diff --git a/zulip-health.prose.md b/zulip-health.prose.md
index 1e28d17..e4c96f0 100644
--- a/zulip-health.prose.md
+++ b/zulip-health.prose.md
@@ -197,15 +197,22 @@ Check `platforms.zulip.state`: `connected` ✅ | `disconnected` ❌ | `error` 
 **B2: Agent Process**
 
 ```bash
-ssh root@<CT> "ps aux | grep 'gateway run' | grep -v grep"
+# Probe from CT 115 (amdpve) to avoid SSH key issues on CT 117
+ssh root@192.168.68.15 "pct exec 112 'systemctl is-active dsh-web'"
 ```
 
-Gateway PID should exist with uptime > 60s. **Dual-gateway detection**: if more than one `gateway run` process is found, the gateway has a collision (typically one `--force` and one `--replace` process). Kill the newer/duplicate process, then restart the remaining gateway per-agent (parameterized 2026-08-09, captain ruling):
+Gateway should be active. **Dual-gateway detection**: check for duplicate processes.
 
-| Agent | Restart command | Notes |
-|-------|-----------------|-------|
+**B3: Gateway Health**
 
-Check gateway log for "Gateway running with 2 platform(s)" (not 1) to confirm Zulip reloaded.
+```bash
+# Probe localhost on CT 112 for DSH web service
+ssh root@192.168.68.15 "pct exec 112 'curl -s -o /dev/null -w \"%{http_code}\" http://127.0.0.1:3080/'"
+```
+
+Expected: any HTTP code (200, 302, 401, etc.) = gateway is alive. Connection refused = gateway down.
+
+**Note**: DSH web service listens on 127.0.0.1:3080 (loopback-only) by design. Public URL returns 302 through proxy-auth chain, not bare 200.
 
 **B3: Heartbeat Verification** (Hermes agent Mumuni only — Tanko has no Hermes gateway)