subprocess would close the gap and
-  is an additive follow-up if it matters.
- The Flowable message-correlation REST shape is validated live (verify-stack), not in the
-  Workflow Client's unit tests, which stub the HTTP exchange and assert only the request shape
-  (consistent with ADR-0009).
-
-## Alternatives considered
-
- **Delete the process instance from the Workflow Client** (`DELETE /runtime/process-instances/{id}`)
-  — rejected: it cancels the case but hides the reason from the BPMN model; the "why" lives in code,
-  not the process. The message event keeps the cancellation a first-class part of the workflow.
- **Interrupting message event subprocess at process level** — more robust (correlates anytime,
-  closing the `OpenZaakAanmaken`-race gap), but a heavier BPMN construct; deferred as an additive
-  change if the race proves to matter.
@@ -1,77 +0,0 @@
-# ADR-0015: Beoordeling escalation reassigns via an external-worker task
-
- **Status:** Accepted
- **Date:** 2026-07-17
- **Deciders:** Respellion engineering
- **Relates to:** S-14 (#15); proposal #98. Builds on ADR-0009 (external-task worker / Workflow
-  Client), ADR-0013 (behandel-portal wiring, the `Beoordelen` user task), ADR-0014 (the boundary-event
-  pattern on `Beoordelen`).
-
-## Context
-
-S-14 escalates a beoordeling that a behandelaar does not pick up in time: after 14 days the case must
-move to the `teamlead` role (PRD §5, flow 5). The `Beoordelen` user task already exists, claimable by
-the `behandelaar` candidate group; the teamlead role is seeded in the medewerker realm.
-
-Two forces shape this.
-
-1. **The task must stay open.** Escalation changes *who may claim* an unclaimed beoordeling, not the
-   work itself — so the timer must be **non-interrupting**: the `Beoordelen` task keeps running while
-   escalation happens alongside it.
-2. **Reassigning an open task's candidate group needs code.** Flowable cannot rewrite the candidate
-   groups of an already-open user task from BPMN XML alone — that requires either a Java delegate/listener
-   embedded in the engine, or an out-of-process actor driving the REST API. The repository has held a
-   "stock Flowable image, no custom jars; the Workflow Client is the only code that talks to Flowable
-   (§8.2)" posture since ADR-0009.
-
-## Decision
-
-**A non-interrupting `P14D` boundary timer on `Beoordelen` fires an external-worker task
-(`BeoordelingEscaleren`); the Workflow Client reassigns the still-open `Beoordelen` task from the
-behandelaar group to teamlead.**
-
- **Modelled in BPMN, driven by an external worker.** The timer routes a parallel token to an
-  `external-worker` service task on the `BeoordelingEscaleren` topic, ending at a dedicated "Beoordeling
-  geëscaleerd" end event. The model owns *when* escalation happens; the Workflow Client — the only code
-  that talks to Flowable (§8.2) — owns *how* the reassignment is applied, exactly as `OpenZaakAanmaken`
-  delegates the ZGW call (ADR-0009). No custom code runs inside Flowable.
- **Reassignment is a candidate-group swap.** The escalation worker finds the still-open `Beoordelen`
-  task in the escalating instance (task query by `processInstanceId` + `taskDefinitionKey`), adds
-  `teamlead` as a candidate group via the task identity links, then removes `behandelaar`. The task now
-  belongs to the teamlead; its history and variables are untouched.
- **Best-effort, mirroring beoordeling and withdrawal.** If the task is no longer open — the behandelaar
-  completed it in the window before the timer fired — the reassignment is a no-op. A failed reassignment
-  leaves the escalation job un-completed so Flowable redelivers it (§8.6), consistent with the
-  `OpenZaakAanmaken` worker.
- **Segregated interface.** The escalation methods live on `IBeoordelingEscalatieClient`, separate from
-  the `OpenZaakAanmaken` worker's `IExternalWorkerClient`, so the OpenZaak worker never sees escalation
-  (interface segregation). Both are implemented by the one `FlowableWorkflowClient`.
-
-## Consequences
-
-**Positive**
-
- The escalation trigger is visible in `registratie.bpmn`; Flowable stays a stock image, and the
-  Workflow Client remains the sole Flowable client (§8.2 upheld, not bent).
- Reuses the external-worker mechanics (topic acquire/complete, hosted pump, per-tick scope,
-  redelivery-on-failure) wholesale — the new code is one client capability, one processor, one pump.
- Escalation latency is bounded by the worker's poll interval (seconds) — negligible against a 14-day
-  timer.
-
-**Negative / costs**
-
- Escalation is two REST hops (add teamlead, remove behandelaar) rather than one atomic update; between
-  them the task is briefly claimable by both groups. Harmless at these volumes, and the pair is idempotent
-  on redelivery.
- The Flowable identity-link and management-job REST shapes are validated live (verify-domain fires the
-  timer early via the management API), not in the Workflow Client's unit tests, which stub the HTTP
-  exchange and assert only the request shape — consistent with ADR-0009 and ADR-0014.
-
-## Alternatives considered
-
- **Flowable timer/task listener (Java delegate).** Reassign in-engine when the timer fires. Rejected:
-  it needs a custom jar in Flowable, breaking the stock-image, REST-only posture and adding a build/deploy
-  surface to the engine for no capability the external-worker route lacks.
- **Interrupting timer that re-creates the task for teamlead.** Cancel `Beoordelen` and start a fresh
-  teamlead task. Rejected: it loses the task's identity/history and complicates correlation, where a
-  candidate-group swap on the same task expresses "the same work, now the teamlead's" directly.
@@ -1,77 +0,0 @@
-# ADR-0016: Diploma eligibility is a DMN evaluated inline as a BPMN DMN service task
-
- **Status:** Accepted
- **Date:** 2026-07-17
- **Deciders:** Respellion engineering
- **Relates to:** S-13 (#14); proposal #100. Builds on ADR-0009 (external-task worker / Workflow
-  Client), ADR-0014/0015 (the boundary-event and routing constructs on the registratie process).
-
-## Context
-
-S-13 adds flow 4: a foreign diploma must get an extra CBGV-advies assessment before beoordeling
-(PRD §5). The eligibility decision — domestic goes straight to beoordeling, foreign routes through
-CBGV-advies — needs a home. The Flowable REST app bundles a DMN engine, and the same
-`repository/deployments` machinery that deploys `registratie.bpmn` can deploy a `.dmn`. §8.2 makes
-the Workflow Client the only code that talks to Flowable; the PRD frames the workflow as "BPMN + DMN
-governing the registration workflow" (Flowable as a peer orchestration module).
-
-The issue's wording ("a DMN decision table evaluated by the Domain Service via Workflow Client")
-suggests the domain reaches into Flowable's DMN API to evaluate the decision and feeds the result
-back. That is one option; it is not the only one, and it is not the cleanest.
-
-## Decision
-
-**The diploma-eligibility DMN is deployed to Flowable and evaluated inline by the registratie process
-as a DMN service task (`flowable:type="dmn"`); an exclusive gateway routes on its output. The domain's
-only new job is to carry the diploma origin and pass it into the process as a start variable.**
-
- **The decision lives in the workflow.** `workflows/diploma-eligibility.dmn` maps `diplomaOrigin`
-  → `route` (`Buitenlands` ⇒ `CBGV_ADVIES`, otherwise `DIRECT`). A DMN service task
-  (`flowable:type="dmn"`, `decisionTableReferenceKey=diploma-eligibility`) runs it between
-  `OpenZaakAanmaken` and `Beoordelen`, and an exclusive gateway sends `CBGV_ADVIES` through a new
-  `CBGVAdvies` user task before `Beoordelen`, `DIRECT` straight there. (A `businessRuleTask` would
-  bind Flowable's legacy Drools/KIE implementation, which `flowable-rest` does not bundle — its parse
-  handler throws `NoClassDefFoundError` at deploy time; the DMN service task is the supported route.)
- **The domain carries the input, not the decision.** The `Registration` aggregate gains a
-  `DiplomaOrigin` (Binnenlands/Buitenlands); `SubmitRegistration` passes it to
-  `StartRegistrationProcessAsync`, which sets it as the `diplomaOrigin` start variable. The domain
-  never evaluates the DMN and never learns the route — that is the process's concern.
- **Deployed as its own DMN-engine deployment, separate from the BPMN.** The DMN is version-controlled
-  in `workflows/` and `flowable-init` deploys it to the DMN engine via the `dmn-api`
-  (`/dmn-api/dmn-repository/deployments`), while `registratie.bpmn` goes to the process engine via
-  `/service/repository/deployments`. Two things were learned the hard way here (both cost a CI cycle):
-  (1) `flowable-rest` does **not** cascade a `.dmn` bundled inside a process `.bar` into the DMN engine
-  — the resource is stored but no decision is created, so the service task fails at runtime with
-  `FlowableObjectNotFoundException: No decision found for key`; the DMN must go through `dmn-api`.
-  (2) Flowable's DMN XML converter rejects an XML comment placed between the `<?xml?>` declaration and
-  the root `<definitions>` element (`XMLStreamReader not in START_DOCUMENT or START_ELEMENT state`),
-  unlike its BPMN converter — so the DMN's documentation comment lives *inside* `<definitions>`.
-  With the decision present in the DMN repository, the process's DMN service task resolves it across
-  deployments by key (verified live), so no shared parent deployment id is needed.
-
-## Consequences
-
-**Positive**
-
- The eligibility rule is a first-class, inspectable workflow artefact (matching the PRD's BPMN+DMN
-  framing); business users can read/adjust the decision table without touching domain code.
- §8.2 stays clean: the Workflow Client remains the only code talking to Flowable, and the decision
-  runs inside the process the client already started — no domain→Flowable round-trip for a decision.
- The domain change is minimal and additive: one value on the aggregate, one start variable.
-
-**Negative / costs**
-
- Deviates from #14's literal "evaluated by the Domain Service via Workflow Client" wording (noted on
-  the issue). The outcome — DMN decides eligibility, foreign diplomas get the CBGV step — is unchanged.
- The DMN and its service-task wiring are validated live (verify-domain drives a foreign
-  registration through CBGV-advies and a domestic one straight to beoordeling, exercising both
-  branches), not in unit tests — consistent with ADR-0009/0014/0015. The domain unit/acceptance tests
-  cover only that the origin is carried into the process.
-
-## Alternatives considered
-
- **Domain evaluates the DMN via the Workflow Client** (the issue's wording). Rejected: it couples
-  the domain to Flowable for a decision and splits the routing across two places (domain computes,
-  BPMN branches), for no benefit over letting the engine that owns the process own the decision.
- **Eligibility rules in domain C#.** Rejected: it moves a governable business decision out of the
-  DMN the PRD calls for, and hard-codes what the reference app is meant to demonstrate as data.
@@ -1,90 +0,0 @@
-# ADR-0017: A document-wait task with a 30-day interrupting timer cancels the registration
-
- **Status:** Accepted
- **Date:** 2026-07-20
- **Deciders:** Respellion engineering
- **Relates to:** S-10a (#102); proposal #104; split from S-10 (#11). Builds on ADR-0009 (external-task
-  worker / Workflow Client), ADR-0014 (withdrawal cancels the process), ADR-0015 (beoordeling
-  escalation — the boundary-timer + external-worker pattern), ADR-0016 (diploma-eligibility DMN).
-
-## Context
-
-Flow 2 (PRD §5) requires the citizen to supply documents (their diploma) after submitting. The
-registratie process must park waiting for those documents and, if they do not arrive within 30 days,
-cancel the case. S-10 was split (§13): **S-10a** is this workflow/timeout spine (backend only);
-**S-10b** wires the actual upload (portal → BFF → domain → ACL → Documenten API) that completes the
-wait. This ADR records the spine: where the wait sits, how the timeout cancels, and how the domain
-aggregate stays in sync.
-
-## Decision
-
-**A `WachtOpDocumenten` user task is inserted immediately after `OpenZaakAanmaken`, carrying an
-`cancelActivity="true"` (interrupting) `P30D` boundary timer. "Documents received" completes the task
-and the process continues into the diploma-eligibility routing; on timeout the timer cancels the task,
-runs a `RegistratieVerlopen` external-worker task, and ends the process at `endVerlopen`. A domain
-worker expires the correlated aggregate to a new terminal status `Verlopen`.**
-
- **Where the wait sits.** Right after the zaak is opened, before the diploma-eligibility DMN: the zaak
-  exists, then the process waits for documents; on receipt it continues to the DMN routing → Beoordelen
-  (ADR-0016). The wait gates the whole assessment, so it precedes the routing rather than sitting
-  between the gateway and Beoordelen.
- **Interrupting timer, mirroring the existing constructs.** Unlike the S-14 escalation timer
-  (non-interrupting — the Beoordelen task stays open), this timer is interrupting: when it fires the
-  wait token is consumed and the case is cancelled, like the S-11 withdrawal boundary (ADR-0014). The
-  timeout branch runs a `RegistratieVerlopen` external-worker task (topic mirrors
-  `OpenZaakAanmaken`/`BeoordelingEscaleren`) → `endVerlopen`.
- **The domain stays authoritative.** The `RegistratieVerlopen` job carries the `registrationId`; the
-  `RegistratieVerlopenProcessor` drains it and the `ExpireRegistrationWorker` loads the aggregate and
-  calls `Registration.Expire()`, moving it to the new terminal status `Verlopen`. This keeps the
-  aggregate — which the projection/openbaar view reads — the source of truth, exactly as escalation and
-  withdrawal do. Idempotent per §8.6: a redelivered job whose aggregate is already `Verlopen` completes
-  without persisting again; an unknown registration throws so the job is redelivered.
- **Documents-in-time transition.** `IWorkflowClient.CompleteDocumentWaitAsync(processInstanceId)`
-  completes the `WachtOpDocumenten` task (the Workflow Client remains the only code that talks to
-  Flowable, §8.2). It is best-effort — a no-op if the instance already left the wait (continued, or
-  timed out). The trigger is wired end-to-end in S-10a: a `ProvideDocuments` application use case behind
-  an owner-scoped domain endpoint `POST /registrations/{id}/documents`, a BFF passthrough
-  `POST /self-service/registrations/{id}/documents` (bsn from the DigiD token), and a "Documenten
-  aanleveren" action on the self-service page — so the walking-skeleton e2e stays green (a registration
-  can still reach the behandelaar). **S-10b replaces the stub trigger with a real file upload stored in
-  the ZGW Documenten (DRC) API via the ACL**; the completion of the wait is unchanged.
-  - *Why the trigger lives here, not in S-10b:* inserting the `WachtOpDocumenten` gate without any way
-    to pass it breaks the submit→beoordeling e2e (a merge gate). Splitting "gate" from "means to pass
-    the gate" across slices would leave `main` red, so S-10a owns both; S-10b is purely the ZGW storage
-    behind the same action.
-
-## Consequences
-
-**Positive**
-
- The wait/timeout is a first-class workflow construct that reuses the boundary-timer + external-worker
-  pattern already proven by S-14, so the domain change is small and additive: one terminal status, one
-  worker trio (worker + processor + pump), one Workflow Client method.
- §8 stays clean: the Workflow Client is still the only Flowable caller, and no new ZGW boundary is
-  introduced in S-10a.
- The timeout is verified live (verify-domain fires the P30D timer via the management-API "move" idiom
-  and asserts the domain reaches `Verlopen`), consistent with ADR-0009/0014/0015.
-
-**Negative / costs**
-
- Every registration now parks at `WachtOpDocumenten` before Beoordelen, so the other flows must supply
-  documents first: the live-check blocks (S-11/S-12b/S-13/S-14) complete the task via Flowable, and the
-  registration e2e clicks "Documenten aanleveren". A small, explicit step, but it touches every path
-  through the process.
- On expiry S-10a cancels the *process* and marks the aggregate `Verlopen` but does **not** set the ZGW
-  *zaak* to a cancellation status — that needs a new ACL method + statustype seeding, which overlaps
-  S-10b's ACL/infra work. Deferred to S-10b (or a follow-up); noted here as the S-10a/S-10b boundary.
- Withdrawing while parked at `WachtOpDocumenten` marks the aggregate `Ingetrokken` but does not cancel
-  the process (the withdrawal message boundary is on `Beoordelen`); the timeout worker tolerates this
-  by no-op'ing on an already-resolved aggregate. Extending withdrawal to the wait state is a follow-up.
-
-## Alternatives considered
-
- **Pure-BPMN cancellation (timer → end event, no worker).** Rejected: the domain aggregate would then
-  be out of sync with the cancelled process, and the openbaar/projection view reads the aggregate's
-  status — the case would still look open.
- **Wait task between the gateway and Beoordelen.** Rejected: documents gate the whole assessment
-  (including the CBGV-advies routing), so the wait belongs before the DMN, not after it.
- **A dedicated timeout status per branch vs. reusing an open-state guard.** `Expire()` reuses the same
-  `RequireOpenForDecision` guard as withdrawal/decision, so only an `INGEDIEND`/`IN_BEHANDELING`
-  registration can lapse and the terminal states stay mutually exclusive — no new guard logic.
@@ -1,74 +0,0 @@
-# ADR-0018: Diploma upload is stored in the ZGW Documenten API, fronted by the ACL
-
- **Status:** Accepted
- **Date:** 2026-07-20
- **Deciders:** Respellion engineering
- **Relates to:** S-10b (#103); proposal #107. Builds on ADR-0001 (ACL is the only ZGW caller),
-  ADR-0003 (ACL default-fill), ADR-0017 (document-wait + provision trigger). Carves the zaak-close on
-  expiry to #106 (S-10c).
-
-## Context
-
-S-10a wired the "documenten aanleveren" trigger (portal → BFF → domain → complete the WachtOpDocumenten
-wait) with the file itself stubbed. S-10b makes the upload real: the diploma must be **stored in the
-ZGW Documenten (DRC) API** and related to the zaak. §8.1 makes the ACL the only code that talks to ZGW.
-The DRC API is served by the same OpenZaak container as the Zaken/Catalogi APIs.
-
-## Decision
-
-**The ACL fronts the Documenten API: it creates an `enkelvoudiginformatieobject` and relates it to the
-zaak. The file travels base64-encoded in JSON across every hop (the portal encodes it client-side); a
-"Diploma" `informatieobjecttype` is seeded in the catalogus and injected into the ACL like the
-zaaktype.**
-
- **ACL gateway.** `OpenZaakGateway.StoreDocumentAsync` POSTs the `enkelvoudiginformatieobject`
-  (`/documenten/api/v1/enkelvoudiginformatieobjecten`, base64 `inhoud`, `bestandsomvang`,
-  `status=definitief`) then relates it to the zaak (`/zaken/api/v1/zaakinformatieobjecten`), reusing the
-  established gateway patterns (ZGW Bearer JWT, buffered non-chunked body for uwsgi, **no CRS headers** —
-  the Documenten API is not geo, unlike zaak-create). `AclService.StoreDiplomaAsync` default-fills the
-  ZGW-mandatory fields (informatieobjecttype, bronorganisatie, vertrouwelijkheidaanduiding, `taal=nld`,
-  creatiedatum); the domain hands over only the zaak, the bytes, and the file's name/type. No new ZGW
-  scopes were needed — the seed applicatie holds `heeft_alle_autorisaties`.
- **The file travels as base64 JSON end-to-end.** The portal reads the chosen file client-side
-  (`FileReader`) and posts `{ contentBase64, fileName, contentType }` as JSON to the BFF; the BFF
-  forwards it to the domain, and the domain to the ACL, all as JSON. This deviates from proposal #107's
-  "multipart on the portal→BFF hop": base64 JSON keeps **one** contract shape across all four services
-  (no `IFormFile`/antiforgery plumbing, no multipart in the generated client), and a diploma is a small
-  placeholder PDF, so the ~33% base64 overhead is immaterial. The ACL turns the base64 back into the
-  ZGW `inhoud`.
- **Storing precedes completing the wait.** `ProvideDocuments` (from S-10a) now stores the diploma via
-  the ACL — once the zaak is opened — and then completes the `WachtOpDocumenten` task, so a registration
-  reaches beoordeling only after its diploma is stored. Both steps stay best-effort about missing
-  preconditions (no zaak yet → skip storage; no process yet → skip completion), mirroring withdrawal.
- **Catalogus.** `seed_catalogus.py` (OZ_PUBLISH) creates a "Diploma" `informatieobjecttype`, relates it
-  to the zaaktype (`zaaktype-informatieobjecttypen`, while both concept), publishes both, and prints
-  `INFORMATIEOBJECTTYPE_URL`; verify-domain injects it as `Acl__Defaults__InformatieobjecttypeUrl`
-  (a zeros-uuid placeholder otherwise, so the ACL still boots).
-
-## Consequences
-
-**Positive**
-
- §8.1 stays intact: the ACL is still the only ZGW caller; the portal only talks to the BFF; the domain
-  only crosses the ACL boundary. Adding a document was almost entirely additive (one gateway method, one
-  default, one seed block).
- One JSON contract shape across portal/BFF/domain/ACL keeps the generated client and the service
-  contracts uniform; the upload is exercised live (ACL integration test against real OpenZaak; the
-  Playwright journey uploads a real PDF).
-
-**Negative / costs**
-
- Base64 inflates the payload ~33% and holds the whole file in memory at each hop — fine for a small
-  diploma, but not a pattern to reuse for large documents without streaming/multipart.
- The zaak is **not** set to a cancellation status when the 30-day term lapses — carved to #106 (S-10c),
-  which adds the cancellation statustype/resultaattype + ACL method + expiry-worker wiring.
- Providing documents before the zaak is opened silently skips storage (best-effort); the e2e/live flow
-  avoids this by uploading only after the openbaar register shows the zaak (INGEDIEND).
-
-## Alternatives considered
-
- **Multipart on the portal→BFF hop** (proposal #107). Rejected: it splits the transport into two shapes
-  (multipart then JSON), needs `IFormFile` + antiforgery handling and a multipart method in the generated
-  client, for no benefit at diploma size.
- **The domain talks to the Documenten API directly.** Rejected outright: violates §8.1 (only the ACL
-  talks to ZGW).
@@ -1,81 +0,0 @@
-# ADR-0019: A timed-out zaak is cancelled with a distinct status + resultaat, resolved by name
-
- **Status:** Accepted
- **Date:** 2026-07-21
- **Deciders:** Respellion engineering
- **Relates to:** S-10c (#106). Completes the S-10a/S-10b boundary noted in ADR-0017 (§Consequences) and
-  reuses the ACL close-zaak machinery from S-09b (approval) and the Documenten work in ADR-0018.
-
-## Context
-
-ADR-0017 (S-10a) cancels the *process* and marks the domain aggregate `Verlopen` when the 30-day
-document term lapses, but explicitly deferred setting the ZGW **zaak** to a cancellation status. Left
-open, a timed-out zaak stays open in OpenZaak while the register shows the registration as lapsed — the
-two diverge. S-10c closes that gap: on expiry the domain must also cancel the zaak through the ACL
-(§8.1, the only code that talks to ZGW).
-
-The non-obvious part is *how to represent "cancelled" in ZGW* alongside the existing "approved" close.
-The approval path (S-09b) sets the zaak's **eindstatus** (the terminal statustype) plus a resultaat. In
-ZGW a zaaktype has exactly one eindstatus — the highest-`volgnummer` statustype — and setting it is what
-closes the zaak (`einddatum`). A second *terminal* status would collide with that single-eindstatus rule.
-
-## Decision
-
-**Model cancellation as a distinct, non-terminal `Geannuleerd` statustype plus a distinct `Vervallen`
-resultaat, and resolve both the approval and cancellation statustype/resultaat by their omschrijving
-(name) rather than by position or the eindstatus flag alone.**
-
- **Seed.** `Geannuleerd` is seeded at `volgnummer` 2 — between `Ontvangen` (1) and the `Afgehandeld`
-  eindstatus (3) — so it is a *non-terminal* status and never displaces the eindstatus the approval path
-  resolves. A second resultaattype `Vervallen` (archiefnominatie `vernietigen`) is seeded beside the
-  approval `Geregistreerd` (`blijvend_bewaren`); both draw their `selectielijstklasse` from the
-  zaaktype's single `selectielijstProcestype` so they validate on publish.
- **The ACL owns the mapping.** `OpenZaakGateway.SetZaakToCancellationStatusAsync` resolves `Geannuleerd`
-  + `Vervallen` by omschrijving and POSTs the resultaat then the status (OpenZaak requires a resultaat
-  before a closing/terminal status), mirroring `SetZaakToEindstatusAsync`. Exposed as
-  `AclService.CancelZaakAsync` behind the ACL endpoint `POST /annuleringen`. The omschrijvingen live as
-  constants in the gateway — the ACL, not the domain, knows which ZGW status means what (§8.1).
- **Approval now resolves its resultaat by name too.** With two resultaattypen present, taking the first
-  is ambiguous (the Zaken API does not guarantee order), so the approval path resolves `Geregistreerd`
-  by omschrijving. Its statustype resolution is unchanged (still the eindstatus).
- **Domain wiring.** The `ExpireRegistrationWorker` calls `IAclClient.CancelZaakAsync(zaakUrl)` **before**
-  advancing the aggregate to `Verlopen` (ACL-first, mirroring approval): if the ACL call fails the job is
-  redelivered (§8.6) rather than leaving the aggregate `Verlopen` with an open zaak. The existing
-  open-state guard stops a redelivered job from cancelling twice (a second resultaat would be a 400); a
-  registration that lapsed before its zaak was opened has nothing to cancel.
-
-## Consequences
-
-**Positive**
-
- The domain aggregate and the ZGW zaak no longer diverge on timeout — both reflect the cancellation.
- Reuses the approval close machinery (resultaat-then-status, ACL endpoint shape, ACL-first ordering), so
-  the change is additive and §8 stays clean (only the ACL talks to ZGW).
- Verified at two levels: an ACL↔OpenZaak integration test asserts the live zaak reaches `Geannuleerd`
-  with a resultaat, and the domain verify script fires the real P30D timer and confirms the zaak is
-  cancelled end-to-end.
-
-**Negative / costs**
-
- `Geannuleerd` is non-terminal, so the cancelled zaak's `einddatum` is not set — it carries a
-  cancellation status + resultaat but is not formally "closed" in ZGW. Accepted: the register reads the
-  domain aggregate's status, and a single eindstatus per zaaktype is a ZGW constraint we chose not to
-  fight. Formally closing a cancelled zaak (a second eindstatus, or reusing `Afgehandeld` with a
-  `Vervallen` resultaat) is a possible follow-up.
- The ACL couples to the seeded omschrijvingen (`Geregistreerd`/`Geannuleerd`/`Vervallen`) by string
-  constants. This mirrors the existing implicit coupling to the catalogus (zaaktype URL, eindstatus) and
-  is documented in the gateway.
- Renumbering `Afgehandeld` from `volgnummer` 2 to 3 means a *stale* local catalogus must have its
-  OpenZaak volumes reset for the change to take effect; CI reseeds a fresh catalogus each run.
-
-## Alternatives considered
-
- **Shared eindstatus, distinct resultaat only** (reuse `Afgehandeld`, distinguish approval vs
-  cancellation purely by the resultaat). ZGW-idiomatic and would set `einddatum` on cancellation too, but
-  the register would show no visibly distinct cancellation *status*. Rejected in favour of the issue's
-  explicit "distinct statustype + resultaattype" outcome, which makes the cancellation legible in ZGW.
- **A second terminal (eindstatus) `Geannuleerd`.** Rejected: ZGW allows only one eindstatus per
-  zaaktype (highest volgnummer); a second terminal status would either not close the zaak or collide with
-  the approval eindstatus resolution.
- **Passing the target omschrijvingen from the domain.** Rejected: which ZGW status means "cancelled" is
-  ZGW vocabulary the ACL owns (§8.1); the domain says only "cancel this zaak".
@@ -1,92 +0,0 @@
-# ADR-0020: The local stack self-seeds the zaaktype, DMN, and NRC abonnement at bring-up
-
- **Status:** Accepted
- **Date:** 2026-07-22
- **Deciders:** Respellion engineering
- **Relates to:** S-B04 (#110). Local-stack twin of the seeding the verify-* scripts do for CI
-  (`infra/run-domain-check.sh`, `infra/verify-notification-driver.py`). Superseded in part by S-27
-  (#113), which would let the ACL resolve its zaaktype by identificatie and remove the URL injection.
-
-## Context
-
-`infra/docker-compose.local.yml` is the host-browser-friendly stack (`make local`) — the one a
-developer clicks through the portals with. It had drifted behind three slices, so a fresh bring-up
-could not complete the flow:
-
-1. The ACL pointed at a placeholder zaaktype (`…/00000000-…`), so zaak creation failed with OpenZaak
-   `400` and the registratie process stuck at `OpenZaakAanmaken` (S-05).
-2. `flowable-init` deployed only `registratie.bpmn`, not `diploma-eligibility.dmn`, so completing
-   `WachtOpDocumenten` 404'd on the missing decision and never reached `Beoordelen` (S-10a/S-13).
-3. No NRC abonnement was registered, so notifications reached NRC and went nowhere — the projection
-   and the openbaar register stayed empty (S-06).
-
-The CI stack (`infra/docker-compose.yml`) does not hit this because its `verify-*` scripts seed the
-zaaktype, deploy the DMN, and register the abonnement at *test* time. The local stack has no such
-harness — a developer just runs `make local` and browses. The non-obvious wrinkle is (1): the
-zaaktype **UUID is assigned by OpenZaak at creation**, so the ACL's zaaktype URL is not knowable when
-the compose file is written and cannot be a static value.
-
-## Decision
-
-**Make the local stack self-seed at bring-up via one-shot init containers, and hand the ACL its
-server-assigned zaaktype URL through a shared-volume env file it sources on startup.**
-
- **DMN (gap 2).** `flowable-init` now deploys `diploma-eligibility.dmn` to the DMN engine
-  (`/flowable-rest/dmn-api/dmn-repository/deployments`) as a separate deployment alongside the BPMN —
-  identical to the CI `flowable-init`. Idempotent.
- **Zaaktype + ACL wiring (gap 1).** A `local-seed` one-shot runs the existing
-  `infra/openzaak/seed_catalogus.py` (`OZ_PUBLISH=1`) against OpenZaak and writes the resulting
-  `Acl__Defaults__ZaaktypeUrl` / `…InformatieobjecttypeUrl` / `Acl__OpenZaak__BaseUrl` into
-  `seed-env:/out/acl.env`. The ACL mounts that volume read-only and overrides its entrypoint to
-  `sh -c 'set -a; . /seed/acl.env; set +a; exec dotnet Acl.Api.dll'`, so the real values override the
-  compose placeholders before the app reads config. The ACL `depends_on: local-seed
-  (service_completed_successfully)`.
- **Abonnement (gap 3).** A `nrc-subscribe` one-shot registers an abonnement on the `zaken` kanaal
-  pointing at the event-subscriber's `/notifications` callback (`infra/local/register-abonnement.py`).
-  It is a leaf — nothing depends on it — so it can wait for the event-subscriber without forming a
-  cycle with the ACL bootstrap.
- **Reach OpenZaak/NRC by container IP, not service name.** Both the seed's ZTC calls and the
-  abonnement's `callbackUrl` are validated by Django's URLValidator, which rejects a single-label host
-  like `openzaak` / `event-subscriber`. The scripts resolve the target's container IP at runtime (as
-  `infra/run-domain-check.sh` does), keeping the seeded URLs valid **and** host-consistent — the ACL's
-  base URL is set to the same OpenZaak IP that owns the zaaktype URL.
- **Acceptance.** `make verify-local` (`infra/run-local-flow-check.sh`) submits against a fresh stack
-  and asserts the zaak opens, the case reaches the werkbak after documents, and the reference appears
-  in the openbaar register — the red-to-green test for all three gaps.
-
-## Consequences
-
-**Positive**
-
- A fresh `make local` completes the full demo (submit → werkbak → openbaar) with no manual seeding —
-  the slice's stated outcome.
- Reuses the proven CI mechanisms (`seed_catalogus.py`, the DMN deploy, the abonnement driver) rather
-  than inventing new ones; the only genuinely new piece is the entrypoint-sourced env file.
- No service code changes — the fix is entirely in `infra/` (compose + two small scripts), so the ACL
-  image and the CI stack are untouched.
-
-**Negative / costs**
-
- The two compose files diverge further: the CI stack seeds at test time, the local stack at bring-up.
-  Mitigated by reusing the same underlying scripts and cross-referencing them.
- The ACL entrypoint override couples the local ACL to the seed-written file path (`/seed/acl.env`);
-  if the seed fails, the ACL fails to start (loud, healthcheck-visible — preferred over silently
-  running with a placeholder).
- Container-IP-based URLs are re-derived on each bring-up; a keep-volumes restart with a changed
-  OpenZaak IP relies on OpenZaak rebuilding hyperlinked URLs from the request host (it does) so the
-  idempotent re-seed reports current-IP URLs.
-
-## Alternatives considered
-
- **ACL resolves its zaaktype by identificatie (`BIG-REGISTRATIE`) at startup.** The cleaner,
-  less-brittle design — no server-assigned URL to capture — and it would help the CI stack too. But it
-  changes a service's runtime behaviour and its config contract, needs new ACL tests + mutation
-  coverage, and still needs a seed step to *create* the zaaktype. Deliberately split out as its own
-  slice with its own ADR (S-27 / #113) rather than folded into this infra-only fix.
- **A documented `make local-seed` step run after `make local`.** Smallest change, but it fails the
-  slice's "no manual seeding" outcome — the local stack is exactly the one meant to just work in a
-  browser. Rejected.
- **Fixed zaaktype UUID via OpenZaak `setup_configuration`/fixtures.** OpenZaak assigns UUIDs on POST;
-  declaratively creating a fully *published* zaaktype (statustypen + resultaattypen validated against
-  the Selectielijst + roltypen + iot relations) is not something `setup_configuration` supports
-  cleanly in 1.28.2. Rejected as more fragile than reusing `seed_catalogus.py`.
@@ -1,67 +0,0 @@
-# ADR-0021: The ACL resolves its zaaktype by identificatie, not a pinned URL
-
- **Status:** Accepted
- **Date:** 2026-07-22
- **Deciders:** Respellion engineering
- **Relates to:** S-27 (#113), proposed in #117. The cleaner design deliberately split out of S-B04
-  (#110, ADR-0020), which fixed the local stack with an infra-only bootstrap.
-
-## Context
-
-The ACL was handed a **pinned zaaktype URL** (`Acl__Defaults__ZaaktypeUrl`) and diploma
-informatieobjecttype URL. OpenZaak assigns those UUIDs at creation, so the URL is not knowable when
-the compose file is written — every stack had to seed the catalogus and then capture + inject the
-resulting URLs out of band: `run-domain-check.sh` for CI, and the `local-seed` → `acl.env` bootstrap
-(ADR-0020) for `make local`. Brittle, and a stale/placeholder URL failed opaquely (OpenZaak 400).
-
-## Decision
-
-**The ACL resolves its zaaktype (by `identificatie`) and diploma informatieobjecttype (by
-`omschrijving`) from OpenZaak's Catalogi API, instead of being handed the URLs.**
-
- **Config:** `AclDefaults.ZaaktypeUrl`/`InformatieobjecttypeUrl` → `ZaaktypeIdentificatie`
-  (`BIG-REGISTRATIE`) / `InformatieobjecttypeOmschrijving` (`Diploma`).
- **Lookup (gateway, §8.1):** `GET /catalogi/api/v1/zaaktypen?status=definitief&identificatie=…` →
-  the published zaaktype URL; `GET /catalogi/api/v1/informatieobjecttypen?status=definitief` matched
-  on `omschrijving`. Reuses the gateway's existing catalogus-query machinery.
- **Timing = lazy + cached (`CachedZaaktypeCatalog`).** Resolve on first use (first zaak open /
-  document store) and cache for the process lifetime. Lazy avoids a startup ordering coupling — the
-  ACL never crash-loops when it boots before the catalogus is published. A **failed** resolution is
-  not cached, so it is retried on the next call (e.g. once the zaaktype is published); a restart
-  re-resolves.
- **Failure mode:** no published match → a clear "No published zaaktype with identificatie '…' found
-  in OpenZaak — is the BIG catalogus seeded and published?" error, replacing the opaque placeholder
-  400.
-
-## Consequences
-
-**Positive**
-
- No stack captures or injects a server-assigned URL any more: `run-domain-check.sh` drops the
-  `ACL_ZAAKTYPE_URL`/`ACL_INFORMATIEOBJECTTYPE_URL` capture+inject, `docker-compose.yml`/`.local.yml`
-  drop the placeholder URL env, and `local-seed`/`acl.env` shrink to a single line. The ACL
-  self-configures from the catalogus it already talks to.
- The failure mode is legible (a named error instead of a 400 on a zeros-UUID).
-
-**Negative / costs**
-
- The ACL still needs its OpenZaak **BaseUrl** pointed at a **URL-valid host (a container IP)**, so
-  the base-URL injection from ADR-0020 stays (the local `acl.env` now carries only that; CI keeps
-  `ACL_OPENZAAK_BASEURL`). This is **not** something S-27 can remove: OpenZaak validates the
-  `zaaktype` field on zaak-create with Django's URLValidator and **rejects a single-label host**
-  (`http://openzaak:8000/…` → `zaaktype: bad-url, "Voer een geldige URL in."`, confirmed empirically).
-  So ADR-0020's `seed-env` volume + ACL entrypoint shim are **simplified, not deleted**.
- New branching in the gateway/resolver → unit + integration test surface; the mutation ratchet
-  covers it (§5).
- A seed step still **creates + publishes** the zaaktype (this ADR changes only discovery). Reaching
-  OpenZaak's Catalogi API to *seed* likewise needs the IP host (its query params hit the same
-  URLValidator) — unchanged from before.
-
-## Alternatives considered
-
- **Resolve at startup** (eager). Simpler cache, but reintroduces the ordering coupling (crash-loop
-  if the catalogus isn't published yet). Rejected in favour of lazy.
- **Per-request resolution** (no cache). No stale-cache risk, but a Catalogi lookup on every ACL
-  operation. Rejected; a process-lifetime cache with restart-to-refresh is enough here.
- **Keep the pinned URL** (status quo / ADR-0020 only). Rejected — the brittleness this ADR removes is
-  exactly what S-27 was carved out to fix.
@@ -5,55 +5,6 @@ copy-pasteable walkthrough against a local `make up` stack.

 ---

-## S-B04 — `make local` completes the whole flow with no manual seeding (#110, ADR-0020)
-
-**Outcome:** the host-browser stack (`make local`) now self-seeds at bring-up — it publishes the BIG
-zaaktype and wires the ACL to it, deploys the `diploma-eligibility` DMN, and registers the NRC
-abonnement — so a fresh bring-up runs submit → werkbak → openbaar without the manual seeding the
-`verify-*` scripts do for CI. (Previously the process stuck at `OpenZaakAanmaken`, the werkbak stayed
-empty, and the openbaar register showed nothing.)
-
-```bash
-# 1. Fresh bring-up (self-seeding init containers: local-seed, nrc-subscribe; DMN in flowable-init).
-make local
-
-# 2. Assert the whole flow works with no manual seeding — submit opens a zaak, documents route it to
-#    the werkbak, and the reference appears in the openbaar register:
-make verify-local     # → "OK — a fresh local stack completed the flow with no manual seeding ..."
-
-# 3. Or by hand in the browser: log in at http://localhost:8140 (jan-burger / test123), submit +
-#    upload a PDF, then approve it in the werkbak at http://localhost:8142 (merel-behandelaar /
-#    test123); it shows as INGESCHREVEN in the openbaar register at http://localhost:8141.
-```
-
-> The zaaktype is discovered by the ACL itself since S-27 (below); `local-seed`'s `acl.env` now
-> carries only OpenZaak's IP base URL, which the ACL still needs because OpenZaak rejects a
-> single-label host on zaak-create (ADR-0020 + ADR-0021).
-
---
-
-## S-27 — ACL resolves its zaaktype by identificatie, not a pinned URL (#113, ADR-0021)
-
-**Outcome:** the ACL discovers its BIG zaaktype (by `identificatie`) and diploma informatieobjecttype
-(by `omschrijving`) from OpenZaak's Catalogi API, instead of being handed the server-assigned URLs.
-No user-visible behaviour change — the flow runs exactly as before — but no stack captures/injects a
-zaaktype URL any more, and a missing catalogus now fails with a clear message instead of an opaque 400.
-
-```bash
-# The live ACL↔OpenZaak integration test proves resolution against a real seeded OpenZaak:
-make verify-acl     # → "resolves the published BIG-REGISTRATIE zaaktype + Diploma informatieobjecttype by business key"
-
-# End-to-end unchanged (the ACL self-discovers the zaaktype during the flow):
-make verify-local   # local stack — still green, now with no zaaktype-URL injection
-make verify-domain  # CI stack — recreates the ACL pointed only at OpenZaak's IP (no URL to inject)
-```
-
-> The ACL still needs its OpenZaak base URL at a URL-valid host (a container IP): OpenZaak's
-> URLValidator rejects a single-label host like `openzaak:8000` on zaak-create. So ADR-0020's base-URL
-> injection stays; only the zaaktype/informatieobjecttype **URL** injection is gone (ADR-0021).
-
---
-
 ## S-08d — Walking skeleton complete: browser → submit, end-to-end

 **Outcome:** the self-service portal is served in the stack and the full front-of-house happy path
@@ -297,237 +248,3 @@ curl -fsS "http://localhost:8140/openbaar/register?q=$ref" | jq

 > The openbaar register's "Referentie" column and its search now use this reference — the exact value
 > the citizen saw on submit. Asserted end-to-end by the Playwright happy path.
-
-## S-12 — Behandel portal: werkbak + beoordeling (#13, ADR-0013)
-
-A behandelaar now works submitted registrations in a real portal instead of the temporary admin
-endpoint. After a citizen submits (as above), the workflow parks the registration at the Flowable
-`Beoordelen` user task, and it shows up in the **werkbak**. The behandelaar logs in against the
-Keycloak `medewerker` realm and decides — **goedkeuren** (→ INGESCHREVEN via the ACL, per ADR-0011)
-or **afwijzen** — which also completes the Beoordelen task so the process advances.
-
-```text
-# 1. Open the behandel portal and log in as a behandelaar (medewerker realm):
-#    http://localhost:8142/   →  merel-behandelaar / test123
-#
-# 2. The werkbak lists the registrations awaiting beoordeling (referentie / bsn / status).
-#    Find the reference from the submit confirmation and click "Goedkeuren" on that row.
-#
-# 3. The row drops off the werkbak (its Beoordelen task is completed) and the openbaar register
-#    (http://localhost:8141/) now shows that reference as INGESCHREVEN.
-```
-
-**The path:** behandel portal → BFF `POST /behandel/registrations/{id}/decide` (behandelaar policy,
-`medewerker` realm) → domain applies the decision + completes the Flowable `Beoordelen` task →
-ACL → NRC → event-subscriber → projection → openbaar register shows INGESCHREVEN.
-
-> The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
-> public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
-> drives the behandel portal in place of the old admin endpoint.
-
-## S-11 — Withdrawal: "trek aanvraag in" (#12, ADR-0014)
-
-A zorgprofessional can withdraw their own still-open registration from the self-service portal. The
-withdrawal is owner-scoped (the BFF forwards the DigiD token's bsn; the domain only lets the owner
-withdraw) and cancels the running workflow via a BPMN message event, so the case leaves the
-behandelaar's werkbak.
-
-```text
-# 1. Log in and submit at the self-service portal (http://localhost:8140/, jan-burger / test123),
-#    note the "Referentie" on the confirmation.
-# 2. Click "Trek aanvraag in" → the page confirms the registration is ingetrokken.
-# 3. In the behandel werkbak (http://localhost:8142/, merel-behandelaar) the registration no longer
-#    appears — its Beoordelen task was cancelled.
-```
-
-**The path:** self-service → BFF `POST /self-service/registrations/{id}/withdraw` (DigiD, owner-scoped)
-→ domain sets INGETROKKEN + correlates the `RegistratieIngetrokken` message to the process → the
-interrupting boundary event ends it → the werkbak drops the case.
-
-> DigiD submit → trek aanvraag in → ingetrokken is the Playwright happy path
-> (`tests/e2e/withdrawal.spec.ts`); the owner-scoping + workflow cancellation are covered by the
-> `Een registratie intrekken` acceptance scenarios and the domain live check.
-
-## S-14 — Beoordeling escalation: 14 days unclaimed → teamlead (#15, ADR-0015)
-
-A beoordeling a behandelaar does not pick up within 14 days escalates to the teamlead. A
-non-interrupting boundary timer on the `Beoordelen` task fires a `BeoordelingEscaleren` external task;
-the domain's escalation worker reassigns the still-open task's candidate group from `behandelaar` to
-`teamlead`, so it moves from the behandelaar werkbak into the teamlead's. The `Beoordelen` task keeps
-its identity throughout — only who may claim it changes.
-
-The timer is 14 days, so the demo fires it early through Flowable's management API (exactly what the
-verify-domain check automates):
-
-```bash
-# 1. Submit at the self-service portal (http://localhost:8140/, jan-burger / test123). The case
-#    parks at Beoordelen, visible in the behandelaar werkbak (http://localhost:8142/, merel-behandelaar)
-#    but NOT claimed.
-#
-# 2. Find the parked instance and its Beoordelen task, then fire the boundary timer early:
-FL=http://localhost:8090/flowable-rest/service
-PID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["processInstanceId"])')
-TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-TJ=$(curl -s -u rest-admin:test "$FL/management/timer-jobs?processInstanceId=$PID" \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/management/timer-jobs/$TJ" \
-  -H 'Content-Type: application/json' -d '{"action":"move"}'
-AJ=$(curl -s -u rest-admin:test "$FL/management/jobs?processInstanceId=$PID" \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/management/jobs/$AJ" \
-  -H 'Content-Type: application/json' -d '{"action":"execute"}'
-#
-# 3. Within a couple of poll cycles the task's candidate group flips to teamlead:
-curl -s -u rest-admin:test "$FL/runtime/tasks/$TID/identitylinks"   # → [{"group":"teamlead","type":"candidate"}]
-```
-
-**The path:** BPMN non-interrupting `P14D` boundary timer on `Beoordelen` → `BeoordelingEscaleren`
-external task → domain escalation worker (`BeoordelingEscalatiePump`) → Workflow Client swaps the task's
-candidate group behandelaar → teamlead (§8.2).
-
-> Both branches (escalate after 14 days; no-op when completed in time) are covered by the
-> `Een beoordeling escaleren` acceptance scenarios and the Workflow Client unit tests; the timer firing
-> and reassignment are asserted live by the verify-domain check.
-
-## S-13 — Diploma-eligibility: foreign diplomas route through CBGV-advies (#14, ADR-0016)
-
-A registration's diploma origin decides its route. A DMN service task in the registratie
-process evaluates the `diploma-eligibility` decision on the `diplomaOrigin` start variable: a
-**foreign** (Buitenlands) diploma is routed through an extra **CBGV-advies** user task before
-beoordeling; a **domestic** (Binnenlands) one goes straight to beoordeling. The decision lives in the
-DMN, not in code — a beheerder can read and adjust the decision table directly.
-
-The self-service portal's eIDAS→foreign wiring is a later slice; for now the origin is submitted to
-the domain directly, so the demo drives it through the domain endpoint:
-
-```bash
-# 1. Submit a foreign-diploma registration to the domain (note the returned Location/reference):
-DOM=http://localhost:8080   # domain service
-curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
-  -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' | grep -i '^location:'
-#
-# 2. Once the zaak is opened, the process first parks at WachtOpDocumenten (S-10a); complete that task
-#    (documents received) — then it parks at the CBGV-advies task (NOT Beoordelen). In Flowable:
-FL=http://localhost:8090/flowable-rest/service
-curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' | python3 -m json.tool
-#
-# 3. Complete the CBGV-advies task; the case then advances to the regular Beoordelen task:
-TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
-  -H 'Content-Type: application/json' -d '{"action":"complete"}'
-# A domestic submission (default, or "Binnenlands") skips CBGV-advies and parks straight at Beoordelen.
-```
-
-**The path:** domain sets the `diplomaOrigin` start variable → registratie process DMN
-DMN service task sets `route` → exclusive gateway → foreign: `CBGVAdvies` user task → `Beoordelen`;
-domestic: `Beoordelen` directly (§8.2, ADR-0016).
-
-> The domestic/foreign paths are covered by the `Een diploma op herkomst routeren` acceptance
-> scenarios and unit tests (the origin is carried into the process); the DMN decision and the
-> foreign→CBGV routing are asserted live by the verify-domain check.
-
-## S-10a — Document wait + 30-day timeout cancels the registration (#102, ADR-0017)
-
-After the zaak is opened the registratie process parks at a **WachtOpDocumenten** user task, waiting
-for the citizen's documents (their diploma). Two things can happen:
-
- **Documents arrive in time** → the task completes and the process continues to the diploma-eligibility
-  routing (S-13) → beoordeling.
- **30 days pass with no documents** → an interrupting `P30D` boundary timer cancels the wait, runs the
-  `RegistratieVerlopen` external task, and the domain expires the registration to the terminal status
-  **VERLOPEN** (the case is cancelled).
-
-The "documents received" trigger is wired end-to-end in S-10a: the self-service page shows a
-**"Documenten aanleveren"** button after submit (portal → BFF → domain → completes the wait). S-10b
-turns that into a real file upload stored in the ZGW Documenten API via the ACL. The timeout branch is
-demonstrated by firing the 30-day timer early via the management API.
-
-```bash
-DOM=http://localhost:8080                      # domain service
-FL=http://localhost:8090/flowable-rest/service # flowable-rest
-
-# 1. Submit a registration; once the zaak is opened it parks at WachtOpDocumenten:
-curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
-  -d '{"bsn":"123456782"}' | grep -i '^location:'          # note the /registrations/<id> reference
-WQ='{"processDefinitionKey":"registratie","taskDefinitionKey":"WachtOpDocumenten"}'
-
-# 2a. Documents-in-time: complete the WachtOpDocumenten task → the process advances to beoordeling.
-TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d "$WQ" | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
-  -H 'Content-Type: application/json' -d '{"action":"complete"}'
-
-# 2b. Timeout: instead of completing it, fire the 30-day timer early via the management API. Find the
-#     instance's timer job, "move" it to executable; the async executor fires the interrupting event.
-PID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d "$WQ" | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["processInstanceId"])')
-JID=$(curl -s -u rest-admin:test "$FL/management/timer-jobs?processInstanceId=$PID" \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/management/timer-jobs/$JID" \
-  -H 'Content-Type: application/json' -d '{"action":"move"}'
-#     The RegistratieVerlopen worker then expires the aggregate — read it back as VERLOPEN:
-curl -s "$DOM/registrations/<id>"   # → {"status":"Verlopen", ...}
-```
-
-**The path:** registratie process parks at `WachtOpDocumenten` → documents received completes it (→
-routing → `Beoordelen`), OR the `P30D` interrupting timer fires → `RegistratieVerlopen` external task
-→ domain worker expires the aggregate to `Verlopen` → `endVerlopen` (§8.2, ADR-0017).
-
-> Both branches are covered by the `Een documenttermijn laten verlopen` acceptance scenarios (worker +
-> aggregate) and unit tests; the wait completion and the 30-day timer firing are asserted live by the
-> verify-domain check.
-
-## S-10b — Diploma upload stored in the ZGW Documenten API (#103, ADR-0018)
-
-The self-service "Documenten aanleveren" action (S-10a) is now a **real file upload**: after submitting,
-the citizen picks a PDF and uploads it. The portal base64-encodes the file client-side and posts it to
-the BFF; the BFF forwards it to the domain, which stores it via the **ACL** as a ZGW
-`enkelvoudiginformatieobject` in the **Documenten (DRC) API** and relates it to the zaak — then completes
-the `WachtOpDocumenten` wait so beoordeling can proceed. Per §8.1 only the ACL talks to ZGW.
-
-```bash
-make up
-# 1. Log in as jan-burger / test123, submit, then — once the openbaar register shows the row —
-#    choose a PDF under "Documenten aanleveren" and upload it. The page confirms "aangeleverd".
-open http://localhost:8140
-#
-# 2. Automated: the walking-skeleton e2e now uploads a real PDF before the behandelaar approves.
-make verify-e2e
-#
-# 3. The ACL integration test proves the document is really created in the Documenten API and
-#    related to the zaak (against a live OpenZaak):
-make verify-acl        # → "Storing a diploma creates a real informatieobject related to the zaak"
-```
-
-**The path:** portal (base64) → BFF `POST /self-service/registrations/{id}/documents` → domain
-`ProvideDocuments` → ACL `POST /documenten` → ZGW `enkelvoudiginformatieobjecten` +
-`zaakinformatieobjecten`; the wait is then completed and the case advances to Beoordelen (§8.1, ADR-0018).
-
-## S-10c — the ZGW zaak is cancelled when the document term lapses (#106)
-
-When the 30-day document term lapses (S-10a), the domain no longer only marks the aggregate `Verlopen` —
-it now also cancels the **ZGW zaak** through the ACL, so OpenZaak and the register agree. The zaak is set
-to a distinct, non-terminal **`Geannuleerd`** status with a **`Vervallen`** resultaat (as opposed to the
-approval `Afgehandeld` + `Geregistreerd`), resolved by name in the ACL (§8.1, ADR-0019).
-
-```bash
-# 1. The ACL integration test proves cancellation records the Geannuleerd status + a resultaat
-#    against a live OpenZaak:
-make verify-acl        # → "Cancelling a zaak records the geannuleerd status and a resultaat"
-#
-# 2. End-to-end: the domain check submits a registration, fires its 30-day timer early, and asserts
-#    the timeout worker both expires the registration (VERLOPEN) and cancels its zaak (Geannuleerd):
-make verify-domain     # → "the timed-out registration's zaak was cancelled to Geannuleerd in OpenZaak"
-```
-
-**The path:** Flowable P30D timer → `RegistratieVerlopen` job → domain `ExpireRegistrationWorker` → ACL
-`POST /annuleringen` → ZGW `resultaten` + `statussen` (Geannuleerd); the aggregate then moves to
-`Verlopen`. The ACL cancels the zaak **before** the aggregate is expired, so a failed ZGW call leaves the
-job for redelivery rather than diverging the two (ADR-0019).
@@ -117,53 +117,3 @@ with the submit form (S-08c, #67); any deviation from NL DS will be recorded her
  (id + status); `bsn`/`naam` never leave the BFF. The e2e asserts the bsn never renders.
 - **Loads on open, filters on search.** `RegisterPage` fetches the full register on construction and
  re-queries `/openbaar/register?q=` on search — no client-side filtering, the BFF owns the query.
-
-## Behandel portal (S-12, #13)
-
-The staff portal where a behandelaar works the **werkbak** (registrations awaiting beoordeling) and
-decides each — goedkeuren or afwijzen. `apps/behandel` mirrors `apps/self-service`; the net-new
-frontend work is the medewerker realm auth and the werkbak/decide page. Wiring rationale is in
-**ADR-0013**; this entry records the frontend-specific choices.
-
- **Medewerker realm auth, reusing `libs/auth`.** Staff authenticate against the Keycloak
-  `medewerker` realm (public client `big-portal`), not `digid`. Rather than fork the auth lib, the
-  abstract `AuthService` grew a **`roles`/`hasRole` surface** (empty for realms without roles, e.g.
-  `digid`), and a parallel **`MedewerkerAuthService` + `provideMedewerkerAuth`** were added — same
-  auth-code + PKCE config, bound to the medewerker realm, reading the nested `realm_access.roles`
-  claim. The library's own `authInterceptor` attaches the token to the relative `/behandel/` calls
-  (secure route), exactly as self-service does for `/self-service/`.
- **Roles reach the frontend via a realm mapper.** Keycloak emits realm roles in the access token by
-  default but not the ID token/userinfo the SPA reads, so the medewerker `big-portal` client gets a
-  **realm-roles protocol mapper** (`realm_access.roles`, added to id + userinfo tokens). The
-  **BFF remains the security boundary** (`behandelaar` policy, 401/403 on `/behandel/*`, ADR-0013);
-  the frontend role signal is for display/UX, and the werkbak page surfaces a load failure (e.g. a
-  403 for a non-behandelaar) rather than swallowing it.
- **Same-origin via nginx, like the other portals.** The compose `behandel` image serves the built
-  app and reverse-proxies `/behandel` to the BFF (relative calls, no CORS). Served on `:8142`,
-  health-checked over IPv4 (`127.0.0.1`), depends on Keycloak for the medewerker realm.
- **Werkbak = decide-and-refresh.** `WerkbakPage` loads `GET /behandel/werkbak` on open and renders a
-  row per registration (referentie/bsn/status). Goedkeuren/afwijzen `POST /behandel/registrations/
-  {id}/decide` and then reload the werkbak, so the handled item drops off (its Flowable `Beoordelen`
-  task is completed). Per-row decide buttons carry an `aria-label` including the reference, so the
-  e2e (and screen readers) can target a specific registration in a shared werkbak.
- **Testing.** Component tests use `@testing-library/angular` with `BffApiV1Service`/`AuthService`
-  mocked and the axe WCAG 2.1 AA check; an `app.config.spec` drives the real interceptor + api-client
-  to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
-  The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
-  path.
-
-## Self-service withdrawal: "trek aanvraag in" (S-11c, #12)
-
-The submit confirmation grows a **"Trek aanvraag in"** action so a zorgprofessional can withdraw the
-registration they just submitted (`apps/self-service`, on the existing `RegistrationPage`).
-
- **Keyed by the reference, owner-scoped at the BFF.** The button calls the generated
-  `postSelfServiceRegistrationsIdWithdraw(reference)` with the reference the submit returned. The
-  DigiD token (attached by the interceptor) carries the bsn the BFF forwards; the domain only lets
-  the owner withdraw (a mismatch is 404). No extra identity is entered in the UI.
- **Same confirm-and-surface pattern as submit.** A secondary-action button; on success the page
-  switches to an ingetrokken confirmation; a failure is surfaced (`role="alert"`) and the action
-  stays available to retry — mirroring how submit handles its failure rather than swallowing it.
- **Testing.** Component tests (`@testing-library/angular`, mocked BFF) cover the button appearing
-  after submit, the reference being passed, the ingetrokken confirmation, and the failure path; the
-  browser round-trip is `tests/e2e/withdrawal.spec.ts`.
@@ -1,12 +1,7 @@
 # LOCAL development stack — runs with a plain `docker compose up`, no make / no
-# external seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
+# seed step / no bash. Use this on a local engine (Docker Desktop on Windows or
 # macOS, or rootless Podman on Linux).
 #
-# Self-seeding (S-B04, #110, ADR-0020): unlike the CI stack — where the verify-* scripts seed the
-# zaaktype and register the NRC abonnement at test time — this stack does that itself, via one-shot
-# init containers (local-seed, nrc-subscribe) + a DMN deploy in flowable-init, so a fresh bring-up
-# completes the whole flow with no manual steps. `make verify-local` asserts it.
-#
 #   docker compose -f infra/docker-compose.local.yml up -d --build         # podman
 #   docker compose -f infra/docker-compose.local.yml up -d --build --wait  # Docker Desktop
 #   docker compose -f infra/docker-compose.local.yml down --volumes
@@ -22,12 +17,7 @@
 #
 # Port map (host):
 #   8000 OpenZaak · 8001 Open Notificaties · 8080 BFF · 8090 Flowable REST
-#   8100 ACL · 8130 Domain · 8180 Keycloak   (all admin: admin / admin — dev only)
-#   8140 self-service portal · 8141 openbaar register · 8142 behandel portal
-#
-# Portal OIDC on the HOST: browse the portals at their 8140/8141/8142 ports and log in via
-# Keycloak on localhost:8180 (KC_HOSTNAME below pins the issuer there; the BFF still validates
-# in-network via keycloak:8080). Test users are in docs/synthetic-data.md.
+#   8100 ACL · 8180 Keycloak   (all admin: admin / admin — dev only)

 services:

@@ -215,12 +205,6 @@ services:
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HEALTH_ENABLED: "true"
      KC_HTTP_ENABLED: "true"
-      # Pin the frontend/issuer URL to the host-published address so a browser on the host and the
-      # tokens it gets both use localhost:8180. KC_HOSTNAME_BACKCHANNEL_DYNAMIC lets in-network
-      # callers (the BFF via keycloak:8080) still resolve token/jwks endpoints to their request host,
-      # so the BFF validates the localhost:8180 issuer while fetching keys over the compose network.
-      KC_HOSTNAME: http://localhost:8180
-      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
    ports:
      - "8180:8080"
    volumes:
@@ -262,79 +246,38 @@ services:
    restart: "no"
    volumes:
      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
-      - ../workflows/diploma-eligibility.dmn:/work/diploma-eligibility.dmn:ro,z
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
-        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
-        # must go via dmn-api. The registratie process's DMN service task then resolves the decision across
-        # deployments by key (S-13, ADR-0016). Without this the WachtOpDocumenten completion 404s on the
-        # missing decision and the case never reaches Beoordelen (S-B04). Both steps are idempotent.
-        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
-          echo "diploma-eligibility DMN already deployed; skip"
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
+          echo "registratie already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
-        fi
-        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie BPMN already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
    depends_on:
      flowable-rest:
        condition: service_started
    networks: [cg]

-  # ── Local bootstrap: seed the zaaktype + wire the ACL (S-B04, #110, ADR-0020) ─────────────────
-  # The zaaktype UUID is assigned by OpenZaak at creation, so it can't be a static value in this
-  # file. This one-shot seeds + publishes the BIG zaaktype (and the Diploma informatieobjecttype)
-  # and writes their server-assigned URLs into a shared volume as acl.env, which the ACL sources on
-  # startup (below). It is the local-stack equivalent of what infra/run-domain-check.sh does for CI.
-  # Reaches OpenZaak by its container IP because a single-label host fails OpenZaak's URLValidator.
-  local-seed:
-    image: docker.io/library/python:3-slim
-    restart: "no"
-    volumes:
-      - ./openzaak/seed_catalogus.py:/work/seed_catalogus.py:ro,z
-      - ./local/seed-zaaktype.sh:/work/seed-zaaktype.sh:ro,z
-      - seed-env:/out
-    command: ["sh", "/work/seed-zaaktype.sh"]
-    depends_on:
-      openzaak:
-        condition: service_healthy
-    networks: [cg]
-
  # ── ACL ──────────────────────────────────────────────────────────────────
  acl:
    build:
      context: ../services/acl
      dockerfile: Dockerfile
    image: register-referentie/acl:dev
-    # The ACL discovers its zaaktype + informatieobjecttype URLs from the Catalogi API by the business
-    # keys below (S-27, ADR-0021), so no URL is injected. It still needs its OpenZaak BaseUrl pointed at
-    # a URL-valid host (OpenZaak rejects a single-label host like `openzaak` on zaak-create), so the
-    # local-seed one-shot writes that IP base into seed-env:/seed/acl.env, which the entrypoint sources
-    # (set -a) before the app starts. A runtime-generated env file is why we override the entrypoint here
-    # rather than use `env_file:` (which compose reads at parse time, before the seed has run).
-    entrypoint: ["/bin/sh", "-c", "set -a; . /seed/acl.env; set +a; exec dotnet Acl.Api.dll"]
    environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/   # placeholder; seed-env/acl.env supplies the IP base
+      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
      Acl__OpenZaak__ClientId: big-reference-seed
      Acl__OpenZaak__Secret: insecure-dev-secret-change-me
      Acl__Defaults__Bronorganisatie: "517439943"
      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
-      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
+      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
    ports:
      - "8100:8080"
-    volumes:
-      - seed-env:/seed:ro
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 5s
@@ -344,8 +287,6 @@ services:
    depends_on:
      openzaak:
        condition: service_healthy
-      local-seed:
-        condition: service_completed_successfully
    networks: [cg]

  # ── BFF ──────────────────────────────────────────────────────────────────
@@ -354,14 +295,6 @@ services:
      context: ../services/bff
      dockerfile: Dockerfile
    image: register-referentie/bff:dev
-    environment:
-      # Reach Keycloak over the compose network for metadata/keys; the discovered issuer is the
-      # host-pinned localhost:8180 (KC_HOSTNAME above), which is what browser tokens carry — so
-      # validation matches without the BFF ever needing to resolve localhost:8180 itself.
-      Keycloak__Authority: http://keycloak:8080/realms/digid
-      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
-      Downstream__Domain__BaseUrl: http://domain:8080/
-      Downstream__Projection__BaseUrl: http://projection-api:8080/
    ports:
      - "8080:8080"
    healthcheck:
@@ -370,39 +303,6 @@ services:
      timeout: 3s
      retries: 5
      start_period: 10s
-    depends_on:
-      domain:
-        condition: service_healthy
-      projection-api:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
-  # ── BIG Domain Service (S-05) ─────────────────────────────────────────────
-  domain:
-    build:
-      context: ../services/domain
-      dockerfile: Dockerfile
-    image: register-referentie/domain:dev
-    environment:
-      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
-      Flowable__Username: rest-admin
-      Flowable__Password: test
-      Acl__BaseUrl: http://acl:8080/
-    ports:
-      - "8130:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      acl:
-        condition: service_healthy
-      flowable-init:
-        condition: service_completed_successfully
    networks: [cg]

  # ── Read projection (S-06) ────────────────────────────────────────────────
@@ -428,10 +328,6 @@ services:
    image: register-referentie/event-subscriber:dev
    environment:
      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-      # The subscriber enriches the projection with each zaak's reference by asking the ACL — the only
-      # code allowed to read ZGW (§8.1, #78). Required: startup throws without it (parity with the
-      # canonical compose).
-      Acl__BaseUrl: http://acl:8080/
      EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
    ports:
      - "8110:8080"
@@ -444,33 +340,6 @@ services:
    depends_on:
      projection-db:
        condition: service_healthy
-      acl:
-        condition: service_healthy
-    networks: [cg]
-
-  # ── Local bootstrap: register the NRC abonnement (S-B04, #110, ADR-0020) ──────────────────────
-  # Without a subscription, OpenZaak's notifications reach NRC and are delivered nowhere, so the
-  # projection (and the openbaar register) stay empty. This one-shot registers an abonnement on the
-  # `zaken` kanaal pointing at the event-subscriber's /notifications callback — the CI equivalent is
-  # infra/verify-notification-driver.py. The callback uses the event-subscriber's container IP (a
-  # single-label host fails NRC's URLValidator). It is a leaf (nothing depends on it), so it can wait
-  # for the event-subscriber without creating a cycle with the ACL bootstrap.
-  nrc-subscribe:
-    image: docker.io/library/python:3-slim
-    restart: "no"
-    volumes:
-      - ./local/register-abonnement.py:/work/register-abonnement.py:ro,z
-    environment:
-      NRC_BASE: http://nrc-web:8000
-      SINK_HOST: event-subscriber
-      SINK_PORT: "8080"
-      SINK_AUTH: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
-    command: ["python", "/work/register-abonnement.py"]
-    depends_on:
-      nrc-web:
-        condition: service_healthy
-      event-subscriber:
-        condition: service_started
    networks: [cg]

  projection-api:
@@ -493,80 +362,11 @@ services:
        condition: service_healthy
    networks: [cg]

-  # ── Portals (S-08/S-09/S-12) ──────────────────────────────────────────────
-  # nginx serves each Angular app and reverse-proxies its endpoint group to the BFF (same-origin).
-  # The images bake config.json with the compose authority (keycloak:8080), which a HOST browser
-  # can't resolve — so here we bind-mount a config.json pointing at the host-published localhost:8180
-  # (matching KC_HOSTNAME). openbaar is anonymous and needs no config.
-  self-service:
-    build:
-      context: ..
-      dockerfile: apps/self-service/Dockerfile
-    image: register-referentie/self-service:dev
-    ports:
-      - "8140:80"
-    volumes:
-      - ./local-config/self-service.config.json:/usr/share/nginx/html/config.json:ro,z
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
-  openbaar:
-    build:
-      context: ..
-      dockerfile: apps/openbaar/Dockerfile
-    image: register-referentie/openbaar:dev
-    ports:
-      - "8141:80"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-    networks: [cg]
-
-  behandel:
-    build:
-      context: ..
-      dockerfile: apps/behandel/Dockerfile
-    image: register-referentie/behandel:dev
-    ports:
-      - "8142:80"
-    volumes:
-      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
 volumes:
  oz-db:
  nrc-db:
  flowable-db:
  projection-db:
-  # Carries the seed-generated acl.env (server-assigned zaaktype URLs) from local-seed to the ACL.
-  seed-env:

 networks:
  cg:
@@ -15,12 +15,12 @@
 #
 #   docker compose -f infra/docker-compose.yml up -d --build --wait
 #
-# After first boot, seed + publish the BIG catalogus:
-#   OZ_PUBLISH=1 python infra/openzaak/seed_catalogus.py
-# The ACL discovers the zaaktype by identificatie (S-27, ADR-0021), so there is no URL to inject —
-# just point its BaseUrl at an OpenZaak host OpenZaak accepts on zaak-create (a container IP; a
-# single-label host is rejected):
-#   ACL_OPENZAAK_BASEURL=http://<openzaak-ip>:8000/ docker compose -f infra/docker-compose.yml up -d acl
+# After first boot, seed the BIG catalogus and note the zaaktype URL:
+#   python infra/openzaak/seed_catalogus.py
+# Then set ACL_ZAAKTYPE_URL in a .env file or your shell and re-up the acl
+# service:
+#   export ACL_ZAAKTYPE_URL=http://openzaak:8000/catalogi/api/v1/zaaktypen/<uuid>
+#   docker compose -f infra/docker-compose.yml up -d acl

 services:

@@ -259,30 +259,19 @@ services:
  flowable-init:
    image: docker.io/curlimages/curl:latest
    restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
-    # infra/seed-config.sh.
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
    volumes:
      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
-        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
-        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
-        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
-        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
-          echo "diploma-eligibility DMN already deployed; skip"
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
+          echo "registratie already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
-        fi
-        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie BPMN already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
    depends_on:
      flowable-rest:
@@ -304,12 +293,8 @@ services:
      Acl__Defaults__Bronorganisatie: "517439943"
      Acl__Defaults__VerantwoordelijkeOrganisatie: "517439943"
      Acl__Defaults__Vertrouwelijkheidaanduiding: openbaar
-      # The ACL resolves the (server-assigned) zaaktype + diploma informatieobjecttype URLs from the
-      # Catalogi API by these stable business keys (S-27, ADR-0021) — no URL to capture and inject.
-      # BaseUrl above stays overridable because OpenZaak rejects a single-label host on zaak creation,
-      # so verify-domain still points the ACL at OpenZaak's container IP.
-      Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
-      Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
+      # Override with the real zaaktype URL after running seed_catalogus.py.
+      Acl__Defaults__ZaaktypeUrl: ${ACL_ZAAKTYPE_URL:-http://openzaak:8000/catalogi/api/v1/zaaktypen/00000000-0000-0000-0000-000000000000}
    ports:
      - "8100:8080"
    healthcheck:
@@ -364,8 +349,6 @@ services:
      # Keycloak (start-dev) derives the issuer from the request host, so the BFF authority and the
      # verify token request both use keycloak:8080 to keep the issuer consistent.
      Keycloak__Authority: http://keycloak:8080/realms/digid
-      # Behandelaars authenticate against the medewerker realm; the BFF validates it for /behandel/* (S-12c).
-      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
      Downstream__Domain__BaseUrl: http://domain:8080/
      Downstream__Projection__BaseUrl: http://projection-api:8080/
    ports:
@@ -501,29 +484,6 @@ services:
        condition: service_healthy
    networks: [cg]

-  # The behandel portal: nginx serves the Angular app and reverse-proxies /behandel to the BFF.
-  # Behandelaars log in against the Keycloak medewerker realm (ADR-0013; S-12).
-  behandel:
-    build:
-      context: ..
-      dockerfile: apps/behandel/Dockerfile
-    image: register-referentie/behandel:dev
-    ports:
-      - "8142:80"
-    healthcheck:
-      # 127.0.0.1, not localhost: nginx listens on IPv4 only, but localhost resolves to ::1 first.
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
 volumes:
  oz-db:
  nrc-db:
@@ -35,35 +35,24 @@ services:
        condition: service_healthy
    networks: [cg]

-  # Deploys registratie.bpmn (process engine) and diploma-eligibility.dmn (DMN engine) via the REST
-  # API once flowable-rest is up. Idempotent: skips each if already deployed.
+  # Deploys workflows/registratie.bpmn via the REST API once flowable-rest is up.
+  # Idempotent: skips if a deployment named "registratie" already exists.
  flowable-init:
    image: docker.io/curlimages/curl:latest
    restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by
-    # infra/seed-config.sh.
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
    volumes:
      - fl-bpmn:/work:ro
    command:
      - sh
      - -c
      - |
-        svc=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmn=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
-        until curl -sf -u rest-admin:test "$$svc" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the DMN to the DMN engine and the BPMN to the process engine as SEPARATE deployments:
-        # flowable-rest does NOT cascade a .dmn bundled in a process .bar into the DMN engine, so the DMN
-        # must go via dmn-api. The process's DMN service task then resolves the decision across deployments
-        # by key (S-13, ADR-0016). Both steps are idempotent (skip if already deployed).
-        if curl -s -u rest-admin:test "$$dmn" | grep -q '"name":"diploma-eligibility.dmn"'; then
-          echo "diploma-eligibility DMN already deployed; skip"
+        base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
+        until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
+        if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
+          echo "registratie already deployed; skip"
        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmn" >/dev/null && echo "deployed diploma-eligibility DMN"
-        fi
-        if curl -s -u rest-admin:test "$$svc?name=registratie" | grep -q '"name":"registratie"'; then
-          echo "registratie BPMN already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$svc" >/dev/null && echo "deployed registratie BPMN"
+          curl -sf -u rest-admin:test -F 'file=@/work/registratie.bpmn;filename=registratie.bpmn' "$$base" >/dev/null && echo "deployed registratie"
        fi
    depends_on:
      flowable-rest:
@@ -16,22 +16,7 @@
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": true,
      "redirectUris": ["*"],
-      "webOrigins": ["*"],
-      "protocolMappers": [
-        {
-          "name": "realm roles",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-realm-role-mapper",
-          "config": {
-            "multivalued": "true",
-            "claim.name": "realm_access.roles",
-            "jsonType.label": "String",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
+      "webOrigins": ["*"]
    }
  ],
  "users": [
@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/medewerker"
-}
@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/digid"
-}
@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-"""Local-stack bootstrap (S-B04, #110, ADR-0020) — register the NRC abonnement.
-
-Runs as the `nrc-subscribe` init container of infra/docker-compose.local.yml. Registers an
-abonnement on the `zaken` kanaal pointing at the event-subscriber's /notifications callback, so
-OpenZaak's notifications (zaak create + status set) reach the projection — without this the openbaar
-(public) register stays empty. This is what infra/verify-notification-driver.py does for CI (minus
-the test zaak it also creates).
-
-The callback host is the event-subscriber's resolved **container IP**, not `event-subscriber`, because
-NRC validates callbackUrl with Django's URLValidator (a single-label host is rejected — same reason the
-zaaktype seed uses OpenZaak's IP). Idempotent + restart-safe: it removes any stale /notifications
-abonnement first, then registers one for the current IP. Stdlib only.
-
-Env: NRC_BASE, SINK_HOST, SINK_PORT, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
-"""
-import base64, hashlib, hmac, json, os, socket, sys, time, urllib.error, urllib.request
-
-NRC = os.environ.get("NRC_BASE", "http://nrc-web:8000").rstrip("/")
-SINK_HOST = os.environ.get("SINK_HOST", "event-subscriber")
-SINK_PORT = os.environ.get("SINK_PORT", "8080")
-SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer big-reference-notifications")
-CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
-SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
-
-
-def token():
-    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
-    seg = (
-        b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
-        + b"."
-        + b64(json.dumps(
-            {"iss": CID, "iat": int(time.time()), "client_id": CID,
-             "user_id": "local-seed", "user_representation": "local-seed"},
-            separators=(",", ":")).encode())
-    )
-    return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
-
-
-def call(method, url, body=None):
-    data = json.dumps(body).encode() if body is not None else None
-    req = urllib.request.Request(url, data=data, method=method, headers={
-        "Authorization": "Bearer " + token(),
-        "Content-Type": "application/json", "Accept": "application/json"})
-    try:
-        with urllib.request.urlopen(req, timeout=30) as r:
-            raw = r.read()
-            return r.status, (json.loads(raw) if raw else None)
-    except urllib.error.HTTPError as e:
-        raw = e.read()
-        return e.code, (json.loads(raw) if raw else None)
-
-
-def main():
-    ip = socket.gethostbyname(SINK_HOST)
-    callback = f"http://{ip}:{SINK_PORT}/notifications"
-
-    # Restart-safe: drop any prior /notifications abonnement (its IP may be stale) before creating a
-    # fresh one for the current event-subscriber IP.
-    status, body = call("GET", f"{NRC}/api/v1/abonnement")
-    for ab in (body or []) if status == 200 else []:
-        if str(ab.get("callbackUrl", "")).endswith("/notifications"):
-            if ab.get("callbackUrl") == callback:
-                print(f"abonnement already current: {ab['url']}")
-                return
-            call("DELETE", ab["url"])
-            print(f"removed stale abonnement {ab['url']}")
-
-    status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
-        "callbackUrl": callback, "auth": SINK_AUTH,
-        "kanalen": [{"naam": "zaken", "filters": {}}]})
-    if status != 201:
-        sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
-    print(f"abonnement registered: {ab['url']} -> {callback}")
-
-
-if __name__ == "__main__":
-    main()
@@ -1,33 +0,0 @@
-#!/bin/sh
-# Local-stack bootstrap (S-B04, #110, ADR-0020) — the "seed zaaktype + wire the ACL" step.
-#
-# Runs as the `local-seed` init container of infra/docker-compose.local.yml. It seeds + publishes
-# the BIG zaaktype (and the Diploma informatieobjecttype) into OpenZaak, then writes the resulting
-# **server-assigned** URLs into /out/acl.env, which the ACL entrypoint sources before starting. This
-# is the local-stack equivalent of what infra/run-domain-check.sh does for CI: the zaaktype UUID is
-# assigned by OpenZaak at creation, so it can't be a static value in the compose file.
-#
-# Why the container IP and not the `openzaak` service name: OpenZaak validates URL query params
-# (e.g. ?catalogus=) with Django's URLValidator, which rejects a single-label host like `openzaak`.
-# Seeding against the resolved IP keeps the seeded URLs valid AND host-consistent with the ACL, which
-# we point at the same IP below. See docs/runbooks/gitea-actions-gotchas.md and ADR-0020.
-set -eu
-
-oz_ip="$(python3 -c "import socket;print(socket.gethostbyname('openzaak'))")"
-OZ_BASE="http://${oz_ip}:8000"
-export OZ_BASE OZ_PUBLISH=1
-
-echo ">> seeding + publishing the BIG zaaktype at ${OZ_BASE} (idempotent)"
-out="$(python3 /work/seed_catalogus.py)"
-echo "$out"
-
-# Sanity-check that the zaaktype was actually published (the ACL discovers it by identificatie, S-27).
-printf '%s\n' "$out" | grep -q '^ZAAKTYPE_URL ' || { echo "ERROR: seed did not publish the zaaktype" >&2; exit 1; }
-
-# The ACL resolves the zaaktype/informatieobjecttype URLs itself (S-27, ADR-0021); the only value it
-# still needs injected is the OpenZaak base URL at a URL-valid host (the container IP), because OpenZaak
-# rejects a single-label host on zaak-create. The ACL entrypoint sources this.
-cat > /out/acl.env <<EOF
-Acl__OpenZaak__BaseUrl=${OZ_BASE}/
-EOF
-echo ">> wrote /out/acl.env (base=${OZ_BASE}/)"
@@ -10,7 +10,7 @@ Creates (if absent):
 Auth uses the JWT client provisioned by setup_configuration (see ADR-0002).
 Stdlib only — no pip deps. Re-running is safe (matches existing by identifier).
 """
-import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.parse, urllib.request
+import base64, hashlib, hmac, json, os, sys, time, urllib.error, urllib.request

 BASE = os.environ.get("OZ_BASE", "http://localhost:8000")
 CLIENT_ID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
@@ -77,12 +77,8 @@ def publish_zaaktype(zt):
    Selectielijst `selectielijstklasse` whose procestype matches the zaaktype's
    `selectielijstProcestype`, plus a `resultaattypeomschrijving`.
    """
-    # Ontvangen (begin) → Afgehandeld (eind, highest volgnummer). "Geannuleerd" (S-10c) sits between
-    # them: a non-terminal status the document-timeout branch sets, so it never displaces the Afgehandeld
-    # eindstatus the approval path resolves. Keyed by volgnummer on a fresh catalogus (CI reseeds); a
-    # stale local stack must reset its OpenZaak volumes for the renumbering to take effect.
    have_st = {s.get("volgnummer") for s in find(f"/statustypen?zaaktype={zt['url']}&status=alles")}
-    for volgnummer, omschrijving in [(1, "Ontvangen"), (2, "Geannuleerd"), (3, "Afgehandeld")]:
+    for volgnummer, omschrijving in [(1, "Ontvangen"), (2, "Afgehandeld")]:
        if volgnummer not in have_st:
            st, body = api("POST", "/statustypen", {
                "omschrijving": omschrijving, "zaaktype": zt["url"], "volgnummer": volgnummer})
@@ -99,42 +95,25 @@ def publish_zaaktype(zt):
            sys.exit(f"create roltype -> {st}: {json.dumps(body, indent=2)}")
        print("create roltype Aanvrager")

-    # Two resultaattypen, keyed by omschrijving so each is created independently (idempotent):
-    #   "Geregistreerd" — the approval outcome (S-09b)
-    #   "Vervallen"     — the document-timeout cancellation outcome (S-10c)
-    # Both selectielijstklassen must share the zaaktype's selectielijstProcestype, so pick two
-    # Selectielijst resultaten from a single procestype and set that procestype on the zaaktype.
-    have_rt = {r.get("omschrijving") for r in find(f"/resultaattypen?zaaktype={zt['url']}&status=alles")}
-    wanted = [("Geregistreerd", "blijvend_bewaren"), ("Vervallen", "vernietigen")]
-    if all(naam in have_rt for naam, _ in wanted):
-        print("skip   resultaattypen Geregistreerd + Vervallen")
+    if find(f"/resultaattypen?zaaktype={zt['url']}&status=alles"):
+        print("skip   resultaattype Geregistreerd")
    else:
-        # Anchor on the procestype of an arbitrary resultaat, then fetch that procestype's resultaten so
-        # both klassen validate against the zaaktype's selectielijstProcestype.
-        procestype = selectielijst("/resultaten?pageSize=1")["results"][0]["procesType"]
-        resultaten = selectielijst(f"/resultaten?procesType={urllib.parse.quote(procestype, safe='')}")["results"]
-        if len(resultaten) < len(wanted):
-            sys.exit(f"selectielijst procestype has too few resultaten ({len(resultaten)}) for {len(wanted)} resultaattypen")
+        resultaat = selectielijst("/resultaten?pageSize=1")["results"][0]
        omschrijvingen = selectielijst("/resultaattypeomschrijvingen")
-        oms_list = omschrijvingen if isinstance(omschrijvingen, list) else omschrijvingen["results"]
-
-        st, body = api("PATCH", zt["url"], {"selectielijstProcestype": procestype})
+        oms = (omschrijvingen if isinstance(omschrijvingen, list) else omschrijvingen["results"])[0]["url"]
+        # The selectielijstklasse and the zaaktype must share a procestype.
+        st, body = api("PATCH", zt["url"], {"selectielijstProcestype": resultaat["procesType"]})
        if st != 200:
            sys.exit(f"set procestype -> {st}: {json.dumps(body, indent=2)}")
-
-        for i, (naam, archiefnominatie) in enumerate(wanted):
-            if naam in have_rt:
-                print(f"skip   resultaattype {naam}")
-                continue
-            st, body = api("POST", "/resultaattypen", {
-                "zaaktype": zt["url"], "omschrijving": naam,
-                "resultaattypeomschrijving": oms_list[i]["url"], "selectielijstklasse": resultaten[i]["url"],
-                "archiefnominatie": archiefnominatie,
-                "brondatumArchiefprocedure": {"afleidingswijze": "afgehandeld"},
-            })
-            if st != 201:
-                sys.exit(f"create resultaattype {naam} -> {st}: {json.dumps(body, indent=2)}")
-            print(f"create resultaattype {naam}")
+        st, body = api("POST", "/resultaattypen", {
+            "zaaktype": zt["url"], "omschrijving": "Geregistreerd",
+            "resultaattypeomschrijving": oms, "selectielijstklasse": resultaat["url"],
+            "archiefnominatie": "blijvend_bewaren",
+            "brondatumArchiefprocedure": {"afleidingswijze": "afgehandeld"},
+        })
+        if st != 201:
+            sys.exit(f"create resultaattype -> {st}: {json.dumps(body, indent=2)}")
+        print("create resultaattype Geregistreerd")

    if zt.get("concept", True):
        st, body = api("POST", f"{zt['url']}/publish")
@@ -145,58 +124,6 @@ def publish_zaaktype(zt):
        print("skip   publish (already published)")


-def seed_informatieobjecttype(cat, zt):
-    """Create the "Diploma" informatieobjecttype and relate it to the zaaktype (both idempotent).
-
-    A diploma uploaded in S-10b is filed under this informatieobjecttype; OpenZaak only accepts a
-    document (and its zaak relation) once the informatieobjecttype is published AND allowed for the
-    zaak's zaaktype (a zaaktype-informatieobjecttype relation). Both the relation and this call must run
-    while the zaaktype is still a concept, so seed this *before* publishing the zaaktype. Returns the
-    informatieobjecttype dict.
-    """
-    iots = [i for i in find(f"/informatieobjecttypen?catalogus={cat['url']}&status=alles")
-            if i.get("omschrijving") == "Diploma"]
-    if iots:
-        iot = iots[0]
-        print(f"skip   informatieobjecttype Diploma ({iot['url']}) concept={iot.get('concept')}")
-    else:
-        st, iot = api("POST", "/informatieobjecttypen", {
-            "catalogus": cat["url"],
-            "omschrijving": "Diploma",
-            "vertrouwelijkheidaanduiding": "openbaar",
-            "informatieobjectcategorie": "diploma",
-            "beginGeldigheid": "2026-01-01",
-        })
-        if st != 201:
-            sys.exit(f"create informatieobjecttype -> {st}: {json.dumps(iot, indent=2)}")
-        print(f"create informatieobjecttype Diploma ({iot['url']})")
-
-    # Relate it to the zaaktype (must be done while both are concept).
-    relations = find(f"/zaaktype-informatieobjecttypen?zaaktype={zt['url']}&status=alles")
-    if any(r.get("informatieobjecttype") == iot["url"] for r in relations):
-        print("skip   zaaktype-informatieobjecttype Diploma")
-    else:
-        st, body = api("POST", "/zaaktype-informatieobjecttypen", {
-            "zaaktype": zt["url"], "informatieobjecttype": iot["url"],
-            "volgnummer": 1, "richting": "inkomend"})
-        if st != 201:
-            sys.exit(f"relate zaaktype-informatieobjecttype -> {st}: {json.dumps(body, indent=2)}")
-        print("create zaaktype-informatieobjecttype Diploma")
-
-    return iot
-
-
-def publish_informatieobjecttype(iot):
-    """Publish the informatieobjecttype (idempotent) so documents may reference it."""
-    if iot.get("concept", True):
-        st, body = api("POST", f"{iot['url']}/publish")
-        if st != 200:
-            sys.exit(f"publish informatieobjecttype -> {st}: {json.dumps(body, indent=2)}")
-        print(f"publish informatieobjecttype Diploma ({iot['url']})")
-    else:
-        print("skip   publish informatieobjecttype (already published)")
-
-
 def main():
    # 1. Catalogus
    existing = [c for c in find(f"/catalogussen?domein=BIG") if c.get("domein") == "BIG"]
@@ -271,16 +198,10 @@ def main():
    # schema-mandatory" zaaktype S-01 asks for (ADR-0002). Set OZ_PUBLISH=1 to add
    # those relations and publish — needed so a real zaak POST is accepted, which
    # the ACL integration test (S-04a, #46) exercises. See ADR-0006.
-    iot = None
    if PUBLISH:
        # Re-fetch: the bsn-eigenschap branch above may hold a stale concept flag.
        zt = next(z for z in find(f"/zaaktypen?catalogus={cat['url']}&status=alles")
                  if z.get("identificatie") == "BIG-REGISTRATIE")
-        # Seed + relate the Diploma informatieobjecttype (S-10b) while the zaaktype is still concept,
-        # then publish both. Publish the informatieobjecttype before the zaaktype so the zaaktype's
-        # relations reference a published type.
-        iot = seed_informatieobjecttype(cat, zt)
-        publish_informatieobjecttype(iot)
        publish_zaaktype(zt)

    # 5. Verify the JWT client can list the zaaktype (concepts included).
@@ -293,10 +214,6 @@ def main():
    # zaaktype URL to configure the ACL's default-fill (ADR-0003/0009).
    zt_url = next(z["url"] for z in zaaktypen if z.get("identificatie") == "BIG-REGISTRATIE")
    print(f"ZAAKTYPE_URL {zt_url}")
-    # Machine-readable informatieobjecttype URL (S-10b) so callers can configure the ACL's document
-    # default-fill. Only emitted when publishing — a concept informatieobjecttype can't back a document.
-    if iot is not None:
-        print(f"INFORMATIEOBJECTTYPE_URL {iot['url']}")
    print(f"OK — BIG catalogus seeded (BIG-REGISTRATIE {state} + bsn eigenschap)")


@@ -30,18 +30,16 @@ oz_ip="$(ip "$oz")"; dom_ip="$(ip "$dom")"
 oz_base="http://$oz_ip:8000"
 echo ">> openzaak=$oz_ip domain=$dom_ip network=$net"

-echo ">> seeding + publishing a BIG zaaktype (idempotent)"
+echo ">> seeding a published BIG zaaktype (idempotent) and capturing its URL"
 sid="$(docker create --network "$net" -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 python:3-slim python /seed.py)"
 docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
-seed_out="$(docker start -a "$sid")"
+zt_url="$(docker start -a "$sid" | sed -n 's/^ZAAKTYPE_URL //p' | head -1)"
 docker rm -f "$sid" >/dev/null
-printf '%s\n' "$seed_out" | grep -q '^ZAAKTYPE_URL ' || { echo "ERROR: seed did not publish the zaaktype" >&2; exit 1; }
+[ -n "$zt_url" ] || { echo "ERROR: seed did not report a ZAAKTYPE_URL" >&2; exit 1; }
+echo ">> zaaktype: $zt_url"

-# The ACL resolves the zaaktype + informatieobjecttype by identificatie/omschrijving (S-27, ADR-0021),
-# so there is no URL to inject — only the OpenZaak base URL, pointed at the same host's container IP
-# (OpenZaak rejects a single-label host on zaak-create).
-echo ">> recreating the acl service pointed at OpenZaak's IP (it resolves the zaaktype itself, S-27)"
-ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
+echo ">> recreating the acl service pointed at the seeded zaaktype (host-consistent)"
+ACL_ZAAKTYPE_URL="$zt_url" ACL_OPENZAAK_BASEURL="$oz_base/" docker compose -f "$compose" up -d acl
 WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}" bash "$here/wait-healthy.sh" acl

 echo ">> submitting a registration to the domain"
@@ -53,346 +51,18 @@ loc="$(docker run --rm --network "$net" curlimages/curl:latest \
 echo ">> registration accepted at $loc"

 echo ">> polling the domain until the worker records the opened zaak"
-zaak_ok=""
 for _ in $(seq 1 30); do
  body="$(docker run --rm --network "$net" curlimages/curl:latest \
    -fsS "http://$dom_ip:8080$loc" 2>/dev/null || true)"
  if echo "$body" | grep -q '/zaken/api/v1/zaken/'; then
    echo "OK — the domain opened a zaak and recorded it on the registration:"
    echo "$body" | cut -c1-300
-    zaak_ok=1
-    break
+    exit 0
  fi
  sleep 2
 done
-if [ -z "$zaak_ok" ]; then
-  echo "FAIL — the registration never received a zaak URL" >&2
-  echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
-  acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
-  [ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
-  exit 1
-fi
-
-# ── S-12b: the process now parks at the Beoordelen user task. Exercise the exact Flowable REST
-# contract the Workflow Client uses (query/claim/complete) against the live engine, reaching
-# flowable-rest by container IP (same in-network constraint as above). ──────────────────────────
-fl="$(docker ps -q --filter 'name=flowable-rest' | head -1)"
-[ -n "$fl" ] || { echo "ERROR: no running flowable-rest container" >&2; exit 1; }
-fl_base="http://$(ip "$fl"):8080/flowable-rest/service"
-reg_id="${loc##*/}"
-
-# Extracts the Beoordelen task id for a given registration from a Flowable task-query response on
-# stdin. Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
-task_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
-try:
-    d=json.load(sys.stdin)
-except Exception:
-    d={}
-rid=os.environ['REG_ID']
-# Flowable's task-query returns the included process variables under 'variables'.
-print(next((t['id'] for t in (d.get('data') or [])
-    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), ''))"; }
-
-flcurl() { docker run --rm --network "$net" curlimages/curl:latest -fsS -u rest-admin:test "$@"; }
-query='{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen","includeProcessVariables":true}'
-wacht_query='{"processDefinitionKey":"registratie","taskDefinitionKey":"WachtOpDocumenten","includeProcessVariables":true}'
-
-# S-10a: every registration now parks at WachtOpDocumenten first (interrupting P30D timer). Completing
-# that task stands in for the citizen's document upload (wired for real in S-10b), letting the process
-# advance to the diploma routing / Beoordelen so the checks below still hold. The 30-day timeout branch
-# is exercised separately at the end.
-complete_wacht() {  # reg_id
-  local rid="$1" wid="" r
-  for _ in $(seq 1 30); do
-    r="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$wacht_query" 2>/dev/null || true)"
-    wid="$(printf '%s' "$r" | task_for_reg "$rid")"
-    [ -n "$wid" ] && break
-    sleep 2
-  done
-  [ -n "$wid" ] || { echo "FAIL — no WachtOpDocumenten task appeared for $rid" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-  flcurl -X POST "$fl_base/runtime/tasks/$wid" -H 'Content-Type: application/json' -d '{"action":"complete"}' >/dev/null
-  echo ">> completed WachtOpDocumenten for $rid (documents received)"
-}
-
-echo ">> completing WachtOpDocumenten so the process advances (documents received)"
-complete_wacht "$reg_id"
-
-echo ">> polling Flowable for the Beoordelen user task (werkbak)"
-task_id=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  task_id="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
-  [ -n "$task_id" ] && break
-  sleep 2
-done
-[ -n "$task_id" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> Beoordelen task $task_id is waiting"
-
-echo ">> claiming the task as merel-behandelaar"
-flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
-  -d '{"action":"claim","assignee":"merel-behandelaar"}' >/dev/null
-
-echo ">> completing the beoordeling (goedkeuren)"
-flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
-  -d '{"action":"complete","variables":[{"name":"besluit","type":"string","value":"goedkeuren"}]}' >/dev/null
-
-echo ">> asserting the process finished (no Beoordelen task remains for the registration)"
-resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
-still="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
-[ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
-echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
-
-# ── S-11: withdrawal. A second registration parks at Beoordelen; the citizen withdraws it via the
-# domain, which delivers the RegistratieIngetrokken message to the task's execution, tripping the
-# BPMN boundary event so the process ends and the Beoordelen task disappears (ADR-0014). ────────────
-echo ">> submitting a second registration to withdraw"
-loc2="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc2" ] || { echo "FAIL — second POST /registrations returned no Location" >&2; exit 1; }
-reg_id2="${loc2##*/}"
-echo ">> second registration $reg_id2"
-complete_wacht "$reg_id2"
-
-echo ">> polling Flowable for its Beoordelen task"
-task_id2=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  task_id2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
-  [ -n "$task_id2" ] && break
-  sleep 2
-done
-[ -n "$task_id2" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id2" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> Beoordelen task $task_id2 is waiting; withdrawing the registration via the domain"
-
-# Owner-scoped: the withdraw carries the same bsn the registration was submitted with (S-11c).
-docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -X POST "http://$dom_ip:8080/registrations/$reg_id2/withdraw" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' >/dev/null
-
-echo ">> asserting the process was cancelled (no Beoordelen task remains for the registration)"
-gone=""
-for _ in $(seq 1 15); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  still2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
-  [ -z "$still2" ] && { gone=1; break; }
-  sleep 2
-done
-[ -n "$gone" ] || { echo "FAIL — Beoordelen task for $reg_id2 still active after withdrawal" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — withdrawal cancelled the Beoordelen task; the registratie process ended (ingetrokken)"
-
-# ── S-13: diploma-eligibility routing. A registration with a FOREIGN diploma must route through the
-# extra CBGVAdvies user task before Beoordelen (the DMN service task sets route=CBGV_ADVIES and the
-# gateway branches, ADR-0016). The domestic DIRECT path is already proven by the first registration
-# above, which parked straight at Beoordelen. ──────────────────────────────────────────────────────
-cbgv_query='{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies","includeProcessVariables":true}'
-echo ">> submitting a registration with a foreign diploma"
-locf="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$locf" ] || { echo "FAIL — foreign POST /registrations returned no Location" >&2; exit 1; }
-reg_idf="${locf##*/}"
-echo ">> foreign registration $reg_idf"
-complete_wacht "$reg_idf"
-
-echo ">> polling Flowable for its CBGV-advies task (foreign diplomas route here first)"
-cbgv_task=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$cbgv_query" 2>/dev/null || true)"
-  cbgv_task="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
-  [ -n "$cbgv_task" ] && break
-  sleep 2
-done
-[ -n "$cbgv_task" ] || { echo "FAIL — no CBGVAdvies task appeared for the foreign registration $reg_idf" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> CBGVAdvies task $cbgv_task is waiting"
-
-echo ">> asserting it has NOT reached Beoordelen yet (still awaiting CBGV-advies)"
-resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
-early="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
-[ -z "$early" ] || { echo "FAIL — foreign registration reached Beoordelen ($early) before CBGV-advies" >&2; exit 1; }
-
-echo ">> completing the CBGV-advies task"
-flcurl -X POST "$fl_base/runtime/tasks/$cbgv_task" -H 'Content-Type: application/json' -d '{"action":"complete"}' >/dev/null
-
-echo ">> asserting it now advances to Beoordelen"
-onward=""
-for _ in $(seq 1 15); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  [ -n "$(printf '%s' "$resp" | task_for_reg "$reg_idf")" ] && { onward=1; break; }
-  sleep 2
-done
-[ -n "$onward" ] || { echo "FAIL — foreign registration did not reach Beoordelen after CBGV-advies" >&2; exit 1; }
-echo "OK — foreign diploma routed through CBGV-advies, then on to Beoordelen (DMN + gateway)"
-
-# ── S-14: escalation. A third registration parks at Beoordelen. We fire its 14-day boundary timer
-# early via Flowable's management API (the timer job is moved to executable and run), which routes a
-# parallel token to the BeoordelingEscaleren external task. The domain's escalation worker acquires
-# it and reassigns the still-open Beoordelen task from the behandelaar group to teamlead (ADR-0015). ─
-echo ">> submitting a third registration to escalate"
-loc3="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc3" ] || { echo "FAIL — third POST /registrations returned no Location" >&2; exit 1; }
-reg_id3="${loc3##*/}"
-echo ">> third registration $reg_id3"
-
-# Extracts "<taskId> <processInstanceId>" for a registration from a task-query response on stdin.
-task_and_pid_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
-try:
-    d=json.load(sys.stdin)
-except Exception:
-    d={}
-rid=os.environ['REG_ID']
-t=next((t for t in (d.get('data') or [])
-    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), None)
-print(f\"{t['id']} {t['processInstanceId']}\" if t else '')"; }
-
-# The candidate groups on a task (space-separated, sorted) from a runtime identitylinks response.
-candidate_groups() { python3 -c "import sys,json
-try:
-    links=json.load(sys.stdin)
-except Exception:
-    links=[]
-print(' '.join(sorted(l.get('group') or '' for l in links if l.get('type')=='candidate' and l.get('group'))))"; }
-
-# The first job id in a management jobs/timer-jobs response on stdin.
-first_job_id() { python3 -c "import sys,json
-try:
-    d=json.load(sys.stdin)
-except Exception:
-    d={}
-print(((d.get('data') or [{}])[0]).get('id',''))"; }
-
-complete_wacht "$reg_id3"
-
-echo ">> polling Flowable for its Beoordelen task"
-task_id3=""; pid3=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  read -r task_id3 pid3 <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_id3")"
-  [ -n "$task_id3" ] && break
-  sleep 2
-done
-[ -n "$task_id3" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id3" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> Beoordelen task $task_id3 (instance $pid3) is waiting for the behandelaar"
-
-echo ">> asserting the task starts out claimable by the behandelaar group"
-before="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" | candidate_groups)"
-[ "$before" = "behandelaar" ] || { echo "FAIL — expected candidate group 'behandelaar', got '$before'" >&2; exit 1; }
-
-echo ">> firing the 14-day boundary timer early via the management API"
-timer_id="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pid3" | first_job_id)"
-[ -n "$timer_id" ] || { echo "FAIL — no timer job found for instance $pid3" >&2; exit 1; }
-# Move the timer job to an executable async job. Flowable's async executor (running in flowable-rest)
-# then picks it up and fires the non-interrupting boundary event. It may run the job before we can
-# look, so executing it explicitly is a best-effort nudge — tolerate the job already being gone.
-flcurl -X POST "$fl_base/management/timer-jobs/$timer_id" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
-async_id="$(flcurl "$fl_base/management/jobs?processInstanceId=$pid3" 2>/dev/null | first_job_id || true)"
-if [ -n "$async_id" ]; then
-  flcurl -X POST "$fl_base/management/jobs/$async_id" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
-fi
-echo ">> timer fired; the BeoordelingEscaleren token is parked for the domain worker"
-
-echo ">> polling until the escalation worker reassigns the beoordeling to the teamlead"
-escalated=""
-for _ in $(seq 1 30); do
-  groups="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" 2>/dev/null | candidate_groups || true)"
-  [ "$groups" = "teamlead" ] && { escalated=1; break; }
-  sleep 2
-done
-[ -n "$escalated" ] || { echo "FAIL — Beoordelen task not reassigned to teamlead (candidate groups: '$groups')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — the 14-day timer escalated the still-open Beoordelen task to the teamlead"
-
-# ── S-10a/S-10c: document timeout. A registration parks at WachtOpDocumenten and — unlike every block
-# above — its documents never arrive. We fire its 30-day boundary timer early via the management API;
-# the INTERRUPTING timer cancels the wait and routes a token to the RegistratieVerlopen external task.
-# The domain's timeout worker acquires it, cancels the ZGW zaak via the ACL (S-10c), and expires the
-# registration to VERLOPEN (ADR-0017). ─────────────────────────────────────────────────────────────
-echo ">> submitting a registration to let its document term lapse"
-locv="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$locv" ] || { echo "FAIL — timeout POST /registrations returned no Location" >&2; exit 1; }
-reg_idv="${locv##*/}"
-echo ">> timeout registration $reg_idv"
-
-echo ">> polling Flowable for its WachtOpDocumenten task"
-wacht_id=""; pidv=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$wacht_query" 2>/dev/null || true)"
-  read -r wacht_id pidv <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_idv")"
-  [ -n "$wacht_id" ] && break
-  sleep 2
-done
-[ -n "$wacht_id" ] || { echo "FAIL — no WachtOpDocumenten task appeared for $reg_idv" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> WachtOpDocumenten task $wacht_id (instance $pidv) is waiting for documents"
-
-echo ">> firing the 30-day document timer early via the management API"
-timer_idv="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pidv" | first_job_id)"
-[ -n "$timer_idv" ] || { echo "FAIL — no timer job found for instance $pidv" >&2; exit 1; }
-# Move the timer job to an executable async job; the async executor fires the interrupting boundary
-# event. It may run before we look, so executing it explicitly is a best-effort nudge (as for S-14).
-flcurl -X POST "$fl_base/management/timer-jobs/$timer_idv" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
-async_idv="$(flcurl "$fl_base/management/jobs?processInstanceId=$pidv" 2>/dev/null | first_job_id || true)"
-if [ -n "$async_idv" ]; then
-  flcurl -X POST "$fl_base/management/jobs/$async_idv" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
-fi
-echo ">> timer fired; the RegistratieVerlopen token is parked for the domain worker"
-
-echo ">> polling the domain until the timeout worker expires the registration to VERLOPEN"
-verlopen=""
-for _ in $(seq 1 30); do
-  body="$(docker run --rm --network "$net" curlimages/curl:latest -fsS "http://$dom_ip:8080$locv" 2>/dev/null || true)"
-  printf '%s' "$body" | grep -qi 'verlopen' && { verlopen=1; break; }
-  sleep 2
-done
-[ -n "$verlopen" ] || { echo "FAIL — registration $reg_idv not VERLOPEN after the document timer fired (body: $body)" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — the 30-day document timer expired the registration to VERLOPEN"
-
-# S-10c: the worker cancels the ZGW zaak (ACL-first, before it expires the aggregate), so a VERLOPEN
-# registration must carry a zaak whose current status is "Geannuleerd". Read it back from OpenZaak with
-# a ZGW token minted like the seed's client (the same client OpenZaak trusts for this stack).
-zaak_url_v="$(printf '%s' "$body" | grep -oiE 'http://[^"]*/zaken/api/v1/zaken/[a-f0-9-]+' | head -1)"
-[ -n "$zaak_url_v" ] || { echo "FAIL — VERLOPEN registration $reg_idv exposes no zaak URL (body: $body)" >&2; exit 1; }
-echo ">> confirming the zaak $zaak_url_v reached the Geannuleerd status in OpenZaak"
-
-read_zaak_status() {
-  # -i so the heredoc reaches `python -` on the container's stdin (without it the script is empty).
-  docker run --rm -i --network "$net" \
-    -e OZ_CLIENT_ID="${OZ_CLIENT_ID:-big-reference-seed}" \
-    -e OZ_SECRET="${OZ_SECRET:-insecure-dev-secret-change-me}" \
-    python:3-slim python - "$1" <<'PY'
-import base64, hashlib, hmac, json, os, sys, time, urllib.request
-cid, sec = os.environ["OZ_CLIENT_ID"], os.environ["OZ_SECRET"]
-b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
-def token():
-    hdr = {"alg": "HS256", "typ": "JWT"}
-    pl = {"iss": cid, "iat": int(time.time()), "client_id": cid, "user_id": "verify", "user_representation": "verify"}
-    seg = b64(json.dumps(hdr, separators=(",", ":")).encode()) + b"." + b64(json.dumps(pl, separators=(",", ":")).encode())
-    return (seg + b"." + b64(hmac.new(sec.encode(), seg, hashlib.sha256).digest())).decode()
-def get(url):
-    req = urllib.request.Request(url, headers={
-        "Authorization": "Bearer " + token(), "Accept": "application/json", "Accept-Crs": "EPSG:4326"})
-    with urllib.request.urlopen(req, timeout=30) as r:
-        return json.loads(r.read())
-zaak = get(sys.argv[1])
-status_url = zaak.get("status")
-if not status_url:
-    print(""); sys.exit(0)
-print(get(get(status_url)["statustype"]).get("omschrijving", ""))
-PY
-}
-
-geannuleerd=""
-for _ in $(seq 1 15); do
-  oms="$(read_zaak_status "$zaak_url_v" 2>/dev/null | tr -d '\r' || true)"
-  [ "$oms" = "Geannuleerd" ] && { geannuleerd=1; break; }
-  sleep 2
-done
-[ -n "$geannuleerd" ] || { echo "FAIL — zaak $zaak_url_v not Geannuleerd after timeout (current status omschrijving: '$oms')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — the timed-out registration's zaak was cancelled to Geannuleerd in OpenZaak"
-exit 0
+echo "FAIL — the registration never received a zaak URL" >&2
+echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
+acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
+[ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
+exit 1
@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-#
-# Acceptance check for the local stack (S-B04, #110): a fresh `make local` must complete the whole
-# flow with NO manual seeding. Run against an already-up local stack (infra/docker-compose.local.yml)
-# via the host-published ports. It exercises, and thereby covers, the three bring-up gaps the slice
-# fixes:
-#
-#   1. zaaktype seeded + ACL wired  -> a submitted registration opens a zaak (zaakUrl gets filled).
-#   2. diploma-eligibility DMN deployed -> providing documents completes WachtOpDocumenten, routes
-#      through the DMN, and the case lands on Beoordelen (visible in the behandel werkbak).
-#   3. NRC abonnement registered    -> the zaak shows up in the openbaar (public) register.
-#
-# Before the fix this fails at step 1 (ACL points at a placeholder zaaktype -> OpenZaak 400).
-set -euo pipefail
-
-DOM=${DOM:-http://localhost:8130}     # domain
-BFF=${BFF:-http://localhost:8080}     # bff (openbaar register)
-BSN=${BSN:-123456782}
-# A minimal, valid PDF, base64-encoded (the diploma upload).
-PDF_B64="$(printf '%%PDF-1.4\n1 0 obj<</Type/Catalog>>endobj\ntrailer<</Root 1 0 R>>\n%%%%EOF\n' | base64 | tr -d '\n')"
-
-echo ">> 1. submit a registration (no manual seeding expected)"
-loc="$(curl -fsS -D - -o /dev/null -X POST "$DOM/registrations" \
-  -H 'Content-Type: application/json' -d "{\"bsn\":\"$BSN\"}" \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc" ] || { echo "FAIL: POST /registrations returned no Location" >&2; exit 1; }
-id="${loc##*/}"
-echo "   accepted: $id"
-
-echo ">> 2. poll until the ACL opens the zaak (proves the zaaktype is seeded + wired)"
-zaak=""
-for _ in $(seq 1 30); do
-  zaak="$(curl -fsS "$DOM$loc" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("zaakUrl") or "")' 2>/dev/null || true)"
-  [ -n "$zaak" ] && break
-  sleep 3
-done
-[ -n "$zaak" ] || { echo "FAIL: zaak never opened — ACL zaaktype not wired (gap 1)" >&2; exit 1; }
-echo "   zaak opened: $zaak"
-
-echo ">> 3. provide documents (proves the diploma-eligibility DMN is deployed)"
-code="$(curl -s -o /dev/null -w '%{http_code}' -X POST "$DOM/registrations/$id/documents" \
-  -H 'Content-Type: application/json' \
-  -d "{\"bsn\":\"$BSN\",\"contentBase64\":\"$PDF_B64\",\"fileName\":\"diploma.pdf\",\"contentType\":\"application/pdf\"}")"
-[ "$code" = "204" ] || { echo "FAIL: provide documents -> $code (DMN missing routes WachtOpDocumenten to a 404 — gap 2)" >&2; exit 1; }
-echo "   documents accepted (204)"
-
-echo ">> 4. poll the werkbak until the registration awaits beoordeling (reached Beoordelen)"
-in_werkbak=""
-for _ in $(seq 1 20); do
-  in_werkbak="$(curl -fsS "$DOM/behandel/werkbak" | python3 -c "import sys,json;print(any(r.get('registrationId')=='$id' for r in json.load(sys.stdin)))" 2>/dev/null || true)"
-  [ "$in_werkbak" = "True" ] && break
-  sleep 3
-done
-[ "$in_werkbak" = "True" ] || { echo "FAIL: registration never reached the werkbak (gap 2)" >&2; exit 1; }
-echo "   in the werkbak"
-
-echo ">> 5. poll the openbaar register until the reference is publicly visible (proves NRC abonnement)"
-public=""
-for _ in $(seq 1 30); do
-  public="$(curl -fsS "$BFF/openbaar/register" | python3 -c "import sys,json;print(any(r.get('reference')=='$id' for r in json.load(sys.stdin)))" 2>/dev/null || true)"
-  [ "$public" = "True" ] && break
-  sleep 3
-done
-[ "$public" = "True" ] || { echo "FAIL: reference never appeared in the openbaar register — NRC abonnement not registered (gap 3)" >&2; exit 1; }
-echo "   visible in the openbaar register"
-
-echo "OK — a fresh local stack completed the flow with no manual seeding (zaaktype + DMN + abonnement)"
@@ -35,21 +35,12 @@ populate() {  # volume  source(file or dir/.)

 [ "$#" -gt 0 ] || { echo "usage: seed-config.sh <oz|nrc|kc|fl> ..." >&2; exit 2; }

-# The registratie process (BPMN) and its diploma-eligibility DMN are deployed as SEPARATE Flowable
-# deployments — the process engine and the DMN engine each own theirs (S-13, ADR-0016). flowable-rest
-# does not cascade a .dmn bundled in a process .bar into the DMN engine, so we seed both raw files and
-# let flowable-init deploy each via its own REST app. We stage them in a temp dir and copy its contents.
-stage_flowable_workflows() {
-  local dir="$1"
-  cp "$here/../workflows/registratie.bpmn" "$here/../workflows/diploma-eligibility.dmn" "$dir/"
-}
-
 for key in "$@"; do
  case "$key" in
    oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
    nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
    kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) d="$(mktemp -d)"; stage_flowable_workflows "$d"; populate rr-fl-bpmn "$d/." ;;
+    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
    *)  echo "unknown seed key: $key" >&2; exit 2 ;;
  esac
 done
@@ -24,10 +24,6 @@ import {
  Observable
 } from 'rxjs';

-export interface DecideRequest {
-  besluit: string;
-}
-
 export interface OpenbaarEntry {
  id: string;
  status: string;
@@ -35,25 +31,11 @@ export interface OpenbaarEntry {
  reference: string | null;
 }

-export interface ProvideDocumentsRequest {
-  contentBase64: string;
-  /** @nullable */
-  fileName?: string | null;
-  /** @nullable */
-  contentType?: string | null;
-}
-
 export interface SubmitAccepted {
  registrationId: string;
  status: string;
 }

-export interface WerkbakItem {
-  registrationId: string;
-  bsn: string;
-  status: string;
-}
-
 export type GetOpenbaarRegisterParams = {
 q?: string;
 };
@@ -200,78 +182,6 @@ export class BffApiV1Service {
    );
  }

- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientBodyOptions): Observable<TData>;
- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
-  postSelfServiceRegistrationsIdWithdraw<TData = void>(
-    id: string, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
-    if (options?.observe === 'events') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'events',
-      }
-    );
-    }
-
-    if (options?.observe === 'response') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'response',
-      }
-    );
-    }
-
-    return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'body',
-      }
-    );
-  }
-
- postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
-    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientBodyOptions): Observable<TData>;
- postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
-    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
- postSelfServiceRegistrationsIdDocuments<TData = void>(id: string,
-    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
-  postSelfServiceRegistrationsIdDocuments<TData = void>(
-    id: string,
-    provideDocumentsRequest: ProvideDocumentsRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
-    if (options?.observe === 'events') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/documents`,
-      provideDocumentsRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'events',
-      }
-    );
-    }
-
-    if (options?.observe === 'response') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/documents`,
-      provideDocumentsRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'response',
-      }
-    );
-    }
-
-    return this.http.post<TData>(
-      `/self-service/registrations/${id}/documents`,
-      provideDocumentsRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'body',
-      }
-    );
-  }
-
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientBodyOptions): Observable<TData>;
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
 getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
@@ -305,73 +215,4 @@ export class BffApiV1Service {
    );
  }

- getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientBodyOptions): Observable<TData>;
- getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
- getBehandelWerkbak<TData = WerkbakItem[]>( options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
-  getBehandelWerkbak<TData = WerkbakItem[]>(
-     options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
-    if (options?.observe === 'events') {
-      return this.http.get<TData>(
-      `/behandel/werkbak`,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'events',
-      }
-    );
-    }
-
-    if (options?.observe === 'response') {
-      return this.http.get<TData>(
-      `/behandel/werkbak`,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'response',
-      }
-    );
-    }
-
-    return this.http.get<TData>(
-      `/behandel/werkbak`,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'body',
-      }
-    );
-  }
-
- postBehandelRegistrationsIdDecide<TData = void>(id: string,
-    decideRequest: DecideRequest, options?: HttpClientBodyOptions): Observable<TData>;
- postBehandelRegistrationsIdDecide<TData = void>(id: string,
-    decideRequest: DecideRequest, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
- postBehandelRegistrationsIdDecide<TData = void>(id: string,
-    decideRequest: DecideRequest, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
-  postBehandelRegistrationsIdDecide<TData = void>(
-    id: string,
-    decideRequest: DecideRequest, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
-    if (options?.observe === 'events') {
-      return this.http.post<TData>(
-      `/behandel/registrations/${id}/decide`,
-      decideRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'events',
-      }
-    );
-    }
-
-    if (options?.observe === 'response') {
-      return this.http.post<TData>(
-      `/behandel/registrations/${id}/decide`,
-      decideRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'response',
-      }
-    );
-    }
-
-    return this.http.post<TData>(
-      `/behandel/registrations/${id}/decide`,
-      decideRequest,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'body',
-      }
-    );
-  }
-
 };
@@ -1,6 +1,4 @@
 export * from './lib/auth.service';
 export * from './lib/digid-auth.service';
 export * from './lib/digid-auth.providers';
-export * from './lib/medewerker-auth.service';
-export * from './lib/medewerker-auth.providers';
 export * from './lib/authenticated.guard';
@@ -1,26 +1,16 @@
-import { signal, Signal } from '@angular/core';
+import { Signal } from '@angular/core';

 /**
 * The portal's view of the signed-in user. An abstraction over the OIDC library so components and
- * guards depend on a small, mockable surface (the real implementations are DigiadAuthService for
- * citizens and MedewerkerAuthService for staff).
+ * guards depend on a small, mockable surface (the real implementation is DigiadAuthService).
 */
 export abstract class AuthService {
-  /** Whether a session is active. */
+  /** Whether a DigiD session is active. */
  abstract readonly isAuthenticated: Signal<boolean>;
-  /** The citizen-service number from the DigiD token, once authenticated (staff have none). */
+  /** The citizen-service number from the DigiD token, once authenticated. */
  abstract readonly bsn: Signal<string | undefined>;
-  /**
-   * The realm roles carried in the token. Empty for realms that don't grant roles (e.g. `digid`);
-   * the `medewerker` realm carries `behandelaar`/`teamlead`.
-   */
-  readonly roles: Signal<readonly string[]> = signal<readonly string[]>([]);
-  /** Start login (redirects to Keycloak). */
+  /** Start the DigiD login (redirects to Keycloak). */
  abstract login(): void;
  /** End the session. */
  abstract logout(): void;
-  /** Whether the signed-in user holds the given realm role. */
-  hasRole(role: string): boolean {
-    return this.roles().includes(role);
-  }
 }
@@ -1,49 +0,0 @@
-import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
-import { LogLevel, provideAuth, withAppInitializerAuthCheck } from 'angular-auth-oidc-client';
-import { AuthService } from './auth.service';
-import { MedewerkerAuthService } from './medewerker-auth.service';
-
-export interface MedewerkerAuthOptions {
-  /** The Keycloak `medewerker` realm issuer, as reachable from the browser. */
-  authority: string;
-  /** Where Keycloak redirects back to after login (usually the app origin). */
-  redirectUrl: string;
-  /**
-   * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
-   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
-   * (e.g. `/behandel/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
-   * relative `req.url` never starts with an absolute origin.
-   */
-  secureRoutes: string[];
-}
-
-/**
- * Configure medewerker login (Keycloak `medewerker` realm, public client `big-portal`, auth-code +
- * PKCE) and bind {@link AuthService} to the medewerker-backed implementation. Register
- * {@link authInterceptor} (re-exported from digid-auth.providers) in the app's HttpClient so BFF
- * calls carry the token.
- */
-export function provideMedewerkerAuth(options: MedewerkerAuthOptions): EnvironmentProviders {
-  return makeEnvironmentProviders([
-    provideAuth(
-      {
-        config: {
-          authority: options.authority,
-          redirectUrl: options.redirectUrl,
-          postLogoutRedirectUri: options.redirectUrl,
-          clientId: 'big-portal',
-          scope: 'openid profile',
-          responseType: 'code',
-          silentRenew: true,
-          useRefreshToken: true,
-          secureRoutes: options.secureRoutes,
-          logLevel: LogLevel.Warn,
-        },
-      },
-      // Run checkAuth() at startup so the login callback (?code=…) is processed before the router
-      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
-      withAppInitializerAuthCheck(),
-    ),
-    { provide: AuthService, useClass: MedewerkerAuthService },
-  ]);
-}
@@ -1,43 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { of } from 'rxjs';
-import { MedewerkerAuthService } from './medewerker-auth.service';
-
-function makeService(userData: unknown, authenticated = true) {
-  const oidc = {
-    isAuthenticated$: of({ isAuthenticated: authenticated }),
-    userData$: of({ userData }),
-    authorize: vi.fn(),
-    logoff: vi.fn(() => of(null)),
-  };
-  TestBed.configureTestingModule({
-    providers: [MedewerkerAuthService, { provide: OidcSecurityService, useValue: oidc }],
-  });
-  return { svc: TestBed.inject(MedewerkerAuthService), oidc };
-}
-
-describe('MedewerkerAuthService', () => {
-  it('exposes the realm roles carried in the token', () => {
-    const { svc } = makeService({ realm_access: { roles: ['behandelaar', 'teamlead'] } });
-    expect(svc.roles()).toEqual(['behandelaar', 'teamlead']);
-    expect(svc.hasRole('behandelaar')).toBe(true);
-    expect(svc.hasRole('beheerder')).toBe(false);
-  });
-
-  it('has no roles when the token omits realm_access', () => {
-    const { svc } = makeService({ preferred_username: 'merel-behandelaar' });
-    expect(svc.roles()).toEqual([]);
-    expect(svc.hasRole('behandelaar')).toBe(false);
-  });
-
-  it('reflects the OIDC authenticated state', () => {
-    const { svc } = makeService({}, true);
-    expect(svc.isAuthenticated()).toBe(true);
-  });
-
-  it('starts login by delegating to the OIDC library', () => {
-    const { svc, oidc } = makeService({});
-    svc.login();
-    expect(oidc.authorize).toHaveBeenCalledTimes(1);
-  });
-});
@@ -1,41 +0,0 @@
-import { inject, Injectable, Signal } from '@angular/core';
-import { toSignal } from '@angular/core/rxjs-interop';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { map } from 'rxjs';
-import { AuthService } from './auth.service';
-
-/** The subset of the medewerker token the portal reads: Keycloak nests realm roles here. */
-interface MedewerkerClaims {
-  realm_access?: { roles?: string[] };
-}
-
-/** Medewerker-backed AuthService over angular-auth-oidc-client (Keycloak `medewerker` realm). */
-@Injectable()
-export class MedewerkerAuthService extends AuthService {
-  private readonly oidc = inject(OidcSecurityService);
-
-  readonly isAuthenticated: Signal<boolean> = toSignal(
-    this.oidc.isAuthenticated$.pipe(map((result) => result.isAuthenticated)),
-    { initialValue: false },
-  );
-
-  // Staff have no BSN; the abstract surface keeps this present for the shared guard/interceptor.
-  readonly bsn: Signal<string | undefined> = toSignal(this.oidc.userData$.pipe(map(() => undefined)), {
-    initialValue: undefined,
-  });
-
-  override readonly roles: Signal<readonly string[]> = toSignal(
-    this.oidc.userData$.pipe(
-      map((data) => (data.userData as MedewerkerClaims | null)?.realm_access?.roles ?? []),
-    ),
-    { initialValue: [] },
-  );
-
-  override login(): void {
-    this.oidc.authorize();
-  }
-
-  override logout(): void {
-    this.oidc.logoff().subscribe();
-  }
-}
@@ -11,8 +11,6 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
    .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
    ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
-// Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
-builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
 builder.Services.AddScoped<AclService>();

 var app = builder.Build();
@@ -34,14 +32,6 @@ app.MapPost("/statussen", async (SetStatusRequest body, AclService acl, Cancella
    return Results.NoContent();
 });

-// Cancel a zaak on document-timeout expiry (S-10c): set it to its zaaktype's cancellation statustype
-// + resultaat. The domain hands over only the zaak URL; the ACL owns the ZGW resolution (§8.1).
-app.MapPost("/annuleringen", async (CancelZaakRequest body, AclService acl, CancellationToken ct) =>
-{
-    await acl.CancelZaakAsync(new Uri(body.ZaakUrl), ct);
-    return Results.NoContent();
-});
-
 // Read a zaak's public-safe reference (its identificatie). The Event Subscriber calls this to enrich
 // the read projection without reading ZGW itself (§8.1, #78).
 app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl, CancellationToken ct) =>
@@ -50,25 +40,12 @@ app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl
    return Results.Ok(new { reference });
 });

-// Store an uploaded diploma against a zaak (S-10b): the domain sends the file as base64; the ACL
-// creates the ZGW enkelvoudiginformatieobject and relates it to the zaak (§8.1). Returns its URL.
-app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, CancellationToken ct) =>
-{
-    var url = await acl.StoreDiplomaAsync(
-        new Uri(body.ZaakUrl), Convert.FromBase64String(body.ContentBase64), body.FileName, body.ContentType, ct);
-    return Results.Ok(new { informatieobjectUrl = url.ToString() });
-});
-
 app.Run();

 public sealed record OpenZaakRequest(string Bsn, string Reference);

 public sealed record SetStatusRequest(string ZaakUrl);

-public sealed record CancelZaakRequest(string ZaakUrl);
-
 public sealed record ZaakReferenceRequest(string ZaakUrl);

-public sealed record StoreDocumentRequest(string ZaakUrl, string ContentBase64, string FileName, string ContentType);
-
 public partial class Program;
@@ -6,12 +6,5 @@ public sealed class AclDefaults
    public required string Bronorganisatie { get; init; }
    public required string VerantwoordelijkeOrganisatie { get; init; }
    public required string Vertrouwelijkheidaanduiding { get; init; }
-
-    /// <summary>The BIG zaaktype's stable business key. The ACL resolves the (server-assigned) zaaktype
-    /// URL from this via the Catalogi API instead of being handed a pinned URL (S-27, ADR-0021).</summary>
-    public required string ZaaktypeIdentificatie { get; init; }
-
-    /// <summary>The omschrijving of the informatieobjecttype an uploaded diploma is filed under (S-10b);
-    /// resolved to a URL by the Catalogi API, like <see cref="ZaaktypeIdentificatie"/>.</summary>
-    public required string InformatieobjecttypeOmschrijving { get; init; }
+    public required Uri ZaaktypeUrl { get; init; }
 }
@@ -2,9 +2,9 @@ namespace Acl.Application;

 /// <summary>The ACL's single operation: open a zaak from a domain payload,
 /// default-filling the ZGW-mandatory fields (ADR-0003).</summary>
-public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaaktypeCatalog catalog, IClock clock)
+public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IClock clock)
 {
-    public async Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
+    public Task<Uri> OpenZaakAsync(DomainRegistration registration, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(registration);

@@ -12,34 +12,22 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak
            defaults.Bronorganisatie,
            defaults.VerantwoordelijkeOrganisatie,
            defaults.Vertrouwelijkheidaanduiding,
-            await catalog.GetZaaktypeUrlAsync(ct),
+            defaults.ZaaktypeUrl,
            clock.Today,
            registration.Reference);

-        return await gateway.OpenZaakAsync(request, ct);
+        return gateway.OpenZaakAsync(request, ct);
    }

    /// <summary>
-    /// Approve a zaak: set it to the eindstatus of the BIG zaaktype (resolved by identificatie, S-27).
-    /// The domain hands over only the zaak URL; the ACL owns which statustype means "approved" (§8.1).
+    /// Approve a zaak: set it to the eindstatus of the configured BIG zaaktype (ADR-0003 default). The
+    /// domain hands over only the zaak URL; the ACL owns which statustype means "approved" (§8.1).
    /// </summary>
-    public async Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    public Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);

-        await gateway.SetZaakToEindstatusAsync(zaakUrl, await catalog.GetZaaktypeUrlAsync(ct), clock.Today, ct);
-    }
-
-    /// <summary>
-    /// Cancel a zaak on document-timeout expiry (S-10c): set it to the BIG zaaktype's cancellation
-    /// statustype + resultaat. The domain hands over only the zaak URL; the ACL owns which
-    /// statustype/resultaat means "cancelled" (§8.1).
-    /// </summary>
-    public async Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(zaakUrl);
-
-        await gateway.SetZaakToCancellationStatusAsync(zaakUrl, await catalog.GetZaaktypeUrlAsync(ct), clock.Today, ct);
+        return gateway.SetZaakToEindstatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
    }

    /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
@@ -49,33 +37,4 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, IZaak

        return gateway.GetZaakIdentificatieAsync(zaakUrl, ct);
    }
-
-    /// <summary>
-    /// Store an uploaded diploma against the zaak (S-10b): default-fill the ZGW-mandatory document
-    /// fields (informatieobjecttype, bronorganisatie, vertrouwelijkheidaanduiding, taal, creatiedatum)
-    /// and hand the file to the gateway, which creates the informatieobject and relates it to the zaak.
-    /// The domain supplies only the zaak, the bytes, and the file's name/type (§8.1).
-    /// </summary>
-    public async Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(zaakUrl);
-        ArgumentNullException.ThrowIfNull(content);
-        ArgumentException.ThrowIfNullOrWhiteSpace(fileName);
-        ArgumentException.ThrowIfNullOrWhiteSpace(contentType);
-
-        var request = new DocumentRequest(
-            defaults.Bronorganisatie,
-            await catalog.GetInformatieobjecttypeUrlAsync(ct),
-            defaults.Vertrouwelijkheidaanduiding,
-            zaakUrl,
-            clock.Today,
-            Titel: "Diploma",
-            Auteur: "zorgprofessional",
-            Taal: "nld",
-            Bestandsnaam: fileName,
-            Formaat: contentType,
-            Inhoud: content);
-
-        return await gateway.StoreDocumentAsync(request, ct);
-    }
 }
@@ -1,46 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Resolves the zaaktype + diploma-informatieobjecttype URLs from the Catalogi API on first
-/// use and caches them for the process lifetime (S-27, ADR-0021). Lazy (not at startup) so the ACL
-/// never crash-loops when it boots before the catalogus is seeded/published; a <em>failed</em>
-/// resolution is not cached, so it is retried on the next call (e.g. once the zaaktype is published).
-/// A process restart re-resolves.</summary>
-public sealed class CachedZaaktypeCatalog(IZaakGateway gateway, AclDefaults defaults) : IZaaktypeCatalog
-{
-    private readonly SemaphoreSlim gate = new(1, 1);
-    private Uri? zaaktype;
-    private Uri? informatieobjecttype;
-
-    public Task<Uri> GetZaaktypeUrlAsync(CancellationToken ct = default) =>
-        ResolveOnceAsync(
-            () => zaaktype, value => zaaktype = value,
-            () => gateway.ResolveZaaktypeUrlAsync(defaults.ZaaktypeIdentificatie, ct), ct);
-
-    public Task<Uri> GetInformatieobjecttypeUrlAsync(CancellationToken ct = default) =>
-        ResolveOnceAsync(
-            () => informatieobjecttype, value => informatieobjecttype = value,
-            () => gateway.ResolveInformatieobjecttypeUrlAsync(defaults.InformatieobjecttypeOmschrijving, ct), ct);
-
-    // Double-checked, single-flight resolution: return the cache if set; otherwise resolve under the
-    // gate and cache only on success (a throw leaves the cache empty so the next call retries).
-    private async Task<Uri> ResolveOnceAsync(Func<Uri?> read, Action<Uri> store, Func<Task<Uri>> resolve, CancellationToken ct)
-    {
-        if (read() is { } cached)
-            return cached;
-
-        await gate.WaitAsync(ct);
-        try
-        {
-            if (read() is { } existing)
-                return existing;
-
-            var resolved = await resolve();
-            store(resolved);
-            return resolved;
-        }
-        finally
-        {
-            gate.Release();
-        }
-    }
-}
@@ -1,17 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>The fully default-filled diploma document the gateway will create in the ZGW Documenten
-/// API and relate to the zaak (S-10b). <see cref="Inhoud"/> is the raw file content; the gateway
-/// base64-encodes it into the ZGW <c>inhoud</c> field.</summary>
-public sealed record DocumentRequest(
-    string Bronorganisatie,
-    Uri Informatieobjecttype,
-    string Vertrouwelijkheidaanduiding,
-    Uri Zaak,
-    DateOnly Creatiedatum,
-    string Titel,
-    string Auteur,
-    string Taal,
-    string Bestandsnaam,
-    string Formaat,
-    byte[] Inhoud);
@@ -13,31 +13,7 @@ public interface IZaakGateway
    /// </summary>
    Task SetZaakToEindstatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);

-    /// <summary>
-    /// Set the given zaak to the <em>cancellation</em> statustype ("Geannuleerd") and record the
-    /// matching cancellation resultaat ("Vervallen") — the ZGW translation of "the 30-day document term
-    /// lapsed" (S-10c). Distinct from <see cref="SetZaakToEindstatusAsync"/> (approval): the gateway
-    /// resolves both the cancellation statustype and resultaattype from the catalogus by their
-    /// omschrijving, POSTs the resultaat then the status, dated <paramref name="datumStatusGezet"/>.
-    /// </summary>
-    Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
-
    /// <summary>Read the zaak's <c>identificatie</c> — the public-safe reference the register shows.
    /// The Event Subscriber calls this through the ACL rather than reading ZGW itself (§8.1, #78).</summary>
    Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default);
-
-    /// <summary>
-    /// Store a diploma document (S-10b): create an <c>enkelvoudiginformatieobject</c> in the ZGW
-    /// Documenten API and relate it to the zaak via a <c>zaakinformatieobject</c>. Returns the URL of
-    /// the created informatieobject.
-    /// </summary>
-    Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default);
-
-    /// <summary>Resolve the URL of the published zaaktype with the given <paramref name="identificatie"/>
-    /// from the Catalogi API (S-27). Throws if no published zaaktype matches.</summary>
-    Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default);
-
-    /// <summary>Resolve the URL of the published informatieobjecttype with the given
-    /// <paramref name="omschrijving"/> from the Catalogi API (S-27). Throws if none matches.</summary>
-    Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default);
 }
@@ -1,12 +0,0 @@
-namespace Acl.Application;
-
-/// <summary>Supplies the ACL's zaaktype + diploma-informatieobjecttype URLs, resolved from OpenZaak's
-/// Catalogi API by their stable business keys (<see cref="AclDefaults.ZaaktypeIdentificatie"/> /
-/// <see cref="AclDefaults.InformatieobjecttypeOmschrijving"/>) rather than pinned in config (S-27,
-/// ADR-0021). Implementations resolve lazily on first use and cache the result.</summary>
-public interface IZaaktypeCatalog
-{
-    Task<Uri> GetZaaktypeUrlAsync(CancellationToken ct = default);
-
-    Task<Uri> GetInformatieobjecttypeUrlAsync(CancellationToken ct = default);
-}
@@ -8,12 +8,6 @@ namespace Acl.Infrastructure;
 /// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
 public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
 {
-    // The ACL owns which ZGW statustype/resultaat carries each domain outcome (§8.1). These
-    // omschrijvingen match the seeded BIG catalogus (infra/openzaak/seed_catalogus.py).
-    private const string GeregistreerdResultaat = "Geregistreerd";   // approval outcome
-    private const string GeannuleerdStatus = "Geannuleerd";          // document-timeout cancellation status (S-10c)
-    private const string VervallenResultaat = "Vervallen";           // document-timeout cancellation outcome (S-10c)
-
    public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(request);
@@ -54,9 +48,7 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        ArgumentNullException.ThrowIfNull(zaaktypeUrl);

        var eindstatus = await ResolveEindstatusAsync(zaaktypeUrl, ct);
-        // Resolve the approval resultaat by name: once S-10c adds the Vervallen resultaattype, taking
-        // the first would be ambiguous (the Zaken API does not guarantee order).
-        var resultaattype = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, GeregistreerdResultaat, ct);
+        var resultaattype = await ResolveResultaattypeAsync(zaaktypeUrl, ct);

        // OpenZaak refuses to set a zaak's eindstatus unless the zaak has a resultaat
        // ("resultaat-does-not-exist"), so record the resultaat first, then the status.
@@ -70,27 +62,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
            "Setting the zaak status", ct);
    }

-    public async Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(zaakUrl);
-        ArgumentNullException.ThrowIfNull(zaaktypeUrl);
-
-        // Distinct from approval: resolve the cancellation statustype + resultaat by name (Geannuleerd
-        // is a non-terminal statustype, so it is never the eindstatus the approval path resolves).
-        var cancellationStatus = await ResolveStatustypeByOmschrijvingAsync(zaaktypeUrl, GeannuleerdStatus, ct);
-        var cancellationResultaat = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, VervallenResultaat, ct);
-
-        // As with approval, OpenZaak wants the resultaat recorded before the status.
-        await PostAsync("/zaken/api/v1/resultaten",
-            new ResultaatDto(zaakUrl.ToString(), cancellationResultaat.ToString()),
-            "Setting the zaak cancellation resultaat", ct);
-
-        await PostAsync("/zaken/api/v1/statussen",
-            new StatusDto(zaakUrl.ToString(), cancellationStatus.ToString(),
-                datumStatusGezet.ToDateTime(TimeOnly.MinValue, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ")),
-            "Setting the zaak cancellation status", ct);
-    }
-
    public async Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
    {
        ArgumentNullException.ThrowIfNull(zaakUrl);
@@ -109,81 +80,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        return zaak.Identificatie;
    }

-    public async Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(request);
-
-        // 1. Create the enkelvoudiginformatieobject in the Documenten API (not a geo API — no CRS).
-        var created = await PostForUrlAsync(
-            "/documenten/api/v1/enkelvoudiginformatieobjecten",
-            new EnkelvoudigInformatieobjectDto(
-                request.Bronorganisatie,
-                request.Creatiedatum.ToString("yyyy-MM-dd"),
-                request.Titel,
-                request.Auteur,
-                request.Taal,
-                request.Informatieobjecttype.ToString(),
-                Convert.ToBase64String(request.Inhoud),
-                request.Bestandsnaam,
-                request.Inhoud.Length,
-                request.Vertrouwelijkheidaanduiding,
-                request.Formaat,
-                "definitief",
-                // No usage-rights restrictions apply. Left null, OpenZaak rejects closing the related
-                // zaak with "indicatiegebruiksrecht-unset"; false records the deliberate "none" answer.
-                false),
-            "Creating the informatieobject", ct);
-
-        // 2. Relate it to the zaak (Zaken API — no CRS).
-        await PostAsync("/zaken/api/v1/zaakinformatieobjecten",
-            new ZaakInformatieobjectDto(request.Zaak.ToString(), created.ToString()),
-            "Relating the informatieobject to the zaak", ct);
-
-        return created;
-    }
-
-    public async Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(identificatie);
-
-        // The published zaaktype with this identificatie; status=definitief excludes concepts.
-        var page = await GetAsync<ZaaktypePage>(
-            "/catalogi/api/v1/zaaktypen?status=definitief&identificatie=" + Uri.EscapeDataString(identificatie),
-            "zaaktypen", ct);
-        var match = (page.Results ?? []).FirstOrDefault()
-            ?? throw new InvalidOperationException(
-                $"No published zaaktype with identificatie '{identificatie}' found in OpenZaak — is the BIG catalogus seeded and published?");
-        return new Uri(match.Url);
-    }
-
-    public async Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(omschrijving);
-
-        // The informatieobjecttypen collection has no omschrijving filter, so match client-side over the
-        // published ones.
-        var page = await GetAsync<InformatieobjecttypePage>(
-            "/catalogi/api/v1/informatieobjecttypen?status=definitief", "informatieobjecttypen", ct);
-        var match = (page.Results ?? []).FirstOrDefault(i => i.Omschrijving == omschrijving)
-            ?? throw new InvalidOperationException(
-                $"No published informatieobjecttype '{omschrijving}' found in OpenZaak — is the BIG catalogus seeded and published?");
-        return new Uri(match.Url);
-    }
-
-    // GETs an absolute-by-path ZGW resource with auth (no CRS — catalogi is not a geo API).
-    private async Task<T> GetAsync<T>(string pathAndQuery, string label, CancellationToken ct)
-    {
-        using var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, pathAndQuery));
-        message.Headers.Authorization =
-            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
-
-        using var response = await http.SendAsync(message, ct);
-        await EnsureSuccessAsync(response, $"Querying {label}", ct);
-
-        return await response.Content.ReadFromJsonAsync<T>(ct)
-            ?? throw new InvalidOperationException($"OpenZaak returned an empty {label} response");
-    }
-
    // POSTs a non-geo ZGW resource (resultaat/status — no CRS headers). Buffers the body so uwsgi gets
    // a Content-Length instead of a chunked body (as with zaak-create).
    private async Task PostAsync(string path, object dto, string action, CancellationToken ct)
@@ -200,26 +96,6 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        await EnsureSuccessAsync(response, action, ct);
    }

-    // POSTs a non-geo ZGW resource and returns the created resource's URL (as PostAsync, but reads back
-    // the `url` of the created object). Buffers the body so uwsgi gets a Content-Length.
-    private async Task<Uri> PostForUrlAsync(string path, object dto, string action, CancellationToken ct)
-    {
-        using var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
-        {
-            Content = JsonContent.Create(dto),
-        };
-        message.Headers.Authorization =
-            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
-        await message.Content.LoadIntoBufferAsync(ct);
-
-        using var response = await http.SendAsync(message, ct);
-        await EnsureSuccessAsync(response, action, ct);
-
-        var created = await response.Content.ReadFromJsonAsync<CreatedDto>(ct)
-            ?? throw new InvalidOperationException($"OpenZaak returned an empty response for {action}");
-        return new Uri(created.Url);
-    }
-
    // EnsureSuccessStatusCode discards the response body; ZGW returns a JSON problem detail on 400 that
    // is essential for diagnosing a rejected request, so surface it in the exception.
    private static async Task EnsureSuccessAsync(HttpResponseMessage response, string action, CancellationToken ct)
@@ -245,23 +121,13 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        return new Uri(eindstatus.Url);
    }

-    /// <summary>Resolve a specific statustype from the catalogus by its omschrijving (e.g. "Geannuleerd").</summary>
-    private async Task<Uri> ResolveStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
-    {
-        var page = await GetCatalogusAsync<StatustypePage>("statustypen", zaaktypeUrl, "statustypen", ct);
-        var match = (page.Results ?? []).FirstOrDefault(s => s.Omschrijving == omschrijving)
-            ?? throw new InvalidOperationException($"No '{omschrijving}' statustype found for zaaktype {zaaktypeUrl}");
-        return new Uri(match.Url);
-    }
-
-    /// <summary>Resolve a specific resultaattype from the catalogus by its omschrijving (the seed defines
-    /// "Geregistreerd" for approval and "Vervallen" for a document-timeout cancellation).</summary>
-    private async Task<Uri> ResolveResultaattypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
+    /// <summary>Resolve the zaaktype's resultaattype from the catalogus (the seed defines one).</summary>
+    private async Task<Uri> ResolveResultaattypeAsync(Uri zaaktypeUrl, CancellationToken ct)
    {
        var page = await GetCatalogusAsync<ResultaattypePage>("resultaattypen", zaaktypeUrl, "resultaattypen", ct);
-        var match = (page.Results ?? []).FirstOrDefault(r => r.Omschrijving == omschrijving)
-            ?? throw new InvalidOperationException($"No '{omschrijving}' resultaattype found for zaaktype {zaaktypeUrl}");
-        return new Uri(match.Url);
+        var resultaattype = (page.Results ?? []).FirstOrDefault()
+            ?? throw new InvalidOperationException($"No resultaattypen found for zaaktype {zaaktypeUrl}");
+        return new Uri(resultaattype.Url);
    }

    // GETs a catalogus collection filtered by zaaktype (status=alles includes concept + published).
@@ -305,8 +171,7 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
    private sealed record StatustypeDto(
        [property: JsonPropertyName("url")] string Url,
        [property: JsonPropertyName("volgnummer")] int Volgnummer,
-        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus,
-        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
+        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus);

    private sealed record ResultaatDto(
        [property: JsonPropertyName("zaak")] string Zaak,
@@ -316,42 +181,5 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
        [property: JsonPropertyName("results")] IReadOnlyList<ResultaattypeDto>? Results);

    private sealed record ResultaattypeDto(
-        [property: JsonPropertyName("url")] string Url,
-        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
-
-    private sealed record CreatedDto(
        [property: JsonPropertyName("url")] string Url);
-
-    private sealed record EnkelvoudigInformatieobjectDto(
-        [property: JsonPropertyName("bronorganisatie")] string Bronorganisatie,
-        [property: JsonPropertyName("creatiedatum")] string Creatiedatum,
-        [property: JsonPropertyName("titel")] string Titel,
-        [property: JsonPropertyName("auteur")] string Auteur,
-        [property: JsonPropertyName("taal")] string Taal,
-        [property: JsonPropertyName("informatieobjecttype")] string Informatieobjecttype,
-        [property: JsonPropertyName("inhoud")] string Inhoud,
-        [property: JsonPropertyName("bestandsnaam")] string Bestandsnaam,
-        [property: JsonPropertyName("bestandsomvang")] int Bestandsomvang,
-        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding,
-        [property: JsonPropertyName("formaat")] string Formaat,
-        [property: JsonPropertyName("status")] string Status,
-        [property: JsonPropertyName("indicatieGebruiksrecht")] bool IndicatieGebruiksrecht);
-
-    private sealed record ZaakInformatieobjectDto(
-        [property: JsonPropertyName("zaak")] string Zaak,
-        [property: JsonPropertyName("informatieobject")] string Informatieobject);
-
-    private sealed record ZaaktypePage(
-        [property: JsonPropertyName("results")] IReadOnlyList<ZaaktypeDto>? Results);
-
-    private sealed record ZaaktypeDto(
-        [property: JsonPropertyName("url")] string Url,
-        [property: JsonPropertyName("identificatie")] string? Identificatie);
-
-    private sealed record InformatieobjecttypePage(
-        [property: JsonPropertyName("results")] IReadOnlyList<InformatieobjecttypeDto>? Results);
-
-    private sealed record InformatieobjecttypeDto(
-        [property: JsonPropertyName("url")] string Url,
-        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
 }
@@ -77,18 +77,6 @@ public sealed class OpenZaakFixture : IDisposable
        return JsonDocument.Parse(json).RootElement.Clone();
    }

-    /// <summary>The URL of the published "Diploma" informatieobjecttype (S-10b), or null when the
-    /// stack has not been seeded with OZ_PUBLISH=1. `status=definitief` returns published types only.</summary>
-    public async Task<Uri?> FindPublishedDiplomaInformatieobjecttypeAsync(CancellationToken ct = default)
-    {
-        var query = new Uri(BaseUrl, "/catalogi/api/v1/informatieobjecttypen?status=definitief");
-        var page = await GetJsonAsync(query, ct);
-        foreach (var iot in page.GetProperty("results").EnumerateArray())
-            if (iot.TryGetProperty("omschrijving", out var o) && o.GetString() == "Diploma")
-                return new Uri(iot.GetProperty("url").GetString()!);
-        return null;
-    }
-
    /// <summary>The zaaktype's eindstatus (terminal statustype) URL — the one an approval sets.</summary>
    public async Task<Uri> FindEindstatustypeAsync(Uri zaaktypeUrl, CancellationToken ct = default)
    {
@@ -114,19 +102,6 @@ public sealed class OpenZaakFixture : IDisposable
        return fallback ?? throw new InvalidOperationException($"No statustypen for zaaktype {zaaktypeUrl}");
    }

-    /// <summary>Resolve a statustype by its omschrijving (e.g. the S-10c "Geannuleerd" cancellation status).</summary>
-    public async Task<Uri> FindStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct = default)
-    {
-        var query = new Uri(BaseUrl,
-            "/catalogi/api/v1/statustypen?status=alles&zaaktype=" + Uri.EscapeDataString(zaaktypeUrl.ToString()));
-        var page = await GetJsonAsync(query, ct);
-        foreach (var st in page.GetProperty("results").EnumerateArray())
-            if (st.TryGetProperty("omschrijving", out var o) && o.GetString() == omschrijving)
-                return new Uri(st.GetProperty("url").GetString()!);
-
-        throw new InvalidOperationException($"No '{omschrijving}' statustype for zaaktype {zaaktypeUrl}");
-    }
-
    // A ZGW (vng-api-common) HS256 JWT, mirroring the seed's client. Minted here
    // rather than reusing Acl.Infrastructure's internal minter to keep that internal.
    private string MintToken()
@@ -74,119 +74,4 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
        var eindstatustype = await stack.FindEindstatustypeAsync(zaaktype!);
        Assert.Equal(eindstatustype.ToString(), status.GetProperty("statustype").GetString());
    }
-
-    [Fact]
-    public async Task Cancelling_a_zaak_records_the_geannuleerd_status_and_a_resultaat()
-    {
-        var zaaktype = await stack.FindPublishedBigZaaktypeAsync();
-        Assert.True(zaaktype is not null,
-            "No published BIG-REGISTRATIE zaaktype found in OpenZaak — bring the stack up and " +
-            "seed it with OZ_PUBLISH=1 (`make integration` does this).");
-
-        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
-        var zaakUrl = await gateway.OpenZaakAsync(new ZaakRequest(
-            Bronorganisatie: "517439943",
-            VerantwoordelijkeOrganisatie: "517439943",
-            Vertrouwelijkheidaanduiding: "openbaar",
-            Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
-            Identificatie: Guid.NewGuid().ToString()));
-
-        await gateway.SetZaakToCancellationStatusAsync(zaakUrl, zaaktype!, DateOnly.FromDateTime(DateTime.UtcNow));
-
-        // The zaak's current status is the Geannuleerd statustype — distinct from the approval eindstatus.
-        var zaak = await stack.GetZaakAsync(zaakUrl);
-        var statusUrl = zaak.GetProperty("status").GetString();
-        Assert.False(string.IsNullOrEmpty(statusUrl), "the cancelled zaak has no current status");
-
-        var status = await stack.GetJsonAsync(new Uri(statusUrl!));
-        var geannuleerd = await stack.FindStatustypeByOmschrijvingAsync(zaaktype!, "Geannuleerd");
-        Assert.Equal(geannuleerd.ToString(), status.GetProperty("statustype").GetString());
-
-        // ...and a resultaat is recorded (OpenZaak requires it before a closing/terminal status).
-        Assert.False(string.IsNullOrEmpty(zaak.GetProperty("resultaat").GetString()),
-            "the cancelled zaak has no resultaat");
-    }
-
-    [Fact]
-    public async Task Storing_a_diploma_creates_a_real_informatieobject_related_to_the_zaak()
-    {
-        var zaaktype = await stack.FindPublishedBigZaaktypeAsync();
-        Assert.True(zaaktype is not null,
-            "No published BIG-REGISTRATIE zaaktype found — seed the stack with OZ_PUBLISH=1.");
-        var informatieobjecttype = await stack.FindPublishedDiplomaInformatieobjecttypeAsync();
-        Assert.True(informatieobjecttype is not null,
-            "No published Diploma informatieobjecttype found — seed the stack with OZ_PUBLISH=1.");
-
-        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
-        var zaakUrl = await gateway.OpenZaakAsync(new ZaakRequest(
-            Bronorganisatie: "517439943",
-            VerantwoordelijkeOrganisatie: "517439943",
-            Vertrouwelijkheidaanduiding: "openbaar",
-            Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
-            Identificatie: Guid.NewGuid().ToString()));
-
-        var content = System.Text.Encoding.UTF8.GetBytes("%PDF-1.4 synthetic diploma\n");
-        var documentUrl = await gateway.StoreDocumentAsync(new DocumentRequest(
-            Bronorganisatie: "517439943",
-            Informatieobjecttype: informatieobjecttype!,
-            Vertrouwelijkheidaanduiding: "openbaar",
-            Zaak: zaakUrl,
-            Creatiedatum: DateOnly.FromDateTime(DateTime.UtcNow),
-            Titel: "Diploma",
-            Auteur: "zorgprofessional",
-            Taal: "nld",
-            Bestandsnaam: "diploma.pdf",
-            Formaat: "application/pdf",
-            Inhoud: content));
-
-        // The gateway returns the canonical informatieobject URL...
-        Assert.StartsWith(
-            new Uri(stack.BaseUrl, "/documenten/api/v1/enkelvoudiginformatieobjecten/").ToString(),
-            documentUrl.ToString());
-
-        // ...the document is really persisted with the default-filled fields...
-        var doc = await stack.GetJsonAsync(documentUrl);
-        Assert.Equal("diploma.pdf", doc.GetProperty("bestandsnaam").GetString());
-        Assert.Equal(informatieobjecttype.ToString(), doc.GetProperty("informatieobjecttype").GetString());
-        Assert.Equal(content.Length, doc.GetProperty("bestandsomvang").GetInt32());
-        // indicatieGebruiksrecht is recorded as "no restrictions"; left null, OpenZaak would refuse to
-        // close the zaak this document is related to (the S-10b regression that broke the e2e flow).
-        Assert.False(doc.GetProperty("indicatieGebruiksrecht").GetBoolean());
-
-        // ...and it is related to the zaak (a zaakinformatieobject links the two).
-        var relations = await stack.GetJsonAsync(new Uri(stack.BaseUrl,
-            "/zaken/api/v1/zaakinformatieobjecten?informatieobject=" + Uri.EscapeDataString(documentUrl.ToString())));
-        Assert.Contains(relations.EnumerateArray(),
-            r => r.GetProperty("zaak").GetString() == zaakUrl.ToString());
-    }
-
-    [Fact]
-    public async Task Resolves_the_published_zaaktype_and_diploma_informatieobjecttype_by_business_key()
-    {
-        var expectedZaaktype = await stack.FindPublishedBigZaaktypeAsync();
-        Assert.True(expectedZaaktype is not null,
-            "No published BIG-REGISTRATIE zaaktype found — seed the stack with OZ_PUBLISH=1.");
-        var expectedInformatieobjecttype = await stack.FindPublishedDiplomaInformatieobjecttypeAsync();
-        Assert.True(expectedInformatieobjecttype is not null,
-            "No published Diploma informatieobjecttype found — seed the stack with OZ_PUBLISH=1.");
-
-        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
-
-        // The ACL discovers both URLs from the live Catalogi API by their stable business keys (S-27),
-        // matching what the fixture found independently — no pinned URL needed.
-        Assert.Equal(expectedZaaktype, await gateway.ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
-        Assert.Equal(expectedInformatieobjecttype, await gateway.ResolveInformatieobjecttypeUrlAsync("Diploma"));
-    }
-
-    [Fact]
-    public async Task Resolving_an_unknown_zaaktype_identificatie_throws_a_clear_error()
-    {
-        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
-
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => gateway.ResolveZaaktypeUrlAsync("NO-SUCH-ZAAKTYPE"));
-        Assert.Contains("NO-SUCH-ZAAKTYPE", ex.Message);
-    }
 }
@@ -6,12 +6,6 @@ public class AclServiceTests
 {
    private sealed class FakeGateway : IZaakGateway
    {
-        // The URLs the catalogus resolves the configured identificatie/omschrijving to (S-27).
-        public Uri ResolvedZaaktype { get; } = new("http://openzaak/catalogi/api/v1/zaaktypen/big");
-        public Uri ResolvedInformatieobjecttype { get; } = new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
-        public string? ResolvedByIdentificatie;
-        public string? ResolvedByOmschrijving;
-
        public ZaakRequest? Captured;
        public Uri Result { get; } = new("http://openzaak/zaken/api/v1/zaken/abc");

@@ -29,14 +23,6 @@ public class AclServiceTests
            return Task.CompletedTask;
        }

-        public (Uri Zaak, Uri Zaaktype, DateOnly Datum)? Cancelled;
-
-        public Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
-        {
-            Cancelled = (zaakUrl, zaaktypeUrl, datumStatusGezet);
-            return Task.CompletedTask;
-        }
-
        public Uri? ReadReferenceFor;

        public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
@@ -44,27 +30,6 @@ public class AclServiceTests
            ReadReferenceFor = zaakUrl;
            return Task.FromResult("REG-FROM-ZAAK");
        }
-
-        public DocumentRequest? StoredDocument;
-        public Uri DocumentResult { get; } = new("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1");
-
-        public Task<Uri> StoreDocumentAsync(DocumentRequest request, CancellationToken ct = default)
-        {
-            StoredDocument = request;
-            return Task.FromResult(DocumentResult);
-        }
-
-        public Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
-        {
-            ResolvedByIdentificatie = identificatie;
-            return Task.FromResult(ResolvedZaaktype);
-        }
-
-        public Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
-        {
-            ResolvedByOmschrijving = omschrijving;
-            return Task.FromResult(ResolvedInformatieobjecttype);
-        }
    }

    private static AclDefaults Defaults() => new()
@@ -72,23 +37,26 @@ public class AclServiceTests
        Bronorganisatie = "517439943",
        VerantwoordelijkeOrganisatie = "517439943",
        Vertrouwelijkheidaanduiding = "openbaar",
-        ZaaktypeIdentificatie = "BIG-REGISTRATIE",
-        InformatieobjecttypeOmschrijving = "Diploma",
+        ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
    };

-    private static AclService ServiceWith(FakeGateway gateway, AclDefaults defaults, DateOnly today) =>
-        new(gateway, defaults, new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
-
    private sealed class FixedClock(DateOnly today) : IClock
    {
        public DateOnly Today { get; } = today;
    }

    [Fact]
-    public async Task Opening_a_zaak_default_fills_zgw_fields_and_uses_the_resolved_zaaktype()
+    public async Task Opening_a_zaak_default_fills_zgw_fields_and_returns_the_zaak_url()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = new AclDefaults
+        {
+            Bronorganisatie = "517439943",
+            VerantwoordelijkeOrganisatie = "517439943",
+            Vertrouwelijkheidaanduiding = "openbaar",
+            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
+        };
+        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));

        var url = await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-77"));

@@ -97,9 +65,7 @@ public class AclServiceTests
        Assert.Equal("517439943", req.Bronorganisatie);
        Assert.Equal("517439943", req.VerantwoordelijkeOrganisatie);
        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
-        // The zaaktype is resolved from the configured identificatie, not a pinned URL (S-27).
-        Assert.Equal("BIG-REGISTRATIE", gateway.ResolvedByIdentificatie);
-        Assert.Equal(gateway.ResolvedZaaktype, req.Zaaktype);
+        Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
        Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
        // The registration reference becomes the zaak identificatie (#78).
        Assert.Equal("reg-77", req.Identificatie);
@@ -109,24 +75,32 @@ public class AclServiceTests
    public async Task Rejects_a_null_registration_without_calling_the_gateway()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = new AclDefaults
+        {
+            Bronorganisatie = "517439943",
+            VerantwoordelijkeOrganisatie = "517439943",
+            Vertrouwelijkheidaanduiding = "openbaar",
+            ZaaktypeUrl = new("http://openzaak/catalogi/api/v1/zaaktypen/big"),
+        };
+        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));

        await Assert.ThrowsAsync<ArgumentNullException>(() => service.OpenZaakAsync(null!));
        Assert.Null(gateway.Captured);
    }

    [Fact]
-    public async Task Approving_a_zaak_sets_it_to_its_resolved_zaaktypes_eindstatus_dated_today()
+    public async Task Approving_a_zaak_sets_it_to_its_zaaktypes_eindstatus_dated_today()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var defaults = Defaults();
+        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");

        await service.ApproveZaakAsync(zaak);

        Assert.NotNull(gateway.Approved);
        Assert.Equal(zaak, gateway.Approved!.Value.Zaak);
-        Assert.Equal(gateway.ResolvedZaaktype, gateway.Approved.Value.Zaaktype);
+        Assert.Equal(defaults.ZaaktypeUrl, gateway.Approved.Value.Zaaktype);
        Assert.Equal(new DateOnly(2026, 6, 4), gateway.Approved.Value.Datum);
    }

@@ -134,80 +108,17 @@ public class AclServiceTests
    public async Task Approving_a_null_zaak_is_rejected_without_touching_the_gateway()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));

        await Assert.ThrowsAsync<ArgumentNullException>(() => service.ApproveZaakAsync(null!));
        Assert.Null(gateway.Approved);
    }

-    [Fact]
-    public async Task Cancelling_a_zaak_sets_it_to_the_cancellation_status_dated_today()
-    {
-        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
-        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
-
-        await service.CancelZaakAsync(zaak);
-
-        Assert.NotNull(gateway.Cancelled);
-        Assert.Equal(zaak, gateway.Cancelled!.Value.Zaak);
-        Assert.Equal(gateway.ResolvedZaaktype, gateway.Cancelled.Value.Zaaktype);
-        Assert.Equal(new DateOnly(2026, 6, 4), gateway.Cancelled.Value.Datum);
-        // Cancellation must not touch the approval path.
-        Assert.Null(gateway.Approved);
-    }
-
-    [Fact]
-    public async Task Cancelling_a_null_zaak_is_rejected_without_touching_the_gateway()
-    {
-        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
-
-        await Assert.ThrowsAsync<ArgumentNullException>(() => service.CancelZaakAsync(null!));
-        Assert.Null(gateway.Cancelled);
-    }
-
-    [Fact]
-    public async Task Storing_a_diploma_default_fills_the_document_fields_and_uses_the_resolved_informatieobjecttype()
-    {
-        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
-        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
-
-        var url = await service.StoreDiplomaAsync(zaak, [1, 2, 3], "diploma.pdf", "application/pdf");
-
-        Assert.Equal(gateway.DocumentResult, url);
-        var req = gateway.StoredDocument!;
-        Assert.Equal(zaak, req.Zaak);
-        // The informatieobjecttype is resolved from the configured omschrijving (S-27).
-        Assert.Equal("Diploma", gateway.ResolvedByOmschrijving);
-        Assert.Equal(gateway.ResolvedInformatieobjecttype, req.Informatieobjecttype);
-        Assert.Equal("517439943", req.Bronorganisatie);
-        Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
-        Assert.Equal(new DateOnly(2026, 6, 4), req.Creatiedatum);
-        Assert.Equal("nld", req.Taal);
-        Assert.Equal("diploma.pdf", req.Bestandsnaam);
-        Assert.Equal("application/pdf", req.Formaat);
-        Assert.Equal(new byte[] { 1, 2, 3 }, req.Inhoud);
-    }
-
-    [Fact]
-    public async Task Storing_a_diploma_rejects_null_or_blank_arguments()
-    {
-        var service = ServiceWith(new FakeGateway(), Defaults(), new DateOnly(2026, 6, 4));
-        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
-
-        await Assert.ThrowsAsync<ArgumentNullException>(() => service.StoreDiplomaAsync(null!, [1], "d.pdf", "application/pdf"));
-        await Assert.ThrowsAsync<ArgumentNullException>(() => service.StoreDiplomaAsync(zaak, null!, "d.pdf", "application/pdf"));
-        await Assert.ThrowsAnyAsync<ArgumentException>(() => service.StoreDiplomaAsync(zaak, [1], " ", "application/pdf"));
-        await Assert.ThrowsAnyAsync<ArgumentException>(() => service.StoreDiplomaAsync(zaak, [1], "d.pdf", " "));
-    }
-
    [Fact]
    public async Task Reading_a_zaak_reference_returns_the_zaaks_identificatie()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");

        var reference = await service.GetZaakReferenceAsync(zaak);
@@ -220,7 +131,7 @@ public class AclServiceTests
    public async Task Reading_a_null_zaak_reference_is_rejected()
    {
        var gateway = new FakeGateway();
-        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));

        await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetZaakReferenceAsync(null!));
        Assert.Null(gateway.ReadReferenceFor);
@@ -173,8 +173,7 @@ public class OpenZaakGatewayTests
    private sealed class OzRoutes
    {
        public string StatustypenJson { get; init; } = StatustypenPage(withEindstatusFlag: true);
-        public string ResultaattypenJson { get; init; } =
-            """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1","omschrijving":"Geregistreerd"}]}""";
+        public string ResultaattypenJson { get; init; } = """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1"}]}""";
        public HttpStatusCode StatustypenStatus { get; init; } = HttpStatusCode.OK;
        public HttpStatusCode ResultaattypenStatus { get; init; } = HttpStatusCode.OK;
        public HttpStatusCode ResultaatPostStatus { get; init; } = HttpStatusCode.Created;
@@ -252,138 +251,6 @@ public class OpenZaakGatewayTests
        Assert.True(status.Length > 0);
    }

-    [Fact]
-    public async Task Approving_selects_the_geregistreerd_resultaat_by_name_when_several_exist()
-    {
-        // Once S-10c adds a second resultaattype (Vervallen), picking the first is ambiguous — the
-        // Zaken API does not guarantee order. Approval must resolve its resultaat by omschrijving.
-        var rec = new Recorder();
-        var twoResultaattypen = """
-            {"results":[
-              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"},
-              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"}
-            ]}
-            """;
-
-        await Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = twoResultaattypen }))
-            .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
-
-        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd\"",
-            rec.Sent("/resultaten").Body);
-    }
-
-    // --- SetZaakToCancellationStatusAsync (document-timeout cancellation / S-10c) ---
-
-    // A catalogus with the three statustypen S-10c seeds (Geannuleerd is non-terminal, below the
-    // Afgehandeld eindstatus) and both resultaattypen. Cancellation must resolve "Geannuleerd" and
-    // "Vervallen" by omschrijving, never the approval pair.
-    private const string CancellationStatustypenJson = """
-        {"results":[
-          {"url":"http://openzaak/catalogi/api/v1/statustypen/ontvangen","volgnummer":1,"omschrijving":"Ontvangen","isEindstatus":false},
-          {"url":"http://openzaak/catalogi/api/v1/statustypen/geannuleerd","volgnummer":2,"omschrijving":"Geannuleerd","isEindstatus":false},
-          {"url":"http://openzaak/catalogi/api/v1/statustypen/afgehandeld","volgnummer":3,"omschrijving":"Afgehandeld","isEindstatus":true}
-        ]}
-        """;
-
-    private const string CancellationResultaattypenJson = """
-        {"results":[
-          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"},
-          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"}
-        ]}
-        """;
-
-    [Fact]
-    public async Task Cancelling_records_the_vervallen_resultaat_then_the_geannuleerd_status_against_the_zaak()
-    {
-        var rec = new Recorder();
-
-        await Gateway(ApprovalStub(rec, new OzRoutes
-        {
-            StatustypenJson = CancellationStatustypenJson,
-            ResultaattypenJson = CancellationResultaattypenJson,
-        })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
-
-        // Resultaat precedes status (OpenZaak requires a resultaat before a closing/terminal status).
-        Assert.True(rec.IndexOf("/resultaten") < rec.IndexOf("/statussen"));
-
-        var resultaat = rec.Sent("/resultaten");
-        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", resultaat.Body);
-        // The cancellation resultaat (Vervallen) is chosen by name — not the approval one (Geregistreerd).
-        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/vervallen\"", resultaat.Body);
-
-        var status = rec.Sent("/statussen");
-        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", status.Body);
-        // The Geannuleerd statustype is chosen by name — not the Afgehandeld eindstatus (approval).
-        Assert.Contains("\"statustype\":\"http://openzaak/catalogi/api/v1/statustypen/geannuleerd\"", status.Body);
-        Assert.Contains("\"datumStatusGezet\":\"2026-06-04T00:00:00Z\"", status.Body);
-    }
-
-    [Fact]
-    public async Task Cancelling_throws_when_the_zaaktype_has_no_geannuleerd_statustype()
-    {
-        var rec = new Recorder();
-
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
-            Gateway(ApprovalStub(rec, new OzRoutes
-            {
-                // Only the approval statustypen — no "Geannuleerd".
-                StatustypenJson = StatustypenPage(withEindstatusFlag: true),
-                ResultaattypenJson = CancellationResultaattypenJson,
-            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
-
-        Assert.Contains("Geannuleerd", ex.Message);
-    }
-
-    [Fact]
-    public async Task Cancelling_rejects_a_null_zaak_without_calling_openzaak()
-    {
-        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
-        await Assert.ThrowsAsync<ArgumentNullException>(() =>
-            Gateway(handler).SetZaakToCancellationStatusAsync(null!, Zaaktype, new DateOnly(2026, 6, 4)));
-    }
-
-    [Fact]
-    public async Task Cancelling_rejects_a_null_zaaktype_without_calling_openzaak()
-    {
-        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
-        await Assert.ThrowsAsync<ArgumentNullException>(() =>
-            Gateway(handler).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), null!, new DateOnly(2026, 6, 4)));
-    }
-
-    [Fact]
-    public async Task Cancelling_surfaces_the_failure_when_recording_the_resultaat_is_rejected()
-    {
-        var rec = new Recorder();
-
-        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
-            Gateway(ApprovalStub(rec, new OzRoutes
-            {
-                StatustypenJson = CancellationStatustypenJson,
-                ResultaattypenJson = CancellationResultaattypenJson,
-                ResultaatPostStatus = HttpStatusCode.BadRequest,
-            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
-
-        Assert.Contains("cancellation resultaat", ex.Message);
-        // It fails on the resultaat, before it ever posts the status.
-        Assert.Equal(-1, rec.IndexOf("/statussen"));
-    }
-
-    [Fact]
-    public async Task Cancelling_surfaces_the_failure_when_recording_the_status_is_rejected()
-    {
-        var rec = new Recorder();
-
-        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
-            Gateway(ApprovalStub(rec, new OzRoutes
-            {
-                StatustypenJson = CancellationStatustypenJson,
-                ResultaattypenJson = CancellationResultaattypenJson,
-                StatusPostStatus = HttpStatusCode.BadRequest,
-            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
-
-        Assert.Contains("cancellation status", ex.Message);
-    }
-
    [Fact]
    public async Task Approving_falls_back_to_the_highest_volgnummer_when_no_eindstatus_is_flagged()
    {
@@ -458,7 +325,7 @@ public class OpenZaakGatewayTests
            Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = "{}" }))
                .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));

-        Assert.Contains("'Geregistreerd' resultaattype", ex.Message);
+        Assert.Contains("No resultaattypen found", ex.Message);
        // Resolved the eindstatus + queried resultaattypen, but posted nothing.
        Assert.Equal(-1, rec.IndexOf("/resultaten"));
        Assert.Equal(-1, rec.IndexOf("/statussen"));
@@ -565,263 +432,4 @@ public class OpenZaakGatewayTests
        b64 = (b64.Length % 4) switch { 2 => b64 + "==", 3 => b64 + "=", _ => b64 };
        return Encoding.UTF8.GetString(Convert.FromBase64String(b64));
    }
-
-    // --- StoreDocumentAsync (diploma upload / S-10b) ---
-
-    private static readonly Uri Informatieobjecttype =
-        new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
-
-    private static DocumentRequest SampleDocument(byte[]? inhoud = null) => new(
-        Bronorganisatie: "517439943",
-        Informatieobjecttype: Informatieobjecttype,
-        Vertrouwelijkheidaanduiding: "openbaar",
-        Zaak: new Uri(ZaakUrl),
-        Creatiedatum: new DateOnly(2026, 6, 4),
-        Titel: "Diploma",
-        Auteur: "zorgprofessional",
-        Taal: "nld",
-        Bestandsnaam: "diploma.pdf",
-        Formaat: "application/pdf",
-        Inhoud: inhoud ?? [1, 2, 3, 4]);
-
-    // Routes the two document calls: POST /enkelvoudiginformatieobjecten (documenten) then
-    // POST /zaakinformatieobjecten (zaken).
-    private static StubHandler DocumentStub(Recorder rec) => new(async req =>
-    {
-        rec.Requests.Add(req);
-        rec.ContentLengths.Add(req.Content?.Headers.ContentLength);
-        rec.Bodies.Add(req.Content is null ? null : await req.Content.ReadAsStringAsync());
-
-        return req.RequestUri!.ToString().Contains("/enkelvoudiginformatieobjecten")
-            ? Json(HttpStatusCode.Created, """{"url":"http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1"}""")
-            : Json(HttpStatusCode.Created, """{"url":"http://openzaak/zaken/api/v1/zaakinformatieobjecten/rel-1"}""");
-    });
-
-    [Fact]
-    public async Task Storing_a_document_creates_the_informatieobject_then_relates_it_to_the_zaak()
-    {
-        var rec = new Recorder();
-
-        var url = await Gateway(DocumentStub(rec)).StoreDocumentAsync(SampleDocument([10, 20, 30]));
-
-        Assert.Equal("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1", url.ToString());
-
-        // 1. Create the enkelvoudiginformatieobject in the Documenten API.
-        var create = rec.Sent("/enkelvoudiginformatieobjecten");
-        Assert.Equal(HttpMethod.Post, create.Request.Method);
-        Assert.Equal("http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten",
-            create.Request.RequestUri!.ToString());
-        Assert.Equal("Bearer", create.Request.Headers.Authorization!.Scheme);
-        Assert.Contains("\"bronorganisatie\":\"517439943\"", create.Body);
-        Assert.Contains("\"informatieobjecttype\":\"http://openzaak/catalogi/api/v1/informatieobjecttypen/dip\"", create.Body);
-        Assert.Contains("\"creatiedatum\":\"2026-06-04\"", create.Body);
-        Assert.Contains("\"titel\":\"Diploma\"", create.Body);
-        Assert.Contains("\"auteur\":\"zorgprofessional\"", create.Body);
-        Assert.Contains("\"taal\":\"nld\"", create.Body);
-        Assert.Contains("\"bestandsnaam\":\"diploma.pdf\"", create.Body);
-        Assert.Contains("\"formaat\":\"application/pdf\"", create.Body);
-        Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", create.Body);
-        Assert.Contains("\"status\":\"definitief\"", create.Body);
-        // indicatieGebruiksrecht must be set explicitly (false = no usage restrictions); left null,
-        // OpenZaak refuses to close the zaak this document is related to ("indicatiegebruiksrecht-unset").
-        Assert.Contains("\"indicatieGebruiksrecht\":false", create.Body);
-        // The file content is base64-encoded into `inhoud`, with its byte length in `bestandsomvang`.
-        Assert.Contains($"\"inhoud\":\"{Convert.ToBase64String([10, 20, 30])}\"", create.Body);
-        Assert.Contains("\"bestandsomvang\":3", create.Body);
-
-        // 2. Relate that informatieobject to the zaak (Zaken API — no CRS).
-        var relate = rec.Sent("/zaakinformatieobjecten");
-        Assert.Equal(HttpMethod.Post, relate.Request.Method);
-        Assert.Equal("http://openzaak/zaken/api/v1/zaakinformatieobjecten",
-            relate.Request.RequestUri!.ToString());
-        Assert.Contains($"\"zaak\":\"{ZaakUrl}\"", relate.Body);
-        Assert.Contains("\"informatieobject\":\"http://openzaak/documenten/api/v1/enkelvoudiginformatieobjecten/doc-1\"", relate.Body);
-    }
-
-    [Fact]
-    public async Task Storing_a_document_buffers_the_body_and_sends_no_crs_headers()
-    {
-        // uwsgi rejects a chunked body (Content-Length must be present); the Documenten API is not a
-        // geo API, so no CRS headers (unlike the Zaken zaak-create).
-        var rec = new Recorder();
-
-        await Gateway(DocumentStub(rec)).StoreDocumentAsync(SampleDocument());
-
-        var create = rec.Sent("/enkelvoudiginformatieobjecten");
-        Assert.NotNull(create.Length);
-        Assert.True(create.Length > 0);
-        Assert.False(create.Request.Headers.Contains("Accept-Crs"));
-        Assert.False(create.Request.Content!.Headers.Contains("Content-Crs"));
-    }
-
-    [Fact]
-    public async Task Storing_a_document_surfaces_an_openzaak_rejection()
-    {
-        var handler = new StubHandler(_ =>
-            Task.FromResult(new HttpResponseMessage(HttpStatusCode.BadRequest)
-            {
-                Content = new StringContent("""{"detail":"bad"}""", Encoding.UTF8, "application/json"),
-            }));
-
-        var ex = await Assert.ThrowsAsync<HttpRequestException>(
-            () => Gateway(handler).StoreDocumentAsync(SampleDocument()));
-        Assert.Contains("bad", ex.Message);
-    }
-
-    [Fact]
-    public async Task Storing_a_document_rejects_a_null_request()
-    {
-        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
-
-        await Assert.ThrowsAsync<ArgumentNullException>(() => Gateway(handler).StoreDocumentAsync(null!));
-    }
-
-    // ── Catalogi resolution by business key (S-27) ────────────────────────────────────────────────
-
-    [Fact]
-    public async Task Resolves_the_published_zaaktype_url_by_identificatie()
-    {
-        HttpRequestMessage? seen = null;
-        var handler = new StubHandler(req =>
-        {
-            seen = req;
-            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-            {
-                Content = JsonContent.Create(new
-                {
-                    results = new[] { new { url = "http://openzaak/catalogi/api/v1/zaaktypen/big", identificatie = "BIG-REGISTRATIE" } },
-                }),
-            });
-        });
-
-        var url = await Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE");
-
-        Assert.Equal("http://openzaak/catalogi/api/v1/zaaktypen/big", url.ToString());
-        Assert.Equal(HttpMethod.Get, seen!.Method);
-        // Filters to the published zaaktype with that identificatie, and authenticates.
-        Assert.Contains("/catalogi/api/v1/zaaktypen", seen.RequestUri!.ToString());
-        Assert.Contains("status=definitief", seen.RequestUri!.Query);
-        Assert.Contains("identificatie=BIG-REGISTRATIE", seen.RequestUri!.Query);
-        Assert.Equal("Bearer", seen.Headers.Authorization!.Scheme);
-    }
-
-    [Fact]
-    public async Task Resolving_a_zaaktype_throws_a_clear_error_when_none_is_published()
-    {
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-        {
-            Content = JsonContent.Create(new { results = Array.Empty<object>() }),
-        }));
-
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
-        Assert.Contains("BIG-REGISTRATIE", ex.Message);
-    }
-
-    [Fact]
-    public async Task Resolves_the_informatieobjecttype_url_by_omschrijving()
-    {
-        HttpRequestMessage? seen = null;
-        var handler = new StubHandler(req =>
-        {
-            seen = req;
-            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-            {
-                Content = JsonContent.Create(new
-                {
-                    results = new[]
-                    {
-                        new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/other", omschrijving = "Overig" },
-                        new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/dip", omschrijving = "Diploma" },
-                    },
-                }),
-            });
-        });
-
-        var url = await Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma");
-
-        // Queries the published informatieobjecttypen collection, and matches on omschrijving (not position).
-        Assert.Contains("/catalogi/api/v1/informatieobjecttypen", seen!.RequestUri!.ToString());
-        Assert.Contains("status=definitief", seen.RequestUri!.Query);
-        Assert.Equal("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip", url.ToString());
-    }
-
-    [Fact]
-    public async Task Resolving_a_zaaktype_throws_when_the_response_carries_no_results()
-    {
-        // No "results" property → the page's Results is null; the gateway must treat that as "none
-        // found" (not dereference null).
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-        {
-            Content = JsonContent.Create(new { count = 0 }),
-        }));
-
-        await Assert.ThrowsAsync<InvalidOperationException>(
-            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
-    }
-
-    [Fact]
-    public async Task Resolving_an_informatieobjecttype_throws_when_the_response_carries_no_results()
-    {
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-        {
-            Content = JsonContent.Create(new { count = 0 }),
-        }));
-
-        await Assert.ThrowsAsync<InvalidOperationException>(
-            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
-    }
-
-    [Fact]
-    public async Task Resolving_a_zaaktype_surfaces_a_non_success_catalogi_response()
-    {
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.InternalServerError)
-        {
-            Content = new StringContent("boom"),
-        }));
-
-        var ex = await Assert.ThrowsAsync<HttpRequestException>(
-            () => Gateway(handler).ResolveZaaktypeUrlAsync("BIG-REGISTRATIE"));
-        // The error names the resource being queried and includes OpenZaak's body.
-        Assert.Contains("zaaktypen", ex.Message);
-        Assert.Contains("boom", ex.Message);
-    }
-
-    [Fact]
-    public async Task Resolving_an_informatieobjecttype_surfaces_a_non_success_catalogi_response()
-    {
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.InternalServerError)
-        {
-            Content = new StringContent("boom"),
-        }));
-
-        var ex = await Assert.ThrowsAsync<HttpRequestException>(
-            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
-        Assert.Contains("informatieobjecttypen", ex.Message);
-    }
-
-    [Fact]
-    public async Task Resolving_an_informatieobjecttype_throws_when_no_omschrijving_matches()
-    {
-        var handler = new StubHandler(_ => Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-        {
-            Content = JsonContent.Create(new
-            {
-                results = new[] { new { url = "http://openzaak/catalogi/api/v1/informatieobjecttypen/other", omschrijving = "Overig" } },
-            }),
-        }));
-
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => Gateway(handler).ResolveInformatieobjecttypeUrlAsync("Diploma"));
-        Assert.Contains("Diploma", ex.Message);
-    }
-
-    [Fact]
-    public async Task Resolving_rejects_a_blank_business_key_without_calling_openzaak()
-    {
-        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
-
-        await Assert.ThrowsAnyAsync<ArgumentException>(() => Gateway(handler).ResolveZaaktypeUrlAsync(" "));
-        await Assert.ThrowsAnyAsync<ArgumentException>(() => Gateway(handler).ResolveInformatieobjecttypeUrlAsync(" "));
-    }
 }
@@ -1,92 +0,0 @@
-using Acl.Application;
-
-namespace Acl.Tests;
-
-public class ZaaktypeCatalogTests
-{
-    // A gateway that only supports resolution; the other members are unused here.
-    private sealed class ResolvingGateway : IZaakGateway
-    {
-        public int ZaaktypeCalls;
-        public int InformatieobjecttypeCalls;
-        public string? LastIdentificatie;
-        public string? LastOmschrijving;
-        public int ThrowZaaktypeTimes;
-        public Uri ZaaktypeUrl { get; } = new("http://openzaak/catalogi/api/v1/zaaktypen/big");
-        public Uri InformatieobjecttypeUrl { get; } = new("http://openzaak/catalogi/api/v1/informatieobjecttypen/dip");
-
-        public Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
-        {
-            ZaaktypeCalls++;
-            LastIdentificatie = identificatie;
-            if (ZaaktypeCalls <= ThrowZaaktypeTimes)
-                throw new InvalidOperationException("no published zaaktype yet");
-            return Task.FromResult(ZaaktypeUrl);
-        }
-
-        public Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
-        {
-            InformatieobjecttypeCalls++;
-            LastOmschrijving = omschrijving;
-            return Task.FromResult(InformatieobjecttypeUrl);
-        }
-
-        public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default) => throw new NotSupportedException();
-        public Task SetZaakToEindstatusAsync(Uri z, Uri zt, DateOnly d, CancellationToken ct = default) => throw new NotSupportedException();
-        public Task SetZaakToCancellationStatusAsync(Uri z, Uri zt, DateOnly d, CancellationToken ct = default) => throw new NotSupportedException();
-        public Task<string> GetZaakIdentificatieAsync(Uri z, CancellationToken ct = default) => throw new NotSupportedException();
-        public Task<Uri> StoreDocumentAsync(DocumentRequest r, CancellationToken ct = default) => throw new NotSupportedException();
-    }
-
-    private static AclDefaults Defaults() => new()
-    {
-        Bronorganisatie = "517439943",
-        VerantwoordelijkeOrganisatie = "517439943",
-        Vertrouwelijkheidaanduiding = "openbaar",
-        ZaaktypeIdentificatie = "BIG-REGISTRATIE",
-        InformatieobjecttypeOmschrijving = "Diploma",
-    };
-
-    [Fact]
-    public async Task Resolves_the_zaaktype_and_informatieobjecttype_by_their_configured_business_keys()
-    {
-        var gateway = new ResolvingGateway();
-        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
-
-        Assert.Equal(gateway.ZaaktypeUrl, await catalog.GetZaaktypeUrlAsync());
-        Assert.Equal(gateway.InformatieobjecttypeUrl, await catalog.GetInformatieobjecttypeUrlAsync());
-        Assert.Equal("BIG-REGISTRATIE", gateway.LastIdentificatie);
-        Assert.Equal("Diploma", gateway.LastOmschrijving);
-    }
-
-    [Fact]
-    public async Task Caches_the_resolved_urls_so_the_gateway_is_hit_once()
-    {
-        var gateway = new ResolvingGateway();
-        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
-
-        for (var i = 0; i < 3; i++)
-        {
-            await catalog.GetZaaktypeUrlAsync();
-            await catalog.GetInformatieobjecttypeUrlAsync();
-        }
-
-        Assert.Equal(1, gateway.ZaaktypeCalls);
-        Assert.Equal(1, gateway.InformatieobjecttypeCalls);
-    }
-
-    [Fact]
-    public async Task Does_not_cache_a_failed_resolution_so_it_is_retried()
-    {
-        // The zaaktype is not published yet on the first call; the catalog must retry (not cache the
-        // failure) so a later call succeeds once it is published.
-        var gateway = new ResolvingGateway { ThrowZaaktypeTimes = 1 };
-        var catalog = new CachedZaaktypeCatalog(gateway, Defaults());
-
-        await Assert.ThrowsAsync<InvalidOperationException>(() => catalog.GetZaaktypeUrlAsync());
-        var url = await catalog.GetZaaktypeUrlAsync();
-
-        Assert.Equal(gateway.ZaaktypeUrl, url);
-        Assert.Equal(2, gateway.ZaaktypeCalls);
-    }
-}
@@ -13,31 +13,10 @@ public sealed record ProjectionEntry(string Id, string Status, string? Reference
 /// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
 public sealed record OpenbaarEntry(string Id, string Status, string? Reference);

-/// <summary>A behandelaar's werkbak row: a registration awaiting beoordeling, with the bsn + status a
-/// behandelaar sees (staff view — reached only behind medewerker/behandelaar authorization, S-12c).</summary>
-public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
-
 /// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
 public interface IDomainClient
 {
    Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
-
-    /// <summary>Withdraw the caller's own registration ("trek aanvraag in"). Owner-scoped by
-    /// <paramref name="bsn"/>. Returns <c>false</c> when the domain reports the registration is
-    /// unknown or not the caller's (404), so the BFF can relay a 404 rather than a 500.</summary>
-    Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default);
-
-    /// <summary>Provide (upload) the diploma the caller's own registration is waiting for ("documenten
-    /// aanleveren"). The file is carried base64-encoded. Owner-scoped by <paramref name="bsn"/>. Returns
-    /// <c>false</c> when the domain reports the registration is unknown or not the caller's (404).</summary>
-    Task<bool> ProvideDocumentsAsync(
-        string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default);
-
-    /// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
-    Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
-
-    /// <summary>Apply a behandelaar's decision (<c>goedkeuren</c>/<c>afwijzen</c>) to a registration.</summary>
-    Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default);
 }

 /// <summary>Port to the read projection.</summary>
@@ -58,40 +37,6 @@ public sealed class DomainClient(HttpClient http) : IDomainClient
        return new SubmitAccepted(dto.RegistrationId, dto.Status);
    }

-    public async Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
-    {
-        using var response = await http.PostAsJsonAsync(
-            $"registrations/{registrationId}/withdraw", new { bsn }, ct);
-        // The domain 404s an unknown or not-owned registration; relay that rather than fail hard.
-        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
-            return false;
-        response.EnsureSuccessStatusCode();
-        return true;
-    }
-
-    public async Task<bool> ProvideDocumentsAsync(
-        string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default)
-    {
-        using var response = await http.PostAsJsonAsync(
-            $"registrations/{registrationId}/documents",
-            new { bsn, contentBase64, fileName, contentType }, ct);
-        // The domain 404s an unknown or not-owned registration; relay that rather than fail hard.
-        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
-            return false;
-        response.EnsureSuccessStatusCode();
-        return true;
-    }
-
-    public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
-        => await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
-
-    public async Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
-    {
-        using var response = await http.PostAsJsonAsync(
-            $"registrations/{registrationId}/decide", new { besluit }, ct);
-        response.EnsureSuccessStatusCode();
-    }
-
    private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
 }

@@ -1,6 +1,4 @@
 using System.Security.Claims;
-using System.Text.Json;
-using System.Text.Json.Serialization;
 using Bff.Api;
 using Microsoft.AspNetCore.Authentication.JwtBearer;

@@ -8,10 +6,6 @@ var builder = WebApplication.CreateBuilder(args);

 var keycloakAuthority = builder.Configuration["Keycloak:Authority"]
    ?? throw new InvalidOperationException("Missing configuration 'Keycloak:Authority'");
-// Behandelaars authenticate against a *different* Keycloak realm (medewerker) than citizens (digid),
-// so the BFF validates a second issuer for the behandel endpoints (ADR-0013).
-var medewerkerAuthority = builder.Configuration["Keycloak:MedewerkerAuthority"]
-    ?? throw new InvalidOperationException("Missing configuration 'Keycloak:MedewerkerAuthority'");
 var domainBaseUrl = builder.Configuration["Downstream:Domain:BaseUrl"]
    ?? throw new InvalidOperationException("Missing configuration 'Downstream:Domain:BaseUrl'");
 var projectionBaseUrl = builder.Configuration["Downstream:Projection:BaseUrl"]
@@ -25,28 +19,8 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        options.Authority = keycloakAuthority;
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters.ValidateAudience = false;
-    })
-    // The medewerker realm — behandel endpoints only. On validation we lift Keycloak's realm roles
-    // (the nested realm_access.roles claim) into role claims so authorization policies can require them.
-    .AddJwtBearer(BehandelAuth.Scheme, options =>
-    {
-        options.Authority = medewerkerAuthority;
-        options.RequireHttpsMetadata = false;
-        options.TokenValidationParameters.ValidateAudience = false;
-        options.Events = new JwtBearerEvents
-        {
-            OnTokenValidated = context =>
-            {
-                BehandelAuth.AddRealmRoles(context.Principal);
-                return Task.CompletedTask;
-            },
-        };
    });
-builder.Services.AddAuthorization(options =>
-    options.AddPolicy(BehandelAuth.Policy, policy => policy
-        .AddAuthenticationSchemes(BehandelAuth.Scheme)
-        .RequireAuthenticatedUser()
-        .RequireRole(BehandelAuth.BehandelaarRole)));
+builder.Services.AddAuthorization();

 // The BFF is the portals' only backend; it fans out to the domain and projection (§8.3).
 builder.Services.AddHttpClient<IDomainClient, DomainClient>(c => c.BaseAddress = new Uri(domainBaseUrl));
@@ -86,46 +60,6 @@ app.MapPost("/self-service/registrations", async (ClaimsPrincipal user, IDomainC
    .Produces(StatusCodes.Status400BadRequest)
    .Produces(StatusCodes.Status401Unauthorized);

-// Self-service withdrawal (S-11): the signed-in zorgprofessional withdraws their own registration.
-// The bsn comes from the DigiD token and is forwarded to the domain, which owner-scopes the action;
-// a registration that is unknown or not the caller's comes back 404 (ownership is not revealed).
-app.MapPost("/self-service/registrations/{id}/withdraw", async (string id, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
-{
-    var bsn = user.FindFirstValue("bsn");
-    if (string.IsNullOrWhiteSpace(bsn))
-        return Results.BadRequest("The token carries no bsn claim.");
-
-    var withdrawn = await domain.WithdrawRegistrationAsync(id, bsn, ct);
-    return withdrawn ? Results.NoContent() : Results.NotFound();
-})
-    .RequireAuthorization()
-    .Produces(StatusCodes.Status204NoContent)
-    .Produces(StatusCodes.Status400BadRequest)
-    .Produces(StatusCodes.Status401Unauthorized)
-    .Produces(StatusCodes.Status404NotFound);
-
-// Self-service provide-documents (S-10a): the signed-in zorgprofessional supplies the documents their
-// registration is waiting for ("documenten aanleveren"). The bsn comes from the DigiD token and is
-// forwarded to the domain, which owner-scopes the action and completes the WachtOpDocumenten task; a
-// registration that is unknown or not the caller's comes back 404. The real file upload + ZGW storage
-// is S-10b — this is the trigger that unblocks the process.
-app.MapPost("/self-service/registrations/{id}/documents", async (string id, ProvideDocumentsRequest body, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
-{
-    var bsn = user.FindFirstValue("bsn");
-    if (string.IsNullOrWhiteSpace(bsn))
-        return Results.BadRequest("The token carries no bsn claim.");
-    if (string.IsNullOrWhiteSpace(body?.ContentBase64))
-        return Results.BadRequest("A document is required.");
-
-    var provided = await domain.ProvideDocumentsAsync(id, bsn, body.ContentBase64, body.FileName, body.ContentType, ct);
-    return provided ? Results.NoContent() : Results.NotFound();
-})
-    .RequireAuthorization()
-    .Produces(StatusCodes.Status204NoContent)
-    .Produces(StatusCodes.Status400BadRequest)
-    .Produces(StatusCodes.Status401Unauthorized)
-    .Produces(StatusCodes.Status404NotFound);
-
 // Openbaar register: an anonymous public lookup that exposes only public-safe fields (S-09).
 app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection, CancellationToken ct) =>
 {
@@ -134,83 +68,7 @@ app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection,
 })
    .Produces<IReadOnlyList<OpenbaarEntry>>(StatusCodes.Status200OK);

-// Behandelaar's werkbak: registrations awaiting beoordeling. Reached only with a medewerker-realm
-// token carrying the behandelaar role; the BFF proxies the domain's werkbak (staff view, ADR-0013).
-app.MapGet("/behandel/werkbak", async (IDomainClient domain, CancellationToken ct) =>
-    Results.Ok(await domain.GetWerkbakAsync(ct)))
-    .RequireAuthorization(BehandelAuth.Policy)
-    .Produces<IReadOnlyList<WerkbakItem>>(StatusCodes.Status200OK)
-    .Produces(StatusCodes.Status401Unauthorized)
-    .Produces(StatusCodes.Status403Forbidden);
-
-// A behandelaar's beoordeling on a registration (goedkeuren/afwijzen). Forwarded to the domain, which
-// applies the decision and completes the workflow task (ADR-0013). Same medewerker/behandelaar gate.
-app.MapPost("/behandel/registrations/{id}/decide",
-    async (string id, DecideRequest body, IDomainClient domain, CancellationToken ct) =>
-    {
-        if (!BehandelAuth.IsKnownBesluit(body.Besluit))
-            return Results.BadRequest(new { error = $"Unknown besluit '{body.Besluit}'. Expected 'goedkeuren' or 'afwijzen'." });
-
-        await domain.DecideAsync(id, body.Besluit, ct);
-        return Results.NoContent();
-    })
-    .RequireAuthorization(BehandelAuth.Policy)
-    .Produces(StatusCodes.Status204NoContent)
-    .Produces(StatusCodes.Status400BadRequest)
-    .Produces(StatusCodes.Status401Unauthorized)
-    .Produces(StatusCodes.Status403Forbidden);
-
 app.Run();

-/// <summary>The behandelaar's decision on a registration.</summary>
-public sealed record DecideRequest(string Besluit);
-
-/// <summary>A diploma upload from the self-service portal — the file base64-encoded client-side, with
-/// its name and MIME type. The bsn is taken from the DigiD token, not this body.</summary>
-public sealed record ProvideDocumentsRequest(string ContentBase64, string? FileName = null, string? ContentType = null);
-
-// Behandel (medewerker-realm) authentication + authorization wiring (ADR-0013).
-internal static class BehandelAuth
-{
-    public const string Scheme = "medewerker";
-    public const string Policy = "behandelaar";
-    public const string BehandelaarRole = "behandelaar";
-
-    /// <summary>The beoordeling vocabulary the BFF accepts (case-insensitive); an unknown besluit is a
-    /// 400 without troubling the domain. Mirrors the domain's <c>BeoordelingsBesluit</c>.</summary>
-    public static bool IsKnownBesluit(string? besluit) =>
-        string.Equals(besluit, "goedkeuren", StringComparison.OrdinalIgnoreCase) ||
-        string.Equals(besluit, "afwijzen", StringComparison.OrdinalIgnoreCase);
-
-    /// <summary>Lift Keycloak's realm roles (the nested <c>realm_access.roles</c> claim) onto the
-    /// principal as role claims, so <c>RequireRole</c> can authorize on them.</summary>
-    public static void AddRealmRoles(ClaimsPrincipal? principal)
-    {
-        if (principal?.Identity is not ClaimsIdentity identity)
-            return;
-
-        var realmAccess = principal.FindFirst("realm_access")?.Value;
-        if (string.IsNullOrWhiteSpace(realmAccess))
-            return;
-
-        // A malformed realm_access claim must not fail authentication (a throw here becomes a 401);
-        // it simply yields no roles, so the authorization policy answers 403.
-        string[] roles;
-        try
-        {
-            roles = JsonSerializer.Deserialize<RealmAccess>(realmAccess)?.Roles ?? [];
-        }
-        catch (JsonException)
-        {
-            return;
-        }
-
-        foreach (var role in roles)
-            identity.AddClaim(new Claim(identity.RoleClaimType, role));
-    }
-
-    private sealed record RealmAccess([property: JsonPropertyName("roles")] string[] Roles);
-}
-
 // Exposed so the test host (WebApplicationFactory<Program>) can boot the app.
 public partial class Program;
@@ -7,8 +7,7 @@
  },
  "AllowedHosts": "*",
  "Keycloak": {
-    "Authority": "http://localhost:8180/realms/digid",
-    "MedewerkerAuthority": "http://localhost:8180/realms/medewerker"
+    "Authority": "http://localhost:8180/realms/digid"
  },
  "Downstream": {
    "Domain": { "BaseUrl": "http://localhost:8130/" },
@@ -1,114 +0,0 @@
-using System.Net;
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
-using Bff.Api;
-
-namespace Bff.Tests;
-
-/// <summary>
-/// The behandel werkbak endpoint (S-12c): reached only with a medewerker-realm token that carries the
-/// <c>behandelaar</c> role. A missing token is 401; an authenticated medewerker without the role is
-/// 403; a behandelaar gets the werkbak (staff view, incl. bsn).
-/// </summary>
-public class BehandelEndpointTests
-{
-    private static HttpRequestMessage Werkbak(string? bearer)
-    {
-        var request = new HttpRequestMessage(HttpMethod.Get, "/behandel/werkbak");
-        if (bearer is not null)
-            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
-        return request;
-    }
-
-    [Fact]
-    public async Task Rejects_the_werkbak_without_a_token()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Werkbak(bearer: null));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
-    }
-
-    [Fact]
-    public async Task Rejects_a_medewerker_without_the_behandelaar_role()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("teamlead")));
-
-        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
-    }
-
-    [Fact]
-    public async Task Serves_the_werkbak_to_a_behandelaar()
-    {
-        using var factory = new BffFactory();
-        factory.Domain.Werkbak.Add(new WerkbakItem("reg-1", "123456782", "InBehandeling"));
-
-        var response = await factory.CreateClient().SendAsync(Werkbak(TestTokens.Medewerker("behandelaar")));
-
-        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
-        var items = await response.Content.ReadFromJsonAsync<List<WerkbakItem>>();
-        var item = Assert.Single(items!);
-        Assert.Equal("reg-1", item.RegistrationId);
-        Assert.Equal("123456782", item.Bsn);
-    }
-
-    private static HttpRequestMessage Decide(string? bearer, string id = "reg-1", string besluit = "goedkeuren")
-    {
-        var request = new HttpRequestMessage(HttpMethod.Post, $"/behandel/registrations/{id}/decide")
-        {
-            Content = JsonContent.Create(new { besluit }),
-        };
-        if (bearer is not null)
-            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
-        return request;
-    }
-
-    [Fact]
-    public async Task Rejects_a_decision_without_a_token()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Decide(bearer: null));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
-        Assert.Null(factory.Domain.Decided);
-    }
-
-    [Fact]
-    public async Task Rejects_a_decision_from_a_medewerker_without_the_behandelaar_role()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Decide(TestTokens.Medewerker("teamlead")));
-
-        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
-        Assert.Null(factory.Domain.Decided);
-    }
-
-    [Fact]
-    public async Task Forwards_a_behandelaar_decision_to_the_domain()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient()
-            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), id: "reg-42", besluit: "afwijzen"));
-
-        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
-        Assert.Equal(("reg-42", "afwijzen"), factory.Domain.Decided);
-    }
-
-    [Fact]
-    public async Task Rejects_an_unknown_besluit_without_calling_the_domain()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient()
-            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), besluit: "misschien"));
-
-        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
-        Assert.Null(factory.Domain.Decided);
-    }
-}
@@ -5,7 +5,6 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;

@@ -24,34 +23,9 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
    public FakeDomainClient Domain { get; } = new();
    public FakeProjectionClient Projection { get; } = new();

-    private static void ValidateWithTestKey(IServiceCollection services, string scheme) =>
-        services.Configure<JwtBearerOptions>(scheme, options =>
-        {
-            // Validate locally against the test key and NEVER reach out for OIDC metadata. A static
-            // configuration manager guarantees this regardless of Configure/PostConfigure ordering —
-            // clearing Authority alone left the medewerker scheme fetching metadata under CI timing
-            // (2s hang → 401), because JwtBearer's PostConfigure could still build a ConfigurationManager.
-            options.Authority = null;
-            options.MetadataAddress = null!;
-            options.RequireHttpsMetadata = false;
-            options.Configuration = new OpenIdConnectConfiguration();
-            options.ConfigurationManager =
-                new StaticConfigurationManager<OpenIdConnectConfiguration>(new OpenIdConnectConfiguration());
-            options.TokenValidationParameters = new TokenValidationParameters
-            {
-                ValidateIssuer = false,
-                ValidateAudience = false,
-                ValidateLifetime = true,
-                ValidateIssuerSigningKey = true,
-                IssuerSigningKey = TestSigningKey,
-                ClockSkew = TimeSpan.Zero,
-            };
-        });
-
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
-        builder.UseSetting("Keycloak:MedewerkerAuthority", "https://keycloak.invalid/realms/medewerker");
        builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
        builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");

@@ -60,11 +34,23 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
            services.AddSingleton<IDomainClient>(Domain);
            services.AddSingleton<IProjectionClient>(Projection);

-            // Both realms validate locally against the test key (no live Keycloak). The medewerker
-            // scheme keeps its OnTokenValidated role-lifting from Program.cs — only the validation
-            // parameters are swapped here.
-            ValidateWithTestKey(services, JwtBearerDefaults.AuthenticationScheme);
-            ValidateWithTestKey(services, "medewerker");
+            services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
+            {
+                // Validate locally against the test key; never reach out for OIDC metadata.
+                options.Authority = null;
+                options.MetadataAddress = null!;
+                options.RequireHttpsMetadata = false;
+                options.Configuration = new OpenIdConnectConfiguration();
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = false,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = TestSigningKey,
+                    ClockSkew = TimeSpan.Zero,
+                };
+            });
        });
    }
 }
@@ -74,48 +60,12 @@ internal sealed class FakeDomainClient : IDomainClient
 {
    public string? SubmittedBsn { get; private set; }
    public SubmitAccepted Result { get; set; } = new("reg-123", "Ingediend");
-    public List<WerkbakItem> Werkbak { get; } = [];

    public Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
    {
        SubmittedBsn = bsn;
        return Task.FromResult(Result);
    }
-
-    public (string RegistrationId, string Bsn)? Withdrawn { get; private set; }
-
-    /// <summary>Whether the fake domain reports the withdrawal as done (true → 204) or not-found/not-owned
-    /// (false → 404). Tests set this to exercise the relay.</summary>
-    public bool WithdrawSucceeds { get; set; } = true;
-
-    public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
-    {
-        Withdrawn = (registrationId, bsn);
-        return Task.FromResult(WithdrawSucceeds);
-    }
-
-    public (string RegistrationId, string Bsn, string ContentBase64, string? FileName, string? ContentType)? DocumentsProvidedFor { get; private set; }
-
-    /// <summary>Whether the fake domain reports the provide-documents as done (true → 204) or
-    /// not-found/not-owned (false → 404). Tests set this to exercise the relay.</summary>
-    public bool ProvideDocumentsSucceeds { get; set; } = true;
-
-    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default)
-    {
-        DocumentsProvidedFor = (registrationId, bsn, contentBase64, fileName, contentType);
-        return Task.FromResult(ProvideDocumentsSucceeds);
-    }
-
-    public (string RegistrationId, string Besluit)? Decided { get; private set; }
-
-    public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
-        => Task.FromResult<IReadOnlyList<WerkbakItem>>(Werkbak);
-
-    public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
-    {
-        Decided = (registrationId, besluit);
-        return Task.CompletedTask;
-    }
 }

 /// <summary>Serves a configurable set of projection rows.</summary>
@@ -71,102 +71,5 @@ public class SelfServiceEndpointTests
        Assert.Equal("reg-123", body!.RegistrationId);
    }

-    private static HttpRequestMessage Withdraw(string? bearer, string id = "reg-123")
-    {
-        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/withdraw");
-        if (bearer is not null)
-            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
-        return request;
-    }
-
-    [Fact]
-    public async Task Rejects_a_withdrawal_without_a_token()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(bearer: null));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
-        Assert.Null(factory.Domain.Withdrawn);
-    }
-
-    [Fact]
-    public async Task Withdraws_the_callers_registration_forwarding_the_id_and_bsn()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782"), "reg-9"));
-
-        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
-        Assert.Equal(("reg-9", "123456782"), factory.Domain.Withdrawn);
-    }
-
-    [Fact]
-    public async Task Relays_not_found_when_the_registration_is_unknown_or_not_the_callers()
-    {
-        using var factory = new BffFactory();
-        factory.Domain.WithdrawSucceeds = false;
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782")));
-
-        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
-    }
-
-    private static HttpRequestMessage ProvideDocuments(string? bearer, string id = "reg-123")
-    {
-        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/documents")
-        {
-            // The portal base64-encodes the file client-side and posts it as JSON (S-10b); the bsn is
-            // never in the body — it comes from the DigiD token.
-            Content = JsonContent.Create(new
-            {
-                contentBase64 = Convert.ToBase64String([1, 2, 3]),
-                fileName = "diploma.pdf",
-                contentType = "application/pdf",
-            }),
-        };
-        if (bearer is not null)
-            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
-        return request;
-    }
-
-    [Fact]
-    public async Task Rejects_providing_documents_without_a_token()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(ProvideDocuments(bearer: null));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
-        Assert.Null(factory.Domain.DocumentsProvidedFor);
-    }
-
-    [Fact]
-    public async Task Provides_documents_for_the_callers_registration_forwarding_id_bsn_and_file()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782"), "reg-9"));
-
-        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
-        var provided = factory.Domain.DocumentsProvidedFor;
-        Assert.NotNull(provided);
-        Assert.Equal("reg-9", provided!.Value.RegistrationId);
-        Assert.Equal("123456782", provided.Value.Bsn);
-        Assert.Equal(Convert.ToBase64String([1, 2, 3]), provided.Value.ContentBase64);
-        Assert.Equal("diploma.pdf", provided.Value.FileName);
-    }
-
-    [Fact]
-    public async Task Relays_not_found_providing_documents_for_an_unknown_or_not_owned_registration()
-    {
-        using var factory = new BffFactory();
-        factory.Domain.ProvideDocumentsSucceeds = false;
-
-        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782")));
-
-        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
-    }
-
    private sealed record SubmitAcceptedDto(string RegistrationId, string Status);
 }
@@ -17,22 +17,6 @@ internal static class TestTokens
        new SymmetricSecurityKey(Encoding.UTF8.GetBytes("a-different-signing-key-256-bits-long-indeed-yes!")),
        expired: false);

-    /// <summary>A medewerker-realm token carrying the given realm roles under <c>realm_access.roles</c>
-    /// (Keycloak's shape), signed with the valid test key. Used to exercise behandel authorization.</summary>
-    public static string Medewerker(params string[] roles)
-    {
-        var handler = new JsonWebTokenHandler();
-        return handler.CreateToken(new SecurityTokenDescriptor
-        {
-            Claims = new Dictionary<string, object>
-            {
-                ["realm_access"] = new Dictionary<string, object> { ["roles"] = roles },
-            },
-            Expires = DateTime.UtcNow.AddMinutes(30),
-            SigningCredentials = new SigningCredentials(BffFactory.TestSigningKey, SecurityAlgorithms.HmacSha256),
-        });
-    }
-
    private static string Create(string bsn, SymmetricSecurityKey key, bool expired)
    {
        var handler = new JsonWebTokenHandler();
@@ -30,78 +30,6 @@
        }
      }
    },
-    "/self-service/registrations/{id}/withdraw": {
-      "post": {
-        "tags": [
-          "Bff.Api"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "description": "Bad Request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Not Found"
-          }
-        }
-      }
-    },
-    "/self-service/registrations/{id}/documents": {
-      "post": {
-        "tags": [
-          "Bff.Api"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ProvideDocumentsRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "description": "Bad Request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Not Found"
-          }
-        }
-      }
-    },
    "/openbaar/register": {
      "get": {
        "tags": [
@@ -132,90 +60,10 @@
          }
        }
      }
-    },
-    "/behandel/werkbak": {
-      "get": {
-        "tags": [
-          "Bff.Api"
-        ],
-        "responses": {
-          "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/WerkbakItem"
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "403": {
-            "description": "Forbidden"
-          }
-        }
-      }
-    },
-    "/behandel/registrations/{id}/decide": {
-      "post": {
-        "tags": [
-          "Bff.Api"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/DecideRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "description": "Bad Request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "403": {
-            "description": "Forbidden"
-          }
-        }
-      }
    }
  },
  "components": {
    "schemas": {
-      "DecideRequest": {
-        "required": [
-          "besluit"
-        ],
-        "type": "object",
-        "properties": {
-          "besluit": {
-            "type": "string"
-          }
-        }
-      },
      "OpenbaarEntry": {
        "required": [
          "id",
@@ -238,29 +86,6 @@
          }
        }
      },
-      "ProvideDocumentsRequest": {
-        "required": [
-          "contentBase64"
-        ],
-        "type": "object",
-        "properties": {
-          "contentBase64": {
-            "type": "string"
-          },
-          "fileName": {
-            "type": [
-              "null",
-              "string"
-            ]
-          },
-          "contentType": {
-            "type": [
-              "null",
-              "string"
-            ]
-          }
-        }
-      },
      "SubmitAccepted": {
        "required": [
          "registrationId",
@@ -275,25 +100,6 @@
            "type": "string"
          }
        }
-      },
-      "WerkbakItem": {
-        "required": [
-          "registrationId",
-          "bsn",
-          "status"
-        ],
-        "type": "object",
-        "properties": {
-          "registrationId": {
-            "type": "string"
-          },
-          "bsn": {
-            "type": "string"
-          },
-          "status": {
-            "type": "string"
-          }
-        }
      }
    }
  },
@@ -20,31 +20,15 @@ builder.Services.AddSingleton<IRegistrationStore, InMemoryRegistrationStore>();
 builder.Services.AddHttpClient<FlowableWorkflowClient>();
 builder.Services.AddTransient<IWorkflowClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IExternalWorkerClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
-builder.Services.AddTransient<IUserTaskClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
-builder.Services.AddTransient<IBeoordelingEscalatieClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
-builder.Services.AddTransient<IRegistratieVerlopenClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddHttpClient<IAclClient, AclHttpClient>();

 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
-builder.Services.AddScoped<BeoordeelRegistratie>();
-builder.Services.AddScoped<WithdrawRegistration>();
-builder.Services.AddScoped<ProvideDocuments>();
-builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
-builder.Services.AddScoped<BeoordelingEscalatieProcessor>();
-builder.Services.AddScoped<ExpireRegistrationWorker>();
-builder.Services.AddScoped<RegistratieVerlopenProcessor>();

 // The hosted external-task job worker polls Flowable and drives OpenZaakAanmaken to completion.
 builder.Services.AddHostedService<OpenZaakJobPump>();
-// The escalation worker polls the BeoordelingEscaleren jobs the 14-day timer parks and reassigns
-// each overdue beoordeling to the teamlead (S-14).
-builder.Services.AddHostedService<BeoordelingEscalatiePump>();
-// The document-timeout worker polls the RegistratieVerlopen jobs the 30-day timer on WachtOpDocumenten
-// parks and expires each lapsed registration to VERLOPEN (S-10a, ADR-0017).
-builder.Services.AddHostedService<RegistratieVerlopenPump>();

 var app = builder.Build();

@@ -55,12 +39,7 @@ app.MapGet("/health", () => "Healthy");
 // a location to read the registration's progress (ADR-0009, eventual consistency).
 app.MapPost("/registrations", async (SubmitRegistrationRequest body, SubmitRegistration submit, CancellationToken ct) =>
 {
-    // Diploma origin defaults to domestic; a foreign (eIDAS) submission passes "Buitenlands" so the
-    // workflow's DMN routes it through CBGV-advies (S-13). An unknown value is a bad request.
-    if (!Enum.TryParse<DiplomaOrigin>(body.DiplomaOrigin, ignoreCase: true, out var origin) && body.DiplomaOrigin is not null)
-        return Results.BadRequest(new { error = $"Unknown diplomaOrigin '{body.DiplomaOrigin}'. Expected 'Binnenlands' or 'Buitenlands'." });
-
-    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn, origin), ct);
+    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn), ct);
    return Results.Accepted($"/registrations/{id}", new RegistrationResponse(id.ToString(), RegistrationStatus.Ingediend.ToString(), null));
 });

@@ -76,70 +55,6 @@ app.MapPost("/registrations/{id}/approve", async (string id, ApproveRegistration
    return Results.NoContent();
 });

-// The behandelaar's beoordeling (S-12): decide a registration goedkeuren (→ INGESCHREVEN, sets the
-// zaak's final status via the ACL) or afwijzen (→ AFGEWEZEN). Idempotent. This is the domain contract
-// the behandel-portal's decision reaches through the BFF; it supersedes the temporary /approve above,
-// which is retired once the portal lands.
-app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body, BeoordeelRegistratie beoordeel, CancellationToken ct) =>
-{
-    if (!Guid.TryParse(id, out var guid))
-        return Results.NotFound();
-
-    if (!Enum.TryParse<BeoordelingsBesluit>(body.Besluit, ignoreCase: true, out var besluit))
-        return Results.BadRequest(new { error = $"Unknown besluit '{body.Besluit}'. Expected 'goedkeuren' or 'afwijzen'." });
-
-    await beoordeel.HandleAsync(new BeoordeelRegistratieCommand(new RegistrationId(guid), besluit), ct);
-    return Results.NoContent();
-});
-
-// Withdraw a registration (S-11): the zorgprofessional pulls their own still-open submission back,
-// advancing it to INGETROKKEN and cancelling its workflow. Owner-scoped by the caller's bsn (the BFF
-// forwards it from the DigiD token, S-11c); a registration that is unknown or not the caller's is
-// 404 (indistinguishable, so ownership isn't leaked). Idempotent.
-app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRequest body, WithdrawRegistration withdraw, CancellationToken ct) =>
-{
-    if (!Guid.TryParse(id, out var guid))
-        return Results.NotFound();
-
-    if (string.IsNullOrWhiteSpace(body?.Bsn))
-        return Results.BadRequest(new { error = "A bsn is required to withdraw a registration." });
-
-    var outcome = await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid), body.Bsn), ct);
-    return outcome == WithdrawOutcome.Withdrawn ? Results.NoContent() : Results.NotFound();
-});
-
-// Provide documents (S-10a): the zorgprofessional supplies the documents their registration is parked
-// waiting for, completing the WachtOpDocumenten task so the process advances to beoordeling (ADR-0017).
-// Owner-scoped by the caller's bsn (the BFF forwards it from the DigiD token); unknown or not-the-
-// caller's is 404 (indistinguishable). Idempotent — completing an already-left wait is a no-op. The
-// real file upload + ZGW storage is S-10b; this endpoint is the trigger that unblocks the process.
-app.MapPost("/registrations/{id}/documents", async (string id, ProvideDocumentsRequest body, ProvideDocuments provide, CancellationToken ct) =>
-{
-    if (!Guid.TryParse(id, out var guid))
-        return Results.NotFound();
-
-    if (string.IsNullOrWhiteSpace(body?.Bsn))
-        return Results.BadRequest(new { error = "A bsn is required to provide documents." });
-    if (string.IsNullOrWhiteSpace(body.ContentBase64))
-        return Results.BadRequest(new { error = "A document is required." });
-
-    byte[] content;
-    try { content = Convert.FromBase64String(body.ContentBase64); }
-    catch (FormatException) { return Results.BadRequest(new { error = "The document content is not valid base64." }); }
-
-    var command = new ProvideDocumentsCommand(
-        new RegistrationId(guid), body.Bsn, content,
-        body.FileName ?? "diploma.pdf", body.ContentType ?? "application/pdf");
-    var outcome = await provide.HandleAsync(command, ct);
-    return outcome == ProvideDocumentsOutcome.Accepted ? Results.NoContent() : Results.NotFound();
-});
-
-// The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
-// Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
-// medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
-app.MapGet("/behandel/werkbak", async (Werkbak werkbak, CancellationToken ct) =>
-    Results.Ok(await werkbak.GetAsync(ct)));
-
 // Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
 app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
 {
@@ -155,13 +70,7 @@ app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, Ca

 await app.RunAsync();

-public sealed record SubmitRegistrationRequest(string Bsn, string? DiplomaOrigin = null);
-
-public sealed record DecideRequest(string Besluit);
-
-public sealed record WithdrawRequest(string Bsn);
-
-public sealed record ProvideDocumentsRequest(string Bsn, string ContentBase64, string? FileName = null, string? ContentType = null);
+public sealed record SubmitRegistrationRequest(string Bsn);

 public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);

@@ -1,71 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>A behandelaar's beoordeling outcome, in domain language.</summary>
-public enum BeoordelingsBesluit
-{
-    /// <summary>Approve — enter the registration in the register.</summary>
-    Goedkeuren,
-
-    /// <summary>Reject — turn the registration down.</summary>
-    Afwijzen,
-}
-
-/// <summary>A behandelaar's decision on a registration.</summary>
-public sealed record BeoordeelRegistratieCommand(RegistrationId RegistrationId, BeoordelingsBesluit Besluit);
-
-/// <summary>
-/// The beoordeling use case (S-12): apply a behandelaar's decision to a registration.
-/// <see cref="BeoordelingsBesluit.Goedkeuren"/> sets the zaak's final status via the ACL (§8.1) and
-/// advances the aggregate to INGESCHREVEN; <see cref="BeoordelingsBesluit.Afwijzen"/> advances it to
-/// AFGEWEZEN in the domain (propagating a rejection to the zaak, so the openbaar projection reflects
-/// it, is a later sub-slice of S-12). After applying the decision it completes the Flowable
-/// <c>Beoordelen</c> task (found by registrationId) so the workflow advances (ADR-0013). Both
-/// decisions are idempotent — a repeated or redelivered decision that matches the current terminal
-/// state is a no-op, so the ACL is not called and the task not completed twice.
-/// </summary>
-public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks)
-{
-    public async Task HandleAsync(BeoordeelRegistratieCommand command, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(command);
-
-        var registration = await store.GetAsync(command.RegistrationId, ct)
-            ?? throw new InvalidOperationException($"No registration {command.RegistrationId} to decide.");
-
-        switch (command.Besluit)
-        {
-            case BeoordelingsBesluit.Goedkeuren:
-                // A repeated approval is a no-op: don't set the zaak status a second time.
-                if (registration.Status == RegistrationStatus.Ingeschreven)
-                    return;
-                if (registration.ZaakUrl is null)
-                    throw new InvalidOperationException(
-                        $"Registration {command.RegistrationId} has no zaak yet; it cannot be approved.");
-                await acl.ApproveZaakAsync(registration.ZaakUrl, ct);
-                registration.Approve();
-                break;
-
-            case BeoordelingsBesluit.Afwijzen:
-                if (registration.Status == RegistrationStatus.Afgewezen)
-                    return;
-                registration.Reject();
-                break;
-        }
-
-        await store.SaveAsync(registration, ct);
-        await CompleteWorkflowTaskAsync(command.RegistrationId, command.Besluit, ct);
-    }
-
-    // Advance the workflow: complete the open Beoordelen task for this registration. If none is open
-    // (already completed, or the process hasn't parked yet) the decision still stands — we complete
-    // nothing rather than fail.
-    private async Task CompleteWorkflowTaskAsync(RegistrationId registrationId, BeoordelingsBesluit besluit, CancellationToken ct)
-    {
-        var open = await tasks.GetOpenBeoordelingenAsync(ct);
-        var task = open.FirstOrDefault(t => t.RegistrationId == registrationId);
-        if (task is not null)
-            await tasks.CompleteBeoordelingAsync(task.TaskId, besluit, ct);
-    }
-}
@@ -1,45 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>
-/// Handles one acquired <c>RegistratieVerlopen</c> external-worker job (S-10a, ADR-0017): load the
-/// registration the job correlates to and expire it to VERLOPEN — the 30-day document-wait timer fired
-/// before the documents arrived, so the case is cancelled. Pure application logic over ports; it knows
-/// nothing of Flowable. The polling loop that feeds it jobs lives in Infrastructure. Mirrors
-/// <see cref="OpenZaakWorker"/>.
-/// </summary>
-public sealed class ExpireRegistrationWorker(IRegistrationStore store, IAclClient acl)
-{
-    /// <summary>
-    /// Process the job. Idempotent and tolerant of races (§8.6, at-least-once delivery): a job whose
-    /// registration is already resolved — a redelivered expiry (VERLOPEN), or one withdrawn/decided
-    /// while it waited (INGETROKKEN/INGESCHREVEN/AFGEWEZEN) — is a no-op, so the job still completes
-    /// rather than throwing into a redelivery loop. Only a still-open registration is expired. An
-    /// unknown registration is an error: it throws, leaving the job un-completed for Flowable to redeliver.
-    /// </summary>
-    public async Task HandleAsync(RegistratieVerlopenJob job, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(job);
-
-        var registration = await store.GetAsync(job.RegistrationId, ct)
-            ?? throw new InvalidOperationException(
-                $"No registration {job.RegistrationId} for RegistratieVerlopen job {job.JobId}.");
-
-        // Only a still-open registration lapses; an already-resolved one (expired, or withdrawn/decided
-        // while it waited) is left untouched so the job can complete without violating the aggregate.
-        if (registration.Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))
-            return;
-
-        // Cancel the ZGW zaak before advancing the aggregate (mirrors the approval path): if the ACL
-        // call fails it throws, the aggregate stays open, and the job is redelivered (§8.6) — rather
-        // than leaving the aggregate VERLOPEN while the zaak stays open. The status guard above stops a
-        // redelivered job from cancelling the zaak twice (a second resultaat would be a 400). A
-        // registration expired before its zaak was opened has nothing to cancel.
-        if (registration.ZaakUrl is not null)
-            await acl.CancelZaakAsync(registration.ZaakUrl, ct);
-
-        registration.Expire();
-        await store.SaveAsync(registration, ct);
-    }
-}
@@ -11,28 +11,10 @@ public interface IWorkflowClient
 {
    /// <summary>
    /// Start one <c>registratie</c> process instance for the given registration, carrying the
-    /// registration id (so the <c>OpenZaakAanmaken</c> external task can be correlated back to its
-    /// aggregate) and the diploma origin (so the workflow's DMN can route foreign diplomas through
-    /// CBGV-advies, S-13). Returns the process instance id.
+    /// registration id so the <c>OpenZaakAanmaken</c> external task can be correlated back to its
+    /// aggregate. Returns the process instance id.
    /// </summary>
-    Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default);
-
-    /// <summary>
-    /// Cancel a running <c>registratie</c> process on withdrawal (S-11): correlate the
-    /// <c>RegistratieIngetrokken</c> message to the instance, tripping the interrupting message event
-    /// that ends it (ADR-0014). Best-effort — if the instance is not waiting on that message (already
-    /// ended, or not yet parked) it is a no-op; the aggregate is INGETROKKEN regardless.
-    /// </summary>
-    Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default);
-
-    /// <summary>
-    /// Signal that the required documents have arrived (S-10a): complete the <c>WachtOpDocumenten</c>
-    /// user task in the instance so the process leaves the 30-day wait state and continues to
-    /// beoordeling (ADR-0017). Best-effort — if the instance is not parked at that task (already
-    /// continued, or timed out) it is a no-op. The upload trigger that calls this is wired in S-10b.
-    /// </summary>
-    Task CompleteDocumentWaitAsync(string processInstanceId, CancellationToken ct = default);
+    Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default);
 }

 /// <summary>
@@ -52,45 +34,8 @@ public interface IAclClient
    /// the zaak's final status — which OpenZaak notifies over NRC; the domain never names statustypen.
    /// </summary>
    Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default);
-
-    /// <summary>
-    /// Store an uploaded diploma against the zaak (S-10b). The domain hands over the zaak, the raw file
-    /// bytes, and the file's name/type; the ACL creates the ZGW informatieobject and relates it to the
-    /// zaak (§8.1). Returns the stored document's URL.
-    /// </summary>
-    Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default);
-
-    /// <summary>
-    /// Cancel the zaak on document-timeout expiry (S-10c): the 30-day document term lapsed, so the ACL
-    /// translates this to the ZGW cancellation status/resultaat. The domain never names statustypen.
-    /// </summary>
-    Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default);
 }

-/// <summary>
-/// The port to the behandelaar's user tasks in the workflow engine (S-12). Implemented by the
-/// Workflow Client — the only code that talks to Flowable (§8.2). The application lists the open
-/// <c>Beoordelen</c> tasks (the werkbak), claims one for a behandelaar, and completes it with the
-/// decision; it never names Flowable's REST shapes.
-/// </summary>
-public interface IUserTaskClient
-{
-    /// <summary>The werkbak: the <c>Beoordelen</c> tasks awaiting a behandelaar, each with the
-    /// registration it belongs to.</summary>
-    Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default);
-
-    /// <summary>Claim a beoordeling task for a behandelaar (assigns it to them).</summary>
-    Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default);
-
-    /// <summary>Complete a beoordeling task, carrying the decision into the process as the
-    /// <c>besluit</c> variable so the workflow can continue on the chosen branch.</summary>
-    Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default);
-}
-
-/// <summary>A <c>Beoordelen</c> user task in the werkbak: the Flowable task id (needed to claim and
-/// complete it) and the registration it carries as a process variable.</summary>
-public sealed record BeoordelingTask(string TaskId, RegistrationId RegistrationId);
-
 /// <summary>
 /// Persistence port for the <see cref="Registration"/> aggregate. In-memory for the minimal slice
 /// (ADR-0009); an EF-backed store is a documented follow-up, and this port keeps that change additive.
@@ -109,18 +54,3 @@ public interface IRegistrationStore
 /// it) and the registration id it carries as a process variable.
 /// </summary>
 public sealed record OpenZaakJob(string JobId, RegistrationId RegistrationId);
-
-/// <summary>
-/// An acquired <c>BeoordelingEscaleren</c> escalation job (S-14): the Flowable job id and the process
-/// instance whose still-open <c>Beoordelen</c> task must be reassigned from behandelaar to teamlead
-/// once the 14-day boundary timer fires (ADR-0015).
-/// </summary>
-public sealed record EscalatieJob(string JobId, string ProcessInstanceId);
-
-/// <summary>
-/// An acquired <c>RegistratieVerlopen</c> job (S-10a): the Flowable job id and the registration id it
-/// carries as a process variable. The 30-day boundary timer on <c>WachtOpDocumenten</c> spawns it when
-/// the required documents were not supplied in time; expiring the correlated registration to VERLOPEN
-/// cancels the case (ADR-0017).
-/// </summary>
-public sealed record RegistratieVerlopenJob(string JobId, RegistrationId RegistrationId);
@@ -1,54 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>A zorgprofessional's upload of the diploma their registration is waiting for ("documenten
-/// aanleveren"). <paramref name="Bsn"/> is the authenticated caller (from the DigiD token, forwarded by
-/// the BFF): only the registration's own bsn may provide its documents. <paramref name="Content"/> is
-/// the raw file, with its <paramref name="FileName"/> and <paramref name="ContentType"/>.</summary>
-public sealed record ProvideDocumentsCommand(
-    RegistrationId RegistrationId, string Bsn, byte[] Content, string FileName, string ContentType);
-
-/// <summary>The outcome of a provide-documents request.</summary>
-public enum ProvideDocumentsOutcome
-{
-    /// <summary>The documents were accepted; the process's document wait was completed (if any).</summary>
-    Accepted,
-
-    /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone else
-    /// (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
-    NotFound,
-}
-
-/// <summary>
-/// The provide-documents use case (S-10a/S-10b): a zorgprofessional uploads the diploma their
-/// registration is parked waiting for. The document is stored in ZGW via the ACL (§8.1), then the
-/// WachtOpDocumenten task is completed so the registratie process leaves the 30-day wait and continues
-/// to beoordeling (ADR-0017). Owner-scoped by bsn. Both steps are best-effort about missing preconditions
-/// (mirroring <see cref="WithdrawRegistration"/>): storage needs an opened zaak, and completion needs a
-/// running process — a request that arrives before either still stands, storing/completing what it can.
-/// </summary>
-public sealed class ProvideDocuments(IRegistrationStore store, IWorkflowClient workflow, IAclClient acl)
-{
-    public async Task<ProvideDocumentsOutcome> HandleAsync(ProvideDocumentsCommand command, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(command);
-
-        var registration = await store.GetAsync(command.RegistrationId, ct);
-
-        // Unknown, or not the caller's registration: report NotFound either way (don't reveal which).
-        if (registration is null || registration.Bsn != command.Bsn)
-            return ProvideDocumentsOutcome.NotFound;
-
-        // Store the diploma against the zaak (once it is opened) — the ACL is the only ZGW caller (§8.1).
-        if (registration.ZaakUrl is not null)
-            await acl.StoreDiplomaAsync(
-                registration.ZaakUrl, command.Content, command.FileName, command.ContentType, ct);
-
-        // Complete the document wait (if a process is running) so beoordeling can proceed.
-        if (registration.ProcessInstanceId is not null)
-            await workflow.CompleteDocumentWaitAsync(registration.ProcessInstanceId, ct);
-
-        return ProvideDocumentsOutcome.Accepted;
-    }
-}
@@ -2,10 +2,8 @@ using Big.Domain;

 namespace Big.Application;

-/// <summary>A zorgprofessional's request to register, in domain language. No ZGW concepts. The
-/// diploma origin defaults to domestic (the DigiD path); a foreign (eIDAS) submission sets it to
-/// <see cref="DiplomaOrigin.Buitenlands"/> so the workflow's DMN routes it through CBGV-advies (S-13).</summary>
-public sealed record SubmitRegistrationCommand(string Bsn, DiplomaOrigin DiplomaOrigin = DiplomaOrigin.Binnenlands);
+/// <summary>A zorgprofessional's request to register, in domain language. No ZGW concepts.</summary>
+public sealed record SubmitRegistrationCommand(string Bsn);

 /// <summary>
 /// The submit use case: create the <see cref="Registration"/> aggregate (INGEDIEND), persist it,
@@ -20,14 +18,13 @@ public sealed class SubmitRegistration(IRegistrationStore store, IWorkflowClient
    {
        ArgumentNullException.ThrowIfNull(command);

-        var registration = Registration.Submit(command.Bsn, command.DiplomaOrigin);
+        var registration = Registration.Submit(command.Bsn);

        // Persist before starting the process so the worker can correlate the OpenZaakAanmaken
        // job back to an aggregate that already exists (ADR-0009).
        await store.SaveAsync(registration, ct);

-        var processInstanceId = await workflow.StartRegistrationProcessAsync(
-            registration.Id, registration.DiplomaOrigin, ct);
+        var processInstanceId = await workflow.StartRegistrationProcessAsync(registration.Id, ct);
        registration.RecordProcessStarted(processInstanceId);
        await store.SaveAsync(registration, ct);

@@ -1,40 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>One row of the behandelaar's werkbak: a registration awaiting beoordeling, with the
-/// public-facing reference (its id) plus the bsn and status a behandelaar needs to triage it.</summary>
-public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
-
-/// <summary>
-/// The werkbak query (S-12c): the registrations awaiting a behandelaar's beoordeling. It reads the
-/// open <c>Beoordelen</c> tasks from the workflow engine (§8.2, via <see cref="IUserTaskClient"/>) —
-/// the authoritative set of work items — and enriches each with its aggregate (bsn + status). A task
-/// whose registration the domain doesn't know, or whose registration is no longer open for beoordeling
-/// (e.g. withdrawn — S-11 — while its task lingers until the workflow cancels it), is skipped.
-/// </summary>
-public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
-{
-    public async Task<IReadOnlyList<WerkbakItem>> GetAsync(CancellationToken ct = default)
-    {
-        var open = await tasks.GetOpenBeoordelingenAsync(ct);
-
-        var items = new List<WerkbakItem>(open.Count);
-        foreach (var task in open)
-        {
-            var registration = await store.GetAsync(task.RegistrationId, ct);
-            if (registration is null || !IsOpenForBeoordeling(registration.Status))
-                continue;
-
-            items.Add(new WerkbakItem(
-                registration.Id.ToString(), registration.Bsn, registration.Status.ToString()));
-        }
-
-        return items;
-    }
-
-    // Only registrations still open for a decision belong in the werkbak; a terminal one (decided or
-    // withdrawn — S-11) whose Beoordelen task has not yet been cleared must not surface to a behandelaar.
-    private static bool IsOpenForBeoordeling(RegistrationStatus status)
-        => status is RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling;
-}
@@ -1,55 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>A zorgprofessional's request to withdraw their own registration ("trek aanvraag in").
-/// <paramref name="Bsn"/> is the authenticated caller (from the DigiD token, forwarded by the BFF):
-/// only the registration's own bsn may withdraw it.</summary>
-public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId, string Bsn);
-
-/// <summary>The outcome of a withdrawal request.</summary>
-public enum WithdrawOutcome
-{
-    /// <summary>The registration is now (or already was) INGETROKKEN.</summary>
-    Withdrawn,
-
-    /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone
-    /// else (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
-    NotFound,
-}
-
-/// <summary>
-/// The withdrawal use case (S-11): a zorgprofessional pulls a still-open registration back. It
-/// advances the aggregate to INGETROKKEN, persists it, then cancels the running registratie process
-/// by correlating the withdrawal message to its instance (ADR-0014), so the case leaves the
-/// behandelaar's werkbak. Idempotent — a repeated or redelivered withdrawal of an already-withdrawn
-/// registration is a no-op (not persisted or cancelled again). Cancelling is best-effort: if the
-/// registration never started a process the withdrawal still stands (the process cancel is skipped),
-/// mirroring how <see cref="BeoordeelRegistratie"/> completes its task best-effort.
-/// </summary>
-public sealed class WithdrawRegistration(IRegistrationStore store, IWorkflowClient workflow)
-{
-    public async Task<WithdrawOutcome> HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(command);
-
-        var registration = await store.GetAsync(command.RegistrationId, ct);
-
-        // Unknown, or not the caller's registration: report NotFound either way (don't reveal which).
-        if (registration is null || registration.Bsn != command.Bsn)
-            return WithdrawOutcome.NotFound;
-
-        // A repeated withdrawal is a no-op: don't persist or cancel the already-withdrawn one again.
-        if (registration.Status == RegistrationStatus.Ingetrokken)
-            return WithdrawOutcome.Withdrawn;
-
-        registration.Withdraw();
-        await store.SaveAsync(registration, ct);
-
-        // Cancel the running process (if one was started) so its Beoordelen task leaves the werkbak.
-        if (registration.ProcessInstanceId is not null)
-            await workflow.WithdrawProcessAsync(registration.ProcessInstanceId, ct);
-
-        return WithdrawOutcome.Withdrawn;
-    }
-}
@@ -1,17 +0,0 @@
-namespace Big.Domain;
-
-/// <summary>
-/// Where a zorgprofessional's diploma was issued. It is the input to the diploma-eligibility decision
-/// (S-13): a <see cref="Buitenlands"/> (foreign) diploma routes the registratie through an extra
-/// CBGV-advies assessment step, a <see cref="Binnenlands"/> (domestic) one goes straight to beoordeling.
-/// The decision itself lives in the workflow's DMN, not here (ADR-0016); the domain only carries the
-/// origin and hands it to the process as a start variable.
-/// </summary>
-public enum DiplomaOrigin
-{
-    /// <summary>A Dutch (domestic) diploma. Default for a registration submitted via DigiD.</summary>
-    Binnenlands,
-
-    /// <summary>A foreign diploma (e.g. an eIDAS submission). Triggers the CBGV-advies step.</summary>
-    Buitenlands,
-}
@@ -7,11 +7,10 @@ namespace Big.Domain;
 /// </summary>
 public sealed class Registration
 {
-    private Registration(RegistrationId id, string bsn, DiplomaOrigin diplomaOrigin)
+    private Registration(RegistrationId id, string bsn)
    {
        Id = id;
        Bsn = bsn;
-        DiplomaOrigin = diplomaOrigin;
        Status = RegistrationStatus.Ingediend;
    }

@@ -21,10 +20,6 @@ public sealed class Registration
    /// as the domain payload; the domain never constructs ZGW concepts from it (§8.1).</summary>
    public string Bsn { get; }

-    /// <summary>Where the diploma was issued. Rides along to the process as a start variable and
-    /// drives the diploma-eligibility DMN's foreign→CBGV-advies routing (S-13, ADR-0016).</summary>
-    public DiplomaOrigin DiplomaOrigin { get; }
-
    public RegistrationStatus Status { get; private set; }

    /// <summary>The Flowable process instance driving this registration, once started.</summary>
@@ -33,13 +28,11 @@ public sealed class Registration
    /// <summary>The zaak the ACL opened for this registration, once the external task has run.</summary>
    public Uri? ZaakUrl { get; private set; }

-    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.
-    /// The diploma origin defaults to <see cref="DiplomaOrigin.Binnenlands"/> — the common DigiD path;
-    /// a foreign (eIDAS) submission passes <see cref="DiplomaOrigin.Buitenlands"/>.</summary>
-    public static Registration Submit(string bsn, DiplomaOrigin diplomaOrigin = DiplomaOrigin.Binnenlands)
+    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.</summary>
+    public static Registration Submit(string bsn)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(bsn);
-        return new Registration(RegistrationId.New(), bsn, diplomaOrigin);
+        return new Registration(RegistrationId.New(), bsn);
    }

    /// <summary>Record that the registratie workflow process has been started for this registration.</summary>
@@ -73,28 +66,10 @@ public sealed class Registration
    }

    /// <summary>
-    /// A behandelaar picks the registration up for beoordeling. Advances
-    /// <see cref="RegistrationStatus.Ingediend"/> → <see cref="RegistrationStatus.InBehandeling"/>.
-    /// Re-taking one already <see cref="RegistrationStatus.InBehandeling"/> is a no-op (the same or
-    /// another behandelaar re-opens it); a decided registration can no longer be taken into behandeling.
-    /// </summary>
-    public void TakeIntoBehandeling()
-    {
-        if (Status == RegistrationStatus.InBehandeling)
-            return;
-
-        if (Status != RegistrationStatus.Ingediend)
-            throw new InvalidOperationException(
-                $"Registration {Id} is {Status}; only an INGEDIEND registration can be taken into behandeling.");
-
-        Status = RegistrationStatus.InBehandeling;
-    }
-
-    /// <summary>
-    /// Approve the registration — the behandelaar's decision to enter it in the register. Advances a
-    /// submitted or in-behandeling registration to <see cref="RegistrationStatus.Ingeschreven"/>.
-    /// Requires an opened zaak (the approval sets that zaak's status via the ACL); a registration that
-    /// has already been decided cannot be approved again.
+    /// Approve the registration — the behandelaar's decision to enter it in the register. Advances
+    /// <see cref="RegistrationStatus.Ingediend"/> → <see cref="RegistrationStatus.Ingeschreven"/>.
+    /// Requires an opened zaak (the approval sets that zaak's status via the ACL), and only a
+    /// submitted registration can be approved: re-approving is rejected as an invalid transition.
    /// </summary>
    public void Approve()
    {
@@ -102,59 +77,10 @@ public sealed class Registration
            throw new InvalidOperationException(
                $"Registration {Id} has no zaak yet; it cannot be approved before its zaak is opened.");

-        RequireOpenForDecision(nameof(Approve));
+        if (Status != RegistrationStatus.Ingediend)
+            throw new InvalidOperationException(
+                $"Registration {Id} is {Status}; only an INGEDIEND registration can be approved.");
+
        Status = RegistrationStatus.Ingeschreven;
    }
-
-    /// <summary>
-    /// Reject the registration — the behandelaar's decision not to enter it in the register. Advances a
-    /// submitted or in-behandeling registration to <see cref="RegistrationStatus.Afgewezen"/>. Unlike
-    /// approval this needs no zaak: a registration can be rejected before or after its zaak is opened.
-    /// A registration that has already been decided cannot be rejected again.
-    /// </summary>
-    public void Reject()
-    {
-        RequireOpenForDecision(nameof(Reject));
-        Status = RegistrationStatus.Afgewezen;
-    }
-
-    /// <summary>
-    /// Withdraw the registration — the zorgprofessional pulls their own submission back (S-11). Allowed
-    /// while it is still open (INGEDIEND or IN_BEHANDELING) and needs no zaak; a registration that has
-    /// already been decided (INGESCHREVEN/AFGEWEZEN) can no longer be withdrawn. Re-withdrawing one
-    /// already <see cref="RegistrationStatus.Ingetrokken"/> is a no-op.
-    /// </summary>
-    public void Withdraw()
-    {
-        if (Status == RegistrationStatus.Ingetrokken)
-            return;
-
-        RequireOpenForDecision(nameof(Withdraw));
-        Status = RegistrationStatus.Ingetrokken;
-    }
-
-    /// <summary>
-    /// Expire the registration — the 30-day document-wait timer fired before the required documents
-    /// were supplied, so the registratie process cancels the case (S-10a). Allowed while it is still
-    /// open (INGEDIEND or IN_BEHANDELING) and needs no zaak; a decided (INGESCHREVEN/AFGEWEZEN) or
-    /// withdrawn (INGETROKKEN) registration can no longer expire. Re-expiring one already
-    /// <see cref="RegistrationStatus.Verlopen"/> is a no-op — the worker job may be redelivered (§8.6).
-    /// </summary>
-    public void Expire()
-    {
-        if (Status == RegistrationStatus.Verlopen)
-            return;
-
-        RequireOpenForDecision(nameof(Expire));
-        Status = RegistrationStatus.Verlopen;
-    }
-
-    // A decision (or withdrawal, or expiry) is only valid while the registration is still open
-    // (INGEDIEND or IN_BEHANDELING).
-    private void RequireOpenForDecision(string decision)
-    {
-        if (Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))
-            throw new InvalidOperationException(
-                $"Registration {Id} is {Status}; only an INGEDIEND or IN_BEHANDELING registration can be decided ({decision}).");
-    }
 }
@@ -1,28 +1,13 @@
 namespace Big.Domain;

-/// <summary>The lifecycle states a <see cref="Registration"/> moves through. Submission starts in
-/// <see cref="Ingediend"/>; a behandelaar takes it <see cref="InBehandeling"/> and decides it into one
-/// of the terminal states <see cref="Ingeschreven"/> (approved) or <see cref="Afgewezen"/> (rejected).
-/// A zorgprofessional can withdraw a still-open registration into <see cref="Ingetrokken"/> (S-11).
-/// The herregistratie state arrives in its own slice.</summary>
+/// <summary>The lifecycle states a <see cref="Registration"/> moves through. The walking
+/// skeleton knows <see cref="Ingediend"/> and the terminal <see cref="Ingeschreven"/>; withdrawal,
+/// beoordeling and herregistratie states arrive in their own slices (Iteration 2+).</summary>
 public enum RegistrationStatus
 {
    /// <summary>Submitted by the zorgprofessional; the registratie process has been started.</summary>
    Ingediend,

-    /// <summary>Picked up by a behandelaar for beoordeling (S-12).</summary>
-    InBehandeling,
-
-    /// <summary>Approved: entered in the register. Terminal.</summary>
+    /// <summary>Approved: entered in the register. Terminal in the walking skeleton (S-09b).</summary>
    Ingeschreven,
-
-    /// <summary>Rejected by the behandelaar. Terminal.</summary>
-    Afgewezen,
-
-    /// <summary>Withdrawn by the zorgprofessional before a decision (S-11). Terminal.</summary>
-    Ingetrokken,
-
-    /// <summary>Lapsed: the required documents were not supplied within the 30-day window, so the
-    /// registratie process cancelled the case (S-10a). Terminal.</summary>
-    Verlopen,
 }
@@ -31,32 +31,6 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
        response.EnsureSuccessStatusCode();
    }

-    public async Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(zaakUrl);
-
-        using var response = await http.PostAsJsonAsync(
-            new Uri(options.BaseUrl, "annuleringen"), new CancelZaakRequest(zaakUrl.ToString()), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(zaakUrl);
-        ArgumentNullException.ThrowIfNull(content);
-
-        // The file crosses this boundary base64-encoded in JSON — the domain and ACL contracts are
-        // JSON, and a diploma is small (S-10b, ADR). The ACL turns it into a ZGW informatieobject.
-        using var response = await http.PostAsJsonAsync(
-            new Uri(options.BaseUrl, "documenten"),
-            new StoreDocumentRequest(zaakUrl.ToString(), Convert.ToBase64String(content), fileName, contentType), ct);
-        response.EnsureSuccessStatusCode();
-
-        var stored = await response.Content.ReadFromJsonAsync<StoreDocumentResponse>(ct)
-            ?? throw new InvalidOperationException("The ACL returned an empty document response.");
-        return new Uri(stored.InformatieobjectUrl);
-    }
-
    private sealed record OpenZaakRequest(
        [property: JsonPropertyName("bsn")] string Bsn,
        [property: JsonPropertyName("reference")] string Reference);
@@ -64,15 +38,4 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
    private sealed record OpenZaakResponse([property: JsonPropertyName("zaakUrl")] string ZaakUrl);

    private sealed record SetStatusRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
-
-    private sealed record CancelZaakRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
-
-    private sealed record StoreDocumentRequest(
-        [property: JsonPropertyName("zaakUrl")] string ZaakUrl,
-        [property: JsonPropertyName("contentBase64")] string ContentBase64,
-        [property: JsonPropertyName("fileName")] string FileName,
-        [property: JsonPropertyName("contentType")] string ContentType);
-
-    private sealed record StoreDocumentResponse(
-        [property: JsonPropertyName("informatieobjectUrl")] string InformatieobjectUrl);
 }
@@ -1,37 +0,0 @@
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// One poll tick of the beoordeling-escalation worker (S-14, ADR-0015): acquire the parked
-/// <c>BeoordelingEscaleren</c> jobs — the tokens the 14-day boundary timer on <c>Beoordelen</c> spawns
-/// — reassign each instance's still-open <c>Beoordelen</c> task to the teamlead, and complete the job.
-/// A job that fails is logged and left un-completed so Flowable redelivers it (§8.6). Split out from
-/// the hosted pump so the acquire→reassign→complete logic is unit-testable without a running host.
-/// </summary>
-public sealed class BeoordelingEscalatieProcessor(
-    IBeoordelingEscalatieClient client,
-    ILogger<BeoordelingEscalatieProcessor> logger)
-{
-    /// <summary>Acquire and process up to <paramref name="maxJobs"/> escalations. Returns the number acquired.</summary>
-    public async Task<int> PumpOnceAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var jobs = await client.AcquireBeoordelingEscalatieJobsAsync(maxJobs, ct);
-
-        foreach (var job in jobs)
-        {
-            try
-            {
-                await client.ReassignBeoordelingToTeamleadAsync(job.ProcessInstanceId, ct);
-                await client.CompleteBeoordelingEscalatieJobAsync(job.JobId, ct);
-            }
-            catch (Exception ex)
-            {
-                // Leave the job un-completed: its lock expires and Flowable redelivers it (§8.6).
-                logger.LogError(ex, "BeoordelingEscaleren job {JobId} failed; leaving it for redelivery.", job.JobId);
-            }
-        }
-
-        return jobs.Count;
-    }
-}
@@ -1,49 +0,0 @@
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// The hosted polling loop of the beoordeling-escalation worker (S-14, ADR-0015): on an interval it
-/// resolves a scoped <see cref="BeoordelingEscalatieProcessor"/> and asks it to drain the parked
-/// <c>BeoordelingEscaleren</c> jobs. A deliberately thin shell — all acquire/reassign/complete logic
-/// lives in the processor, which is unit-tested; this class only owns the timer, the per-tick scope,
-/// and loop resilience. Structurally identical to <see cref="OpenZaakJobPump"/>.
-/// </summary>
-public sealed class BeoordelingEscalatiePump(
-    IServiceScopeFactory scopeFactory,
-    FlowableOptions options,
-    ILogger<BeoordelingEscalatiePump> logger) : BackgroundService
-{
-    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
-    {
-        while (!stoppingToken.IsCancellationRequested)
-        {
-            try
-            {
-                using var scope = scopeFactory.CreateScope();
-                var processor = scope.ServiceProvider.GetRequiredService<BeoordelingEscalatieProcessor>();
-                await processor.PumpOnceAsync(options.MaxJobsPerPoll, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-            catch (Exception ex)
-            {
-                // A transient fault (e.g. Flowable briefly unreachable) must not kill the loop.
-                logger.LogError(ex, "BeoordelingEscaleren job poll failed; retrying after the poll interval.");
-            }
-
-            try
-            {
-                await Task.Delay(options.PollInterval, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-        }
-    }
-}
@@ -15,31 +15,18 @@ namespace Big.Infrastructure;
 /// The REST contract here is the one verified against a live flowable-rest engine (ADR-0009).
 /// </summary>
 public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions options)
-    : IWorkflowClient, IExternalWorkerClient, IUserTaskClient, IBeoordelingEscalatieClient, IRegistratieVerlopenClient
+    : IWorkflowClient, IExternalWorkerClient
 {
    private const string Topic = "OpenZaakAanmaken";
-    private const string EscalatieTopic = "BeoordelingEscaleren";
-    private const string VerlopenTopic = "RegistratieVerlopen";
    private const string ProcessDefinitionKey = "registratie";
-    private const string BeoordelenTaskKey = "Beoordelen";
-    private const string WachtOpDocumentenTaskKey = "WachtOpDocumenten";
-    private const string BehandelaarGroup = "behandelaar";
-    private const string TeamleadGroup = "teamlead";
    private const string RegistrationIdVariable = "registrationId";
-    private const string DiplomaOriginVariable = "diplomaOrigin";
    private const string ZaakUrlVariable = "zaakUrl";
-    private const string BesluitVariable = "besluit";
-    private const string IngetrokkenMessage = "RegistratieIngetrokken";

-    public async Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
+    public async Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
    {
        var request = new StartProcessRequest(
            ProcessDefinitionKey,
-            [
-                new Variable(RegistrationIdVariable, "string", registrationId.ToString()),
-                new Variable(DiplomaOriginVariable, "string", diplomaOrigin.ToString()),
-            ]);
+            [new Variable(RegistrationIdVariable, "string", registrationId.ToString())]);

        var created = await PostAsync<StartProcessRequest, ProcessInstance>(
            "service/runtime/process-instances", request, ct)
@@ -68,148 +55,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
        response.EnsureSuccessStatusCode();
    }

-    public async Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
-    {
-        var request = new TaskQueryRequest(ProcessDefinitionKey, BeoordelenTaskKey, IncludeProcessVariables: true);
-
-        var page = await PostAsync<TaskQueryRequest, TaskQueryResult>(
-            "service/query/tasks", request, ct);
-
-        var tasks = page?.Data ?? [];
-        return [.. tasks.Select(t => new BeoordelingTask(t.Id, RegistrationId.Parse(t.RegistrationId())))];
-    }
-
-    public async Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default)
-    {
-        using var response = await SendAsync(
-            $"service/runtime/tasks/{taskId}", new ClaimTaskRequest("claim", behandelaar), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
-    {
-        var request = new CompleteTaskRequest(
-            "complete",
-            [new Variable(BesluitVariable, "string", besluit.ToString().ToLowerInvariant())]);
-
-        using var response = await SendAsync($"service/runtime/tasks/{taskId}", request, ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // Correlate the withdrawal message to the instance: find the execution subscribed to it (the
-        // interrupting message event's own execution — NOT the user task's), then deliver
-        // messageEventReceived to that execution so the process ends (ADR-0014). If nothing is
-        // subscribed (the process is not parked at Beoordelen) this is a best-effort no-op.
-        var subscribed = await GetAsync<ExecutionQueryResult>(
-            $"service/runtime/executions?messageEventSubscriptionName={IngetrokkenMessage}&processInstanceId={processInstanceId}",
-            ct);
-
-        var execution = subscribed?.Data?.FirstOrDefault();
-        if (execution is null)
-            return;
-
-        var request = new MessageEventRequest("messageEventReceived", IngetrokkenMessage);
-        using var response = await SendAsync(
-            $"service/runtime/executions/{execution.Id}", request, ct, HttpMethod.Put);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task CompleteDocumentWaitAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // Find the still-open WachtOpDocumenten task in this instance and complete it, so the process
-        // leaves the 30-day wait and continues to beoordeling (S-10a, ADR-0017). If the instance is no
-        // longer parked there (already continued, or the timer already cancelled it) this is a
-        // best-effort no-op — mirroring the withdrawal/escalation correlation (§8.6).
-        var query = new TaskByInstanceQueryRequest(processInstanceId, WachtOpDocumentenTaskKey);
-        var page = await PostAsync<TaskByInstanceQueryRequest, TaskQueryResult>(
-            "service/query/tasks", query, ct);
-
-        var task = page?.Data?.FirstOrDefault();
-        if (task is null)
-            return;
-
-        using var response = await SendAsync(
-            $"service/runtime/tasks/{task.Id}", new CompleteTaskRequest("complete", []), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var request = new AcquireJobsRequest(EscalatieTopic, options.LockDuration, maxJobs, options.WorkerId);
-
-        var jobs = await PostAsync<AcquireJobsRequest, List<AcquiredEscalatieJob>>(
-            "external-job-api/acquire/jobs", request, ct) ?? [];
-
-        return [.. jobs.Select(job => new EscalatieJob(job.Id, job.ProcessInstanceId))];
-    }
-
-    public async Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // The escalation token runs in parallel to the still-open Beoordelen task (non-interrupting
-        // boundary timer); find that task in this instance so we can move it to the teamlead. If the
-        // behandelaar completed it just before the timer fired there is nothing to reassign — a
-        // best-effort no-op (the timer/completion race, cf. §8.6).
-        var query = new TaskByInstanceQueryRequest(processInstanceId, BeoordelenTaskKey);
-        var page = await PostAsync<TaskByInstanceQueryRequest, TaskQueryResult>(
-            "service/query/tasks", query, ct);
-
-        var task = page?.Data?.FirstOrDefault();
-        if (task is null)
-            return;
-
-        // Add teamlead, then drop behandelaar: the task now belongs to the teamlead group.
-        using (var added = await SendAsync(
-            $"service/runtime/tasks/{task.Id}/identitylinks",
-            new IdentityLinkRequest(TeamleadGroup, "candidate"), ct))
-            added.EnsureSuccessStatusCode();
-
-        await DeleteAsync(
-            $"service/runtime/tasks/{task.Id}/identitylinks/groups/{BehandelaarGroup}/candidate", ct);
-    }
-
-    public async Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default)
-    {
-        using var response = await SendAsync(
-            $"external-job-api/acquire/jobs/{jobId}/complete", new CompleteJobRequest(options.WorkerId, []), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task<IReadOnlyList<RegistratieVerlopenJob>> AcquireRegistratieVerlopenJobsAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var request = new AcquireJobsRequest(VerlopenTopic, options.LockDuration, maxJobs, options.WorkerId);
-
-        var jobs = await PostAsync<AcquireJobsRequest, List<AcquiredJob>>(
-            "external-job-api/acquire/jobs", request, ct) ?? [];
-
-        return [.. jobs.Select(job => new RegistratieVerlopenJob(job.Id, RegistrationId.Parse(job.RegistrationId())))];
-    }
-
-    public async Task CompleteRegistratieVerlopenJobAsync(string jobId, CancellationToken ct = default)
-    {
-        using var response = await SendAsync(
-            $"external-job-api/acquire/jobs/{jobId}/complete", new CompleteJobRequest(options.WorkerId, []), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    private async Task<TResponse?> GetAsync<TResponse>(string path, CancellationToken ct)
-    {
-        var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, path));
-        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-        return await response.Content.ReadFromJsonAsync<TResponse>(ct);
-    }
-
-    private async Task DeleteAsync(string path, CancellationToken ct)
-    {
-        var message = new HttpRequestMessage(HttpMethod.Delete, new Uri(options.BaseUrl, path));
-        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-    }
-
    private async Task<TResponse?> PostAsync<TRequest, TResponse>(string path, TRequest body, CancellationToken ct)
    {
        using var response = await SendAsync(path, body, ct);
@@ -217,9 +62,9 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
        return await response.Content.ReadFromJsonAsync<TResponse>(ct);
    }

-    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct, HttpMethod? method = null)
+    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct)
    {
-        var message = new HttpRequestMessage(method ?? HttpMethod.Post, new Uri(options.BaseUrl, path))
+        var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
        {
            Content = JsonContent.Create(body),
        };
@@ -244,46 +89,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
        [property: JsonPropertyName("workerId")] string WorkerId,
        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);

-    private sealed record TaskQueryRequest(
-        [property: JsonPropertyName("processDefinitionKey")] string ProcessDefinitionKey,
-        [property: JsonPropertyName("taskDefinitionKey")] string TaskDefinitionKey,
-        [property: JsonPropertyName("includeProcessVariables")] bool IncludeProcessVariables);
-
-    private sealed record TaskByInstanceQueryRequest(
-        [property: JsonPropertyName("processInstanceId")] string ProcessInstanceId,
-        [property: JsonPropertyName("taskDefinitionKey")] string TaskDefinitionKey);
-
-    private sealed record IdentityLinkRequest(
-        [property: JsonPropertyName("group")] string Group,
-        [property: JsonPropertyName("type")] string Type);
-
-    private sealed record ClaimTaskRequest(
-        [property: JsonPropertyName("action")] string Action,
-        [property: JsonPropertyName("assignee")] string Assignee);
-
-    private sealed record CompleteTaskRequest(
-        [property: JsonPropertyName("action")] string Action,
-        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
-
-    private sealed record MessageEventRequest(
-        [property: JsonPropertyName("action")] string Action,
-        [property: JsonPropertyName("messageName")] string MessageName);
-
-    private sealed record TaskQueryResult(
-        [property: JsonPropertyName("data")] IReadOnlyList<UserTaskDto>? Data);
-
-    private sealed record UserTaskDto(
-        [property: JsonPropertyName("id")] string Id,
-        // Flowable's task-query returns the (included) process variables under "variables", not
-        // "processVariables"; the request opts in via includeProcessVariables.
-        [property: JsonPropertyName("variables")] IReadOnlyList<Variable>? Variables)
-    {
-        /// <summary>The registration id this task carries as a process variable.</summary>
-        public string RegistrationId() =>
-            Variables?.SingleOrDefault(v => v.Name == "registrationId")?.Value
-            ?? throw new InvalidOperationException($"Beoordelen task {Id} carries no registrationId variable.");
-    }
-
    private sealed record Variable(
        [property: JsonPropertyName("name")] string Name,
        [property: JsonPropertyName("type")] string Type,
@@ -291,15 +96,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti

    private sealed record ProcessInstance([property: JsonPropertyName("id")] string Id);

-    private sealed record ExecutionQueryResult(
-        [property: JsonPropertyName("data")] IReadOnlyList<ExecutionDto>? Data);
-
-    private sealed record ExecutionDto([property: JsonPropertyName("id")] string Id);
-
-    private sealed record AcquiredEscalatieJob(
-        [property: JsonPropertyName("id")] string Id,
-        [property: JsonPropertyName("processInstanceId")] string ProcessInstanceId);
-
    private sealed record AcquiredJob(
        [property: JsonPropertyName("id")] string Id,
        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables)
@@ -16,39 +16,3 @@ public interface IExternalWorkerClient
    /// <summary>Complete an acquired job, passing the opened zaak URL back into the process.</summary>
    Task CompleteOpenZaakJobAsync(string jobId, Uri zaakUrl, CancellationToken ct = default);
 }
-
-/// <summary>
-/// The escalation side of the Workflow Client (S-14): the <c>BeoordelingEscaleren</c> external-worker
-/// jobs parked by the 14-day boundary timer on <c>Beoordelen</c>, and the reassignment they drive.
-/// Kept separate from <see cref="IExternalWorkerClient"/> (interface segregation) so the OpenZaak
-/// worker never sees escalation. Implemented by <see cref="FlowableWorkflowClient"/> — the only code
-/// that talks to Flowable (§8.2, ADR-0015).
-/// </summary>
-public interface IBeoordelingEscalatieClient
-{
-    /// <summary>Acquire and lock up to <paramref name="maxJobs"/> <c>BeoordelingEscaleren</c> jobs.</summary>
-    Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default);
-
-    /// <summary>Reassign the still-open <c>Beoordelen</c> task in the given process instance from the
-    /// behandelaar group to teamlead. Best-effort no-op if the task is no longer open.</summary>
-    Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default);
-
-    /// <summary>Complete an acquired escalation job so its token reaches the escalation end event.</summary>
-    Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default);
-}
-
-/// <summary>
-/// The document-timeout side of the Workflow Client (S-10a): the <c>RegistratieVerlopen</c>
-/// external-worker jobs parked by the 30-day boundary timer on <c>WachtOpDocumenten</c>. Kept separate
-/// from the other worker ports (interface segregation) so neither the OpenZaak nor escalation worker
-/// sees expiry. Implemented by <see cref="FlowableWorkflowClient"/> — the only code that talks to
-/// Flowable (§8.2, ADR-0017).
-/// </summary>
-public interface IRegistratieVerlopenClient
-{
-    /// <summary>Acquire and lock up to <paramref name="maxJobs"/> <c>RegistratieVerlopen</c> jobs.</summary>
-    Task<IReadOnlyList<RegistratieVerlopenJob>> AcquireRegistratieVerlopenJobsAsync(int maxJobs, CancellationToken ct = default);
-
-    /// <summary>Complete an acquired expiry job so its token reaches the <c>endVerlopen</c> end event.</summary>
-    Task CompleteRegistratieVerlopenJobAsync(string jobId, CancellationToken ct = default);
-}
@@ -1,41 +0,0 @@
-using Big.Application;
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// One poll tick of the document-timeout worker (S-10a, ADR-0017): acquire the parked
-/// <c>RegistratieVerlopen</c> jobs — the tokens the 30-day boundary timer on <c>WachtOpDocumenten</c>
-/// spawns — expire each correlated registration via the <see cref="ExpireRegistrationWorker"/>, and
-/// complete the job so its token reaches <c>endVerlopen</c>. A job that fails is logged and left
-/// un-completed so Flowable redelivers it (§8.6). Split out from the hosted pump so the
-/// acquire→expire→complete logic is unit-testable without a running host. Mirrors
-/// <see cref="OpenZaakJobProcessor"/> and <see cref="BeoordelingEscalatieProcessor"/>.
-/// </summary>
-public sealed class RegistratieVerlopenProcessor(
-    IRegistratieVerlopenClient client,
-    ExpireRegistrationWorker worker,
-    ILogger<RegistratieVerlopenProcessor> logger)
-{
-    /// <summary>Acquire and process up to <paramref name="maxJobs"/> jobs. Returns the number acquired.</summary>
-    public async Task<int> PumpOnceAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var jobs = await client.AcquireRegistratieVerlopenJobsAsync(maxJobs, ct);
-
-        foreach (var job in jobs)
-        {
-            try
-            {
-                await worker.HandleAsync(job, ct);
-                await client.CompleteRegistratieVerlopenJobAsync(job.JobId, ct);
-            }
-            catch (Exception ex)
-            {
-                // Leave the job un-completed: its lock expires and Flowable redelivers it (§8.6).
-                logger.LogError(ex, "RegistratieVerlopen job {JobId} failed; leaving it for redelivery.", job.JobId);
-            }
-        }
-
-        return jobs.Count;
-    }
-}
@@ -1,49 +0,0 @@
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// The hosted polling loop of the document-timeout worker (S-10a, ADR-0017): on an interval it
-/// resolves a scoped <see cref="RegistratieVerlopenProcessor"/> and asks it to drain the parked
-/// <c>RegistratieVerlopen</c> jobs. A deliberately thin shell — all acquire/expire/complete logic
-/// lives in the processor, which is unit-tested; this class only owns the timer, the per-tick scope,
-/// and loop resilience. Structurally identical to <see cref="BeoordelingEscalatiePump"/>.
-/// </summary>
-public sealed class RegistratieVerlopenPump(
-    IServiceScopeFactory scopeFactory,
-    FlowableOptions options,
-    ILogger<RegistratieVerlopenPump> logger) : BackgroundService
-{
-    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
-    {
-        while (!stoppingToken.IsCancellationRequested)
-        {
-            try
-            {
-                using var scope = scopeFactory.CreateScope();
-                var processor = scope.ServiceProvider.GetRequiredService<RegistratieVerlopenProcessor>();
-                await processor.PumpOnceAsync(options.MaxJobsPerPoll, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-            catch (Exception ex)
-            {
-                // A transient fault (e.g. Flowable briefly unreachable) must not kill the loop.
-                logger.LogError(ex, "RegistratieVerlopen job poll failed; retrying after the poll interval.");
-            }
-
-            try
-            {
-                await Task.Delay(options.PollInterval, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-        }
-    }
-}
--- a/Show More
+++ b/Show More