diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 2f0cdfca8a..6a5f444787 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -2555,6 +2555,9 @@ jobs:
       CANDIDATE_SHA: ${{ inputs.checkout_sha || github.sha }}
       E2E_JOB: "1"
       INSTANCE_NAME: nclaw-e2e-${{ github.run_id }}-${{ github.run_attempt }}
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Exact staging image boots and completes the full E2E scenario"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Brev Launchable Docker host; NVIDIA hosted inference"
     steps:
       - name: Checkout trusted Launchable lane
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -3078,6 +3081,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-gateway-auth-contract"
+      E2E_AGENT_RUNTIME: "none"
+      E2E_OBSERVABLE_OUTCOME: "Gateway mTLS and sandbox JWT authentication boundaries hold"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
@@ -3156,9 +3162,21 @@ jobs:
       fail-fast: false
       matrix:
         agent: [openclaw, hermes, deepagents]
+        include:
+          - agent: openclaw
+            agent_runtime: openclaw
+            coverage_variant: openclaw
+          - agent: hermes
+            agent_runtime: hermes
+            coverage_variant: hermes
+          - agent: deepagents
+            agent_runtime: langchain-deepagents-code
+            coverage_variant: deepagents
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "mcp-bridge"
+      E2E_OBSERVABLE_OUTCOME: "Stable OpenShell MCP bridge reaches tools and inference"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/mcp-bridge/${{ matrix.agent }}
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
@@ -3483,6 +3501,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-credential-generation-window"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Credential expiry rotation detach and rebuild preserve the intended access window"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-credential-generation-window
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_OPENSHELL_CHANNEL: stable
@@ -3641,9 +3662,21 @@ jobs:
       fail-fast: false
       matrix:
         agent: [openclaw, hermes, deepagents]
+        include:
+          - agent: openclaw
+            agent_runtime: openclaw
+            coverage_variant: openclaw
+          - agent: hermes
+            agent_runtime: hermes
+            coverage_variant: hermes
+          - agent: deepagents
+            agent_runtime: langchain-deepagents-code
+            coverage_variant: deepagents
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "mcp-bridge-dev"
+      E2E_OBSERVABLE_OUTCOME: "Development OpenShell MCP bridge reaches tools and inference"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/mcp-bridge-dev/${{ matrix.agent }}
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
@@ -3842,13 +3875,19 @@ jobs:
           - platform: linux/amd64
             runner: ubuntu-24.04
             shard: linux-amd64
+            environment_or_inference_endpoint: "AMD64 Ubuntu; exact managed image startup"
+            coverage_variant: linux-amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
             shard: linux-arm64
+            environment_or_inference_endpoint: "Arm64 Ubuntu; exact managed image startup"
+            coverage_variant: linux-arm64
     env:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-multiarch-startup/${{ matrix.shard }}
       E2E_JOB: "1"
       E2E_TARGET_ID: "managed-image-multiarch-startup"
+      E2E_AGENT_RUNTIME: "openclaw + hermes + langchain-deepagents-code"
+      E2E_OBSERVABLE_OUTCOME: "Exact managed images start directly on the native architecture"
       RELEASE_E2E_ACTIVATION_PATH: ci/protected-managed-image-multiarch-activation-v1.json
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }}
       NEMOCLAW_PROTECTED_MANAGED_IMAGE_HEAD_SHA: ${{ inputs.checkout_sha || github.sha }}
@@ -4272,6 +4311,10 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/llama-cpp-dgx-spark-qualification
       E2E_JOB: "1"
       E2E_TARGET_ID: "llama-cpp-dgx-spark-qualification"
+      E2E_AGENT_RUNTIME: "unresolved"
+      E2E_OBSERVABLE_OUTCOME: "Exact NemoClaw-built llama.cpp image produces protected DGX Spark evidence"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA DGX Spark GB10; local llama.cpp inference"
+      E2E_UNRESOLVED_REASON: "The protected plan can enable or skip its OpenClaw subqualification"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }}
       NEMOCLAW_E2E_SHARD: linux-arm64-gpu-dgx-spark-gb10
       NEMOCLAW_LLAMA_CPP_QUALIFICATION_BASE_SHA: ${{ inputs.base_sha || github.event.before || github.sha }}
@@ -4463,6 +4506,9 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-protected-runtime
       E2E_JOB: "1"
       E2E_TARGET_ID: "managed-image-protected-runtime"
+      E2E_AGENT_RUNTIME: "openclaw + hermes + langchain-deepagents-code"
+      E2E_OBSERVABLE_OUTCOME: "Protected GPU runtime supports Ollama vLLM NIM rollback and cleanup"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA GPU runner; local and hosted inference services"
       E2E_WORKLOAD_SOURCE: "managed-image"
       RELEASE_E2E_ACTIVATION_PATH: ci/protected-managed-image-runtime-activation-v1.json
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
@@ -4741,6 +4787,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "hermes-e2e"
+      E2E_AGENT_RUNTIME: "hermes"
+      E2E_OBSERVABLE_OUTCOME: "Install onboarding health inference lifecycle dashboard and security succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; mock or NVIDIA hosted inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/hermes-e2e
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -4831,13 +4880,21 @@ jobs:
         include:
           - scenario: native
             sandbox_name: e2e-hgpu-native
+            observable_outcome: "Native GPU startup reaches the stable Ready route"
+            coverage_variant: native
           - scenario: fallback
             sandbox_name: e2e-hgpu-fallback
+            observable_outcome: "Fallback GPU startup reaches the stable Ready route"
+            coverage_variant: fallback
           - scenario: compatibility-only
             sandbox_name: e2e-hgpu-compat
+            observable_outcome: "Compatibility-only GPU startup reaches the stable Ready route"
+            coverage_variant: compatibility-only
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "hermes-gpu-startup"
+      E2E_AGENT_RUNTIME: "hermes"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA GPU runner; local GPU inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/hermes-gpu-startup/${{ matrix.scenario }}
       E2E_HERMES_GPU_STARTUP_SCENARIO: ${{ matrix.scenario }}
       NEMOCLAW_E2E_SHARD: ${{ matrix.scenario }}
@@ -5139,6 +5196,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "cloud-onboard"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Public install onboarding hosted inference and security checks succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; NVIDIA hosted inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/cloud-onboard
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5261,6 +5321,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "messaging-providers"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Provider configuration redaction and optional real sends succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; NVIDIA hosted inference and messaging providers"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/messaging-providers
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5326,6 +5389,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openclaw-plugin-runtime-exdev-release"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Release baseline plugin runtime survives the EXDEV boundary"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; release baseline package; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openclaw-plugin-runtime-exdev-release
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5398,6 +5464,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openclaw-plugin-runtime-exdev"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Current plugin lifecycle rebuild and dependencies survive the EXDEV boundary"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; current package; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openclaw-plugin-runtime-exdev
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
diff --git a/test/e2e-recommendations.test.ts b/test/e2e-recommendations.test.ts
index 9dfb271141..514fc47fc4 100644
--- a/test/e2e-recommendations.test.ts
+++ b/test/e2e-recommendations.test.ts
@@ -54,6 +54,7 @@ const RUNTIME_INVENTORY_FILES = [
   "tools/advisors/e2e-text.mts",
   "tools/advisors/json.mts",
   "tools/advisors/risk-plan.mts",
+  "tools/e2e/execution-coverage.mts",
   "tools/e2e/target-catalogue.mts",
   "scripts/checks/llama-cpp-dgx-spark-qualification-paths.mts",
   "scripts/checks/protected-managed-image-contract.ts",
diff --git a/test/e2e/README.md b/test/e2e/README.md
index cf87a04953..e57135d38a 100644
--- a/test/e2e/README.md
+++ b/test/e2e/README.md
@@ -325,7 +325,36 @@ npx tsx tools/e2e/workflow-plan.mts --summary >> "$GITHUB_STEP_SUMMARY"
 ```
 
 The workflow's `--ci-output` mode uses the same renderer for its job summary.
-The table includes the typed registry matrix, shared test matrix, catalogue profile matrices, and retained workflow jobs.
+The table includes the typed registry matrix, shared test matrix, catalogue profile matrices, retained workflow jobs, and staging Brev execution.
+
+Each execution row declares three coverage fields:
+
+- `agentRuntime` names the agent runtime that the execution asserts. Use `none` when the execution does not start an agent. Use `unresolved` only with an `unresolvedReason`.
+- `observableOutcome` names the behavior that produces the evidence. Catalogue targets use their outcome-oriented `displayName` as this value.
+- `environmentOrInferenceEndpoint` names the host boundary or inference endpoint that distinguishes the evidence.
+
+Keep coverage metadata with the execution owner:
+
+- Catalogue targets declare it in `tools/e2e/target-catalogue.mts`.
+- Executable typed targets declare it in `test/e2e/registry/definitions/baseline.ts`.
+- Shared credential-free tests declare it in `tools/e2e/credential-free-tests.mts`.
+- Retained workflow jobs and staging Brev declare it in `.github/workflows/e2e.yaml`.
+
+Single workflow jobs use the `E2E_AGENT_RUNTIME`, `E2E_OBSERVABLE_OUTCOME`,
+`E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT`, and optional `E2E_UNRESOLVED_REASON`
+environment entries. Matrix jobs put variant-specific values in the corresponding
+snake-case include entries and use `coverage_variant` when one job contributes
+multiple rows. `tools/e2e/workflow-plan.mts` composes and validates these sources.
+Do not add a separate hand-maintained execution list.
+
+The default coverage matrix excludes explicit-only jobs and inert typed-registry declarations.
+The rendered report lists those categories separately.
+Explicit-only rows keep their coverage dimensions but do not join the default release matrix.
+Inert declarations report unresolved coverage fields and the missing executable ownership.
+
+The inert declarations are combinatorial gaps, not supported matrix cells. #8285 owns the decision on the inert cross-runtime foundation. #8286 owns executable-only registry cleanup after that decision. Do not schedule other Cartesian-product cells without an accepted supported combination. This migration removes no execution, so it requires no duplicate-to-retained-evidence mapping. A documented gap does not schedule a new combination or change release judgment.
+
+The report also groups repeated observable outcomes. Those rows are retained only when agent runtime or environment provides distinct evidence. Validation rejects two rows with the same three coverage dimensions.
 
 ## Launch-readiness locked-image acceptance
 
diff --git a/test/e2e/registry/definitions/baseline.ts b/test/e2e/registry/definitions/baseline.ts
index ea1dea6b24..8c86d461db 100644
--- a/test/e2e/registry/definitions/baseline.ts
+++ b/test/e2e/registry/definitions/baseline.ts
@@ -12,6 +12,10 @@ import {
   wslRepoDocker,
 } from "../matrix.ts";
 import type { ExpectedFailureContract, TargetDefinition, TargetEnvironment } from "../types.ts";
+import {
+  type E2eExecutionMetadata,
+  validateE2eExecutionMetadata,
+} from "../../../../tools/e2e/execution-coverage.mts";
 
 interface CanonicalTargetInput {
   id: string;
@@ -21,6 +25,7 @@ interface CanonicalTargetInput {
   suiteIds: string[];
   onboardingAssertionIds?: string[];
   description?: string;
+  executionCoverage?: E2eExecutionMetadata;
   runnerRequirements?: string[];
   requiredSecrets?: string[];
   skippedCapabilities?: Array<Record<string, unknown>>;
@@ -48,7 +53,15 @@ function canonicalTarget(input: CanonicalTargetInput): TargetDefinition {
   if (input.expectedFailure) {
     builder = builder.expectedFailure(input.expectedFailure);
   }
-  return builder.build();
+  const definition = builder.build();
+  if (!input.executionCoverage) return definition;
+  return {
+    ...definition,
+    executionCoverage: validateE2eExecutionMetadata(
+      input.executionCoverage,
+      `Typed E2E target ${input.id}`,
+    ),
+  };
 }
 
 const macosDockerSkipped = [
@@ -69,6 +82,12 @@ const canonicalTargetInputs: CanonicalTargetInput[] = [
     suiteIds: ["smoke", "inference", "credentials", "personal-stock-fetch"],
     description:
       "Ubuntu repo checkout with Docker, Personal policy, and cloud OpenClaw stock-fetch proof.",
+    executionCoverage: {
+      agentRuntime: "openclaw",
+      observableOutcome: "Repository install onboarding and hosted inference succeed",
+      environmentOrInferenceEndpoint: "Ubuntu Docker host; NVIDIA hosted inference",
+      unresolvedReason: "",
+    },
     requiredSecrets: ["NVIDIA_INFERENCE_API_KEY"],
   },
   {
@@ -89,6 +108,12 @@ const canonicalTargetInputs: CanonicalTargetInput[] = [
     expectedStateId: "cloud-deepagents-code-ready",
     suiteIds: ["smoke", "inference", "terminal-agent", "deepagents-code-policy"],
     description: "Ubuntu repo checkout with Docker and LangChain Deep Agents Code onboarding.",
+    executionCoverage: {
+      agentRuntime: "langchain-deepagents-code",
+      observableOutcome: "Repository install onboarding and hosted inference succeed",
+      environmentOrInferenceEndpoint: "Ubuntu Docker host; NVIDIA hosted inference",
+      unresolvedReason: "",
+    },
     requiredSecrets: ["NVIDIA_INFERENCE_API_KEY"],
   },
   {
@@ -180,6 +205,12 @@ const canonicalTargetInputs: CanonicalTargetInput[] = [
     description:
       "Post-reboot recovery guard: the gateway must recover through the required user service " +
       "while preserving the local sandbox registry and container.",
+    executionCoverage: {
+      agentRuntime: "openclaw",
+      observableOutcome: "Docker-backed sandbox recovers after a simulated host reboot",
+      environmentOrInferenceEndpoint: "Ubuntu Docker host; local recovery fixture",
+      unresolvedReason: "",
+    },
   },
   {
     id: "ubuntu-repo-openai-compatible-openclaw",
@@ -328,6 +359,12 @@ const canonicalTargetInputs: CanonicalTargetInput[] = [
     expectedStateId: "onboarding-failure-policy-presets-required",
     onboardingAssertionIds: ["base-installed", "preflight-passed"],
     suiteIds: [],
+    executionCoverage: {
+      agentRuntime: "openclaw",
+      observableOutcome: "Missing custom policy presets fail closed",
+      environmentOrInferenceEndpoint: "Ubuntu Docker host; local negative fixture",
+      unresolvedReason: "",
+    },
     requiredSecrets: ["NVIDIA_INFERENCE_API_KEY"],
     expectedFailure: {
       phase: "onboarding",
diff --git a/test/e2e/registry/run.ts b/test/e2e/registry/run.ts
index bd99288276..d73f6fa372 100644
--- a/test/e2e/registry/run.ts
+++ b/test/e2e/registry/run.ts
@@ -4,6 +4,11 @@
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
+import {
+  type E2eAgentRuntime,
+  validateE2eExecutionMetadata,
+} from "../../../tools/e2e/execution-coverage.mts";
+
 import { listTargets, requireTargets } from "./registry.ts";
 import { resolveRunnerForTarget } from "./runner-routing.ts";
 import { type LiveTargetSupport, liveTargetSupport } from "./runtime-support.ts";
@@ -17,6 +22,10 @@ interface Args {
 
 export interface LiveTargetMatrixEntry {
   id: string;
+  agentRuntime: E2eAgentRuntime;
+  observableOutcome: string;
+  environmentOrInferenceEndpoint: string;
+  unresolvedReason: string;
   runner: string;
   label: string;
   platform: string;
@@ -92,8 +101,23 @@ function liveMatrixEntry(
   support: LiveTargetSupport,
 ): LiveTargetMatrixEntry {
   const { runner } = resolveRunnerForTarget(target);
+  if (support.supported && !target.executionCoverage) {
+    throw new Error(
+      `Executable typed E2E target ${target.id} requires execution coverage metadata`,
+    );
+  }
+  const executionCoverage = validateE2eExecutionMetadata(
+    target.executionCoverage ?? {
+      agentRuntime: "unresolved",
+      observableOutcome: "unresolved",
+      environmentOrInferenceEndpoint: "unresolved",
+      unresolvedReason: "This typed registry declaration has no executable owner",
+    },
+    `Typed E2E target ${target.id}`,
+  );
   return {
     id: target.id,
+    ...executionCoverage,
     runner,
     label: buildLabel(target),
     platform: target.environment?.platform ?? "unknown",
diff --git a/test/e2e/registry/types.ts b/test/e2e/registry/types.ts
index 4e355621d0..4788d6e0f3 100644
--- a/test/e2e/registry/types.ts
+++ b/test/e2e/registry/types.ts
@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import type { E2eExecutionMetadata } from "../../../tools/e2e/execution-coverage.mts";
+
 export type PhaseName = "environment" | "onboarding" | "state-validation" | "lifecycle" | "runtime";
 
 // Synthetic phase appended by the target runner when a target
@@ -195,6 +197,7 @@ export interface TargetEnvironment {
 export interface TargetDefinition {
   id: string;
   description?: string;
+  executionCoverage?: E2eExecutionMetadata;
   manifestPath?: string;
   environment?: TargetEnvironment;
   assertionGroups: AssertionGroup[];
diff --git a/test/e2e/support/e2e-matrix.test.ts b/test/e2e/support/e2e-matrix.test.ts
index f0384856b1..ed5184c6b0 100644
--- a/test/e2e/support/e2e-matrix.test.ts
+++ b/test/e2e/support/e2e-matrix.test.ts
@@ -29,6 +29,15 @@ function requireUnsupportedTarget() {
   return unsupported!;
 }
 
+function expectExecutableTypedTargetCoverage(): void {
+  for (const row of buildLiveTargetMatrix()) {
+    expect(row.agentRuntime).not.toBe("unresolved");
+    expect(row.observableOutcome).not.toBe("unresolved");
+    expect(row.environmentOrInferenceEndpoint).not.toBe("unresolved");
+    expect(row.unresolvedReason).toBe("");
+  }
+}
+
 describe("live E2E target matrix", () => {
   it("honors an explicit runs-on:<label> requirement override", () => {
     const custom = target("test-runs-on-override")
@@ -90,12 +99,21 @@ describe("live E2E target matrix", () => {
     expect(buildLiveTargetMatrix([unsupported.id])).toEqual([
       expect.objectContaining({
         id: unsupported.id,
+        agentRuntime: "unresolved",
+        observableOutcome: "unresolved",
+        environmentOrInferenceEndpoint: "unresolved",
+        unresolvedReason: "This typed registry declaration has no executable owner",
         supported: false,
         supportReasons: support.reasons,
       }),
     ]);
   });
 
+  it("exposes execution coverage for every executable typed target (#9167)", () => {
+    expect(buildLiveTargetMatrix()).toHaveLength(4);
+    expectExecutableTypedTargetCoverage();
+  });
+
   it("prints a single-line JSON array of supported live E2E targets for --emit-live-matrix", () => {
     const result = runEmitLiveMatrix();
     expect(result.status, result.stderr).toBe(0);
diff --git a/test/e2e/support/workflow-plan.test.ts b/test/e2e/support/workflow-plan.test.ts
index 0a37e23b33..91f799b1a7 100644
--- a/test/e2e/support/workflow-plan.test.ts
+++ b/test/e2e/support/workflow-plan.test.ts
@@ -8,7 +8,11 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-import { discoverCredentialFreeTests } from "../../../tools/e2e/credential-free-tests.mts";
+import {
+  credentialFreeTestCoverage,
+  discoverCredentialFreeTests,
+} from "../../../tools/e2e/credential-free-tests.mts";
+import { E2E_AGENT_RUNTIMES } from "../../../tools/e2e/execution-coverage.mts";
 import { RETIRED_CONTROLLER_SELECTOR_IDS } from "../../../tools/e2e/retired-selector-compatibility.mts";
 import {
   catalogueTarget,
@@ -25,6 +29,7 @@ import {
   runE2eWorkflowPlanCli,
   selectedWorkflowJobs,
   validateE2eWorkflowPlan,
+  withoutCredentialedCatalogueProfiles,
   writeE2eWorkflowPlanCiOutput,
 } from "../../../tools/e2e/workflow-plan.mts";
 import { REPO_ROOT } from "../fixtures/paths.ts";
@@ -66,15 +71,14 @@ function expectedCiOutput(plan: ReturnType<typeof buildE2eWorkflowPlan>): string
 function prCandidatePlan(
   plan: ReturnType<typeof buildE2eWorkflowPlan>,
 ): ReturnType<typeof buildE2eWorkflowPlan> {
-  return {
-    ...plan,
-    catalogueMatrices: Object.fromEntries(
-      Object.entries(plan.catalogueMatrices).map(([profile, rows]) => [
-        profile,
-        rows.filter((row) => isPrCandidateCatalogueTarget(catalogueTarget(row.id))),
-      ]),
-    ) as ReturnType<typeof buildE2eWorkflowPlan>["catalogueMatrices"],
-  };
+  return withoutCredentialedCatalogueProfiles(plan);
+}
+
+function expectExplicitCatalogueCoverage(): void {
+  for (const target of E2E_TARGET_CATALOGUE) {
+    expect(E2E_AGENT_RUNTIMES).toContain(target.agentRuntime);
+    expect(target.agentRuntime === "unresolved").toBe(target.unresolvedReason !== "");
+  }
 }
 
 describe("E2E workflow plan", () => {
@@ -84,6 +88,24 @@ describe("E2E workflow plan", () => {
     expect(plan.matrix).toEqual(buildLiveTargetMatrix());
     expect(plan.testMatrix).toEqual(discoverCredentialFreeTests());
     expect(Object.values(plan.catalogueMatrices).flat()).toHaveLength(E2E_TARGET_CATALOGUE.length);
+    expect(
+      plan.coverageMatrix.reduce<Record<string, number>>((counts, row) => {
+        counts[row.source] = (counts[row.source] ?? 0) + 1;
+        return counts;
+      }, {}),
+    ).toEqual({
+      catalogue: E2E_TARGET_CATALOGUE.length,
+      "typed-registry": 4,
+      "shared-e2e": 2,
+      "retained-workflow": 19,
+      staging: 1,
+    });
+    expect(plan.coverageMatrix.filter((row) => row.unresolvedReason !== "")).toEqual([
+      expect.objectContaining({
+        id: "spark-install",
+        agentRuntime: "unresolved",
+      }),
+    ]);
     expect(plan.hermesSelected).toBe(true);
     expect(plan.explicitOnlyJobs).toEqual(["llama-cpp-dgx-spark-qualification"]);
     expect(releaseRequiredWorkflowJobs()).toContain("live");
@@ -91,6 +113,43 @@ describe("E2E workflow plan", () => {
     expect(releaseRequiredWorkflowJobs()).not.toContain("llama-cpp-dgx-spark-qualification");
   });
 
+  it("keeps multiple inert declarations visibly unresolved without treating them as evidence (#9167)", () => {
+    const plan = buildE2eWorkflowPlan({
+      targets: "ubuntu-repo-cloud-hermes,ubuntu-repo-cloud-hermes-slack",
+    });
+
+    expect(plan.matrix).toHaveLength(2);
+    expect(plan.matrix.every((row) => !row.supported)).toBe(true);
+    expect(plan.coverageMatrix).toEqual([
+      expect.objectContaining({ id: "ubuntu-repo-cloud-hermes", agentRuntime: "unresolved" }),
+      expect.objectContaining({
+        id: "ubuntu-repo-cloud-hermes-slack",
+        agentRuntime: "unresolved",
+      }),
+    ]);
+    expect(() => validateE2eWorkflowPlan(plan)).not.toThrow();
+  });
+
+  it("includes staging only when the execution plan selects it (#9167)", () => {
+    const stagingPlan = buildE2eWorkflowPlan({ jobs: "staging-brev-launchable" });
+
+    expect(stagingPlan.selectedJobs).toEqual(["staging-brev-launchable"]);
+    expect(stagingPlan.coverageMatrix).toEqual([
+      expect.objectContaining({ id: "staging-brev-launchable", source: "staging" }),
+    ]);
+
+    const hermesPlan = buildE2eWorkflowPlan({ jobs: "hermes-e2e" });
+    const stagingRow = buildE2eWorkflowPlan().coverageMatrix.find(
+      (row) => row.id === "staging-brev-launchable",
+    )!;
+    expect(() =>
+      validateE2eWorkflowPlan({
+        ...hermesPlan,
+        coverageMatrix: [stagingRow, ...hermesPlan.coverageMatrix],
+      }),
+    ).toThrow("execution coverage that does not match its execution plan");
+  });
+
   it("validates jobs and selects only matching credential-free tests", () => {
     const testId = firstId(discoverCredentialFreeTests(), "credential-free test");
     const plan = buildE2eWorkflowPlan({ jobs: `${testId},hermes-e2e` });
@@ -374,6 +433,26 @@ describe("E2E workflow plan", () => {
     expect(catalogueTarget(id)).toMatchObject(contract);
   });
 
+  it("requires explicit execution coverage for every catalogue target (#9167)", () => {
+    expectExplicitCatalogueCoverage();
+
+    const target = catalogueTarget("cloud-inference");
+    expect(() =>
+      validateE2eTargetCatalogue([{ ...target, agentRuntime: "unresolved", unresolvedReason: "" }]),
+    ).toThrow("must declare an unresolved reason");
+    expect(() =>
+      validateE2eTargetCatalogue([
+        { ...target, displayName: "Inference: preserves the operator's selected route" },
+      ]),
+    ).not.toThrow();
+  });
+
+  it("rejects inherited properties as credential-free coverage IDs (#9167)", () => {
+    expect(() => credentialFreeTestCoverage("constructor")).toThrow(
+      "Credential-free test constructor requires execution coverage metadata",
+    );
+  });
+
   it.each([
     [
       "bedrock-runtime-compatible-anthropic",
@@ -441,11 +520,7 @@ describe("E2E workflow plan", () => {
     const directory = mkdtempSync(path.join(tmpdir(), "nemoclaw-workflow-plan-pr-"));
     const output = path.join(directory, "github-output");
     const summary = path.join(directory, "summary.md");
-    const plan = buildE2eWorkflowPlan();
-    plan.catalogueMatrices["nvidia-api"] = [];
-    plan.catalogueMatrices["nvidia-inference"] = [];
-    plan.catalogueMatrices["github-read"] = [];
-    plan.catalogueMatrices["brave-nvidia-inference"] = [];
+    const plan = prCandidatePlan(buildE2eWorkflowPlan());
 
     try {
       writeE2eWorkflowPlanCiOutput(
@@ -685,7 +760,9 @@ describe("E2E workflow plan", () => {
       expect(result.status, result.stderr).toBe(0);
       const expectedPlan = prCandidatePlan(plan);
       expect(readFileSync(output, "utf8")).toBe(expectedCiOutput(expectedPlan));
-      expect(readFileSync(summary, "utf8")).toBe(renderE2eWorkflowPlanSummary(expectedPlan));
+      expect(readFileSync(summary, "utf8")).toBe(
+        renderE2eWorkflowPlanSummary(expectedPlan, { includeCoverageAudit: false }),
+      );
     } finally {
       rmSync(directory, { force: true, recursive: true });
     }
@@ -716,7 +793,9 @@ describe("E2E workflow plan", () => {
       expect(result.status, result.stderr).toBe(0);
       const expectedPlan = prCandidatePlan(plan);
       expect(readFileSync(output, "utf8")).toBe(expectedCiOutput(expectedPlan));
-      expect(readFileSync(summary, "utf8")).toBe(renderE2eWorkflowPlanSummary(expectedPlan));
+      expect(readFileSync(summary, "utf8")).toBe(
+        renderE2eWorkflowPlanSummary(expectedPlan, { includeCoverageAudit: false }),
+      );
     } finally {
       rmSync(directory, { force: true, recursive: true });
     }
@@ -738,6 +817,7 @@ describe("E2E workflow plan", () => {
           "github-read": [],
           "brave-nvidia-inference": [],
         },
+        coverageMatrix: [],
         selectedJobs: [],
         hermesSelected: false,
         explicitOnlyJobs: readFreeStandingJobsInventory().explicitOnlyJobs,
@@ -780,6 +860,7 @@ describe("E2E workflow plan", () => {
           "github-read": [],
           "brave-nvidia-inference": [],
         },
+        coverageMatrix: [],
         selectedJobs: ["jetson-nvmap-gpu"],
         hermesSelected: false,
         explicitOnlyJobs: readFreeStandingJobsInventory().explicitOnlyJobs,
@@ -801,6 +882,7 @@ describe("E2E workflow plan", () => {
         "github-read": [],
         "brave-nvidia-inference": [],
       },
+      coverageMatrix: [],
       selectedJobs: [],
       hermesSelected: false,
       explicitOnlyJobs: readFreeStandingJobsInventory().explicitOnlyJobs,
@@ -882,8 +964,10 @@ describe("E2E workflow plan", () => {
     const validPlan = buildE2eWorkflowPlan();
     const [registryRow] = validPlan.matrix;
     const [testRow] = validPlan.testMatrix;
+    const [coverageRow] = validPlan.coverageMatrix;
     expect(registryRow).toBeDefined();
     expect(testRow).toBeDefined();
+    expect(coverageRow).toBeDefined();
     const { explicitOnlyJobs: _omitted, ...missingField } = validPlan;
     const malformedPlans = [
       missingField,
@@ -894,6 +978,14 @@ describe("E2E workflow plan", () => {
         testMatrix: [{ ...testRow, project: "e2e-live", file: "test/e2e/live/../secret.test.ts" }],
       },
       { ...validPlan, testMatrix: [{ ...testRow, id: registryRow.id }] },
+      { ...validPlan, coverageMatrix: [...validPlan.coverageMatrix, { ...coverageRow }] },
+      {
+        ...validPlan,
+        coverageMatrix: [
+          { ...coverageRow, observableOutcome: "Injected | Markdown row" },
+          ...validPlan.coverageMatrix.slice(1),
+        ],
+      },
       { ...validPlan, hermesSelected: "false" },
     ];
 
@@ -904,6 +996,17 @@ describe("E2E workflow plan", () => {
     });
   });
 
+  it("rejects execution coverage that differs from its execution owner (#9167)", () => {
+    const plan = buildE2eWorkflowPlan({ jobs: "cloud-inference" });
+    const coverageMatrix = plan.coverageMatrix.map((row) =>
+      row.id === "cloud-inference" ? { ...row, observableOutcome: "Different valid outcome" } : row,
+    );
+
+    expect(() => validateE2eWorkflowPlan({ ...plan, coverageMatrix })).toThrow(
+      "execution coverage that does not match its execution plan",
+    );
+  });
+
   it("writes byte-compatible GitHub outputs and the execution-plan summary", () => {
     const testId = firstId(discoverCredentialFreeTests(), "credential-free test");
     const directory = mkdtempSync(path.join(tmpdir(), "nemoclaw-workflow-plan-"));
@@ -921,7 +1024,9 @@ describe("E2E workflow plan", () => {
       );
 
       expect(readFileSync(output, "utf8")).toBe(expectedCiOutput(plan));
-      expect(readFileSync(summary, "utf8")).toBe(renderE2eWorkflowPlanSummary(plan));
+      expect(readFileSync(summary, "utf8")).toBe(
+        renderE2eWorkflowPlanSummary(plan, { includeCoverageAudit: false }),
+      );
     } finally {
       rmSync(directory, { force: true, recursive: true });
     }
@@ -984,6 +1089,7 @@ describe("E2E workflow plan", () => {
       "selectedJobs",
       "hermesSelected",
       "explicitOnlyJobs",
+      "coverageMatrix",
     ]);
     expect(output).toBe(`${JSON.stringify(parsed)}\n`);
   });
@@ -998,9 +1104,9 @@ describe("E2E workflow plan", () => {
     expect(filtered.status, filtered.stderr).toBe(0);
     expect(filtered.stdout).toBe(`## E2E Execution Plan
 
-| Target or job | Execution | Runner |
-| --- | --- | --- |
-| \`hermes-e2e\` | retained workflow job | declared by job |
+| Target or job | Agent runtime | Observable outcome | Environment or inference endpoint | Source | Unresolved reason |
+| --- | --- | --- | --- | --- | --- |
+| \`hermes-e2e\` | hermes | Install onboarding health inference lifecycle dashboard and security succeed | Ubuntu; mock or NVIDIA hosted inference | retained-workflow |  |
 `);
 
     const complete = spawnSync(TSX, [PLANNER_CLI, "--summary"], {
@@ -1011,17 +1117,35 @@ describe("E2E workflow plan", () => {
 
     expect(complete.status, complete.stderr).toBe(0);
     expect(complete.stdout).toContain(
-      "| `cloud-onboard` | retained workflow job | declared by job |",
+      "| `cloud-onboard` | openclaw | Public install onboarding hosted inference and security checks succeed | Ubuntu; NVIDIA hosted inference | retained-workflow |  |",
+    );
+    expect(complete.stdout).toContain(
+      "| `ubuntu-repo-cloud-openclaw` | openclaw | Repository install onboarding and hosted inference succeed | Ubuntu Docker host; NVIDIA hosted inference | typed-registry |  |",
+    );
+    expect(complete.stdout).toContain(
+      "| `vllm-docker-storage` | none | vLLM storage gate accepts and rejects the intended host states | Native Linux Docker host; no inference endpoint | shared-e2e |  |",
+    );
+    expect(complete.stdout).toContain(
+      "| `channels-add-remove` | openclaw | Messaging: adds and removes Telegram configuration | Ubuntu; no inference endpoint | catalogue |  |",
     );
     expect(complete.stdout).toContain(
-      "| `ubuntu-repo-cloud-openclaw` | typed registry | `ubuntu-latest` |",
+      "| `model-router-provider-routed-inference` | openclaw | Inference: Model Router returns a provider-routed response | Ubuntu; NVIDIA API and Model Router | catalogue |  |",
     );
-    expect(complete.stdout).toContain("| shared E2E job | `ubuntu-latest` |");
-    expect(complete.stdout).toContain("| `channels-add-remove` | `standard` profile |");
     expect(complete.stdout).toContain(
-      "| `model-router-provider-routed-inference` | `nvidia-api` profile |",
+      "| `spark-install` | unresolved | Install: leaves NemoClaw and OpenShell usable after standard installation | Ubuntu; NVIDIA hosted inference | catalogue | The test asserts CLI usability but does not assert an agent runtime |",
     );
-    expect(complete.stdout).toContain("| `cloud-inference` | `nvidia-inference` profile |");
+    expect(complete.stdout).toContain("### Repeated outcomes with distinct evidence");
+    expect(complete.stdout).toContain(
+      "| Repository install onboarding and hosted inference succeed | `ubuntu-repo-cloud-langchain-deepagents-code`, `ubuntu-repo-cloud-openclaw` | agent runtime |",
+    );
+    expect(complete.stdout).toContain("### Intentional exclusions");
+    expect(complete.stdout).toContain(
+      "| `llama-cpp-dgx-spark-qualification` | unresolved | Exact NemoClaw-built llama.cpp image produces protected DGX Spark evidence | NVIDIA DGX Spark GB10; local llama.cpp inference | Explicit dispatch only; excluded from the default release matrix | The protected plan can enable or skip its OpenClaw subqualification |",
+    );
+    expect(complete.stdout).toContain("### Unsupported or unresolved typed declarations");
+    expect(complete.stdout).toMatch(/The \d+ inert typed declarations above/);
+    expect(complete.stdout).toContain("#8285");
+    expect(complete.stdout).toContain("#8286");
   });
 
   it("keeps CI and readable summary output modes separate", () => {
@@ -1065,7 +1189,9 @@ describe("E2E workflow plan", () => {
 
       expect(result.status, result.stderr).toBe(0);
       expect(readFileSync(output, "utf8")).toBe(expectedCiOutput(plan));
-      expect(readFileSync(summary, "utf8")).toBe(renderE2eWorkflowPlanSummary(plan));
+      expect(readFileSync(summary, "utf8")).toBe(
+        renderE2eWorkflowPlanSummary(plan, { includeCoverageAudit: false }),
+      );
     } finally {
       rmSync(directory, { force: true, recursive: true });
     }
@@ -1094,7 +1220,9 @@ describe("E2E workflow plan", () => {
 
       expect(result.status, result.stderr).toBe(0);
       expect(readFileSync(output, "utf8")).toBe(expectedCiOutput(plan));
-      expect(readFileSync(summary, "utf8")).toBe(renderE2eWorkflowPlanSummary(plan));
+      expect(readFileSync(summary, "utf8")).toBe(
+        renderE2eWorkflowPlanSummary(plan, { includeCoverageAudit: false }),
+      );
     } finally {
       rmSync(directory, { force: true, recursive: true });
     }
diff --git a/tools/e2e/credential-free-tests.mts b/tools/e2e/credential-free-tests.mts
index bd3d2e9b2e..18d337bc76 100644
--- a/tools/e2e/credential-free-tests.mts
+++ b/tools/e2e/credential-free-tests.mts
@@ -7,6 +7,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { moduleTagDeclarations, stripModuleTagDeclarations } from "./module-tags.mts";
+import { type E2eExecutionMetadata, validateE2eExecutionMetadata } from "./execution-coverage.mts";
 
 export const CREDENTIAL_FREE_TEST_TAG = "e2e/credential-free";
 export const SHARED_E2E_JOB_ID = "shared-e2e";
@@ -38,6 +39,30 @@ const E2E_LIVE_CREDENTIAL_FREE_TEST_PATTERN =
 const INTEGRATION_CREDENTIAL_FREE_TEST_PATTERN =
   /^test\/(?!e2e\/)(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+\.test\.(?:js|ts)$/;
 const SUPPORTED_PROJECTS = new Set<CredentialFreeTestProject>(["e2e-live", "integration"]);
+const CREDENTIAL_FREE_TEST_COVERAGE = {
+  "onboard-managed-image-buildless-e2e": {
+    agentRuntime: "none",
+    observableOutcome: "Buildless onboarding selects exact managed images for every agent",
+    environmentOrInferenceEndpoint: "Mocked integration environment; no inference endpoint",
+    unresolvedReason: "",
+  },
+  "vllm-docker-storage": {
+    agentRuntime: "none",
+    observableOutcome: "vLLM storage gate accepts and rejects the intended host states",
+    environmentOrInferenceEndpoint: "Native Linux Docker host; no inference endpoint",
+    unresolvedReason: "",
+  },
+} as const satisfies Readonly<Record<string, E2eExecutionMetadata>>;
+
+export function credentialFreeTestCoverage(id: string): E2eExecutionMetadata {
+  if (!Object.hasOwn(CREDENTIAL_FREE_TEST_COVERAGE, id)) {
+    throw new Error(`Credential-free test ${id} requires execution coverage metadata`);
+  }
+  const metadata = (
+    CREDENTIAL_FREE_TEST_COVERAGE as Readonly<Record<string, E2eExecutionMetadata>>
+  )[id];
+  return validateE2eExecutionMetadata(metadata, `Credential-free test ${id}`);
+}
 
 export function credentialFreeTestProjectForFile(
   file: string,
diff --git a/tools/e2e/execution-coverage.mts b/tools/e2e/execution-coverage.mts
new file mode 100644
index 0000000000..bfa86795b8
--- /dev/null
+++ b/tools/e2e/execution-coverage.mts
@@ -0,0 +1,118 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const E2E_AGENT_RUNTIMES = [
+  "openclaw",
+  "hermes",
+  "langchain-deepagents-code",
+  "none",
+  "openclaw + hermes",
+  "openclaw + langchain-deepagents-code",
+  "openclaw + hermes + langchain-deepagents-code",
+  "unresolved",
+] as const;
+
+export type E2eAgentRuntime = (typeof E2E_AGENT_RUNTIMES)[number];
+
+export interface E2eExecutionMetadata {
+  agentRuntime: E2eAgentRuntime;
+  observableOutcome: string;
+  environmentOrInferenceEndpoint: string;
+  unresolvedReason: string;
+}
+
+export const E2E_EXECUTION_SOURCES = [
+  "catalogue",
+  "typed-registry",
+  "shared-e2e",
+  "retained-workflow",
+  "staging",
+] as const;
+
+export type E2eExecutionSource = (typeof E2E_EXECUTION_SOURCES)[number];
+
+export interface E2eExecutionRow extends E2eExecutionMetadata {
+  id: string;
+  variant: string;
+  source: E2eExecutionSource;
+}
+
+const SELECTOR_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const COVERAGE_TEXT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 .,'+()/:;_-]{0,199}$/u;
+
+export function validateE2eExecutionMetadata(
+  metadata: E2eExecutionMetadata,
+  context: string,
+): E2eExecutionMetadata {
+  if (!E2E_AGENT_RUNTIMES.includes(metadata.agentRuntime)) {
+    throw new Error(`${context} has an invalid agent runtime`);
+  }
+  for (const [field, value] of [
+    ["observable outcome", metadata.observableOutcome],
+    ["environment or inference endpoint", metadata.environmentOrInferenceEndpoint],
+  ] as const) {
+    if (!COVERAGE_TEXT_PATTERN.test(value)) {
+      throw new Error(`${context} has an invalid ${field}`);
+    }
+  }
+  const unresolved =
+    metadata.agentRuntime === "unresolved" ||
+    metadata.observableOutcome === "unresolved" ||
+    metadata.environmentOrInferenceEndpoint === "unresolved";
+  if (unresolved !== (metadata.unresolvedReason !== "")) {
+    throw new Error(
+      `${context} must declare an unresolved reason exactly when a coverage field is unresolved`,
+    );
+  }
+  if (metadata.unresolvedReason !== "" && !COVERAGE_TEXT_PATTERN.test(metadata.unresolvedReason)) {
+    throw new Error(`${context} has an invalid unresolved reason`);
+  }
+  return metadata;
+}
+
+export function validateE2eExecutionRows(
+  rows: readonly E2eExecutionRow[],
+): readonly E2eExecutionRow[] {
+  const keys = new Set<string>();
+  const coverageEvidence = new Map<string, string>();
+  for (const row of rows) {
+    if (!SELECTOR_ID_PATTERN.test(row.id)) {
+      throw new Error(`E2E execution coverage contains an invalid ID: ${row.id}`);
+    }
+    if (row.variant !== "" && !SELECTOR_ID_PATTERN.test(row.variant)) {
+      throw new Error(`E2E execution coverage ${row.id} has an invalid variant`);
+    }
+    if (!E2E_EXECUTION_SOURCES.includes(row.source)) {
+      throw new Error(`E2E execution coverage ${row.id} has an invalid source`);
+    }
+    validateE2eExecutionMetadata(row, `E2E execution coverage ${row.id}`);
+    const key = `${row.source}:${row.id}:${row.variant}`;
+    if (keys.has(key)) {
+      throw new Error(`E2E execution coverage contains a duplicate row: ${key}`);
+    }
+    keys.add(key);
+    if (
+      row.agentRuntime !== "unresolved" &&
+      row.observableOutcome !== "unresolved" &&
+      row.environmentOrInferenceEndpoint !== "unresolved"
+    ) {
+      const evidenceKey = [
+        row.agentRuntime,
+        row.observableOutcome,
+        row.environmentOrInferenceEndpoint,
+      ].join("\u0000");
+      const previous = coverageEvidence.get(evidenceKey);
+      if (previous) {
+        throw new Error(
+          `E2E execution coverage duplicates evidence between ${previous} and ${e2eExecutionLabel(row)}`,
+        );
+      }
+      coverageEvidence.set(evidenceKey, e2eExecutionLabel(row));
+    }
+  }
+  return rows;
+}
+
+export function e2eExecutionLabel(row: E2eExecutionRow): string {
+  return row.variant === "" ? row.id : `${row.id} / ${row.variant}`;
+}
diff --git a/tools/e2e/hermes-gpu-startup-workflow-boundary.mts b/tools/e2e/hermes-gpu-startup-workflow-boundary.mts
index 2bbaf777a1..cbd2e8d54d 100644
--- a/tools/e2e/hermes-gpu-startup-workflow-boundary.mts
+++ b/tools/e2e/hermes-gpu-startup-workflow-boundary.mts
@@ -60,7 +60,23 @@ function stringValue(value: unknown): string {
   return typeof value === "string" ? value : "";
 }
 
-const TOKENS = { "@bash": '/bin/bash "$trusted_fixture" "$@"', "@bin": "/usr/bin", "@daemon": '"$daemon_json"', "@docker": "/etc/docker/daemon.json", "@env": "/usr/bin/sudo -n /usr/bin/env -i", "@fixture": '"$trusted_fixture"', "@gpu": "hermes-gpu-fallback-docker-runtime", "@install": "/usr/bin/sudo /usr/bin/install", "@root": '"$trusted_state_root"', "@run": "run_trusted_fixture", "@sha": '"$TRUSTED_FIXTURE_SHA256"', "@source": '"$trusted_source"', "@state": '"$state_dir"', "@sudo": "/usr/bin/sudo", "@workflow": '"$TRUSTED_WORKFLOW_SHA"' } as const;
+const TOKENS = {
+  "@bash": '/bin/bash "$trusted_fixture" "$@"',
+  "@bin": "/usr/bin",
+  "@daemon": '"$daemon_json"',
+  "@docker": "/etc/docker/daemon.json",
+  "@env": "/usr/bin/sudo -n /usr/bin/env -i",
+  "@fixture": '"$trusted_fixture"',
+  "@gpu": "hermes-gpu-fallback-docker-runtime",
+  "@install": "/usr/bin/sudo /usr/bin/install",
+  "@root": '"$trusted_state_root"',
+  "@run": "run_trusted_fixture",
+  "@sha": '"$TRUSTED_FIXTURE_SHA256"',
+  "@source": '"$trusted_source"',
+  "@state": '"$state_dir"',
+  "@sudo": "/usr/bin/sudo",
+  "@workflow": '"$TRUSTED_WORKFLOW_SHA"',
+} as const;
 
 function proof(spec: string): string[] {
   return spec
@@ -119,9 +135,24 @@ export function validateHermesGpuStartupWorkflow(
     strategy["max-parallel"] !== 1 ||
     JSON.stringify(matrix.include) !==
       JSON.stringify([
-        { scenario: "native", sandbox_name: "e2e-hgpu-native" },
-        { scenario: "fallback", sandbox_name: "e2e-hgpu-fallback" },
-        { scenario: "compatibility-only", sandbox_name: "e2e-hgpu-compat" },
+        {
+          scenario: "native",
+          sandbox_name: "e2e-hgpu-native",
+          observable_outcome: "Native GPU startup reaches the stable Ready route",
+          coverage_variant: "native",
+        },
+        {
+          scenario: "fallback",
+          sandbox_name: "e2e-hgpu-fallback",
+          observable_outcome: "Fallback GPU startup reaches the stable Ready route",
+          coverage_variant: "fallback",
+        },
+        {
+          scenario: "compatibility-only",
+          sandbox_name: "e2e-hgpu-compat",
+          observable_outcome: "Compatibility-only GPU startup reaches the stable Ready route",
+          coverage_variant: "compatibility-only",
+        },
       ])
   ) {
     errors.push(`${JOB_NAME} must serialize GPU scenarios`);
diff --git a/tools/e2e/managed-image-multiarch-workflow-boundary.mts b/tools/e2e/managed-image-multiarch-workflow-boundary.mts
index 69b5831a19..c798ae6e18 100644
--- a/tools/e2e/managed-image-multiarch-workflow-boundary.mts
+++ b/tools/e2e/managed-image-multiarch-workflow-boundary.mts
@@ -128,11 +128,15 @@ export function validateManagedImageMultiarchWorkflow(workflow: WorkflowRecord):
           platform: "linux/amd64",
           runner: "ubuntu-24.04",
           shard: "linux-amd64",
+          environment_or_inference_endpoint: "AMD64 Ubuntu; exact managed image startup",
+          coverage_variant: "linux-amd64",
         },
         {
           platform: "linux/arm64",
           runner: "ubuntu-24.04-arm",
           shard: "linux-arm64",
+          environment_or_inference_endpoint: "Arm64 Ubuntu; exact managed image startup",
+          coverage_variant: "linux-arm64",
         },
       ],
     },
diff --git a/tools/e2e/mcp-dev-workflow-boundary-digests.mts b/tools/e2e/mcp-dev-workflow-boundary-digests.mts
index 452d8523b4..675f8df7f9 100644
--- a/tools/e2e/mcp-dev-workflow-boundary-digests.mts
+++ b/tools/e2e/mcp-dev-workflow-boundary-digests.mts
@@ -6,7 +6,7 @@ import { createHash } from "node:crypto";
 export const MCP_DEV_WORKFLOW_EXECUTION_CONTEXT_SHA256 =
   "052c49d5e8688266dbf38fa911733132d33e4470a29a61deb6e7a11067737559";
 export const MCP_DEV_JOB_EXECUTION_CONTEXT_SHA256 =
-  "9f9983804a29816d7e1b35e9e791f453f4e9e83f4ec41b906953e976d372353e";
+  "b9219b0f29da3834499a7c9dcb0acc8287cb3441d01a51bed615d7b2ea4383f9";
 export const MCP_DEV_TRUSTED_NODE_SETUP_CONTENT_SHA256 =
   "504821ad93c57971d0281ef1130ed6008fadd331bd56acb1a6b5e6a3358f3e49";
 export const MCP_DEV_TRUSTED_PREFIX_CONTENT_SHA256 =
diff --git a/tools/e2e/mcp-workflow-boundary.mts b/tools/e2e/mcp-workflow-boundary.mts
index 44312a34e8..28e532d05b 100644
--- a/tools/e2e/mcp-workflow-boundary.mts
+++ b/tools/e2e/mcp-workflow-boundary.mts
@@ -43,8 +43,7 @@ const DEV_ARTIFACT_TRUSTED_CHECKOUT_NAME = "Checkout trusted OpenShell dev tooli
 const DEV_ARTIFACT_TRUSTED_CHECKOUT = ".trusted-openshell-dev-artifact";
 const DEV_ARTIFACT_TRUSTED_PATHS =
   "scripts/install-openshell.sh\ntools/e2e/openshell-dev-artifact.mts\n";
-const DEV_ARTIFACT_SHARD_TRUSTED_PATHS =
-  `.github/scripts/docker-auth-cleanup.sh\n${DEV_ARTIFACT_TRUSTED_PATHS}`;
+const DEV_ARTIFACT_SHARD_TRUSTED_PATHS = `.github/scripts/docker-auth-cleanup.sh\n${DEV_ARTIFACT_TRUSTED_PATHS}`;
 const DEV_ARTIFACT_TRUSTED_TOOL = `\${{ github.workspace }}/${DEV_ARTIFACT_TRUSTED_CHECKOUT}/${DEV_ARTIFACT_TOOL}`;
 const DEV_ARTIFACT_TRUSTED_INSTALLER = `\${{ github.workspace }}/${DEV_ARTIFACT_TRUSTED_CHECKOUT}/scripts/install-openshell.sh`;
 const DEV_ARTIFACT_SOURCE_OUTPUT = "${{ needs.openshell-dev-artifact.outputs.source_commit }}";
@@ -584,9 +583,7 @@ function validateJobExecution(
       trustedCheckoutIndex !== dockerAuthIndex + 1 ||
       prepareIndex !== installIndex + 1 ||
       restoreCliIndex !== prepareIndex + 1 ||
-      trustedInstallSequence.some(
-        (step, offset) => steps[trustedCheckoutIndex + offset] !== step,
-      )
+      trustedInstallSequence.some((step, offset) => steps[trustedCheckoutIndex + offset] !== step)
     ) {
       errors.push(
         "mcp-bridge-dev must complete trusted Node.js setup, Docker auth, artifact verification, credential revocation, and installation before candidate dependency preparation and CLI restore",
@@ -594,12 +591,9 @@ function validateJobExecution(
     }
     if (
       installIndex < 0 ||
-      contentSha256(steps.slice(0, installIndex + 1)) !==
-        MCP_DEV_TRUSTED_PREFIX_CONTENT_SHA256
+      contentSha256(steps.slice(0, installIndex + 1)) !== MCP_DEV_TRUSTED_PREFIX_CONTENT_SHA256
     ) {
-      errors.push(
-        "mcp-bridge-dev must preserve every reviewed step through trusted installation",
-      );
+      errors.push("mcp-bridge-dev must preserve every reviewed step through trusted installation");
     }
     if (
       prepareIndex < 0 ||
@@ -891,6 +885,11 @@ function validateCredentialWindowJob(
   const expectedEnv = {
     E2E_JOB: "1",
     E2E_TARGET_ID: CREDENTIAL_WINDOW_JOB,
+    E2E_AGENT_RUNTIME: "openclaw",
+    E2E_OBSERVABLE_OUTCOME:
+      "Credential expiry rotation detach and rebuild preserve the intended access window",
+    E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT:
+      "Ubuntu Docker host; local compatible inference and MCP endpoint",
     E2E_ARTIFACT_DIR: `\${{ github.workspace }}/${CREDENTIAL_WINDOW_ARTIFACT_DIR}`,
     NEMOCLAW_CLI_BIN: "${{ github.workspace }}/bin/nemoclaw.js",
     NEMOCLAW_OPENSHELL_CHANNEL: "stable",
diff --git a/tools/e2e/target-catalogue.mts b/tools/e2e/target-catalogue.mts
index 2bac99f680..0bbbfd3c7a 100644
--- a/tools/e2e/target-catalogue.mts
+++ b/tools/e2e/target-catalogue.mts
@@ -7,6 +7,8 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 
+import { type E2eAgentRuntime, validateE2eExecutionMetadata } from "./execution-coverage.mts";
+
 export const E2E_EXECUTION_PROFILES = [
   "standard",
   "nvidia-api",
@@ -43,6 +45,9 @@ export interface E2eCatalogueTarget {
   id: string;
   targetId: string;
   displayName: string;
+  agentRuntime: E2eAgentRuntime;
+  environmentOrInferenceEndpoint: string;
+  unresolvedReason: string;
   testFile: string;
   profile: E2eExecutionProfile;
   runner: string;
@@ -71,6 +76,10 @@ export interface E2eCatalogueMatrixRow {
   id: string;
   target_id: string;
   display_name: string;
+  agent_runtime: E2eAgentRuntime;
+  observable_outcome: string;
+  environment_or_inference_endpoint: string;
+  unresolved_reason: string;
   runner: string;
   runner_key: string;
   test_file: string;
@@ -94,6 +103,9 @@ type TargetOptions = Omit<
   | "testFile"
   | "owningPaths"
   | "releaseRequired"
+  | "agentRuntime"
+  | "environmentOrInferenceEndpoint"
+  | "unresolvedReason"
   | "environment"
   | "hostPackages"
   | "cloudflared"
@@ -109,6 +121,9 @@ type TargetOptions = Omit<
   | "shard"
   | "artifactLayout"
 > & {
+  agentRuntime: E2eAgentRuntime;
+  environmentOrInferenceEndpoint: string;
+  unresolvedReason?: string;
   owningPaths?: readonly string[];
   environment?: Readonly<Record<string, string>>;
   hostPackages?: readonly E2eHostPackage[];
@@ -130,6 +145,9 @@ type TargetOptions = Omit<
 function target(id: string, options: TargetOptions): E2eCatalogueTarget {
   const {
     displayName,
+    agentRuntime,
+    environmentOrInferenceEndpoint,
+    unresolvedReason = "",
     owningPaths = [],
     environment = {},
     hostPackages = [],
@@ -151,6 +169,9 @@ function target(id: string, options: TargetOptions): E2eCatalogueTarget {
   return {
     id,
     displayName,
+    agentRuntime,
+    environmentOrInferenceEndpoint,
+    unresolvedReason,
     testFile,
     owningPaths: [testFile, ...owningPaths],
     releaseRequired: true,
@@ -184,6 +205,7 @@ const nonInteractive = {
 function commonEgressTarget(options: {
   displayName: string;
   environment?: Readonly<Record<string, string>>;
+  environmentOrInferenceEndpoint: string;
   hermes?: boolean;
   owningPaths?: readonly string[];
   profile?: E2eExecutionProfile;
@@ -194,6 +216,8 @@ function commonEgressTarget(options: {
   return target(`common-egress-agent-${options.shard}`, {
     targetId: "common-egress-agent",
     displayName: options.displayName,
+    agentRuntime: options.hermes ? "hermes" : "openclaw",
+    environmentOrInferenceEndpoint: options.environmentOrInferenceEndpoint,
     profile: options.profile ?? "brave-nvidia-inference",
     testFile: "test/e2e/live/common-egress-agent.test.ts",
     timeoutMinutes: 60,
@@ -239,6 +263,11 @@ function gatewayUpgradeTarget(options: GatewayUpgradeTargetOptions): E2eCatalogu
   return target(`openshell-gateway-upgrade-${options.shard}`, {
     targetId: "openshell-gateway-upgrade",
     displayName: options.displayName,
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint:
+      options.runner === "ubuntu-24.04-arm"
+        ? "Arm64 Ubuntu; GitHub release artifacts; no inference endpoint"
+        : "x86-64 Ubuntu; GitHub release artifacts; no inference endpoint",
     profile: "github-read",
     runner: options.runner ?? "ubuntu-latest",
     testFile: "test/e2e/live/openshell-gateway-upgrade.test.ts",
@@ -349,6 +378,8 @@ export function catalogueExclusionReason(id: string): string | undefined {
 export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("agent-turn-latency", {
     displayName: "Performance: bounds hosted inference turns for OpenClaw and Hermes",
+    agentRuntime: "openclaw + hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     timeoutMinutes: 110,
@@ -374,6 +405,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("bedrock-runtime-compatible-anthropic-openclaw", {
     targetId: "bedrock-runtime-compatible-anthropic",
     displayName: "Inference: OpenClaw routes an Anthropic request through Amazon Bedrock",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; Amazon Bedrock Anthropic-compatible endpoint",
     profile: "standard",
     testFile: "test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts",
     timeoutMinutes: 60,
@@ -392,6 +425,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("bedrock-runtime-compatible-anthropic-hermes", {
     targetId: "bedrock-runtime-compatible-anthropic",
     displayName: "Inference: Hermes routes an Anthropic request through Amazon Bedrock",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; Amazon Bedrock Anthropic-compatible endpoint",
     profile: "standard",
     testFile: "test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts",
     timeoutMinutes: 60,
@@ -410,6 +445,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("bootstrap-install-smoke", {
     displayName: "Install: bootstraps NemoClaw and completes hosted inference",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     timeoutMinutes: 30,
@@ -431,6 +468,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("brave-search", {
     displayName: "Search: OpenClaw returns a Brave result without exposing its key",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Brave Search",
     profile: "brave-nvidia-inference",
     timeoutMinutes: 45,
     installMode: "authenticated",
@@ -446,6 +485,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("channels-add-remove", {
     displayName: "Messaging: adds and removes Telegram configuration",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 75,
     installMode: "credential-free",
@@ -463,6 +504,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("channels-stop-start-openclaw", {
     targetId: "channels-stop-start",
     displayName: "Messaging: OpenClaw preserves channels across stop and start",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     testFile: "test/e2e/live/channels-stop-start.test.ts",
@@ -489,6 +532,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("channels-stop-start-hermes", {
     targetId: "channels-stop-start",
     displayName: "Messaging: Hermes preserves channels across stop and start",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     testFile: "test/e2e/live/channels-stop-start.test.ts",
@@ -517,6 +562,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("cloud-inference", {
     displayName: "Inference: OpenClaw uses hosted inference",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 50,
     installMode: "none",
@@ -530,22 +577,26 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   commonEgressTarget({
     displayName: "Networking: OpenClaw answers through balanced egress",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and public weather endpoint",
     shard: "openclaw-balanced-weather",
     selector: "^common-egress.+C1.+$",
   }),
   commonEgressTarget({
     displayName: "Networking: OpenClaw reaches a public reference through open egress",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and public reference endpoint",
     shard: "openclaw-open-reference",
     selector: "^common-egress.+C2.+$",
   }),
   commonEgressTarget({
     displayName: "Networking: Hermes reaches a public reference through open egress",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and public reference endpoint",
     hermes: true,
     shard: "hermes-open-reference",
     selector: "^common-egress.+C3.+$",
   }),
   commonEgressTarget({
     displayName: "Networking: Personal permits a keyless public stock fetch",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and public stock endpoint",
     profile: "nvidia-inference",
     runnerComparison: false,
     owningPaths: [
@@ -567,6 +618,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("concurrent-gateway-ports", {
     displayName: "Gateway: isolates ports for concurrent sandboxes",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local gateway; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 90,
     installMode: "authenticated",
@@ -576,6 +629,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("cron-preflight-inference-local", {
     displayName: "Preflight: reaches managed inference without DNS failure",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local managed inference",
     profile: "nvidia-inference",
     timeoutMinutes: 45,
     installMode: "authenticated",
@@ -591,6 +646,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("dashboard-remote-bind", {
     displayName: "Dashboard: retains audit findings when bound remotely",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 65,
     installMode: "none",
@@ -606,6 +663,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("device-auth-health", {
     displayName: "Health: treats a 401 authentication response as reachable",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; local authentication fixture; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 40,
     installMode: "authenticated",
@@ -620,6 +679,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("double-onboard", {
     displayName: "Onboarding: reuses the gateway and preserves sibling sandboxes",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local gateway fixtures",
     profile: "standard",
     timeoutMinutes: 90,
     installMode: "authenticated",
@@ -629,6 +690,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("gpu-double-onboard", {
     displayName: "Onboarding: preserves Ollama authentication after GPU re-onboarding",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "NVIDIA GPU runner; local Ollama",
     profile: "standard",
     runner: "linux-amd64-gpu-rtxpro6000-latest-1",
     timeoutMinutes: 100,
@@ -645,6 +708,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("gpu-e2e", {
     displayName: "Inference: routes an agent turn through GPU Ollama",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "NVIDIA GPU runner; local Ollama",
     profile: "standard",
     runner: "linux-amd64-gpu-rtxpro6000-latest-1",
     timeoutMinutes: 90,
@@ -663,6 +728,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("full-e2e", {
     displayName: "OpenClaw: installs, onboards, and completes an agent turn",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 75,
     installMode: "authenticated",
@@ -681,6 +748,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("gateway-guard-recovery", {
     displayName: "Gateway: restores the guard chain after recreation",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 45,
     installMode: "authenticated",
@@ -696,6 +765,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("hermes-discord", {
     displayName: "Messaging: Hermes preserves Discord configuration across rebuild",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Discord",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     timeoutMinutes: 90,
@@ -719,6 +790,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("hermes-inference-switch", {
     displayName: "Inference: Hermes switches to an Anthropic-compatible endpoint",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; Anthropic-compatible inference fixture",
     profile: "standard",
     timeoutMinutes: 55,
     installMode: "authenticated",
@@ -742,6 +815,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("hermes-shields-config", {
     displayName: "Shields: restores stopped Hermes across posture changes",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 60,
     installMode: "none",
@@ -759,6 +834,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("hermes-slack", {
     displayName: "Messaging: isolates Hermes Slack credentials and reaches Slack APIs",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Slack",
     profile: "nvidia-inference",
     runner: "linux-amd64-cpu4",
     testFile: "test/e2e/live/hermes-slack-e2e.test.ts",
@@ -781,6 +858,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("issue-2478-crash-loop-recovery", {
     displayName: "Gateway: recovers after process termination and remains stable",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local gateway; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 30,
     installMode: "authenticated",
@@ -794,6 +873,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("issue-4462-scope-upgrade-approval", {
     displayName: "Authorization: approves a write-scope upgrade without operator.admin",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 90,
     installMode: "authenticated",
@@ -807,6 +888,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("inference-routing", {
     displayName: "Inference: rejects unsafe routes and proves runtime identities",
+    agentRuntime: "openclaw + langchain-deepagents-code",
+    environmentOrInferenceEndpoint: "Ubuntu; local compatible and HTTPS inference fixtures",
     profile: "standard",
     timeoutMinutes: 45,
     installMode: "none",
@@ -816,6 +899,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("kimi-inference-compat", {
     displayName: "Inference: configures a Kimi-compatible endpoint",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; Kimi-compatible inference fixture",
     profile: "standard",
     timeoutMinutes: 50,
     installMode: "authenticated",
@@ -830,6 +915,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("llama-cpp-generic-gpu", {
     displayName: "Inference: completes an agent turn with llama.cpp on a generic NVIDIA GPU",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "NVIDIA GPU runner; local llama.cpp",
     profile: "standard",
     runner: "linux-amd64-gpu-rtxpro6000-latest-1",
     timeoutMinutes: 120,
@@ -846,6 +933,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("messaging-compatible-endpoint", {
     displayName: "Messaging: routes Telegram through a compatible endpoint",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; compatible inference and Telegram fixtures",
     profile: "standard",
     timeoutMinutes: 45,
     installMode: "none",
@@ -861,6 +950,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("model-router-provider-routed-inference", {
     displayName: "Inference: Model Router returns a provider-routed response",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA API and Model Router",
     profile: "nvidia-api",
     timeoutMinutes: 45,
     installMode: "none",
@@ -870,6 +961,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("network-policy", {
     displayName: "Network policy: enforces restricted allow and deny rules",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and network probes",
     profile: "nvidia-inference",
     timeoutMinutes: 90,
     installMode: "credential-free",
@@ -896,6 +989,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("ollama-auth-proxy", {
     displayName: "Inference: Ollama proxy enforces and preserves authentication",
+    agentRuntime: "none",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local Ollama proxy",
     profile: "standard",
     timeoutMinutes: 45,
     installMode: "none",
@@ -908,6 +1003,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("onboard-repair", {
     displayName: "Onboarding: repairs a missing sandbox and rejects conflicting resume input",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local onboarding fixtures",
     profile: "standard",
     timeoutMinutes: 75,
     installMode: "authenticated",
@@ -917,6 +1014,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("onboard-policy-preset-sequencing", {
     displayName: "Onboarding: preserves policy preset step order",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 60,
     installMode: "authenticated",
@@ -927,6 +1026,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("onboard-resume", {
     displayName: "Onboarding: resumes interrupted setup from recorded progress",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; local onboarding fixtures",
     profile: "standard",
     timeoutMinutes: 45,
     installMode: "credential-free",
@@ -936,6 +1037,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("openclaw-discord-pairing", {
     displayName: "Messaging: shares OpenClaw Discord pairing approval",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Discord",
     profile: "nvidia-inference",
     timeoutMinutes: 60,
     installMode: "credential-free",
@@ -951,6 +1054,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("openclaw-skill-cli", {
     displayName: "Skills: OpenClaw installs and inspects workspace skills",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 60,
     installMode: "none",
@@ -964,6 +1069,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("openclaw-inference-switch", {
     displayName: "Inference: OpenClaw switches providers and remains responsive",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; compatible inference fixtures",
     profile: "standard",
     timeoutMinutes: 90,
     installMode: "none",
@@ -984,6 +1091,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("openclaw-tui-chat-correlation", {
     displayName: "TUI: keeps rapid OpenClaw turns correlated",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 75,
     installMode: "none",
@@ -1007,6 +1116,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("openclaw-slack-pairing", {
     displayName: "Messaging: shares OpenClaw Slack pairing approval",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Slack",
     profile: "nvidia-inference",
     timeoutMinutes: 60,
     installMode: "credential-free",
@@ -1024,6 +1135,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   ...GATEWAY_UPGRADE_TARGETS,
   target("rebuild-openclaw", {
     displayName: "Rebuild: preserves OpenClaw state and rotates the gateway token",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 130,
     installMode: "credential-free",
@@ -1037,6 +1150,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("rebuild-hermes", {
     displayName: "Rebuild: preserves Hermes state and recovers cron dispatch",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     owningPaths: ["test/e2e/live/rebuild-hermes-cron-restore.ts"],
@@ -1064,6 +1179,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("rebuild-hermes-stale-base", {
     displayName: "Rebuild: refreshes a stale Hermes base and restores state",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     testFile: "test/e2e/live/rebuild-hermes.test.ts",
@@ -1093,6 +1210,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("sandbox-survival", {
     displayName: "Lifecycle: preserves sandbox state after an OpenShell gateway restart",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 30,
     installMode: "none",
@@ -1107,6 +1226,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("sandbox-operations", {
     displayName: "Sandbox: preserves lifecycle and multi-sandbox operations",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 60,
     installMode: "credential-free",
@@ -1125,6 +1246,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("security-posture-openclaw", {
     targetId: "security-posture",
     displayName: "Security: OpenClaw retains the required sandbox posture",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     testFile: "test/e2e/live/full-e2e.test.ts",
@@ -1151,6 +1274,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   target("security-posture-hermes", {
     targetId: "security-posture",
     displayName: "Security: Hermes retains the required sandbox posture",
+    agentRuntime: "hermes",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     testFile: "test/e2e/live/hermes-e2e.test.ts",
@@ -1179,6 +1304,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("sessions-agents-cli", {
     displayName: "CLI: routes sessions and agents to OpenClaw",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 70,
     installMode: "credential-free",
@@ -1193,6 +1320,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("shields-config", {
     displayName: "Shields: restores stopped OpenClaw across posture changes",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 45,
     installMode: "none",
@@ -1208,6 +1337,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("snapshot-commands", {
     displayName: "Snapshot: restores selected sandbox state without credential leaks",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu Docker host; no inference endpoint",
     profile: "standard",
     timeoutMinutes: 40,
     installMode: "none",
@@ -1227,6 +1358,9 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("spark-install", {
     displayName: "Install: leaves NemoClaw and OpenShell usable after standard installation",
+    agentRuntime: "unresolved",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
+    unresolvedReason: "The test asserts CLI usability but does not assert an agent runtime",
     profile: "nvidia-inference",
     timeoutMinutes: 45,
     installMode: "none",
@@ -1243,6 +1377,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("skill-agent", {
     displayName: "Skills: OpenClaw reads an injected sandbox skill",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     prAdvisorSelectable: true,
     timeoutMinutes: 30,
@@ -1253,6 +1389,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("state-backup-restore", {
     displayName: "Backup: restores workspace files and memory",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference",
     profile: "nvidia-inference",
     timeoutMinutes: 60,
     installMode: "credential-free",
@@ -1267,6 +1405,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("telegram-injection", {
     displayName: "Messaging: treats Telegram shell metacharacters as data",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Telegram fixture",
     profile: "nvidia-inference",
     timeoutMinutes: 45,
     installMode: "credential-free",
@@ -1281,6 +1421,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("token-rotation", {
     displayName: "Messaging: rotates one provider token without rebuilding siblings",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; no inference endpoint",
     profile: "github-read",
     timeoutMinutes: 45,
     installMode: "none",
@@ -1299,6 +1441,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("tunnel-lifecycle", {
     displayName: "Tunnel: starts, probes, and stops a public dashboard tunnel",
+    agentRuntime: "openclaw",
+    environmentOrInferenceEndpoint: "Ubuntu; NVIDIA hosted inference and Cloudflare tunnel",
     profile: "nvidia-inference",
     timeoutMinutes: 75,
     installMode: "none",
@@ -1314,6 +1458,8 @@ export const E2E_TARGET_CATALOGUE: readonly E2eCatalogueTarget[] = [
   }),
   target("whatsapp-qr-compact", {
     displayName: "Messaging: renders a compact WhatsApp pairing QR code",
+    agentRuntime: "none",
+    environmentOrInferenceEndpoint: "Ubuntu; no sandbox or inference endpoint",
     profile: "standard",
     timeoutMinutes: 15,
     installMode: "none",
@@ -1464,6 +1610,15 @@ export function validateE2eTargetCatalogue(
         throw new Error(`E2E target ${entry.id} has an invalid environment entry`);
       }
     }
+    validateE2eExecutionMetadata(
+      {
+        agentRuntime: entry.agentRuntime,
+        environmentOrInferenceEndpoint: entry.environmentOrInferenceEndpoint,
+        observableOutcome: entry.displayName,
+        unresolvedReason: entry.unresolvedReason,
+      },
+      `E2E target ${entry.id}`,
+    );
   }
   return targets;
 }
@@ -1516,6 +1671,10 @@ export function catalogueMatrix(
       id: entry.id,
       target_id: entry.targetId,
       display_name: entry.displayName,
+      agent_runtime: entry.agentRuntime,
+      observable_outcome: entry.displayName,
+      environment_or_inference_endpoint: entry.environmentOrInferenceEndpoint,
+      unresolved_reason: entry.unresolvedReason,
       runner: entry.runner,
       runner_key: entry.runnerKey,
       test_file: entry.testFile,
diff --git a/tools/e2e/workflow-boundary.mts b/tools/e2e/workflow-boundary.mts
index d4a9448113..0a90d0945e 100644
--- a/tools/e2e/workflow-boundary.mts
+++ b/tools/e2e/workflow-boundary.mts
@@ -39,6 +39,11 @@ import {
 } from "./operations-workflow-boundary.mts";
 import { validateRunnerComparisonWorkflowBoundary } from "./runner-comparison-workflow-boundary.mts";
 import { normalizeE2eSelectorIds } from "./selector-aliases.mts";
+import {
+  type E2eExecutionRow,
+  validateE2eExecutionRows,
+  validateE2eExecutionMetadata,
+} from "./execution-coverage.mts";
 import { validateStandardProfileWorkflowBoundary } from "./standard-profile-workflow-boundary.mts";
 import {
   validateTrustedHermesSwapHelperSource,
@@ -114,6 +119,7 @@ export interface FreeStandingJobsInventory {
   freeStandingTargets: string[];
   targetToJob: Map<string, string>;
   liveTestToJobs: Map<string, string[]>;
+  coverageRows: E2eExecutionRow[];
 }
 
 export interface FocusedE2eJob {
@@ -154,6 +160,18 @@ const LIVE_TEST_FILE_PATTERN = /test\/e2e\/live\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-
 const FREE_STANDING_JOB_MARKER = "E2E_JOB";
 const FREE_STANDING_TARGET_MARKER = "E2E_TARGET_ID";
 const FREE_STANDING_DEFAULT_ENABLED_MARKER = "E2E_DEFAULT_ENABLED";
+const AGENT_RUNTIME_MARKER = "E2E_AGENT_RUNTIME";
+const OUTCOME_MARKER = "E2E_OBSERVABLE_OUTCOME";
+const ENVIRONMENT_MARKER = "E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT";
+const UNRESOLVED_MARKER = "E2E_UNRESOLVED_REASON";
+const COVERAGE_MATRIX_KEYS = [
+  "agent_runtime",
+  "observable_outcome",
+  "environment_or_inference_endpoint",
+  "unresolved_reason",
+  "coverage_variant",
+] as const;
+const STAGING_BREV_JOB_ID = "staging-brev-launchable";
 const COMMON_SECRET_ENV_NAMES = [
   "NVIDIA_API_KEY",
   "NVIDIA_INFERENCE_API_KEY",
@@ -449,6 +467,44 @@ function findDuplicates(values: readonly string[]): string[] {
   return [...duplicates].sort();
 }
 
+function workflowCoverageRows(jobId: string, job: WorkflowRecord): E2eExecutionRow[] {
+  const env = asRecord(job.env);
+  const matrix = asRecord(asRecord(job.strategy).matrix);
+  const includes = Array.isArray(matrix.include)
+    ? matrix.include
+        .map(asRecord)
+        .filter((entry) => COVERAGE_MATRIX_KEYS.some((key) => Object.hasOwn(entry, key)))
+    : [];
+  const hasEnvironmentMetadata = [
+    AGENT_RUNTIME_MARKER,
+    OUTCOME_MARKER,
+    ENVIRONMENT_MARKER,
+    UNRESOLVED_MARKER,
+  ].some((key) => Object.hasOwn(env, key));
+  if (!hasEnvironmentMetadata && includes.length === 0) return [];
+
+  const candidates = includes.length > 0 ? includes : [{}];
+  return candidates.map((entry) => {
+    const metadata = validateE2eExecutionMetadata(
+      {
+        agentRuntime: stringValue(entry.agent_runtime || env[AGENT_RUNTIME_MARKER]),
+        observableOutcome: stringValue(entry.observable_outcome || env[OUTCOME_MARKER]),
+        environmentOrInferenceEndpoint: stringValue(
+          entry.environment_or_inference_endpoint || env[ENVIRONMENT_MARKER],
+        ),
+        unresolvedReason: stringValue(entry.unresolved_reason || env[UNRESOLVED_MARKER]),
+      } as Parameters<typeof validateE2eExecutionMetadata>[0],
+      `E2E workflow job ${jobId}`,
+    );
+    return {
+      id: jobId,
+      variant: stringValue(entry.coverage_variant),
+      source: jobId === STAGING_BREV_JOB_ID ? "staging" : "retained-workflow",
+      ...metadata,
+    };
+  });
+}
+
 function deriveFreeStandingJobsInventoryFromJobs(jobs: WorkflowRecord): {
   errors: string[];
   inventory: FreeStandingJobsInventory;
@@ -460,10 +516,16 @@ function deriveFreeStandingJobsInventoryFromJobs(jobs: WorkflowRecord): {
   const freeStandingTargets: string[] = [];
   const targetToJob = new Map<string, string>();
   const liveTestToJobs = new Map<string, string[]>();
+  const coverageRows: E2eExecutionRow[] = [];
 
   for (const [jobId, rawJob] of Object.entries(jobs)) {
     const job = asRecord(rawJob);
     const env = asRecord(job.env);
+    try {
+      coverageRows.push(...workflowCoverageRows(jobId, job));
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : String(error));
+    }
     if (jobId === SHARED_E2E_JOB_ID) continue;
     const hasJobMarker = Object.hasOwn(env, FREE_STANDING_JOB_MARKER);
     const hasTargetMarker = Object.hasOwn(env, FREE_STANDING_TARGET_MARKER);
@@ -532,6 +594,22 @@ function deriveFreeStandingJobsInventoryFromJobs(jobs: WorkflowRecord): {
   for (const duplicate of findDuplicates(freeStandingTargets)) {
     errors.push(`free-standing workflow metadata repeats target id: ${duplicate}`);
   }
+  for (const jobId of workflowJobs) {
+    if (jobId !== SHARED_E2E_JOB_ID && !coverageRows.some((row) => row.id === jobId)) {
+      errors.push(`${jobId} job requires execution coverage metadata`);
+    }
+  }
+  if (
+    Object.hasOwn(jobs, STAGING_BREV_JOB_ID) &&
+    !coverageRows.some((row) => row.source === "staging")
+  ) {
+    errors.push(`${STAGING_BREV_JOB_ID} job requires execution coverage metadata`);
+  }
+  try {
+    validateE2eExecutionRows(coverageRows);
+  } catch (error) {
+    errors.push(error instanceof Error ? error.message : String(error));
+  }
 
   return {
     errors,
@@ -541,6 +619,7 @@ function deriveFreeStandingJobsInventoryFromJobs(jobs: WorkflowRecord): {
       explicitOnlyJobs,
       freeStandingTargets,
       targetToJob,
+      coverageRows,
       liveTestToJobs: new Map(
         [...liveTestToJobs]
           .sort(([left], [right]) => left.localeCompare(right))
@@ -568,6 +647,7 @@ function cloneFreeStandingJobsInventory(
     explicitOnlyJobs: [...inventory.explicitOnlyJobs],
     freeStandingTargets: [...inventory.freeStandingTargets],
     targetToJob: new Map(inventory.targetToJob),
+    coverageRows: inventory.coverageRows.map((row) => ({ ...row })),
     liveTestToJobs: cloneStringArrayMap(inventory.liveTestToJobs),
   };
 }
diff --git a/tools/e2e/workflow-plan.mts b/tools/e2e/workflow-plan.mts
index b245d51e5e..c094ecdb5d 100644
--- a/tools/e2e/workflow-plan.mts
+++ b/tools/e2e/workflow-plan.mts
@@ -4,11 +4,13 @@
 import { appendFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 
 import { buildLiveTargetMatrix, type LiveTargetMatrixEntry } from "../../test/e2e/registry/run.ts";
 import { buildRiskPlan } from "../advisors/risk-plan.mts";
 import {
   type CredentialFreeTestMatrixRow,
+  credentialFreeTestCoverage,
   discoverCredentialFreeTests,
   SHARED_E2E_JOB_ID,
 } from "./credential-free-tests.mts";
@@ -32,6 +34,12 @@ import {
   focusedE2eJobsForChangedFiles,
   readFreeStandingJobsInventory,
 } from "./workflow-boundary.mts";
+import {
+  e2eExecutionLabel,
+  type E2eExecutionRow,
+  validateE2eExecutionRows,
+  validateE2eExecutionMetadata,
+} from "./execution-coverage.mts";
 
 export type WorkflowPlanSelectors = {
   jobs?: string;
@@ -42,6 +50,7 @@ export type E2eWorkflowPlan = {
   matrix: LiveTargetMatrixEntry[];
   testMatrix: CredentialFreeTestMatrixRow[];
   catalogueMatrices: Record<E2eExecutionProfile, E2eCatalogueMatrixRow[]>;
+  coverageMatrix: E2eExecutionRow[];
   selectedJobs: string[];
   hermesSelected: boolean;
   explicitOnlyJobs: string[];
@@ -107,15 +116,43 @@ function isStringArray(value: unknown): value is string[] {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
 
+function hasValidExecutionMetadata(value: Record<string, unknown>): boolean {
+  if (
+    typeof value.agentRuntime !== "string" ||
+    typeof value.observableOutcome !== "string" ||
+    typeof value.environmentOrInferenceEndpoint !== "string" ||
+    typeof value.unresolvedReason !== "string"
+  ) {
+    return false;
+  }
+  try {
+    validateE2eExecutionMetadata(
+      {
+        agentRuntime: value.agentRuntime as E2eExecutionRow["agentRuntime"],
+        observableOutcome: value.observableOutcome,
+        environmentOrInferenceEndpoint: value.environmentOrInferenceEndpoint,
+        unresolvedReason: value.unresolvedReason,
+      },
+      "E2E workflow plan row",
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function isLiveTargetMatrixEntry(value: unknown): value is LiveTargetMatrixEntry {
   if (!isRecord(value)) return false;
   if (
     !hasExactKeys(value, [
+      "agentRuntime",
+      "environmentOrInferenceEndpoint",
       "expectedStateId",
       "id",
       "install",
       "label",
       "onboarding",
+      "observableOutcome",
       "pendingRuntimeSuites",
       "platform",
       "requiredSecrets",
@@ -124,6 +161,7 @@ function isLiveTargetMatrixEntry(value: unknown): value is LiveTargetMatrixEntry
       "suites",
       "supportReasons",
       "supported",
+      "unresolvedReason",
     ])
   ) {
     return false;
@@ -139,11 +177,16 @@ function isLiveTargetMatrixEntry(value: unknown): value is LiveTargetMatrixEntry
     typeof value.runtime === "string" &&
     typeof value.onboarding === "string" &&
     typeof value.expectedStateId === "string" &&
+    typeof value.agentRuntime === "string" &&
+    typeof value.observableOutcome === "string" &&
+    typeof value.environmentOrInferenceEndpoint === "string" &&
+    typeof value.unresolvedReason === "string" &&
     typeof value.supported === "boolean" &&
     isStringArray(value.suites) &&
     isStringArray(value.requiredSecrets) &&
     isStringArray(value.supportReasons) &&
-    isStringArray(value.pendingRuntimeSuites)
+    isStringArray(value.pendingRuntimeSuites) &&
+    hasValidExecutionMetadata(value)
   );
 }
 
@@ -176,15 +219,18 @@ function isCatalogueMatrixRow(value: unknown): value is E2eCatalogueMatrixRow {
     isRecord(value) &&
     hasExactKeys(value, [
       "artifact_layout",
+      "agent_runtime",
       "cloudflared",
       "compatible_api_key",
       "id",
       "display_name",
+      "environment_or_inference_endpoint",
       "host_preparation",
       "host_packages",
       "install_mode",
       "install_non_interactive",
       "restore_cli",
+      "observable_outcome",
       "runner",
       "runner_comparison",
       "runner_key",
@@ -193,11 +239,16 @@ function isCatalogueMatrixRow(value: unknown): value is E2eCatalogueMatrixRow {
       "target_id",
       "test_file",
       "timeout_minutes",
+      "unresolved_reason",
     ]) &&
     typeof value.id === "string" &&
     /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(value.id) &&
     typeof value.display_name === "string" &&
     /^[A-Z][A-Za-z0-9 .'+()-]+: [^/\r\n]{1,72}$/u.test(value.display_name) &&
+    typeof value.agent_runtime === "string" &&
+    typeof value.observable_outcome === "string" &&
+    typeof value.environment_or_inference_endpoint === "string" &&
+    typeof value.unresolved_reason === "string" &&
     typeof value.runner === "string" &&
     /^[A-Za-z0-9._-]+$/u.test(value.runner) &&
     typeof value.runner_key === "string" &&
@@ -225,10 +276,53 @@ function isCatalogueMatrixRow(value: unknown): value is E2eCatalogueMatrixRow {
     (value.install_mode === "none" ||
       value.install_mode === "authenticated" ||
       value.install_mode === "credential-free") &&
-    typeof value.restore_cli === "boolean"
+    typeof value.restore_cli === "boolean" &&
+    hasValidExecutionMetadata({
+      agentRuntime: value.agent_runtime,
+      observableOutcome: value.observable_outcome,
+      environmentOrInferenceEndpoint: value.environment_or_inference_endpoint,
+      unresolvedReason: value.unresolved_reason,
+    })
   );
 }
 
+function isE2eExecutionRow(value: unknown): value is E2eExecutionRow {
+  if (
+    !isRecord(value) ||
+    !hasExactKeys(value, [
+      "agentRuntime",
+      "environmentOrInferenceEndpoint",
+      "id",
+      "observableOutcome",
+      "source",
+      "unresolvedReason",
+      "variant",
+    ]) ||
+    typeof value.id !== "string" ||
+    typeof value.variant !== "string" ||
+    typeof value.source !== "string" ||
+    !hasValidExecutionMetadata(value)
+  ) {
+    return false;
+  }
+  try {
+    validateE2eExecutionRows([value as unknown as E2eExecutionRow]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isE2eExecutionRows(value: unknown): value is E2eExecutionRow[] {
+  if (!Array.isArray(value) || !value.every(isE2eExecutionRow)) return false;
+  try {
+    validateE2eExecutionRows(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function isCatalogueMatrixRowForProfile(
   value: unknown,
   profile: E2eExecutionProfile,
@@ -239,6 +333,10 @@ function isCatalogueMatrixRowForProfile(
     target?.profile === profile &&
     target.targetId === value.target_id &&
     target.displayName === value.display_name &&
+    target.agentRuntime === value.agent_runtime &&
+    target.displayName === value.observable_outcome &&
+    target.environmentOrInferenceEndpoint === value.environment_or_inference_endpoint &&
+    target.unresolvedReason === value.unresolved_reason &&
     target.runner === value.runner &&
     target.runnerKey === value.runner_key &&
     target.testFile === value.test_file &&
@@ -376,12 +474,62 @@ function emptyE2eWorkflowPlan(): E2eWorkflowPlan {
     matrix: [],
     testMatrix: [],
     catalogueMatrices: emptyCatalogueMatrices(),
+    coverageMatrix: [],
     selectedJobs: [],
     hermesSelected: false,
     explicitOnlyJobs: readFreeStandingJobsInventory().explicitOnlyJobs,
   };
 }
 
+type E2eWorkflowPlanWithoutCoverage = Omit<E2eWorkflowPlan, "coverageMatrix">;
+
+function coverageMatrixForPlan(
+  plan: E2eWorkflowPlanWithoutCoverage,
+  inventory: ReturnType<typeof readFreeStandingJobsInventory>,
+): E2eExecutionRow[] {
+  const catalogueRows = E2E_EXECUTION_PROFILES.flatMap((profile) =>
+    plan.catalogueMatrices[profile].map((row) => ({
+      id: row.id,
+      variant: "",
+      source: "catalogue" as const,
+      agentRuntime: row.agent_runtime,
+      observableOutcome: row.observable_outcome,
+      environmentOrInferenceEndpoint: row.environment_or_inference_endpoint,
+      unresolvedReason: row.unresolved_reason,
+    })),
+  );
+  const registryRows = plan.matrix.map((row) => ({
+    id: row.id,
+    variant: "",
+    source: "typed-registry" as const,
+    agentRuntime: row.agentRuntime,
+    observableOutcome: row.observableOutcome,
+    environmentOrInferenceEndpoint: row.environmentOrInferenceEndpoint,
+    unresolvedReason: row.unresolvedReason,
+  }));
+  const sharedRows = plan.testMatrix.map((row) => ({
+    id: row.id,
+    variant: "",
+    source: "shared-e2e" as const,
+    ...credentialFreeTestCoverage(row.id),
+  }));
+  const selectedJobs = new Set(plan.selectedJobs);
+  const workflowRows = inventory.coverageRows.filter((row) => selectedJobs.has(row.id));
+  const rows = [...catalogueRows, ...registryRows, ...sharedRows, ...workflowRows];
+  validateE2eExecutionRows(rows);
+  return rows;
+}
+
+function withCoverageMatrix(
+  plan: E2eWorkflowPlanWithoutCoverage,
+  inventory: ReturnType<typeof readFreeStandingJobsInventory>,
+): E2eWorkflowPlan {
+  return {
+    ...plan,
+    coverageMatrix: coverageMatrixForPlan(plan, inventory),
+  };
+}
+
 export function releaseRequiredWorkflowJobs(): string[] {
   const inventory = readFreeStandingJobsInventory();
   const sharedTestsRun = discoverCredentialFreeTests().length > 0;
@@ -433,14 +581,17 @@ export function buildE2eWorkflowPlan(
     (jobs.length === 1 && jobs[0] === JETSON_DISPATCH_TARGET && targets.length === 0) ||
     (targets.length === 1 && targets[0] === JETSON_DISPATCH_TARGET && jobs.length === 0);
   if (jetsonDispatchSelected) {
-    return {
-      matrix: [],
-      testMatrix: [],
-      catalogueMatrices: emptyCatalogueMatrices(),
-      selectedJobs: [JETSON_DISPATCH_TARGET],
-      hermesSelected: false,
-      explicitOnlyJobs: [...inventory.explicitOnlyJobs],
-    };
+    return withCoverageMatrix(
+      {
+        matrix: [],
+        testMatrix: [],
+        catalogueMatrices: emptyCatalogueMatrices(),
+        selectedJobs: [JETSON_DISPATCH_TARGET],
+        hermesSelected: false,
+        explicitOnlyJobs: [...inventory.explicitOnlyJobs],
+      },
+      inventory,
+    );
   }
   const credentialFreeTests = discoverCredentialFreeTests();
   const catalogueIds = new Set(
@@ -475,14 +626,17 @@ export function buildE2eWorkflowPlan(
       selectedJobSet.add("openshell-credential-generation-window");
     }
     const selectedJobs = [...selectedJobSet];
-    return {
-      matrix: registryTargets.length > 0 ? buildLiveTargetMatrix(registryTargets) : [],
-      testMatrix: selectTestRows(credentialFreeTests, [...jobs, ...targets]),
-      catalogueMatrices: catalogueMatrices(selectedCatalogueTargets),
-      selectedJobs,
-      hermesSelected: selectedJobs.includes(HERMES_JOB_ID),
-      explicitOnlyJobs: [...inventory.explicitOnlyJobs],
-    };
+    return withCoverageMatrix(
+      {
+        matrix: registryTargets.length > 0 ? buildLiveTargetMatrix(registryTargets) : [],
+        testMatrix: selectTestRows(credentialFreeTests, [...jobs, ...targets]),
+        catalogueMatrices: catalogueMatrices(selectedCatalogueTargets),
+        selectedJobs,
+        hermesSelected: selectedJobs.includes(HERMES_JOB_ID),
+        explicitOnlyJobs: [...inventory.explicitOnlyJobs],
+      },
+      inventory,
+    );
   }
 
   if (options.changedFiles) {
@@ -538,24 +692,32 @@ export function buildE2eWorkflowPlan(
       ...registryTargetsForChangedFiles(changedFiles),
       ...(riskTargetIds.length > 0 ? buildLiveTargetMatrix(riskTargetIds) : []),
     ].filter((entry, index, rows) => rows.findIndex((row) => row.id === entry.id) === index);
-    return {
-      matrix: registryMatrix,
-      testMatrix: selectedTests,
-      catalogueMatrices: catalogueMatrices(selectedCatalogueTargets),
-      selectedJobs,
-      hermesSelected: selectedJobs.includes(HERMES_JOB_ID),
-      explicitOnlyJobs: [...inventory.explicitOnlyJobs],
-    };
+    return withCoverageMatrix(
+      {
+        matrix: registryMatrix,
+        testMatrix: selectedTests,
+        catalogueMatrices: catalogueMatrices(selectedCatalogueTargets),
+        selectedJobs,
+        hermesSelected: selectedJobs.includes(HERMES_JOB_ID),
+        explicitOnlyJobs: [...inventory.explicitOnlyJobs],
+      },
+      inventory,
+    );
   }
 
-  return {
-    matrix: buildLiveTargetMatrix(),
-    testMatrix: credentialFreeTests,
-    catalogueMatrices: catalogueMatrices(E2E_TARGET_CATALOGUE),
-    selectedJobs: inventory.workflowJobs.filter((job) => !inventory.explicitOnlyJobs.includes(job)),
-    hermesSelected: true,
-    explicitOnlyJobs: [...inventory.explicitOnlyJobs],
-  };
+  return withCoverageMatrix(
+    {
+      matrix: buildLiveTargetMatrix(),
+      testMatrix: credentialFreeTests,
+      catalogueMatrices: catalogueMatrices(E2E_TARGET_CATALOGUE),
+      selectedJobs: inventory.workflowJobs.filter(
+        (job) => !inventory.explicitOnlyJobs.includes(job),
+      ),
+      hermesSelected: true,
+      explicitOnlyJobs: [...inventory.explicitOnlyJobs],
+    },
+    inventory,
+  );
 }
 
 export function validateE2eWorkflowPlan(plan: unknown): E2eWorkflowPlan {
@@ -566,6 +728,7 @@ export function validateE2eWorkflowPlan(plan: unknown): E2eWorkflowPlan {
       "explicitOnlyJobs",
       "hermesSelected",
       "matrix",
+      "coverageMatrix",
       "selectedJobs",
       "testMatrix",
     ])
@@ -584,6 +747,7 @@ export function validateE2eWorkflowPlan(plan: unknown): E2eWorkflowPlan {
     !plan.matrix.every(isLiveTargetMatrixEntry) ||
     !Array.isArray(plan.testMatrix) ||
     !plan.testMatrix.every(isCredentialFreeTestMatrixRow) ||
+    !isE2eExecutionRows(plan.coverageMatrix) ||
     !hasUniqueIds([...plan.matrix, ...plan.testMatrix, ...catalogueMatrixRows]) ||
     !isStringArray(plan.selectedJobs) ||
     !plan.selectedJobs.every((job) => /^[A-Za-z0-9_-]+$/u.test(job)) ||
@@ -595,6 +759,16 @@ export function validateE2eWorkflowPlan(plan: unknown): E2eWorkflowPlan {
   ) {
     throw new Error("E2E planner returned an invalid output schema");
   }
+  const { coverageMatrix, ...planWithoutCoverage } = plan as E2eWorkflowPlan;
+  const expectedCoverageMatrix = coverageMatrixForPlan(
+    planWithoutCoverage,
+    readFreeStandingJobsInventory(),
+  );
+  if (!isDeepStrictEqual(coverageMatrix, expectedCoverageMatrix)) {
+    throw new Error(
+      "E2E planner returned execution coverage that does not match its execution plan",
+    );
+  }
   return plan as E2eWorkflowPlan;
 }
 
@@ -609,41 +783,105 @@ function expectedHermesSelection(
   return (selected.length === 0 && !retiredSelectorSelected) || selected.includes(HERMES_JOB_ID);
 }
 
-function withoutCredentialedCatalogueProfiles(plan: E2eWorkflowPlan): E2eWorkflowPlan {
+export function withoutCredentialedCatalogueProfiles(plan: E2eWorkflowPlan): E2eWorkflowPlan {
   const eligibleRows = (rows: E2eCatalogueMatrixRow[]) =>
     rows.filter((row) => isPrCandidateCatalogueTarget(catalogueTarget(row.id)));
+  const catalogueMatrices = Object.fromEntries(
+    E2E_EXECUTION_PROFILES.map((profile) => [
+      profile,
+      eligibleRows(plan.catalogueMatrices[profile]),
+    ]),
+  ) as Record<E2eExecutionProfile, E2eCatalogueMatrixRow[]>;
+  const eligibleCatalogueIds = new Set(
+    E2E_EXECUTION_PROFILES.flatMap((profile) => catalogueMatrices[profile].map((row) => row.id)),
+  );
   return {
     ...plan,
-    catalogueMatrices: Object.fromEntries(
-      E2E_EXECUTION_PROFILES.map((profile) => [
-        profile,
-        eligibleRows(plan.catalogueMatrices[profile]),
-      ]),
-    ) as Record<E2eExecutionProfile, E2eCatalogueMatrixRow[]>,
+    catalogueMatrices,
+    coverageMatrix: plan.coverageMatrix.filter(
+      (row) => row.source !== "catalogue" || eligibleCatalogueIds.has(row.id),
+    ),
   };
 }
 
-export function renderE2eWorkflowPlanSummary(plan: E2eWorkflowPlan): string {
+export function renderE2eWorkflowPlanSummary(
+  plan: E2eWorkflowPlan,
+  options: { includeCoverageAudit?: boolean } = {},
+): string {
   const lines = [
     "## E2E Execution Plan",
     "",
-    "| Target or job | Execution | Runner |",
-    "| --- | --- | --- |",
+    "| Target or job | Agent runtime | Observable outcome | Environment or inference endpoint | Source | Unresolved reason |",
+    "| --- | --- | --- | --- | --- | --- |",
   ];
-  for (const job of plan.selectedJobs) {
-    lines.push(`| \`${job}\` | retained workflow job | declared by job |`);
+  for (const row of plan.coverageMatrix) {
+    lines.push(
+      `| \`${e2eExecutionLabel(row)}\` | ${row.agentRuntime} | ${row.observableOutcome} | ${row.environmentOrInferenceEndpoint} | ${row.source} | ${row.unresolvedReason} |`,
+    );
   }
-  for (const row of plan.matrix) {
-    lines.push(`| \`${row.id}\` | typed registry | \`${row.runner}\` |`);
+  if (options.includeCoverageAudit === false) {
+    return `${lines.join("\n")}\n`;
   }
-  for (const row of plan.testMatrix) {
-    lines.push(`| \`${row.id}\` | shared E2E job | \`ubuntu-latest\` |`);
+  const inventory = readFreeStandingJobsInventory();
+  const explicitOnlyRows = inventory.coverageRows.filter((row) =>
+    plan.explicitOnlyJobs.includes(row.id),
+  );
+  const unsupportedDeclarations = plan.matrix.filter((row) => !row.supported);
+  const outcomeRows = new Map<string, E2eExecutionRow[]>();
+  for (const row of plan.coverageMatrix) {
+    const rows = outcomeRows.get(row.observableOutcome) ?? [];
+    rows.push(row);
+    outcomeRows.set(row.observableOutcome, rows);
   }
-  for (const profile of E2E_EXECUTION_PROFILES) {
-    for (const row of plan.catalogueMatrices[profile]) {
-      lines.push(`| \`${row.id}\` | \`${profile}\` profile | \`${row.runner}\` |`);
-    }
+  const repeatedOutcomes = [...outcomeRows].filter(([, rows]) => rows.length > 1);
+  lines.push(
+    "",
+    "### Repeated outcomes with distinct evidence",
+    "",
+    "| Observable outcome | Rows | Distinguishing dimensions |",
+    "| --- | --- | --- |",
+  );
+  for (const [outcome, rows] of repeatedOutcomes) {
+    const dimensions = [
+      new Set(rows.map((row) => row.agentRuntime)).size > 1 ? "agent runtime" : "",
+      new Set(rows.map((row) => row.environmentOrInferenceEndpoint)).size > 1
+        ? "environment or inference endpoint"
+        : "",
+    ].filter(Boolean);
+    lines.push(
+      `| ${outcome} | ${rows.map((row) => `\`${e2eExecutionLabel(row)}\``).join(", ")} | ${dimensions.join(" and ")} |`,
+    );
+  }
+  lines.push(
+    "",
+    "### Intentional exclusions",
+    "",
+    "| Target or job | Agent runtime | Observable outcome | Environment or inference endpoint | Exclusion | Unresolved reason |",
+    "| --- | --- | --- | --- | --- | --- |",
+  );
+  for (const row of explicitOnlyRows) {
+    lines.push(
+      `| \`${e2eExecutionLabel(row)}\` | ${row.agentRuntime} | ${row.observableOutcome} | ${row.environmentOrInferenceEndpoint} | Explicit dispatch only; excluded from the default release matrix | ${row.unresolvedReason} |`,
+    );
+  }
+  lines.push(
+    "",
+    "### Unsupported or unresolved typed declarations",
+    "",
+    "| Declaration | Agent runtime | Observable outcome | Environment or inference endpoint | Missing executable ownership |",
+    "| --- | --- | --- | --- | --- |",
+  );
+  for (const row of unsupportedDeclarations) {
+    lines.push(
+      `| \`${row.id}\` | ${row.agentRuntime} | ${row.observableOutcome} | ${row.environmentOrInferenceEndpoint} | ${row.supportReasons.join("; ")} |`,
+    );
   }
+  lines.push(
+    "",
+    "### Combinatorial gaps",
+    "",
+    `The ${unsupportedDeclarations.length} inert typed declarations above are not executable matrix cells. #8285 owns the decision on the inert cross-runtime foundation, and #8286 owns executable-only registry cleanup after that decision. Unlisted Cartesian-product cells are not required without an accepted supported combination. This migration removes no execution, so no duplicate-to-retained-evidence mapping is required.`,
+  );
   return `${lines.join("\n")}\n`;
 }
 
@@ -696,7 +934,12 @@ export function writeE2eWorkflowPlanCiOutput(
       "",
     ].join("\n"),
   );
-  appendFileSync(summary, renderE2eWorkflowPlanSummary(plan));
+  appendFileSync(
+    summary,
+    renderE2eWorkflowPlanSummary(plan, {
+      includeCoverageAudit: !hasPlannerSelectors && changedFiles === undefined,
+    }),
+  );
 }
 
 function parseArgs(argv: readonly string[]): WorkflowPlanCliOptions {
@@ -737,7 +980,11 @@ export function runE2eWorkflowPlanCli(argv = process.argv.slice(2)): void {
   }
   const plan = buildE2eWorkflowPlan(options);
   process.stdout.write(
-    options.summary ? renderE2eWorkflowPlanSummary(plan) : `${JSON.stringify(plan)}\n`,
+    options.summary
+      ? renderE2eWorkflowPlanSummary(plan, {
+          includeCoverageAudit: !options.jobs && !options.targets,
+        })
+      : `${JSON.stringify(plan)}\n`,
   );
 }