feat(acl,domain): cancel the ZGW zaak on document-timeout expiry (S-10c, closes #106) (#109)

## S-10c · Close the ZGW zaak on document-timeout expiry (closes #106)

Completes the S-10a/S-10b boundary flagged in ADR-0017: when a registration's 30-day document term lapses, the domain now cancels the **ZGW zaak** as well as marking the aggregate `Verlopen`, so OpenZaak and the register no longer diverge.

### What it does
On expiry the `ExpireRegistrationWorker` calls the ACL to set the zaak to a distinct, non-terminal **`Geannuleerd`** status with a **`Vervallen`** resultaat (vs the approval `Afgehandeld` + `Geregistreerd`), resolved **by omschrijving** in the ACL — the ACL-first ordering mirrors approval so a failed ZGW call leaves the job for redelivery rather than diverging the two.

**Path:** Flowable P30D timer → `RegistratieVerlopen` job → domain `ExpireRegistrationWorker` → ACL `POST /annuleringen` → ZGW `resultaten` + `statussen` (Geannuleerd) → aggregate `Verlopen`.

### Layers touched (each red→green)
- **ACL gateway** — `SetZaakToCancellationStatusAsync` (Geannuleerd + Vervallen by name); approval now resolves its `Geregistreerd` resultaat by name too (a second resultaattype now exists).
- **ACL service/API** — `AclService.CancelZaakAsync` + `POST /annuleringen`.
- **Domain** — `IAclClient.CancelZaakAsync` + client; expiry worker cancels the zaak before advancing to `Verlopen`, guarded against redelivery double-cancel.
- **Seed** — non-terminal `Geannuleerd` statustype (volgnummer 2; `Afgehandeld` → 3) + `Vervallen` resultaattype, both idempotent by omschrijving and sharing the zaaktype's procestype.
- **Verify/integration** — ACL↔OpenZaak integration test (live `Geannuleerd` + resultaat); `run-domain-check.sh` fires the real P30D timer and asserts the zaak reaches `Geannuleerd` end-to-end; BDD scenario asserts cancel-on-timeout vs untouched-when-in-time.
- **Docs** — ADR-0019 (cancellation modelling decision), demo-script, BACKLOG.

### Design note (ADR-0019)
ZGW allows only one eindstatus per zaaktype, so `Geannuleerd` is modelled as a **non-terminal** status (it records a cancellation status + resultaat but does not set `einddatum`). This follows the issue's explicit "distinct statustype + resultaat" outcome; the shared-eindstatus alternative is recorded in the ADR.

### Tests
Unit + acceptance all green locally (Acl 38, Big 134, Acceptance 17, Bff 33, EventSubscriber 19). Integration + verify-stack run in CI (need live OpenZaak + selectielijst egress).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #109

services/acl/Acl.Api/Program.cs

@@ -32,6 +32,14 @@ app.MapPost("/statussen", async (SetStatusRequest body, AclService acl, Cancella
     return Results.NoContent();
 });
 
+// Cancel a zaak on document-timeout expiry (S-10c): set it to its zaaktype's cancellation statustype
+// + resultaat. The domain hands over only the zaak URL; the ACL owns the ZGW resolution (§8.1).
+app.MapPost("/annuleringen", async (CancelZaakRequest body, AclService acl, CancellationToken ct) =>
+{
+    await acl.CancelZaakAsync(new Uri(body.ZaakUrl), ct);
+    return Results.NoContent();
+});
+
 // Read a zaak's public-safe reference (its identificatie). The Event Subscriber calls this to enrich
 // the read projection without reading ZGW itself (§8.1, #78).
 app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl, CancellationToken ct) =>
@@ -55,6 +63,8 @@ public sealed record OpenZaakRequest(string Bsn, string Reference);
 
 public sealed record SetStatusRequest(string ZaakUrl);
 
+public sealed record CancelZaakRequest(string ZaakUrl);
+
 public sealed record ZaakReferenceRequest(string ZaakUrl);
 
 public sealed record StoreDocumentRequest(string ZaakUrl, string ContentBase64, string FileName, string ContentType);

services/acl/Acl.Application/AclService.cs

@@ -30,6 +30,18 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, ICloc
         return gateway.SetZaakToEindstatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
     }
 
+    /// <summary>
+    /// Cancel a zaak on document-timeout expiry (S-10c): set it to the configured BIG zaaktype's
+    /// cancellation statustype + resultaat. The domain hands over only the zaak URL; the ACL owns which
+    /// statustype/resultaat means "cancelled" (§8.1).
+    /// </summary>
+    public Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        return gateway.SetZaakToCancellationStatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
+    }
+
     /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
     public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
     {

services/acl/Acl.Application/IZaakGateway.cs

@@ -13,6 +13,15 @@ public interface IZaakGateway
     /// </summary>
     Task SetZaakToEindstatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
 
+    /// <summary>
+    /// Set the given zaak to the <em>cancellation</em> statustype ("Geannuleerd") and record the
+    /// matching cancellation resultaat ("Vervallen") — the ZGW translation of "the 30-day document term
+    /// lapsed" (S-10c). Distinct from <see cref="SetZaakToEindstatusAsync"/> (approval): the gateway
+    /// resolves both the cancellation statustype and resultaattype from the catalogus by their
+    /// omschrijving, POSTs the resultaat then the status, dated <paramref name="datumStatusGezet"/>.
+    /// </summary>
+    Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
+
     /// <summary>Read the zaak's <c>identificatie</c> — the public-safe reference the register shows.
     /// The Event Subscriber calls this through the ACL rather than reading ZGW itself (§8.1, #78).</summary>
     Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default);

services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -8,6 +8,12 @@ namespace Acl.Infrastructure;
 /// <summary>The only code that talks to OpenZaak's Zaken API (ADR-0001).</summary>
 public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) : IZaakGateway
 {
+    // The ACL owns which ZGW statustype/resultaat carries each domain outcome (§8.1). These
+    // omschrijvingen match the seeded BIG catalogus (infra/openzaak/seed_catalogus.py).
+    private const string GeregistreerdResultaat = "Geregistreerd";   // approval outcome
+    private const string GeannuleerdStatus = "Geannuleerd";          // document-timeout cancellation status (S-10c)
+    private const string VervallenResultaat = "Vervallen";           // document-timeout cancellation outcome (S-10c)
+
     public async Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(request);
@@ -48,7 +54,9 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         ArgumentNullException.ThrowIfNull(zaaktypeUrl);
 
         var eindstatus = await ResolveEindstatusAsync(zaaktypeUrl, ct);
-        var resultaattype = await ResolveResultaattypeAsync(zaaktypeUrl, ct);
+        // Resolve the approval resultaat by name: once S-10c adds the Vervallen resultaattype, taking
+        // the first would be ambiguous (the Zaken API does not guarantee order).
+        var resultaattype = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, GeregistreerdResultaat, ct);
 
         // OpenZaak refuses to set a zaak's eindstatus unless the zaak has a resultaat
         // ("resultaat-does-not-exist"), so record the resultaat first, then the status.
@@ -62,6 +70,27 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
             "Setting the zaak status", ct);
     }
 
+    public async Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+        ArgumentNullException.ThrowIfNull(zaaktypeUrl);
+
+        // Distinct from approval: resolve the cancellation statustype + resultaat by name (Geannuleerd
+        // is a non-terminal statustype, so it is never the eindstatus the approval path resolves).
+        var cancellationStatus = await ResolveStatustypeByOmschrijvingAsync(zaaktypeUrl, GeannuleerdStatus, ct);
+        var cancellationResultaat = await ResolveResultaattypeByOmschrijvingAsync(zaaktypeUrl, VervallenResultaat, ct);
+
+        // As with approval, OpenZaak wants the resultaat recorded before the status.
+        await PostAsync("/zaken/api/v1/resultaten",
+            new ResultaatDto(zaakUrl.ToString(), cancellationResultaat.ToString()),
+            "Setting the zaak cancellation resultaat", ct);
+
+        await PostAsync("/zaken/api/v1/statussen",
+            new StatusDto(zaakUrl.ToString(), cancellationStatus.ToString(),
+                datumStatusGezet.ToDateTime(TimeOnly.MinValue, DateTimeKind.Utc).ToString("yyyy-MM-ddTHH:mm:ssZ")),
+            "Setting the zaak cancellation status", ct);
+    }
+
     public async Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(zaakUrl);
@@ -174,13 +203,23 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         return new Uri(eindstatus.Url);
     }
 
-    /// <summary>Resolve the zaaktype's resultaattype from the catalogus (the seed defines one).</summary>
-    private async Task<Uri> ResolveResultaattypeAsync(Uri zaaktypeUrl, CancellationToken ct)
+    /// <summary>Resolve a specific statustype from the catalogus by its omschrijving (e.g. "Geannuleerd").</summary>
+    private async Task<Uri> ResolveStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
+    {
+        var page = await GetCatalogusAsync<StatustypePage>("statustypen", zaaktypeUrl, "statustypen", ct);
+        var match = (page.Results ?? []).FirstOrDefault(s => s.Omschrijving == omschrijving)
+            ?? throw new InvalidOperationException($"No '{omschrijving}' statustype found for zaaktype {zaaktypeUrl}");
+        return new Uri(match.Url);
+    }
+
+    /// <summary>Resolve a specific resultaattype from the catalogus by its omschrijving (the seed defines
+    /// "Geregistreerd" for approval and "Vervallen" for a document-timeout cancellation).</summary>
+    private async Task<Uri> ResolveResultaattypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct)
     {
         var page = await GetCatalogusAsync<ResultaattypePage>("resultaattypen", zaaktypeUrl, "resultaattypen", ct);
-        var resultaattype = (page.Results ?? []).FirstOrDefault()
-            ?? throw new InvalidOperationException($"No resultaattypen found for zaaktype {zaaktypeUrl}");
-        return new Uri(resultaattype.Url);
+        var match = (page.Results ?? []).FirstOrDefault(r => r.Omschrijving == omschrijving)
+            ?? throw new InvalidOperationException($"No '{omschrijving}' resultaattype found for zaaktype {zaaktypeUrl}");
+        return new Uri(match.Url);
     }
 
     // GETs a catalogus collection filtered by zaaktype (status=alles includes concept + published).
@@ -224,7 +263,8 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
     private sealed record StatustypeDto(
         [property: JsonPropertyName("url")] string Url,
         [property: JsonPropertyName("volgnummer")] int Volgnummer,
-        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus);
+        [property: JsonPropertyName("isEindstatus")] bool IsEindstatus,
+        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
 
     private sealed record ResultaatDto(
         [property: JsonPropertyName("zaak")] string Zaak,
@@ -234,7 +274,8 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         [property: JsonPropertyName("results")] IReadOnlyList<ResultaattypeDto>? Results);
 
     private sealed record ResultaattypeDto(
-        [property: JsonPropertyName("url")] string Url);
+        [property: JsonPropertyName("url")] string Url,
+        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
 
     private sealed record CreatedDto(
         [property: JsonPropertyName("url")] string Url);

services/acl/Acl.IntegrationTests/OpenZaakFixture.cs

@@ -114,6 +114,19 @@ public sealed class OpenZaakFixture : IDisposable
         return fallback ?? throw new InvalidOperationException($"No statustypen for zaaktype {zaaktypeUrl}");
     }
 
+    /// <summary>Resolve a statustype by its omschrijving (e.g. the S-10c "Geannuleerd" cancellation status).</summary>
+    public async Task<Uri> FindStatustypeByOmschrijvingAsync(Uri zaaktypeUrl, string omschrijving, CancellationToken ct = default)
+    {
+        var query = new Uri(BaseUrl,
+            "/catalogi/api/v1/statustypen?status=alles&zaaktype=" + Uri.EscapeDataString(zaaktypeUrl.ToString()));
+        var page = await GetJsonAsync(query, ct);
+        foreach (var st in page.GetProperty("results").EnumerateArray())
+            if (st.TryGetProperty("omschrijving", out var o) && o.GetString() == omschrijving)
+                return new Uri(st.GetProperty("url").GetString()!);
+
+        throw new InvalidOperationException($"No '{omschrijving}' statustype for zaaktype {zaaktypeUrl}");
+    }
+
     // A ZGW (vng-api-common) HS256 JWT, mirroring the seed's client. Minted here
     // rather than reusing Acl.Infrastructure's internal minter to keep that internal.
     private string MintToken()

services/acl/Acl.IntegrationTests/OpenZaakGatewayIntegrationTests.cs

@@ -75,6 +75,39 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
         Assert.Equal(eindstatustype.ToString(), status.GetProperty("statustype").GetString());
     }
 
+    [Fact]
+    public async Task Cancelling_a_zaak_records_the_geannuleerd_status_and_a_resultaat()
+    {
+        var zaaktype = await stack.FindPublishedBigZaaktypeAsync();
+        Assert.True(zaaktype is not null,
+            "No published BIG-REGISTRATIE zaaktype found in OpenZaak — bring the stack up and " +
+            "seed it with OZ_PUBLISH=1 (`make integration` does this).");
+
+        var gateway = new OpenZaakGateway(stack.Http, stack.Options);
+        var zaakUrl = await gateway.OpenZaakAsync(new ZaakRequest(
+            Bronorganisatie: "517439943",
+            VerantwoordelijkeOrganisatie: "517439943",
+            Vertrouwelijkheidaanduiding: "openbaar",
+            Zaaktype: zaaktype!,
+            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
+            Identificatie: Guid.NewGuid().ToString()));
+
+        await gateway.SetZaakToCancellationStatusAsync(zaakUrl, zaaktype!, DateOnly.FromDateTime(DateTime.UtcNow));
+
+        // The zaak's current status is the Geannuleerd statustype — distinct from the approval eindstatus.
+        var zaak = await stack.GetZaakAsync(zaakUrl);
+        var statusUrl = zaak.GetProperty("status").GetString();
+        Assert.False(string.IsNullOrEmpty(statusUrl), "the cancelled zaak has no current status");
+
+        var status = await stack.GetJsonAsync(new Uri(statusUrl!));
+        var geannuleerd = await stack.FindStatustypeByOmschrijvingAsync(zaaktype!, "Geannuleerd");
+        Assert.Equal(geannuleerd.ToString(), status.GetProperty("statustype").GetString());
+
+        // ...and a resultaat is recorded (OpenZaak requires it before a closing/terminal status).
+        Assert.False(string.IsNullOrEmpty(zaak.GetProperty("resultaat").GetString()),
+            "the cancelled zaak has no resultaat");
+    }
+
     [Fact]
     public async Task Storing_a_diploma_creates_a_real_informatieobject_related_to_the_zaak()
     {

services/acl/Acl.Tests/AclServiceTests.cs

@@ -23,6 +23,14 @@ public class AclServiceTests
             return Task.CompletedTask;
         }
 
+        public (Uri Zaak, Uri Zaaktype, DateOnly Datum)? Cancelled;
+
+        public Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
+        {
+            Cancelled = (zaakUrl, zaaktypeUrl, datumStatusGezet);
+            return Task.CompletedTask;
+        }
+
         public Uri? ReadReferenceFor;
 
         public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
@@ -126,6 +134,34 @@ public class AclServiceTests
         Assert.Null(gateway.Approved);
     }
 
+    [Fact]
+    public async Task Cancelling_a_zaak_sets_it_to_the_cancellation_status_dated_today()
+    {
+        var gateway = new FakeGateway();
+        var defaults = Defaults();
+        var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
+
+        await service.CancelZaakAsync(zaak);
+
+        Assert.NotNull(gateway.Cancelled);
+        Assert.Equal(zaak, gateway.Cancelled!.Value.Zaak);
+        Assert.Equal(defaults.ZaaktypeUrl, gateway.Cancelled.Value.Zaaktype);
+        Assert.Equal(new DateOnly(2026, 6, 4), gateway.Cancelled.Value.Datum);
+        // Cancellation must not touch the approval path.
+        Assert.Null(gateway.Approved);
+    }
+
+    [Fact]
+    public async Task Cancelling_a_null_zaak_is_rejected_without_touching_the_gateway()
+    {
+        var gateway = new FakeGateway();
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => service.CancelZaakAsync(null!));
+        Assert.Null(gateway.Cancelled);
+    }
+
     [Fact]
     public async Task Storing_a_diploma_default_fills_the_document_fields_and_returns_its_url()
     {

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -173,7 +173,8 @@ public class OpenZaakGatewayTests
     private sealed class OzRoutes
     {
         public string StatustypenJson { get; init; } = StatustypenPage(withEindstatusFlag: true);
-        public string ResultaattypenJson { get; init; } = """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1"}]}""";
+        public string ResultaattypenJson { get; init; } =
+            """{"results":[{"url":"http://openzaak/catalogi/api/v1/resultaattypen/1","omschrijving":"Geregistreerd"}]}""";
         public HttpStatusCode StatustypenStatus { get; init; } = HttpStatusCode.OK;
         public HttpStatusCode ResultaattypenStatus { get; init; } = HttpStatusCode.OK;
         public HttpStatusCode ResultaatPostStatus { get; init; } = HttpStatusCode.Created;
@@ -251,6 +252,138 @@ public class OpenZaakGatewayTests
         Assert.True(status.Length > 0);
     }
 
+    [Fact]
+    public async Task Approving_selects_the_geregistreerd_resultaat_by_name_when_several_exist()
+    {
+        // Once S-10c adds a second resultaattype (Vervallen), picking the first is ambiguous — the
+        // Zaken API does not guarantee order. Approval must resolve its resultaat by omschrijving.
+        var rec = new Recorder();
+        var twoResultaattypen = """
+            {"results":[
+              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"},
+              {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"}
+            ]}
+            """;
+
+        await Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = twoResultaattypen }))
+            .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
+
+        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd\"",
+            rec.Sent("/resultaten").Body);
+    }
+
+    // --- SetZaakToCancellationStatusAsync (document-timeout cancellation / S-10c) ---
+
+    // A catalogus with the three statustypen S-10c seeds (Geannuleerd is non-terminal, below the
+    // Afgehandeld eindstatus) and both resultaattypen. Cancellation must resolve "Geannuleerd" and
+    // "Vervallen" by omschrijving, never the approval pair.
+    private const string CancellationStatustypenJson = """
+        {"results":[
+          {"url":"http://openzaak/catalogi/api/v1/statustypen/ontvangen","volgnummer":1,"omschrijving":"Ontvangen","isEindstatus":false},
+          {"url":"http://openzaak/catalogi/api/v1/statustypen/geannuleerd","volgnummer":2,"omschrijving":"Geannuleerd","isEindstatus":false},
+          {"url":"http://openzaak/catalogi/api/v1/statustypen/afgehandeld","volgnummer":3,"omschrijving":"Afgehandeld","isEindstatus":true}
+        ]}
+        """;
+
+    private const string CancellationResultaattypenJson = """
+        {"results":[
+          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/geregistreerd","omschrijving":"Geregistreerd"},
+          {"url":"http://openzaak/catalogi/api/v1/resultaattypen/vervallen","omschrijving":"Vervallen"}
+        ]}
+        """;
+
+    [Fact]
+    public async Task Cancelling_records_the_vervallen_resultaat_then_the_geannuleerd_status_against_the_zaak()
+    {
+        var rec = new Recorder();
+
+        await Gateway(ApprovalStub(rec, new OzRoutes
+        {
+            StatustypenJson = CancellationStatustypenJson,
+            ResultaattypenJson = CancellationResultaattypenJson,
+        })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4));
+
+        // Resultaat precedes status (OpenZaak requires a resultaat before a closing/terminal status).
+        Assert.True(rec.IndexOf("/resultaten") < rec.IndexOf("/statussen"));
+
+        var resultaat = rec.Sent("/resultaten");
+        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", resultaat.Body);
+        // The cancellation resultaat (Vervallen) is chosen by name — not the approval one (Geregistreerd).
+        Assert.Contains("\"resultaattype\":\"http://openzaak/catalogi/api/v1/resultaattypen/vervallen\"", resultaat.Body);
+
+        var status = rec.Sent("/statussen");
+        Assert.Contains("\"zaak\":\"" + ZaakUrl + "\"", status.Body);
+        // The Geannuleerd statustype is chosen by name — not the Afgehandeld eindstatus (approval).
+        Assert.Contains("\"statustype\":\"http://openzaak/catalogi/api/v1/statustypen/geannuleerd\"", status.Body);
+        Assert.Contains("\"datumStatusGezet\":\"2026-06-04T00:00:00Z\"", status.Body);
+    }
+
+    [Fact]
+    public async Task Cancelling_throws_when_the_zaaktype_has_no_geannuleerd_statustype()
+    {
+        var rec = new Recorder();
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            Gateway(ApprovalStub(rec, new OzRoutes
+            {
+                // Only the approval statustypen — no "Geannuleerd".
+                StatustypenJson = StatustypenPage(withEindstatusFlag: true),
+                ResultaattypenJson = CancellationResultaattypenJson,
+            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
+
+        Assert.Contains("Geannuleerd", ex.Message);
+    }
+
+    [Fact]
+    public async Task Cancelling_rejects_a_null_zaak_without_calling_openzaak()
+    {
+        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
+        await Assert.ThrowsAsync<ArgumentNullException>(() =>
+            Gateway(handler).SetZaakToCancellationStatusAsync(null!, Zaaktype, new DateOnly(2026, 6, 4)));
+    }
+
+    [Fact]
+    public async Task Cancelling_rejects_a_null_zaaktype_without_calling_openzaak()
+    {
+        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
+        await Assert.ThrowsAsync<ArgumentNullException>(() =>
+            Gateway(handler).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), null!, new DateOnly(2026, 6, 4)));
+    }
+
+    [Fact]
+    public async Task Cancelling_surfaces_the_failure_when_recording_the_resultaat_is_rejected()
+    {
+        var rec = new Recorder();
+
+        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
+            Gateway(ApprovalStub(rec, new OzRoutes
+            {
+                StatustypenJson = CancellationStatustypenJson,
+                ResultaattypenJson = CancellationResultaattypenJson,
+                ResultaatPostStatus = HttpStatusCode.BadRequest,
+            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
+
+        Assert.Contains("cancellation resultaat", ex.Message);
+        // It fails on the resultaat, before it ever posts the status.
+        Assert.Equal(-1, rec.IndexOf("/statussen"));
+    }
+
+    [Fact]
+    public async Task Cancelling_surfaces_the_failure_when_recording_the_status_is_rejected()
+    {
+        var rec = new Recorder();
+
+        var ex = await Assert.ThrowsAsync<HttpRequestException>(() =>
+            Gateway(ApprovalStub(rec, new OzRoutes
+            {
+                StatustypenJson = CancellationStatustypenJson,
+                ResultaattypenJson = CancellationResultaattypenJson,
+                StatusPostStatus = HttpStatusCode.BadRequest,
+            })).SetZaakToCancellationStatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
+
+        Assert.Contains("cancellation status", ex.Message);
+    }
+
     [Fact]
     public async Task Approving_falls_back_to_the_highest_volgnummer_when_no_eindstatus_is_flagged()
     {
@@ -325,7 +458,7 @@ public class OpenZaakGatewayTests
             Gateway(ApprovalStub(rec, new OzRoutes { ResultaattypenJson = "{}" }))
                 .SetZaakToEindstatusAsync(new Uri(ZaakUrl), Zaaktype, new DateOnly(2026, 6, 4)));
 
-        Assert.Contains("No resultaattypen found", ex.Message);
+        Assert.Contains("'Geregistreerd' resultaattype", ex.Message);
         // Resolved the eindstatus + queried resultaattypen, but posted nothing.
         Assert.Equal(-1, rec.IndexOf("/resultaten"));
         Assert.Equal(-1, rec.IndexOf("/statussen"));