A release caused editors, but not admins, to receive 500 when saving one valid payload. Add the right regression test.

Reproduce the exact effective capability set and minimal payload that triggered the bug. Replace unrelated dependencies, keep persistence isolated, and assert the successful response plus saved state. Name the test after behavior, not the ticket number alone.

The test fails before the fix because one editor-only branch dereferences missing reviewer metadata. After the fix it returns 200 and persists the intended update.

• Preserve the failing capability combination.
• Reduce the payload to the smallest reproducer.
• Assert state as well as response.
• Add broader tests only when the incident reveals a wider class of risk.

I start from production evidence, reproduce deterministically, then remove irrelevant details until one focused test remains. This test belongs at the API layer because the failure depended on authorization, binding, and persistence together.

[Fact]
public async Task Editor_can_save_valid_review_without_admin_metadata()
{
    await using var factory = await ApiTestFactory.WithIsolatedReviewAsync("review-1");
    var client = factory.CreateAuthenticatedClient(
        "editor-1",
        "content.read,content.update");

    var response = await client.PutAsJsonAsync(
        "/api/reviews/review-1",
        new
        {
            Decision = "ChangesRequested",
            Comment = "Clarify the retry boundary.",
            AdminRecoveryNote = (string?)null
        });

    response.EnsureSuccessStatusCode();
    var stored = await factory.ReadReviewAsync("review-1");
    Assert.Equal("ChangesRequested", stored.Decision);
    Assert.Equal("editor-1", stored.UpdatedByUserId);
}

One focused integration test closes the exact gap. The incident follow-up may also add a capability-matrix row or nullable-state unit test, but only when each catches a distinct failure mode.

• Admin-only metadata is null or absent.
• The same payload is submitted by a user without update capability.
• The record changed concurrently.
• The error occurred only under one serializer option.

• Prove the test fails against the pre-fix behavior when practical.
• Keep the original capability set exact.
• Verify logs now classify any future failure with a correlation id.

• Adding a broad end-to-end test that does not isolate the trigger.
• Testing only admins because they were unaffected.
• Encoding ticket prose instead of behavior.
• Stopping at the hotfix without a durable guard.