Authority: Doyle RNCYMURP (delivery 82), reinforced GQF2NYS4 (delivery 83).
Task: unchanged-S4 discriminator only. No product plumbing, commit, assembly edits, Windows producers, or product-fix validation gates.
Pinned source: 35d6f7a38f2189455f1a9e1a85a86b1e4bc0481a.
Local source: .worktrees/304-web-helper-rca.
Linux source: /home/reavus/projects/spt-core/spt-core/.worktrees/304-web-helper-rca.
Linux target: source tree's own target/, never another tree's pool.

SOURCE FINDINGS (runtime verdicts remain separate)
1. Failure is the daemon helper, not the CLI. webproxy.rs:522-527 queries servehost::docs_port(seed_socket_name()), emits DOCS_PORT_DISCOVERY_FAILED for an error, then returns WebServeOutcome::Failed. The scoped registration was already saved at servehost::apply_at before this query. A saved row is not proof that the helper returned a URL.
2. serveverb.rs:77-104 already permits NotFound | ConnectionRefused as the CLI-only offline fallback. This predicate is not a fix target. A running helper cannot substitute configured ports for a real bound listener.
3. endpoint.rs:23-39 derives separate seed and broker names from the active spt_home() hash. The failing query targets the canonical seed-control name of the B fixture's private home, not its invented broker name.
4. transport.rs:36-55 uses GenericNamespaced names. On Linux these are abstract-namespace Unix sockets; on Windows named pipes. The Linux missing listener can report ConnectionRefused, while Windows missing named pipe generally reports NotFound. This is not evidence of a stale filesystem socket. No platform runtime claim is made here.
5. seedmap.rs:182-184 handles KIND_SERVE_REQUEST. Broker does not: broker.rs:6421-6422 rejects unknown commands. Merely replacing the seed name with the owning broker name targets the wrong protocol. docs_server_e2e.rs:29-33 already documents this exact fixture mistake.
6. Production docs HTTP listener is owned by the broker (daemon.rs:310-316); production dispatcher/peer pump run in the separate brain process (brainproc.rs:422-440; daemon.rs:461-468). BOUND_DOCS_PORT is process-local (docshost.rs:28-45). Unconditionally reading it inside the brain would break production. Canonical seed-control IPC intentionally reaches the owner.
7. Role B's rig_broker creates only an invented-name Broker/NetHost (twohost_web.rs:256-270,725-726). B does not start a seed-control server or docs HTTP listener. A's requester does start a docs listener (1117-1124), but that is another process/host and cannot satisfy B's discovery.
8. DocsStatus is produced from the bound listener state (servehost.rs:158-162). port_from_status at399-409 accepts Some(nonzero); None/zero stay DOCS_LISTENER_UNAVAILABLE, unexpected replies stay DOCS_LISTENER_UNREPORTED. No policy change is authorized.
9. Passing single-host consumers did not cover this helper-success seam: webserve_cross_node_e2e.rs:31-45 moves the positive path to two-host coverage because same-host label collisions compromise the end-to-end routing setup; its 6c arm at767-790 tests the earlier agent-authored ingress decline. A direct ServeFor exchange isolates this seam without WAN ingress, gossip, or same-host HTTP routing aliases.
10. B's 4/5 and A's missing helperline are consistent with the failed helper counting as served dispatch while only a Registered reply publishes A's helperline, gating its next fetch. This is a source-based scheduling explanation, not a captured replay.

WITHDRAWN FIX SHAPES
- Add ConnectionRefused to the CLI predicate: already present and wrong process.
- Read bound_docs_port unconditionally inside helper worker: wrong production process.
- Pass the broker name to existing servehost::docs_port: wrong protocol.
- Add typed broker status plumbing: explicitly NOT authorized; discriminator decides whether any product defect exists.

PREDECLARED PAIR
One real local ServeFor fixture; two fresh native processes; same unchanged S4 product and fixture source.
Bare probe: invented owner broker name, no canonical seed-control server, no docs listener. Expect actual DOCS_PORT_DISCOVERY_FAILED and the Registered assertion to fail (native test exit 101). An earlier access, routing, transport, or compile failure is not this red.
Full control: identical fixture plus canonical seed-control server and broker-backed ephemeral HTTP listener in the owner process. Expect successful Registered reply whose URL uses the actual bound port, native test exit 0.
If full control is green: fixture defect confirmed; Hertz owns test-only S5, and this lane stops product work.
If full control is red: report exact error and stop, not invent another fix or retry.
No result is claimed until native stdout, stderr, and exits are captured.