[rubenvdlinde]

Coordinator ruling on Q-dossiq-L11-2, following decision 224. Stacked on #3920 (Q-dossiq-L11-3): land after it.

What changes

A ZGW delete answered 404 "Not found" on any failure. An unknown id, a store that was down, a refused permission and a delete that happened but whose notification then failed all read the same. A show did the same, and an update answered 400.

One place now sorts a store failure, for every resource: Zgw/StoreFailureAnswer, behind ZgwService::storeFailureResponse().

The store says	Answer
DoesNotExistException, or no object	404 {"detail": "Not found"}, as before
OpenRegister's NotAuthorizedException, or any failure with code 403	403, code permission_denied (the body the ZGW scope check already uses)
anything else	503, code store-not-reached, logged at error with the operation and the object

A refused permission never becomes 503, and a store that was down never becomes 404.

Who answers through it: ZgwService::handleShow(), handleUpdate() (the read of the existing object; a failing save keeps its 400) and handleDestroy(), plus BrcController::destroyDecision() and BrcDocumentLinkHandler::destroy().

A delete that happened answers 204 even when its notification fails; that failure is logged at error (ZgwService::notifyDeleted()). PATCH merges onto the object the update already read, instead of reading it a second time.

The cross-register writes of the Besluiten API (Zgw/BrcCrossRegisterSync: brc-006, brc-005a, brc-005b, brc-009) stay best effort, as ruled. A failure is now logged at error with the rule, the resource and the objects, instead of a warning with only the message.

Spec

REQ-ZBR-023 in openspec/changes/guards-refuse-when-unsure, tasks section 6.

Seen, not fixed

• OpenRegister's scoped find() rewraps a database failure as DoesNotExistException (MagicMapper::findInRegisterSchemaTable). In that one path a store that is down still reads as "not found", and dossiq cannot tell. It needs an OpenRegister change.
• ZrcController deletes a case on its own path (409 for the delete guard, 400 for anything else). It is not part of this change.

Verified (once, on the stack top 3bfc0b4, which holds #3858 and the four PRs above it)

Every composer check:strict stage once, one at a time in the lane's check worktree (exit codes in dq-l11-logs/r7/s31.rc):

• lint 0, refusal-grounds snapshot 0, phpcs 0, psalm 0, phpstan 0.
• phpmd 2: only the two BooleanArgumentFlag findings in lib/Service/Termijn/TermLetters.php (401, 425) that development carries since fix(letters): every date in a letter to the applicant reads the same way #3884/fix(portal): the Woo request form reads Dutch dates and names refused fields in Dutch #3895. Inherited.
• PHPUnit --no-coverage: 8,676 tests, exit 0 (7 skipped, 1 warning). A first run found 3 reds of this stack (BrcCrossRegisterSyncTest still read the old warning lines), fixed in 28e4ad6, then the run above.
• Mutations: the catch in ZgwBusinessRulesService, the throw in findBySchemaKey, the throw in fieldPairExists, the not-found branch, the not-allowed branch and the null check in handleDestroy each turn their tests red.
• Not run locally: the touched test classes under pcov with fail-on-risky. The pcov image is gone and docker cannot pull, so the @covers/@uses of every touched test were checked by hand (each class a test can now execute is listed). CI is the check for that.
• eslint and prettier on the 17 JS/Vue files the citation PR touches: 0. Vitest not run: comments only.
• Hydra gates against refactor(transitions): the status engine asks two facades instead of fourteen collaborators #3858's head: 80 of 80 applicable ran, 8 failed, all inherited (22 and 53 on src/manifest.json, which this stack does not touch; 23, 43, 51, 55, 104, 107). Gates 5, 13, 16, 25 and 46 pass.
• openspec validate guards-refuse-when-unsure and method-decomposition: valid.
• Inherited: the debt ratchet reads red on development itself (phpmd.suppressWarnings 187 measured against 182) and eslint.inlineDisables 15 against 14.

No register change, so no info.version bump.