@@ -26,8 +26,21 @@ export type WakeWatch = {
   kind: string;
   note: string;
   identity: string;
+  /**
+   * Why the watch ended, from its last result — `terminal_unsatisfied` when the
+   * condition became impossible (a cancelled run, a deleted queue). Absent when
+   * the host doesn't carry it, and the banner falls back to the plain expiry.
+   */
+  endedReason?: string | null;
 };
 
+/**
+ * A watch that expired because its condition can never happen now. That IS an
+ * answer, so it gets its own headline instead of "no answer" — the watcher writes
+ * this reason when a check comes back `terminal_unsatisfied`.
+ */
+const TERMINAL_UNSATISFIED = "terminal_unsatisfied";
+
 export type WakeRef = { watchId: string; outcome: WakeOutcome };
 
 /**
@@ -62,8 +75,17 @@ function toneFor(outcome: WakeOutcome, kind: string | undefined): AgentTone {
   return "neutral";
 }
 
-function headlineFor(tone: AgentTone, outcome: WakeOutcome): string {
-  if (outcome === "expired") return "Watch expired — no answer";
+/** The banner's headline. Exported for the tests; the component owns the tone. */
+export function wakeHeadline(
+  outcome: WakeOutcome,
+  watch: Pick<WakeWatch, "endedReason"> | undefined,
+  tone: AgentTone
+): string {
+  if (outcome === "expired") {
+    return watch?.endedReason === TERMINAL_UNSATISFIED
+      ? "Watch ended — the condition can no longer happen"
+      : "Watch expired — no answer";
+  }
   switch (tone) {
     case "success":
       return "Watch update — all clear";
@@ -113,7 +135,7 @@ export function WakeBanner({
     >
       <Icon className={cn("mt-0.5 size-4 shrink-0", TONE_ICON_COLOR[tone])} />
       <div className="min-w-0">
-        <p className="text-sm font-medium text-text-bright">{headlineFor(tone, outcome)}</p>
+        <p className="text-sm font-medium text-text-bright">{wakeHeadline(outcome, watch, tone)}</p>
         <p className="truncate text-xs text-text-dimmed">{subline(watch)}</p>
       </div>
     </div>
 
@@ -25,6 +25,8 @@ export type WatchChip = {
   note: string;
   checkEveryMinutes: number;
   expiresAt: string;
+  /** Last check's reason — the wake banner distinguishes terminal_unsatisfied. */
+  endedReason?: string | null;
 };
 
 const STATUS_TONE: Record<WatchStatus, AgentTone> = {
 
@@ -0,0 +1,25 @@
+// The wake banner's headline: what the user reads before the narration. The rule
+// pinned here is that an expiry with an ANSWER ("it can't happen any more") never
+// reads as the silent "no answer" expiry.
+import { describe, expect, it } from "vitest";
+import { wakeHeadline } from "./WakeBanner";
+
+describe("wakeHeadline", () => {
+  it("says the condition can no longer happen when the watch ended terminally", () => {
+    expect(wakeHeadline("expired", { endedReason: "terminal_unsatisfied" }, "neutral")).toBe(
+      "Watch ended — the condition can no longer happen"
+    );
+  });
+
+  it("keeps the plain expiry when the watch simply ran out of time", () => {
+    for (const watch of [undefined, { endedReason: null }, { endedReason: "not_met_by_expiry" }]) {
+      expect(wakeHeadline("expired", watch, "neutral")).toBe("Watch expired — no answer");
+    }
+  });
+
+  it("words a fire by its tone", () => {
+    expect(wakeHeadline("fired", undefined, "success")).toBe("Watch update — all clear");
+    expect(wakeHeadline("fired", undefined, "error")).toBe("Watch update — needs your attention");
+    expect(wakeHeadline("fired", undefined, "neutral")).toBe("Watch update — condition met");
+  });
+});
@@ -33,6 +33,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
     return json({ error: "Not allowed", code: "forbidden_client" }, { status: 403 });
   }
   const userId = authentication.userActor.userId;
+  // The turn's environment scope — the authority for the chat's project below.
+  const environmentId = authentication.userActor.environmentId;
+  if (!environmentId) {
+    return json(
+      { error: "This chat has no environment context.", code: "invalid_target" },
+      { status: 400 }
+    );
+  }
 
   const parsedParams = ParamsSchema.safeParse(params);
   if (!parsedParams.success) return json({ error: "Invalid params" }, { status: 400 });
@@ -48,9 +56,18 @@ export async function action({ request, params }: ActionFunctionArgs) {
     return json({ error: "Invalid request", code: "invalid_request" }, { status: 400 });
   }
 
-  const context = await resolveAgentAlertContext({ userId, ...body });
+  const context = await resolveAgentAlertContext({
+    userId,
+    environmentId,
+    chatId: body.chatId,
+    claimedEnvironmentId: body.environmentId,
+    claimedProjectRef: body.projectRef,
+  });
   if (!context.ok) {
-    return json({ error: context.error, code: context.code }, { status: 404 });
+    return json(
+      { error: context.error, code: context.code },
+      { status: context.code === "environment_mismatch" ? 400 : 404 }
+    );
   }
 
   const result = await unsubscribeChannelFromWatchAlerts(parsedParams.data.channelId, {
 
@@ -5,7 +5,10 @@ import {
   ProjectAlertEmailProperties,
   ProjectAlertSlackProperties,
 } from "~/models/projectAlert.server";
-import { resolveAgentAlertContext } from "~/services/dashboardAgentAlertContext.server";
+import {
+  resolveAgentAlertContext,
+  type AgentAlertContextError,
+} from "~/services/dashboardAgentAlertContext.server";
 import {
   canUseDashboardAgentEmailAlerts,
   DASHBOARD_AGENT_WATCH_ALERT_TYPE,
@@ -21,7 +24,8 @@ import { CreateAlertChannelService } from "~/v3/services/alerts/createAlertChann
  *
  * Accepts ONLY the dashboard agent's delegated user-actor token, like the watches
  * endpoint: POST creates something that later mails a person, so the only caller
- * it trusts is the agent acting for the signed-in user in a live chat.
+ * it trusts is the agent acting for the signed-in user in a live chat. The
+ * environment is the token's, not the body's (see `resolveAgentAlertContext`).
  *
  * The plan/flag gate is enforced here AND at delivery, and its denial carries a
  * machine-readable `reason` so the agent can say why instead of guessing.
@@ -42,18 +46,38 @@ const CreateBodySchema = z.object({
   projectRef: z.string().min(1).optional(),
 });
 
-async function authenticate(request: Request) {
+/**
+ * The preamble both handlers share: a dashboard-agent token, plus the environment
+ * scope the dashboard minted it with — which is the authority for everything here,
+ * so a token without one can't be used at all.
+ */
+async function authenticate(
+  request: Request
+): Promise<{ userId: string; environmentId: string } | { error: Response }> {
   const authentication = await authenticateUatOrApiRequest(request);
-  if (!authentication?.userActor) return undefined;
-  if (authentication.userActor.client !== "dashboard-agent") return undefined;
-  return authentication.userActor.userId;
+  const actor = authentication?.userActor;
+  if (!actor || actor.client !== "dashboard-agent") {
+    return { error: json({ error: "Invalid or missing access token" }, { status: 401 }) };
+  }
+  if (!actor.environmentId) {
+    return {
+      error: json(
+        { error: "This chat has no environment context.", code: "invalid_target" },
+        { status: 400 }
+      ),
+    };
+  }
+  return { userId: actor.userId, environmentId: actor.environmentId };
+}
+
+/** Context failures: a mismatched claim is the caller's error, the rest are 404s. */
+function contextStatus(code: AgentAlertContextError) {
+  return code === "environment_mismatch" ? 400 : 404;
 }
 
 export async function loader({ request }: LoaderFunctionArgs) {
-  const userId = await authenticate(request);
-  if (!userId) {
-    return json({ error: "Invalid or missing access token" }, { status: 401 });
-  }
+  const auth = await authenticate(request);
+  if ("error" in auth) return auth.error;
 
   const query = ListQuerySchema.safeParse(
     Object.fromEntries(new URL(request.url).searchParams.entries())
@@ -62,9 +86,18 @@ export async function loader({ request }: LoaderFunctionArgs) {
     return json({ error: "Invalid request", code: "invalid_request" }, { status: 400 });
   }
 
-  const context = await resolveAgentAlertContext({ userId, ...query.data });
+  const context = await resolveAgentAlertContext({
+    userId: auth.userId,
+    environmentId: auth.environmentId,
+    chatId: query.data.chatId,
+    claimedEnvironmentId: query.data.environmentId,
+    claimedProjectRef: query.data.projectRef,
+  });
   if (!context.ok) {
-    return json({ error: context.error, code: context.code }, { status: 404 });
+    return json(
+      { error: context.error, code: context.code },
+      { status: contextStatus(context.code) }
+    );
   }
 
   const channels = await $replica.projectAlertChannel.findMany({
@@ -92,10 +125,9 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: "Method not allowed" }, { status: 405 });
   }
 
-  const userId = await authenticate(request);
-  if (!userId) {
-    return json({ error: "Invalid or missing access token" }, { status: 401 });
-  }
+  const auth = await authenticate(request);
+  if ("error" in auth) return auth.error;
+  const { userId } = auth;
 
   let body: z.infer<typeof CreateBodySchema>;
   try {
@@ -110,12 +142,16 @@ export async function action({ request }: ActionFunctionArgs) {
 
   const context = await resolveAgentAlertContext({
     userId,
+    environmentId: auth.environmentId,
     chatId: body.chatId,
-    environmentId: body.environmentId,
-    projectRef: body.projectRef,
+    claimedEnvironmentId: body.environmentId,
+    claimedProjectRef: body.projectRef,
   });
   if (!context.ok) {
-    return json({ error: context.error, code: context.code }, { status: 404 });
+    return json(
+      { error: context.error, code: context.code },
+      { status: contextStatus(context.code) }
+    );
   }
   const { environment } = context;
 
 
@@ -1,5 +1,5 @@
 import { json, type ActionFunctionArgs } from "@remix-run/server-runtime";
-import { cancelWatch, getWatch, recordWatchTick } from "@internal/dashboard-agent-db";
+import { cancelWatch, getWatch, recordWatchCheck } from "@internal/dashboard-agent-db";
 import { z } from "zod";
 import { dashboardAgentDb } from "~/services/dashboardAgentDb.server";
 import { logger } from "~/services/logger.server";
@@ -26,10 +26,12 @@ import {
  *  3. the USER is re-authorized against that snapshot on EVERY call, and a revoked
  *     user gets the watch cancelled here, before any environment data is read.
  *
- * The route does NOT transition the watch to fired/expired. It records the tick
- * (which is also how the row keeps `lastResult` for the notification) and returns
- * the verdict; the watcher task owns the fire/expire transition and delivery, so
- * exactly one component decides when the user gets told.
+ * The route does NOT transition the watch to fired/expired, and does NOT advance
+ * the tick counter. It records what the check observed (`lastCheckedAt` plus the
+ * `lastResult` the notification reads) and returns the verdict; the watcher task
+ * owns the fire/expire transition and the delivery, so exactly one component
+ * decides when the user gets told. The tick counter likewise has exactly one
+ * writer — the task's generation claim — so nothing here can fork the tick chain.
  */
 
 const ParamsSchema = z.object({ watchId: z.string().min(1) });
@@ -142,10 +144,11 @@ export async function action({ request, params }: ActionFunctionArgs) {
     (error) => logger.error("Dashboard agent watch check failed", { watchId, error })
   );
 
-  // Record the tick even on the final evaluation: it stamps `lastCheckedAt` and
+  // Record the check even on the final evaluation: it stamps `lastCheckedAt` and
   // parks `lastResult` on the row, which is the payload the notification reads.
   // Guarded on `active`, so a concurrent fire/expire simply wins and this no-ops.
-  await recordWatchTick(dashboardAgentDb, {
+  // Never touches `tickCount` — see the note above.
+  await recordWatchCheck(dashboardAgentDb, {
     id: watchId,
     lastResult: { result: outcome.result, facts: outcome.facts, final: body.final === true },
   });
 
@@ -23,25 +23,29 @@ import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server"
  * later runs in the background on a user's behalf, so the only caller it trusts is
  * the agent acting for the signed-in user in a live chat.
  *
- * The token carries a userId and nothing else, so everything else is a claim to be
- * proven:
+ * Order of authority:
  *
- *   - the CHAT must be a live chat owned by that user, or a watch could be bound
- *     to (and later wake) someone else's conversation. That same scoped read also
- *     yields the chat's org and its project/environment context.
- *   - the ENVIRONMENT — from the body when the caller sends one, otherwise the
- *     chat's stored context — is re-authorized through the same path a background
- *     check uses, so the agent can't name an environment its user can't reach, and
- *     must belong to the chat's org.
+ *   - the ENVIRONMENT comes from the TOKEN, which the dashboard minted for the
+ *     environment the current turn is being taken in. Nothing in the request body
+ *     can widen or move it: an `environmentId`/`projectRef` that disagrees is a
+ *     400, and a token with no environment scope can't create a watch at all. A
+ *     chat's stored context is never consulted — it's a snapshot from whenever the
+ *     chat started, and would silently bind a watch to a stale environment.
+ *   - the CHAT must still be a live chat owned by that user, or a watch could be
+ *     bound to (and later wake) someone else's conversation. That scoped read also
+ *     yields the chat's org, which the token's environment must match.
+ *   - the environment is then re-authorized through the same path a background
+ *     check uses, so a watch is only created for an environment its user can reach
+ *     right now.
  */
 
 const BodySchema = z.object({
   spec: watchSpecSchema,
   chatId: z.string().min(1),
   /**
-   * Optional overrides for the chat's stored context. `environmentId` is
-   * `RuntimeEnvironment.id` — the canonical environment identity (VERDICTS §3).
-   * Both are re-authorized, never trusted.
+   * Echoes of the turn's environment, if the caller sends them. Not overrides:
+   * they're only ever checked against the token's environment scope, which is the
+   * canonical `RuntimeEnvironment.id` (VERDICTS §3).
    */
   projectRef: z.string().min(1).optional(),
   environmentId: z.string().min(1).optional(),
@@ -60,6 +64,15 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: "Not allowed", code: "forbidden_client" }, { status: 403 });
   }
   const userId = authentication.userActor.userId;
+  // The environment this turn is scoped to. Absent means the turn was minted
+  // without one, and there is nothing to fall back to that we'd trust.
+  const environmentId = authentication.userActor.environmentId;
+  if (!environmentId) {
+    return json(
+      { error: "This chat has no environment context to watch in.", code: "invalid_target" },
+      { status: 400 }
+    );
+  }
 
   let parsed: z.infer<typeof BodySchema>;
   try {
@@ -72,22 +85,26 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: "Invalid watch request", code: "invalid_request" }, { status: 400 });
   }
 
+  // A body that names a different environment than the turn is a bug or an
+  // attempt to move the watch — either way, refuse rather than silently pick one.
+  if (parsed.environmentId && parsed.environmentId !== environmentId) {
+    return json(
+      {
+        error: "That environment isn't the one this chat is open in.",
+        code: "environment_mismatch",
+      },
+      { status: 400 }
+    );
+  }
+
   try {
-    // Ownership first — a chat this user doesn't own doesn't exist as far as this
+    // Ownership — a chat this user doesn't own doesn't exist as far as this
     // endpoint is concerned, and nothing is written.
     const chat = await resolveChatWatchContext({ chatId: parsed.chatId, userId });
     if (!chat) {
       return json({ error: "Chat not found", code: "chat_not_found" }, { status: 404 });
     }
 
-    const environmentId = parsed.environmentId ?? chat.environmentId;
-    if (!environmentId) {
-      return json(
-        { error: "This chat has no environment context to watch in.", code: "invalid_target" },
-        { status: 400 }
-      );
-    }
-
     // The same authorization a background check applies, so a watch is only ever
     // created for an environment its user can reach right now.
     const environment = await authorizeWatchEnvironmentById({ userId, environmentId });
@@ -98,9 +115,15 @@ export async function action({ request }: ActionFunctionArgs) {
     if (environment.organizationId !== chat.organizationId) {
       return json({ error: "Environment not found", code: "invalid_target" }, { status: 404 });
     }
-    const projectRef = parsed.projectRef ?? chat.projectRef;
-    if (projectRef && environment.project.externalRef !== projectRef) {
-      return json({ error: "Environment not found", code: "invalid_target" }, { status: 404 });
+    // Same check as `environmentId`, for callers that send the project instead.
+    if (parsed.projectRef && environment.project.externalRef !== parsed.projectRef) {
+      return json(
+        {
+          error: "That project isn't the one this chat is open in.",
+          code: "environment_mismatch",
+        },
+        { status: 400 }
+      );
     }
 
     const result = await createDashboardAgentWatch({