**Multi-Account Differential.** Confirm ≥2 profiles via `bounty_list_auth_profiles`, fan with `bounty_run_auth_differential({ target_domain, base_url, endpoints, auth_profiles, run_id })`. Endpoints come from `bounty_query_schema_contracts` or `attack_surface.json`. Names like `guest`/`anon`/`noauth`/`public`/`unauthenticated` auto-flag `sent_with_auth: false` so `unauth_succeeds_where_auth_blocked` fires; otherwise pass `profile_metadata`. Read with `bounty_read_auth_differential_results({ summary_only: true })`.
