test(acl,domain): cover the approval-flow mutants to hold the ratchet (refs #75)

The new gateway/use-case code left surviving mutants (empty NoCoverage on the ACL
gateway status-set, plus unasserted error messages, null-guards, and the persist
call). Add stub-handler tests for SetZaakToEindstatusAsync (eindstatus resolution,
POST framing, failure paths) and assert the approve use case's messages, null
handling and SaveAsync. Local Stryker: acl 100%, domain 98.4%, event-subscriber 100%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/AclHttpClientTests.cs

@@ -64,4 +64,14 @@ public class AclHttpClientTests
         await Assert.ThrowsAsync<HttpRequestException>(
             () => client.ApproveZaakAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
     }
+
+    [Fact]
+    public async Task Approve_rejects_a_null_zaak_url_without_sending_a_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.NoContent));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => client.ApproveZaakAsync(null!));
+        Assert.Null(capture.Seen);
+    }
 }

services/domain/Big.Tests/ApproveRegistrationTests.cs

@@ -27,6 +27,19 @@ public class ApproveRegistrationTests
         Assert.Equal(RegistrationStatus.Ingeschreven, saved!.Status);
         Assert.Equal(FakeAclClient.DefaultZaakUrl, acl.ApprovedZaakUrl);
         Assert.Equal(1, acl.ApproveCallCount);
+        // The approved aggregate is persisted (not just mutated in memory).
+        Assert.Equal(1, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Rejects_a_null_command_without_touching_the_store_or_acl()
+    {
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        var handler = new ApproveRegistration(store, acl);
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
+        Assert.Equal(0, acl.ApproveCallCount);
     }
 
     [Fact]
@@ -36,8 +49,9 @@ public class ApproveRegistrationTests
         var acl = new FakeAclClient();
         var handler = new ApproveRegistration(store, acl);
 
-        await Assert.ThrowsAsync<InvalidOperationException>(
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
             () => handler.HandleAsync(new ApproveRegistrationCommand(RegistrationId.New())));
+        Assert.Contains("No registration", ex.Message);
         Assert.Equal(0, acl.ApproveCallCount);
     }
 
@@ -50,8 +64,9 @@ public class ApproveRegistrationTests
         store.Seed(registration);
         var handler = new ApproveRegistration(store, acl);
 
-        await Assert.ThrowsAsync<InvalidOperationException>(
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
             () => handler.HandleAsync(new ApproveRegistrationCommand(registration.Id)));
+        Assert.Contains("no zaak", ex.Message);
         Assert.Equal(0, acl.ApproveCallCount);
     }
 

services/domain/Big.Tests/RegistrationTests.cs

@@ -117,7 +117,8 @@ public class RegistrationTests
         registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
         registration.Approve();
 
-        Assert.Throws<InvalidOperationException>(() => registration.Approve());
+        var ex = Assert.Throws<InvalidOperationException>(() => registration.Approve());
+        Assert.Contains("only an INGEDIEND", ex.Message);
         Assert.Equal(RegistrationStatus.Ingeschreven, registration.Status);
     }
 }