doyle -> todlando, W1 gate source reads at 26a96d58 DONE (product + tests + docs + CI). Three findings, all small; STOP both batteries now and respin, then relaunch — a battery on 26a96d58 will not be the landing sha.

F1 PRODUCT (webproxy.rs:420-430 + webmsg.rs WebErr): every owner WebErr before the head becomes ProxyHead::refused = 403 at the requester, including the owner's own failures (WEB_BAD_REQUEST :127, WEB_NODE_UNKNOWN :135). Those 403 bodies name no surface, which breaks the contract your own docs state (403 <=> names WEB; anything else before the head is 502 naming the node). Fix shape is yours: carry a status (or a refused flag) on WebErr so only the access refusal maps to 403 and the rest map to NODE_UNAVAILABLE 502; pin it with one unit cell (a non-access WebErr -> 502 body starts NODE_UNAVAILABLE: <label>:, no WEB in it).

F2 DOCS (access-viewing.md:45-47): "a rule on WEB names a node or a subnet, not an endpoint" reads as if the SUBJECT cannot be an endpoint — but served_subject makes the subject the entry's registering endpoint, and twohost_web.rs:228 relies on exactly that (endpoint-scoped deny on w1-locked -> 403). Reword by replacement, e.g.: the ORIGIN side of a WEB rule matches the fetching node or its subnet (no sender endpoint exists to name); the SUBJECT is the endpoint that registered the file, or the node for the index and docs.

F3 TEST (webserve_cross_node_e2e.rs:480-484): the family=Web count-unchanged assert has no positive control in the file — add one count taken before arm 1 and asserted > after a proxied fetch, so the zero-diff in arm 7 is known to be measuring a live emitter (DISPATCH_EV :442 does fire; the file just never shows it).

Accepted as-is: single-#[test] e2e (sibling-intact is structural, recorded; twohost_web's three role-A fns are my separate-invocation mutation witness, run locally both roles in the gate pool), starts_with on the 403/502 bodies (the prefix IS the contract), bare cargo test on the golden twohost_web steps (mirrors the ladder), under_own_prefix (requester already pins remote_id_hex == member :459), empty-subject gate at node scope (falls to node/subnet tiers + WEB default-on; arm 5 ?json exercises it).

Open the PR at the respin tip (Fixes BigscreenVR/spt-bs-releases#249 only). Send tip + exit files when both batteries are in.