S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

services/event-subscriber/EventSubscriber.Api/Program.cs

@@ -54,9 +54,9 @@ await app.RunAsync();
 
 /// <summary>The NRC notification body, as Open Notificaties POSTs it. Only the fields the
 /// projection needs are bound; <c>aanmaakdatum</c>/<c>kenmerken</c> are ignored for the minimal slice.</summary>
-public sealed record NotificationDto(string Kanaal, string Resource, string Actie, Uri ResourceUrl)
+public sealed record NotificationDto(string Kanaal, string Resource, string Actie, Uri ResourceUrl, Uri? HoofdObject = null)
 {
-    public Notification ToNotification() => new(Kanaal, Resource, Actie, ResourceUrl);
+    public Notification ToNotification() => new(Kanaal, Resource, Actie, ResourceUrl, HoofdObject);
 }
 
 public partial class Program

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -11,14 +11,23 @@ public sealed record Notification(
     string Kanaal,
     string Resource,
     string Actie,
-    Uri ResourceUrl)
+    Uri ResourceUrl,
+    Uri? HoofdObject = null)
 {
-    /// <summary>The only event the walking-skeleton projection reacts to: a zaak being created.</summary>
+    /// <summary>A zaak being created — projected as INGEDIEND.</summary>
     public bool IsZaakCreated =>
         Kanaal == "zaken" && Resource == "zaak" && Actie == "create";
 
-    /// <summary>The zaak UUID — the trailing path segment of the resource URL — used as the projection key.</summary>
-    public string ZaakId => ResourceUrl.Segments[^1].Trim('/');
+    /// <summary>A status being set on a zaak — the approval, projected as INGESCHREVEN (S-09b). In the
+    /// walking skeleton the only status ever set after creation is the approval, and the subscriber may
+    /// not read OpenZaak (§8.1), so any status-create is taken as the approval.</summary>
+    public bool IsZaakStatusSet =>
+        Kanaal == "zaken" && Resource == "status" && Actie == "create";
+
+    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
+    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
+    /// resource URL) — see the NRC payload note.</summary>
+    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -7,13 +7,15 @@ namespace EventSubscriber.Application;
 /// </summary>
 public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
 {
-    /// <summary>Handle one inbound notification. Ignores anything that is not a zaak-created event.</summary>
+    /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
+    /// status being set (INGESCHREVEN); ignores everything else.</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
-        if (!notification.IsZaakCreated)
+        if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
-        var recorded = new RecordedNotification(notification.IdempotencyKey, notification.Actie, notification.ZaakId);
+        var recorded = new RecordedNotification(
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -31,8 +33,10 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
             await store.UpsertAsync(ToEntry(recorded), ct);
     }
 
-    /// <summary>The minimal projection row for an accepted notification. A zaak-create maps to
-    /// INGEDIEND; bsn/naam are deferred (ADR-0008).</summary>
+    /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
+    /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, RegistrationStatus.Ingediend);
+        => new(recorded.ZaakId, recorded.Resource == "status"
+            ? RegistrationStatus.Ingeschreven
+            : RegistrationStatus.Ingediend);
 }

services/event-subscriber/EventSubscriber.Application/Ports.cs

@@ -19,8 +19,10 @@ public interface INotificationLog
     Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default);
 }
 
-/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its projection row.</summary>
-public sealed record RecordedNotification(string Key, string Actie, string ZaakId);
+/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its
+/// projection row — including the ZGW <c>resource</c>, which distinguishes a zaak-create (INGEDIEND)
+/// from a status-set (INGESCHREVEN) so a rebuild reproduces the right status.</summary>
+public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource);
 
 /// <summary>The read projection store. Owned by the projection bounded context (ADR-0008); the
 /// subscriber writes to it and the projection-api reads it.</summary>

services/event-subscriber/EventSubscriber.Application/RegisterEntry.cs

@@ -17,4 +17,7 @@ public static class RegistrationStatus
 {
     /// <summary>A zaak has been created; the registration is submitted.</summary>
     public const string Ingediend = "INGEDIEND";
+
+    /// <summary>The registration has been approved and entered in the register (S-09b).</summary>
+    public const string Ingeschreven = "INGESCHREVEN";
 }

services/event-subscriber/EventSubscriber.Tests/NotificationProjectorTests.cs

@@ -8,6 +8,7 @@ namespace EventSubscriber.Tests;
 public sealed class NotificationProjectorTests
 {
     private const string ZaakUrl = "http://openzaak:8000/zaken/api/v1/zaken/11111111-1111-1111-1111-111111111111";
+    private const string StatusUrl = "http://openzaak:8000/zaken/api/v1/statussen/22222222-2222-2222-2222-222222222222";
 
     private readonly InMemoryNotificationLog _log = new();
     private readonly InMemoryProjectionStore _store = new();
@@ -17,6 +18,10 @@ public sealed class NotificationProjectorTests
     private static Notification ZaakCreated(string url = ZaakUrl)
         => new("zaken", "zaak", "create", new Uri(url));
 
+    // A status-set notification: resourceUrl is the status resource, hoofdObject is the zaak it belongs to.
+    private static Notification StatusSet(string zaakUrl = ZaakUrl, string statusUrl = StatusUrl)
+        => new("zaken", "status", "create", new Uri(statusUrl), new Uri(zaakUrl));
+
     [Fact]
     public async Task creating_a_zaak_writes_one_row_with_status_ingediend()
     {
@@ -62,16 +67,53 @@ public sealed class NotificationProjectorTests
     [Theory]
     [InlineData("documenten", "enkelvoudiginformatieobject", "create")] // wrong kanaal + resource
     [InlineData("documenten", "zaak", "create")]                        // wrong kanaal only
-    [InlineData("zaken", "status", "create")]                           // wrong resource only
     [InlineData("zaken", "zaak", "update")]                             // wrong actie
     [InlineData("zaken", "zaak", "destroy")]                            // wrong actie
-    public async Task only_a_zaken_zaak_create_notification_is_projected(string kanaal, string resource, string actie)
+    [InlineData("zaken", "status", "update")]                           // a status change we ignore
+    [InlineData("zaken", "resultaat", "create")]                        // not a status we project
+    public async Task an_unrelated_notification_is_not_projected(string kanaal, string resource, string actie)
     {
         await Projector().HandleAsync(new Notification(kanaal, resource, actie, new Uri(ZaakUrl)));
 
         Assert.Empty(await _store.AllAsync());
     }
 
+    [Fact]
+    public async Task setting_a_status_projects_ingeschreven_keyed_on_the_zaak_not_the_status()
+    {
+        await Projector().HandleAsync(StatusSet());
+
+        var entry = Assert.Single(await _store.AllAsync());
+        // Keyed on the zaak (hoofdObject), not the status resource URL.
+        Assert.Equal("11111111-1111-1111-1111-111111111111", entry.Id);
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
+    [Fact]
+    public async Task approving_updates_the_existing_zaak_row_from_ingediend_to_ingeschreven()
+    {
+        var projector = Projector();
+        await projector.HandleAsync(ZaakCreated());
+        await projector.HandleAsync(StatusSet());
+
+        var entry = Assert.Single(await _store.AllAsync());
+        Assert.Equal("11111111-1111-1111-1111-111111111111", entry.Id);
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
+    [Fact]
+    public async Task rebuild_reproduces_the_approved_status()
+    {
+        var projector = Projector();
+        await projector.HandleAsync(ZaakCreated());
+        await projector.HandleAsync(StatusSet());
+
+        await projector.RebuildAsync();
+
+        var entry = Assert.Single(await _store.AllAsync());
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
     [Fact]
     public async Task rebuild_clears_stale_rows_and_repopulates_from_the_notification_log()
     {