Fix #27107: soft-deleted users still appear in Experts/Reviewers across all entities (#27120)

* Fix #27107: soft-deleted users still appear in experts/reviewers across all entities

Two bugs caused soft-deleted users to leak into experts/reviewers/owners/followers:

1. EntityRepository.resolveRelationshipEntityReferencesByType hardcoded Include.ALL
   for the consolidated bulk list path, affecting ALL entities (DataProduct, Domain,
   GlossaryTerm, Glossary, Table, Schema, Service, Container, etc.). Fixed by
   switching to getEntityReferencesByIdsRespectingInclude(..., NON_DELETED).

2. EntityResource.getInternal / getByNameInternal built RelationIncludes(null, ...)
   which defaulted to Include.ALL, causing single-entity GET on DataProduct, Domain,
   EventSubscription, Query to return deleted users in relation fields. Fixed by
   defaulting null include to Include.NON_DELETED for all resource endpoints.

Also cleaned up dead-code in DataProductRepository.batchFetchExperts and
DomainRepository.batchFetchExperts which used getEntityReferenceById that
silently overrides NON_DELETED to ALL.

Adds regression tests in DataProductResourceIT, DomainResourceIT,
GlossaryTermResourceIT covering both single-GET and list-endpoint paths.

* Thread Include through bulk relationship resolution instead of hardcoding NON_DELETED

- Add Include parameter to resolveRelationshipEntityReferencesByType, fetchAndSetRelationshipFieldsInBulk, and fetchAndSetFields (new 3-arg overload)
- Add setFieldsInBulk(fields, entities, Include) overload in base class; existing 2-arg delegates to NON_DELETED
- The Include is no longer hardcoded — callers with request context (e.g. include=all) can pass it through via the 3-arg setFieldsInBulk or fetchAndSetFields

Fixes: #27107

* Fix inherited experts/owners including soft-deleted users from parent Domain

DataProductRepository.setInheritedFields and DomainRepository.setInheritedFields
both fetched parent Domain entities with Include.ALL, causing the domain's
experts and owners fields to be resolved with ALL include — returning
soft-deleted users. Changed to NON_DELETED so inherited fields only carry
active users.

Fixes: #27107

* Fix soft-deleted users leaking into owners/experts/reviewers across all entities

Five additional bug sites using Include.ALL when resolving user relationships:

- EntityRepository.batchFetchOwners: getEntityReferencesByIds → getEntityReferencesByIdsRespectingInclude(NON_DELETED)
- EntityRepository.batchFetchReviewers: same fix
- EntityRepository.batchFetchExperts (base class): same fix
- TagRepository.setInheritedFields: fetch Classification with NON_DELETED (was ALL), preventing soft-deleted owners/reviewers from being inherited by Tags
- WorksheetRepository.setInheritedFields: fetch Spreadsheet with NON_DELETED (was ALL), preventing soft-deleted owners from being inherited by Worksheets

Fixes: #27107

* Fix test user email validation in soft-delete integration tests

ns.prefix() generates ~110-char strings; after stripping underscores the
local part exceeds RFC 5321's 64-char limit and the server's maxLength:127
constraint.  Switch to ns.shortPrefix() (~27 chars total) which is already
alphanumeric+underscore and requires no sanitisation.

* Fix GlossaryTerm list test to filter by glossary ID

Without a glossary filter the list call returns the first 100 terms
across all glossaries; in a populated CI env the test term lands
outside that window and the search fails with 'GlossaryTerm not found
in list'.  Add .addFilter("glossary", glossary.getId()) so the query
is scoped to only our test glossary.

* Fix fromId/toId swap in EntityRepository.batchFetchExperts

findToBatch(entityIds, EXPERT, USER) returns rows where fromId=entity
and toId=user (matching the write path in bulkInsertToRelationship).
The original code collected fromId as expert user IDs and toId as
entity IDs — both backwards. Method is preempted by the bulk path in
practice, but the logic should be correct.

* Add merge function to Collectors.toMap in batchFetchExperts

Prevents potential IllegalStateException if getEntityReferencesByIdsRespectingInclude
returns duplicate references for the same ID due to data inconsistency.
Consistent with the (a, b) -> a merge function used elsewhere.

* Handle soft-deleted parent in setInheritedFields for DataProduct and Domain

Entity.getEntity(..., NON_DELETED) throws EntityNotFoundException when
the parent domain/domain is soft-deleted while the relationship still
exists. Catch and skip inheritance for that parent rather than
propagating the exception and breaking the GET/list response.

* Remove dead setFieldsInBulk(Include) overload and collapse Include from private chain

The 3-arg setFieldsInBulk(Fields, List<T>, Include) overload had no callers
passing a non-default Include — the intent of this PR is to always filter
soft-deleted users from relationship fields, not to respect the caller's
include. Remove the overload and collapse the Include parameter out of
fetchAndSetFields and fetchAndSetRelationshipFieldsInBulk/
resolveRelationshipEntityReferencesByType, hardcoding NON_DELETED where
it matters.

* Paginate domain list to find test domain regardless of total count

* Revert WorksheetRepository Include change — out of scope for #27107

* Address PR review: add limit to DataProduct list test; align TagRepository bulk path to NON_DELETED

* Revert TagRepository Include changes — out of scope for #27107

* Remove unnecessary changes and compilation error

* Thread Include parameter through bulk relationship resolution path

setFieldsInBulk, fetchAndSetFields, fetchAndSetRelationshipFieldsInBulk, and
resolveRelationshipEntityReferencesByType now accept an Include parameter so
that include=all list queries correctly surface soft-deleted relationship
targets (owners, experts, reviewers) — matching the single-entity GET path
behaviour via RelationIncludes.

All existing 2-param overrides delegate to the new 3-param overloads with
NON_DELETED, so all subclass repositories and the update hydration path are
unchanged. All list/get callers with access to an Include value (listAfter,
listBefore, listAll, listAfterKeyset, listWithOffset, get, getByNames) now
forward that value through the chain.

* Fix subclass bypass: use ThreadLocal to carry Include through virtual setFieldsInBulk dispatch

The previous approach made callers invoke the 3-param setFieldsInBulk directly,
which bypassed all subclass overrides of the 2-param version (GlossaryTermRepository,
DatabaseRepository, TableRepository, etc. all override 2-param with essential
hydration logic like populateParentAndGlossaryReferencesInBulk). This caused a
regression where entities from those repos would be missing service references,
parent references, and other custom bulk-hydrated fields.

Fix: store the include in a static ThreadLocal before delegating to the virtual
2-param setFieldsInBulk (so all subclass overrides run), then the 2-param
fetchAndSetFields reads bulkInclude.get() so it reaches
fetchAndSetRelationshipFieldsInBulk with the correct value. The 3-param overload
is now final to prevent further accidental overrides.

* Fix null Include in setFieldsInBulk — default to NON_DELETED

Callers like DomainResource/DataProductResource/PersonaResource build
new ListFilter(null), so filter.getInclude() returns null. That null was
stored in the bulkInclude ThreadLocal and propagated into
getEntityReferencesByIdsRespectingInclude, bypassing the soft-delete
filter for USER/TEAM types and re-introducing soft-deleted users in
owners/experts/reviewers/followers on those list endpoints.

Resolve null to NON_DELETED before setting the ThreadLocal.
Add unit test covering null → NON_DELETED defaulting.

* Fix #27107: fix inverted ternary root cause; harden bulk-list NON_DELETED

Root cause: Entity.java had an inverted ternary in getEntityReferenceById and
getEntityReferencesByIds:

  // WRONG — forces ALL when type supports soft delete
  include = repository.supportsSoftDelete ? Include.ALL : include;

  // CORRECT — respects caller's include; falls back to ALL only when the
  //            type has no deleted column and filtering isn't possible
  include = repository.supportsSoftDelete ? include : Include.ALL;

PR #25284 worked around this by introducing getEntityReferenceByIdRespectingInclude /
getEntityReferencesByIdsRespectingInclude with the correct ternary, but the original
broken methods were never fixed — a permanent trap. This commit fixes the root and
deletes the RespectingInclude pair (now identical after the flip).

For the bulk-list path (GET /entities?fields=...) nested reference hydration is
hardcoded to NON_DELETED unconditionally in resolveRelationshipEntityReferencesByType
and all five batchFetch* methods (owners, followers, reviewers, experts, votes).
The ?include= query param controls which top-level entities appear in the list;
it does not change the semantics of nested relationship pointers, which should
always resolve to live entities.

For single-entity GET: EntityResource.getInternal/getByNameInternal had a latent
null-include bug for resources (Domain, DataProduct, EventSubscription, Query) that
don't declare @QueryParam("include"). Those null values defaulted to ALL inside
RelationIncludes, leaking soft-deleted nested refs. Fixed by defaulting null →
NON_DELETED before constructing RelationIncludes.

Remove ThreadLocal bulkInclude and the include-threading approach added earlier in
this branch — superseded by the root-cause fix and the NON_DELETED semantic above.
Delete EntityRepositoryIncludeThreadingTest (tested the rejected approach).

Tests: 7 integration tests covering single-GET and list endpoints for Domain,
DataProduct, and GlossaryTerm; verify soft-deleted experts/owners/reviewers are
absent from both paths, including with ?include=all on the list endpoint.

* Fix Copilot review: null-guard in batchFetchFollowers, remove dead 3-arg setFieldsInBulk, add follower/voter IT tests

- batchFetchFollowers: add null-check before adding followerRef to list.
  When a follower is soft-deleted, getEntityReferencesByIds(NON_DELETED)
  omits their ID from the result map, so followerRefs.get(followerId)
  returns null. All other batchFetch* methods already guard this;
  batchFetchFollowers was the only one missing the check.

- Remove the dead 3-arg setFieldsInBulk(Fields, List<T>, Include) overload
  that accepted include but silently discarded it, delegating to the 2-arg
  form. Revert all 6 call sites back to the 2-arg form. The overload was
  misleading — callers appeared to plumb include through but bulk hydration
  was never affected; NON_DELETED is hardcoded in resolveRelationship-
  EntityReferencesByType.

- Add integration tests for followers and votes:
  softDeletedFollower_notReturnedInListEndpoint and
  softDeletedVoter_notReturnedInListEndpoint in DomainResourceIT.
  Both pass (5/5 DomainResourceIT soft-delete tests green).

* fix: bump list limit to 1000000 in follower/voter IT tests to handle large CI datasets

* fix: remove unused Include param from listInternal and serializeJsons

Author: yan-3005

openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/DataProductResourceIT.java

@@ -33,6 +33,7 @@
 import org.openmetadata.schema.api.domains.CreateDomain.DomainType;
 import org.openmetadata.schema.api.domains.DataProductPortsView;
 import org.openmetadata.schema.api.services.CreateDatabaseService;
+import org.openmetadata.schema.api.teams.CreateUser;
 import org.openmetadata.schema.entity.data.Dashboard;
 import org.openmetadata.schema.entity.data.Table;
 import org.openmetadata.schema.entity.data.Topic;
@@ -41,6 +42,7 @@
 import org.openmetadata.schema.entity.services.DashboardService;
 import org.openmetadata.schema.entity.services.DatabaseService;
 import org.openmetadata.schema.entity.services.MessagingService;
+import org.openmetadata.schema.entity.teams.User;
 import org.openmetadata.schema.entity.type.Style;
 import org.openmetadata.schema.services.connections.database.MysqlConnection;
 import org.openmetadata.schema.services.connections.database.common.basicAuth;
@@ -2884,4 +2886,122 @@ void test_deletingAssetRemovesItFromPorts(TestNamespace ns) throws Exception {
     ResultList<Map<String, Object>> outputPorts = getOutputPorts(dataProduct.getId(), 10, 0);
     assertEquals(0, outputPorts.getPaging().getTotal());
   }
+
+  @Test
+  void softDeletedExpert_notReturnedInSingleGet(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+    Domain domain = getOrCreateDomain(ns);
+
+    String userName = ns.shortPrefix("expert_user");
+    User expert =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Expert user for soft-delete test"));
+
+    CreateDataProduct create =
+        new CreateDataProduct()
+            .withName(ns.prefix("dp_softdel_expert"))
+            .withDescription("DataProduct for soft-delete expert test")
+            .withDomains(List.of(domain.getFullyQualifiedName()))
+            .withExperts(List.of(expert.getFullyQualifiedName()));
+    DataProduct dp = createEntity(create);
+
+    client.users().delete(expert.getId().toString());
+
+    DataProduct byId = client.dataProducts().get(dp.getId().toString(), "experts");
+    assertTrue(
+        byId.getExperts() == null || byId.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in single GET by ID");
+
+    DataProduct byName = client.dataProducts().getByName(dp.getFullyQualifiedName(), "experts");
+    assertTrue(
+        byName.getExperts() == null || byName.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in single GET by name");
+  }
+
+  @Test
+  void softDeletedExpert_notReturnedInListEndpoint(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+    Domain domain = getOrCreateDomain(ns);
+
+    String userName = ns.shortPrefix("expert_list_user");
+    User expert =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Expert user for bulk soft-delete test"));
+
+    CreateDataProduct create =
+        new CreateDataProduct()
+            .withName(ns.prefix("dp_softdel_expert_list"))
+            .withDescription("DataProduct for soft-delete expert list test")
+            .withDomains(List.of(domain.getFullyQualifiedName()))
+            .withExperts(List.of(expert.getFullyQualifiedName()));
+    DataProduct dp = createEntity(create);
+
+    client.users().delete(expert.getId().toString());
+
+    ListParams params =
+        new ListParams()
+            .setFields("experts")
+            .withDomain(domain.getFullyQualifiedName())
+            .withLimit(100);
+    ListResponse<DataProduct> list = client.dataProducts().list(params);
+    DataProduct listed =
+        list.getData().stream()
+            .filter(p -> p.getId().equals(dp.getId()))
+            .findFirst()
+            .orElseThrow(() -> new AssertionError("DataProduct not found in list"));
+    assertTrue(
+        listed.getExperts() == null || listed.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in list endpoint");
+  }
+
+  @Test
+  void softDeletedOwner_notReturnedInListEndpoint(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+    Domain domain = getOrCreateDomain(ns);
+
+    String userName = ns.shortPrefix("owner_list_user");
+    User owner =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Owner user for soft-delete list test"));
+
+    CreateDataProduct create =
+        new CreateDataProduct()
+            .withName(ns.prefix("dp_softdel_owner_list"))
+            .withDescription("DataProduct for soft-delete owner list test")
+            .withDomains(List.of(domain.getFullyQualifiedName()))
+            .withOwners(List.of(owner.getEntityReference()));
+    DataProduct dp = createEntity(create);
+
+    client.users().delete(owner.getId().toString());
+
+    ListParams params =
+        new ListParams()
+            .setFields("owners")
+            .withDomain(domain.getFullyQualifiedName())
+            .withLimit(100);
+    ListResponse<DataProduct> list = client.dataProducts().list(params);
+    DataProduct listed =
+        list.getData().stream()
+            .filter(p -> p.getId().equals(dp.getId()))
+            .findFirst()
+            .orElseThrow(() -> new AssertionError("DataProduct not found in list"));
+    assertTrue(
+        listed.getOwners() == null || listed.getOwners().isEmpty(),
+        "Soft-deleted owner must not appear in list endpoint");
+  }
 }

openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/DomainResourceIT.java

@@ -29,14 +29,20 @@
 import org.junit.jupiter.api.parallel.ExecutionMode;
 import org.openmetadata.it.util.SdkClients;
 import org.openmetadata.it.util.TestNamespace;
+import org.openmetadata.schema.api.VoteRequest;
 import org.openmetadata.schema.api.domains.CreateDomain;
 import org.openmetadata.schema.api.domains.CreateDomain.DomainType;
+import org.openmetadata.schema.api.teams.CreateUser;
 import org.openmetadata.schema.entity.domains.Domain;
+import org.openmetadata.schema.entity.teams.User;
+import org.openmetadata.schema.type.ChangeEvent;
 import org.openmetadata.schema.type.EntityHistory;
 import org.openmetadata.schema.type.EntityReference;
+import org.openmetadata.schema.type.Votes;
 import org.openmetadata.sdk.client.OpenMetadataClient;
 import org.openmetadata.sdk.models.ListParams;
 import org.openmetadata.sdk.models.ListResponse;
+import org.openmetadata.sdk.network.HttpMethod;
 
 /**
  * Integration tests for Domain entity operations.
@@ -1164,4 +1170,204 @@ void test_renameDomainDoesNotAffectSimilarPrefixDomains(TestNamespace ns) throws
     // Verify old child FQN no longer works
     assertThrows(Exception.class, () -> getEntityByName(oldChildFqn));
   }
+
+  @Test
+  void softDeletedExpert_notReturnedInSingleGet(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+
+    String userName = ns.shortPrefix("domain_expert");
+    User expert =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Expert user for domain soft-delete test"));
+
+    CreateDomain create =
+        new CreateDomain()
+            .withName(ns.prefix("domain_softdel"))
+            .withDomainType(DomainType.AGGREGATE)
+            .withExperts(List.of(expert.getFullyQualifiedName()))
+            .withDescription("Domain for soft-delete expert test");
+    Domain domain = createEntity(create);
+
+    client.users().delete(expert.getId().toString());
+
+    Domain byId = client.domains().get(domain.getId().toString(), "experts");
+    assertTrue(
+        byId.getExperts() == null || byId.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in single GET by ID");
+
+    Domain byName = client.domains().getByName(domain.getFullyQualifiedName(), "experts");
+    assertTrue(
+        byName.getExperts() == null || byName.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in single GET by name");
+  }
+
+  @Test
+  void softDeletedExpert_notReturnedInListEndpoint(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+
+    String userName = ns.shortPrefix("domain_expert_list");
+    User expert =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Expert user for domain list soft-delete test"));
+
+    CreateDomain create =
+        new CreateDomain()
+            .withName(ns.prefix("domain_softdel_list"))
+            .withDomainType(DomainType.AGGREGATE)
+            .withExperts(List.of(expert.getFullyQualifiedName()))
+            .withDescription("Domain for soft-delete expert list test");
+    Domain domain = createEntity(create);
+
+    client.users().delete(expert.getId().toString());
+
+    Domain listed = null;
+    ListParams params = new ListParams().setFields("experts").withLimit(100);
+    while (listed == null) {
+      ListResponse<Domain> page = listEntities(params);
+      listed =
+          page.getData().stream()
+              .filter(d -> d.getId().equals(domain.getId()))
+              .findFirst()
+              .orElse(null);
+      String after = page.getPaging() != null ? page.getPaging().getAfter() : null;
+      if (listed != null || after == null) break;
+      params = new ListParams().setFields("experts").withLimit(100).setAfter(after);
+    }
+    assertNotNull(listed, "Domain not found in list");
+    assertTrue(
+        listed.getExperts() == null || listed.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear in list endpoint");
+  }
+
+  @Test
+  void softDeletedExpert_notReturnedInListWithIncludeAll(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+
+    String userName = ns.shortPrefix("domain_expert_all");
+    User expert =
+        client
+            .users()
+            .create(
+                new CreateUser()
+                    .withName(userName)
+                    .withEmail(userName + "@test.openmetadata.org")
+                    .withDescription("Expert user for domain include-all soft-delete test"));
+
+    CreateDomain create =
+        new CreateDomain()
+            .withName(ns.prefix("domain_softdel_all"))
+            .withDomainType(DomainType.AGGREGATE)
+            .withExperts(List.of(expert.getFullyQualifiedName()))
+            .withDescription("Domain for include-all soft-delete expert test");
+    Domain domain = createEntity(create);
+
+    client.users().delete(expert.getId().toString());
+
+    Domain listed = null;
+    ListParams params =
+        new ListParams().setFields("experts").withLimit(100).addFilter("include", "all");
+    while (listed == null) {
+      ListResponse<Domain> page = listEntities(params);
+      listed =
+          page.getData().stream()
+              .filter(d -> d.getId().equals(domain.getId()))
+              .findFirst()
+              .orElse(null);
+      String after = page.getPaging() != null ? page.getPaging().getAfter() : null;
+      if (listed != null || after == null) break;
+      params =
+          new ListParams()
+              .setFields("experts")
+              .withLimit(100)
+              .addFilter("include", "all")
+              .setAfter(after);
+    }
+    assertNotNull(listed, "Domain not found in list with include=all");
+    assertTrue(
+        listed.getExperts() == null || listed.getExperts().isEmpty(),
+        "Soft-deleted expert must not appear even when include=all (applies to top-level only)");
+  }
+
+  @Test
+  void softDeletedFollower_notReturnedInListEndpoint(TestNamespace ns) {
+    OpenMetadataClient client = SdkClients.adminClient();
+
+    String userName = ns.shortPrefix("follower_list");
+    User follower =
+        client
+            .users()
+            .create(
+                new CreateUser().withName(userName).withEmail(userName + "@test.openmetadata.org"));
+
+    Domain domain = createEntity(createRequest(ns.prefix("dom_follower"), ns));
+
+    client
+        .getHttpClient()
+        .execute(
+            HttpMethod.PUT,
+            "/v1/domains/" + domain.getId() + "/followers",
+            follower.getId(),
+            ChangeEvent.class);
+
+    client.users().delete(follower.getId().toString());
+
+    ListParams params = new ListParams().setFields("followers").withLimit(1000000);
+    ListResponse<Domain> list = listEntities(params);
+    Domain listed =
+        list.getData().stream()
+            .filter(d -> d.getId().equals(domain.getId()))
+            .findFirst()
+            .orElseThrow(() -> new AssertionError("Domain not found in list"));
+    assertTrue(
+        listed.getFollowers() == null || listed.getFollowers().isEmpty(),
+        "Soft-deleted follower must not appear in list endpoint");
+  }
+
+  @Test
+  void softDeletedVoter_notReturnedInListEndpoint(TestNamespace ns) {
+    String userName = ns.shortPrefix("voter_list");
+    String userEmail = userName + "@test.openmetadata.org";
+
+    OpenMetadataClient adminClient = SdkClients.adminClient();
+    User voter =
+        adminClient.users().create(new CreateUser().withName(userName).withEmail(userEmail));
+
+    Domain domain = createEntity(createRequest(ns.prefix("dom_voter"), ns));
+
+    OpenMetadataClient voterClient = SdkClients.createClient(userEmail, userEmail, new String[] {});
+    voterClient
+        .getHttpClient()
+        .execute(
+            HttpMethod.PUT,
+            "/v1/domains/" + domain.getId() + "/vote",
+            new VoteRequest().withUpdatedVoteType(VoteRequest.VoteType.VOTED_UP),
+            ChangeEvent.class);
+
+    adminClient.users().delete(voter.getId().toString());
+
+    ListParams params = new ListParams().setFields("votes").withLimit(1000000);
+    ListResponse<Domain> list = listEntities(params);
+    Domain listed =
+        list.getData().stream()
+            .filter(d -> d.getId().equals(domain.getId()))
+            .findFirst()
+            .orElseThrow(() -> new AssertionError("Domain not found in list"));
+    Votes votes = listed.getVotes();
+    boolean voterInUpVotes =
+        votes != null
+            && votes.getUpVoters() != null
+            && votes.getUpVoters().stream()
+                .anyMatch(ref -> ref != null && voter.getId().equals(ref.getId()));
+    assertFalse(voterInUpVotes, "Soft-deleted voter must not appear in list endpoint votes");
+  }
 }