Exercise 2: Extending Rules Rather Than Replacing Them — Possible Solution
====================================================================

WHAT STAYED EXACTLY THE SAME
------------------------------
Chapter 6's create rule still checks that name is a non-empty string, that status is one of 'active' or 'used', and that addedAt equals request.time (enforcing serverTimestamp()). Chapter 9's update rule still checks that status is one of the two valid values and that a document with status 'used' never contains an expiryDate field. None of that original validation logic was removed or rewritten.

WHAT WAS ADDED
------------------------------
Each rule gained an additional ownership check joined with && alongside its existing conditions: create now also requires request.auth != null and request.auth.uid == request.resource.data.userId; update (and the newly added delete) now also require request.auth != null and request.auth.uid == resource.data.userId. The new checks confirm the caller is authenticated and owns the document, in addition to whatever shape/invariant checks already existed.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies that the original shape and invariant checks from Chapters 6 and 9 remain fully intact and unchanged, and correctly explains that this chapter adds ownership/authentication conditions alongside them via additional && clauses, rather than rewriting or replacing the earlier logic.