diff --git a/.agents/aw/notes.md b/.agents/aw/notes.md
index ec43dfd4c..4c0978d9c 100644
--- a/.agents/aw/notes.md
+++ b/.agents/aw/notes.md
@@ -34,7 +34,9 @@ Values live in the sibling `environments.yml`, `ui.yml` and `telemetry.yml`; thi
 ## Telemetry
 
 - Dash0 dev org (`app.dash0-dev.com`), dataset `default`. Use the Dash0 MCP server whose `listDatasets` contains it, and set its key as `mcp_server` in `~/.agents/aw/config.yml`.
-- `service.namespace` is `lorekit` on every service in every environment, and production traffic sits in the same dataset and window. Separate a run's records by `deployment.environment.name` (`preview` on a PR preview, `local` or `development` locally) and, for web events, by the page host.
+- `service.namespace` is `lorekit` on every service in every environment, and production traffic sits in the same dataset and window. Separate a local run's records by `deployment.environment.name` (`local` or `development`); separate a preview run's web events by the page host and its `api` spans by web session (next bullet).
+- **A PR's web preview calls the production `api`.** `web-preview-deploy.yml` builds with no Supabase override, so the preview's browser RUM carries `deployment.environment.name=preview` while its `api` spans carry `production` and production's `service.version`, not the PR's backend. Scope those spans by `dash0.trace.origin.web.session.id`: collect the `session.id` of the run's web events whose `page.url.domain` is the preview host, then keep the `api` spans whose `dash0.trace.origin.web.session.id` is one of them. Never filter a PR preview's `api` spans by `deployment.environment.name=preview` — that value marks the preview Supabase project (`deploy.yml` sets `DEPLOYMENT_ENVIRONMENT=preview` there for main's staging deploy, and `/preview` deploys to it), which the automatic web preview never calls.
+- `page.url.domain` is the host the browser opened: the `lorekit-pr-<n>-…` alias or the immutable `lorekit-<hash>-…` deployment host, both linked from the sticky preview comment. Match the one the run used.
 - `service.name`: `web` (browser RUM and the Next.js server), `api` (every Edge Function, told apart by `faas.name`), `cli`, `e2e`. Web events have been seen from `production` and `preview` only.
 - Local export happens only when `.env.local` sets the `OTEL_*` variables; none arrived from local `web` in the 24 h before 2026-10-21. Without them, report `telemetry: skipped (no local export configured)` rather than a clean window.
 - Attribute reference: `docs/otel.md`. Smoke and CI runs are tagged `deployment.environment.name=test`.
diff --git a/.agents/aw/telemetry.yml b/.agents/aw/telemetry.yml
index cbe2bdd13..27098b8fe 100644
--- a/.agents/aw/telemetry.yml
+++ b/.agents/aw/telemetry.yml
@@ -7,8 +7,14 @@ environments:
   # Local export goes wherever your .env.local OTEL_* variables point; set the
   # dataset in your personal overlay. Every LoreKit service shares this namespace.
   local: { namespace: lorekit }
-  # PR previews (web on Vercel, api on the preview Supabase project) export to the
-  # shared org's `default` dataset with deployment.environment.name=preview.
+  # A PR's web preview (web-preview-deploy.yml) exports browser RUM to the shared
+  # org's `default` dataset with deployment.environment.name=preview, but it calls
+  # the PRODUCTION api: its api spans carry deployment.environment.name=production
+  # and production's service.version, not the PR's. Scope them by
+  # dash0.trace.origin.web.session.id, matched against the session.id of web
+  # events whose page.url.domain is the preview host; never by environment. api
+  # spans tagged `preview` come from the preview Supabase project (main's staging
+  # deploy, `/preview` builds), which a PR's web preview never calls.
   preview: { dataset: default, namespace: lorekit }
 web:
   service_name: web                   # SERVICE_NAME in packages/web/src/lib/dash0-rum.ts