diff --git a/e2e/access-lists.spec.ts b/e2e/access-lists.spec.ts
index 817a52d..8208760 100644
--- a/e2e/access-lists.spec.ts
+++ b/e2e/access-lists.spec.ts
@@ -120,7 +120,7 @@ test("state 1: no holder and no scope asks for the grant, and shows no table", a
   await page.goto("/admin/access-lists");
 
   await expect(page.getByRole("heading", { level: 1 })).toHaveText("Access lists");
-  await expect(page.locator(".lede")).toContainText("Nobody has granted");
+  await expect(page.locator(".page__lede")).toContainText("Nobody has granted");
   await expect(page.getByRole("link", { name: "Grant access" })).toHaveAttribute(
     "href",
     "/auth/eve/link?grant=access-lists",
@@ -137,7 +137,7 @@ test("state 2: a granted character with no holder gets the designate button", as
   await asAdmin(context);
   await page.goto("/admin/access-lists");
 
-  await expect(page.locator(".lede")).toContainText("Designate it as the holder");
+  await expect(page.locator(".page__lede")).toContainText("Designate it as the holder");
   await expect(page.getByRole("button", { name: "Designate as holder" })).toBeVisible();
   await expect(page.getByRole("link", { name: "Grant access" })).toHaveCount(0);
 });
@@ -155,12 +155,14 @@ test("state 3: a holder whose scope was dropped is offered the GRANTING link, no
   await seedWatched(characterId);
   await page.goto("/admin/access-lists");
 
-  await expect(page.locator(".lede")).toContainText("no longer carries the access-list");
+  await expect(page.locator(".page__lede")).toContainText(
+    "no longer carries the access-list",
+  );
   // Lowercase mid-sentence ("...it, so no reads are happening.") — this state's
   // sentence is one clause, unlike holder-needs-reauth/holder-no-token's
   // separate "No reads are happening." sentence — so the case must match the
   // actual copy rather than the brief's shorthand.
-  await expect(page.locator(".lede")).toContainText("no reads are happening");
+  await expect(page.locator(".page__lede")).toContainText("no reads are happening");
   await expect(page.getByRole("link", { name: "Re-grant access" })).toHaveAttribute(
     "href",
     "/auth/eve/link?grant=access-lists",
@@ -178,7 +180,7 @@ test("states 4 and 5: a stale authorization and a dead token are different sente
   await seedHolder(reauth.characterId);
   await seedCatalog(reauth.characterId);
   await page.goto("/admin/access-lists");
-  await expect(page.locator(".lede")).toContainText("authorization has gone stale");
+  await expect(page.locator(".page__lede")).toContainText("authorization has gone stale");
   await expect(page.getByRole("link", { name: "Re-authenticate" })).toBeVisible();
 
   await resetDb(db);
@@ -186,7 +188,7 @@ test("states 4 and 5: a stale authorization and a dead token are different sente
   await seedHolder(dead.characterId);
   await seedCatalog(dead.characterId);
   await page.goto("/admin/access-lists");
-  await expect(page.locator(".lede")).toContainText("no stored token");
+  await expect(page.locator(".page__lede")).toContainText("no stored token");
   await expect(
     page.getByRole("link", { name: "Add this character again" }),
   ).toBeVisible();
@@ -200,7 +202,9 @@ test("state 6: a healthy holder with an empty catalog offers Check now as the pr
   await seedHolder(characterId);
   await page.goto("/admin/access-lists");
 
-  await expect(page.locator(".lede")).toContainText("No lists have been discovered");
+  await expect(page.locator(".page__lede")).toContainText(
+    "No lists have been discovered",
+  );
   await expect(page.getByRole("button", { name: "Check now" })).toHaveClass(
     /btn--primary/,
   );
@@ -393,3 +397,159 @@ test("Check now enqueues a read and audits nothing", async ({ page, context }) =
     .where(eq(auditLog.action, "access_list.check_requested"));
   expect(audits).toHaveLength(0);
 });
+
+/**
+ * The never-read row is the ONLY row whose name cannot come from a snapshot,
+ * because it has no snapshot — `seedWatched` always writes one, so this test
+ * inserts the watch row bare. It is also the row an admin sees at the moment
+ * they care most: the seconds between adding a list and the job first reading
+ * it. `getWatchedListViews` used to select the name from the snapshot alone,
+ * so this row rendered as `#4001` — a number chosen by CCP, shown to a person
+ * who picked that list BY NAME out of the dropdown one click earlier. The
+ * catalog knew the name the entire time.
+ */
+test("a list added but never read is still named, not reduced to its id", async ({
+  page,
+  context,
+}) => {
+  const { characterId } = await asAdmin(context);
+  await seedHolder(characterId);
+  await seedCatalog(characterId, { name: "Fleet staging" });
+  // No snapshot row: watched, never read.
+  await db.insert(accessListWatch).values({ accessListId: LIST_ID, addedBy: "e2e" });
+  await page.goto("/admin/access-lists");
+
+  const row = page.locator(".acl-list__row");
+  await expect(row).toContainText("Fleet staging");
+  // The assertion that would have failed before the catalog join, kept
+  // separate from the positive one: a row can contain both, and "the name is
+  // present" is not the same claim as "the id is not standing in for it".
+  await expect(row).not.toContainText(`#${LIST_ID}`);
+
+  // The confirmation names it too, which takes `removeWatch`'s return value
+  // rather than the id the action already had in hand: the row said "Fleet
+  // staging" a moment ago, and a notice answering "#4001 removed" would leave
+  // the admin matching a number against a name they never saw here.
+  await row.getByRole("button", { name: "Stop watching" }).click();
+  await expect(page.locator(".notice").last()).toContainText(
+    "Fleet staging removed from the watchlist",
+  );
+});
+
+/**
+ * The dropdown's default is a real option rather than an absent one, and the
+ * select is `required`. Without the placeholder, `defaultValue=""` matched
+ * nothing rendered, so the browser selected the first list in the catalog and
+ * an untouched submit added a list the admin never chose. Without `required`,
+ * the placeholder alone only stopped the browser re-selecting it: a disabled
+ * selected option contributes no entry at all, so the submit still went, with
+ * no `accessListId` in it, and `parseId` threw `invalid_id` — an ordinary
+ * mis-click landing on the error boundary. Both halves are asserted below,
+ * because either one alone leaves a bad outcome.
+ */
+test("the add control cannot submit a list the admin never chose", async ({
+  page,
+  context,
+}) => {
+  const { characterId } = await asAdmin(context);
+  await seedHolder(characterId);
+  await seedCatalog(characterId, { accessListId: 4001, name: "Fleet staging" });
+  await seedCatalog(characterId, { accessListId: 4002, name: "Home defence" });
+  await page.goto("/admin/access-lists");
+
+  const select = page.locator("#add-list");
+  await expect(select).toHaveValue("");
+  await expect(select.locator("option[value='']")).toBeDisabled();
+
+  // Count the POSTs rather than inspecting the page afterwards. "Nothing was
+  // added" is the weaker claim — a server action that throws adds nothing
+  // either, and the admin is then looking at "Something broke". The claim
+  // worth pinning is that the mis-click never leaves the browser.
+  const posts: string[] = [];
+  page.on("request", (r) => {
+    if (r.method() === "POST") posts.push(r.url());
+  });
+  await page.getByRole("button", { name: "Add to watchlist" }).click();
+
+  // Read the validity state before asserting on `posts`: it is a round trip to
+  // the browser, so a submit that DID fire has been observed by the time the
+  // count is read.
+  expect(await select.evaluate((el: HTMLSelectElement) => el.validity.valueMissing)).toBe(
+    true,
+  );
+  expect(posts).toEqual([]);
+  expect(await db.select().from(accessListWatch)).toHaveLength(0);
+});
+
+/**
+ * The two stale-page presses. Neither is reachable by clicking alone — the
+ * `<select>` never offers a watched list, and a removed row takes its button
+ * with it — so both are reached the only way a real admin reaches them: the
+ * page renders, the table changes underneath it (another admin, another tab),
+ * and the press lands against a world that has moved. The seeds below make
+ * that change directly, between the render and the click.
+ *
+ * The copy is what is asserted, because the copy is the whole of the fix: both
+ * presses used to answer with the ordinary success sentence, crediting this
+ * admin with an act that had already happened without them.
+ */
+test("a removal whose row is already gone says so, and does not claim a removal", async ({
+  page,
+  context,
+}) => {
+  const { characterId } = await asAdmin(context);
+  await seedHolder(characterId);
+  await seedCatalog(characterId, { name: "Fleet staging" });
+  await seedWatched(characterId);
+  await page.goto("/admin/access-lists");
+
+  const row = page.locator(".acl-list__row");
+  await expect(row).toContainText("Fleet staging");
+  // Seeded with no entries against a one-member roster, so this row drifts and
+  // therefore expands: its "Stop watching" lives inside the drawer, and the
+  // drawer has to be open for the press to reach it.
+  await row.locator("summary").click();
+  // The other tab's removal, after this page has rendered its button.
+  await db.delete(accessListWatch).where(eq(accessListWatch.accessListId, LIST_ID));
+
+  await row.getByRole("button", { name: "Stop watching" }).click();
+  const notice = page.locator(".notice").last();
+  // Named, not numbered: the catalog row outlives the watch row, so the
+  // sentence about the press that did nothing can still say which list.
+  await expect(notice).toContainText("Fleet staging was already off the watchlist");
+  await expect(notice).not.toContainText("removed from the watchlist");
+  // `warn`, not the untoned success rendering — this action returns an
+  // `ActionOutcome`, so unlike the redirecting controls it has a tone channel
+  // and uses it.
+  await expect(notice).toHaveClass(/notice--warn/);
+  // No audit row: nothing was removed, so nothing in the history says it was.
+  // The audit table is why the boolean lives at the service layer rather than
+  // only in the copy.
+  expect(await db.select().from(auditLog)).toHaveLength(0);
+});
+
+test("an add of a list someone else already watched says nothing was added", async ({
+  page,
+  context,
+}) => {
+  const { characterId } = await asAdmin(context);
+  await seedHolder(characterId);
+  await seedCatalog(characterId, { name: "Fleet staging" });
+  await page.goto("/admin/access-lists");
+
+  await page.locator("#add-list").selectOption(String(LIST_ID));
+  // The other tab's add, after this page built its `<select>` from a catalog
+  // with nothing watched in it.
+  await db.insert(accessListWatch).values({ accessListId: LIST_ID, addedBy: "other" });
+
+  await page.getByRole("button", { name: "Add to watchlist" }).click();
+  const notice = page.locator(".notice").last();
+  await expect(notice).toContainText("already on the watchlist");
+  // The assertion that fails without the split marker: `doneNotice("watch")`
+  // is a perfectly good sentence to render here, and a wrong one.
+  await expect(notice).not.toContainText("List added to the watchlist");
+  // One watch row, and no audit row — the other tab wrote the row without
+  // going through `addWatch`, and this press wrote nothing at all.
+  expect(await db.select().from(accessListWatch)).toHaveLength(1);
+  expect(await db.select().from(auditLog)).toHaveLength(0);
+});
diff --git a/src/app/admin/access-lists/actions.ts b/src/app/admin/access-lists/actions.ts
index 9cb30d5..afcdc39 100644
--- a/src/app/admin/access-lists/actions.ts
+++ b/src/app/admin/access-lists/actions.ts
@@ -38,9 +38,18 @@ export async function designateHolderAction(formData: FormData): Promise<void> {
 export async function addWatchAction(formData: FormData): Promise<void> {
   const { accountId: actor } = await requireAdminAction();
   const accessListId = parseId(formData.get("accessListId"));
-  await addWatch(getDb(), accessListId, actor);
+  const added = await addWatch(getDb(), accessListId, actor);
   revalidatePath("/admin/access-lists");
-  redirect(`/admin/access-lists?done=watch&at=${Date.now()}`);
+  // Two markers, because a press that inserted nothing is not the press the
+  // admin thinks they made: the `<select>` only offers lists that were not
+  // watched when the page rendered, so landing here means someone else added
+  // it first (or this tab is a stale back-button). Unlike `removeWatchAction`
+  // below there is no tone channel — this control redirects, so its copy comes
+  // back through `doneNotice`/`ConfirmNotice`, which carry a sentence and
+  // nothing else — so the wording is the whole of the correction.
+  redirect(
+    `/admin/access-lists?done=${added ? "watch" : "watch-already"}&at=${Date.now()}`,
+  );
 }
 
 /**
@@ -74,7 +83,20 @@ export async function removeWatchAction(
 ): Promise<ActionOutcome> {
   const { accountId: actor } = await requireAdminAction();
   const accessListId = parseId(formData.get("accessListId"));
-  await removeWatch(getDb(), accessListId, actor);
+  const { removed, name } = await removeWatch(getDb(), accessListId, actor);
   revalidatePath("/admin/access-lists");
-  return { text: `Access list ${accessListId} removed from the watchlist.` };
+  // Same `#id` fallback the page itself uses for a name-less row
+  // (`page.tsx`'s `label`), so the confirmation and the row it described can
+  // never disagree about what an unnamed list was called.
+  const label = name ?? `#${accessListId}`;
+  // A press that deleted no row gets a `warn` outcome rather than the ordinary
+  // confirmation, the same shape and for the same reason as
+  // `admin/accounts/actions.ts`'s `not_linked` branch: the admin pressed a
+  // button on a row that another tab (or another admin) had already removed,
+  // and `revalidatePath` above is what makes the row disappear. Confirming it
+  // as a removal would credit this press with someone else's act.
+  if (!removed) {
+    return { text: `${label} was already off the watchlist.`, tone: "warn" };
+  }
+  return { text: `${label} removed from the watchlist.` };
 }
diff --git a/src/app/admin/access-lists/page.tsx b/src/app/admin/access-lists/page.tsx
index ff214bc..29ce29b 100644
--- a/src/app/admin/access-lists/page.tsx
+++ b/src/app/admin/access-lists/page.tsx
@@ -23,6 +23,7 @@ import { Disclosure } from "@/app/_components/disclosure";
 import { Submit } from "@/app/_components/submit";
 import { RelativeTime } from "@/app/_components/relative-time";
 import { formatAgo } from "@/app/_components/format-ago";
+import { StopWatching } from "./stop-watching";
 import {
   addWatchAction,
   checkNowAction,
@@ -131,10 +132,12 @@ export default async function AdminAccessListsPage({
 
   return (
     <main id="main" className="page page--wide">
-      <h1>Access lists</h1>
-      <ConfirmNotice text={notice} at={at} />
+      <div className="page__head">
+        <h1>Access lists</h1>
+        <p className="page__lede">{monitorSentence(state)}</p>
+      </div>
 
-      <p className="lede">{monitorSentence(state)}</p>
+      <ConfirmNotice text={notice} at={at} />
 
       <div className="btn-row btn-row--controls">
         {remedy.kind === "link" && (
@@ -162,14 +165,63 @@ export default async function AdminAccessListsPage({
 
       {showsObservations(state) && (
         <>
-          <RuleHead as="h2" aside={addable.length === 0 ? undefined : "add a list"}>
-            Watched lists
-          </RuleHead>
+          <RuleHead as="h2">Watched lists</RuleHead>
 
+          {/* Its own class rather than `.btn-row`: same four declarations
+              today, but the two answer to different things — `.btn-row` is
+              the shape of a row of buttons, and a change to it should not
+              have to reason about a label bound to a control. No `aside` on
+              the `RuleHead` above either — `aside` is a metadata slot (every
+              other user in `src/app` carries a fact: an ISK total, a
+              "checked … UTC" stamp, a filter summary — never an action name),
+              so the affordance's name was rendering as inert prose at the
+              rule's trailing edge rather than owning a control.
+
+              Not `.btn--primary`: this form renders in four of the five
+              states `showsObservations` admits (every one but `catalog-empty`,
+              which by definition has nothing addable), and in the three
+              dark-monitor ones the gold is already spent on `monitorRemedy`'s
+              link — re-granting a dropped scope outranks adding a list when
+              nothing is being read at all. Rather than paint it gold in
+              `normal` and plain elsewhere, which would make the emphasis a
+              function of an unrelated fault, it stays plain everywhere and
+              earns its place by sitting directly under the section it adds
+              to. */}
           {addable.length > 0 && (
-            <form action={addWatchAction} className="btn-row">
-              <label htmlFor="add-list">List</label>
-              <select id="add-list" name="accessListId" defaultValue="">
+            <form action={addWatchAction} className="acl-add">
+              <label className="acl-add__label" htmlFor="add-list">
+                Catalog
+              </label>
+              <select
+                id="add-list"
+                name="accessListId"
+                className="field"
+                defaultValue=""
+                required
+              >
+                {/* A real option for the default, not an absent one: every
+                    option below comes from `addable`, so with no placeholder
+                    the browser's ask-for-reset step selected the first list in
+                    the catalog and an untouched submit added a list the admin
+                    never chose, which the redirect then confirmed as a
+                    deliberate act.
+
+                    `required` is what makes the placeholder a guard rather
+                    than a label. `disabled` alone only stops the option being
+                    re-chosen; it does NOT stop the form submitting, and a
+                    disabled selected option contributes no entry at all — so
+                    an untouched submit sent no `accessListId`, `parseId` threw
+                    `invalid_id` on the resulting `null`, and an ordinary
+                    mis-click landed on the "Something broke" boundary
+                    (measured: the form's entry list held only `$ACTION_ID_…`).
+                    With `required` the browser refuses the submit and points
+                    at the field, and `parseId` goes back to being what its own
+                    docblock says it is — the backstop for a hand-crafted POST,
+                    not the only thing between a mis-click and the error
+                    page. */}
+                <option value="" disabled>
+                  Choose a list…
+                </option>
                 {addable.map((c) => (
                   <option key={c.accessListId} value={c.accessListId}>
                     {c.name}
@@ -268,56 +320,6 @@ export default async function AdminAccessListsPage({
   );
 }
 
-/**
- * The one control every watched row carries, expandable or not. A plain
- * submit button, not a form of its own: it submits the single `ConfirmingForm`
- * that wraps the whole watched-lists region (`AdminAccessListsPage` above),
- * carrying its own `accessListId` by name/value the way any button in a
- * shared HTML form does. `<form>` cannot nest, and this row's own form would
- * unmount with it anyway — the button's job ends at the press.
- *
- * The region-wide form exists because a row-level (or even row-level-group)
- * `ConfirmingForm` unmounts in the same commit that would paint its own
- * confirmation: `revalidatePath` and this action's `useActionState` result
- * land together, so removing the last row collapses straight to the empty
- * `Notice`, taking whatever reported the text with it.
- * `src/app/admin/accounts/page.tsx:1075-1097` documents the same failure for
- * the Discord drawer group and states the fix this page follows: "hoisting
- * the host alone is not enough... both halves have to outlive the press" —
- * here that means the `ConfirmingForm`, not just the `ConfirmGroup`, has to
- * sit above every row rather than inside one.
- *
- * No `pendingLabel` here, unlike every other `Submit` on this page.
- * `useFormStatus` (inside `Submit`) reports the nearest parent `<form>`'s
- * pending state, and after this refactor that form is shared by every row —
- * pressing one row's button flips `pending` for all of them at once, so a
- * "Removing…" label would name the wrong row on every row but the one
- * actually in flight. `aria-busy` still fans out the same way, but that is
- * honest rather than a bug: the shared form genuinely is busy, region-wide,
- * until the one submission it can hold at a time resolves. Same reason
- * `useSubmitGuard` correctly refuses a second press anywhere in the region
- * while the first is in flight, not just on the pressed row's own button —
- * one form, one in-flight submission. Undoing any of this would mean giving
- * the row its own form again, which is the exact structure that breaks the
- * confirmation.
- */
-function StopWatching({ accessListId, name }: { accessListId: number; name: string }) {
-  return (
-    <Submit
-      name="accessListId"
-      value={accessListId}
-      className="btn btn--quiet"
-      // Every watched row renders this button with the same visible words, so
-      // the accessible name has to carry the row's identity — `Submit`'s own
-      // rule for when an aria-label is required. The visible text stays
-      // "Stop watching"; the label appends the list it acts on.
-      aria-label={`Stop watching ${name}`}
-    >
-      Stop watching
-    </Submit>
-  );
-}
-
 /**
  * Names lead and ids are secondary throughout: the admin retypes these in-game,
  * where the id is not what the client accepts.
diff --git a/src/app/admin/access-lists/stop-watching.tsx b/src/app/admin/access-lists/stop-watching.tsx
new file mode 100644
index 0000000..33d59a0
--- /dev/null
+++ b/src/app/admin/access-lists/stop-watching.tsx
@@ -0,0 +1,83 @@
+"use client";
+
+import { useConfirmReport } from "@/app/_components/confirm-group";
+import { Submit } from "@/app/_components/submit";
+
+/**
+ * The one control every watched row carries, expandable or not. A plain
+ * submit button, not a form of its own: it submits the single `ConfirmingForm`
+ * that wraps the whole watched-lists region (`page.tsx`'s
+ * `AdminAccessListsPage`), carrying its own `accessListId` by name/value the
+ * way any button in a shared HTML form does. `<form>` cannot nest, and this
+ * row's own form would unmount with it anyway — the button's job ends at the
+ * press.
+ *
+ * The region-wide form exists because a row-level (or even row-level-group)
+ * `ConfirmingForm` unmounts in the same commit that would paint its own
+ * confirmation: `revalidatePath` and this action's `useActionState` result
+ * land together, so removing the last row collapses straight to the empty
+ * `Notice`, taking whatever reported the text with it.
+ * `src/app/admin/accounts/page.tsx:1075-1097` documents the same failure for
+ * the Discord drawer group and states the fix this page follows: "hoisting
+ * the host alone is not enough... both halves have to outlive the press" —
+ * here that means the `ConfirmingForm`, not just the `ConfirmGroup`, has to
+ * sit above every row rather than inside one.
+ *
+ * A client component rather than part of `page.tsx`'s server tree, and only
+ * for the refusal channel below: `onRefused` is a function, which a server
+ * component cannot hand to a client one.
+ *
+ * No `pendingLabel` here, unlike every other `Submit` on this page.
+ * `useFormStatus` (inside `Submit`) reports the nearest parent `<form>`'s
+ * pending state, and that form is shared by every row — pressing one row's
+ * button flips `pending` for all of them at once, so a "Removing…" label would
+ * name the wrong row on every row but the one actually in flight. `aria-busy`
+ * still fans out the same way, but that is honest rather than a bug: the
+ * shared form genuinely is busy, region-wide, until the one submission it can
+ * hold at a time resolves. Same reason `useSubmitGuard` correctly refuses a
+ * second press anywhere in the region while the first is in flight, not just
+ * on the pressed row's own button — one form, one in-flight submission.
+ * Undoing any of this would mean giving the row its own form again, which is
+ * the exact structure that breaks the confirmation.
+ */
+export function StopWatching({
+  accessListId,
+  name,
+}: {
+  accessListId: number;
+  name: string;
+}) {
+  // A refused re-press is otherwise entirely silent (`submit-guard.ts`): no
+  // POST, no response, nothing for `ConfirmingForm` to forward. Silence is the
+  // right answer where the first press navigates, and the wrong one here —
+  // `removeWatchAction` deliberately does not redirect (see `actions.ts`), so
+  // the page does not move and the admin is left watching a press do nothing.
+  // The region shares one form, so the button refused is frequently a
+  // DIFFERENT row's than the one in flight, which makes the silence harder to
+  // read here than anywhere else this pattern appears.
+  //
+  // Wording and safety follow `ConfirmSubmit`'s identical wiring
+  // (`_components/confirm-submit.tsx`): the sentence is safe to leave standing
+  // because the press was refused precisely because an action is in flight,
+  // and that action's own outcome overwrites it when it resolves.
+  const report = useConfirmReport();
+  return (
+    <Submit
+      name="accessListId"
+      value={accessListId}
+      className="btn btn--quiet"
+      // Every watched row renders this button with the same visible words, so
+      // the accessible name has to carry the row's identity — `Submit`'s own
+      // rule for when an aria-label is required. The visible text stays
+      // "Stop watching"; the label appends the list it acts on.
+      aria-label={`Stop watching ${name}`}
+      onRefused={
+        report
+          ? () => report({ text: "Still working on the last press.", tone: "warn" })
+          : undefined
+      }
+    >
+      Stop watching
+    </Submit>
+  );
+}
diff --git a/src/app/admin/access-lists/view.ts b/src/app/admin/access-lists/view.ts
index 9a4b1f3..d59a454 100644
--- a/src/app/admin/access-lists/view.ts
+++ b/src/app/admin/access-lists/view.ts
@@ -77,6 +77,19 @@ export function monitorState(input: MonitorInput): MonitorState {
  * holder makes these the likeliest way the feature dies quietly, and a page
  * that renders zero rows without saying why is indistinguishable from a page
  * saying everything is fine.
+ *
+ * `normal` used to be the one exception: five words naming the holder and
+ * nothing else, on the theory that a healthy state needs no explaining. It is
+ * also the state scanned most, by the admin who arrives when nothing is wrong
+ * and is never told what this page even compares. It now says that much.
+ *
+ * What it deliberately does NOT say is that reads are healthy. `monitorState`
+ * reaches `normal` on a designated holder with the scope, a valid token, and a
+ * non-empty catalog — it never looks at any row's `readStatus`, which lives on
+ * the snapshot and is per-list. Every watched row can be `failed` or
+ * `not_visible` in this state, both of which `rowTone` turns warn. A summary claiming reads are fine, printed directly above the rows
+ * disproving it, is the failure this docblock's first paragraph exists to
+ * prevent, so the sentence stays limited to what the state actually knows.
  */
 export function monitorSentence(state: MonitorState): string {
   switch (state.kind) {
@@ -109,7 +122,10 @@ export function monitorSentence(state: MonitorState): string {
     case "catalog-empty":
       return `${state.holder.name} is the holder. No lists have been discovered yet.`;
     case "normal":
-      return `${state.holder.name} is the holder.`;
+      return (
+        `${state.holder.name} is the holder. This page compares the alliance ` +
+        "roster against the in-game access lists watched below."
+      );
   }
 }
 
@@ -253,9 +269,11 @@ export function doneStamp(at: string | undefined): string | null {
 
 /**
  * The outcome of the press that produced this render, for the three actions
- * that redirect. An unrecognized marker yields the empty string rather than
- * being echoed — `Notice` renders an empty slot for it, which is the shape
- * that keeps its live region announcing changes rather than being born full.
+ * that redirect. Four markers rather than three: `addWatchAction` splits on
+ * whether it inserted anything. An unrecognized marker yields the empty string
+ * rather than being echoed — `Notice` renders an empty slot for it, which is
+ * the shape that keeps its live region announcing changes rather than being
+ * born full.
  */
 export function doneNotice(done: string | undefined, at: string | undefined): string {
   const stamp = doneStamp(at);
@@ -266,6 +284,13 @@ export function doneNotice(done: string | undefined, at: string | undefined): st
   if (done === "watch") {
     return `List added to the watchlist${when}. It is read on the next run.`;
   }
+  // The idempotent add. Reached only from a stale page — the `<select>` offers
+  // nothing already watched — so it says what the press did (nothing) rather
+  // than repeating the success sentence above. `ConfirmNotice` renders a
+  // sentence and no tone, so the wording carries the correction alone.
+  if (done === "watch-already") {
+    return `That list was already on the watchlist${when}. Nothing was added.`;
+  }
   if (done === "check") {
     return `Check queued${when}. Reload this page once the worker has run.`;
   }
diff --git a/src/app/globals.css b/src/app/globals.css
index 43478bc..eeaba5a 100644
--- a/src/app/globals.css
+++ b/src/app/globals.css
@@ -380,6 +380,7 @@ a:hover {
 .facts dt,
 .filters__label,
 .filter-form__label,
+.acl-add__label,
 .launch__scopes-head,
 .shell__register,
 .acl-detail th,
@@ -760,17 +761,6 @@ a:hover {
   margin-top: var(--s-2);
 }
 
-/* The access-list monitor's own lede: same treatment as `.page__lede`, but
-   the page has no `.page__head` wrapper around its `<h1>` — `AdminAccessListsPage`
-   sits the summary sentence directly after it (and, when there is one, the
-   redirect-carried `ConfirmNotice`), so the class has to stand on its own
-   rather than as a child selector. */
-.lede {
-  max-width: var(--measure);
-  color: var(--ink-dim);
-  margin-top: var(--s-2);
-}
-
 /* Mission-patch furniture: a small designation above the page's own H1,
    naming the instrument rather than the page — DESIGN.md's own metaphor for
    this surface ("the flight log, not the cockpit display"). One live use
@@ -4622,6 +4612,27 @@ h3.rule-head__label {
    with no drawer at all (`rowHasDetail`, page.tsx), which `.strip`'s jobs
    never need to. */
 
+/* The catalog-to-watchlist control: a label, a select, a submit, on one line
+   above the list it adds to. The four declarations are `.btn-row`'s today,
+   but the two names answer to different things — `.btn-row` describes a row
+   of buttons, and a change to how buttons sit together should not have to
+   reason about a label bound to a control — so this keeps its own class and
+   `.acl-add__label` joins the register (near the top of this file) rather
+   than rendering as an unregistered proportional label beside this section's
+   mono uppercase `RuleHead`. */
+.acl-add {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--s-2);
+  align-items: center;
+}
+
+.acl-add__label {
+  letter-spacing: var(--track-label);
+  color: var(--ink-faint);
+  margin-right: var(--s-1);
+}
+
 .acl-list {
   list-style: none;
   margin: var(--s-4) 0 0;
diff --git a/src/services/access-lists.ts b/src/services/access-lists.ts
index fca4367..77df495 100644
--- a/src/services/access-lists.ts
+++ b/src/services/access-lists.ts
@@ -1,4 +1,4 @@
-import { and, asc, eq, inArray } from "drizzle-orm";
+import { and, asc, eq, inArray, sql } from "drizzle-orm";
 import type { Db, Dbx } from "@/db";
 import {
   accessListCatalog,
@@ -107,35 +107,53 @@ async function watchedListName(dbx: Dbx, accessListId: number): Promise<string |
  * Adds a list to the shared watchlist. Idempotent: watching an already-watched
  * list changes nothing and therefore audits nothing, so a double submit does
  * not manufacture history.
+ *
+ * Returns whether a row was actually inserted, which is the same fact the
+ * audit branch turns on. The caller needs it because "idempotent" and
+ * "confirmed as done" are different claims: the page filters already-watched
+ * lists out of its `<select>`, so reaching this branch means the admin was
+ * looking at a stale catalog, and telling them the list was added would
+ * describe an act that did not happen.
  */
 export async function addWatch(
   db: Db,
   accessListId: number,
   actor: string,
-): Promise<void> {
-  await db.transaction(async (tx) => {
+): Promise<boolean> {
+  return db.transaction(async (tx) => {
     const inserted = await tx
       .insert(accessListWatch)
       .values({ accessListId, addedAt: new Date(), addedBy: actor })
       .onConflictDoNothing({ target: accessListWatch.accessListId })
       .returning({ accessListId: accessListWatch.accessListId });
-    if (inserted.length === 0) return;
+    if (inserted.length === 0) return false;
     await logAudit(tx, {
       actor,
       action: "access_list.watch_added",
       target: String(accessListId),
       details: { accessListId, name: await watchedListName(tx, accessListId) },
     });
+    return true;
   });
 }
 
-/** Removes a list from the watchlist. Audits only when a row actually went. */
+/**
+ * Removes a list from the watchlist. Audits only when a row actually went.
+ *
+ * Returns both halves the caller needs to write an honest confirmation: the
+ * name it read (the same one that lands in the audit row, when one is written)
+ * so the list can be named rather than numbered, and `removed` so a press that
+ * deleted nothing is not confirmed as a removal. `name` is populated on both
+ * branches — the catalog and snapshot rows outlive the watch row, so a list
+ * that was already off the watchlist can still be named in the notice saying
+ * so.
+ */
 export async function removeWatch(
   db: Db,
   accessListId: number,
   actor: string,
-): Promise<void> {
-  await db.transaction(async (tx) => {
+): Promise<{ removed: boolean; name: string | null }> {
+  return db.transaction(async (tx) => {
     // Read the name BEFORE the delete: nothing here cascades to the snapshot,
     // but reading first keeps the audit row correct regardless of what a later
     // change makes the delete cascade to.
@@ -144,13 +162,14 @@ export async function removeWatch(
       .delete(accessListWatch)
       .where(eq(accessListWatch.accessListId, accessListId))
       .returning({ accessListId: accessListWatch.accessListId });
-    if (removed.length === 0) return;
+    if (removed.length === 0) return { removed: false, name };
     await logAudit(tx, {
       actor,
       action: "access_list.watch_removed",
       target: String(accessListId),
       details: { accessListId, name },
     });
+    return { removed: true, name };
   });
 }
 
@@ -207,12 +226,27 @@ export type WatchedListView = {
  * Every watched list, LEFT-joined to its snapshot: a list added to the
  * watchlist a minute ago has no snapshot row at all, and that "never read"
  * state is one the page renders rather than a row it drops.
+ *
+ * Also LEFT-joined to the catalog, with the name sourced as
+ * COALESCE(catalog, snapshot): a list can be watched before the worker ever
+ * takes a snapshot of it, in which case only the catalog has a name at all.
+ *
+ * The two sources rarely disagree — a successful read writes `snapshot.name`
+ * and `catalog.name` from the same ESI detail in one transaction
+ * (`jobs/access-lists.ts`) — so the precedence only decides the edges, and
+ * both edges want the catalog first: a watched-but-never-read list has only a
+ * catalog row, and a list the holder can no longer see is pruned from the
+ * catalog by discovery, leaving only the last snapshot. Keeping this in the
+ * same order as `watchedListName()` above is load-bearing: the page and the
+ * audit log must never disagree about what a list is called.
  */
 export async function getWatchedListViews(dbx: Dbx): Promise<WatchedListView[]> {
   const rows = await dbx
     .select({
       accessListId: accessListWatch.accessListId,
-      name: accessListSnapshot.name,
+      name: sql<
+        string | null
+      >`coalesce(${accessListCatalog.name}, ${accessListSnapshot.name})`,
       readStatus: accessListSnapshot.readStatus,
       observedAt: accessListSnapshot.observedAt,
       lastAttemptAt: accessListSnapshot.lastAttemptAt,
@@ -224,6 +258,10 @@ export async function getWatchedListViews(dbx: Dbx): Promise<WatchedListView[]>
       accessListSnapshot,
       eq(accessListSnapshot.accessListId, accessListWatch.accessListId),
     )
+    .leftJoin(
+      accessListCatalog,
+      eq(accessListCatalog.accessListId, accessListWatch.accessListId),
+    )
     .orderBy(accessListWatch.accessListId);
   if (rows.length === 0) return [];
   const entries = await dbx
diff --git a/tests/access-lists-service.test.ts b/tests/access-lists-service.test.ts
index f744158..7edfa5d 100644
--- a/tests/access-lists-service.test.ts
+++ b/tests/access-lists-service.test.ts
@@ -141,6 +141,28 @@ describe("addWatch / removeWatch / getWatchedListIds", () => {
     expect(await audits()).toHaveLength(1);
   });
 
+  it("reports whether the press changed anything, so a no-op is not confirmed", async () => {
+    // The return values the two actions turn their copy on: a second add and a
+    // second remove both leave the table exactly as the first press did, and
+    // the only thing separating "added" from "was already there" is this
+    // boolean. Both are reachable from a stale page — the `<select>` and the
+    // row list are both built from a render that has since been overtaken.
+    const acc = await seedAccount(ctx.db, { tier: "member", isAdmin: true });
+    await seedCatalog(42, "Home Structures");
+    expect(await addWatch(ctx.db, 42, acc.id)).toBe(true);
+    expect(await addWatch(ctx.db, 42, acc.id)).toBe(false);
+    expect(await removeWatch(ctx.db, 42, acc.id)).toEqual({
+      removed: true,
+      name: "Home Structures",
+    });
+    // Still named on the no-op branch: the catalog row outlives the watch row,
+    // so the notice saying nothing happened can still say which list.
+    expect(await removeWatch(ctx.db, 42, acc.id)).toEqual({
+      removed: false,
+      name: "Home Structures",
+    });
+  });
+
   it("returns watched ids in a stable order", async () => {
     const acc = await seedAccount(ctx.db, { tier: "member", isAdmin: true });
     await addWatch(ctx.db, 9, acc.id);
diff --git a/tests/access-lists-view.test.ts b/tests/access-lists-view.test.ts
index 270b5f6..68f2902 100644
--- a/tests/access-lists-view.test.ts
+++ b/tests/access-lists-view.test.ts
@@ -111,7 +111,25 @@ describe("monitorState", () => {
   });
 
   it("7: a healthy holder with a catalog is normal", () => {
-    expect(monitorState(input()).kind).toBe("normal");
+    const s = monitorState(input());
+    expect(s.kind).toBe("normal");
+    // Names the holder and says what the page compares — the state an admin
+    // scans most is the one that used to explain itself least.
+    expect(monitorSentence(s)).toContain("Vela Kaine");
+    expect(monitorSentence(s)).toContain("compares");
+  });
+
+  it("normal never claims reads are healthy — it cannot know that", () => {
+    // `monitorState` reaches `normal` from holder + scope + token + catalog
+    // size. It never sees a `readStatus`, which is per-list and lives on the
+    // snapshot: `rowTone` below turns `failed` and `not_visible` rows warn,
+    // and every one of those rows renders under this sentence. A summary
+    // asserting reads are fine, printed above the rows disproving it, is the
+    // "looks fine while dead" failure this whole cascade exists to prevent.
+    const sentence = monitorSentence(monitorState(input()));
+    for (const claim of ["running normally", "reads are running", "no problems"]) {
+      expect(sentence).not.toContain(claim);
+    }
   });
 
   it("every dark-monitor state still shows the last observations", () => {
@@ -235,4 +253,15 @@ describe("doneNotice", () => {
     expect(doneNotice("nope", "1786500000000")).toBe("");
     expect(doneNotice(undefined, undefined)).toBe("");
   });
+
+  it("distinguishes an add that inserted from one that found the list already there", () => {
+    // `addWatchAction` picks the marker from `addWatch`'s return value. The
+    // two sentences must not be interchangeable: this control redirects, so
+    // there is no tone channel and the words are the whole of the correction.
+    const added = doneNotice("watch", "1786500000000");
+    const already = doneNotice("watch-already", "1786500000000");
+    expect(added).toContain("added to the watchlist");
+    expect(already).toContain("already on the watchlist");
+    expect(already).not.toContain("added to the watchlist");
+  });
 });