test: finish high-risk response contract intent guidance

CONTRIBUTING.md

@@ -160,6 +160,13 @@ interpreted by your shell (notably zsh with `EXTENDED_GLOB`).
 
 ## Example Coverage Policy
 
+When extending high-risk tests, state the invariant that a surprising fixture
+protects: for example, a returned subclass containing a password hash proves the
+declared public response model is a disclosure boundary. PR #600 already documented
+custom trigger binding and aggregation-failure ordering; keep those explanations
+alongside the tests, and leave self-evident assertions uncommented. No comment-count
+metric or mandatory boilerplate is required.
+
 Examples are part of the supported API experience and should stay verified.
 
 - Keep one representative example for the minimal validation workflow.

tests/test_pipeline.py

@@ -291,6 +291,8 @@ def handler(req: HttpRequest) -> list[dict[str, object]]:
     def test_response_model_drops_subclass_fields(
         self, mock_request_factory: RequestFactory
     ) -> None:
+        """Serialize the declared public contract, never secret fields on a returned subclass."""
+
         @validate_http(response_model=PublicUserModel)
         def handler(req: HttpRequest) -> StoredUserModel:
             return StoredUserModel(name="Ada", password_hash="secret")
@@ -311,6 +313,8 @@ def handler(req: HttpRequest) -> AliasedResponseModel:
     def test_response_serialization_options_apply_after_validation(
         self, mock_request_factory: RequestFactory
     ) -> None:
+        """Output shaping must not bypass validation of the handler's response contract."""
+
         @validate_http(
             response_model=SerializationOptionsResponse,
             response_by_alias=False,