diff --git a/backend/handlers/bookings/reserve.go b/backend/handlers/bookings/reserve.go
index d2f06c0..1e2264c 100644
--- a/backend/handlers/bookings/reserve.go
+++ b/backend/handlers/bookings/reserve.go
@@ -69,11 +69,15 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// c. Detect auth: try context first, then parse Bearer token from Authorization header
+	// c. Detect auth: try context first (set by OptionalAuth middleware).
+	// The inline Bearer fallback below is a safety net for the 22+ test
+	// invocations that call ReserveSlotHandler via http.HandlerFunc directly
+	// (without middleware). Keeping it is deliberate: the fallback never
+	// executes in production (middleware always sets context first), removing it
+	// would require refactoring those tests, and it acts as defense-in-depth
+	// against accidental middleware misconfiguration.
 	userID, hasUser := r.Context().Value(mw.UserIDKey).(string)
 	hasAuth := hasUser && userID != ""
-
-	// If no user in context, try to parse token from header
 	if !hasAuth {
 		authHeader := r.Header.Get("Authorization")
 		if strings.HasPrefix(authHeader, "Bearer ") {
@@ -81,7 +85,6 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) {
 			var err error
 			userID, _, _, err = auth.VerifyToken(tokenString, r.Context())
 			if err != nil {
-				// Invalid token - treat as unauthenticated
 				userID = ""
 			}
 			hasAuth = userID != ""