A release caused editors, but not admins, to receive 500 when saving one valid payload. Add the right regression test.

• Preserve the failing capability combination.
• Reduce the payload to the smallest reproducer.
• Assert state as well as response.
• Add broader tests only when the incident reveals a wider class of risk.

I start from production evidence, reproduce deterministically, then remove irrelevant details until one focused test remains. This test belongs at the API layer because the failure depended on authorization, binding, and persistence together.

[Fact]
public async Task Editor_can_save_valid_review_without_admin_metadata()
{
    await using var factory = await ApiTestFactory.WithIsolatedReviewAsync("review-1");
    var client = factory.CreateAuthenticatedClient(
        "editor-1",
        "content.read,content.update");

    var response = await client.PutAsJsonAsync(
        "/api/reviews/review-1",
        new
        {
            Decision = "ChangesRequested",
            Comment = "Clarify the retry boundary.",
            AdminRecoveryNote = (string?)null
        });

    response.EnsureSuccessStatusCode();
    var stored = await factory.ReadReviewAsync("review-1");
    Assert.Equal("ChangesRequested", stored.Decision);
    Assert.Equal("editor-1", stored.UpdatedByUserId);
}

One focused integration test closes the exact gap. The incident follow-up may also add a capability-matrix row or nullable-state unit test, but only when each catches a distinct failure mode.

• Admin-only metadata is null or absent.
• The same payload is submitted by a user without update capability.
• The record changed concurrently.
• The error occurred only under one serializer option.

• Prove the test fails against the pre-fix behavior when practical.
• Keep the original capability set exact.
• Verify logs now classify any future failure with a correlation id.

• Adding a broad end-to-end test that does not isolate the trigger.
• Testing only admins because they were unaffected.
• Encoding ticket prose instead of behavior.
• Stopping at the hotfix without a durable guard.