feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

services/acl/Acl.Api/Program.cs

@@ -20,7 +20,7 @@ app.MapGet("/health", () => "Healthy");
 // The ACL's single operation, exposed as a service endpoint.
 app.MapPost("/zaken", async (OpenZaakRequest body, AclService acl, CancellationToken ct) =>
 {
-    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn), ct);
+    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn, body.Reference), ct);
     return Results.Ok(new { zaakUrl = zaakUrl.ToString() });
 });
 
@@ -32,10 +32,20 @@ app.MapPost("/statussen", async (SetStatusRequest body, AclService acl, Cancella
     return Results.NoContent();
 });
 
+// Read a zaak's public-safe reference (its identificatie). The Event Subscriber calls this to enrich
+// the read projection without reading ZGW itself (§8.1, #78).
+app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl, CancellationToken ct) =>
+{
+    var reference = await acl.GetZaakReferenceAsync(new Uri(body.ZaakUrl), ct);
+    return Results.Ok(new { reference });
+});
+
 app.Run();
 
-public sealed record OpenZaakRequest(string Bsn);
+public sealed record OpenZaakRequest(string Bsn, string Reference);
 
 public sealed record SetStatusRequest(string ZaakUrl);
 
+public sealed record ZaakReferenceRequest(string ZaakUrl);
+
 public partial class Program;

services/acl/Acl.Application/AclService.cs

@@ -13,7 +13,8 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, ICloc
             defaults.VerantwoordelijkeOrganisatie,
             defaults.Vertrouwelijkheidaanduiding,
             defaults.ZaaktypeUrl,
-            clock.Today);
+            clock.Today,
+            registration.Reference);
 
         return gateway.OpenZaakAsync(request, ct);
     }
@@ -28,4 +29,12 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, ICloc
 
         return gateway.SetZaakToEindstatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
     }
+
+    /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
+    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        return gateway.GetZaakIdentificatieAsync(zaakUrl, ct);
+    }
 }

services/acl/Acl.Application/DomainRegistration.cs

@@ -1,4 +1,5 @@
 namespace Acl.Application;
 
-/// <summary>Domain-language payload handed to the ACL. No ZGW concepts here.</summary>
-public sealed record DomainRegistration(string Bsn);
+/// <summary>Domain-language payload handed to the ACL. No ZGW concepts here. <see cref="Reference"/>
+/// is the registration's own id; the ACL records it as the zaak identificatie (adr-proposal #78).</summary>
+public sealed record DomainRegistration(string Bsn, string Reference);

services/acl/Acl.Application/IZaakGateway.cs

@@ -12,4 +12,8 @@ public interface IZaakGateway
     /// the catalogus and POSTs a status against the zaak, dated <paramref name="datumStatusGezet"/>.
     /// </summary>
     Task SetZaakToEindstatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
+
+    /// <summary>Read the zaak's <c>identificatie</c> — the public-safe reference the register shows.
+    /// The Event Subscriber calls this through the ACL rather than reading ZGW itself (§8.1, #78).</summary>
+    Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default);
 }

services/acl/Acl.Application/ZaakRequest.cs

@@ -6,4 +6,5 @@ public sealed record ZaakRequest(
     string VerantwoordelijkeOrganisatie,
     string Vertrouwelijkheidaanduiding,
     Uri Zaaktype,
-    DateOnly Startdatum);
+    DateOnly Startdatum,
+    string Identificatie);

services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -20,7 +20,8 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
                 request.Zaaktype.ToString(),
                 request.VerantwoordelijkeOrganisatie,
                 request.Startdatum.ToString("yyyy-MM-dd"),
-                request.Vertrouwelijkheidaanduiding)),
+                request.Vertrouwelijkheidaanduiding,
+                request.Identificatie)),
         };
         message.Headers.Authorization =
             new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
@@ -61,6 +62,24 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
             "Setting the zaak status", ct);
     }
 
+    public async Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        using var message = new HttpRequestMessage(HttpMethod.Get, zaakUrl);
+        message.Headers.Authorization =
+            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
+        // The zaak is a geo resource; the Zaken API requires the CRS header even on GET.
+        message.Headers.Add("Accept-Crs", "EPSG:4326");
+
+        using var response = await http.SendAsync(message, ct);
+        await EnsureSuccessAsync(response, "Reading the zaak", ct);
+
+        var zaak = await response.Content.ReadFromJsonAsync<ZaakReadDto>(ct)
+            ?? throw new InvalidOperationException("OpenZaak returned an empty zaak response");
+        return zaak.Identificatie;
+    }
+
     // POSTs a non-geo ZGW resource (resultaat/status — no CRS headers). Buffers the body so uwsgi gets
     // a Content-Length instead of a chunked body (as with zaak-create).
     private async Task PostAsync(string path, object dto, string action, CancellationToken ct)
@@ -132,11 +151,15 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         [property: JsonPropertyName("zaaktype")] string Zaaktype,
         [property: JsonPropertyName("verantwoordelijkeOrganisatie")] string VerantwoordelijkeOrganisatie,
         [property: JsonPropertyName("startdatum")] string Startdatum,
-        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding);
+        [property: JsonPropertyName("vertrouwelijkheidaanduiding")] string Vertrouwelijkheidaanduiding,
+        [property: JsonPropertyName("identificatie")] string Identificatie);
 
     private sealed record ZaakCreatedDto(
         [property: JsonPropertyName("url")] string Url);
 
+    private sealed record ZaakReadDto(
+        [property: JsonPropertyName("identificatie")] string Identificatie);
+
     private sealed record StatusDto(
         [property: JsonPropertyName("zaak")] string Zaak,
         [property: JsonPropertyName("statustype")] string Statustype,

services/acl/Acl.IntegrationTests/OpenZaakGatewayIntegrationTests.cs

@@ -22,12 +22,14 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             "seed it with OZ_PUBLISH=1 (`make integration` does this).");
 
         var gateway = new OpenZaakGateway(stack.Http, stack.Options);
+        var reference = Guid.NewGuid().ToString(); // zaak identificatie must be unique per bronorganisatie
         var request = new ZaakRequest(
             Bronorganisatie: "517439943",
             VerantwoordelijkeOrganisatie: "517439943",
             Vertrouwelijkheidaanduiding: "openbaar",
             Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow));
+            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
+            Identificatie: reference);
 
         var zaakUrl = await gateway.OpenZaakAsync(request);
 
@@ -36,11 +38,12 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             new Uri(stack.BaseUrl, "/zaken/api/v1/zaken/").ToString(),
             zaakUrl.ToString());
 
-        // ...and that zaak is really persisted with the default-filled fields.
+        // ...and that zaak is really persisted with the default-filled fields + the reference identificatie.
         var zaak = await stack.GetZaakAsync(zaakUrl);
         Assert.Equal(zaaktype.ToString(), zaak.GetProperty("zaaktype").GetString());
         Assert.Equal("517439943", zaak.GetProperty("bronorganisatie").GetString());
         Assert.Equal("openbaar", zaak.GetProperty("vertrouwelijkheidaanduiding").GetString());
+        Assert.Equal(reference, zaak.GetProperty("identificatie").GetString());
     }
 
     [Fact]
@@ -57,7 +60,8 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             VerantwoordelijkeOrganisatie: "517439943",
             Vertrouwelijkheidaanduiding: "openbaar",
             Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow)));
+            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
+            Identificatie: Guid.NewGuid().ToString()));
 
         await gateway.SetZaakToEindstatusAsync(zaakUrl, zaaktype!, DateOnly.FromDateTime(DateTime.UtcNow));
 

services/acl/Acl.Tests/AclServiceTests.cs

@@ -22,6 +22,14 @@ public class AclServiceTests
             Approved = (zaakUrl, zaaktypeUrl, datumStatusGezet);
             return Task.CompletedTask;
         }
+
+        public Uri? ReadReferenceFor;
+
+        public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
+        {
+            ReadReferenceFor = zaakUrl;
+            return Task.FromResult("REG-FROM-ZAAK");
+        }
     }
 
     private static AclDefaults Defaults() => new()
@@ -50,7 +58,7 @@ public class AclServiceTests
         };
         var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
 
-        var url = await service.OpenZaakAsync(new DomainRegistration("123456782"));
+        var url = await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-77"));
 
         Assert.Equal(gateway.Result, url);
         var req = Assert.IsType<ZaakRequest>(gateway.Captured);
@@ -59,6 +67,8 @@ public class AclServiceTests
         Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
         Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
         Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
+        // The registration reference becomes the zaak identificatie (#78).
+        Assert.Equal("reg-77", req.Identificatie);
     }
 
     [Fact]
@@ -103,4 +113,27 @@ public class AclServiceTests
         await Assert.ThrowsAsync<ArgumentNullException>(() => service.ApproveZaakAsync(null!));
         Assert.Null(gateway.Approved);
     }
+
+    [Fact]
+    public async Task Reading_a_zaak_reference_returns_the_zaaks_identificatie()
+    {
+        var gateway = new FakeGateway();
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
+
+        var reference = await service.GetZaakReferenceAsync(zaak);
+
+        Assert.Equal("REG-FROM-ZAAK", reference);
+        Assert.Equal(zaak, gateway.ReadReferenceFor);
+    }
+
+    [Fact]
+    public async Task Reading_a_null_zaak_reference_is_rejected()
+    {
+        var gateway = new FakeGateway();
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetZaakReferenceAsync(null!));
+        Assert.Null(gateway.ReadReferenceFor);
+    }
 }

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -22,7 +22,7 @@ public class OpenZaakGatewayTests
 
     private static ZaakRequest SampleRequest() => new(
         "517439943", "517439943", "openbaar",
-        new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4));
+        new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4), "REG-REF-1");
 
     private static StubHandler Created(out RequestCapture capture)
     {
@@ -67,6 +67,8 @@ public class OpenZaakGatewayTests
         Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", capture.Body);
         Assert.Contains("\"startdatum\":\"2026-06-04\"", capture.Body);
         Assert.Contains("\"zaaktype\":\"http://openzaak/catalogi/api/v1/zaaktypen/big\"", capture.Body);
+        // The registration reference is set as the zaak identificatie (#78).
+        Assert.Contains("\"identificatie\":\"REG-REF-1\"", capture.Body);
     }
 
     [Fact]
@@ -357,6 +359,61 @@ public class OpenZaakGatewayTests
         Assert.Equal(4, rec.Requests.Count);
     }
 
+    [Fact]
+    public async Task Reading_a_zaak_returns_its_identificatie_with_bearer_and_crs()
+    {
+        RequestCapture? capture = null;
+        var handler = new StubHandler(req =>
+        {
+            capture = new RequestCapture { Seen = req };
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = JsonContent.Create(new { identificatie = "REG-XYZ", url = ZaakUrl }),
+            });
+        });
+
+        var reference = await Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl));
+
+        Assert.Equal("REG-XYZ", reference);
+        Assert.Equal(HttpMethod.Get, capture!.Seen!.Method);
+        Assert.Equal(ZaakUrl, capture.Seen.RequestUri!.ToString());
+        Assert.Equal("Bearer", capture.Seen.Headers.Authorization!.Scheme);
+        Assert.Equal("EPSG:4326", Assert.Single(capture.Seen.Headers.GetValues("Accept-Crs")));
+    }
+
+    [Fact]
+    public async Task Reading_a_zaak_throws_when_openzaak_rejects_it()
+    {
+        var handler = new StubHandler(_ =>
+            Task.FromResult(new HttpResponseMessage(HttpStatusCode.NotFound) { Content = new StringContent("nope") }));
+
+        var ex = await Assert.ThrowsAsync<HttpRequestException>(
+            () => Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl)));
+        Assert.Contains("Reading the zaak", ex.Message);
+    }
+
+    [Fact]
+    public async Task Reading_a_zaak_throws_when_openzaak_returns_an_empty_body()
+    {
+        var handler = new StubHandler(_ =>
+            Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent("null", System.Text.Encoding.UTF8, "application/json"),
+            }));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl)));
+        Assert.Contains("empty zaak response", ex.Message);
+    }
+
+    [Fact]
+    public async Task Reading_a_null_zaak_is_rejected()
+    {
+        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => Gateway(handler).GetZaakIdentificatieAsync(null!));
+    }
+
     [Fact]
     public async Task Approving_rejects_a_null_zaak_or_zaaktype()
     {

services/bff/Bff.Api/DownstreamClients.cs

@@ -6,11 +6,12 @@ namespace Bff.Api;
 public sealed record SubmitAccepted(string RegistrationId, string Status);
 
 /// <summary>A projection row as the projection-api serves it. <c>Bsn</c>/<c>NaamPlaceholder</c> are
-/// read but never surfaced by the openbaar endpoint (public-safe filtering, ADR-0010/S-09).</summary>
-public sealed record ProjectionEntry(string Id, string Status, string? Bsn, string? NaamPlaceholder);
+/// read but never surfaced by the openbaar endpoint (public-safe filtering, ADR-0010/S-09).
+/// <c>Reference</c> is the public-safe citizen reference (the zaak identificatie, #78).</summary>
+public sealed record ProjectionEntry(string Id, string Status, string? Reference, string? Bsn, string? NaamPlaceholder);
 
 /// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
-public sealed record OpenbaarEntry(string Id, string Status);
+public sealed record OpenbaarEntry(string Id, string Status, string? Reference);
 
 /// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
 public interface IDomainClient

services/bff/Bff.Api/OpenbaarProjection.cs

@@ -11,8 +11,10 @@ public static class OpenbaarProjection
     {
         var filtered = string.IsNullOrWhiteSpace(q)
             ? entries
-            : entries.Where(e => e.Id.Contains(q, StringComparison.OrdinalIgnoreCase));
+            : entries.Where(e =>
+                e.Id.Contains(q, StringComparison.OrdinalIgnoreCase) ||
+                (e.Reference?.Contains(q, StringComparison.OrdinalIgnoreCase) ?? false));
 
-        return [.. filtered.Select(e => new OpenbaarEntry(e.Id, e.Status))];
+        return [.. filtered.Select(e => new OpenbaarEntry(e.Id, e.Status, e.Reference))];
     }
 }

services/bff/Bff.Tests/OpenbaarEndpointTests.cs

@@ -10,7 +10,7 @@ public class OpenbaarEndpointTests
     public async Task Serves_public_safe_rows_anonymously()
     {
         using var factory = new BffFactory();
-        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "123456782", "Jan"));
+        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", "123456782", "Jan"));
 
         // No Authorization header — the openbaar register is a public lookup (ADR-0010/S-09).
         var response = await factory.CreateClient().GetAsync("/openbaar/register");
@@ -19,7 +19,9 @@ public class OpenbaarEndpointTests
         var body = await response.Content.ReadAsStringAsync();
         Assert.Contains("abc-111", body);
         Assert.Contains("INGEDIEND", body);
-        // The bsn must never appear in a public response.
+        // The public reference is surfaced (matches the submit confirmation, #78)...
+        Assert.Contains("REG-abc", body);
+        // ...but the bsn must never appear in a public response.
         Assert.DoesNotContain("123456782", body);
     }
 
@@ -27,8 +29,8 @@ public class OpenbaarEndpointTests
     public async Task Filters_by_the_query_parameter()
     {
         using var factory = new BffFactory();
-        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", null, null));
-        factory.Projection.Entries.Add(new ProjectionEntry("def-222", "INGEDIEND", null, null));
+        factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", null, null));
+        factory.Projection.Entries.Add(new ProjectionEntry("def-222", "INGEDIEND", "REG-def", null, null));
 
         var rows = await factory.CreateClient()
             .GetFromJsonAsync<List<OpenbaarEntry>>("/openbaar/register?q=abc");

services/bff/Bff.Tests/OpenbaarProjectionTests.cs

@@ -6,8 +6,8 @@ public class OpenbaarProjectionTests
 {
     private static readonly ProjectionEntry[] Sample =
     [
-        new("abc-111", "INGEDIEND", "123456782", "Jan"),
-        new("def-222", "INGEDIEND", "987654321", "Piet"),
+        new("abc-111", "INGEDIEND", Reference: "REG-A", Bsn: "123456782", NaamPlaceholder: "Jan"),
+        new("def-222", "INGESCHREVEN", Reference: "REG-B", Bsn: "987654321", NaamPlaceholder: "Piet"),
     ];
 
     [Fact]
@@ -18,31 +18,47 @@ public class OpenbaarProjectionTests
         Assert.Equal(2, view.Count);
         Assert.Equal("abc-111", view[0].Id);
         Assert.Equal("INGEDIEND", view[0].Status);
+        // The public reference (zaak identificatie) is surfaced so it matches the submit confirmation (#78).
+        Assert.Equal("REG-A", view[0].Reference);
     }
 
     [Fact]
-    public void Public_view_exposes_only_id_and_status()
+    public void Public_view_exposes_only_id_status_and_reference()
     {
-        // OpenbaarEntry structurally carries only Id + Status — bsn/naam can never leak.
+        // OpenbaarEntry structurally carries only public-safe fields — bsn/naam can never leak.
         var props = typeof(OpenbaarEntry).GetProperties().Select(p => p.Name).ToArray();
-        Assert.Equal(["Id", "Status"], props);
+        Assert.Equal(["Id", "Status", "Reference"], props);
     }
 
     [Theory]
-    [InlineData("abc", 1)]
-    [InlineData("ABC", 1)]
-    [InlineData("2", 1)]
-    [InlineData("zzz", 0)]
+    [InlineData("abc", 1)]   // by id
+    [InlineData("ABC", 1)]   // by id, case-insensitive
+    [InlineData("def", 1)]   // by id
+    [InlineData("zzz", 0)]   // no match
     public void Filters_by_id_containing_the_query_case_insensitively(string q, int expected)
-    {
-        var view = OpenbaarProjection.PublicView(Sample, q);
+        => Assert.Equal(expected, OpenbaarProjection.PublicView(Sample, q).Count);
 
-        Assert.Equal(expected, view.Count);
-    }
+    [Theory]
+    [InlineData("REG-A", 1)] // by reference — the citizen's confirmation reference
+    [InlineData("reg-a", 1)] // by reference, case-insensitive
+    [InlineData("REG", 2)]   // both share the prefix
+    public void Filters_by_reference_containing_the_query_case_insensitively(string q, int expected)
+        => Assert.Equal(expected, OpenbaarProjection.PublicView(Sample, q).Count);
 
     [Fact]
     public void Blank_query_is_treated_as_no_filter()
     {
         Assert.Equal(2, OpenbaarProjection.PublicView(Sample, "   ").Count);
     }
+
+    [Fact]
+    public void A_row_without_a_reference_never_matches_a_query()
+    {
+        // Older rows can have a null reference (the column is additive, #78/ADR-0012). A search must
+        // simply not match them — it must not throw and must not treat "no reference" as a match.
+        var entries = new[] { new ProjectionEntry("xyz-999", "INGEDIEND", Reference: null, Bsn: null, NaamPlaceholder: null) };
+
+        Assert.Empty(OpenbaarProjection.PublicView(entries, "REG"));
+        Assert.Equal("xyz-999", Assert.Single(OpenbaarProjection.PublicView(entries, "xyz")).Id);
+    }
 }

services/bff/openapi.json

@@ -67,7 +67,8 @@
       "OpenbaarEntry": {
         "required": [
           "id",
-          "status"
+          "status",
+          "reference"
         ],
         "type": "object",
         "properties": {
@@ -76,6 +77,12 @@
           },
           "status": {
             "type": "string"
+          },
+          "reference": {
+            "type": [
+              "null",
+              "string"
+            ]
           }
         }
       },
@@ -101,4 +108,4 @@
       "name": "Bff.Api"
     }
   ]
-}
+}

services/domain/Big.Application/OpenZaakWorker.cs

@@ -28,7 +28,7 @@ public sealed class OpenZaakWorker(IRegistrationStore store, IAclClient acl)
         if (registration.ZaakUrl is not null)
             return registration.ZaakUrl;
 
-        var zaakUrl = await acl.OpenZaakAsync(registration.Bsn, ct);
+        var zaakUrl = await acl.OpenZaakAsync(registration.Bsn, registration.Id.ToString(), ct);
         registration.AttachZaak(zaakUrl);
         await store.SaveAsync(registration, ct);
         return zaakUrl;

services/domain/Big.Application/Ports.cs

@@ -24,7 +24,10 @@ public interface IWorkflowClient
 /// </summary>
 public interface IAclClient
 {
-    Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default);
+    /// <summary>Open a zaak for the registration. <paramref name="reference"/> is the registration's
+    /// own reference (its id); the ACL records it as the zaak's identificatie so the openbaar register
+    /// can show the same reference the zorgprofessional was given (S-09b follow-up, adr-proposal #78).</summary>
+    Task<Uri> OpenZaakAsync(string bsn, string reference, CancellationToken ct = default);
 
     /// <summary>
     /// Record the approval on the given zaak. The ACL translates this to the ZGW concept — setting

services/domain/Big.Infrastructure/AclHttpClient.cs

@@ -11,10 +11,10 @@ namespace Big.Infrastructure;
 /// </summary>
 public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclClient
 {
-    public async Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    public async Task<Uri> OpenZaakAsync(string bsn, string reference, CancellationToken ct = default)
     {
         using var response = await http.PostAsJsonAsync(
-            new Uri(options.BaseUrl, "zaken"), new OpenZaakRequest(bsn), ct);
+            new Uri(options.BaseUrl, "zaken"), new OpenZaakRequest(bsn, reference), ct);
         response.EnsureSuccessStatusCode();
 
         var opened = await response.Content.ReadFromJsonAsync<OpenZaakResponse>(ct)
@@ -31,7 +31,9 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
         response.EnsureSuccessStatusCode();
     }
 
-    private sealed record OpenZaakRequest([property: JsonPropertyName("bsn")] string Bsn);
+    private sealed record OpenZaakRequest(
+        [property: JsonPropertyName("bsn")] string Bsn,
+        [property: JsonPropertyName("reference")] string Reference);
 
     private sealed record OpenZaakResponse([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
 

services/domain/Big.Tests/AclHttpClientTests.cs

@@ -15,12 +15,13 @@ public class AclHttpClientTests
         var client = Client(capture.Responds(HttpStatusCode.OK,
             """{"zaakUrl":"http://openzaak/zaken/api/v1/zaken/abc"}"""));
 
-        var url = await client.OpenZaakAsync("123456782");
+        var url = await client.OpenZaakAsync("123456782", "reg-42");
 
         Assert.Equal("http://openzaak/zaken/api/v1/zaken/abc", url.ToString());
         Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
         Assert.Equal("http://acl/zaken", capture.Seen.RequestUri!.ToString());
         Assert.Contains("\"bsn\":\"123456782\"", capture.Body);
+        Assert.Contains("\"reference\":\"reg-42\"", capture.Body);
     }
 
     [Fact]
@@ -29,7 +30,7 @@ public class AclHttpClientTests
         var capture = new RequestCapture();
         var client = Client(capture.Responds(HttpStatusCode.BadGateway));
 
-        await Assert.ThrowsAsync<HttpRequestException>(() => client.OpenZaakAsync("123456782"));
+        await Assert.ThrowsAsync<HttpRequestException>(() => client.OpenZaakAsync("123456782", "reg-1"));
     }
 
     [Fact]
@@ -38,7 +39,7 @@ public class AclHttpClientTests
         var capture = new RequestCapture();
         var client = Client(capture.Responds(HttpStatusCode.OK, "null"));
 
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.OpenZaakAsync("123456782"));
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() => client.OpenZaakAsync("123456782", "reg-1"));
         Assert.Contains("empty", ex.Message, StringComparison.OrdinalIgnoreCase);
     }
 

services/domain/Big.Tests/Fakes.cs

@@ -50,15 +50,17 @@ internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
     private readonly Uri _zaakUrl = zaakUrl ?? DefaultZaakUrl;
 
     public string? OpenedForBsn { get; private set; }
+    public string? OpenedWithReference { get; private set; }
     public int CallCount { get; private set; }
 
     public Uri? ApprovedZaakUrl { get; private set; }
     public int ApproveCallCount { get; private set; }
 
-    public Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    public Task<Uri> OpenZaakAsync(string bsn, string reference, CancellationToken ct = default)
     {
         CallCount++;
         OpenedForBsn = bsn;
+        OpenedWithReference = reference;
         return Task.FromResult(_zaakUrl);
     }
 

services/domain/Big.Tests/OpenZaakWorkerTests.cs

@@ -25,6 +25,9 @@ public class OpenZaakWorkerTests
 
         Assert.Equal(FakeAclClient.DefaultZaakUrl, zaakUrl);
         Assert.Equal("123456782", acl.OpenedForBsn);
+        // The registration's own id is handed to the ACL as the zaak reference (identificatie),
+        // so the openbaar register can show the reference the zorgprofessional received (#78).
+        Assert.Equal(registration.Id.ToString(), acl.OpenedWithReference);
         var saved = await store.GetAsync(registration.Id);
         Assert.Equal(FakeAclClient.DefaultZaakUrl, saved!.ZaakUrl);
         Assert.Equal(1, store.SaveCount);

services/event-subscriber/EventSubscriber.Api/AclHttpClient.cs

@@ -0,0 +1,30 @@
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using EventSubscriber.Application;
+
+namespace EventSubscriber.Api;
+
+/// <summary>
+/// HTTP client to the ACL service. The subscriber enriches the projection with the zaak's reference
+/// (identificatie) by asking the ACL — the only code that may read ZGW (§8.1) — rather than reading
+/// OpenZaak itself (adr-proposal #78).
+/// </summary>
+public sealed class AclHttpClient(HttpClient http) : IAclClient
+{
+    public async Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        using var response = await http.PostAsJsonAsync(
+            new Uri(http.BaseAddress!, "zaken/reference"), new ReferenceRequest(zaakUrl.ToString()), ct);
+        response.EnsureSuccessStatusCode();
+
+        var body = await response.Content.ReadFromJsonAsync<ReferenceResponse>(ct)
+            ?? throw new InvalidOperationException("The ACL returned an empty reference response.");
+        return body.Reference;
+    }
+
+    private sealed record ReferenceRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
+
+    private sealed record ReferenceResponse([property: JsonPropertyName("reference")] string Reference);
+}

services/event-subscriber/EventSubscriber.Api/Program.cs

@@ -11,9 +11,15 @@ var connectionString = builder.Configuration.GetConnectionString("Projection")
 // this value (ADR-0007), so the webhook enforces it.
 var webhookToken = builder.Configuration["EventSubscriber:Webhook:AuthToken"]
     ?? throw new InvalidOperationException("Missing configuration 'EventSubscriber:Webhook:AuthToken'");
+// The ACL is the only code that may read ZGW (§8.1); the subscriber enriches the projection with the
+// zaak reference through it (adr-proposal #78).
+var aclBaseUrl = builder.Configuration["Acl:BaseUrl"]
+    ?? throw new InvalidOperationException("Missing configuration 'Acl:BaseUrl'");
 
 builder.Services.AddProjectionReadModel(connectionString);
 builder.Services.AddProjectionWriteSide();
+builder.Services.AddHttpClient<EventSubscriber.Application.IAclClient, EventSubscriber.Api.AclHttpClient>(
+    c => c.BaseAddress = new Uri(aclBaseUrl));
 
 var app = builder.Build();
 

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -24,10 +24,12 @@ public sealed record Notification(
     public bool IsZaakStatusSet =>
         Kanaal == "zaken" && Resource == "status" && Actie == "create";
 
-    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
-    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
-    /// resource URL) — see the NRC payload note.</summary>
-    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
+    /// <summary>The zaak URL this notification concerns — <c>hoofdObject</c> (the zaak) for a status
+    /// notification, else the resource URL (which, for a zaak-create, is the zaak).</summary>
+    public Uri ZaakUrl => HoofdObject ?? ResourceUrl;
+
+    /// <summary>The zaak UUID used as the projection key — the trailing segment of <see cref="ZaakUrl"/>.</summary>
+    public string ZaakId => ZaakUrl.Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -5,17 +5,19 @@ namespace EventSubscriber.Application;
 /// out-of-order deliveries (CLAUDE.md §8.6): the notification log dedups, and the projection
 /// upsert is idempotent on the zaak id. Rebuilds the projection by replaying the log.
 /// </summary>
-public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
+public sealed class NotificationProjector(INotificationLog log, IProjectionStore store, IAclClient acl)
 {
     /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
-    /// status being set (INGESCHREVEN); ignores everything else.</summary>
+    /// status being set (INGESCHREVEN); ignores everything else. Enriches the row with the zaak's
+    /// reference via the ACL (§8.1) and records it so a rebuild needs no ZGW access (#78).</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
         if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
+        var reference = await acl.GetZaakReferenceAsync(notification.ZaakUrl, ct);
         var recorded = new RecordedNotification(
-            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource, reference);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -36,7 +38,8 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
     /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
     /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, recorded.Resource == "status"
-            ? RegistrationStatus.Ingeschreven
-            : RegistrationStatus.Ingediend);
+        => new(
+            recorded.ZaakId,
+            recorded.Resource == "status" ? RegistrationStatus.Ingeschreven : RegistrationStatus.Ingediend,
+            Reference: recorded.Reference);
 }

services/event-subscriber/EventSubscriber.Application/Ports.cs

@@ -20,9 +20,20 @@ public interface INotificationLog
 }
 
 /// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its
-/// projection row — including the ZGW <c>resource</c>, which distinguishes a zaak-create (INGEDIEND)
-/// from a status-set (INGESCHREVEN) so a rebuild reproduces the right status.</summary>
-public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource);
+/// projection row — the ZGW <c>resource</c> (zaak-create → INGEDIEND vs status-set → INGESCHREVEN) and
+/// the zaak <c>reference</c> (identificatie), so a rebuild reproduces the row without re-reading ZGW (#78).</summary>
+public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource, string? Reference);
+
+/// <summary>
+/// Port to the Anti-Corruption Layer. The subscriber enriches the projection with the zaak's
+/// public-safe reference (its identificatie) by asking the ACL — the only code that may read ZGW
+/// (§8.1) — rather than reading OpenZaak itself (adr-proposal #78).
+/// </summary>
+public interface IAclClient
+{
+    /// <summary>The zaak's reference (identificatie) for the read projection.</summary>
+    Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default);
+}
 
 /// <summary>The read projection store. Owned by the projection bounded context (ADR-0008); the
 /// subscriber writes to it and the projection-api reads it.</summary>

services/event-subscriber/EventSubscriber.Application/RegisterEntry.cs

@@ -9,6 +9,7 @@ namespace EventSubscriber.Application;
 public sealed record RegisterEntry(
     string Id,
     string Status,
+    string? Reference = null,
     string? Bsn = null,
     string? NaamPlaceholder = null);
 

services/event-subscriber/EventSubscriber.Tests/AclHttpClientTests.cs

@@ -0,0 +1,86 @@
+using System.Net;
+using System.Text;
+using EventSubscriber.Api;
+
+namespace EventSubscriber.Tests;
+
+/// <summary>
+/// Unit tests for the subscriber's ACL client, which reads a zaak's reference (identificatie) through
+/// the ACL — the only code allowed to talk to ZGW (§8.1, #78). Uses a scripted message handler so no
+/// real ACL is required.
+/// </summary>
+public class AclHttpClientTests
+{
+    private static AclHttpClient Client(StubHandler handler) =>
+        new(new HttpClient(handler) { BaseAddress = new Uri("http://acl/") });
+
+    [Fact]
+    public async Task Reads_a_zaak_reference_by_posting_the_zaak_url_and_returns_it()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, """{"reference":"REG-42"}"""));
+
+        var reference = await client.GetZaakReferenceAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
+
+        Assert.Equal("REG-42", reference);
+        Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
+        Assert.Equal("http://acl/zaken/reference", capture.Seen.RequestUri!.ToString());
+        Assert.Contains("\"zaakUrl\":\"http://openzaak/zaken/api/v1/zaken/abc\"", capture.Body);
+    }
+
+    [Fact]
+    public async Task Throws_when_the_acl_rejects_the_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.BadGateway));
+
+        await Assert.ThrowsAsync<HttpRequestException>(
+            () => client.GetZaakReferenceAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
+    }
+
+    [Fact]
+    public async Task Throws_when_the_acl_returns_an_empty_body()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, "null"));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => client.GetZaakReferenceAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
+        Assert.Contains("empty", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Rejects_a_null_zaak_url_without_sending_a_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.OK, """{"reference":"REG-1"}"""));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => client.GetZaakReferenceAsync(null!));
+        Assert.Null(capture.Seen);
+    }
+}
+
+/// <summary>A test double for <see cref="HttpMessageHandler"/> that records the last request and
+/// returns a scripted response — mirrors the ACL/domain gateway tests.</summary>
+internal sealed class StubHandler(Func<HttpRequestMessage, Task<HttpResponseMessage>> onSend) : HttpMessageHandler
+{
+    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+        => onSend(request);
+}
+
+/// <summary>Captures the request a client sent, including the (buffered) body.</summary>
+internal sealed class RequestCapture
+{
+    public HttpRequestMessage? Seen { get; private set; }
+    public string? Body { get; private set; }
+
+    public StubHandler Responds(HttpStatusCode status, string? json = null) => new(async req =>
+    {
+        Seen = req;
+        Body = req.Content is null ? null : await req.Content.ReadAsStringAsync();
+        var response = new HttpResponseMessage(status);
+        if (json is not null)
+            response.Content = new StringContent(json, Encoding.UTF8, "application/json");
+        return response;
+    });
+}

services/event-subscriber/EventSubscriber.Tests/EventSubscriber.Tests.csproj

@@ -19,6 +19,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <ProjectReference Include="..\EventSubscriber.Api\EventSubscriber.Api.csproj" />
     <ProjectReference Include="..\EventSubscriber.Application\EventSubscriber.Application.csproj" />
   </ItemGroup>
 

services/event-subscriber/EventSubscriber.Tests/InMemoryStores.cs

@@ -5,6 +5,19 @@ namespace EventSubscriber.Tests;
 /// <summary>In-memory stand-ins for the projection store and notification log, so the
 /// projector's behaviour is exercised without Postgres (hand-written stubs, the repo's
 /// convention — no mocking library).</summary>
+/// <summary>A fake ACL client that returns a fixed reference derived from the zaak, and records
+/// how many times it was called (to prove a rebuild does not re-read via the ACL).</summary>
+internal sealed class FakeAclClient : IAclClient
+{
+    public int CallCount { get; private set; }
+
+    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        CallCount++;
+        return Task.FromResult("REG-" + zaakUrl.Segments[^1].Trim('/'));
+    }
+}
+
 internal sealed class InMemoryNotificationLog : INotificationLog
 {
     private readonly Dictionary<string, RecordedNotification> _byKey = [];

services/event-subscriber/EventSubscriber.Tests/NotificationProjectorTests.cs

@@ -12,8 +12,9 @@ public sealed class NotificationProjectorTests
 
     private readonly InMemoryNotificationLog _log = new();
     private readonly InMemoryProjectionStore _store = new();
+    private readonly FakeAclClient _acl = new();
 
-    private NotificationProjector Projector() => new(_log, _store);
+    private NotificationProjector Projector() => new(_log, _store, _acl);
 
     private static Notification ZaakCreated(string url = ZaakUrl)
         => new("zaken", "zaak", "create", new Uri(url));
@@ -30,6 +31,23 @@ public sealed class NotificationProjectorTests
         var entry = Assert.Single(await _store.AllAsync());
         Assert.Equal("11111111-1111-1111-1111-111111111111", entry.Id);
         Assert.Equal(RegistrationStatus.Ingediend, entry.Status);
+        // Enriched with the zaak's reference (identificatie), fetched via the ACL (#78).
+        Assert.Equal("REG-11111111-1111-1111-1111-111111111111", entry.Reference);
+    }
+
+    [Fact]
+    public async Task rebuild_reproduces_the_reference_without_re_reading_via_the_acl()
+    {
+        var projector = Projector();
+        await projector.HandleAsync(ZaakCreated());
+        var callsAfterProjection = _acl.CallCount;
+
+        await projector.RebuildAsync();
+
+        var entry = Assert.Single(await _store.AllAsync());
+        Assert.Equal("REG-11111111-1111-1111-1111-111111111111", entry.Reference);
+        // Rebuild replays the log (which stored the reference) — no extra ACL calls (#78, ADR-0008).
+        Assert.Equal(callsAfterProjection, _acl.CallCount);
     }
 
     [Fact]

services/projection-api/Projection.ReadModel/EfNotificationLog.cs

@@ -16,6 +16,7 @@ public sealed class EfNotificationLog(ProjectionDbContext db) : INotificationLog
             Actie = notification.Actie,
             ZaakId = notification.ZaakId,
             Resource = notification.Resource,
+            Reference = notification.Reference,
             ReceivedAt = DateTimeOffset.UtcNow,
         });
 
@@ -35,6 +36,6 @@ public sealed class EfNotificationLog(ProjectionDbContext db) : INotificationLog
     public async Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default)
         => await db.ProcessedNotifications
             .OrderBy(r => r.ReceivedAt)
-            .Select(r => new RecordedNotification(r.Key, r.Actie, r.ZaakId, r.Resource))
+            .Select(r => new RecordedNotification(r.Key, r.Actie, r.ZaakId, r.Resource, r.Reference))
             .ToListAsync(ct);
 }

services/projection-api/Projection.ReadModel/EfProjectionStore.cs

@@ -15,6 +15,7 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
             {
                 Id = entry.Id,
                 Status = entry.Status,
+                Reference = entry.Reference,
                 Bsn = entry.Bsn,
                 NaamPlaceholder = entry.NaamPlaceholder,
             });
@@ -22,6 +23,7 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
         else
         {
             row.Status = entry.Status;
+            row.Reference = entry.Reference;
             row.Bsn = entry.Bsn;
             row.NaamPlaceholder = entry.NaamPlaceholder;
         }
@@ -35,6 +37,6 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
     public async Task<IReadOnlyList<RegisterEntry>> AllAsync(CancellationToken ct = default)
         => await db.RegisterEntries
             .OrderBy(r => r.Id)
-            .Select(r => new RegisterEntry(r.Id, r.Status, r.Bsn, r.NaamPlaceholder))
+            .Select(r => new RegisterEntry(r.Id, r.Status, Reference: r.Reference, Bsn: r.Bsn, NaamPlaceholder: r.NaamPlaceholder))
             .ToListAsync(ct);
 }

services/projection-api/Projection.ReadModel/Migrations/20260714101642_AddReferenceColumns.Designer.cs

@@ -0,0 +1,92 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Projection.ReadModel;
+
+#nullable disable
+
+namespace Projection.ReadModel.Migrations
+{
+    [DbContext(typeof(ProjectionDbContext))]
+    [Migration("20260714101642_AddReferenceColumns")]
+    partial class AddReferenceColumns
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.0")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Projection.ReadModel.ProcessedNotificationRow", b =>
+                {
+                    b.Property<string>("Key")
+                        .HasColumnType("text")
+                        .HasColumnName("key");
+
+                    b.Property<string>("Actie")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("actie");
+
+                    b.Property<DateTimeOffset>("ReceivedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("received_at");
+
+                    b.Property<string>("Reference")
+                        .HasColumnType("text")
+                        .HasColumnName("reference");
+
+                    b.Property<string>("Resource")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("resource");
+
+                    b.Property<string>("ZaakId")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("zaak_id");
+
+                    b.HasKey("Key");
+
+                    b.ToTable("processed_notifications", (string)null);
+                });
+
+            modelBuilder.Entity("Projection.ReadModel.RegisterEntryRow", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Bsn")
+                        .HasColumnType("text")
+                        .HasColumnName("bsn");
+
+                    b.Property<string>("NaamPlaceholder")
+                        .HasColumnType("text")
+                        .HasColumnName("naam_placeholder");
+
+                    b.Property<string>("Reference")
+                        .HasColumnType("text")
+                        .HasColumnName("reference");
+
+                    b.Property<string>("Status")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("register_projection", (string)null);
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

services/projection-api/Projection.ReadModel/Migrations/20260714101642_AddReferenceColumns.cs

@@ -0,0 +1,38 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Projection.ReadModel.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddReferenceColumns : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "reference",
+                table: "register_projection",
+                type: "text",
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "reference",
+                table: "processed_notifications",
+                type: "text",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "reference",
+                table: "register_projection");
+
+            migrationBuilder.DropColumn(
+                name: "reference",
+                table: "processed_notifications");
+        }
+    }
+}

services/projection-api/Projection.ReadModel/Migrations/ProjectionDbContextModelSnapshot.cs

@@ -37,6 +37,10 @@ namespace Projection.ReadModel.Migrations
                         .HasColumnType("timestamp with time zone")
                         .HasColumnName("received_at");
 
+                    b.Property<string>("Reference")
+                        .HasColumnType("text")
+                        .HasColumnName("reference");
+
                     b.Property<string>("Resource")
                         .IsRequired()
                         .HasColumnType("text")
@@ -66,6 +70,10 @@ namespace Projection.ReadModel.Migrations
                         .HasColumnType("text")
                         .HasColumnName("naam_placeholder");
 
+                    b.Property<string>("Reference")
+                        .HasColumnType("text")
+                        .HasColumnName("reference");
+
                     b.Property<string>("Status")
                         .IsRequired()
                         .HasColumnType("text")

services/projection-api/Projection.ReadModel/ProjectionDbContext.cs

@@ -24,6 +24,7 @@ public sealed class ProjectionDbContext(DbContextOptions<ProjectionDbContext> op
             e.HasKey(r => r.Id);
             e.Property(r => r.Id).HasColumnName("id");
             e.Property(r => r.Status).HasColumnName("status").IsRequired();
+            e.Property(r => r.Reference).HasColumnName("reference");
             e.Property(r => r.Bsn).HasColumnName("bsn");
             e.Property(r => r.NaamPlaceholder).HasColumnName("naam_placeholder");
         });
@@ -36,6 +37,7 @@ public sealed class ProjectionDbContext(DbContextOptions<ProjectionDbContext> op
             e.Property(r => r.Actie).HasColumnName("actie").IsRequired();
             e.Property(r => r.ZaakId).HasColumnName("zaak_id").IsRequired();
             e.Property(r => r.Resource).HasColumnName("resource").IsRequired();
+            e.Property(r => r.Reference).HasColumnName("reference");
             e.Property(r => r.ReceivedAt).HasColumnName("received_at");
         });
     }
@@ -46,6 +48,10 @@ public sealed class RegisterEntryRow
 {
     public required string Id { get; set; }
     public required string Status { get; set; }
+
+    /// <summary>The citizen-facing reference (the zaak's identificatie) — matches the submit confirmation (#78).</summary>
+    public string? Reference { get; set; }
+
     public string? Bsn { get; set; }
     public string? NaamPlaceholder { get; set; }
 }
@@ -61,5 +67,8 @@ public sealed class ProcessedNotificationRow
     /// the right status without reading OpenZaak (S-09b).</summary>
     public required string Resource { get; set; }
 
+    /// <summary>The zaak reference (identificatie), retained so a rebuild reprojects it without the ACL (#78).</summary>
+    public string? Reference { get; set; }
+
     public DateTimeOffset ReceivedAt { get; set; }
 }

services/projection-api/ProjectionApi.Api/Program.cs

@@ -23,7 +23,7 @@ app.MapGet("/register", async (ProjectionDbContext db, CancellationToken ct) =>
 {
     var rows = await db.RegisterEntries
         .OrderBy(r => r.Id)
-        .Select(r => new RegisterEntryDto(r.Id, r.Status, r.Bsn, r.NaamPlaceholder))
+        .Select(r => new RegisterEntryDto(r.Id, r.Status, r.Reference, r.Bsn, r.NaamPlaceholder))
         .ToListAsync(ct);
     return Results.Ok(rows);
 });
@@ -32,13 +32,13 @@ app.MapGet("/register/{id}", async (string id, ProjectionDbContext db, Cancellat
 {
     var row = await db.RegisterEntries
         .Where(r => r.Id == id)
-        .Select(r => new RegisterEntryDto(r.Id, r.Status, r.Bsn, r.NaamPlaceholder))
+        .Select(r => new RegisterEntryDto(r.Id, r.Status, r.Reference, r.Bsn, r.NaamPlaceholder))
         .SingleOrDefaultAsync(ct);
     return row is null ? Results.NotFound() : Results.Ok(row);
 });
 
 await app.RunAsync();
 
-public sealed record RegisterEntryDto(string Id, string Status, string? Bsn, string? NaamPlaceholder);
+public sealed record RegisterEntryDto(string Id, string Status, string? Reference, string? Bsn, string? NaamPlaceholder);
 
 public partial class Program;