diff --git a/agent99-sre-alert-inbox.ps1 b/agent99-sre-alert-inbox.ps1
index 66c0e48ad..79baa43c1 100644
--- a/agent99-sre-alert-inbox.ps1
+++ b/agent99-sre-alert-inbox.ps1
@@ -405,7 +405,7 @@ function Test-Agent99ControlPlaneHealthEnvelope {
   $executor = [string](Get-AgentField $typedRoute "executor" "")
   $verifier = [string](Get-AgentField $typedRoute "verifier" "")
   if (
-    $canonicalAssetId -ne "host_99" -or
+    $canonicalAssetId -ne "windows-vmware:host_99" -or
     $targetKind -ne "windows_vmware" -or
     $executor -ne "Agent99" -or
     $verifier -ne "agent99_control_plane_selfcheck_independent_verifier"
@@ -435,7 +435,7 @@ function Test-Agent99ControlPlaneHealthEnvelope {
   $dispatchIdentity = Get-AgentField $awoooiMetadata "agent99DispatchIdentity" $null
   if (
     -not $awoooiMetadata -or
-    [string](Get-AgentField $awoooiMetadata "canonicalAssetId" "") -ne "host_99" -or
+    [string](Get-AgentField $awoooiMetadata "canonicalAssetId" "") -ne "windows-vmware:host_99" -or
     [string](Get-AgentField $awoooiMetadata "typedDomain" "") -ne "windows_vmware" -or
     [string](Get-AgentField $awoooiMetadata "assetResolutionStatus" "") -ne "resolved" -or
     -not $dispatchIdentity -or
diff --git a/apps/api/src/services/agent99_sre_bridge.py b/apps/api/src/services/agent99_sre_bridge.py
index 17712f16b..40a1d2da9 100644
--- a/apps/api/src/services/agent99_sre_bridge.py
+++ b/apps/api/src/services/agent99_sre_bridge.py
@@ -1227,7 +1227,8 @@ async def bridge_alertmanager_to_agent99(
                 and payload.get("force") is False
                 and resolved_route_id == AGENT99_CONTROL_PLANE_HEALTH_ROUTE_ID
                 and typed_target_route.get("resolution_status") == "resolved"
-                and typed_target_route.get("canonical_asset_id") == "host_99"
+                and typed_target_route.get("canonical_asset_id")
+                == "windows-vmware:host_99"
                 and typed_target_route.get("target_kind") == "windows_vmware"
                 and typed_target_route.get("executor") == "Agent99"
                 and typed_target_route.get("verifier")
diff --git a/apps/api/src/services/controlled_alert_target_router.py b/apps/api/src/services/controlled_alert_target_router.py
index b1e2da1fa..30c65c518 100644
--- a/apps/api/src/services/controlled_alert_target_router.py
+++ b/apps/api/src/services/controlled_alert_target_router.py
@@ -527,7 +527,7 @@ def resolve_typed_alert_target(
             target_kind="windows_vmware",
             target_resource=target_resource or "Agent99",
             namespace=namespace,
-            canonical_asset_id="host_99",
+            canonical_asset_id="windows-vmware:host_99",
             host=_HOSTS["99"][1],
             executor="Agent99",
             verifier="agent99_control_plane_selfcheck_independent_verifier",
diff --git a/apps/api/tests/test_agent99_alert_dispatch_order_contract.py b/apps/api/tests/test_agent99_alert_dispatch_order_contract.py
index ff815230b..6d008d522 100644
--- a/apps/api/tests/test_agent99_alert_dispatch_order_contract.py
+++ b/apps/api/tests/test_agent99_alert_dispatch_order_contract.py
@@ -188,7 +188,7 @@ def test_agent99_control_plane_health_is_exact_selfcheck_no_write() -> None:
         "crossDomainFallbackAllowed",
     ):
         assert f'"{policy_field}"' in guard
-    assert '$canonicalAssetId -ne "host_99"' in guard
+    assert '$canonicalAssetId -ne "windows-vmware:host_99"' in guard
     assert '$targetKind -ne "windows_vmware"' in guard
     assert '$executor -ne "Agent99"' in guard
     assert '"agent99_control_plane_selfcheck_independent_verifier"' in guard
diff --git a/apps/api/tests/test_agent99_control_plane_health_route.py b/apps/api/tests/test_agent99_control_plane_health_route.py
index 42cc7590b..3c5375ffc 100644
--- a/apps/api/tests/test_agent99_control_plane_health_route.py
+++ b/apps/api/tests/test_agent99_control_plane_health_route.py
@@ -77,7 +77,7 @@ def test_agent99_control_plane_payload_is_host99_selfcheck_only() -> None:
     assert payload["controlledApply"] is False
     assert payload["force"] is False
     assert typed_route["resolution_status"] == "resolved"
-    assert typed_route["canonical_asset_id"] == "host_99"
+    assert typed_route["canonical_asset_id"] == "windows-vmware:host_99"
     assert typed_route["target_kind"] == "windows_vmware"
     assert typed_route["executor"] == "Agent99"
     assert typed_route["verifier"] == (
@@ -147,7 +147,7 @@ def test_agent99_dispatch_scope_is_bound_to_same_run(monkeypatch) -> None:
         "suggested_mode": "SelfCheck",
         "target_resource": "Agent99",
         "controlled_apply_requested": False,
-        "canonical_asset_id": "host_99",
+        "canonical_asset_id": "windows-vmware:host_99",
         "typed_domain": "windows_vmware",
         "executor": "Agent99",
         "verifier": "agent99_control_plane_selfcheck_independent_verifier",