diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md
index d5c8f5307287..7fd64aee16ee 100644
--- a/docs/concepts/qa-e2e-automation.md
+++ b/docs/concepts/qa-e2e-automation.md
@@ -63,10 +63,11 @@ the selected profile instead of defining separate lanes. The resulting
 counts and missing coverage IDs; the individual evidence entries remain the
 source of truth for the tests, coverage roles, and results. Taxonomy feature
 coverage IDs are exact proof targets, not aliases: primary scenario coverage
-fulfills matching IDs, secondary coverage stays advisory. Coverage IDs use
-dotted `namespace.behavior` form with lowercase alphanumeric/dash segments;
-profile, surface, and category IDs may still use the existing dashed or dotted
-taxonomy IDs.
+fulfills matching IDs, while secondary coverage stays advisory. Every coverage
+ID is exactly `taxonomy-surface.feature`, using the short surface ID from
+`taxonomy.yaml`. A scenario's separate `surface` field is an execution/reporting
+label (for example, `channel` or `runtime-tool`); it does not define taxonomy
+ownership.
 
 Slim evidence omits per-entry `execution` and sets `evidenceMode: "slim"`;
 `smoke-ci` defaults to slim, and `--evidence-mode full` restores full entries:
@@ -74,7 +75,7 @@ Slim evidence omits per-entry `execution` and sets `evidenceMode: "slim"`;
 ```bash
 pnpm openclaw qa run \
   --qa-profile smoke-ci \
-  --category channel-framework.conversation-routing-and-delivery \
+  --category channels.conversation-routing-and-delivery \
   --provider-mode mock-openai \
   --output-dir .artifacts/qa-e2e/smoke-ci-profile-dispatch
 ```
diff --git a/extensions/qa-lab/src/ci-smoke-plan.test.ts b/extensions/qa-lab/src/ci-smoke-plan.test.ts
index 03028a5abbd8..d99894a428d8 100644
--- a/extensions/qa-lab/src/ci-smoke-plan.test.ts
+++ b/extensions/qa-lab/src/ci-smoke-plan.test.ts
@@ -55,6 +55,16 @@ describe("createQaSmokeCiPart", () => {
       scenarioIds.map((scenarioId) => scenarioById.get(scenarioId)?.sourcePath),
     );
     const scorecardReport = readQaScorecardTaxonomyReport([...scenarioById.values()]);
+    const smokeScenarioRefs = new Set(
+      scorecardReport.categories
+        .filter((category) => category.profiles.includes("smoke-ci"))
+        .flatMap((category) => category.scenarioRefs),
+    );
+    expect(
+      [...selectedScenarioPaths].every(
+        (scenarioPath) => scenarioPath !== undefined && smokeScenarioRefs.has(scenarioPath),
+      ),
+    ).toBe(true);
     const uncoveredCategoryIds = scorecardReport.categories
       .filter((category) => category.profiles.includes("smoke-ci"))
       .filter((category) => !category.scenarioRefs.some((ref) => selectedScenarioPaths.has(ref)))
diff --git a/extensions/qa-lab/src/cli.runtime.test.ts b/extensions/qa-lab/src/cli.runtime.test.ts
index 70c6cef41b6a..28d757ccb722 100644
--- a/extensions/qa-lab/src/cli.runtime.test.ts
+++ b/extensions/qa-lab/src/cli.runtime.test.ts
@@ -383,15 +383,15 @@ describe("qa cli runtime", () => {
               {
                 test: {
                   kind: "qa-scenario",
-                  id: "dm-chat-baseline",
-                  title: "DM baseline conversation",
+                  id: "channel-top-level-reply-shape",
+                  title: "Channel top-level reply shape",
                   source: {
-                    path: "qa/scenarios/channels/dm-chat-baseline.yaml",
+                    path: "qa/scenarios/channels/channel-top-level-reply-shape.yaml",
                   },
                 },
                 coverage: [
                   {
-                    id: "channels.dm",
+                    id: "channels.group-final-reply",
                     role: "primary",
                   },
                 ],
@@ -438,9 +438,9 @@ describe("qa cli runtime", () => {
         repoRoot: "/tmp/openclaw-repo",
         outputDir: ".artifacts/qa-e2e/smoke-ci",
         profile: "smoke-ci",
-        surface: "channel-framework",
-        category: "channel-framework.conversation-routing-and-delivery",
-        scenarioIds: ["dm-chat-baseline"],
+        surface: "channels",
+        category: "channels.outbound-delivery-and-reply-pipeline",
+        scenarioIds: ["channel-top-level-reply-shape"],
         transportId: "qa-channel",
         fastMode: true,
         concurrency: 2,
@@ -461,7 +461,7 @@ describe("qa cli runtime", () => {
         channel: "telegram",
         channelDriver: "crabline",
       });
-      expect(suiteArgs.scenarioIds).toEqual(["dm-chat-baseline"]);
+      expect(suiteArgs.scenarioIds).toEqual(["channel-top-level-reply-shape"]);
       expect(process.env.OPENCLAW_QA_PROFILE).toBe("release");
       const evidence = JSON.parse(await fs.readFile(suiteEvidencePath, "utf8")) as {
         evidenceMode?: unknown;
@@ -489,13 +489,13 @@ describe("qa cli runtime", () => {
       expect(evidence.scorecard).not.toHaveProperty("profile");
       expect(evidence.scorecard?.coverageIds?.fulfilled).toBe(1);
       expect(evidence.scorecard?.categoryReports?.[0]).toMatchObject({
-        id: "channel-framework.conversation-routing-and-delivery",
+        id: "channels.outbound-delivery-and-reply-pipeline",
         coverageIds: {
           fulfilled: 1,
         },
       });
       expect(evidence.entries?.[0]).not.toHaveProperty("execution");
-      expect(JSON.stringify(evidence.scorecard)).not.toContain("dm-chat-baseline");
+      expect(JSON.stringify(evidence.scorecard)).not.toContain("channel-top-level-reply-shape");
       expectWriteContains(stdoutWrite, "QA run profile: smoke-ci; categories: 1; scenarios:");
       expectWriteContains(stdoutWrite, `QA profile scorecard: ${suiteEvidencePath}`);
     } finally {
@@ -511,8 +511,8 @@ describe("qa cli runtime", () => {
     await runQaProfileCommand({
       repoRoot: "/tmp/openclaw-repo",
       profile: "release",
-      surface: "agent-runtime-and-provider-execution",
-      category: "agent-runtime-and-provider-execution.agent-turn-execution",
+      surface: "agent-runtime",
+      category: "agent-runtime.agent-turn-execution",
       providerMode: "mock-openai",
     });
 
@@ -525,7 +525,7 @@ describe("qa cli runtime", () => {
     await runQaProfileCommand({
       repoRoot: "/tmp/openclaw-repo",
       profile: "release",
-      surface: "channel-framework",
+      surface: "channels",
       providerMode: "mock-openai",
       scenarioIds: ["channel-chat-baseline", "telegram-help-command"],
     });
@@ -542,8 +542,8 @@ describe("qa cli runtime", () => {
     await runQaProfileCommand({
       repoRoot: "/tmp/openclaw-repo",
       profile: "all",
-      surface: "agent-runtime-and-provider-execution",
-      category: "agent-runtime-and-provider-execution.agent-turn-execution",
+      surface: "agent-runtime",
+      category: "agent-runtime.agent-turn-execution",
       providerMode: "mock-openai",
     });
 
@@ -568,12 +568,12 @@ describe("qa cli runtime", () => {
     await runQaProfileCommand({
       repoRoot: "/tmp/openclaw-repo",
       profile: "smoke-ci",
-      scenarioIds: ["dm-chat-baseline", "instruction-followthrough-repo-contract"],
+      scenarioIds: ["channel-top-level-reply-shape", "control-ui-qa-channel-image-roundtrip"],
     });
 
     const suiteArgs = mockFirstObjectArg(runQaSuite);
     expect(suiteArgs.channelDriver).toBe("crabline");
-    expect(suiteArgs.scenarioIds).toEqual(["dm-chat-baseline"]);
+    expect(suiteArgs.scenarioIds).toEqual(["channel-top-level-reply-shape"]);
     expect(suiteArgs.scenarioIds).not.toEqual(
       expect.arrayContaining([
         "instruction-followthrough-repo-contract",
@@ -636,11 +636,11 @@ describe("qa cli runtime", () => {
       runQaProfileCommand({
         repoRoot: "/tmp/openclaw-repo",
         profile: "smoke-ci",
-        category: "channel-framework.conversation-routing-and-delivery",
+        category: "channels.outbound-delivery-and-reply-pipeline",
         scenarioIds: ["not-a-real-scenario"],
       }),
     ).rejects.toThrow(
-      "qa run did not find taxonomy scenarios for --qa-profile smoke-ci --category channel-framework.conversation-routing-and-delivery --scenario not-a-real-scenario.",
+      "qa run did not find taxonomy scenarios for --qa-profile smoke-ci --category channels.outbound-delivery-and-reply-pipeline --scenario not-a-real-scenario.",
     );
     expect(runQaSuite).not.toHaveBeenCalled();
   });
@@ -2087,7 +2087,7 @@ describe("qa cli runtime", () => {
       await runQaCoverageReportCommand({ repoRoot: process.cwd() });
 
       expectWriteContains(stdoutWrite, "# QA Coverage Inventory");
-      expectWriteContains(stdoutWrite, "memory.recall");
+      expectWriteContains(stdoutWrite, "session-memory.embedding-search-recall");
     });
   });
 
diff --git a/extensions/qa-lab/src/cli.test.ts b/extensions/qa-lab/src/cli.test.ts
index bc319880b9b1..7b7530993306 100644
--- a/extensions/qa-lab/src/cli.test.ts
+++ b/extensions/qa-lab/src/cli.test.ts
@@ -215,9 +215,9 @@ describe("qa cli registration", () => {
       "--qa-profile",
       "smoke-ci",
       "--surface",
-      "channel-framework",
+      "channels",
       "--category",
-      "channel-framework.conversation-routing-and-delivery",
+      "channels.conversation-routing-and-delivery",
       "--scenario",
       "dm-chat-baseline",
       "--evidence-mode",
@@ -240,8 +240,8 @@ describe("qa cli registration", () => {
       repoRoot: "/tmp/openclaw-repo",
       outputDir: ".artifacts/qa-e2e/smoke-ci",
       profile: "smoke-ci",
-      surface: "channel-framework",
-      category: "channel-framework.conversation-routing-and-delivery",
+      surface: "channels",
+      category: "channels.conversation-routing-and-delivery",
       scenarioIds: ["dm-chat-baseline"],
       evidenceMode: "slim",
       transportId: "qa-channel",
@@ -257,8 +257,8 @@ describe("qa cli registration", () => {
 
   it.each([
     ["--output-dir", [".artifacts/qa-e2e/smoke-ci"]],
-    ["--surface", ["agent-runtime-and-provider-execution"]],
-    ["--category", ["channel-framework.conversation-routing-and-delivery"]],
+    ["--surface", ["agents"]],
+    ["--category", ["channels.conversation-routing-and-delivery"]],
     ["--scenario", ["dm-chat-baseline"]],
     ["--evidence-mode", ["slim"]],
     ["--exclude-test-execution-evidence", []],
diff --git a/extensions/qa-lab/src/coverage-id.ts b/extensions/qa-lab/src/coverage-id.ts
new file mode 100644
index 000000000000..215f0661f867
--- /dev/null
+++ b/extensions/qa-lab/src/coverage-id.ts
@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+export const qaCoverageIdSchema = z
+  .string()
+  .trim()
+  .regex(/^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/, {
+    message: "coverage ids must use exactly <surface-id>.<feature-id>",
+  });
diff --git a/extensions/qa-lab/src/coverage-report.test.ts b/extensions/qa-lab/src/coverage-report.test.ts
index a04b20beb95d..4e4975bd7dd6 100644
--- a/extensions/qa-lab/src/coverage-report.test.ts
+++ b/extensions/qa-lab/src/coverage-report.test.ts
@@ -11,12 +11,12 @@ import {
 import { readQaScenarioPack, type QaSeedScenarioWithSource } from "./scenario-catalog.js";
 import { readQaScorecardTaxonomyReport, type QaMaturityTaxonomy } from "./scorecard-taxonomy.js";
 
-const TEST_EXECUTABLE_CATEGORY_ID = "agent-runtime-and-provider-execution.agent-turn-execution";
-const TEST_EXECUTABLE_COVERAGE_ID = "channels.dm";
-const TEST_BROWSER_CATEGORY_ID = "browser-control-ui-and-webchat.browser-ui";
-const TEST_BROWSER_COVERAGE_ID = "ui.control";
-const TEST_WEBCHAT_COVERAGE_ID = "ui.webchat";
-const DOTTED_COVERAGE_ID_PATTERN = /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+$/;
+const TEST_EXECUTABLE_CATEGORY_ID = "agent-runtime.agent-turn-execution";
+const TEST_EXECUTABLE_COVERAGE_ID = "agent-runtime.dm";
+const TEST_BROWSER_CATEGORY_ID = "control-ui.browser-ui";
+const TEST_BROWSER_COVERAGE_ID = "control-ui.gateway-hosted-ui-control";
+const TEST_WEBCHAT_COVERAGE_ID = "agent-runtime.webchat";
+const TWO_PART_COVERAGE_ID_PATTERN = /^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/;
 
 function buildQaScorecardTaxonomyReport(params: {
   taxonomy: QaMaturityTaxonomy;
@@ -35,7 +35,6 @@ function buildQaScorecardTaxonomyReport(params: {
 function testMaturityTaxonomy(params?: {
   categoryId?: string;
   coverageIds?: readonly string[];
-  featureCoverageIds?: readonly (readonly string[])[];
   includeAllCategories?: boolean;
   includeArchivedSurface?: boolean;
 }): QaMaturityTaxonomy {
@@ -76,14 +75,9 @@ function testMaturityTaxonomy(params?: {
             category_note: "test-category.md",
             docs: [],
             search_anchors: [],
-            features: (
-              params?.featureCoverageIds ??
-              (params?.coverageIds ?? [TEST_EXECUTABLE_COVERAGE_ID]).map((coverageId) => [
-                coverageId,
-              ])
-            ).map((coverageIds) => ({
-              name: coverageIds.join(" + "),
-              coverageIds: [...coverageIds],
+            features: (params?.coverageIds ?? [TEST_EXECUTABLE_COVERAGE_ID]).map((coverageId) => ({
+              name: coverageId,
+              coverageIds: [coverageId],
             })),
           },
         ],
@@ -103,7 +97,12 @@ function testMaturityTaxonomy(params?: {
                   category_note: "legacy-category.md",
                   docs: [],
                   search_anchors: [],
-                  features: [{ name: "legacy.feature", coverageIds: ["legacy.feature"] }],
+                  features: [
+                    {
+                      name: "Legacy feature",
+                      coverageIds: ["archived-surface.legacy-feature"],
+                    },
+                  ],
                 },
               ],
             },
@@ -178,9 +177,9 @@ describe("qa coverage report", () => {
       channelDriver: "live",
     });
     for (const [categoryId, scenarioRef] of [
-      ["docker-podman-hosting.container-setup", "qa/scenarios/runtime/compose-setup.yaml"],
+      ["containers.container-setup", "qa/scenarios/runtime/compose-setup.yaml"],
       [
-        "docker-podman-hosting.image-release-and-validation",
+        "containers.image-release-and-validation",
         "qa/scenarios/runtime/docker-package-install.yaml",
       ],
     ] as const) {
@@ -197,9 +196,7 @@ describe("qa coverage report", () => {
       inventory.scorecardTaxonomy.profiles.find((profile) => profile.id === "all"),
     ).toMatchObject({
       channelDriver: "live",
-      categoryIds: expect.arrayContaining([
-        "browser-automation-and-exec-sandbox-tools.tool-invocation-and-execution",
-      ]),
+      categoryIds: expect.arrayContaining(["tools.tool-invocation-and-execution"]),
     });
     expect(inventory.scorecardTaxonomy.categoryCount).toBeGreaterThan(200);
     expect(inventory.scorecardTaxonomy.requiredCategoryCount).toBeGreaterThan(0);
@@ -215,7 +212,7 @@ describe("qa coverage report", () => {
     expect(
       inventory.scorecardTaxonomy.categories
         .flatMap((category) => category.coverageIds)
-        .every((coverageId) => DOTTED_COVERAGE_ID_PATTERN.test(coverageId)),
+        .every((coverageId) => TWO_PART_COVERAGE_ID_PATTERN.test(coverageId)),
     ).toBe(true);
     expect(inventory.scorecardTaxonomy.validationIssues.length).toBeGreaterThan(0);
     expect(
@@ -247,16 +244,18 @@ describe("qa coverage report", () => {
     const observabilityPack = inventory.scenarioPacks.find((pack) => pack.id === "observability");
     expect(personalPack?.missingScenarioIds).toStrictEqual([]);
     expect(personalPack?.scenarioIds).toContain("personal-share-safe-diagnostics-artifact");
-    expect(personalPack?.coverageIds).toContain("personal.redaction");
+    expect(personalPack?.coverageIds).toContain("security.redaction-personal-redaction");
     expect(observabilityPack?.missingScenarioIds).toStrictEqual([]);
     expect(observabilityPack?.scenarioIds).toEqual(["otel-trace-smoke", "docker-prometheus-smoke"]);
-    expect(observabilityPack?.coverageIds).toContain("telemetry.prometheus");
+    expect(observabilityPack?.coverageIds).toContain("observability.prometheus");
     expect(
       expectDefined(inventory.byTheme.memory, "memory QA theme").map((coverage) => coverage.id),
-    ).toContain("memory.recall");
+    ).toContain("session-memory.memory-recall");
     expect(
-      expectDefined(inventory.bySurface.memory, "memory QA surface").map((coverage) => coverage.id),
-    ).toContain("memory.recall");
+      expectDefined(inventory.bySurface["session-memory"], "memory QA surface").map(
+        (coverage) => coverage.id,
+      ),
+    ).toContain("session-memory.memory-recall");
   });
 
   it("rejects duplicate ownership across YAML and non-YAML catalogs", () => {
@@ -288,7 +287,7 @@ describe("qa coverage report", () => {
     expect(report).toContain("# QA Coverage Inventory");
     expect(report).toContain("- Missing coverage metadata: 0");
     expect(report).toContain("- Overlapping coverage IDs:");
-    expect(report).toContain("memory.recall");
+    expect(report).toContain("session-memory.embedding-search-recall");
     expect(report).toContain("primary: memory-recall (qa/scenarios/memory/memory-recall.yaml)");
     expect(report).toContain("secondary: active-memory-preprompt-recall");
     expect(report).toContain("## Scenario Packs");
@@ -307,9 +306,11 @@ describe("qa coverage report", () => {
     expect(report).toContain("- Inventory refs:");
     expect(report).toContain("- Scenario coverage IDs:");
     expect(report).toContain(
-      "- browser-automation-and-exec-sandbox-tools.tool-invocation-and-execution (browser-automation-and-exec-sandbox-tools / Tool Invocation and Execution; partial): profiles: all, release, smoke-ci; coverage IDs:",
+      "- tools.tool-invocation-and-execution (tools / Tool Invocation and Execution; partial): profiles: all, release; coverage IDs:",
+    );
+    expect(report).toContain(
+      "primary:playwright:ui/src/e2e/chat-flow.e2e.test.ts (control-ui.gateway-hosted-ui-control)",
     );
-    expect(report).toContain("primary:playwright:ui/src/e2e/chat-flow.e2e.test.ts (ui.control)");
     expect(report).not.toContain("### Unknown Scenario Coverage IDs");
   });
 
@@ -445,7 +446,7 @@ describe("qa coverage report", () => {
       repoRoot: process.cwd(),
       scenarios: [
         scenarioWithCoverage({
-          primary: ["agent-runtime-and-provider-execution.agent-turn-execution.missing-coverage"],
+          primary: ["agents.missing-coverage"],
         }),
       ],
     });
@@ -497,7 +498,7 @@ describe("qa coverage report", () => {
   it("counts partial coverage IDs proportionately for taxonomy inventory", () => {
     const report = buildQaScorecardTaxonomyReport({
       taxonomy: testMaturityTaxonomy({
-        featureCoverageIds: [[TEST_EXECUTABLE_COVERAGE_ID, TEST_WEBCHAT_COVERAGE_ID]],
+        coverageIds: [TEST_EXECUTABLE_COVERAGE_ID, TEST_WEBCHAT_COVERAGE_ID],
       }),
       repoRoot: process.cwd(),
       scenarios: [
@@ -525,7 +526,7 @@ describe("qa coverage report", () => {
     );
   });
 
-  it("counts each required taxonomy coverage ID once across categories", () => {
+  it("rejects one coverage ID assigned to different exact features", () => {
     const taxonomy: QaMaturityTaxonomy = {
       ...testMaturityTaxonomy(),
       profiles: [
@@ -534,15 +535,12 @@ describe("qa coverage report", () => {
           description: "Test release profile.",
           includeAllCategories: false,
           channelDriver: "qa-channel",
-          categoryIds: [
-            "agent-runtime-and-provider-execution.agent-turn-execution",
-            "agent-runtime-and-provider-execution.tool-execution-controls",
-          ],
+          categoryIds: ["agent-runtime.agent-turn-execution"],
         },
       ],
       surfaces: [
         {
-          id: "agent-runtime-and-provider-execution",
+          id: "agent-runtime",
           name: "Agent Runtime",
           family: "test",
           level: "experimental",
@@ -555,18 +553,9 @@ describe("qa coverage report", () => {
               search_anchors: [],
               features: [
                 {
-                  name: "shared plus unique",
-                  coverageIds: [TEST_EXECUTABLE_COVERAGE_ID, TEST_WEBCHAT_COVERAGE_ID],
+                  name: "shared",
+                  coverageIds: [TEST_EXECUTABLE_COVERAGE_ID],
                 },
-              ],
-            },
-            {
-              id: "tool-execution-controls",
-              name: "Tool Execution Controls",
-              category_note: "tool-execution-controls.md",
-              docs: [],
-              search_anchors: [],
-              features: [
                 {
                   name: "shared",
                   coverageIds: [TEST_EXECUTABLE_COVERAGE_ID],
@@ -577,21 +566,38 @@ describe("qa coverage report", () => {
         },
       ],
     };
-    const report = buildQaScorecardTaxonomyReport({
-      taxonomy,
-      repoRoot: process.cwd(),
-      scenarios: [
-        scenarioWithCoverage({
-          primary: [TEST_EXECUTABLE_COVERAGE_ID],
-          secondary: [TEST_WEBCHAT_COVERAGE_ID],
-          sourcePath: "qa/scenarios/channels/dm-chat-baseline.yaml",
-        }),
-      ],
-    });
+    expect(() =>
+      buildQaScorecardTaxonomyReport({
+        taxonomy,
+        repoRoot: process.cwd(),
+        scenarios: [],
+      }),
+    ).toThrow(
+      `coverage ID ${TEST_EXECUTABLE_COVERAGE_ID} already belongs to agent-runtime.agent-turn-execution feature shared; coverage IDs must identify exactly one taxonomy feature`,
+    );
+  });
 
-    expect(report.requiredCoverageIdCount).toBe(2);
-    expect(report.inventoriedCoverageIdCount).toBe(1);
-    expect(report.coverageIdInventoryPercent).toBe(50);
+  it("requires one two-part ID owned by each exact taxonomy feature", () => {
+    const taxonomy = testMaturityTaxonomy();
+    const feature = expectDefined(
+      taxonomy.surfaces[0]?.categories[0]?.features[0],
+      "test taxonomy feature",
+    );
+    feature.coverageIds = [TEST_EXECUTABLE_COVERAGE_ID, TEST_WEBCHAT_COVERAGE_ID];
+
+    expect(() =>
+      buildQaScorecardTaxonomyReport({ taxonomy, repoRoot: process.cwd(), scenarios: [] }),
+    ).toThrow("taxonomy features must define exactly one coverage ID");
+
+    feature.coverageIds = ["agents.delivery.group"];
+    expect(() =>
+      buildQaScorecardTaxonomyReport({ taxonomy, repoRoot: process.cwd(), scenarios: [] }),
+    ).toThrow("coverage ids must use exactly <surface-id>.<feature-id>");
+
+    feature.coverageIds = [TEST_BROWSER_COVERAGE_ID];
+    expect(() =>
+      buildQaScorecardTaxonomyReport({ taxonomy, repoRoot: process.cwd(), scenarios: [] }),
+    ).toThrow(`coverage ID ${TEST_BROWSER_COVERAGE_ID} must belong to surface agent-runtime`);
   });
 
   it("inventories script producer declarations", () => {
diff --git a/extensions/qa-lab/src/evidence-summary.ts b/extensions/qa-lab/src/evidence-summary.ts
index ac755970756d..c6c294b52c46 100644
--- a/extensions/qa-lab/src/evidence-summary.ts
+++ b/extensions/qa-lab/src/evidence-summary.ts
@@ -1,5 +1,6 @@
 // Qa Lab plugin module implements QA evidence summary behavior.
 import { z } from "zod";
+import { qaCoverageIdSchema } from "./coverage-id.js";
 import { resolveQaEvidenceEnvironment } from "./evidence-environment.js";
 import { splitQaModelRef } from "./model-selection.js";
 import { getQaProvider, type QaProviderMode } from "./providers/index.js";
@@ -19,7 +20,6 @@ const qaEvidenceStatusSchema = z.enum(["pass", "fail", "blocked", "skipped"]);
 const nonEmptyStringSchema = z.string().trim().min(1);
 const nullableStringSchema = nonEmptyStringSchema.nullable();
 const qaEvidenceProfileIdSchema = nonEmptyStringSchema;
-const qaEvidenceIdSchema = z.strictObject({ id: nonEmptyStringSchema });
 
 const qaEvidenceProviderSchema = z.strictObject({
   id: nonEmptyStringSchema,
@@ -82,7 +82,8 @@ const qaEvidenceRefSchema = z.strictObject({
   path: nonEmptyStringSchema,
 });
 
-const qaEvidenceCoverageSchema = qaEvidenceIdSchema.extend({
+const qaEvidenceCoverageSchema = z.strictObject({
+  id: qaCoverageIdSchema,
   role: nonEmptyStringSchema,
 });
 
diff --git a/extensions/qa-lab/src/scenario-catalog.test.ts b/extensions/qa-lab/src/scenario-catalog.test.ts
index e700509ca276..329e2eea2228 100644
--- a/extensions/qa-lab/src/scenario-catalog.test.ts
+++ b/extensions/qa-lab/src/scenario-catalog.test.ts
@@ -59,7 +59,13 @@ function flowContainsCall(value: unknown, callName: string): boolean {
 }
 
 describe("qa scenario catalog", () => {
-  const dottedCoverageIdPattern = /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+$/;
+  const twoPartCoverageIdPattern = /^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/;
+  const agentRuntime = "agent-runtime";
+  const browserUi = "control-ui";
+  const cli = "cli";
+  const codex = "openai";
+  const memory = "session-memory";
+  const otel = "observability";
 
   it("keeps repo-backed scenarios YAML-only", () => {
     expect(listScenarioMarkdownPaths()).toStrictEqual([]);
@@ -113,14 +119,15 @@ describe("qa scenario catalog", () => {
       pack.scenarios.every(
         (scenario) =>
           (scenario.coverage?.primary ?? []).every((coverageId) =>
-            dottedCoverageIdPattern.test(coverageId),
+            twoPartCoverageIdPattern.test(coverageId),
           ) &&
           (scenario.coverage?.secondary ?? []).every((coverageId) =>
-            dottedCoverageIdPattern.test(coverageId),
+            twoPartCoverageIdPattern.test(coverageId),
           ),
       ),
     ).toBe(true);
-    expect(readQaScenarioById("memory-recall").coverage?.primary).toContain("memory.recall");
+    const recall = readQaScenarioById("memory-recall");
+    expect(recall.coverage?.primary).toContain(`${memory}.memory-recall`);
   });
 
   it("exposes bootstrap data from the YAML pack", () => {
@@ -241,7 +248,7 @@ describe("qa scenario catalog", () => {
       "sends a chat turn through the GUI and renders the final Gateway event",
     );
     expect(scenario.execution.flow).toBeUndefined();
-    expect(scenario.coverage?.primary).toContain("ui.control");
+    expect(scenario.coverage?.primary).toContain(`${browserUi}.gateway-hosted-ui-control`);
     expect(otelSmoke.execution.kind).toBe("script");
     if (otelSmoke.execution.kind !== "script") {
       throw new Error(`expected script scenario, got ${otelSmoke.execution.kind}`);
@@ -252,24 +259,24 @@ describe("qa scenario catalog", () => {
       "--logs-exporter",
       "both",
     ]);
-    expect(otelSmoke.coverage?.secondary).not.toContain("harness.qa-lab");
+    expect(otelSmoke.coverage?.secondary).not.toContain(`${otel}.otlp-http-traces-qa-lab`);
   });
 
   it("loads helper-backed HTTP API scenarios as supporting taxonomy coverage", () => {
     expect(readQaScenarioById("openai-compatible-chat-tools").coverage?.secondary).toStrictEqual([
       "gateway.openai-compatible-apis",
-      "runtime.hosted-tool-use",
+      `${agentRuntime}.hosted-tool-use`,
     ]);
     expect(readQaScenarioById("openai-web-search-minimal").coverage?.secondary).toEqual(
       expect.arrayContaining([
-        "runtime.reasoning-and-cache-controls",
+        `${agentRuntime}.reasoning-and-cache-controls`,
         "web-search.openai-native-web-search",
         "plugins.web-search-and-fetch",
       ]),
     );
-    expect(readQaScenarioById("openwebui-openai-compatible").coverage?.secondary).toEqual(
-      expect.arrayContaining(["gateway.openai-compatible-apis", "runtime.hosted-provider-turns"]),
-    );
+    const webuiCoverage = readQaScenarioById("openwebui-openai-compatible").coverage?.secondary;
+    expect(webuiCoverage).toContain("gateway.openai-compatible-apis");
+    expect(webuiCoverage).toContain(`${agentRuntime}.hosted-provider-turns`);
   });
 
   it("routes Docker runtime scenarios through the shared lane adapter", () => {
@@ -509,10 +516,13 @@ describe("qa scenario catalog", () => {
           searchQuery?: string;
         }
       | undefined;
+    const claims = scenario.coverage;
 
-    expect(scenario.sourcePath).toBe("qa/scenarios/runtime/qa-bus-tool-trace-visibility.yaml");
-    expect(scenario.coverage?.primary).toContain("harness.tool-trace-visibility");
-    expect(scenario.coverage?.secondary ?? []).toStrictEqual(["runtime.qa-bus", "tools.trace"]);
+    expect(claims?.primary).toContain(`${otel}.telemetry-tool-trace-visibility`);
+    expect(claims?.secondary ?? []).toStrictEqual([
+      `${otel}.telemetry-qa-bus`,
+      `${otel}.telemetry-trace`,
+    ]);
     expect(config?.expectedToolName).toBe("exec");
     expect(config?.expectedRedaction).toBe("[redacted]");
     expect(config?.searchQuery).toBe("exec");
@@ -524,9 +534,8 @@ describe("qa scenario catalog", () => {
   it("loads the opt-in update.run package self-upgrade script proof", () => {
     const scenario = readQaScenarioById("update-run-package-self-upgrade");
 
-    expect(scenario.sourcePath).toBe("qa/scenarios/runtime/update-run-package-self-upgrade.yaml");
-    expect(scenario.coverage?.primary).toContain("runtime.update-run");
-    expect(scenario.coverage?.secondary).toContain("runtime.package-update");
+    expect(scenario.coverage?.primary).toEqual([`${cli}.update-status-and-rpc`]);
+    expect(scenario.coverage?.secondary).toEqual([`${cli}.managed-gateway-restart`]);
     expect(scenario.execution.kind).toBe("script");
     if (scenario.execution.kind !== "script") {
       throw new Error(`expected script execution, got ${scenario.execution.kind}`);
@@ -582,7 +591,7 @@ describe("qa scenario catalog", () => {
   it("loads Codex plugin lifecycle scenarios into the standard runtime tier", () => {
     const coldInstall = readQaScenarioById("codex-plugin-cold-install");
     expect(coldInstall.runtimeParityTier).toBe("standard");
-    expect(coldInstall.coverage?.primary).toContain("runtime.codex-plugin.lifecycle");
+    expect(coldInstall.coverage?.primary).toEqual(["plugins.lifecycle-hot-install"]);
     expect(coldInstall.coverage?.secondary).toBeUndefined();
     expect(coldInstall.execution.kind).toBe("script");
 
@@ -610,8 +619,8 @@ describe("qa scenario catalog", () => {
       kind: "vitest",
       path: "test/e2e/qa-lab/runtime/codex-auth-doctor-migration-product-proof.e2e.test.ts",
     });
-    expect(scenario.coverage?.primary).toContain("runtime.doctor-repair");
-    expect(scenario.coverage?.secondary).toContain("runtime.codex-plugin.auth");
+    expect(scenario.coverage?.primary).toEqual([`${codex}.codex-oauth-profiles-doctor-repair`]);
+    expect(scenario.coverage?.secondary).toEqual([`${otel}.doctor-codex-plugin-auth`]);
   });
 
   it("routes the Codex mixed-profile row through the product-backed Vitest", () => {
@@ -623,8 +632,11 @@ describe("qa scenario catalog", () => {
       kind: "vitest",
       path: "test/e2e/qa-lab/runtime/codex-auth-product-proof.e2e.test.ts",
     });
-    expect(scenario.coverage?.primary).toContain("runtime.codex-plugin.auth");
-    expect(scenario.coverage?.secondary).toContain("runtime.doctor-repair");
+    expect(scenario.coverage?.primary).toEqual([`${codex}.codex-oauth-profiles-codex-plugin-auth`]);
+    expect(scenario.coverage?.secondary).toEqual([
+      `${agentRuntime}.auth-profile-selection-provider-selection`,
+      `${codex}.codex-oauth-profiles-doctor-repair`,
+    ]);
   });
 
   it("keeps the character eval scenario natural and task-shaped", () => {
@@ -1040,11 +1052,11 @@ describe("qa scenario catalog", () => {
       | undefined;
     const flow = JSON.stringify(scenario.execution.flow);
 
-    expect(scenario.sourcePath).toBe("qa/scenarios/memory/dreaming-shadow-trial-report.yaml");
-    expect(scenario.coverage?.primary).toContain("memory.dreaming");
-    expect(config?.prompt).toContain("Dreaming shadow trial report check");
-    expect(config?.reportName).toBe("dreaming-shadow-trial-report.md");
-    expect(config?.seededMemory).toBe("# Memory\n\n");
+    expect(scenario.coverage?.primary).toEqual([`${memory}.memory-files-dreaming`]);
+    expect(scenario.coverage?.secondary).toEqual([
+      `${memory}.memory-files-promotion`,
+      `${memory}.memory-files-artifact-safety`,
+    ]);
     expect(config?.expectedReportAll).toContain("verdict: helpful");
     expect(config?.expectedReportAll).toContain("exact verification commands and remaining risk");
     expect(config?.expectedReportAll).toContain("omits the exact command and remaining risk");
@@ -1058,7 +1070,8 @@ describe("qa scenario catalog", () => {
   it("enables Telegram previews for channel streaming evidence", () => {
     const scenario = readQaScenarioById("channel-message-flows");
 
-    expect(scenario.coverage?.primary).toContain("channels.streaming");
+    expect(scenario.coverage?.primary).toEqual([`${agentRuntime}.streaming-replies`]);
+    expect(scenario.coverage?.secondary).toEqual([`${agentRuntime}.streaming-replies-delivery`]);
     expect(scenario.gatewayConfigPatch).toMatchObject({
       channels: { telegram: { streaming: { mode: "partial" } } },
     });
diff --git a/extensions/qa-lab/src/scenario-catalog.ts b/extensions/qa-lab/src/scenario-catalog.ts
index 852c54bc48d4..336e85f78945 100644
--- a/extensions/qa-lab/src/scenario-catalog.ts
+++ b/extensions/qa-lab/src/scenario-catalog.ts
@@ -3,6 +3,7 @@ import path from "node:path";
 import YAML from "yaml";
 import { z } from "zod";
 import { isRepoRootRelativeRef } from "./cli-paths.js";
+import { qaCoverageIdSchema } from "./coverage-id.js";
 import { resolveQaRepoPath, type QaRepoPathKind } from "./repo-path.js";
 import { qaScenarioModuleFlow } from "./scenario-module-flow.js";
 
@@ -121,13 +122,6 @@ const qaScenarioExecutionSchema = z.union([
   qaTestFileScenarioExecutionSchema,
 ]);
 
-const qaCoverageIdSchema = z
-  .string()
-  .trim()
-  .regex(/^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+$/, {
-    message: "coverage ids must use lowercase dotted tokens",
-  });
-
 const qaCoverageIdListSchema = z.array(qaCoverageIdSchema).min(1);
 
 const qaScenarioCoverageSchema = z
diff --git a/extensions/qa-lab/src/scorecard-evidence.test.ts b/extensions/qa-lab/src/scorecard-evidence.test.ts
index 36032d91bcfd..4e2e86773cb0 100644
--- a/extensions/qa-lab/src/scorecard-evidence.test.ts
+++ b/extensions/qa-lab/src/scorecard-evidence.test.ts
@@ -82,14 +82,17 @@ async function buildQaProfileScorecardEvidence(params: {
 }
 
 describe("profile scorecard evidence", () => {
-  it("scores partial multi-id feature coverage by covered coverage IDs", async () => {
+  it("scores atomic feature coverage by its one exact coverage ID", async () => {
     const category: QaScorecardCategoryCoverageReport = {
       id: "surface.category",
       taxonomySurfaceId: "surface",
       taxonomyCategoryName: "Category",
       inventoryStatus: "partial",
       profiles: ["release"],
-      features: [{ name: "Multi-id feature", coverageIds: ["coverage.one", "coverage.two"] }],
+      features: [
+        { name: "Covered feature", coverageIds: ["coverage.one"] },
+        { name: "Missing feature", coverageIds: ["coverage.two"] },
+      ],
       coverageIds: ["coverage.one", "coverage.two"],
       inventoriedCoverageIds: ["coverage.one"],
       inventoryRefs: [],
@@ -117,11 +120,11 @@ describe("profile scorecard evidence", () => {
 
     expect(scorecard.categoryReports[0]?.status).toBe("partial");
     expect(scorecard.categoryReports[0]?.features).toMatchObject({
-      total: 1,
-      fulfilled: 0,
-      partial: 1,
-      missing: 0,
-      fulfillmentPercent: 0,
+      total: 2,
+      fulfilled: 1,
+      partial: 0,
+      missing: 1,
+      fulfillmentPercent: 50,
     });
     expect(scorecard.categoryReports[0]?.coverageIds).toMatchObject({
       total: 2,
@@ -137,11 +140,11 @@ describe("profile scorecard evidence", () => {
       fulfillmentPercent: 50,
     });
     expect(scorecard.features).toMatchObject({
-      total: 1,
-      fulfilled: 0,
-      partial: 1,
-      missing: 0,
-      fulfillmentPercent: 0,
+      total: 2,
+      fulfilled: 1,
+      partial: 0,
+      missing: 1,
+      fulfillmentPercent: 50,
     });
   });
 
diff --git a/extensions/qa-lab/src/scorecard-taxonomy.ts b/extensions/qa-lab/src/scorecard-taxonomy.ts
index 5ae593231be7..6d27e6410a24 100644
--- a/extensions/qa-lab/src/scorecard-taxonomy.ts
+++ b/extensions/qa-lab/src/scorecard-taxonomy.ts
@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { z } from "zod";
+import { qaCoverageIdSchema } from "./coverage-id.js";
 import { resolveQaRepoPath, type QaRepoPathKind } from "./repo-path.js";
 import type { QaSeedScenarioWithSource } from "./scenario-catalog.js";
 
@@ -25,13 +26,6 @@ const qaScorecardIdSchema = z
     message: "scorecard ids must use lowercase dotted or dashed tokens",
   });
 
-const qaCoverageIdSchema = z
-  .string()
-  .trim()
-  .regex(/^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+$/, {
-    message: "coverage ids must use lowercase dotted tokens",
-  });
-
 function isRepoRootRelativeRef(value: string) {
   return !path.isAbsolute(value) && value.split(/[\\/]+/u).every((part) => part !== "..");
 }
@@ -156,7 +150,9 @@ const qaMaturityScoresSchema = z.strictObject({
 
 const qaMaturityFeatureSchema = z.object({
   name: z.string().trim().min(1),
-  coverageIds: z.array(qaCoverageIdSchema).default([]),
+  coverageIds: z
+    .array(qaCoverageIdSchema)
+    .length(1, { message: "taxonomy features must define exactly one coverage ID" }),
   description: z.string().trim().min(1).optional(),
 });
 
@@ -255,6 +251,7 @@ const qaMaturityTaxonomySchema = z
     }
 
     const categoryIds = new Set<string>();
+    const coverageIdOwners = new Map<string, { key: string; label: string }>();
     const surfaceIds = new Set<string>();
     for (const [surfaceIndex, surface] of taxonomy.surfaces.entries()) {
       if (surfaceIds.has(surface.id)) {
@@ -277,6 +274,50 @@ const qaMaturityTaxonomySchema = z
         }
         localCategoryIds.add(category.id);
         categoryIds.add(`${surface.id}.${category.id}`);
+
+        for (const [featureIndex, feature] of category.features.entries()) {
+          const featureOwner = {
+            key: `${surfaceIndex}.${categoryIndex}.${featureIndex}`,
+            label: `${surface.id}.${category.id} feature ${feature.name}`,
+          };
+          for (const [coverageIdIndex, coverageId] of feature.coverageIds.entries()) {
+            if (!coverageId.startsWith(`${surface.id}.`)) {
+              ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [
+                  "surfaces",
+                  surfaceIndex,
+                  "categories",
+                  categoryIndex,
+                  "features",
+                  featureIndex,
+                  "coverageIds",
+                  coverageIdIndex,
+                ],
+                message: `coverage ID ${coverageId} must belong to surface ${surface.id}`,
+              });
+            }
+            const existingOwner = coverageIdOwners.get(coverageId);
+            if (existingOwner && existingOwner.key !== featureOwner.key) {
+              ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [
+                  "surfaces",
+                  surfaceIndex,
+                  "categories",
+                  categoryIndex,
+                  "features",
+                  featureIndex,
+                  "coverageIds",
+                  coverageIdIndex,
+                ],
+                message: `coverage ID ${coverageId} already belongs to ${existingOwner.label}; coverage IDs must identify exactly one taxonomy feature`,
+              });
+              continue;
+            }
+            coverageIdOwners.set(coverageId, featureOwner);
+          }
+        }
       }
     }
 
diff --git a/extensions/qa-lab/src/test-file-scenario-runner.test.ts b/extensions/qa-lab/src/test-file-scenario-runner.test.ts
index a41b7be1f458..e5129a0b6ff4 100644
--- a/extensions/qa-lab/src/test-file-scenario-runner.test.ts
+++ b/extensions/qa-lab/src/test-file-scenario-runner.test.ts
@@ -60,10 +60,7 @@ function makeTestFileScenario(
     id: `scenario-${executionKind}`,
     title: `${executionKind} scenario`,
     surface: executionKind === "playwright" ? "control-ui" : "qa-lab",
-    category:
-      executionKind === "playwright"
-        ? "browser-control-ui-and-webchat.browser-ui"
-        : "qa-lab.coverage",
+    category: executionKind === "playwright" ? "control-ui.browser-ui" : "qa-lab.coverage",
     coverage: {
       primary: [executionKind === "playwright" ? "ui.control" : "qa.coverage"],
       secondary: [executionKind === "playwright" ? "ui.streaming" : "qa.reporting"],
@@ -448,9 +445,13 @@ describe("qa test file scenario runner", () => {
       },
       coverage: [
         {
-          id: "ui.control",
+          id: "qa.coverage",
           role: "primary",
         },
+        {
+          id: "qa.reporting",
+          role: "secondary",
+        },
       ],
       execution: {
         runner: "evidence-producer-script",
@@ -742,6 +743,10 @@ describe("qa test file scenario runner", () => {
         kind: "script-producer-check",
         id: "script-producer.web-ui.smoke",
       },
+      coverage: [
+        { id: "qa.coverage", role: "primary" },
+        { id: "qa.reporting", role: "secondary" },
+      ],
       result: {
         status: "fail",
         failure: {
diff --git a/extensions/qa-lab/src/test-file-scenario-runner.ts b/extensions/qa-lab/src/test-file-scenario-runner.ts
index 343609be2d69..9af37b1a4871 100644
--- a/extensions/qa-lab/src/test-file-scenario-runner.ts
+++ b/extensions/qa-lab/src/test-file-scenario-runner.ts
@@ -192,6 +192,20 @@ function buildScenarioEvidenceTarget(scenario: QaTestFileScenario) {
   };
 }
 
+function coverageForScenario(scenario: QaTestFileScenario) {
+  return [
+    ...(scenario.coverage?.primary ?? []).map((id) => ({ id, role: "primary" as const })),
+    ...(scenario.coverage?.secondary ?? []).map((id) => ({ id, role: "secondary" as const })),
+  ];
+}
+
+function withScenarioCoverage(
+  entry: QaEvidenceSummaryJson["entries"][number],
+  scenario: QaTestFileScenario,
+) {
+  return { ...entry, coverage: coverageForScenario(scenario) };
+}
+
 async function runScenarioCommandSteps(params: {
   commandTimeoutMs: number;
   env: NodeJS.ProcessEnv;
@@ -341,8 +355,12 @@ function buildTestFileEvidence(params: {
   evidenceMode?: QaScorecardEvidenceMode;
   env?: NodeJS.ProcessEnv;
 }) {
-  const producerEntries = params.results.flatMap(
-    (result) => result.producerEvidence?.entries ?? [],
+  const producerEntries = params.results.flatMap((result) =>
+    // Producer artifacts own execution facts; the scenario catalog remains the
+    // sole owner of which semantic features those facts cover.
+    (result.producerEvidence?.entries ?? []).map((entry) =>
+      withScenarioCoverage(entry, result.scenario),
+    ),
   );
   if (producerEntries.length > 0) {
     const definition = testFileRunnerDefinitions[params.kind];
diff --git a/extensions/qa-lab/src/tool-coverage-report.test.ts b/extensions/qa-lab/src/tool-coverage-report.test.ts
index c9eb35c6e6a6..381b0da72f5d 100644
--- a/extensions/qa-lab/src/tool-coverage-report.test.ts
+++ b/extensions/qa-lab/src/tool-coverage-report.test.ts
@@ -6,8 +6,7 @@ import {
   renderQaToolCoverageMarkdownReport,
 } from "./tool-coverage-report.js";
 
-const TEST_TOOL_COVERAGE_ID =
-  "agent-runtime-and-provider-execution.tool-calls-and-response-handling.tool-call-handling";
+const TEST_TOOL_COVERAGE_ID = "agents.tool-call-handling";
 
 function makeScenario(
   id: string,
diff --git a/qa/maturity-scores.yaml b/qa/maturity-scores.yaml
index ed882e0e415f..7e2bf45c67f9 100644
--- a/qa/maturity-scores.yaml
+++ b/qa/maturity-scores.yaml
@@ -19,7 +19,7 @@ rollups:
       score: 72
       label: Beta
 surfaces:
-  - id: gateway-runtime
+  - id: gateway
     name: Gateway runtime
     family: core
     level:
@@ -187,7 +187,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: cli-install-update-onboard-doctor
+  - id: cli
     name: CLI
     family: core
     level:
@@ -289,7 +289,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: plugin-sdk-and-bundled-plugin-architecture
+  - id: plugins
     name: Plugins
     family: core
     level:
@@ -413,7 +413,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: agent-runtime-and-provider-execution
+  - id: agent-runtime
     name: Agent Runtime
     family: core
     level:
@@ -537,7 +537,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: session-memory-and-context-engine
+  - id: session-memory
     name: Session, memory, and context engine
     family: core
     level:
@@ -661,7 +661,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: channel-framework
+  - id: channels
     name: Channel framework
     family: core
     level:
@@ -774,7 +774,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: security-auth-pairing-and-secrets
+  - id: security
     name: Security, auth, pairing, and secrets
     family: core
     level:
@@ -865,7 +865,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: telemetry-diagnostics-and-observability
+  - id: observability
     name: Observability
     family: core
     level:
@@ -945,7 +945,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: automation-cron-hooks-tasks-polling
+  - id: automation
     name: "Automation: cron, hooks, tasks, polling"
     family: core
     level:
@@ -1036,7 +1036,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: media-understanding-and-media-generation
+  - id: media
     name: Media understanding and media generation
     family: core
     level:
@@ -1127,7 +1127,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: voice-and-realtime-talk
+  - id: voice
     name: Voice and realtime talk
     family: core
     level:
@@ -1218,7 +1218,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: browser-control-ui-and-webchat
+  - id: control-ui
     name: Gateway Web App
     family: core
     level:
@@ -1309,7 +1309,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: tui-and-terminal-ux
+  - id: tui
     name: TUI
     family: core
     level:
@@ -1389,7 +1389,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: clawhub-and-external-plugin-distribution
+  - id: clawhub
     name: ClawHub
     family: core
     level:
@@ -1458,7 +1458,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: openclaw-app-sdk
+  - id: app-sdk
     name: OpenClaw App SDK
     family: core
     level:
@@ -1549,7 +1549,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: macos-gateway-host
+  - id: macos-host
     name: macOS Gateway host
     family: platform-app
     level:
@@ -1651,7 +1651,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: macos-companion-app
+  - id: macos-app
     name: macOS companion app
     family: platform-app
     level:
@@ -1764,7 +1764,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: linux-gateway-host
+  - id: linux-host
     name: Linux Gateway host
     family: platform-app
     level:
@@ -1844,7 +1844,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: linux-companion-app
+  - id: linux-app
     name: Linux companion app
     family: platform-app
     level:
@@ -1924,7 +1924,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: windows-via-wsl2
+  - id: wsl
     name: Windows via WSL2
     family: platform-app
     level:
@@ -2015,7 +2015,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: native-windows-cli-and-gateway
+  - id: windows
     name: Native Windows
     family: platform-app
     level:
@@ -2084,7 +2084,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: native-windows-companion-app
+  - id: windows-app
     name: Native Windows companion app
     family: platform-app
     level:
@@ -2164,7 +2164,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: android-app
+  - id: android
     name: Android app
     family: platform-app
     level:
@@ -2266,7 +2266,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: ios-app
+  - id: ios
     name: iOS app
     family: platform-app
     level:
@@ -2379,7 +2379,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: watchos-companion-surfaces
+  - id: watchos
     name: watchOS companion surfaces
     family: platform-app
     level:
@@ -2459,7 +2459,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: raspberry-pi-small-linux-devices
+  - id: small-linux
     name: Raspberry Pi and small Linux devices
     family: platform-app
     level:
@@ -2528,7 +2528,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: docker-podman-hosting
+  - id: containers
     name: Docker and Podman hosting
     family: platform-app
     level:
@@ -2597,7 +2597,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: kubernetes-hosting
+  - id: kubernetes
     name: Kubernetes hosting
     family: platform-app
     level:
@@ -2666,7 +2666,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: nix-install-path
+  - id: nix
     name: Nix install path
     family: platform-app
     level:
@@ -3488,7 +3488,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: mattermost-line-irc-nextcloud-talk-nostr-twitch-tlon-synology-chat
+  - id: community-channels
     name: Mattermost, LINE, IRC, Nextcloud Talk, Nostr, Twitch, Tlon, Synology Chat
     family: channel
     level:
@@ -3557,7 +3557,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: feishu-qq-bot-wechat-yuanbao-zalo-zalo-personal-regional-channels
+  - id: regional-channels
     name: Feishu, QQ Bot, WeChat, Yuanbao, Zalo, Zalo Personal, regional channels
     family: channel
     level:
@@ -3626,7 +3626,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: voice-call-channel
+  - id: voice-call
     name: Voice Call channel
     family: channel
     level:
@@ -3706,7 +3706,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: openai-codex-provider-path
+  - id: openai
     name: OpenAI and Codex provider path
     family: provider-tool
     level:
@@ -3786,7 +3786,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: anthropic-provider-path
+  - id: anthropic
     name: Anthropic provider path
     family: provider-tool
     level:
@@ -3866,7 +3866,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: google-provider-path
+  - id: google-ai
     name: Google provider path
     family: provider-tool
     level:
@@ -3946,7 +3946,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: openrouter-provider-path
+  - id: openrouter
     name: OpenRouter provider path
     family: provider-tool
     level:
@@ -4015,7 +4015,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: local-model-providers-ollama-vllm-sglang-lm-studio
+  - id: local-models
     name: "Local model providers: Ollama, vLLM, SGLang, LM Studio"
     family: provider-tool
     level:
@@ -4095,7 +4095,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: long-tail-hosted-providers
+  - id: hosted-providers
     name: Long-tail hosted providers
     family: provider-tool
     level:
@@ -4153,7 +4153,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: web-search-tools
+  - id: web-search
     name: Web search tools
     family: provider-tool
     level:
@@ -4222,7 +4222,7 @@ surfaces:
           supported: false
           reason: none
           human_override: false
-  - id: browser-automation-and-exec-sandbox-tools
+  - id: tools
     name: Browser automation, exec, and sandbox tools
     family: provider-tool
     level:
@@ -4280,7 +4280,7 @@ surfaces:
           supported: true
           reason: human_override
           human_override: true
-  - id: image-video-music-generation-tools
+  - id: media-generation
     name: Image, video, and music generation tools
     family: provider-tool
     level:
diff --git a/qa/scenarios/agents/instruction-followthrough-repo-contract.yaml b/qa/scenarios/agents/instruction-followthrough-repo-contract.yaml
index d1b49fbebb37..12c672fe6352 100644
--- a/qa/scenarios/agents/instruction-followthrough-repo-contract.yaml
+++ b/qa/scenarios/agents/instruction-followthrough-repo-contract.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: repo-contract
   coverage:
     primary:
-      - agents.instructions
+      - session-memory.instruction-profile-instructions
     secondary:
-      - runtime.first-action
+      - session-memory.instruction-profile-first-action
   objective: Verify the agent reads repo instruction files first, follows the required tool order, and completes the first feasible action instead of stopping at a plan.
   successCriteria:
     - Agent reads the seeded instruction files before writing the requested artifact.
diff --git a/qa/scenarios/agents/issue-109025-completion-policy-live.yaml b/qa/scenarios/agents/issue-109025-completion-policy-live.yaml
index c20be3c3a04d..06368388f863 100644
--- a/qa/scenarios/agents/issue-109025-completion-policy-live.yaml
+++ b/qa/scenarios/agents/issue-109025-completion-policy-live.yaml
@@ -5,10 +5,11 @@ scenario:
   surface: subagents
   runtimeParityTier: live-only
   coverage:
+    primary:
+      - agent-runtime.delegated-tool-access
     secondary:
-      - agents.subagents
-      - runtime.delivery
-      - channels.qa-channel
+      - agent-runtime.subagent-turns-subagents
+      - agent-runtime.subagent-turns-delivery
   gatewayConfigPatch:
     tools:
       toolsBySender:
diff --git a/qa/scenarios/agents/issue-109025-sender-policy-live.yaml b/qa/scenarios/agents/issue-109025-sender-policy-live.yaml
index 4c354206d17c..be2e0dca1df5 100644
--- a/qa/scenarios/agents/issue-109025-sender-policy-live.yaml
+++ b/qa/scenarios/agents/issue-109025-sender-policy-live.yaml
@@ -5,9 +5,11 @@ scenario:
   surface: subagents
   runtimeParityTier: live-only
   coverage:
+    primary:
+      - agent-runtime.delegated-tool-access
     secondary:
-      - agents.subagents
-      - tools.fs.read
+      - agent-runtime.subagent-turns-subagents
+      - agent-runtime.tool-fs-read
   gatewayConfigPatch:
     tools:
       toolsBySender:
diff --git a/qa/scenarios/agents/subagent-completion-direct-fallback.yaml b/qa/scenarios/agents/subagent-completion-direct-fallback.yaml
index dc6fafb61c12..5e5ec5933ee5 100644
--- a/qa/scenarios/agents/subagent-completion-direct-fallback.yaml
+++ b/qa/scenarios/agents/subagent-completion-direct-fallback.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: subagents
   coverage:
     primary:
-      - agents.subagents
+      - agent-runtime.subagent-turns-subagents
     secondary:
-      - runtime.delivery
-      - channels.qa-channel
+      - agent-runtime.subagent-turns-delivery
+      - channels.qa-channel-final-reply
   objective: Verify a yielded parent still receives a successful subagent result through direct fallback delivery when the dormant announce turn produces no visible reply.
   successCriteria:
     - Parent launches a native subagent.
diff --git a/qa/scenarios/agents/subagent-fanout-synthesis.yaml b/qa/scenarios/agents/subagent-fanout-synthesis.yaml
index 5204c88cbe32..02e4a213fc07 100644
--- a/qa/scenarios/agents/subagent-fanout-synthesis.yaml
+++ b/qa/scenarios/agents/subagent-fanout-synthesis.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: subagents
   coverage:
     primary:
-      - agents.subagents
+      - agent-runtime.subagent-turns-subagents
     secondary:
-      - agents.synthesis
+      - agent-runtime.subagent-turns-synthesis
   objective: Verify the agent can delegate multiple bounded subagent tasks and fold both results back into one parent reply.
   successCriteria:
     - Parent flow launches at least two bounded subagent tasks.
diff --git a/qa/scenarios/agents/subagent-forked-context.yaml b/qa/scenarios/agents/subagent-forked-context.yaml
index 162415c136c7..264bcaf55071 100644
--- a/qa/scenarios/agents/subagent-forked-context.yaml
+++ b/qa/scenarios/agents/subagent-forked-context.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: subagents
   coverage:
     primary:
-      - agents.subagents
+      - agent-runtime.subagent-turns-subagents
   objective: Verify the agent can choose forked subagent context when the child needs the current transcript.
   successCriteria:
     - Agent launches a native subagent with context=fork.
diff --git a/qa/scenarios/agents/subagent-handoff.yaml b/qa/scenarios/agents/subagent-handoff.yaml
index 61211646a4f7..032749e020c0 100644
--- a/qa/scenarios/agents/subagent-handoff.yaml
+++ b/qa/scenarios/agents/subagent-handoff.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: subagents
   coverage:
     primary:
-      - agents.subagents
+      - agent-runtime.subagent-turns-subagents
   objective: Verify the agent can delegate a bounded task to a subagent and fold the result back into the main thread.
   successCriteria:
     - Agent launches a bounded subagent task.
diff --git a/qa/scenarios/agents/subagent-stale-child-links.yaml b/qa/scenarios/agents/subagent-stale-child-links.yaml
index f0c9eb32c9a4..b479db8c49d1 100644
--- a/qa/scenarios/agents/subagent-stale-child-links.yaml
+++ b/qa/scenarios/agents/subagent-stale-child-links.yaml
@@ -5,9 +5,10 @@ scenario:
   surface: subagents
   coverage:
     primary:
-      - agents.subagents
+      - gateway.session-apis-subagents
+      - agent-runtime.subagent-turns-subagents
     secondary:
-      - gateway.sessions-list
+      - gateway.session-apis-sessions-list
   objective: Verify restarted gateways hide stale persisted subagent child links without hiding live or fresh children.
   successCriteria:
     - Old ended subagent run records are not exposed as current children.
diff --git a/qa/scenarios/channels/a2a-message-tool-mirror-dedupe.yaml b/qa/scenarios/channels/a2a-message-tool-mirror-dedupe.yaml
index 22ad37bbf542..3bebc2897081 100644
--- a/qa/scenarios/channels/a2a-message-tool-mirror-dedupe.yaml
+++ b/qa/scenarios/channels/a2a-message-tool-mirror-dedupe.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - runtime.delivery
+      - agent-runtime.subagent-turns-delivery
     secondary:
-      - channels.qa-channel
-      - tools.message
+      - agent-runtime.subagent-turns-qa-channel
+      - channels.message-final-reply
   objective: Verify a sessions_send A2A turn whose nested target run replies through message(action=send) delivers once to the requester channel and does not re-announce the delivery-mirror transcript row.
   gatewayConfigPatch:
     messages:
diff --git a/qa/scenarios/channels/channel-canary.yaml b/qa/scenarios/channels/channel-canary.yaml
index 0ffeaca8b9f3..3af6e6f0812c 100644
--- a/qa/scenarios/channels/channel-canary.yaml
+++ b/qa/scenarios/channels/channel-canary.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-messages
+      - channels.mention-required-group-visible-replies
     secondary:
-      - channels.qa-channel
-      - runtime.delivery
+      - channels.qa-channel-final-reply
+      - channels.automatic-final-reply
   objective: Verify the selected channel transport can deliver one mention-triggered group reply through the canonical QA host.
   successCriteria:
     - One mentioned group message produces one visible reply containing the exact marker.
diff --git a/qa/scenarios/channels/channel-chat-baseline.yaml b/qa/scenarios/channels/channel-chat-baseline.yaml
index bc66ef3e8cdf..de113fc9c2ee 100644
--- a/qa/scenarios/channels/channel-chat-baseline.yaml
+++ b/qa/scenarios/channels/channel-chat-baseline.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.group-messages
+      - channels.mention-gating
     secondary:
-      - channels.qa-channel
+      - channels.mention-required-qa-channel
   objective: Verify the QA agent can respond correctly in a shared channel and respect mention-driven group semantics.
   successCriteria:
     - Agent replies in the shared channel transcript.
diff --git a/qa/scenarios/channels/channel-dm-group-routing.yaml b/qa/scenarios/channels/channel-dm-group-routing.yaml
index 77daec347671..6978a85ad559 100644
--- a/qa/scenarios/channels/channel-dm-group-routing.yaml
+++ b/qa/scenarios/channels/channel-dm-group-routing.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.dm
-      - channels.group-messages
+      - channels.inbound-routing-dm
+      - channels.runtime-conversation-routing
     secondary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify direct and group replies stay on their originating conversation routes.
   successCriteria:
     - A direct message receives its marker only on the direct conversation.
diff --git a/qa/scenarios/channels/channel-mention-gating.yaml b/qa/scenarios/channels/channel-mention-gating.yaml
index 1ec8a5cea6e7..664397369397 100644
--- a/qa/scenarios/channels/channel-mention-gating.yaml
+++ b/qa/scenarios/channels/channel-mention-gating.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-messages
+      - channels.mention-gating
     secondary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify required-mention group traffic stays quiet until the bot is explicitly mentioned.
   successCriteria:
     - Unmentioned group traffic produces no outbound reply.
diff --git a/qa/scenarios/channels/channel-message-flows.yaml b/qa/scenarios/channels/channel-message-flows.yaml
index 40e2b21525f2..5a1e1755b642 100644
--- a/qa/scenarios/channels/channel-message-flows.yaml
+++ b/qa/scenarios/channels/channel-message-flows.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - agent-runtime.streaming-replies
     secondary:
-      - runtime.delivery
+      - agent-runtime.streaming-replies-delivery
   objective: Verify streaming channel replies produce visible previews that resolve to one final answer.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/channel-multi-actor-ordering.yaml b/qa/scenarios/channels/channel-multi-actor-ordering.yaml
index 7d4d62bb7532..1be3e5a8460d 100644
--- a/qa/scenarios/channels/channel-multi-actor-ordering.yaml
+++ b/qa/scenarios/channels/channel-multi-actor-ordering.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - runtime.turn-ordering
+      - agent-runtime.session-turn-ordering
     secondary:
-      - channels.group-messages
+      - channels.room-allowlist
   objective: Verify blocked secondary-actor traffic does not poison a later allowlisted driver turn.
   successCriteria:
     - The observer turn remains unanswered.
diff --git a/qa/scenarios/channels/channel-secondary-conversation-isolation.yaml b/qa/scenarios/channels/channel-secondary-conversation-isolation.yaml
index ed4a3c54cfcd..9a5dfc4e7981 100644
--- a/qa/scenarios/channels/channel-secondary-conversation-isolation.yaml
+++ b/qa/scenarios/channels/channel-secondary-conversation-isolation.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-messages
+      - channels.room-session-group-messages
     secondary:
-      - runtime.turn-ordering
+      - agent-runtime.session-turn-ordering
   objective: Verify a reply in a secondary conversation stays isolated from the primary conversation.
   successCriteria:
     - The primary conversation receives only its marker.
diff --git a/qa/scenarios/channels/channel-sender-allowlist.yaml b/qa/scenarios/channels/channel-sender-allowlist.yaml
index c5cbd56a565a..e26ad3e80ff1 100644
--- a/qa/scenarios/channels/channel-sender-allowlist.yaml
+++ b/qa/scenarios/channels/channel-sender-allowlist.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-messages
+      - channels.room-allowlist
     secondary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify a blocked secondary actor stays quiet while the configured driver override still triggers a reply.
   successCriteria:
     - A mentioned message from the observer actor produces no reply.
diff --git a/qa/scenarios/channels/channel-top-level-reply-shape.yaml b/qa/scenarios/channels/channel-top-level-reply-shape.yaml
index 8b97d46b1371..e702a9105728 100644
--- a/qa/scenarios/channels/channel-top-level-reply-shape.yaml
+++ b/qa/scenarios/channels/channel-top-level-reply-shape.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-visible-replies
+      - channels.group-final-reply
     secondary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify a top-level group prompt produces a top-level reply without thread or quote relation metadata.
   successCriteria:
     - The reply contains the exact marker.
diff --git a/qa/scenarios/channels/discord-canary.yaml b/qa/scenarios/channels/discord-canary.yaml
index 973e92a61ecd..e915143a8f47 100644
--- a/qa/scenarios/channels/discord-canary.yaml
+++ b/qa/scenarios/channels/discord-canary.yaml
@@ -3,7 +3,8 @@ scenario:
   id: discord-canary
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - discord.configured-and-runtime-routing
   execution:
     profiles: { "discord:adapter": 0, "discord:default": 0 }
     kind: flow
diff --git a/qa/scenarios/channels/discord-mention-gating.yaml b/qa/scenarios/channels/discord-mention-gating.yaml
index 0296ea757182..edee3823f95b 100644
--- a/qa/scenarios/channels/discord-mention-gating.yaml
+++ b/qa/scenarios/channels/discord-mention-gating.yaml
@@ -3,7 +3,8 @@ scenario:
   id: discord-mention-gating
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - discord.mention-gating
   execution:
     profiles: { "discord:adapter": 1, "discord:default": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/discord-status-reactions-tool-only.yaml b/qa/scenarios/channels/discord-status-reactions-tool-only.yaml
index a4832f061947..3747b21c3e23 100644
--- a/qa/scenarios/channels/discord-status-reactions-tool-only.yaml
+++ b/qa/scenarios/channels/discord-status-reactions-tool-only.yaml
@@ -3,7 +3,8 @@ scenario:
   id: discord-status-reactions-tool-only
   surface: channels
   coverage:
-    primary: [channels.message-actions]
+    primary:
+      - channels.reply-message-actions
   execution:
     kind: flow
     channel: discord
diff --git a/qa/scenarios/channels/discord-thread-reply-filepath-attachment.yaml b/qa/scenarios/channels/discord-thread-reply-filepath-attachment.yaml
index 34b25fe92eb6..fec7fc23d535 100644
--- a/qa/scenarios/channels/discord-thread-reply-filepath-attachment.yaml
+++ b/qa/scenarios/channels/discord-thread-reply-filepath-attachment.yaml
@@ -3,7 +3,8 @@ scenario:
   id: discord-thread-reply-filepath-attachment
   surface: channels
   coverage:
-    primary: [channels.media-rich-content]
+    primary:
+      - discord.media-and-rich-content
   execution:
     kind: flow
     channel: discord
diff --git a/qa/scenarios/channels/dm-chat-baseline.yaml b/qa/scenarios/channels/dm-chat-baseline.yaml
index bd57e642d643..799390f3152a 100644
--- a/qa/scenarios/channels/dm-chat-baseline.yaml
+++ b/qa/scenarios/channels/dm-chat-baseline.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: dm
   coverage:
     primary:
-      - channels.dm
+      - channels.inbound-routing-dm
     secondary:
-      - channels.qa-channel
+      - channels.inbound-routing-qa-channel
   objective: Verify the QA agent can chat coherently in a DM, explain the QA setup, and stay in character.
   successCriteria:
     - Agent replies in DM without channel routing mistakes.
diff --git a/qa/scenarios/channels/dm-per-room-session.yaml b/qa/scenarios/channels/dm-per-room-session.yaml
index 0d87ed27e9df..bdf9ed1805ff 100644
--- a/qa/scenarios/channels/dm-per-room-session.yaml
+++ b/qa/scenarios/channels/dm-per-room-session.yaml
@@ -5,8 +5,8 @@ scenario:
   surface: dm
   coverage:
     primary:
-      - channels.dm
-      - memory.session-key-construction
+      - matrix.sender-bound-dm-routing
+      - channels.session-key-construction
   objective: Verify Matrix dm.sessionScope=per-room isolates two DM rooms and suppresses the shared-session notice.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/dm-shared-session.yaml b/qa/scenarios/channels/dm-shared-session.yaml
index 25a7a88262e0..19c707138899 100644
--- a/qa/scenarios/channels/dm-shared-session.yaml
+++ b/qa/scenarios/channels/dm-shared-session.yaml
@@ -5,8 +5,8 @@ scenario:
   surface: dm
   coverage:
     primary:
-      - channels.dm
-      - memory.session-key-construction
+      - matrix.sender-bound-dm-routing
+      - channels.session-key-construction
   objective: Verify the default Matrix per-user DM session emits a cross-room notice when the same sender moves to another DM room.
   successCriteria:
     - Both DM rooms receive top-level marker replies.
diff --git a/qa/scenarios/channels/group-message-tool-unavailable-fallback.yaml b/qa/scenarios/channels/group-message-tool-unavailable-fallback.yaml
index 69e569cea10f..8e35e5e28ade 100644
--- a/qa/scenarios/channels/group-message-tool-unavailable-fallback.yaml
+++ b/qa/scenarios/channels/group-message-tool-unavailable-fallback.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.group-visible-replies
+      - channels.group-final-reply
     secondary:
-      - channels.qa-channel
-      - tools.message
+      - channels.qa-channel-final-reply
+      - channels.message-final-reply
   objective: Reproduce the group-visible-reply bug class where message_tool mode selected tool-only delivery even though group tool policy removed the message tool.
   gatewayConfigPatch:
     messages:
diff --git a/qa/scenarios/channels/group-visible-reply-tool.yaml b/qa/scenarios/channels/group-visible-reply-tool.yaml
index f2cc0dd4d130..ef8861994474 100644
--- a/qa/scenarios/channels/group-visible-reply-tool.yaml
+++ b/qa/scenarios/channels/group-visible-reply-tool.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.group-visible-replies
+      - channels.outbound-group-reply
     secondary:
-      - channels.qa-channel
-      - tools.message
+      - channels.qa-channel-outbound
+      - channels.outbound-message
   objective: Verify a group-sourced QA channel turn replies visibly through message(action=send) in the same room.
   gatewayConfigPatch:
     messages:
diff --git a/qa/scenarios/channels/matrix-allowbots-default-block.yaml b/qa/scenarios/channels/matrix-allowbots-default-block.yaml
index b015b05c9580..7e59f0e6a0f5 100644
--- a/qa/scenarios/channels/matrix-allowbots-default-block.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-default-block.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 36, "matrix:fast": 8, "matrix:transport": 35 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-mentions-dm-unmentioned.yaml b/qa/scenarios/channels/matrix-allowbots-mentions-dm-unmentioned.yaml
index 08a176891895..5b263c1e02a8 100644
--- a/qa/scenarios/channels/matrix-allowbots-mentions-dm-unmentioned.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-mentions-dm-unmentioned.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.dm
+      - matrix.dm-policy
   execution:
     profiles: { "matrix:all": 40, "matrix:transport": 39 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-mentions-mentioned-room.yaml b/qa/scenarios/channels/matrix-allowbots-mentions-mentioned-room.yaml
index fd4fbf29115f..66f2a5c05c9b 100644
--- a/qa/scenarios/channels/matrix-allowbots-mentions-mentioned-room.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-mentions-mentioned-room.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 38, "matrix:fast": 9, "matrix:transport": 37 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-mentions-unmentioned-open-room-block.yaml b/qa/scenarios/channels/matrix-allowbots-mentions-unmentioned-open-room-block.yaml
index 5f792b5e2a75..ab13e81180b0 100644
--- a/qa/scenarios/channels/matrix-allowbots-mentions-unmentioned-open-room-block.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-mentions-unmentioned-open-room-block.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 39, "matrix:transport": 38 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-room-override-blocks-account-true.yaml b/qa/scenarios/channels/matrix-allowbots-room-override-blocks-account-true.yaml
index 8084c26424d3..bba2a9159e06 100644
--- a/qa/scenarios/channels/matrix-allowbots-room-override-blocks-account-true.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-room-override-blocks-account-true.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 41, "matrix:transport": 40 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-room-override-enables-account-off.yaml b/qa/scenarios/channels/matrix-allowbots-room-override-enables-account-off.yaml
index bda4372946d8..a7ccf6ed34aa 100644
--- a/qa/scenarios/channels/matrix-allowbots-room-override-enables-account-off.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-room-override-enables-account-off.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 42, "matrix:transport": 41 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-self-sender-ignored.yaml b/qa/scenarios/channels/matrix-allowbots-self-sender-ignored.yaml
index ea84296bcc19..126a346ad8a3 100644
--- a/qa/scenarios/channels/matrix-allowbots-self-sender-ignored.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-self-sender-ignored.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 43, "matrix:transport": 42 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-allowbots-true-unmentioned-open-room.yaml b/qa/scenarios/channels/matrix-allowbots-true-unmentioned-open-room.yaml
index d418f43e5823..eafbb278f4be 100644
--- a/qa/scenarios/channels/matrix-allowbots-true-unmentioned-open-room.yaml
+++ b/qa/scenarios/channels/matrix-allowbots-true-unmentioned-open-room.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 37, "matrix:transport": 36 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-channel-target-both.yaml b/qa/scenarios/channels/matrix-approval-channel-target-both.yaml
index f9805219c7e1..d0f49b5a8528 100644
--- a/qa/scenarios/channels/matrix-approval-channel-target-both.yaml
+++ b/qa/scenarios/channels/matrix-approval-channel-target-both.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 30, "matrix:transport": 29 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-deny-reaction.yaml b/qa/scenarios/channels/matrix-approval-deny-reaction.yaml
index a6c4584a3e72..c14414abfed1 100644
--- a/qa/scenarios/channels/matrix-approval-deny-reaction.yaml
+++ b/qa/scenarios/channels/matrix-approval-deny-reaction.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 28, "matrix:transport": 27 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-exec-metadata-chunked.yaml b/qa/scenarios/channels/matrix-approval-exec-metadata-chunked.yaml
index 399f2bad4b0d..e20b3a8d9330 100644
--- a/qa/scenarios/channels/matrix-approval-exec-metadata-chunked.yaml
+++ b/qa/scenarios/channels/matrix-approval-exec-metadata-chunked.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 26, "matrix:fast": 6, "matrix:transport": 25 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-exec-metadata-single-event.yaml b/qa/scenarios/channels/matrix-approval-exec-metadata-single-event.yaml
index 521eaa91b4e2..ff718906c8b9 100644
--- a/qa/scenarios/channels/matrix-approval-exec-metadata-single-event.yaml
+++ b/qa/scenarios/channels/matrix-approval-exec-metadata-single-event.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 25, "matrix:fast": 5, "matrix:transport": 24 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-plugin-metadata-single-event.yaml b/qa/scenarios/channels/matrix-approval-plugin-metadata-single-event.yaml
index 79bb79984d2c..be815fb24589 100644
--- a/qa/scenarios/channels/matrix-approval-plugin-metadata-single-event.yaml
+++ b/qa/scenarios/channels/matrix-approval-plugin-metadata-single-event.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 27, "matrix:transport": 26 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-approval-thread-target.yaml b/qa/scenarios/channels/matrix-approval-thread-target.yaml
index 354d011d62c5..3ff873014694 100644
--- a/qa/scenarios/channels/matrix-approval-thread-target.yaml
+++ b/qa/scenarios/channels/matrix-approval-thread-target.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-approval-prompts
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "matrix:all": 29, "matrix:transport": 28 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-attachment-only-ignored.yaml b/qa/scenarios/channels/matrix-attachment-only-ignored.yaml
index 2d1a0a48c7f4..5447bfe49c80 100644
--- a/qa/scenarios/channels/matrix-attachment-only-ignored.yaml
+++ b/qa/scenarios/channels/matrix-attachment-only-ignored.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.mention-gating
+      - matrix.mention-gates
     secondary:
       - channels.inbound-media-normalization
   execution:
diff --git a/qa/scenarios/channels/matrix-dm-thread-reply-override.yaml b/qa/scenarios/channels/matrix-dm-thread-reply-override.yaml
index 02b2b4c6208e..8c95cd2dfac2 100644
--- a/qa/scenarios/channels/matrix-dm-thread-reply-override.yaml
+++ b/qa/scenarios/channels/matrix-dm-thread-reply-override.yaml
@@ -4,9 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
-    secondary:
-      - channels.dm
+      - matrix.matrix-thread-reply-routing
   execution:
     profiles: { "matrix:all": 16, "matrix:transport": 15 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-artifact-redaction.yaml b/qa/scenarios/channels/matrix-e2ee-artifact-redaction.yaml
index 8bc2fec2319d..703dfab3db56 100644
--- a/qa/scenarios/channels/matrix-e2ee-artifact-redaction.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-artifact-redaction.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - security.redaction-artifact-safety
   execution:
     profiles: { "matrix:all": 64, "matrix:e2ee-smoke": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-basic-reply.yaml b/qa/scenarios/channels/matrix-e2ee-basic-reply.yaml
index 7ba44ae5dd02..3b9ca6777adc 100644
--- a/qa/scenarios/channels/matrix-e2ee-basic-reply.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-basic-reply.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 58, "matrix:e2ee-smoke": 0, "matrix:fast": 11 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-bootstrap-success.yaml b/qa/scenarios/channels/matrix-e2ee-bootstrap-success.yaml
index 69fd4da87547..30e1aaf03389 100644
--- a/qa/scenarios/channels/matrix-e2ee-bootstrap-success.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-bootstrap-success.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 60, "matrix:e2ee-smoke": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-account-add-enable-e2ee.yaml b/qa/scenarios/channels/matrix-e2ee-cli-account-add-enable-e2ee.yaml
index 0e0854d850c5..e8c23de08550 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-account-add-enable-e2ee.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-account-add-enable-e2ee.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 84, "matrix:e2ee-cli": 0 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-bootstrap-failure.yaml b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-bootstrap-failure.yaml
index 53e477ca7b4f..6b77bf175797 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-bootstrap-failure.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-bootstrap-failure.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 87, "matrix:e2ee-cli": 3 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-idempotent.yaml b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-idempotent.yaml
index 35f5f097b145..eac3ba7fefd7 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-idempotent.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-idempotent.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 86, "matrix:e2ee-cli": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-multi-account.yaml b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-multi-account.yaml
index 7d4feab5bc06..463fb0484c9a 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-multi-account.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup-multi-account.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 90, "matrix:e2ee-cli": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup.yaml b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup.yaml
index ed854bad85fa..b98f1f6d5aa7 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-encryption-setup.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 85, "matrix:e2ee-cli": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-invalid.yaml b/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-invalid.yaml
index 7c944282ddf8..f39ae915ac05 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-invalid.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-invalid.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 89, "matrix:e2ee-cli": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-setup.yaml b/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-setup.yaml
index fbfd0aceb3c7..bc98163410ad 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-setup.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-recovery-key-setup.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 88, "matrix:e2ee-cli": 4 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-self-verification.yaml b/qa/scenarios/channels/matrix-e2ee-cli-self-verification.yaml
index ed0dc69d167f..f8a9c96a6d79 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-self-verification.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-self-verification.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 92, "matrix:e2ee-cli": 8 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-cli-setup-then-gateway-reply.yaml b/qa/scenarios/channels/matrix-e2ee-cli-setup-then-gateway-reply.yaml
index 13d9ee3d6b12..63eae338bab8 100644
--- a/qa/scenarios/channels/matrix-e2ee-cli-setup-then-gateway-reply.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-cli-setup-then-gateway-reply.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 91, "matrix:e2ee-cli": 7 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-corrupt-crypto-idb-snapshot.yaml b/qa/scenarios/channels/matrix-e2ee-corrupt-crypto-idb-snapshot.yaml
index 5eced403ae82..c7529a6a12bb 100644
--- a/qa/scenarios/channels/matrix-e2ee-corrupt-crypto-idb-snapshot.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-corrupt-crypto-idb-snapshot.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 73, "matrix:e2ee-deep": 7 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-device-sas-verification.yaml b/qa/scenarios/channels/matrix-e2ee-device-sas-verification.yaml
index 4e7b10d719bd..039ac9ee6f52 100644
--- a/qa/scenarios/channels/matrix-e2ee-device-sas-verification.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-device-sas-verification.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 78, "matrix:e2ee-deep": 12 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-dm-sas-verification.yaml b/qa/scenarios/channels/matrix-e2ee-dm-sas-verification.yaml
index 886487ae6ff5..9ea90820ec08 100644
--- a/qa/scenarios/channels/matrix-e2ee-dm-sas-verification.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-dm-sas-verification.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.dm
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 81, "matrix:e2ee-deep": 15 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-history-exists-backup-empty.yaml b/qa/scenarios/channels/matrix-e2ee-history-exists-backup-empty.yaml
index 3a6e2a85c4e4..1adc3539deed 100644
--- a/qa/scenarios/channels/matrix-e2ee-history-exists-backup-empty.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-history-exists-backup-empty.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 77, "matrix:e2ee-deep": 11 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-key-bootstrap-failure.yaml b/qa/scenarios/channels/matrix-e2ee-key-bootstrap-failure.yaml
index 7f56c1acdec2..1c4396c8c92b 100644
--- a/qa/scenarios/channels/matrix-e2ee-key-bootstrap-failure.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-key-bootstrap-failure.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 65, "matrix:e2ee-smoke": 7 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-media-image.yaml b/qa/scenarios/channels/matrix-e2ee-media-image.yaml
index 151cd34e588b..3ce1130e4b66 100644
--- a/qa/scenarios/channels/matrix-e2ee-media-image.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-media-image.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.media-rich-content
+      - matrix.encrypted-media-upload-download
   execution:
     profiles: { "matrix:all": 57, "matrix:media": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-qr-verification.yaml b/qa/scenarios/channels/matrix-e2ee-qr-verification.yaml
index 3b01d80e6061..83a310095c7b 100644
--- a/qa/scenarios/channels/matrix-e2ee-qr-verification.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-qr-verification.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 79, "matrix:e2ee-deep": 13 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-recovery-key-lifecycle.yaml b/qa/scenarios/channels/matrix-e2ee-recovery-key-lifecycle.yaml
index decb7225ec74..39e1e286fad9 100644
--- a/qa/scenarios/channels/matrix-e2ee-recovery-key-lifecycle.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-recovery-key-lifecycle.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 61, "matrix:e2ee-smoke": 3 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-recovery-owner-verification-required.yaml b/qa/scenarios/channels/matrix-e2ee-recovery-owner-verification-required.yaml
index 298c1de2adcd..555e36a8c64b 100644
--- a/qa/scenarios/channels/matrix-e2ee-recovery-owner-verification-required.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-recovery-owner-verification-required.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 62, "matrix:e2ee-smoke": 4 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-restart-resume.yaml b/qa/scenarios/channels/matrix-e2ee-restart-resume.yaml
index 2145e7b3856d..369116fc4046 100644
--- a/qa/scenarios/channels/matrix-e2ee-restart-resume.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-restart-resume.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 63, "matrix:e2ee-smoke": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-reupload-restores.yaml b/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-reupload-restores.yaml
index 2e7bfa6688fc..26ae523a5f5d 100644
--- a/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-reupload-restores.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-reupload-restores.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 72, "matrix:e2ee-deep": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-state-intact.yaml b/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-state-intact.yaml
index cc6e18b5f0b3..d5c2a7841505 100644
--- a/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-state-intact.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-server-backup-deleted-local-state-intact.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 71, "matrix:e2ee-deep": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-server-device-deleted-local-state-intact.yaml b/qa/scenarios/channels/matrix-e2ee-server-device-deleted-local-state-intact.yaml
index 2af6e904fd35..1acb8d2cd207 100644
--- a/qa/scenarios/channels/matrix-e2ee-server-device-deleted-local-state-intact.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-server-device-deleted-local-state-intact.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 74, "matrix:e2ee-deep": 8 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-server-device-deleted-relogin-recovers.yaml b/qa/scenarios/channels/matrix-e2ee-server-device-deleted-relogin-recovers.yaml
index 2f1544f8a7de..b5584816adba 100644
--- a/qa/scenarios/channels/matrix-e2ee-server-device-deleted-relogin-recovers.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-server-device-deleted-relogin-recovers.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 75, "matrix:e2ee-deep": 9 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-stale-device-hygiene.yaml b/qa/scenarios/channels/matrix-e2ee-stale-device-hygiene.yaml
index 52c489d3ab09..0e7e52fcabf4 100644
--- a/qa/scenarios/channels/matrix-e2ee-stale-device-hygiene.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-stale-device-hygiene.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 80, "matrix:e2ee-deep": 14 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-stale-recovery-key-after-backup-reset.yaml b/qa/scenarios/channels/matrix-e2ee-stale-recovery-key-after-backup-reset.yaml
index bcbc5b5487ce..43c230830ece 100644
--- a/qa/scenarios/channels/matrix-e2ee-stale-recovery-key-after-backup-reset.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-stale-recovery-key-after-backup-reset.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 70, "matrix:e2ee-deep": 4 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-state-after-missing-encryption.yaml b/qa/scenarios/channels/matrix-e2ee-state-after-missing-encryption.yaml
index 50d7c895d9c6..5a8aa5bb1baf 100644
--- a/qa/scenarios/channels/matrix-e2ee-state-after-missing-encryption.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-state-after-missing-encryption.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 66, "matrix:e2ee-deep": 0 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-state-loss-external-recovery-key.yaml b/qa/scenarios/channels/matrix-e2ee-state-loss-external-recovery-key.yaml
index 92e7e6888361..75258e0ff0ae 100644
--- a/qa/scenarios/channels/matrix-e2ee-state-loss-external-recovery-key.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-state-loss-external-recovery-key.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 67, "matrix:e2ee-deep": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-state-loss-no-recovery-key.yaml b/qa/scenarios/channels/matrix-e2ee-state-loss-no-recovery-key.yaml
index 64985666d689..eac726fea6f1 100644
--- a/qa/scenarios/channels/matrix-e2ee-state-loss-no-recovery-key.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-state-loss-no-recovery-key.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 69, "matrix:e2ee-deep": 3 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-state-loss-stored-recovery-key.yaml b/qa/scenarios/channels/matrix-e2ee-state-loss-stored-recovery-key.yaml
index f2263768cdf6..93951c4ce233 100644
--- a/qa/scenarios/channels/matrix-e2ee-state-loss-stored-recovery-key.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-state-loss-stored-recovery-key.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 68, "matrix:e2ee-deep": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-sync-state-loss-crypto-intact.yaml b/qa/scenarios/channels/matrix-e2ee-sync-state-loss-crypto-intact.yaml
index e88cf0ed39ec..cc3c80a44570 100644
--- a/qa/scenarios/channels/matrix-e2ee-sync-state-loss-crypto-intact.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-sync-state-loss-crypto-intact.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.legacy-state
   execution:
     profiles: { "matrix:all": 76, "matrix:e2ee-deep": 10 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-thread-follow-up.yaml b/qa/scenarios/channels/matrix-e2ee-thread-follow-up.yaml
index 1c43d890b1e7..e46e3a530d69 100644
--- a/qa/scenarios/channels/matrix-e2ee-thread-follow-up.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-thread-follow-up.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
+      - matrix.matrix-thread-reply-routing
   execution:
     profiles: { "matrix:all": 59, "matrix:e2ee-smoke": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-verification-notice-no-trigger.yaml b/qa/scenarios/channels/matrix-e2ee-verification-notice-no-trigger.yaml
index b6139337b2c2..4898d1971943 100644
--- a/qa/scenarios/channels/matrix-e2ee-verification-notice-no-trigger.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-verification-notice-no-trigger.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encrypted-media-upload-download
   execution:
     profiles: { "matrix:all": 82, "matrix:e2ee-deep": 16 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-e2ee-wrong-account-recovery-key.yaml b/qa/scenarios/channels/matrix-e2ee-wrong-account-recovery-key.yaml
index 812949a57b3d..9297eb8c75e6 100644
--- a/qa/scenarios/channels/matrix-e2ee-wrong-account-recovery-key.yaml
+++ b/qa/scenarios/channels/matrix-e2ee-wrong-account-recovery-key.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-and-identity
+      - matrix.encryption-setup
   execution:
     profiles: { "matrix:all": 83, "matrix:e2ee-deep": 17 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-homeserver-restart-resume.yaml b/qa/scenarios/channels/matrix-homeserver-restart-resume.yaml
index d6e820926cef..452175c567dd 100644
--- a/qa/scenarios/channels/matrix-homeserver-restart-resume.yaml
+++ b/qa/scenarios/channels/matrix-homeserver-restart-resume.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.conversation-routing-and-delivery
   execution:
     profiles: { "matrix:all": 34, "matrix:transport": 33 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-inbound-edit-ignored.yaml b/qa/scenarios/channels/matrix-inbound-edit-ignored.yaml
index fba1fa701741..0d61ff4ba361 100644
--- a/qa/scenarios/channels/matrix-inbound-edit-ignored.yaml
+++ b/qa/scenarios/channels/matrix-inbound-edit-ignored.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 49, "matrix:transport": 48 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-inbound-edit-no-duplicate-trigger.yaml b/qa/scenarios/channels/matrix-inbound-edit-no-duplicate-trigger.yaml
index e07c2bf50e46..5960178ce81b 100644
--- a/qa/scenarios/channels/matrix-inbound-edit-no-duplicate-trigger.yaml
+++ b/qa/scenarios/channels/matrix-inbound-edit-no-duplicate-trigger.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 50, "matrix:transport": 49 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-initial-catchup-then-incremental.yaml b/qa/scenarios/channels/matrix-initial-catchup-then-incremental.yaml
index d37ba781706d..03f8598e8a29 100644
--- a/qa/scenarios/channels/matrix-initial-catchup-then-incremental.yaml
+++ b/qa/scenarios/channels/matrix-initial-catchup-then-incremental.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.conversation-routing-and-delivery
   execution:
     profiles: { "matrix:all": 31, "matrix:transport": 30 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-media-type-coverage.yaml b/qa/scenarios/channels/matrix-media-type-coverage.yaml
index 5e889c7ca0f2..76303facb6d3 100644
--- a/qa/scenarios/channels/matrix-media-type-coverage.yaml
+++ b/qa/scenarios/channels/matrix-media-type-coverage.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.media-rich-content
+      - matrix.media-and-rich-content
   execution:
     profiles: { "matrix:all": 53, "matrix:media": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-mention-metadata-spoof-block.yaml b/qa/scenarios/channels/matrix-mention-metadata-spoof-block.yaml
index 49472e7424de..d21f7aa13544 100644
--- a/qa/scenarios/channels/matrix-mention-metadata-spoof-block.yaml
+++ b/qa/scenarios/channels/matrix-mention-metadata-spoof-block.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   execution:
     profiles: { "matrix:all": 45, "matrix:transport": 44 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-mxid-prefixed-command-block.yaml b/qa/scenarios/channels/matrix-mxid-prefixed-command-block.yaml
index 1e3638c987be..cb2b8d50a2e5 100644
--- a/qa/scenarios/channels/matrix-mxid-prefixed-command-block.yaml
+++ b/qa/scenarios/channels/matrix-mxid-prefixed-command-block.yaml
@@ -4,9 +4,9 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.native-commands
+      - channels.channel-native-commands
     secondary:
-      - channels.group-messages
+      - matrix.mention-gates
   execution:
     profiles: { "matrix:all": 44, "matrix:transport": 43 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-post-restart-room-continue.yaml b/qa/scenarios/channels/matrix-post-restart-room-continue.yaml
index cff659de57c4..fd2fc5e87ca4 100644
--- a/qa/scenarios/channels/matrix-post-restart-room-continue.yaml
+++ b/qa/scenarios/channels/matrix-post-restart-room-continue.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.restart-resume
+      - channels.resumed-final-reply
   objective: Verify channel delivery resumes after a Gateway restart without replaying completed delivery.
   successCriteria:
     - A reply is delivered before restart.
diff --git a/qa/scenarios/channels/matrix-reaction-not-a-reply.yaml b/qa/scenarios/channels/matrix-reaction-not-a-reply.yaml
index 6b3f0dfd3e1b..c704e6b2ff6f 100644
--- a/qa/scenarios/channels/matrix-reaction-not-a-reply.yaml
+++ b/qa/scenarios/channels/matrix-reaction-not-a-reply.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 23, "matrix:transport": 22 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-reaction-notification.yaml b/qa/scenarios/channels/matrix-reaction-notification.yaml
index 879a3a9b6ff2..12771165e5ac 100644
--- a/qa/scenarios/channels/matrix-reaction-notification.yaml
+++ b/qa/scenarios/channels/matrix-reaction-notification.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 21, "matrix:fast": 4, "matrix:transport": 20 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-reaction-redaction-observed.yaml b/qa/scenarios/channels/matrix-reaction-redaction-observed.yaml
index 9045abca45b7..04a4b8e56b31 100644
--- a/qa/scenarios/channels/matrix-reaction-redaction-observed.yaml
+++ b/qa/scenarios/channels/matrix-reaction-redaction-observed.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 24, "matrix:transport": 23 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-reaction-threaded.yaml b/qa/scenarios/channels/matrix-reaction-threaded.yaml
index 9a55b5bc92e1..7e7a0a72e790 100644
--- a/qa/scenarios/channels/matrix-reaction-threaded.yaml
+++ b/qa/scenarios/channels/matrix-reaction-threaded.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.message-actions
+      - matrix.message-send-read-edit-delete
   execution:
     profiles: { "matrix:all": 22, "matrix:transport": 21 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-restart-replay-dedupe.yaml b/qa/scenarios/channels/matrix-restart-replay-dedupe.yaml
index f08c7d5b5d38..9e92e040fdc5 100644
--- a/qa/scenarios/channels/matrix-restart-replay-dedupe.yaml
+++ b/qa/scenarios/channels/matrix-restart-replay-dedupe.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.restart-resume
+      - channels.resumed-final-reply
   objective: Verify channel delivery resumes after a Gateway restart without replaying completed delivery.
   successCriteria:
     - A reply is delivered before restart.
diff --git a/qa/scenarios/channels/matrix-restart-resume.yaml b/qa/scenarios/channels/matrix-restart-resume.yaml
index 9f03e9929204..ddeb2b3ab2bf 100644
--- a/qa/scenarios/channels/matrix-restart-resume.yaml
+++ b/qa/scenarios/channels/matrix-restart-resume.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.restart-resume
+      - channels.resumed-final-reply
   objective: Verify channel delivery resumes after a Gateway restart without replaying completed delivery.
   successCriteria:
     - A reply is delivered before restart.
diff --git a/qa/scenarios/channels/matrix-room-autojoin-invite.yaml b/qa/scenarios/channels/matrix-room-autojoin-invite.yaml
index 79452b329db8..32422e9334c5 100644
--- a/qa/scenarios/channels/matrix-room-autojoin-invite.yaml
+++ b/qa/scenarios/channels/matrix-room-autojoin-invite.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.conversation-routing-and-delivery
   execution:
     profiles: { "matrix:all": 18, "matrix:transport": 17 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-block-streaming.yaml b/qa/scenarios/channels/matrix-room-block-streaming.yaml
index f8eb28ef6bab..c63fb0c74b13 100644
--- a/qa/scenarios/channels/matrix-room-block-streaming.yaml
+++ b/qa/scenarios/channels/matrix-room-block-streaming.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     kind: flow
     channel: matrix
diff --git a/qa/scenarios/channels/matrix-room-generated-image-delivery.yaml b/qa/scenarios/channels/matrix-room-generated-image-delivery.yaml
index 780e876978ad..29bc4b4990d1 100644
--- a/qa/scenarios/channels/matrix-room-generated-image-delivery.yaml
+++ b/qa/scenarios/channels/matrix-room-generated-image-delivery.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.media-rich-content
+      - matrix.media-and-rich-content
   execution:
     profiles: { "matrix:all": 52, "matrix:media": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-image-understanding-attachment.yaml b/qa/scenarios/channels/matrix-room-image-understanding-attachment.yaml
index f9e19038f61a..cae452397cde 100644
--- a/qa/scenarios/channels/matrix-room-image-understanding-attachment.yaml
+++ b/qa/scenarios/channels/matrix-room-image-understanding-attachment.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - media.image-understanding
+      - media.image-summary-image-understanding
     secondary:
       - channels.inbound-media-normalization
   docsRefs:
diff --git a/qa/scenarios/channels/matrix-room-membership-loss.yaml b/qa/scenarios/channels/matrix-room-membership-loss.yaml
index 84ab4f04efc3..d723514b9bd9 100644
--- a/qa/scenarios/channels/matrix-room-membership-loss.yaml
+++ b/qa/scenarios/channels/matrix-room-membership-loss.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.conversation-routing-and-delivery
   execution:
     profiles: { "matrix:all": 33, "matrix:transport": 32 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-partial-streaming-preview.yaml b/qa/scenarios/channels/matrix-room-partial-streaming-preview.yaml
index 64ab80521051..232ebe84e919 100644
--- a/qa/scenarios/channels/matrix-room-partial-streaming-preview.yaml
+++ b/qa/scenarios/channels/matrix-room-partial-streaming-preview.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   docsRefs:
     - docs/concepts/streaming.md
   execution:
diff --git a/qa/scenarios/channels/matrix-room-quiet-streaming-preview.yaml b/qa/scenarios/channels/matrix-room-quiet-streaming-preview.yaml
index f8afede62209..594de0cff81e 100644
--- a/qa/scenarios/channels/matrix-room-quiet-streaming-preview.yaml
+++ b/qa/scenarios/channels/matrix-room-quiet-streaming-preview.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   docsRefs:
     - docs/concepts/streaming.md
   execution:
diff --git a/qa/scenarios/channels/matrix-room-tool-progress-command-preview.yaml b/qa/scenarios/channels/matrix-room-tool-progress-command-preview.yaml
index daea8d677808..6c5741daf87d 100644
--- a/qa/scenarios/channels/matrix-room-tool-progress-command-preview.yaml
+++ b/qa/scenarios/channels/matrix-room-tool-progress-command-preview.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     profiles: { "matrix:all": 10, "matrix:transport": 9 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-tool-progress-error.yaml b/qa/scenarios/channels/matrix-room-tool-progress-error.yaml
index 975ff3ff8403..ef241b9f0c8d 100644
--- a/qa/scenarios/channels/matrix-room-tool-progress-error.yaml
+++ b/qa/scenarios/channels/matrix-room-tool-progress-error.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     profiles: { "matrix:all": 12, "matrix:transport": 11 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-tool-progress-mention-safety.yaml b/qa/scenarios/channels/matrix-room-tool-progress-mention-safety.yaml
index 7bf91a53331c..2e268b324c03 100644
--- a/qa/scenarios/channels/matrix-room-tool-progress-mention-safety.yaml
+++ b/qa/scenarios/channels/matrix-room-tool-progress-mention-safety.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     profiles: { "matrix:all": 13, "matrix:transport": 12 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-tool-progress-preview-opt-out.yaml b/qa/scenarios/channels/matrix-room-tool-progress-preview-opt-out.yaml
index 9830f9fae29d..4cb053e5e939 100644
--- a/qa/scenarios/channels/matrix-room-tool-progress-preview-opt-out.yaml
+++ b/qa/scenarios/channels/matrix-room-tool-progress-preview-opt-out.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     profiles: { "matrix:all": 11, "matrix:transport": 10 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-room-tool-progress-preview.yaml b/qa/scenarios/channels/matrix-room-tool-progress-preview.yaml
index 4676d71dddf3..c4b4a982ed80 100644
--- a/qa/scenarios/channels/matrix-room-tool-progress-preview.yaml
+++ b/qa/scenarios/channels/matrix-room-tool-progress-preview.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.streaming
+      - matrix.message-presentation-metadata
   execution:
     profiles: { "matrix:all": 9, "matrix:transport": 8 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-secondary-room-open-trigger.yaml b/qa/scenarios/channels/matrix-secondary-room-open-trigger.yaml
index 5f4f43e0f975..c58326d07330 100644
--- a/qa/scenarios/channels/matrix-secondary-room-open-trigger.yaml
+++ b/qa/scenarios/channels/matrix-secondary-room-open-trigger.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.group-messages
+      - matrix.mention-gates
   execution:
     profiles: { "matrix:all": 20, "matrix:transport": 19 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-stale-sync-replay-dedupe.yaml b/qa/scenarios/channels/matrix-stale-sync-replay-dedupe.yaml
index 247f123b10e5..f2bee94d3d6d 100644
--- a/qa/scenarios/channels/matrix-stale-sync-replay-dedupe.yaml
+++ b/qa/scenarios/channels/matrix-stale-sync-replay-dedupe.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.reconnect
+      - matrix.conversation-routing-and-delivery
   execution:
     profiles: { "matrix:all": 32, "matrix:transport": 31 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-thread-nested-reply-shape.yaml b/qa/scenarios/channels/matrix-thread-nested-reply-shape.yaml
index 24d82d9f916e..0a3ea3565b7f 100644
--- a/qa/scenarios/channels/matrix-thread-nested-reply-shape.yaml
+++ b/qa/scenarios/channels/matrix-thread-nested-reply-shape.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
+      - matrix.matrix-thread-reply-routing
   execution:
     profiles: { "matrix:all": 3, "matrix:transport": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-thread-root-preservation.yaml b/qa/scenarios/channels/matrix-thread-root-preservation.yaml
index c1ea1708ad4f..048147c94c29 100644
--- a/qa/scenarios/channels/matrix-thread-root-preservation.yaml
+++ b/qa/scenarios/channels/matrix-thread-root-preservation.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
+      - matrix.matrix-thread-reply-routing
   execution:
     profiles: { "matrix:all": 2, "matrix:transport": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-unsupported-media-safe.yaml b/qa/scenarios/channels/matrix-unsupported-media-safe.yaml
index d67072f2e573..db36961811b9 100644
--- a/qa/scenarios/channels/matrix-unsupported-media-safe.yaml
+++ b/qa/scenarios/channels/matrix-unsupported-media-safe.yaml
@@ -6,7 +6,7 @@ scenario:
     primary:
       - channels.inbound-media-normalization
     secondary:
-      - runtime.delivery
+      - matrix.inbound-media-failure-handling
   execution:
     profiles: { "matrix:all": 56, "matrix:media": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/matrix-voice-preflight-mention.yaml b/qa/scenarios/channels/matrix-voice-preflight-mention.yaml
index f6953d4a9a56..5d870c0213c2 100644
--- a/qa/scenarios/channels/matrix-voice-preflight-mention.yaml
+++ b/qa/scenarios/channels/matrix-voice-preflight-mention.yaml
@@ -4,7 +4,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.media-rich-content
+      - matrix.media-and-rich-content
   gatewayConfigPatch:
     tools:
       media:
diff --git a/qa/scenarios/channels/message-tool-stranded-final-reply.yaml b/qa/scenarios/channels/message-tool-stranded-final-reply.yaml
index 5ba324f31709..b04faade4423 100644
--- a/qa/scenarios/channels/message-tool-stranded-final-reply.yaml
+++ b/qa/scenarios/channels/message-tool-stranded-final-reply.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.direct-visible-replies
+      - channels.direct-final-reply
     secondary:
-      - channels.qa-channel
-      - tools.message
+      - channels.qa-channel-final-reply
+      - channels.message-final-reply
   objective: Reproduce #85714 end to end under messages.visibleReplies=message_tool. A long private final reply that never calls the message tool must warn, enqueue one recovery retry by default, and deliver the original reply via message(action=send).
   gatewayConfigPatch:
     messages:
diff --git a/qa/scenarios/channels/message-tool-stranded-final-retry-failure.yaml b/qa/scenarios/channels/message-tool-stranded-final-retry-failure.yaml
index 967123d204af..5fa0a50022f2 100644
--- a/qa/scenarios/channels/message-tool-stranded-final-retry-failure.yaml
+++ b/qa/scenarios/channels/message-tool-stranded-final-retry-failure.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.direct-visible-replies
+      - channels.direct-final-reply
     secondary:
-      - channels.qa-channel
-      - tools.message
+      - channels.qa-channel-final-reply
+      - channels.message-final-reply
   objective: Prove #85714 retry exhaustion is fail-closed and visible. If the one stranded-final recovery retry also omits message(action=send), OpenClaw must deliver only a sanitized diagnostic and must not leak the original private final text.
   gatewayConfigPatch:
     messages:
diff --git a/qa/scenarios/channels/native-command-session-target.yaml b/qa/scenarios/channels/native-command-session-target.yaml
index ffa7ce72eb4d..6cedb443b018 100644
--- a/qa/scenarios/channels/native-command-session-target.yaml
+++ b/qa/scenarios/channels/native-command-session-target.yaml
@@ -2,13 +2,13 @@ title: Native command active session target evidence
 
 scenario:
   id: native-command-session-target
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
     primary:
       - channels.native-command-session-target
     secondary:
-      - channels.native-commands
+      - channels.channel-native-commands
   objective: Verify a channel-native `/stop` command aborts the active routed conversation session instead of its separate slash-command session.
   successCriteria:
     - A real delayed agent turn is active on the routed channel conversation session.
diff --git a/qa/scenarios/channels/qa-channel-reconnect-dedupe.yaml b/qa/scenarios/channels/qa-channel-reconnect-dedupe.yaml
index 9a72d036e72c..95d69b8d85b3 100644
--- a/qa/scenarios/channels/qa-channel-reconnect-dedupe.yaml
+++ b/qa/scenarios/channels/qa-channel-reconnect-dedupe.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channel
   coverage:
     primary:
-      - channels.reconnect
+      - channels.reconnect-final-reply
     secondary:
-      - channels.dedup
-      - runtime.delivery
+      - channels.final-reply-dedup
+      - channels.automatic-final-reply
   objective: Verify qa-channel resumes after a Gateway restart without replaying consumed inbound events or completed delivery.
   successCriteria:
     - Agent replies once before a reconnect-style readiness cycle.
diff --git a/qa/scenarios/channels/reaction-edit-delete.yaml b/qa/scenarios/channels/reaction-edit-delete.yaml
index 0445d2e9fb92..4df82096e3ff 100644
--- a/qa/scenarios/channels/reaction-edit-delete.yaml
+++ b/qa/scenarios/channels/reaction-edit-delete.yaml
@@ -7,7 +7,7 @@ scenario:
     primary:
       - channels.message-actions
     secondary:
-      - channels.qa-channel
+      - channels.qa-channel-reply-transform
   objective: Verify the agent can use channel-owned message actions and that the QA transcript reflects them.
   successCriteria:
     - Agent adds at least one reaction.
diff --git a/qa/scenarios/channels/slack-allowlist-block.yaml b/qa/scenarios/channels/slack-allowlist-block.yaml
index f03b56d94e1c..b370b608c9e5 100644
--- a/qa/scenarios/channels/slack-allowlist-block.yaml
+++ b/qa/scenarios/channels/slack-allowlist-block.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-allowlist-block
   surface: channels
   coverage:
-    primary: [channels.access-and-identity]
+    primary:
+      - slack.access-and-identity
   execution:
     profiles: { "slack:default": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-approval-exec-native.yaml b/qa/scenarios/channels/slack-approval-exec-native.yaml
index de578a4d77cb..c44ff68173ef 100644
--- a/qa/scenarios/channels/slack-approval-exec-native.yaml
+++ b/qa/scenarios/channels/slack-approval-exec-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-approval-exec-native
   surface: channels
   coverage:
-    primary: [channels.native-approval-prompts]
+    primary:
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "slack:default": 7 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-approval-plugin-native.yaml b/qa/scenarios/channels/slack-approval-plugin-native.yaml
index 74e7025505fe..7a59d2a36c81 100644
--- a/qa/scenarios/channels/slack-approval-plugin-native.yaml
+++ b/qa/scenarios/channels/slack-approval-plugin-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-approval-plugin-native
   surface: channels
   coverage:
-    primary: [channels.native-approval-prompts]
+    primary:
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "slack:default": 8 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-canary.yaml b/qa/scenarios/channels/slack-canary.yaml
index bbfbc12c172d..8cffb624c764 100644
--- a/qa/scenarios/channels/slack-canary.yaml
+++ b/qa/scenarios/channels/slack-canary.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-canary
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - slack.runtime-lifecycle
   execution:
     profiles: { "slack:default": 0 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-channel-disabled-warning.yaml b/qa/scenarios/channels/slack-channel-disabled-warning.yaml
index 63d0bd692083..294dffb76636 100644
--- a/qa/scenarios/channels/slack-channel-disabled-warning.yaml
+++ b/qa/scenarios/channels/slack-channel-disabled-warning.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-channel-disabled-warning
   surface: channels
   coverage:
-    primary: [channels.access-and-identity]
+    primary:
+      - slack.access-and-identity
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-chart-presentation-native.yaml b/qa/scenarios/channels/slack-chart-presentation-native.yaml
index 7fe13832b3ad..e7a54da2b6fe 100644
--- a/qa/scenarios/channels/slack-chart-presentation-native.yaml
+++ b/qa/scenarios/channels/slack-chart-presentation-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-chart-presentation-native
   surface: channels
   coverage:
-    primary: [channels.media-rich-content]
+    primary:
+      - slack.media-and-rich-content
   execution:
     profiles: { "slack:default": 4 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-codex-approval-exec-native.yaml b/qa/scenarios/channels/slack-codex-approval-exec-native.yaml
index 811b969c50ea..0154ee88cccd 100644
--- a/qa/scenarios/channels/slack-codex-approval-exec-native.yaml
+++ b/qa/scenarios/channels/slack-codex-approval-exec-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-codex-approval-exec-native
   surface: channels
   coverage:
-    primary: [channels.native-approval-prompts]
+    primary:
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "slack:default": 9 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-codex-approval-plugin-native.yaml b/qa/scenarios/channels/slack-codex-approval-plugin-native.yaml
index 4830c330f27f..91c2335119cb 100644
--- a/qa/scenarios/channels/slack-codex-approval-plugin-native.yaml
+++ b/qa/scenarios/channels/slack-codex-approval-plugin-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-codex-approval-plugin-native
   surface: channels
   coverage:
-    primary: [channels.native-approval-prompts]
+    primary:
+      - channels.channel-native-approval-prompts
   execution:
     profiles: { "slack:default": 10 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-mention-gating.yaml b/qa/scenarios/channels/slack-mention-gating.yaml
index 7cf4fce8c69b..e8d71354c8c2 100644
--- a/qa/scenarios/channels/slack-mention-gating.yaml
+++ b/qa/scenarios/channels/slack-mention-gating.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-mention-gating
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - slack.channel-allowlists
   execution:
     profiles: { "slack:default": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-progress-commentary-false.yaml b/qa/scenarios/channels/slack-progress-commentary-false.yaml
index 56068cd34485..259131af2198 100644
--- a/qa/scenarios/channels/slack-progress-commentary-false.yaml
+++ b/qa/scenarios/channels/slack-progress-commentary-false.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-progress-commentary-false
   surface: channels
   coverage:
-    primary: [channels.streaming]
+    primary:
+      - agent-runtime.streaming-replies
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-progress-commentary-omitted.yaml b/qa/scenarios/channels/slack-progress-commentary-omitted.yaml
index 889232a6f594..13c73b57b067 100644
--- a/qa/scenarios/channels/slack-progress-commentary-omitted.yaml
+++ b/qa/scenarios/channels/slack-progress-commentary-omitted.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-progress-commentary-omitted
   surface: channels
   coverage:
-    primary: [channels.streaming]
+    primary:
+      - agent-runtime.streaming-replies
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-progress-commentary-true.yaml b/qa/scenarios/channels/slack-progress-commentary-true.yaml
index 11effd511fdb..c9818477a568 100644
--- a/qa/scenarios/channels/slack-progress-commentary-true.yaml
+++ b/qa/scenarios/channels/slack-progress-commentary-true.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-progress-commentary-true
   surface: channels
   coverage:
-    primary: [channels.streaming]
+    primary:
+      - agent-runtime.streaming-replies
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-progress-commentary-verbose-dedupe.yaml b/qa/scenarios/channels/slack-progress-commentary-verbose-dedupe.yaml
index 392fb8f7556f..aa29c167ff1f 100644
--- a/qa/scenarios/channels/slack-progress-commentary-verbose-dedupe.yaml
+++ b/qa/scenarios/channels/slack-progress-commentary-verbose-dedupe.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-progress-commentary-verbose-dedupe
   surface: channels
   coverage:
-    primary: [channels.streaming]
+    primary:
+      - agent-runtime.streaming-replies
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-reaction-glyph-native.yaml b/qa/scenarios/channels/slack-reaction-glyph-native.yaml
index c6de652b2bc3..9e9415e212eb 100644
--- a/qa/scenarios/channels/slack-reaction-glyph-native.yaml
+++ b/qa/scenarios/channels/slack-reaction-glyph-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-reaction-glyph-native
   surface: channels
   coverage:
-    primary: [channels.message-actions]
+    primary:
+      - slack.actions
   execution:
     profiles: { "slack:default": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-restart-resume.yaml b/qa/scenarios/channels/slack-restart-resume.yaml
index a7b0ec7b997b..617fe55621d8 100644
--- a/qa/scenarios/channels/slack-restart-resume.yaml
+++ b/qa/scenarios/channels/slack-restart-resume.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.restart-resume
+      - channels.resumed-final-reply
   objective: Verify channel delivery resumes after a Gateway restart without replaying completed delivery.
   successCriteria:
     - A reply is delivered before restart.
diff --git a/qa/scenarios/channels/slack-table-invalid-blocks-fallback.yaml b/qa/scenarios/channels/slack-table-invalid-blocks-fallback.yaml
index c147162e0afc..dc8eff525aa5 100644
--- a/qa/scenarios/channels/slack-table-invalid-blocks-fallback.yaml
+++ b/qa/scenarios/channels/slack-table-invalid-blocks-fallback.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-table-invalid-blocks-fallback
   surface: channels
   coverage:
-    primary: [channels.media-rich-content]
+    primary:
+      - slack.media-and-rich-content
   execution:
     kind: flow
     channel: slack
diff --git a/qa/scenarios/channels/slack-table-presentation-native.yaml b/qa/scenarios/channels/slack-table-presentation-native.yaml
index 8b2777937b99..370b7683a26b 100644
--- a/qa/scenarios/channels/slack-table-presentation-native.yaml
+++ b/qa/scenarios/channels/slack-table-presentation-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-table-presentation-native
   surface: channels
   coverage:
-    primary: [channels.media-rich-content]
+    primary:
+      - slack.media-and-rich-content
   execution:
     profiles: { "slack:default": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/slack-top-level-reply-shape.yaml b/qa/scenarios/channels/slack-top-level-reply-shape.yaml
index 2c321d0631d6..d9f1fc958529 100644
--- a/qa/scenarios/channels/slack-top-level-reply-shape.yaml
+++ b/qa/scenarios/channels/slack-top-level-reply-shape.yaml
@@ -3,7 +3,8 @@ scenario:
   id: slack-top-level-reply-shape
   surface: channels
   coverage:
-    primary: [channels.group-visible-replies]
+    primary:
+      - slack.thread-routing
   execution:
     profiles: { "slack:default": 3 }
     kind: flow
diff --git a/qa/scenarios/channels/subagent-thread-spawn.yaml b/qa/scenarios/channels/subagent-thread-spawn.yaml
index e674a75de128..5f9fe1a441f2 100644
--- a/qa/scenarios/channels/subagent-thread-spawn.yaml
+++ b/qa/scenarios/channels/subagent-thread-spawn.yaml
@@ -5,8 +5,8 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
-      - agents.subagents
+      - matrix.acp-subagent-spawn-hooks
+      - agent-runtime.subagent-turns-subagents
   objective: Verify sessions_spawn(thread=true, mode=session) creates a persistent Matrix child thread and delivers the child result there.
   gatewayConfigPatch:
     tools:
diff --git a/qa/scenarios/channels/telegram-assistant-transcript-role-boundary.yaml b/qa/scenarios/channels/telegram-assistant-transcript-role-boundary.yaml
index 82679f53a929..ddf68ea8daf4 100644
--- a/qa/scenarios/channels/telegram-assistant-transcript-role-boundary.yaml
+++ b/qa/scenarios/channels/telegram-assistant-transcript-role-boundary.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify Telegram renders transcript-role-looking assistant text as inert authorship-marked content.
   successCriteria:
     - The controlled model reply reaches the real Telegram plugin through Crabline.
diff --git a/qa/scenarios/channels/telegram-commands-command.yaml b/qa/scenarios/channels/telegram-commands-command.yaml
index a8c64eaff0f8..7bbb919f46f0 100644
--- a/qa/scenarios/channels/telegram-commands-command.yaml
+++ b/qa/scenarios/channels/telegram-commands-command.yaml
@@ -2,10 +2,11 @@ title: Telegram commands list reply
 
 scenario:
   id: telegram-commands-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify Telegram renders the full native command catalog.
   successCriteria:
     - The command list is returned through the Telegram group command path.
diff --git a/qa/scenarios/channels/telegram-context-command.yaml b/qa/scenarios/channels/telegram-context-command.yaml
index e21fedb9e97b..5175d47f9b00 100644
--- a/qa/scenarios/channels/telegram-context-command.yaml
+++ b/qa/scenarios/channels/telegram-context-command.yaml
@@ -2,10 +2,11 @@ title: Telegram context command reply
 
 scenario:
   id: telegram-context-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify Telegram context help reaches native command routing.
   successCriteria:
     - The context command returns the context list shortcut.
diff --git a/qa/scenarios/channels/telegram-current-session-status-tool.yaml b/qa/scenarios/channels/telegram-current-session-status-tool.yaml
index b26e0c31842d..0f77ea3620d0 100644
--- a/qa/scenarios/channels/telegram-current-session-status-tool.yaml
+++ b/qa/scenarios/channels/telegram-current-session-status-tool.yaml
@@ -2,11 +2,13 @@ title: Telegram current-session status tool context
 
 scenario:
   id: telegram-current-session-status-tool
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [tools.session-status]
-    secondary: [memory.session-key-construction]
+    primary:
+      - gateway.session-apis-session-status
+    secondary:
+      - telegram.session-key-construction
   objective: Verify the session_status tool resolves current to the active Telegram group session.
   successCriteria:
     - The model calls session_status with sessionKey current.
diff --git a/qa/scenarios/channels/telegram-help-command.yaml b/qa/scenarios/channels/telegram-help-command.yaml
index b0ed97791a3c..49408342785a 100644
--- a/qa/scenarios/channels/telegram-help-command.yaml
+++ b/qa/scenarios/channels/telegram-help-command.yaml
@@ -2,11 +2,11 @@ title: Telegram help command reply
 
 scenario:
   id: telegram-help-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
     primary:
-      - channels.native-commands
+      - channels.channel-native-commands
   objective: Verify the Telegram help command returns the concise command guide.
   successCriteria:
     - The help command is accepted in the Telegram group command path.
diff --git a/qa/scenarios/channels/telegram-long-final-reuses-preview.yaml b/qa/scenarios/channels/telegram-long-final-reuses-preview.yaml
index 4b9c0d8caa0c..0cfdfc997d25 100644
--- a/qa/scenarios/channels/telegram-long-final-reuses-preview.yaml
+++ b/qa/scenarios/channels/telegram-long-final-reuses-preview.yaml
@@ -2,10 +2,11 @@ title: Telegram long final reuses its preview
 
 scenario:
   id: telegram-long-final-reuses-preview
-  surface: channel-framework
-  category: channel-framework.conversation-routing-and-delivery
+  surface: channels
+  category: channels.conversation-routing-and-delivery
   coverage:
-    primary: [runtime.delivery]
+    primary:
+      - telegram.conversation-routing-and-delivery
   regressionRefs:
     - openclaw/openclaw#39905
   objective: Verify a long Telegram final replaces its preview instead of leaving stale text.
diff --git a/qa/scenarios/channels/telegram-long-final-three-chunks.yaml b/qa/scenarios/channels/telegram-long-final-three-chunks.yaml
index 8bcc328b226a..68c7a4d166ab 100644
--- a/qa/scenarios/channels/telegram-long-final-three-chunks.yaml
+++ b/qa/scenarios/channels/telegram-long-final-three-chunks.yaml
@@ -2,10 +2,11 @@ title: Telegram long final keeps three final chunks
 
 scenario:
   id: telegram-long-final-three-chunks
-  surface: channel-framework
-  category: channel-framework.conversation-routing-and-delivery
+  surface: channels
+  category: channels.conversation-routing-and-delivery
   coverage:
-    primary: [runtime.delivery]
+    primary:
+      - telegram.conversation-routing-and-delivery
   regressionRefs:
     - openclaw/openclaw#39905
   objective: Verify a three-chunk Telegram final removes previews and keeps only final chunks.
diff --git a/qa/scenarios/channels/telegram-other-bot-command-gating.yaml b/qa/scenarios/channels/telegram-other-bot-command-gating.yaml
index 36de2dffc0a1..d52fbffecbaf 100644
--- a/qa/scenarios/channels/telegram-other-bot-command-gating.yaml
+++ b/qa/scenarios/channels/telegram-other-bot-command-gating.yaml
@@ -2,10 +2,11 @@ title: Telegram command addressed to another bot
 
 scenario:
   id: telegram-other-bot-command-gating
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify a command addressed to another Telegram bot does not wake OpenClaw.
   successCriteria:
     - The driver sends a native status command addressed to another bot.
diff --git a/qa/scenarios/channels/telegram-repeated-command-authorization.yaml b/qa/scenarios/channels/telegram-repeated-command-authorization.yaml
index cd2f9d4eeac0..acbe47bcbaf9 100644
--- a/qa/scenarios/channels/telegram-repeated-command-authorization.yaml
+++ b/qa/scenarios/channels/telegram-repeated-command-authorization.yaml
@@ -2,10 +2,11 @@ title: Telegram repeated command authorization
 
 scenario:
   id: telegram-repeated-command-authorization
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify an allowlisted Telegram bot operator remains authorized across repeated native commands.
   successCriteria:
     - The same operator is blocked while removed from the group allowlist.
diff --git a/qa/scenarios/channels/telegram-reply-chain-exact-marker.yaml b/qa/scenarios/channels/telegram-reply-chain-exact-marker.yaml
index 2ce6f533b107..b25587b13e2f 100644
--- a/qa/scenarios/channels/telegram-reply-chain-exact-marker.yaml
+++ b/qa/scenarios/channels/telegram-reply-chain-exact-marker.yaml
@@ -2,10 +2,11 @@ title: Telegram reply-chain exact marker
 
 scenario:
   id: telegram-reply-chain-exact-marker
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [runtime.delivery]
+    primary:
+      - telegram.conversation-routing-and-delivery
   objective: Verify an exact-marker Telegram reply is delivered once without extra visible text.
   successCriteria:
     - The model returns the requested exact marker through the reply path.
diff --git a/qa/scenarios/channels/telegram-status-command.yaml b/qa/scenarios/channels/telegram-status-command.yaml
index 7b304cb5395e..dc55bae2f8f5 100644
--- a/qa/scenarios/channels/telegram-status-command.yaml
+++ b/qa/scenarios/channels/telegram-status-command.yaml
@@ -2,10 +2,11 @@ title: Telegram status command reply
 
 scenario:
   id: telegram-status-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   regressionRefs:
     - openclaw/openclaw#74698
   objective: Verify Telegram status returns model, session, and activation details.
diff --git a/qa/scenarios/channels/telegram-stream-final-single-message.yaml b/qa/scenarios/channels/telegram-stream-final-single-message.yaml
index a2df55ba5d08..d319d9e80df9 100644
--- a/qa/scenarios/channels/telegram-stream-final-single-message.yaml
+++ b/qa/scenarios/channels/telegram-stream-final-single-message.yaml
@@ -2,10 +2,11 @@ title: Telegram streamed final stays one message
 
 scenario:
   id: telegram-stream-final-single-message
-  surface: channel-framework
-  category: channel-framework.conversation-routing-and-delivery
+  surface: channels
+  category: channels.conversation-routing-and-delivery
   coverage:
-    primary: [runtime.delivery]
+    primary:
+      - telegram.conversation-routing-and-delivery
   regressionRefs:
     - openclaw/openclaw#39905
   objective: Verify Telegram quiet streaming finalizes one preview without a duplicate reply.
diff --git a/qa/scenarios/channels/telegram-tool-only-usage-footer.yaml b/qa/scenarios/channels/telegram-tool-only-usage-footer.yaml
index e3777cd3bff7..7a1764ac5ada 100644
--- a/qa/scenarios/channels/telegram-tool-only-usage-footer.yaml
+++ b/qa/scenarios/channels/telegram-tool-only-usage-footer.yaml
@@ -2,11 +2,13 @@ title: Telegram tool-only usage footer
 
 scenario:
   id: telegram-tool-only-usage-footer
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [telemetry.model-usage]
-    secondary: [channels.native-commands]
+    primary:
+      - observability.model-usage
+    secondary:
+      - channels.channel-native-commands
   regressionRefs:
     - openclaw/openclaw#87392
   objective: Verify Telegram usage mode decorates a message-tool-only visible reply.
diff --git a/qa/scenarios/channels/telegram-tools-compact-command.yaml b/qa/scenarios/channels/telegram-tools-compact-command.yaml
index 7a3a9e4b9a63..58b7756036d0 100644
--- a/qa/scenarios/channels/telegram-tools-compact-command.yaml
+++ b/qa/scenarios/channels/telegram-tools-compact-command.yaml
@@ -2,10 +2,11 @@ title: Telegram compact tools command reply
 
 scenario:
   id: telegram-tools-compact-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify Telegram renders the compact model-tool inventory.
   successCriteria:
     - The compact tools command reaches native command dispatch.
diff --git a/qa/scenarios/channels/telegram-whoami-command.yaml b/qa/scenarios/channels/telegram-whoami-command.yaml
index cacd0f412a7a..f6a2f5c017ac 100644
--- a/qa/scenarios/channels/telegram-whoami-command.yaml
+++ b/qa/scenarios/channels/telegram-whoami-command.yaml
@@ -2,10 +2,11 @@ title: Telegram whoami command reply
 
 scenario:
   id: telegram-whoami-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify Telegram command identity includes the active channel context.
   successCriteria:
     - The whoami command returns an identity block.
diff --git a/qa/scenarios/channels/thread-follow-up.yaml b/qa/scenarios/channels/thread-follow-up.yaml
index 30c0b7b52d12..e6c200b14625 100644
--- a/qa/scenarios/channels/thread-follow-up.yaml
+++ b/qa/scenarios/channels/thread-follow-up.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
       - channels.thread-parent-child-placement
+      - channels.native-threads
     secondary:
-      - runtime.delivery
+      - channels.automatic-final-reply
   objective: Verify a follow-up sent inside a thread receives one reply in the same thread.
   successCriteria:
     - The transport accepts a normalized threaded inbound message.
diff --git a/qa/scenarios/channels/thread-isolation.yaml b/qa/scenarios/channels/thread-isolation.yaml
index d1d7abd5b709..b614e8074f7e 100644
--- a/qa/scenarios/channels/thread-isolation.yaml
+++ b/qa/scenarios/channels/thread-isolation.yaml
@@ -5,8 +5,8 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
-      - memory.thread-isolation
+      - channels.native-threads
+      - channels.native-threads-thread-isolation
   objective: Verify a fresh top-level prompt does not inherit the prior thread relation.
   successCriteria:
     - A threaded prompt receives a threaded reply.
diff --git a/qa/scenarios/channels/thread-reply-override.yaml b/qa/scenarios/channels/thread-reply-override.yaml
index 08ce23065d52..a43f5d11ac9b 100644
--- a/qa/scenarios/channels/thread-reply-override.yaml
+++ b/qa/scenarios/channels/thread-reply-override.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.threads
+      - channels.native-threads
   objective: Verify Matrix threadReplies=always converts a top-level inbound message into a native threaded reply.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/webchat-direct-reply-routing.yaml b/qa/scenarios/channels/webchat-direct-reply-routing.yaml
index db50f2610311..b53ee732b3d3 100644
--- a/qa/scenarios/channels/webchat-direct-reply-routing.yaml
+++ b/qa/scenarios/channels/webchat-direct-reply-routing.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.direct-reply-routing
+      - control-ui.chat-send-lifecycle-direct-reply-routing
     secondary:
-      - tools.message
-      - channels.webchat
+      - control-ui.chat-send-lifecycle-message
+      - control-ui.chat-send-lifecycle-webchat
   objective: Verify a current-chat reply is delivered as assistant text, not by calling `message(action=send)` and ending with `Sent.`.
   gatewayConfigPatch:
     session:
diff --git a/qa/scenarios/channels/whatsapp-access-control-dm-disabled.yaml b/qa/scenarios/channels/whatsapp-access-control-dm-disabled.yaml
index 4dc380d03f0b..5809747fe0c8 100644
--- a/qa/scenarios/channels/whatsapp-access-control-dm-disabled.yaml
+++ b/qa/scenarios/channels/whatsapp-access-control-dm-disabled.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   objective: Verify dmPolicy disabled rejects direct messages.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/whatsapp-access-control-dm-open.yaml b/qa/scenarios/channels/whatsapp-access-control-dm-open.yaml
index 2e0abfc068c8..1cd4344c774c 100644
--- a/qa/scenarios/channels/whatsapp-access-control-dm-open.yaml
+++ b/qa/scenarios/channels/whatsapp-access-control-dm-open.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   objective: Verify dmPolicy open accepts a direct message.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/whatsapp-access-control-group-disabled.yaml b/qa/scenarios/channels/whatsapp-access-control-group-disabled.yaml
index 059d15fc8b62..33cb77966090 100644
--- a/qa/scenarios/channels/whatsapp-access-control-group-disabled.yaml
+++ b/qa/scenarios/channels/whatsapp-access-control-group-disabled.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   objective: Verify groupPolicy disabled rejects group messages.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/whatsapp-access-control-group-open.yaml b/qa/scenarios/channels/whatsapp-access-control-group-open.yaml
index aca6f9982ed7..73a613c021ca 100644
--- a/qa/scenarios/channels/whatsapp-access-control-group-open.yaml
+++ b/qa/scenarios/channels/whatsapp-access-control-group-open.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.access-policy
+      - channels.room-allowlist-access-policy
   objective: Verify groupPolicy open accepts a mentioned group message.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/whatsapp-agent-message-action-react.yaml b/qa/scenarios/channels/whatsapp-agent-message-action-react.yaml
index 21b6dea30fc0..5a59eb4d524f 100644
--- a/qa/scenarios/channels/whatsapp-agent-message-action-react.yaml
+++ b/qa/scenarios/channels/whatsapp-agent-message-action-react.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-agent-message-action-react
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.message-actions
   execution:
     profiles: { "whatsapp:mock-default": 10 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-agent-message-action-upload-file.yaml b/qa/scenarios/channels/whatsapp-agent-message-action-upload-file.yaml
index 261a4e7e13f4..e6d6ad3a1173 100644
--- a/qa/scenarios/channels/whatsapp-agent-message-action-upload-file.yaml
+++ b/qa/scenarios/channels/whatsapp-agent-message-action-upload-file.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-agent-message-action-upload-file
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-image
   execution:
     profiles: { "whatsapp:mock-default": 11 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-approval-exec-deny-native.yaml b/qa/scenarios/channels/whatsapp-approval-exec-deny-native.yaml
index f7b08feff61f..d058ff63a269 100644
--- a/qa/scenarios/channels/whatsapp-approval-exec-deny-native.yaml
+++ b/qa/scenarios/channels/whatsapp-approval-exec-deny-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-approval-exec-deny-native
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.native-exec
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-approval-exec-group-reaction-native.yaml b/qa/scenarios/channels/whatsapp-approval-exec-group-reaction-native.yaml
index 78219b117ef2..730e2410e806 100644
--- a/qa/scenarios/channels/whatsapp-approval-exec-group-reaction-native.yaml
+++ b/qa/scenarios/channels/whatsapp-approval-exec-group-reaction-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-approval-exec-group-reaction-native
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.approver-target-resolution
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-approval-exec-native.yaml b/qa/scenarios/channels/whatsapp-approval-exec-native.yaml
index 8746f672cad0..a8d240583503 100644
--- a/qa/scenarios/channels/whatsapp-approval-exec-native.yaml
+++ b/qa/scenarios/channels/whatsapp-approval-exec-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-approval-exec-native
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.native-exec
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-approval-exec-reaction-native.yaml b/qa/scenarios/channels/whatsapp-approval-exec-reaction-native.yaml
index a13589f8b156..19a45bfa7624 100644
--- a/qa/scenarios/channels/whatsapp-approval-exec-reaction-native.yaml
+++ b/qa/scenarios/channels/whatsapp-approval-exec-reaction-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-approval-exec-reaction-native
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.native-exec
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-approval-plugin-native.yaml b/qa/scenarios/channels/whatsapp-approval-plugin-native.yaml
index 1b2c982fbe84..7b1b3bef42bc 100644
--- a/qa/scenarios/channels/whatsapp-approval-plugin-native.yaml
+++ b/qa/scenarios/channels/whatsapp-approval-plugin-native.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-approval-plugin-native
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.native-exec
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-audio-preflight.yaml b/qa/scenarios/channels/whatsapp-audio-preflight.yaml
index 2cbf7d3c59e0..1c247b4f6d8c 100644
--- a/qa/scenarios/channels/whatsapp-audio-preflight.yaml
+++ b/qa/scenarios/channels/whatsapp-audio-preflight.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-audio-preflight
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.inbound-media-download
   execution:
     profiles: { "whatsapp:mock-default": 17 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-broadcast-group-fanout.yaml b/qa/scenarios/channels/whatsapp-broadcast-group-fanout.yaml
index 29e64ffc7bcd..973d83b4dcd7 100644
--- a/qa/scenarios/channels/whatsapp-broadcast-group-fanout.yaml
+++ b/qa/scenarios/channels/whatsapp-broadcast-group-fanout.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-broadcast-group-fanout
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-session-keys
   execution:
     profiles: { "whatsapp:mock-default": 3 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-canary.yaml b/qa/scenarios/channels/whatsapp-canary.yaml
index d64218d49e75..f776d55bcfc4 100644
--- a/qa/scenarios/channels/whatsapp-canary.yaml
+++ b/qa/scenarios/channels/whatsapp-canary.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-canary
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:default": 0, "whatsapp:mock-default": 0 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-commands-command.yaml b/qa/scenarios/channels/whatsapp-commands-command.yaml
index ed69595f6c22..eb26278e0487 100644
--- a/qa/scenarios/channels/whatsapp-commands-command.yaml
+++ b/qa/scenarios/channels/whatsapp-commands-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp commands list reply
 
 scenario:
   id: whatsapp-commands-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp renders the full native command catalog.
   successCriteria:
     - The command catalog is returned in a WhatsApp DM.
diff --git a/qa/scenarios/channels/whatsapp-context-command.yaml b/qa/scenarios/channels/whatsapp-context-command.yaml
index 7502459db7a2..aece59ca493a 100644
--- a/qa/scenarios/channels/whatsapp-context-command.yaml
+++ b/qa/scenarios/channels/whatsapp-context-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp context command reply
 
 scenario:
   id: whatsapp-context-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp returns the current context breakdown.
   successCriteria:
     - The context list command succeeds in a WhatsApp DM.
diff --git a/qa/scenarios/channels/whatsapp-group-activation-always.yaml b/qa/scenarios/channels/whatsapp-group-activation-always.yaml
index 9035645bb69e..cfc36fa7aaa7 100644
--- a/qa/scenarios/channels/whatsapp-group-activation-always.yaml
+++ b/qa/scenarios/channels/whatsapp-group-activation-always.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-activation-always
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-allowlists
   execution:
     profiles: { "whatsapp:mock-default": 4 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-agent-message-action-react.yaml b/qa/scenarios/channels/whatsapp-group-agent-message-action-react.yaml
index 2e2e47b85cfc..80182c107a24 100644
--- a/qa/scenarios/channels/whatsapp-group-agent-message-action-react.yaml
+++ b/qa/scenarios/channels/whatsapp-group-agent-message-action-react.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-agent-message-action-react
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.message-actions
   execution:
     profiles: { "whatsapp:mock-default": 12 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-agent-message-action-upload-file.yaml b/qa/scenarios/channels/whatsapp-group-agent-message-action-upload-file.yaml
index 26968cbfe465..f8d47e34bdad 100644
--- a/qa/scenarios/channels/whatsapp-group-agent-message-action-upload-file.yaml
+++ b/qa/scenarios/channels/whatsapp-group-agent-message-action-upload-file.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-agent-message-action-upload-file
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-image
   execution:
     profiles: { "whatsapp:mock-default": 13 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-allowlist-block.yaml b/qa/scenarios/channels/whatsapp-group-allowlist-block.yaml
index fc5c4193ee42..73da02f41717 100644
--- a/qa/scenarios/channels/whatsapp-group-allowlist-block.yaml
+++ b/qa/scenarios/channels/whatsapp-group-allowlist-block.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-allowlist-block
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-allowlists
   execution:
     profiles: { "whatsapp:default": 6, "whatsapp:mock-default": 31 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-audio-gating.yaml b/qa/scenarios/channels/whatsapp-group-audio-gating.yaml
index 4f1342f50dcf..244de8d37dbe 100644
--- a/qa/scenarios/channels/whatsapp-group-audio-gating.yaml
+++ b/qa/scenarios/channels/whatsapp-group-audio-gating.yaml
@@ -3,7 +3,9 @@ scenario:
   id: whatsapp-group-audio-gating
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-allowlists
+      - whatsapp.inbound-media-download
   execution:
     profiles: { "whatsapp:mock-default": 26 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-outbound-audio.yaml b/qa/scenarios/channels/whatsapp-group-outbound-audio.yaml
index e30c01c2cd7d..35ec89a5f06d 100644
--- a/qa/scenarios/channels/whatsapp-group-outbound-audio.yaml
+++ b/qa/scenarios/channels/whatsapp-group-outbound-audio.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-outbound-audio
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-audio
   execution:
     profiles: { "whatsapp:mock-default": 22 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-outbound-media.yaml b/qa/scenarios/channels/whatsapp-group-outbound-media.yaml
index 61d5b58b61e1..0e30570b6e5a 100644
--- a/qa/scenarios/channels/whatsapp-group-outbound-media.yaml
+++ b/qa/scenarios/channels/whatsapp-group-outbound-media.yaml
@@ -3,7 +3,9 @@ scenario:
   id: whatsapp-group-outbound-media
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-image
+      - whatsapp.outbound-document
   execution:
     profiles: { "whatsapp:mock-default": 21 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-outbound-poll.yaml b/qa/scenarios/channels/whatsapp-group-outbound-poll.yaml
index 65a60bd546fd..acb6a153c706 100644
--- a/qa/scenarios/channels/whatsapp-group-outbound-poll.yaml
+++ b/qa/scenarios/channels/whatsapp-group-outbound-poll.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-outbound-poll
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.provider-specific-channeldata
   execution:
     profiles: { "whatsapp:mock-default": 23 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-pending-history-context.yaml b/qa/scenarios/channels/whatsapp-group-pending-history-context.yaml
index 0c17dbf26d26..7031871ae3ed 100644
--- a/qa/scenarios/channels/whatsapp-group-pending-history-context.yaml
+++ b/qa/scenarios/channels/whatsapp-group-pending-history-context.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-pending-history-context
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-session-keys
   execution:
     profiles: { "whatsapp:mock-default": 2 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-reply-to-bot-triggers.yaml b/qa/scenarios/channels/whatsapp-group-reply-to-bot-triggers.yaml
index f99a961f7a2a..489aba9d87e9 100644
--- a/qa/scenarios/channels/whatsapp-group-reply-to-bot-triggers.yaml
+++ b/qa/scenarios/channels/whatsapp-group-reply-to-bot-triggers.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-reply-to-bot-triggers
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-allowlists
   execution:
     profiles: { "whatsapp:mock-default": 5 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-group-reply-to-message.yaml b/qa/scenarios/channels/whatsapp-group-reply-to-message.yaml
index 291b30d480af..894b87bec6c2 100644
--- a/qa/scenarios/channels/whatsapp-group-reply-to-message.yaml
+++ b/qa/scenarios/channels/whatsapp-group-reply-to-message.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-group-reply-to-message
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:default": 4, "whatsapp:mock-default": 8 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-help-command.yaml b/qa/scenarios/channels/whatsapp-help-command.yaml
index dec511a75e26..85a0592d127c 100644
--- a/qa/scenarios/channels/whatsapp-help-command.yaml
+++ b/qa/scenarios/channels/whatsapp-help-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp help command reply
 
 scenario:
   id: whatsapp-help-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp help returns the concise command guide.
   successCriteria:
     - The help command is accepted in a WhatsApp DM.
diff --git a/qa/scenarios/channels/whatsapp-inbound-image-caption.yaml b/qa/scenarios/channels/whatsapp-inbound-image-caption.yaml
index 5699ae1a34b9..8aa9448ca3e4 100644
--- a/qa/scenarios/channels/whatsapp-inbound-image-caption.yaml
+++ b/qa/scenarios/channels/whatsapp-inbound-image-caption.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-inbound-image-caption
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.inbound-media-download
   execution:
     profiles: { "whatsapp:mock-default": 16 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-inbound-reaction-no-trigger.yaml b/qa/scenarios/channels/whatsapp-inbound-reaction-no-trigger.yaml
index 706182f42096..1f67d156f476 100644
--- a/qa/scenarios/channels/whatsapp-inbound-reaction-no-trigger.yaml
+++ b/qa/scenarios/channels/whatsapp-inbound-reaction-no-trigger.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-inbound-reaction-no-trigger
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.message-actions
   execution:
     profiles: { "whatsapp:mock-default": 14 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-inbound-structured-messages.yaml b/qa/scenarios/channels/whatsapp-inbound-structured-messages.yaml
index 637afa34a739..14492207cdfe 100644
--- a/qa/scenarios/channels/whatsapp-inbound-structured-messages.yaml
+++ b/qa/scenarios/channels/whatsapp-inbound-structured-messages.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-inbound-structured-messages
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.provider-specific-channeldata
   execution:
     profiles: { "whatsapp:mock-default": 25 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-mention-gating.yaml b/qa/scenarios/channels/whatsapp-mention-gating.yaml
index d0d4bca0b4c1..f9e0711f6328 100644
--- a/qa/scenarios/channels/whatsapp-mention-gating.yaml
+++ b/qa/scenarios/channels/whatsapp-mention-gating.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-mention-gating
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.group-allowlists
   execution:
     profiles: { "whatsapp:default": 1, "whatsapp:mock-default": 1 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-message-actions.yaml b/qa/scenarios/channels/whatsapp-message-actions.yaml
index 942f23dfbc68..4d269e7f6360 100644
--- a/qa/scenarios/channels/whatsapp-message-actions.yaml
+++ b/qa/scenarios/channels/whatsapp-message-actions.yaml
@@ -3,7 +3,9 @@ scenario:
   id: whatsapp-message-actions
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.message-actions
+      - whatsapp.outbound-image
   execution:
     profiles: { "whatsapp:mock-default": 24 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-native-new-command.yaml b/qa/scenarios/channels/whatsapp-native-new-command.yaml
index b66881948dd0..27ad0cb9ca03 100644
--- a/qa/scenarios/channels/whatsapp-native-new-command.yaml
+++ b/qa/scenarios/channels/whatsapp-native-new-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp new-session command
 
 scenario:
   id: whatsapp-native-new-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp `/new` starts a new session through native command dispatch.
   successCriteria:
     - The `/new` command is accepted in a WhatsApp DM.
diff --git a/qa/scenarios/channels/whatsapp-outbound-document-preserves-filename.yaml b/qa/scenarios/channels/whatsapp-outbound-document-preserves-filename.yaml
index ff5e9367a1bc..b2c46298784e 100644
--- a/qa/scenarios/channels/whatsapp-outbound-document-preserves-filename.yaml
+++ b/qa/scenarios/channels/whatsapp-outbound-document-preserves-filename.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-outbound-document-preserves-filename
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-document
   execution:
     profiles: { "whatsapp:mock-default": 19 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-outbound-media-matrix.yaml b/qa/scenarios/channels/whatsapp-outbound-media-matrix.yaml
index fa215875371b..30052bdffa33 100644
--- a/qa/scenarios/channels/whatsapp-outbound-media-matrix.yaml
+++ b/qa/scenarios/channels/whatsapp-outbound-media-matrix.yaml
@@ -3,7 +3,10 @@ scenario:
   id: whatsapp-outbound-media-matrix
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-image
+      - whatsapp.outbound-document
+      - whatsapp.outbound-audio
   execution:
     profiles: { "whatsapp:mock-default": 18 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-outbound-poll.yaml b/qa/scenarios/channels/whatsapp-outbound-poll.yaml
index 12009be903dc..ad699ce9043b 100644
--- a/qa/scenarios/channels/whatsapp-outbound-poll.yaml
+++ b/qa/scenarios/channels/whatsapp-outbound-poll.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-outbound-poll
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.provider-specific-channeldata
   execution:
     profiles: { "whatsapp:mock-default": 20 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-outbound-send-serialization.yaml b/qa/scenarios/channels/whatsapp-outbound-send-serialization.yaml
index 171ef8a945e3..99a7f006b085 100644
--- a/qa/scenarios/channels/whatsapp-outbound-send-serialization.yaml
+++ b/qa/scenarios/channels/whatsapp-outbound-send-serialization.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-outbound-send-serialization
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     kind: flow
     channel: whatsapp
diff --git a/qa/scenarios/channels/whatsapp-pairing-block.yaml b/qa/scenarios/channels/whatsapp-pairing-block.yaml
index 3337829cb094..d4fffbab7522 100644
--- a/qa/scenarios/channels/whatsapp-pairing-block.yaml
+++ b/qa/scenarios/channels/whatsapp-pairing-block.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.pairing-gate
+      - channels.dm-pairing-pairing-gate
   objective: Verify an unpaired WhatsApp DM receives the pairing gate instead of reaching the agent.
   gatewayConfigPatch:
     channels:
diff --git a/qa/scenarios/channels/whatsapp-reply-context-isolation.yaml b/qa/scenarios/channels/whatsapp-reply-context-isolation.yaml
index c8bf751f54e7..eea4df2bf67a 100644
--- a/qa/scenarios/channels/whatsapp-reply-context-isolation.yaml
+++ b/qa/scenarios/channels/whatsapp-reply-context-isolation.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-reply-context-isolation
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:mock-default": 15 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-reply-delivery-shape.yaml b/qa/scenarios/channels/whatsapp-reply-delivery-shape.yaml
index 9f0cab4ccce6..b01192d49da3 100644
--- a/qa/scenarios/channels/whatsapp-reply-delivery-shape.yaml
+++ b/qa/scenarios/channels/whatsapp-reply-delivery-shape.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-reply-delivery-shape
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:mock-default": 27 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-reply-to-message.yaml b/qa/scenarios/channels/whatsapp-reply-to-message.yaml
index b2d45b2191dd..6cc66487c86b 100644
--- a/qa/scenarios/channels/whatsapp-reply-to-message.yaml
+++ b/qa/scenarios/channels/whatsapp-reply-to-message.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-reply-to-message
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:default": 3, "whatsapp:mock-default": 7 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-reply-to-mode-batched.yaml b/qa/scenarios/channels/whatsapp-reply-to-mode-batched.yaml
index c390a4ea6191..bf36c7c4eeb6 100644
--- a/qa/scenarios/channels/whatsapp-reply-to-mode-batched.yaml
+++ b/qa/scenarios/channels/whatsapp-reply-to-mode-batched.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-reply-to-mode-batched
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:mock-default": 9 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-restart-resume.yaml b/qa/scenarios/channels/whatsapp-restart-resume.yaml
index 4c30f20ff621..07b2af0a024e 100644
--- a/qa/scenarios/channels/whatsapp-restart-resume.yaml
+++ b/qa/scenarios/channels/whatsapp-restart-resume.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: channels
   coverage:
     primary:
-      - channels.restart-resume
+      - channels.resumed-final-reply
   objective: Verify channel delivery resumes after a Gateway restart without replaying completed delivery.
   successCriteria:
     - A reply is delivered before restart.
diff --git a/qa/scenarios/channels/whatsapp-status-command.yaml b/qa/scenarios/channels/whatsapp-status-command.yaml
index b45521f8e30f..f205d1d70379 100644
--- a/qa/scenarios/channels/whatsapp-status-command.yaml
+++ b/qa/scenarios/channels/whatsapp-status-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp status command reply
 
 scenario:
   id: whatsapp-status-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp status returns the active session summary.
   successCriteria:
     - The status command succeeds in a WhatsApp DM.
diff --git a/qa/scenarios/channels/whatsapp-status-reaction-lifecycle.yaml b/qa/scenarios/channels/whatsapp-status-reaction-lifecycle.yaml
index c116a9164a6d..8d1101199316 100644
--- a/qa/scenarios/channels/whatsapp-status-reaction-lifecycle.yaml
+++ b/qa/scenarios/channels/whatsapp-status-reaction-lifecycle.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-status-reaction-lifecycle
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.reply-message-actions
   execution:
     profiles: { "whatsapp:mock-default": 30 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-status-reactions.yaml b/qa/scenarios/channels/whatsapp-status-reactions.yaml
index 19dae841ed5e..bc1027783ac7 100644
--- a/qa/scenarios/channels/whatsapp-status-reactions.yaml
+++ b/qa/scenarios/channels/whatsapp-status-reactions.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-status-reactions
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - channels.reply-message-actions
   execution:
     profiles: { "whatsapp:default": 5, "whatsapp:mock-default": 29 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-stream-final-message-accounting.yaml b/qa/scenarios/channels/whatsapp-stream-final-message-accounting.yaml
index dfdd5c6de87c..875a54ab01e5 100644
--- a/qa/scenarios/channels/whatsapp-stream-final-message-accounting.yaml
+++ b/qa/scenarios/channels/whatsapp-stream-final-message-accounting.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-stream-final-message-accounting
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:mock-default": 28 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-tool-only-usage-footer.yaml b/qa/scenarios/channels/whatsapp-tool-only-usage-footer.yaml
index 7a448e0460c0..1fd6f03b6013 100644
--- a/qa/scenarios/channels/whatsapp-tool-only-usage-footer.yaml
+++ b/qa/scenarios/channels/whatsapp-tool-only-usage-footer.yaml
@@ -2,11 +2,13 @@ title: WhatsApp tool-only usage footer
 
 scenario:
   id: whatsapp-tool-only-usage-footer
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [telemetry.model-usage]
-    secondary: [channels.native-commands]
+    primary:
+      - observability.model-usage
+    secondary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp usage mode decorates a message-tool-only visible reply.
   successCriteria:
     - The usage command enables token footer mode.
diff --git a/qa/scenarios/channels/whatsapp-tools-compact-command.yaml b/qa/scenarios/channels/whatsapp-tools-compact-command.yaml
index 2a2e3e585355..68f1a6bffb2e 100644
--- a/qa/scenarios/channels/whatsapp-tools-compact-command.yaml
+++ b/qa/scenarios/channels/whatsapp-tools-compact-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp compact tools command reply
 
 scenario:
   id: whatsapp-tools-compact-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp renders the compact model-tool inventory.
   successCriteria:
     - The compact tools command reaches native command dispatch.
diff --git a/qa/scenarios/channels/whatsapp-top-level-reply-shape.yaml b/qa/scenarios/channels/whatsapp-top-level-reply-shape.yaml
index 3f2a890a4154..e2db4ef4d4e7 100644
--- a/qa/scenarios/channels/whatsapp-top-level-reply-shape.yaml
+++ b/qa/scenarios/channels/whatsapp-top-level-reply-shape.yaml
@@ -3,7 +3,8 @@ scenario:
   id: whatsapp-top-level-reply-shape
   surface: channels
   coverage:
-    primary: [channels.group-messages]
+    primary:
+      - whatsapp.outbound-text-sends
   execution:
     profiles: { "whatsapp:default": 2, "whatsapp:mock-default": 6 }
     kind: flow
diff --git a/qa/scenarios/channels/whatsapp-whoami-command.yaml b/qa/scenarios/channels/whatsapp-whoami-command.yaml
index a5ccd476cb62..5542a88faf74 100644
--- a/qa/scenarios/channels/whatsapp-whoami-command.yaml
+++ b/qa/scenarios/channels/whatsapp-whoami-command.yaml
@@ -2,10 +2,11 @@ title: WhatsApp whoami command reply
 
 scenario:
   id: whatsapp-whoami-command
-  surface: channel-framework
-  category: channel-framework.channel-actions-commands-and-approvals
+  surface: channels
+  category: channels.channel-actions-commands-and-approvals
   coverage:
-    primary: [channels.native-commands]
+    primary:
+      - channels.channel-native-commands
   objective: Verify WhatsApp command identity includes channel and allowlist context.
   successCriteria:
     - The whoami command returns an identity block.
diff --git a/qa/scenarios/character/character-vibes-c3po.yaml b/qa/scenarios/character/character-vibes-c3po.yaml
index 21e0574f273c..8565d812628a 100644
--- a/qa/scenarios/character/character-vibes-c3po.yaml
+++ b/qa/scenarios/character/character-vibes-c3po.yaml
@@ -5,9 +5,7 @@ scenario:
   surface: character
   coverage:
     primary:
-      - character.persona
-    secondary:
-      - workspace.artifacts
+      - session-memory.instruction-profile-persona
   objective: Capture a natural multi-turn C-3PO-flavored character conversation with real workspace help so another model can later grade naturalness, vibe, and funniness from the raw transcript.
   successCriteria:
     - Agent gets a natural multi-turn conversation, and any missed replies stay visible in the transcript instead of aborting capture.
diff --git a/qa/scenarios/character/character-vibes-gollum.yaml b/qa/scenarios/character/character-vibes-gollum.yaml
index 13b174bcccd3..cc61cbfc331e 100644
--- a/qa/scenarios/character/character-vibes-gollum.yaml
+++ b/qa/scenarios/character/character-vibes-gollum.yaml
@@ -5,9 +5,7 @@ scenario:
   surface: character
   coverage:
     primary:
-      - character.persona
-    secondary:
-      - workspace.artifacts
+      - session-memory.instruction-profile-persona
   objective: Capture a natural multi-turn character conversation with real workspace help so another model can later grade naturalness, vibe, and funniness from the raw transcript.
   successCriteria:
     - Agent gets a natural multi-turn conversation, and any missed replies stay visible in the transcript instead of aborting capture.
diff --git a/qa/scenarios/config/cli-channel-picker.yaml b/qa/scenarios/config/cli-channel-picker.yaml
index e5f0cbf68994..38695ed876c9 100644
--- a/qa/scenarios/config/cli-channel-picker.yaml
+++ b/qa/scenarios/config/cli-channel-picker.yaml
@@ -2,8 +2,8 @@ title: CLI channel picker
 
 scenario:
   id: cli-channel-picker
-  surface: cli-install-update-onboard-doctor
-  category: cli-install-update-onboard-doctor.plugin-and-channel-setup
+  surface: cli
+  category: cli.plugin-and-channel-setup
   coverage:
     primary:
       - cli.channel-picker
diff --git a/qa/scenarios/config/config-apply-restart-wakeup.yaml b/qa/scenarios/config/config-apply-restart-wakeup.yaml
index 4c9040f50b58..6749d1e4b849 100644
--- a/qa/scenarios/config/config-apply-restart-wakeup.yaml
+++ b/qa/scenarios/config/config-apply-restart-wakeup.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: config
   coverage:
     primary:
-      - config.restart-apply
+      - gateway.restart-and-stop-restart-apply
     secondary:
-      - runtime.gateway-restart
+      - gateway.restart-and-stop-gateway-restart
   objective: Verify a restart-required config.apply restarts cleanly and delivers the post-restart wake message back into the QA channel.
   successCriteria:
     - config.apply schedules a restart-required change.
diff --git a/qa/scenarios/config/config-patch-hot-apply.yaml b/qa/scenarios/config/config-patch-hot-apply.yaml
index 07fdd58e47c0..8337d7e3ec1b 100644
--- a/qa/scenarios/config/config-patch-hot-apply.yaml
+++ b/qa/scenarios/config/config-patch-hot-apply.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: config
   coverage:
     primary:
-      - config.hot-apply
+      - gateway.config-reload-hot-apply
     secondary:
-      - plugins.skills
+      - plugins.activation-skills
   objective: Verify config.patch can disable a workspace skill and the restarted gateway exposes the new disabled state cleanly.
   successCriteria:
     - config.patch succeeds for the skill toggle change.
diff --git a/qa/scenarios/config/config-restart-capability-flip.yaml b/qa/scenarios/config/config-restart-capability-flip.yaml
index dc53d17cd9ce..d6196774daf7 100644
--- a/qa/scenarios/config/config-restart-capability-flip.yaml
+++ b/qa/scenarios/config/config-restart-capability-flip.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: config
   coverage:
     primary:
-      - config.restart-apply
+      - gateway.restart-and-stop-restart-apply
     secondary:
-      - plugins.capabilities
+      - plugins.mixed-plugin-capabilities
   objective: Verify a restart-triggering config change flips capability inventory and the same session successfully uses the newly restored tool after wake-up.
   successCriteria:
     - Capability is absent before the restart-triggering patch.
diff --git a/qa/scenarios/config/system-agent-ring-zero-setup.yaml b/qa/scenarios/config/system-agent-ring-zero-setup.yaml
index 05acb2e304f8..b86f69ce9449 100644
--- a/qa/scenarios/config/system-agent-ring-zero-setup.yaml
+++ b/qa/scenarios/config/system-agent-ring-zero-setup.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: config
   coverage:
     secondary:
-      - config.system-agent-setup
-      - channels.discord-config
-      - agents.create
+      - channels.setup-onboarding-flows-system-agent-setup
+      - discord.token-and-application-id-configuration
+      - channels.setup-onboarding-flows-create
   objective: Verify the package-installed OpenClaw inference gate and supporting one-shot setup operations, without claiming the interactive agent/tool/approval flow.
   successCriteria:
     - OpenClaw fails closed in an empty state dir and directs the user to inference onboarding.
diff --git a/qa/scenarios/goals/goal-context-next-turn.yaml b/qa/scenarios/goals/goal-context-next-turn.yaml
index 8928320e4657..49ba8d4d03ea 100644
--- a/qa/scenarios/goals/goal-context-next-turn.yaml
+++ b/qa/scenarios/goals/goal-context-next-turn.yaml
@@ -3,12 +3,12 @@ title: Active goal context on the next turn
 scenario:
   id: goal-context-next-turn
   surface: goals
-  category: session-memory-and-context-engine.context-engine
+  category: session-memory.context-engine
   coverage:
     primary:
-      - goals.context-injection
+      - session-memory.goal-continuance-context-injection
     secondary:
-      - goals.continuance
+      - session-memory.goal-continuance-continuance
   objective: Verify an active session goal is injected into the next unrelated turn sent to the model.
   successCriteria:
     - An authorized channel turn starts a session goal through the public `/goal start` command.
diff --git a/qa/scenarios/goals/goal-context-survives-compaction.yaml b/qa/scenarios/goals/goal-context-survives-compaction.yaml
index 83a24f21db48..a2031f1b17cb 100644
--- a/qa/scenarios/goals/goal-context-survives-compaction.yaml
+++ b/qa/scenarios/goals/goal-context-survives-compaction.yaml
@@ -3,13 +3,13 @@ title: Active goal context survives compaction
 scenario:
   id: goal-context-survives-compaction
   surface: goals
-  category: session-memory-and-context-engine.context-engine
+  category: session-memory.context-engine
   coverage:
     primary:
-      - goals.context-injection
+      - session-memory.goal-continuance-context-injection
     secondary:
-      - goals.continuance
-      - runtime.compaction
+      - session-memory.goal-continuance-continuance
+      - session-memory.compaction
   objective: Verify compaction does not remove active session-goal context from the next model turn.
   successCriteria:
     - An authorized channel turn starts a session goal through `/goal start`.
diff --git a/qa/scenarios/goals/goal-followthrough-live.yaml b/qa/scenarios/goals/goal-followthrough-live.yaml
index fa39e766031c..e12697cd61a4 100644
--- a/qa/scenarios/goals/goal-followthrough-live.yaml
+++ b/qa/scenarios/goals/goal-followthrough-live.yaml
@@ -3,14 +3,13 @@ title: Active goal followthrough on bare continue
 scenario:
   id: goal-followthrough-live
   surface: goals
-  category: session-memory-and-context-engine.context-engine
+  category: session-memory.context-engine
   runtimeParityTier: live-only
   coverage:
     primary:
-      - goals.continuance
+      - session-memory.goal-continuance-continuance
     secondary:
-      - goals.context-injection
-      - runtime.first-action
+      - session-memory.goal-continuance-context-injection
   objective: Verify a live model advances the next concrete step of an active multi-step goal on a later bare continue turn.
   successCriteria:
     - The first goal turn acknowledges the staged first step without creating the second-step artifact early.
diff --git a/qa/scenarios/index.yaml b/qa/scenarios/index.yaml
index e7f97d0602da..180ea313ad79 100644
--- a/qa/scenarios/index.yaml
+++ b/qa/scenarios/index.yaml
@@ -17,8 +17,8 @@ title: OpenClaw QA Scenario Pack
 #
 # - use `coverage.primary` only for evidence that executes the required product boundary
 # - use `coverage.secondary` for helper or supporting evidence; it may stand alone
-# - keep IDs behavior-shaped, broad enough to reuse, lowercase, and dotted
-#   as `namespace.behavior`, with dashes allowed inside each segment
+# - keep IDs behavior-shaped, broad enough to reuse, lowercase, and exactly
+#   `surface.feature`, with dashes allowed inside each segment
 # - use the exact values listed under feature `coverageIds` in `taxonomy.yaml`
 # - taxonomy feature coverage IDs are exact proof targets, not aliases
 # - scenario primary can list multiple IDs only when this scenario is primary
diff --git a/qa/scenarios/media/hosted-image-generation-providers-live.yaml b/qa/scenarios/media/hosted-image-generation-providers-live.yaml
index 420215eef72a..1f61b6234239 100644
--- a/qa/scenarios/media/hosted-image-generation-providers-live.yaml
+++ b/qa/scenarios/media/hosted-image-generation-providers-live.yaml
@@ -2,8 +2,8 @@ title: Hosted image generation providers live
 
 scenario:
   id: hosted-image-generation-providers-live
-  surface: long-tail-hosted-providers
-  category: long-tail-hosted-providers.hosted-media-providers
+  surface: hosted-providers
+  category: hosted-providers.hosted-media-providers
   runtimeParityTier: live-only
   coverage:
     primary:
diff --git a/qa/scenarios/media/hosted-video-generation-providers-live.yaml b/qa/scenarios/media/hosted-video-generation-providers-live.yaml
index c76ecdc80491..702fb4db8508 100644
--- a/qa/scenarios/media/hosted-video-generation-providers-live.yaml
+++ b/qa/scenarios/media/hosted-video-generation-providers-live.yaml
@@ -2,8 +2,8 @@ title: Hosted video generation providers live
 
 scenario:
   id: hosted-video-generation-providers-live
-  surface: long-tail-hosted-providers
-  category: long-tail-hosted-providers.hosted-media-providers
+  surface: hosted-providers
+  category: hosted-providers.hosted-media-providers
   runtimeParityTier: live-only
   coverage:
     primary:
diff --git a/qa/scenarios/media/image-generation-roundtrip.yaml b/qa/scenarios/media/image-generation-roundtrip.yaml
index 7f22994c7a24..989d46daab02 100644
--- a/qa/scenarios/media/image-generation-roundtrip.yaml
+++ b/qa/scenarios/media/image-generation-roundtrip.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: image-generation
   coverage:
     primary:
-      - media.image-generation
-      - media.image-generation-delivery
+      - media.generated-image-persistence-and-delivery
+      - media.image-tool-image-generation
     secondary:
-      - channels.qa-channel
+      - channels.qa-channel-outbound
   objective: Verify a generated image is saved as media, reattached on the next turn, and described correctly through the vision path.
   successCriteria:
     - image_generate produces a saved MEDIA artifact.
diff --git a/qa/scenarios/media/image-understanding-attachment.yaml b/qa/scenarios/media/image-understanding-attachment.yaml
index 1b9f001cd390..edb9f98c0542 100644
--- a/qa/scenarios/media/image-understanding-attachment.yaml
+++ b/qa/scenarios/media/image-understanding-attachment.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: image-understanding
   coverage:
     primary:
-      - media.image-understanding
+      - media.image-summary-image-understanding
     secondary:
-      - channels.qa-channel
+      - channels.inbound-routing-qa-channel
   objective: Verify an attached image reaches the agent model and the agent can describe what it sees.
   successCriteria:
     - Agent receives at least one image attachment.
diff --git a/qa/scenarios/media/native-image-generation.yaml b/qa/scenarios/media/native-image-generation.yaml
index 7da28aeccbf4..063715176a5a 100644
--- a/qa/scenarios/media/native-image-generation.yaml
+++ b/qa/scenarios/media/native-image-generation.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: image-generation
   coverage:
     primary:
-      - media.image-generation
+      - media.image-routing
     secondary:
-      - tools.native-image-generation
+      - media.image-routing-native-image-generation
   objective: Verify image_generate appears when configured, returns a real saved media artifact, and delivers it once.
   successCriteria:
     - image_generate appears in the effective tool inventory.
diff --git a/qa/scenarios/media/webchat-auto-tts.yaml b/qa/scenarios/media/webchat-auto-tts.yaml
index 4f1c93a65a55..beec6dcd29f6 100644
--- a/qa/scenarios/media/webchat-auto-tts.yaml
+++ b/qa/scenarios/media/webchat-auto-tts.yaml
@@ -2,8 +2,8 @@ title: WebChat auto TTS delivery
 
 scenario:
   id: webchat-auto-tts
-  surface: media-understanding-and-media-generation
-  category: media-understanding-and-media-generation.text-to-speech-delivery
+  surface: media
+  category: media.text-to-speech-delivery
   coverage:
     primary:
       - media.tts
diff --git a/qa/scenarios/memory/active-memory-preprompt-recall.yaml b/qa/scenarios/memory/active-memory-preprompt-recall.yaml
index cb530738e367..652602872fb7 100644
--- a/qa/scenarios/memory/active-memory-preprompt-recall.yaml
+++ b/qa/scenarios/memory/active-memory-preprompt-recall.yaml
@@ -2,12 +2,12 @@ title: Active Memory pre-reply recall
 
 scenario:
   id: active-memory-preprompt-recall
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.active-recall
+      - session-memory.active-memory-active-recall
     secondary:
-      - memory.recall
+      - session-memory.active-memory-recall
   objective: Verify Active Memory surfaces a memory-only preference before the main reply, and that the same question stays unresolved when the plugin is off.
   plugins:
     - active-memory
diff --git a/qa/scenarios/memory/commitments-heartbeat-target-none.yaml b/qa/scenarios/memory/commitments-heartbeat-target-none.yaml
index c028564aea36..d5b72c9b9b75 100644
--- a/qa/scenarios/memory/commitments-heartbeat-target-none.yaml
+++ b/qa/scenarios/memory/commitments-heartbeat-target-none.yaml
@@ -2,13 +2,13 @@ title: Commitments heartbeat target none
 
 scenario:
   id: commitments-heartbeat-target-none
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - commitments.heartbeat-target-none
+      - automation.commitment-check-ins-heartbeat-target-none
     secondary:
-      - commitments.scope
-      - runtime.delivery
+      - automation.commitment-check-ins-scope
+      - automation.commitment-check-ins-delivery
   objective: Verify due inferred commitments stay internal when heartbeat delivery target is none.
   successCriteria:
     - Scenario runs through qa-channel and a real gateway child.
diff --git a/qa/scenarios/memory/dreaming-shadow-trial-report.yaml b/qa/scenarios/memory/dreaming-shadow-trial-report.yaml
index e4367ef53ddc..fcd0860ac291 100644
--- a/qa/scenarios/memory/dreaming-shadow-trial-report.yaml
+++ b/qa/scenarios/memory/dreaming-shadow-trial-report.yaml
@@ -2,13 +2,13 @@ title: Dreaming shadow trial report
 
 scenario:
   id: dreaming-shadow-trial-report
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.dreaming
+      - session-memory.memory-files-dreaming
     secondary:
-      - memory.promotion
-      - qa.artifact-safety
+      - session-memory.memory-files-promotion
+      - session-memory.memory-files-artifact-safety
   risk: medium
   capabilities:
     - tools.read
diff --git a/qa/scenarios/memory/memory-dreaming-sweep.yaml b/qa/scenarios/memory/memory-dreaming-sweep.yaml
index 7ea2cfb87639..e98bab25f0a0 100644
--- a/qa/scenarios/memory/memory-dreaming-sweep.yaml
+++ b/qa/scenarios/memory/memory-dreaming-sweep.yaml
@@ -2,10 +2,10 @@ title: Memory dreaming sweep
 
 scenario:
   id: memory-dreaming-sweep
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.dreaming
+      - session-memory.memory-files-dreaming
   objective: Verify enabling dreaming creates the managed sweep, stages light and REM artifacts, and consolidates repeated recall signals into durable memory.
   successCriteria:
     - Dreaming can be enabled and doctor.memory.status reports the managed sweep cron.
diff --git a/qa/scenarios/memory/memory-failure-fallback.yaml b/qa/scenarios/memory/memory-failure-fallback.yaml
index fa3e24722ce2..abc849135763 100644
--- a/qa/scenarios/memory/memory-failure-fallback.yaml
+++ b/qa/scenarios/memory/memory-failure-fallback.yaml
@@ -2,12 +2,10 @@ title: "Memory failure fallback"
 
 scenario:
   id: memory-failure-fallback
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.failure-handling
-    secondary:
-      - runtime.fallbacks
+      - agent-runtime.tool-availability-rules-tool-policy
   objective: Verify the agent degrades gracefully when memory tools are unavailable and the answer exists only in memory-backed notes.
   successCriteria:
     - Memory tools are absent from the effective tool inventory.
diff --git a/qa/scenarios/memory/memory-recall.yaml b/qa/scenarios/memory/memory-recall.yaml
index 168d754d2554..4aa8cffa0135 100644
--- a/qa/scenarios/memory/memory-recall.yaml
+++ b/qa/scenarios/memory/memory-recall.yaml
@@ -31,10 +31,10 @@ title: Memory recall after context switch
 
 scenario:
   id: memory-recall
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.recall
+      - session-memory.memory-recall
   objective: Verify the agent can store a fact, switch topics, then recall the fact accurately later.
   successCriteria:
     - Agent acknowledges the seeded fact.
diff --git a/qa/scenarios/memory/memory-tools-channel-context.yaml b/qa/scenarios/memory/memory-tools-channel-context.yaml
index 219e340b7906..ac9135327dd0 100644
--- a/qa/scenarios/memory/memory-tools-channel-context.yaml
+++ b/qa/scenarios/memory/memory-tools-channel-context.yaml
@@ -2,12 +2,12 @@ title: Memory tools in channel context
 
 scenario:
   id: memory-tools-channel-context
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.tools
+      - session-memory.memory-tools
     secondary:
-      - channels.group-messages
+      - channels.room-session-group-messages
   objective: Verify the agent uses memory tools in a shared channel when the answer lives only in memory files, not the live transcript.
   successCriteria:
     - Agent uses memory_search before answering.
diff --git a/qa/scenarios/memory/remember-across-conversations.yaml b/qa/scenarios/memory/remember-across-conversations.yaml
index a8655f5050eb..7c8a3905f4b6 100644
--- a/qa/scenarios/memory/remember-across-conversations.yaml
+++ b/qa/scenarios/memory/remember-across-conversations.yaml
@@ -2,14 +2,14 @@ title: Remember across conversations
 
 scenario:
   id: remember-across-conversations
-  surface: memory
+  surface: session-memory
   risk: high
   coverage:
     primary:
-      - memory.active-recall
+      - session-memory.active-memory-active-recall
     secondary:
-      - memory.recall
-      - channels.qa-channel
+      - session-memory.active-memory-recall
+      - session-memory.active-memory-qa-channel
   objective: Verify bounded private transcript recall across separate conversations without crossing shared, anchor, disabled, or paused conversation boundaries.
   plugins:
     - active-memory
diff --git a/qa/scenarios/memory/session-memory-ranking.yaml b/qa/scenarios/memory/session-memory-ranking.yaml
index 40020a9ad9a9..1d10b702fb05 100644
--- a/qa/scenarios/memory/session-memory-ranking.yaml
+++ b/qa/scenarios/memory/session-memory-ranking.yaml
@@ -2,12 +2,12 @@ title: Session memory ranking
 
 scenario:
   id: session-memory-ranking
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.ranking
+      - session-memory.embedding-search-ranking
     secondary:
-      - memory.recall
+      - session-memory.embedding-search-recall
   objective: Verify session-transcript memory can outrank stale durable notes and drive the final answer toward the newer fact.
   successCriteria:
     - Session memory indexing is enabled for the scenario.
diff --git a/qa/scenarios/memory/thread-memory-isolation.yaml b/qa/scenarios/memory/thread-memory-isolation.yaml
index 70d3e1ff5a9c..8a5df2c1519e 100644
--- a/qa/scenarios/memory/thread-memory-isolation.yaml
+++ b/qa/scenarios/memory/thread-memory-isolation.yaml
@@ -2,12 +2,12 @@ title: Thread memory isolation
 
 scenario:
   id: thread-memory-isolation
-  surface: memory
+  surface: session-memory
   coverage:
     primary:
-      - memory.thread-isolation
+      - session-memory.cross-client-history-thread-isolation
     secondary:
-      - channels.threads
+      - channels.native-threads
   objective: Verify a memory-backed answer requested inside a thread stays in-thread and does not leak into the root channel.
   successCriteria:
     - Agent uses memory tools inside the thread.
diff --git a/qa/scenarios/models/anthropic-opus-api-key-smoke.yaml b/qa/scenarios/models/anthropic-opus-api-key-smoke.yaml
index ba95eebef396..5096492e3740 100644
--- a/qa/scenarios/models/anthropic-opus-api-key-smoke.yaml
+++ b/qa/scenarios/models/anthropic-opus-api-key-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: model-provider
   coverage:
     primary:
-      - models.provider-auth
+      - agent-runtime.auth-setup-provider-auth
     secondary:
-      - models.anthropic
+      - anthropic.canonical-anthropic-refs
   objective: Verify the regular Anthropic Opus lane can complete a quick chat turn using API-key auth.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary provider is anthropic.
diff --git a/qa/scenarios/models/anthropic-opus-setup-token-smoke.yaml b/qa/scenarios/models/anthropic-opus-setup-token-smoke.yaml
index 08f053326962..fb4c709648ae 100644
--- a/qa/scenarios/models/anthropic-opus-setup-token-smoke.yaml
+++ b/qa/scenarios/models/anthropic-opus-setup-token-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: model-provider
   coverage:
     primary:
-      - models.provider-auth
+      - agent-runtime.auth-setup-provider-auth
     secondary:
-      - models.anthropic
+      - anthropic.canonical-anthropic-refs
   objective: Verify the regular Anthropic Opus lane can complete a quick chat turn using setup-token auth.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary provider is anthropic.
diff --git a/qa/scenarios/models/claude-cli-provider-capabilities-subscription.yaml b/qa/scenarios/models/claude-cli-provider-capabilities-subscription.yaml
index 87615722ae0c..761781a5205c 100644
--- a/qa/scenarios/models/claude-cli-provider-capabilities-subscription.yaml
+++ b/qa/scenarios/models/claude-cli-provider-capabilities-subscription.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: model-provider
   coverage:
     primary:
-      - models.provider-capabilities
+      - anthropic.claude-cli-compatibility-provider-capabilities
     secondary:
-      - models.claude-cli
+      - anthropic.claude-cli-compatibility
   objective: Verify the Claude CLI model-provider lane can use native Claude subscription auth to talk, read an attached image, use bundled MCP tools, and apply workspace skills.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary provider is claude-cli.
diff --git a/qa/scenarios/models/claude-cli-provider-capabilities.yaml b/qa/scenarios/models/claude-cli-provider-capabilities.yaml
index c65da98d7647..9ae85ae2f3c4 100644
--- a/qa/scenarios/models/claude-cli-provider-capabilities.yaml
+++ b/qa/scenarios/models/claude-cli-provider-capabilities.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: model-provider
   coverage:
     primary:
-      - models.provider-capabilities
+      - anthropic.claude-cli-compatibility-provider-capabilities
     secondary:
-      - models.claude-cli
+      - anthropic.claude-cli-compatibility
   objective: Verify the Claude CLI model-provider lane can use the Anthropic API key path to talk, read an attached image, use bundled MCP tools, and apply workspace skills.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary provider is claude-cli.
diff --git a/qa/scenarios/models/codex-harness-no-meta-leak.yaml b/qa/scenarios/models/codex-harness-no-meta-leak.yaml
index 1291db60d388..4622251f32cf 100644
--- a/qa/scenarios/models/codex-harness-no-meta-leak.yaml
+++ b/qa/scenarios/models/codex-harness-no-meta-leak.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: dm
   coverage:
     primary:
-      - models.codex-cli
+      - openai.codex-harness-codex-cli
     secondary:
-      - runtime.no-meta-leak
+      - openai.codex-harness-no-meta-leak
   plugins:
     - codex
   objective: Verify the Codex app-server harness keeps coordination/meta chatter out of the visible reply.
diff --git a/qa/scenarios/models/luna-thinking-visibility-switch.yaml b/qa/scenarios/models/luna-thinking-visibility-switch.yaml
index 513d3152c1df..febbe1b12c7f 100644
--- a/qa/scenarios/models/luna-thinking-visibility-switch.yaml
+++ b/qa/scenarios/models/luna-thinking-visibility-switch.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: models
   coverage:
     primary:
-      - models.thinking
+      - agent-runtime.thinking
     secondary:
-      - runtime.reasoning-visibility
+      - agent-runtime.progress-visibility-reasoning-visibility
   objective: Verify GPT-5.6 Luna can switch from disabled thinking to medium thinking while reasoning display stays enabled.
   successCriteria:
     - Live runs target openai/gpt-5.6-luna.
diff --git a/qa/scenarios/models/model-switch-follow-up.yaml b/qa/scenarios/models/model-switch-follow-up.yaml
index b4ae3f110068..26dda7a7f2a5 100644
--- a/qa/scenarios/models/model-switch-follow-up.yaml
+++ b/qa/scenarios/models/model-switch-follow-up.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: models
   coverage:
     primary:
-      - models.switching
+      - agent-runtime.runtime-override-switching
     secondary:
-      - runtime.session-continuity
+      - session-memory.session-parity-session-continuity
   objective: Verify the agent can switch to a different configured model and continue coherently.
   successCriteria:
     - Agent reflects the model switch request.
diff --git a/qa/scenarios/models/model-switch-tool-continuity.yaml b/qa/scenarios/models/model-switch-tool-continuity.yaml
index f0af037ba358..c251a5110b8c 100644
--- a/qa/scenarios/models/model-switch-tool-continuity.yaml
+++ b/qa/scenarios/models/model-switch-tool-continuity.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: models
   coverage:
     primary:
-      - models.switching
+      - agent-runtime.runtime-override-switching
     secondary:
-      - runtime.tool-continuity
+      - agent-runtime.tool-continuity
   objective: Verify switching models preserves session context and tool use instead of dropping into plain-text only behavior.
   successCriteria:
     - Alternate model is actually requested.
diff --git a/qa/scenarios/models/openai-native-web-search-live.yaml b/qa/scenarios/models/openai-native-web-search-live.yaml
index bc4a3404d635..0209eb0855cd 100644
--- a/qa/scenarios/models/openai-native-web-search-live.yaml
+++ b/qa/scenarios/models/openai-native-web-search-live.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: model-provider
   coverage:
     primary:
-      - tools.web-search
+      - web-search.web-search-exposure
     secondary:
-      - models.openai
+      - openai.canonical-openai-model-routing-openai
   objective: Verify a live OpenAI GPT model can use OpenAI native web_search when OpenClaw web search is enabled in auto mode.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary provider is openai.
diff --git a/qa/scenarios/models/thinking-slash-model-remap.yaml b/qa/scenarios/models/thinking-slash-model-remap.yaml
index 1165681cc1ab..7b744f2d08ea 100644
--- a/qa/scenarios/models/thinking-slash-model-remap.yaml
+++ b/qa/scenarios/models/thinking-slash-model-remap.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: models
   coverage:
     primary:
-      - models.thinking
+      - agent-runtime.thinking
     secondary:
-      - models.switching
-      - runtime.session-continuity
+      - agent-runtime.runtime-override-switching
+      - agent-runtime.thinking-session-continuity
   objective: Verify /think lists provider-owned levels and remaps stored thinking levels when the session model changes provider capabilities.
   plugins:
     - anthropic
diff --git a/qa/scenarios/personal/approval-denial-stop.yaml b/qa/scenarios/personal/approval-denial-stop.yaml
index 4b9a2a0f98c0..ded0c007fa06 100644
--- a/qa/scenarios/personal/approval-denial-stop.yaml
+++ b/qa/scenarios/personal/approval-denial-stop.yaml
@@ -6,10 +6,10 @@ scenario:
   category: approvals
   coverage:
     primary:
-      - personal.approval-denial
+      - security.approval-policy-approval-denial
     secondary:
-      - runtime.approvals
-      - tools.safety
+      - security.approval-policy-approvals
+      - security.approval-policy-safety
   risk: high
   capabilities:
     - approvals.denial
diff --git a/qa/scenarios/personal/channel-thread-reply.yaml b/qa/scenarios/personal/channel-thread-reply.yaml
index d52be012ac94..d8fdc66efcba 100644
--- a/qa/scenarios/personal/channel-thread-reply.yaml
+++ b/qa/scenarios/personal/channel-thread-reply.yaml
@@ -6,11 +6,11 @@ scenario:
   category: channel-replies
   coverage:
     primary:
-      - personal.channel-replies
+      - channels.native-threads-channel-replies
     secondary:
-      - channels.dm
-      - channels.threads
-      - channels.qa-channel
+      - channels.native-threads-dm
+      - channels.native-threads
+      - channels.native-threads-qa-channel
   risk: medium
   capabilities:
     - channel.reply
diff --git a/qa/scenarios/personal/failure-recovery.yaml b/qa/scenarios/personal/failure-recovery.yaml
index 0b62b1db6402..98a20a12a734 100644
--- a/qa/scenarios/personal/failure-recovery.yaml
+++ b/qa/scenarios/personal/failure-recovery.yaml
@@ -6,10 +6,10 @@ scenario:
   category: reliability
   coverage:
     primary:
-      - personal.failure-recovery
+      - agent-runtime.failure-recovery
     secondary:
-      - personal.no-fake-progress
-      - tools.evidence
+      - agent-runtime.failure-recovery-no-fake-progress
+      - agent-runtime.failure-recovery-evidence
   risk: medium
   capabilities:
     - tools.read
diff --git a/qa/scenarios/personal/memory-preference-recall.yaml b/qa/scenarios/personal/memory-preference-recall.yaml
index 4298f57f0233..1596f91042ae 100644
--- a/qa/scenarios/personal/memory-preference-recall.yaml
+++ b/qa/scenarios/personal/memory-preference-recall.yaml
@@ -6,10 +6,10 @@ scenario:
   category: memory
   coverage:
     primary:
-      - personal.memory-recall
+      - session-memory.personal-memory-recall
     secondary:
-      - memory.recall
-      - channels.qa-channel
+      - session-memory.memory-recall
+      - channels.inbound-routing-qa-channel
   risk: medium
   capabilities:
     - memory.recall
diff --git a/qa/scenarios/personal/no-fake-progress.yaml b/qa/scenarios/personal/no-fake-progress.yaml
index 2d1e673bda5a..4c2f5c173f08 100644
--- a/qa/scenarios/personal/no-fake-progress.yaml
+++ b/qa/scenarios/personal/no-fake-progress.yaml
@@ -6,10 +6,10 @@ scenario:
   category: honesty
   coverage:
     primary:
-      - personal.no-fake-progress
+      - agent-runtime.progress-visibility-no-fake-progress
     secondary:
-      - personal.task-followthrough
-      - tools.evidence
+      - agent-runtime.progress-visibility-task-followthrough
+      - agent-runtime.progress-visibility-evidence
   risk: medium
   capabilities:
     - tools.read
diff --git a/qa/scenarios/personal/redaction-no-secret-leak.yaml b/qa/scenarios/personal/redaction-no-secret-leak.yaml
index 68bc59bf57f2..10317f9f1dea 100644
--- a/qa/scenarios/personal/redaction-no-secret-leak.yaml
+++ b/qa/scenarios/personal/redaction-no-secret-leak.yaml
@@ -6,10 +6,10 @@ scenario:
   category: redaction
   coverage:
     primary:
-      - personal.redaction
+      - security.redaction-personal-redaction
     secondary:
-      - security.redaction
-      - qa.artifact-safety
+      - security.redaction-security-redaction
+      - security.redaction-artifact-safety
   risk: high
   capabilities:
     - redaction
diff --git a/qa/scenarios/personal/reminder-roundtrip.yaml b/qa/scenarios/personal/reminder-roundtrip.yaml
index 66c8bdcafcc1..89b32295a02a 100644
--- a/qa/scenarios/personal/reminder-roundtrip.yaml
+++ b/qa/scenarios/personal/reminder-roundtrip.yaml
@@ -6,10 +6,10 @@ scenario:
   category: reminders
   coverage:
     primary:
-      - personal.reminders
+      - automation.agent-cron-tool-reminders
     secondary:
-      - scheduling.cron
-      - channels.qa-channel
+      - automation.agent-cron-tool
+      - channels.qa-channel-final-reply
   risk: medium
   capabilities:
     - cron.add
diff --git a/qa/scenarios/personal/share-safe-diagnostics-artifact.yaml b/qa/scenarios/personal/share-safe-diagnostics-artifact.yaml
index b8b8c40f3545..d916370d9666 100644
--- a/qa/scenarios/personal/share-safe-diagnostics-artifact.yaml
+++ b/qa/scenarios/personal/share-safe-diagnostics-artifact.yaml
@@ -6,10 +6,10 @@ scenario:
   category: diagnostics
   coverage:
     primary:
-      - personal.diagnostics
+      - observability.support-zip-diagnostics
     secondary:
-      - personal.redaction
-      - qa.artifact-safety
+      - observability.support-zip-redaction
+      - observability.support-zip-artifact-safety
   risk: high
   capabilities:
     - tools.read
diff --git a/qa/scenarios/personal/task-followthrough-status.yaml b/qa/scenarios/personal/task-followthrough-status.yaml
index cc22dc4a0a64..f81d274045a4 100644
--- a/qa/scenarios/personal/task-followthrough-status.yaml
+++ b/qa/scenarios/personal/task-followthrough-status.yaml
@@ -6,10 +6,10 @@ scenario:
   category: followthrough
   coverage:
     primary:
-      - personal.task-followthrough
+      - agent-runtime.tool-task-followthrough
     secondary:
-      - tools.followthrough
-      - workspace.artifacts
+      - agent-runtime.tool-followthrough
+      - agent-runtime.tool-fs-write
   risk: medium
   capabilities:
     - tools.read
diff --git a/qa/scenarios/personal/tool-safety-followthrough.yaml b/qa/scenarios/personal/tool-safety-followthrough.yaml
index 130f887564df..ee8b66470597 100644
--- a/qa/scenarios/personal/tool-safety-followthrough.yaml
+++ b/qa/scenarios/personal/tool-safety-followthrough.yaml
@@ -6,10 +6,10 @@ scenario:
   category: tool-safety
   coverage:
     primary:
-      - personal.tool-safety
+      - agent-runtime.tool-safety-controls
     secondary:
-      - tools.followthrough
-      - runtime.approvals
+      - security.approval-policy-followthrough
+      - security.approval-policy-approvals
   risk: medium
   capabilities:
     - tools.read
diff --git a/qa/scenarios/plugins/bundled-plugin-skill-runtime.yaml b/qa/scenarios/plugins/bundled-plugin-skill-runtime.yaml
index d4d4baa42692..61df93e01a2b 100644
--- a/qa/scenarios/plugins/bundled-plugin-skill-runtime.yaml
+++ b/qa/scenarios/plugins/bundled-plugin-skill-runtime.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: skills
   coverage:
     primary:
-      - plugins.skills
+      - plugins.activation-skills
     secondary:
-      - plugins.runtime
+      - plugins.activation-runtime
   objective: Verify packaged bundled plugin skills load from dist-runtime instead of being skipped by path-containment checks.
   successCriteria:
     - The runtime-packaged bundled plugin tree is used as OPENCLAW_BUNDLED_PLUGINS_DIR.
diff --git a/qa/scenarios/plugins/clawhub-marketplace-list.yaml b/qa/scenarios/plugins/clawhub-marketplace-list.yaml
index 5868efeea25f..7667c93f9928 100644
--- a/qa/scenarios/plugins/clawhub-marketplace-list.yaml
+++ b/qa/scenarios/plugins/clawhub-marketplace-list.yaml
@@ -2,8 +2,8 @@ title: ClawHub marketplace list package lane
 
 scenario:
   id: clawhub-marketplace-list
-  surface: clawhub-and-external-plugin-distribution
-  category: clawhub-and-external-plugin-distribution.plugin-lifecycle-and-health
+  surface: clawhub
+  category: clawhub.plugin-lifecycle-and-health
   coverage:
     primary:
       - clawhub.marketplace-list
diff --git a/qa/scenarios/plugins/clawhub-release-candidate-checklist.yaml b/qa/scenarios/plugins/clawhub-release-candidate-checklist.yaml
index e291c4b6c838..b7ad3ff858d4 100644
--- a/qa/scenarios/plugins/clawhub-release-candidate-checklist.yaml
+++ b/qa/scenarios/plugins/clawhub-release-candidate-checklist.yaml
@@ -2,8 +2,8 @@ title: ClawHub release candidate package install proof
 
 scenario:
   id: clawhub-release-candidate-checklist
-  surface: clawhub-and-external-plugin-distribution
-  category: clawhub-and-external-plugin-distribution.plugin-lifecycle-and-health
+  surface: clawhub
+  category: clawhub.plugin-lifecycle-and-health
   coverage:
     primary:
       - clawhub.npm-pack-local-release-candidate-installs
diff --git a/qa/scenarios/plugins/clawhub-skill-installs.yaml b/qa/scenarios/plugins/clawhub-skill-installs.yaml
index 22b5d1f3dcd3..f1f0f8e21346 100644
--- a/qa/scenarios/plugins/clawhub-skill-installs.yaml
+++ b/qa/scenarios/plugins/clawhub-skill-installs.yaml
@@ -2,11 +2,11 @@ title: ClawHub skill install evidence
 
 scenario:
   id: clawhub-skill-installs
-  surface: clawhub-and-external-plugin-distribution
-  category: clawhub-and-external-plugin-distribution.plugin-lifecycle-and-health
+  surface: clawhub
+  category: clawhub.plugin-lifecycle-and-health
   coverage:
     primary:
-      - clawhub.skill-installs
+      - clawhub.clawhub-skill-installs
   objective: Link ClawHub-backed skill install e2e coverage to ClawHub maturity accounting.
   successCriteria:
     - The CLI resolves a ClawHub skill install descriptor.
diff --git a/qa/scenarios/plugins/kitchen-sink-live-openai.yaml b/qa/scenarios/plugins/kitchen-sink-live-openai.yaml
index 74586a703c5f..4978c515fc70 100644
--- a/qa/scenarios/plugins/kitchen-sink-live-openai.yaml
+++ b/qa/scenarios/plugins/kitchen-sink-live-openai.yaml
@@ -6,12 +6,11 @@ scenario:
   category: pre-release
   coverage:
     primary:
-      - plugins.kitchen-sink
+      - plugins.tool-plugin-kitchen-sink
     secondary:
-      - plugins.lifecycle
+      - plugins.activation-lifecycle
       - plugins.plugin-tools
-      - models.live-openai
-      - gateway.performance
+      - agent-runtime.hosted-provider-turns
   risk: high
   objective: Verify the external Kitchen Sink plugin can be installed into a qa-lab gateway, expose its major runtime surfaces, and coexist with a live OpenAI provider turn.
   successCriteria:
diff --git a/qa/scenarios/plugins/mcp-plugin-tools-call.yaml b/qa/scenarios/plugins/mcp-plugin-tools-call.yaml
index 77a39ba386fc..55b96eb92af9 100644
--- a/qa/scenarios/plugins/mcp-plugin-tools-call.yaml
+++ b/qa/scenarios/plugins/mcp-plugin-tools-call.yaml
@@ -5,8 +5,8 @@ scenario:
   surface: mcp
   coverage:
     primary:
-      - plugins.mcp-tools
-      - tools.invocation
+      - plugins.tool-plugin-mcp-tools
+      - plugins.tool-plugin-invocation
   objective: Verify OpenClaw can expose plugin tools over MCP and a real MCP client can call one successfully.
   successCriteria:
     - Plugin tools MCP server lists memory_search.
diff --git a/qa/scenarios/plugins/packaged-bundled-plugin-install-uninstall.yaml b/qa/scenarios/plugins/packaged-bundled-plugin-install-uninstall.yaml
index f7b68aa52510..f57b2b704791 100644
--- a/qa/scenarios/plugins/packaged-bundled-plugin-install-uninstall.yaml
+++ b/qa/scenarios/plugins/packaged-bundled-plugin-install-uninstall.yaml
@@ -2,8 +2,8 @@ title: Packaged bundled plugin install uninstall
 
 scenario:
   id: packaged-bundled-plugin-install-uninstall
-  surface: plugin-sdk-and-bundled-plugin-architecture
-  category: plugin-sdk-and-bundled-plugin-architecture.bundled-plugins
+  surface: plugins
+  category: plugins.bundled-plugins
   coverage:
     secondary:
       - plugins.packaged-bundled-plugins
diff --git a/qa/scenarios/plugins/plugin-hook-health-sentinel.yaml b/qa/scenarios/plugins/plugin-hook-health-sentinel.yaml
index 6fe62c33ac6c..5959bb761b28 100644
--- a/qa/scenarios/plugins/plugin-hook-health-sentinel.yaml
+++ b/qa/scenarios/plugins/plugin-hook-health-sentinel.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.gateway-log-sentinel.plugin-hooks
+      - plugins.activation-gateway-log-sentinel-plugin-hooks
     secondary:
-      - plugins.before-prompt-build
-      - plugins.before-tool-call
+      - plugins.tool-plugin-before-prompt-build
+      - plugins.tool-plugin-before-tool-call
   objective: Fail the live parity lane when plugin hook crashes appear in gateway logs during ordinary prompt and tool activity.
   successCriteria:
     - An ordinary live agent turn completes with the expected marker.
diff --git a/qa/scenarios/plugins/plugin-lifecycle-hot-reload.yaml b/qa/scenarios/plugins/plugin-lifecycle-hot-reload.yaml
index a0432df65035..a7d01df478b8 100644
--- a/qa/scenarios/plugins/plugin-lifecycle-hot-reload.yaml
+++ b/qa/scenarios/plugins/plugin-lifecycle-hot-reload.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: plugins
   coverage:
     primary:
-      - plugins.lifecycle
+      - plugins.activation-lifecycle
     secondary:
-      - plugins.hot-reload
-      - config.hot-apply
+      - plugins.enable-and-disable-hot-reload
+      - gateway.config-reload-hot-apply
   objective: Verify a runtime-owned capability can be disabled and re-enabled through hot config reload without stale state.
   successCriteria:
     - Workspace skill capability is eligible before reload.
diff --git a/qa/scenarios/plugins/plugin-lifecycle-probe.yaml b/qa/scenarios/plugins/plugin-lifecycle-probe.yaml
index 767c5a6751ab..785879991300 100644
--- a/qa/scenarios/plugins/plugin-lifecycle-probe.yaml
+++ b/qa/scenarios/plugins/plugin-lifecycle-probe.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: plugins
   coverage:
     secondary:
-      - plugins.lifecycle
-      - cli.plugin-validation-repair
-      - plugins.setup-flows
+      - cli.plugin-validation-and-repair
+      - plugins.plugin-setup
+      - plugins.smoke-tests-lifecycle
   objective: Exercise packaged plugin install, inspect, disable, enable, update, downgrade, and uninstall behavior in a clean Docker runtime.
   successCriteria:
     - A clean container installs the candidate OpenClaw package and fixture plugin package.
diff --git a/qa/scenarios/plugins/plugin-manifest-contract-health.yaml b/qa/scenarios/plugins/plugin-manifest-contract-health.yaml
index 3df77950bd48..c65f057a2b66 100644
--- a/qa/scenarios/plugins/plugin-manifest-contract-health.yaml
+++ b/qa/scenarios/plugins/plugin-manifest-contract-health.yaml
@@ -9,9 +9,9 @@ scenario:
     reason: Startup-log sentinel only; no assistant turn runs.
   coverage:
     primary:
-      - runtime.gateway-log-sentinel.plugin-contracts
+      - plugins.load-failure-contract-sentinel
     secondary:
-      - plugins.contracts.tools
+      - plugins.harness-contracts-tools
   objective: Fail live proof when gateway startup logs show plugin manifest contract registration errors such as missing `contracts.tools`.
   successCriteria:
     - Gateway reaches healthy state.
diff --git a/qa/scenarios/plugins/skill-install-hot-availability.yaml b/qa/scenarios/plugins/skill-install-hot-availability.yaml
index f58143389b9a..11ddec305e8b 100644
--- a/qa/scenarios/plugins/skill-install-hot-availability.yaml
+++ b/qa/scenarios/plugins/skill-install-hot-availability.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: skills
   coverage:
     primary:
-      - plugins.skills
+      - plugins.lifecycle-skills
     secondary:
-      - plugins.hot-install
+      - plugins.lifecycle-hot-install
   objective: Verify a newly added workspace skill shows up without a broken intermediate state and can influence the next turn immediately.
   successCriteria:
     - Skill is absent before install.
diff --git a/qa/scenarios/plugins/skill-visibility-invocation.yaml b/qa/scenarios/plugins/skill-visibility-invocation.yaml
index 9cf9e9c12fa5..99f01646899f 100644
--- a/qa/scenarios/plugins/skill-visibility-invocation.yaml
+++ b/qa/scenarios/plugins/skill-visibility-invocation.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: skills
   coverage:
     primary:
-      - plugins.skills
+      - plugins.activation-skills
     secondary:
-      - tools.invocation
+      - plugins.mixed-plugin-skill-invocation
   objective: Verify a workspace skill becomes visible in skills.status and influences the next agent turn.
   successCriteria:
     - skills.status reports the seeded skill as visible and eligible.
diff --git a/qa/scenarios/plugins/voice-call-cli-rpc-agent-tool.yaml b/qa/scenarios/plugins/voice-call-cli-rpc-agent-tool.yaml
index 902de1369e81..825f80e2bb1f 100644
--- a/qa/scenarios/plugins/voice-call-cli-rpc-agent-tool.yaml
+++ b/qa/scenarios/plugins/voice-call-cli-rpc-agent-tool.yaml
@@ -2,8 +2,8 @@ title: Voice Call CLI, RPC, agent tool, and realtime consult flow
 
 scenario:
   id: voice-call-cli-rpc-agent-tool
-  surface: voice-call-channel
-  category: voice-call-channel.channel-setup-and-operations
+  surface: voice-call
+  category: voice-call.channel-setup-and-operations
   coverage:
     primary:
       - voice-call.cli-rpc-agent-tool
diff --git a/qa/scenarios/runtime/active-talk-agent-run-status.yaml b/qa/scenarios/runtime/active-talk-agent-run-status.yaml
index bfc2d345a095..cb5cae3d438e 100644
--- a/qa/scenarios/runtime/active-talk-agent-run-status.yaml
+++ b/qa/scenarios/runtime/active-talk-agent-run-status.yaml
@@ -2,8 +2,8 @@ title: Active Talk agent-run control boundaries
 
 scenario:
   id: active-talk-agent-run-status
-  surface: voice-and-realtime-talk
-  category: voice-and-realtime-talk.realtime-talk-sessions
+  surface: voice
+  category: voice.realtime-talk-sessions
   coverage:
     primary:
       - voice.active-talk-agent-run-status
diff --git a/qa/scenarios/runtime/anthropic-thinking-error-recovery-replay-safe-read.yaml b/qa/scenarios/runtime/anthropic-thinking-error-recovery-replay-safe-read.yaml
index 2ae8c7f46606..5ad991ac2929 100644
--- a/qa/scenarios/runtime/anthropic-thinking-error-recovery-replay-safe-read.yaml
+++ b/qa/scenarios/runtime/anthropic-thinking-error-recovery-replay-safe-read.yaml
@@ -7,7 +7,7 @@ scenario:
     primary:
       - anthropic.signed-redacted-thinking-replay
     secondary:
-      - runtime.retry-policy
+      - agent-runtime.failure-recovery-retry-policy
   gatewayConfigPatch:
     agents:
       defaults:
diff --git a/qa/scenarios/runtime/approval-turn-tool-followthrough.yaml b/qa/scenarios/runtime/approval-turn-tool-followthrough.yaml
index 75612b6476ec..a03a4014564b 100644
--- a/qa/scenarios/runtime/approval-turn-tool-followthrough.yaml
+++ b/qa/scenarios/runtime/approval-turn-tool-followthrough.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: harness
   coverage:
     primary:
-      - runtime.approvals
+      - agent-runtime.approval-flow-approvals
     secondary:
-      - tools.followthrough
+      - agent-runtime.approval-flow-followthrough
   objective: Verify a short approval like "ok do it" triggers immediate tool use instead of fake-progress narration.
   successCriteria:
     - Agent can keep the pre-action turn brief.
diff --git a/qa/scenarios/runtime/auth-profile-codex-mixed-profiles.yaml b/qa/scenarios/runtime/auth-profile-codex-mixed-profiles.yaml
index 26b86386eae9..dd9c63693c2e 100644
--- a/qa/scenarios/runtime/auth-profile-codex-mixed-profiles.yaml
+++ b/qa/scenarios/runtime/auth-profile-codex-mixed-profiles.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.codex-plugin.auth
+      - openai.codex-oauth-profiles-codex-plugin-auth
     secondary:
-      - auth-profiles.provider-selection
-      - runtime.doctor-repair
+      - agent-runtime.auth-profile-selection-provider-selection
+      - openai.codex-oauth-profiles-doctor-repair
   objective: Verify doctor repairs mixed legacy Codex OAuth and OpenAI API-key profiles into canonical SQLite state and the Codex auth bridge sends the selected OAuth profile to App Server.
   successCriteria:
     - The selected auth profile id is openai:qa-oauth.
diff --git a/qa/scenarios/runtime/auth-profile-doctor-migration-safety.yaml b/qa/scenarios/runtime/auth-profile-doctor-migration-safety.yaml
index 9be8b89203a0..26f2ea290562 100644
--- a/qa/scenarios/runtime/auth-profile-doctor-migration-safety.yaml
+++ b/qa/scenarios/runtime/auth-profile-doctor-migration-safety.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.doctor-repair
+      - openai.codex-oauth-profiles-doctor-repair
     secondary:
-      - runtime.codex-plugin.auth
+      - observability.doctor-codex-plugin-auth
   objective: Prove that the real doctor command migrates legacy Codex OAuth stores into canonical per-agent SQLite state.
   successCriteria:
     - OAuth-only legacy stores become canonical openai OAuth profiles in per-agent SQLite.
diff --git a/qa/scenarios/runtime/codex-legacy-read-tool-vocabulary.yaml b/qa/scenarios/runtime/codex-legacy-read-tool-vocabulary.yaml
index 8a1cde53e92b..27947c66b2f3 100644
--- a/qa/scenarios/runtime/codex-legacy-read-tool-vocabulary.yaml
+++ b/qa/scenarios/runtime/codex-legacy-read-tool-vocabulary.yaml
@@ -6,10 +6,9 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.codex-native-workspace.read
+      - openai.tool-context-codex-native-workspace-read
     secondary:
-      - runtime.prompt-compatibility
-      - tools.fs.read
+      - openai.payload-compatibility-prompt-compatibility
   objective: Verify Codex-mode agents can satisfy legacy "Read tool" wording through the native Codex workspace-read capability instead of stopping because duplicate OpenClaw dynamic read is intentionally filtered.
   successCriteria:
     - Agent reads the seeded workspace file and replies with the exact marker line.
diff --git a/qa/scenarios/runtime/codex-plugin-cold-install.yaml b/qa/scenarios/runtime/codex-plugin-cold-install.yaml
index b2bed8ded978..dd63cb900e8b 100644
--- a/qa/scenarios/runtime/codex-plugin-cold-install.yaml
+++ b/qa/scenarios/runtime/codex-plugin-cold-install.yaml
@@ -9,7 +9,7 @@ scenario:
     reason: Packaged CLI/plugin-lifecycle proof only; no assistant turn runs.
   coverage:
     primary:
-      - runtime.codex-plugin.lifecycle
+      - plugins.lifecycle-hot-install
   objective: Verify a package-installed OpenClaw in a clean Docker home downloads the official Codex runtime on demand during OpenAI onboarding and records a loadable managed install.
   successCriteria:
     - The prepared OpenClaw tarball and clean home contain neither @openclaw/codex nor @openai/codex before onboarding.
diff --git a/qa/scenarios/runtime/codex-plugin-pinned-new.yaml b/qa/scenarios/runtime/codex-plugin-pinned-new.yaml
index 65e83ab74f7c..a919e6de710c 100644
--- a/qa/scenarios/runtime/codex-plugin-pinned-new.yaml
+++ b/qa/scenarios/runtime/codex-plugin-pinned-new.yaml
@@ -9,7 +9,7 @@ scenario:
     reason: Local version-mismatch fixture only; no assistant turn runs.
   coverage:
     primary:
-      - runtime.codex-plugin.version
+      - openai.doctor-diagnostics
   objective: Verify a Codex plugin pinned ahead of the OpenClaw host version fails closed with a precise host-upgrade remediation.
   successCriteria:
     - The lifecycle fixture detects the plugin version is newer than the host version.
diff --git a/qa/scenarios/runtime/codex-plugin-pinned-old.yaml b/qa/scenarios/runtime/codex-plugin-pinned-old.yaml
index a3bf23674d39..b583570ccb4d 100644
--- a/qa/scenarios/runtime/codex-plugin-pinned-old.yaml
+++ b/qa/scenarios/runtime/codex-plugin-pinned-old.yaml
@@ -9,7 +9,7 @@ scenario:
     reason: Local version-mismatch fixture only; no assistant turn runs.
   coverage:
     primary:
-      - runtime.codex-plugin.version
+      - openai.doctor-diagnostics
   objective: Verify a Codex plugin pinned behind the OpenClaw host version fails closed with a precise update remediation.
   successCriteria:
     - The lifecycle fixture detects the plugin version is older than the host version.
diff --git a/qa/scenarios/runtime/compaction-retry-mutating-tool.yaml b/qa/scenarios/runtime/compaction-retry-mutating-tool.yaml
index cc88374791cb..5d4fcfdc465c 100644
--- a/qa/scenarios/runtime/compaction-retry-mutating-tool.yaml
+++ b/qa/scenarios/runtime/compaction-retry-mutating-tool.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.compaction
+      - session-memory.compaction
     secondary:
-      - runtime.retry-policy
+      - session-memory.compaction-retry-policy
   objective: Verify a real mutating tool step keeps replay-unsafety explicit instead of disappearing into a clean-looking success if the run compacts or retries.
   successCriteria:
     - Agent reads the seeded large context before it writes.
diff --git a/qa/scenarios/runtime/compose-setup.yaml b/qa/scenarios/runtime/compose-setup.yaml
index f2d658f6afee..577bf64ede63 100644
--- a/qa/scenarios/runtime/compose-setup.yaml
+++ b/qa/scenarios/runtime/compose-setup.yaml
@@ -2,11 +2,11 @@ title: Docker Compose setup evidence
 
 scenario:
   id: compose-setup
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.container-setup
+  surface: containers
+  category: containers.container-setup
   coverage:
     secondary:
-      - docker.compose
+      - containers.docker-compose-mounts-and-secrets
   objective: Launch the documented Docker Compose topology from the package-backed functional image and record the exact package, image, and service container identities.
   successCriteria:
     - The scheduler builds the real package artifact and package-backed functional image through the canonical Docker planner.
diff --git a/qa/scenarios/runtime/docker-agent-bundle-mcp-tools.yaml b/qa/scenarios/runtime/docker-agent-bundle-mcp-tools.yaml
index 5140f0ee7876..12a0418048a9 100644
--- a/qa/scenarios/runtime/docker-agent-bundle-mcp-tools.yaml
+++ b/qa/scenarios/runtime/docker-agent-bundle-mcp-tools.yaml
@@ -2,11 +2,11 @@ title: Docker agent bundle MCP tools
 
 scenario:
   id: docker-agent-bundle-mcp-tools
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.agent-sandbox-and-tooling
+  surface: containers
+  category: containers.agent-sandbox-and-tooling
   coverage:
     primary:
-      - docker.backed-agent-sandbox-support
+      - containers.docker-backed-agent-sandbox-support
   objective: Verify the package-installed Docker image can materialize bundled MCP tools for an agent run and apply tool policy inside the container-hosted runtime.
   successCriteria:
     - The functional Docker E2E image starts with an empty OpenClaw test state.
diff --git a/qa/scenarios/runtime/docker-agents-delete-shared-workspace.yaml b/qa/scenarios/runtime/docker-agents-delete-shared-workspace.yaml
index ebcc059822c2..e508a90daaff 100644
--- a/qa/scenarios/runtime/docker-agents-delete-shared-workspace.yaml
+++ b/qa/scenarios/runtime/docker-agents-delete-shared-workspace.yaml
@@ -2,11 +2,11 @@ title: Docker agents delete shared workspace
 
 scenario:
   id: docker-agents-delete-shared-workspace
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.agent-sandbox-and-tooling
+  surface: containers
+  category: containers.agent-sandbox-and-tooling
   coverage:
     primary:
-      - docker.backed-agent-sandbox-support
+      - containers.docker-backed-agent-sandbox-support
   objective: Verify Docker-hosted agent workspace deletion keeps shared workspace state safe while running against the package-installed image.
   successCriteria:
     - The Docker lane starts from an empty OpenClaw state.
diff --git a/qa/scenarios/runtime/docker-gateway-network.yaml b/qa/scenarios/runtime/docker-gateway-network.yaml
index 792a9beb301f..e4c4c4c5e797 100644
--- a/qa/scenarios/runtime/docker-gateway-network.yaml
+++ b/qa/scenarios/runtime/docker-gateway-network.yaml
@@ -2,11 +2,11 @@ title: Docker gateway network access
 
 scenario:
   id: docker-gateway-network
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.container-operations
+  surface: containers
+  category: containers.container-operations
   coverage:
     primary:
-      - docker.compose-network-access
+      - containers.docker-compose-network-access
   objective: Verify container-network access and the packaged Gateway suspension lifecycle, including loopback admin control and same-container restart recovery.
   successCriteria:
     - The gateway container starts on an isolated Docker network with token auth.
diff --git a/qa/scenarios/runtime/docker-npm-onboard-channel-agent.yaml b/qa/scenarios/runtime/docker-npm-onboard-channel-agent.yaml
index 25d0f5f6ec17..1f8457591194 100644
--- a/qa/scenarios/runtime/docker-npm-onboard-channel-agent.yaml
+++ b/qa/scenarios/runtime/docker-npm-onboard-channel-agent.yaml
@@ -2,13 +2,13 @@ title: Docker npm onboard channel agent
 
 scenario:
   id: docker-npm-onboard-channel-agent
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.agent-sandbox-and-tooling
+  surface: containers
+  category: containers.agent-sandbox-and-tooling
   coverage:
     primary:
-      - docker.backed-agent-sandbox-support
+      - containers.docker-backed-agent-sandbox-support
     secondary:
-      - docker.first-run-onboarding
+      - containers.first-run-onboarding
   objective: Verify a package-installed Docker runner can complete non-interactive onboarding, configure a channel, start Gateway-backed agent behavior, and complete a mocked model turn.
   successCriteria:
     - The candidate OpenClaw tarball installs in a clean Docker home.
diff --git a/qa/scenarios/runtime/docker-package-install.yaml b/qa/scenarios/runtime/docker-package-install.yaml
index 71575872e7b9..b63bc65ee30c 100644
--- a/qa/scenarios/runtime/docker-package-install.yaml
+++ b/qa/scenarios/runtime/docker-package-install.yaml
@@ -2,11 +2,11 @@ title: Docker package install evidence
 
 scenario:
   id: docker-package-install
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.image-release-and-validation
+  surface: containers
+  category: containers.image-release-and-validation
   coverage:
     secondary:
-      - docker.package-artifact-generation
+      - containers.docker-e2e-package-artifact-generation
       - cli.package-manager-installs
   objective: Build the real OpenClaw package artifact, install and execute it in the scheduler-selected bare container image, and record exact package, image, and container identities.
   successCriteria:
diff --git a/qa/scenarios/runtime/docker-prometheus-smoke.yaml b/qa/scenarios/runtime/docker-prometheus-smoke.yaml
index a5c080480c29..343f1f5b40f7 100644
--- a/qa/scenarios/runtime/docker-prometheus-smoke.yaml
+++ b/qa/scenarios/runtime/docker-prometheus-smoke.yaml
@@ -5,11 +5,11 @@ scenario:
   surface: telemetry
   coverage:
     primary:
-      - telemetry.prometheus
-      - telemetry.prometheus-authenticated-gateway-export
+      - observability.prometheus-api-auth
+      - observability.prometheus
     secondary:
-      - harness.qa-lab
-      - docker.runtime-validation
+      - observability.prometheus-qa-lab
+      - containers.e2e-plan-runtime-validation
   objective: Verify a QA-lab gateway run emits protected, bounded Prometheus diagnostics metrics through the diagnostics-prometheus plugin.
   successCriteria:
     - The diagnostics-prometheus plugin exposes the protected scrape route.
diff --git a/qa/scenarios/runtime/docker-release-upgrade-user-journey.yaml b/qa/scenarios/runtime/docker-release-upgrade-user-journey.yaml
index 1c44c7e1e56a..0053fb52f364 100644
--- a/qa/scenarios/runtime/docker-release-upgrade-user-journey.yaml
+++ b/qa/scenarios/runtime/docker-release-upgrade-user-journey.yaml
@@ -2,12 +2,12 @@ title: Docker release upgrade user journey
 
 scenario:
   id: docker-release-upgrade-user-journey
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.image-release-and-validation
+  surface: containers
+  category: containers.image-release-and-validation
   coverage:
     primary:
-      - docker.release-workflow
-      - docker.release-path-install
+      - containers.docker-release-workflow
+      - containers.release-path-install
   objective: Verify a published baseline can be configured, upgraded to the candidate tarball, and still complete the core release journey.
   successCriteria:
     - A published baseline installs and is configured with mock provider, plugin, and ClickClack channel state.
diff --git a/qa/scenarios/runtime/docker-release-user-journey.yaml b/qa/scenarios/runtime/docker-release-user-journey.yaml
index 51ac66a8d0cd..74772acae84e 100644
--- a/qa/scenarios/runtime/docker-release-user-journey.yaml
+++ b/qa/scenarios/runtime/docker-release-user-journey.yaml
@@ -2,11 +2,11 @@ title: Docker release user journey
 
 scenario:
   id: docker-release-user-journey
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.image-release-and-validation
+  surface: containers
+  category: containers.image-release-and-validation
   coverage:
     primary:
-      - docker.release-path-install
+      - containers.release-path-install
   objective: Verify the package-installed Docker release journey from clean install through agent, plugin, channel, Gateway restart, and doctor checks.
   successCriteria:
     - The packed OpenClaw tarball installs globally in a clean Docker home.
diff --git a/qa/scenarios/runtime/docker-system-agent-first-run.yaml b/qa/scenarios/runtime/docker-system-agent-first-run.yaml
index 2cd532f1f44e..3c4380ff8df5 100644
--- a/qa/scenarios/runtime/docker-system-agent-first-run.yaml
+++ b/qa/scenarios/runtime/docker-system-agent-first-run.yaml
@@ -2,12 +2,12 @@ title: Docker packaged OpenClaw inference gate
 
 scenario:
   id: docker-system-agent-first-run
-  surface: docker-podman-hosting
-  category: docker-podman-hosting.container-setup
+  surface: containers
+  category: containers.container-setup
   coverage:
     secondary:
-      - docker.first-run-onboarding
-      - raspberry-pi.first-run-verification
+      - containers.first-run-onboarding
+      - small-linux.first-run-verification
   objective: Verify a fresh package-installed Docker state gates OpenClaw on a tested inference route, then supports planner-backed and typed setup operations without leaking secrets.
   successCriteria:
     - The bare-command routing policy selects onboarding, and the packaged OpenClaw CLI exits with onboarding guidance while inference is unavailable.
diff --git a/qa/scenarios/runtime/docker-update-channel-switch.yaml b/qa/scenarios/runtime/docker-update-channel-switch.yaml
index be7548727197..84b16667bb95 100644
--- a/qa/scenarios/runtime/docker-update-channel-switch.yaml
+++ b/qa/scenarios/runtime/docker-update-channel-switch.yaml
@@ -2,8 +2,8 @@ title: Docker update channel switch
 
 scenario:
   id: docker-update-channel-switch
-  surface: cli-install-update-onboard-doctor
-  category: cli-install-update-onboard-doctor.updates-and-upgrades
+  surface: cli
+  category: cli.updates-and-upgrades
   coverage:
     primary:
       - cli.install-kind-switching
diff --git a/qa/scenarios/runtime/docker-update-migration.yaml b/qa/scenarios/runtime/docker-update-migration.yaml
index 87dc6d3b8669..5e6b914dd6f9 100644
--- a/qa/scenarios/runtime/docker-update-migration.yaml
+++ b/qa/scenarios/runtime/docker-update-migration.yaml
@@ -2,8 +2,8 @@ title: Docker update migration
 
 scenario:
   id: docker-update-migration
-  surface: cli-install-update-onboard-doctor
-  category: cli-install-update-onboard-doctor.updates-and-upgrades
+  surface: cli
+  category: cli.updates-and-upgrades
   coverage:
     primary:
       - cli.plugin-convergence
diff --git a/qa/scenarios/runtime/docker-update-restart-auth.yaml b/qa/scenarios/runtime/docker-update-restart-auth.yaml
index aa99cb17c00f..92bc42718dc5 100644
--- a/qa/scenarios/runtime/docker-update-restart-auth.yaml
+++ b/qa/scenarios/runtime/docker-update-restart-auth.yaml
@@ -2,8 +2,8 @@ title: Docker update managed restart auth
 
 scenario:
   id: docker-update-restart-auth
-  surface: cli-install-update-onboard-doctor
-  category: cli-install-update-onboard-doctor.updates-and-upgrades
+  surface: cli
+  category: cli.updates-and-upgrades
   coverage:
     primary:
       - cli.managed-gateway-restart
diff --git a/qa/scenarios/runtime/docker-upgrade-survivor.yaml b/qa/scenarios/runtime/docker-upgrade-survivor.yaml
index 58647d863d19..fc742d546e76 100644
--- a/qa/scenarios/runtime/docker-upgrade-survivor.yaml
+++ b/qa/scenarios/runtime/docker-upgrade-survivor.yaml
@@ -2,13 +2,13 @@ title: Docker upgrade survivor
 
 scenario:
   id: docker-upgrade-survivor
-  surface: cli-install-update-onboard-doctor
-  category: cli-install-update-onboard-doctor.updates-and-upgrades
+  surface: cli
+  category: cli.updates-and-upgrades
   coverage:
     primary:
       - cli.update-status-and-rpc
     secondary:
-      - docker.release-path-install
+      - containers.release-path-install
   objective: Verify dirty existing user state survives package update, doctor repair, Gateway startup, health probes, and RPC status in Docker.
   successCriteria:
     - The packed candidate installs over seeded existing-user state with agents, channels, plugin allowlists, workspaces, sessions, and stale dependency debris.
diff --git a/qa/scenarios/runtime/empty-response-recovery-replay-safe-read.yaml b/qa/scenarios/runtime/empty-response-recovery-replay-safe-read.yaml
index c61d15be6f79..3013356d6382 100644
--- a/qa/scenarios/runtime/empty-response-recovery-replay-safe-read.yaml
+++ b/qa/scenarios/runtime/empty-response-recovery-replay-safe-read.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.empty-response-recovery
+      - agent-runtime.failure-recovery-empty-response-recovery
     secondary:
-      - runtime.retry-policy
+      - agent-runtime.failure-recovery-retry-policy
   objective: Verify an empty visible GPT turn after a replay-safe read auto-continues into a visible answer.
   successCriteria:
     - Scenario is mock-openai only so live lanes do not pick it up implicitly.
diff --git a/qa/scenarios/runtime/empty-response-retry-budget-exhausted.yaml b/qa/scenarios/runtime/empty-response-retry-budget-exhausted.yaml
index a59ea7f0d22a..9f2459775363 100644
--- a/qa/scenarios/runtime/empty-response-retry-budget-exhausted.yaml
+++ b/qa/scenarios/runtime/empty-response-retry-budget-exhausted.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.empty-response-recovery
+      - agent-runtime.failure-recovery-empty-response-recovery
     secondary:
-      - runtime.retry-policy
+      - agent-runtime.failure-recovery-retry-policy
   objective: Verify repeated empty GPT turns exhaust the retry budget after one continuation attempt.
   successCriteria:
     - Scenario is mock-openai only so live lanes do not pick it up implicitly.
diff --git a/qa/scenarios/runtime/first-hour-20-turn.yaml b/qa/scenarios/runtime/first-hour-20-turn.yaml
index 96130baf8240..f46f832770da 100644
--- a/qa/scenarios/runtime/first-hour-20-turn.yaml
+++ b/qa/scenarios/runtime/first-hour-20-turn.yaml
@@ -6,9 +6,9 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - runtime.multi-turn-continuity
+      - session-memory.token-pressure-multi-turn-continuity
     secondary:
-      - runtime.long-context
+      - session-memory.token-pressure-long-context
   objective: Verify both runtimes preserve a same-session conversation across the required 20-turn maintainer gate.
   successCriteria:
     - The same QA session accepts 20 sequential user turns.
diff --git a/qa/scenarios/runtime/gateway-restart-inflight-run.yaml b/qa/scenarios/runtime/gateway-restart-inflight-run.yaml
index 4abe492027d4..a93036b58306 100644
--- a/qa/scenarios/runtime/gateway-restart-inflight-run.yaml
+++ b/qa/scenarios/runtime/gateway-restart-inflight-run.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.restart-recovery
+      - session-memory.recovery-restart-recovery
     secondary:
-      - runtime.gateway-restart
-      - runtime.delivery
+      - gateway.restart-and-stop-gateway-restart
+      - session-memory.recovery-delivery
   gatewayConfigPatch:
     tools:
       alsoAllow:
diff --git a/qa/scenarios/runtime/gateway-restart-multi-live.yaml b/qa/scenarios/runtime/gateway-restart-multi-live.yaml
index bb315379ae9f..cd39bcd78e51 100644
--- a/qa/scenarios/runtime/gateway-restart-multi-live.yaml
+++ b/qa/scenarios/runtime/gateway-restart-multi-live.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.restart-recovery
+      - session-memory.recovery-restart-recovery
     secondary:
-      - runtime.gateway-restart
-      - runtime.delivery
+      - gateway.restart-and-stop-gateway-restart
+      - session-memory.recovery-delivery
   gatewayRuntime:
     preserveDebugArtifacts: true
   gatewayConfigPatch:
diff --git a/qa/scenarios/runtime/long-context-cache-stability.yaml b/qa/scenarios/runtime/long-context-cache-stability.yaml
index b0040da71250..d9f926692eed 100644
--- a/qa/scenarios/runtime/long-context-cache-stability.yaml
+++ b/qa/scenarios/runtime/long-context-cache-stability.yaml
@@ -6,9 +6,9 @@ scenario:
   runtimeParityTier: soak
   coverage:
     primary:
-      - runtime.reasoning-and-cache-controls
+      - agent-runtime.reasoning-and-cache-controls
     secondary:
-      - runtime.long-context
+      - session-memory.token-pressure-long-context
   objective: Exercise repeated same-session turns after a large tool result so prompt assembly and provider cache reuse remain stable.
   successCriteria:
     - The agent reads a large workspace fixture and returns the warmup marker from the capped read output.
diff --git a/qa/scenarios/runtime/long-context-progress-watchdog.yaml b/qa/scenarios/runtime/long-context-progress-watchdog.yaml
index 04216aeca309..d270c5645388 100644
--- a/qa/scenarios/runtime/long-context-progress-watchdog.yaml
+++ b/qa/scenarios/runtime/long-context-progress-watchdog.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - runtime.gateway-log-sentinel.codex-progress
+      - session-memory.codex-progress-sentinel
     secondary:
-      - runtime.long-context
-      - runtime.codex-app-server
+      - session-memory.token-pressure-long-context
+      - openai.codex-harness
   objective: Fail live proof when long-context activity triggers Codex app-server timeout or stalled-progress sentinels.
   successCriteria:
     - Gateway config routes the selected QA model through the Codex app-server runtime.
diff --git a/qa/scenarios/runtime/openai-compatible-chat-tools.yaml b/qa/scenarios/runtime/openai-compatible-chat-tools.yaml
index 3092bb4c7118..a6382cad270f 100644
--- a/qa/scenarios/runtime/openai-compatible-chat-tools.yaml
+++ b/qa/scenarios/runtime/openai-compatible-chat-tools.yaml
@@ -6,7 +6,7 @@ scenario:
   coverage:
     secondary:
       - gateway.openai-compatible-apis
-      - runtime.hosted-tool-use
+      - agent-runtime.hosted-tool-use
   objective: Verify the OpenAI-compatible chat-completions client and Docker lane preserve strict tool-call API behavior.
   successCriteria:
     - The Docker lane fails missing or placeholder OpenAI auth before Docker build work starts.
diff --git a/qa/scenarios/runtime/openai-web-search-minimal.yaml b/qa/scenarios/runtime/openai-web-search-minimal.yaml
index 9ecd21316426..9729ce3b5e47 100644
--- a/qa/scenarios/runtime/openai-web-search-minimal.yaml
+++ b/qa/scenarios/runtime/openai-web-search-minimal.yaml
@@ -6,10 +6,10 @@ scenario:
   coverage:
     secondary:
       - plugins.web-search-and-fetch
-      - runtime.reasoning-and-cache-controls
+      - agent-runtime.reasoning-and-cache-controls
       - web-search.openai-native-web-search
       - web-search.model-and-filter-routing
-      - tools.web-search
+      - web-search.web-search-exposure
   objective: Verify the OpenAI web_search minimal-reasoning E2E client distinguishes successful grounded turns from provider schema rejection.
   successCriteria:
     - Reject mode accepts the expected raw OpenAI schema rejection and the gateway schema wrapper.
diff --git a/qa/scenarios/runtime/openwebui-openai-compatible.yaml b/qa/scenarios/runtime/openwebui-openai-compatible.yaml
index df42ec426535..442ce853a917 100644
--- a/qa/scenarios/runtime/openwebui-openai-compatible.yaml
+++ b/qa/scenarios/runtime/openwebui-openai-compatible.yaml
@@ -6,8 +6,8 @@ scenario:
   coverage:
     secondary:
       - gateway.openai-compatible-apis
-      - runtime.hosted-provider-turns
-      - runtime.provider-specific-model-options
+      - agent-runtime.hosted-provider-turns
+      - agent-runtime.provider-specific-model-options
   objective: Verify the OpenWebUI E2E probe exercises OpenClaw through OpenWebUI's OpenAI-compatible model and chat APIs.
   successCriteria:
     - Probe environment limits are parsed strictly and control-plane requests time out quickly.
diff --git a/qa/scenarios/runtime/otel-both-log-smoke.yaml b/qa/scenarios/runtime/otel-both-log-smoke.yaml
index 31330039176a..36e701dacad2 100644
--- a/qa/scenarios/runtime/otel-both-log-smoke.yaml
+++ b/qa/scenarios/runtime/otel-both-log-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: telemetry
   coverage:
     primary:
-      - telemetry.otel
+      - observability.telemetry-otel
     secondary:
-      - harness.qa-lab
+      - observability.telemetry-qa-lab
   objective: Verify a QA-lab gateway run emits bounded OpenTelemetry traces and metrics while routing diagnostics-otel logs to OTLP and stdout JSONL.
   successCriteria:
     - The diagnostics-otel plugin starts with trace, metric, and log export enabled.
diff --git a/qa/scenarios/runtime/otel-stdout-log-smoke.yaml b/qa/scenarios/runtime/otel-stdout-log-smoke.yaml
index adbabe36076c..da27990db6d8 100644
--- a/qa/scenarios/runtime/otel-stdout-log-smoke.yaml
+++ b/qa/scenarios/runtime/otel-stdout-log-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: telemetry
   coverage:
     primary:
-      - telemetry.otel
+      - observability.telemetry-otel
     secondary:
-      - harness.qa-lab
+      - observability.telemetry-qa-lab
   objective: Verify a QA-lab gateway run emits bounded OpenTelemetry traces and metrics while routing diagnostics-otel logs to stdout JSONL.
   successCriteria:
     - The diagnostics-otel plugin starts with trace, metric, and log export enabled.
diff --git a/qa/scenarios/runtime/otel-trace-smoke.yaml b/qa/scenarios/runtime/otel-trace-smoke.yaml
index a70569a415ec..e96fc1c2ec4e 100644
--- a/qa/scenarios/runtime/otel-trace-smoke.yaml
+++ b/qa/scenarios/runtime/otel-trace-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: telemetry
   coverage:
     primary:
-      - telemetry.otel
+      - observability.otlp-http-traces-otel
     secondary:
-      - harness.qa-lab
+      - observability.otlp-http-traces-qa-lab
   objective: Verify a QA-lab gateway run emits bounded OpenTelemetry traces, metrics, and logs through the diagnostics-otel plugin.
   successCriteria:
     - The diagnostics-otel plugin starts with trace, metric, and log export enabled.
diff --git a/qa/scenarios/runtime/qa-bus-tool-trace-visibility.yaml b/qa/scenarios/runtime/qa-bus-tool-trace-visibility.yaml
index 7f9f1c3a9e9d..17e3cc4606a9 100644
--- a/qa/scenarios/runtime/qa-bus-tool-trace-visibility.yaml
+++ b/qa/scenarios/runtime/qa-bus-tool-trace-visibility.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: harness
   coverage:
     primary:
-      - harness.tool-trace-visibility
+      - observability.telemetry-tool-trace-visibility
     secondary:
-      - runtime.qa-bus
-      - tools.trace
+      - observability.telemetry-qa-bus
+      - observability.telemetry-trace
   objective: Verify QA-Lab can assert sanitized tool-call traces directly on bus messages.
   successCriteria:
     - QA bus messages can carry a toolCalls array.
diff --git a/qa/scenarios/runtime/qa-otel-smoke.yaml b/qa/scenarios/runtime/qa-otel-smoke.yaml
index e9fff39a6d56..cd58c5f4149a 100644
--- a/qa/scenarios/runtime/qa-otel-smoke.yaml
+++ b/qa/scenarios/runtime/qa-otel-smoke.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: telemetry
   coverage:
     primary:
-      - telemetry.otel
+      - observability.otlp-http-traces-otel
     secondary:
-      - telemetry.plugin-sdk-runtime-exports
+      - observability.plugin-sdk-diagnostic-runtime-exports
   objective: Execute the bounded local OTLP runtime producer directly and publish its OpenTelemetry assertions through the shared QA script evidence writer.
   successCriteria:
     - QA Lab launches the runtime producer directly with a bounded local collector configuration.
diff --git a/qa/scenarios/runtime/reasoning-only-no-auto-retry-after-write.yaml b/qa/scenarios/runtime/reasoning-only-no-auto-retry-after-write.yaml
index 4e2525b04612..34f5c3fa129d 100644
--- a/qa/scenarios/runtime/reasoning-only-no-auto-retry-after-write.yaml
+++ b/qa/scenarios/runtime/reasoning-only-no-auto-retry-after-write.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.reasoning-only-recovery
+      - agent-runtime.failure-recovery-reasoning-only-recovery
     secondary:
-      - runtime.retry-policy
+      - agent-runtime.failure-recovery-retry-policy
   objective: Verify a GPT-style reasoning-only turn after a mutating write stays replay-unsafe and does not auto-retry.
   successCriteria:
     - Scenario is mock-openai only so live lanes do not pick it up implicitly.
diff --git a/qa/scenarios/runtime/reasoning-only-recovery-replay-safe-read.yaml b/qa/scenarios/runtime/reasoning-only-recovery-replay-safe-read.yaml
index 1a47b57a7614..7d8f59201ddf 100644
--- a/qa/scenarios/runtime/reasoning-only-recovery-replay-safe-read.yaml
+++ b/qa/scenarios/runtime/reasoning-only-recovery-replay-safe-read.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.reasoning-only-recovery
+      - agent-runtime.failure-recovery-reasoning-only-recovery
     secondary:
-      - runtime.retry-policy
+      - agent-runtime.failure-recovery-retry-policy
   objective: Verify a GPT-style reasoning-only turn after a replay-safe read auto-continues into a visible answer.
   successCriteria:
     - Scenario is mock-openai only so live lanes do not pick it up implicitly.
diff --git a/qa/scenarios/runtime/runtime-inventory-drift-check.yaml b/qa/scenarios/runtime/runtime-inventory-drift-check.yaml
index 0e8d0be470c9..4fe9174a58b3 100644
--- a/qa/scenarios/runtime/runtime-inventory-drift-check.yaml
+++ b/qa/scenarios/runtime/runtime-inventory-drift-check.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: inventory
   coverage:
     primary:
-      - runtime.inventory
+      - agent-runtime.tool-availability-rules-inventory
   objective: Verify tools.effective and skills.status stay aligned with runtime behavior after config changes.
   successCriteria:
     - Enabled tool appears before the config change.
diff --git a/qa/scenarios/runtime/soak-100-turn.yaml b/qa/scenarios/runtime/soak-100-turn.yaml
index 298810cbb6e5..4f488785e3c5 100644
--- a/qa/scenarios/runtime/soak-100-turn.yaml
+++ b/qa/scenarios/runtime/soak-100-turn.yaml
@@ -6,9 +6,9 @@ scenario:
   runtimeParityTier: soak
   coverage:
     primary:
-      - runtime.long-run-stability
+      - agent-runtime.terminal-long-run-stability
     secondary:
-      - runtime.long-context
+      - session-memory.token-pressure-long-context
   objective: Provide an optional long-run soak that can be scheduled or run in Testbox without entering the maintainer default gate.
   successCriteria:
     - The same QA session accepts 100 sequential user turns.
diff --git a/qa/scenarios/runtime/streaming-final-integrity.yaml b/qa/scenarios/runtime/streaming-final-integrity.yaml
index 4791e52c82c1..eae4a6eaf61a 100644
--- a/qa/scenarios/runtime/streaming-final-integrity.yaml
+++ b/qa/scenarios/runtime/streaming-final-integrity.yaml
@@ -6,10 +6,10 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - channels.streaming
+      - agent-runtime.streaming-replies
     secondary:
-      - runtime.fallback-delivery
-      - runtime.delivery
+      - agent-runtime.streaming-replies-fallback-delivery
+      - agent-runtime.streaming-replies-delivery
   objective: Verify channel-visible streaming settles into one coherent final message without token-delta chatter.
   successCriteria:
     - Agent produces a final marker reply.
diff --git a/qa/scenarios/runtime/tool-search-gateway-e2e.yaml b/qa/scenarios/runtime/tool-search-gateway-e2e.yaml
index b577099c8f80..2593ccecd0a9 100644
--- a/qa/scenarios/runtime/tool-search-gateway-e2e.yaml
+++ b/qa/scenarios/runtime/tool-search-gateway-e2e.yaml
@@ -5,10 +5,10 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.hosted-tool-use
+      - agent-runtime.hosted-tool-use
     secondary:
       - plugins.plugin-tools
-      - tools.invocation
+      - plugins.tool-plugin-invocation
   objective: Verify the Tool Search gateway QA Lab flow keeps a large plugin-owned tool catalog behind the compact bridge while still invoking the selected plugin tool.
   successCriteria:
     - Direct mode exposes the fake plugin tool schemas and calls the selected plugin tool.
diff --git a/qa/scenarios/runtime/tools/apply-patch.yaml b/qa/scenarios/runtime/tools/apply-patch.yaml
index 48b64f69ccfd..c2c2a2ff6fc0 100644
--- a/qa/scenarios/runtime/tools/apply-patch.yaml
+++ b/qa/scenarios/runtime/tools/apply-patch.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.apply-patch
+      - agent-runtime.tool-apply-patch
   objective: Verify apply_patch behavior is tracked across OpenClaw and Codex while Codex owns patching natively.
   successCriteria:
     - OpenClaw may expose OpenClaw apply_patch while Codex app-server mode may omit duplicate OpenClaw dynamic apply_patch.
diff --git a/qa/scenarios/runtime/tools/ask-user.yaml b/qa/scenarios/runtime/tools/ask-user.yaml
index 28712c9ddabe..386e8cd76fc9 100644
--- a/qa/scenarios/runtime/tools/ask-user.yaml
+++ b/qa/scenarios/runtime/tools/ask-user.yaml
@@ -5,9 +5,8 @@ scenario:
   surface: runtime-tool
   coverage:
     primary:
-      - tools.ask-user
+      - agent-runtime.tool-ask-user
     secondary:
-      - channels.qa-channel
       - gateway.chat-apis
   objective: Verify the agent can ask three structured questions, pause, receive mixed answer shapes, and resume with the selected values.
   successCriteria:
diff --git a/qa/scenarios/runtime/tools/bash.yaml b/qa/scenarios/runtime/tools/bash.yaml
index 6e9d469ce0c6..ec59339784fa 100644
--- a/qa/scenarios/runtime/tools/bash.yaml
+++ b/qa/scenarios/runtime/tools/bash.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.bash
+      - tools.exec-routing-bash
   objective: Verify shell command behavior is tracked across OpenClaw and Codex while Codex owns exec/process natively.
   successCriteria:
     - OpenClaw may expose OpenClaw exec while Codex app-server mode may omit duplicate OpenClaw dynamic exec/process.
diff --git a/qa/scenarios/runtime/tools/edit.yaml b/qa/scenarios/runtime/tools/edit.yaml
index 3bfbc597dc26..7177e7134d72 100644
--- a/qa/scenarios/runtime/tools/edit.yaml
+++ b/qa/scenarios/runtime/tools/edit.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.edit
+      - agent-runtime.tool-edit
   objective: Verify targeted edit behavior is tracked across OpenClaw and Codex while Codex owns edit natively.
   successCriteria:
     - OpenClaw may expose OpenClaw edit while Codex app-server mode may omit duplicate OpenClaw dynamic edit.
diff --git a/qa/scenarios/runtime/tools/exec.yaml b/qa/scenarios/runtime/tools/exec.yaml
index f69e4476fc31..0692bf5962e4 100644
--- a/qa/scenarios/runtime/tools/exec.yaml
+++ b/qa/scenarios/runtime/tools/exec.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.exec
+      - tools.exec-routing-exec
   objective: Verify command execution behavior is tracked across OpenClaw and Codex while Codex owns exec/process natively.
   successCriteria:
     - OpenClaw may expose OpenClaw exec while Codex app-server mode may omit duplicate OpenClaw dynamic exec/process.
diff --git a/qa/scenarios/runtime/tools/fs-list.yaml b/qa/scenarios/runtime/tools/fs-list.yaml
index 4e1fa3f214d2..4624343afc9c 100644
--- a/qa/scenarios/runtime/tools/fs-list.yaml
+++ b/qa/scenarios/runtime/tools/fs-list.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.fs.list
+      - agent-runtime.tool-fs-list
   objective: Verify directory inspection behavior is tracked through read while Codex owns file inspection natively.
   successCriteria:
     - OpenClaw may expose OpenClaw read while Codex app-server mode may omit duplicate OpenClaw dynamic read.
diff --git a/qa/scenarios/runtime/tools/fs-read.yaml b/qa/scenarios/runtime/tools/fs-read.yaml
index 534a12269e11..51f62bf0026c 100644
--- a/qa/scenarios/runtime/tools/fs-read.yaml
+++ b/qa/scenarios/runtime/tools/fs-read.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.fs.read
+      - agent-runtime.tool-fs-read
   objective: Verify file read behavior is tracked across OpenClaw and Codex while Codex owns read natively.
   successCriteria:
     - OpenClaw may expose OpenClaw read while Codex app-server mode may omit duplicate OpenClaw dynamic read.
diff --git a/qa/scenarios/runtime/tools/fs-write.yaml b/qa/scenarios/runtime/tools/fs-write.yaml
index 2997fe15fef4..779747e20837 100644
--- a/qa/scenarios/runtime/tools/fs-write.yaml
+++ b/qa/scenarios/runtime/tools/fs-write.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.fs.write
+      - agent-runtime.tool-fs-write
   objective: Verify file write behavior is tracked across OpenClaw and Codex while Codex owns write natively.
   successCriteria:
     - OpenClaw may expose OpenClaw write while Codex app-server mode may omit duplicate OpenClaw dynamic write.
diff --git a/qa/scenarios/runtime/tools/grep.yaml b/qa/scenarios/runtime/tools/grep.yaml
index 87e8893ed860..410d8b7505a7 100644
--- a/qa/scenarios/runtime/tools/grep.yaml
+++ b/qa/scenarios/runtime/tools/grep.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.grep
+      - agent-runtime.tool-grep
   objective: Verify grep-style search behavior is tracked through command execution while Codex owns exec/process natively.
   successCriteria:
     - OpenClaw may expose OpenClaw exec while Codex app-server mode may omit duplicate OpenClaw dynamic exec/process.
diff --git a/qa/scenarios/runtime/tools/image-generate.yaml b/qa/scenarios/runtime/tools/image-generate.yaml
index 7221eae1ab8b..4ce2d6359293 100644
--- a/qa/scenarios/runtime/tools/image-generate.yaml
+++ b/qa/scenarios/runtime/tools/image-generate.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.image-generate
+      - media.image-tool-image-generate
   objective: Verify image_generate preserves arguments and result shape across OpenClaw and Codex.
   successCriteria:
     - Scenario is mock-openai only because live image generation uses async task lifecycle proof outside this direct failure-path fixture.
diff --git a/qa/scenarios/runtime/tools/memory-add.yaml b/qa/scenarios/runtime/tools/memory-add.yaml
index afe32a4e0cba..7552297c24e1 100644
--- a/qa/scenarios/runtime/tools/memory-add.yaml
+++ b/qa/scenarios/runtime/tools/memory-add.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.memory.add
+      - session-memory.memory-add
   objective: Track memory.add parity once a first-class memory add tool is exposed.
   successCriteria:
     - If memory_add is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/memory-recall.yaml b/qa/scenarios/runtime/tools/memory-recall.yaml
index 01ac9cb8d58a..444d4ab2304f 100644
--- a/qa/scenarios/runtime/tools/memory-recall.yaml
+++ b/qa/scenarios/runtime/tools/memory-recall.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.memory.recall
+      - session-memory.memory-recall-tool
   objective: Verify memory_recall parity when the memory plugin exposes the tool.
   successCriteria:
     - If memory_recall is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/message-tool.yaml b/qa/scenarios/runtime/tools/message-tool.yaml
index 6a18495af458..0b2b0f047b77 100644
--- a/qa/scenarios/runtime/tools/message-tool.yaml
+++ b/qa/scenarios/runtime/tools/message-tool.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.message-tool
+      - channels.message-tool-outbound
   objective: Report whether a direct message tool is present. The coding-profile session surface normally uses sessions_send instead.
   successCriteria:
     - The fixture is report-only when the coding profile does not expose a direct message tool.
diff --git a/qa/scenarios/runtime/tools/session-status.yaml b/qa/scenarios/runtime/tools/session-status.yaml
index 6449b225d9f1..0e65c2b290eb 100644
--- a/qa/scenarios/runtime/tools/session-status.yaml
+++ b/qa/scenarios/runtime/tools/session-status.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.session-status
+      - gateway.session-apis-session-status
   objective: Verify session_status preserves arguments and result shape across OpenClaw and Codex.
   successCriteria:
     - Effective tools expose session_status.
diff --git a/qa/scenarios/runtime/tools/sessions-spawn.yaml b/qa/scenarios/runtime/tools/sessions-spawn.yaml
index e638930a0dfa..f24de0598978 100644
--- a/qa/scenarios/runtime/tools/sessions-spawn.yaml
+++ b/qa/scenarios/runtime/tools/sessions-spawn.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.sessions-spawn
+      - agent-runtime.subagent-turns-sessions-spawn
   objective: Verify sessions_spawn preserves arguments and result shape across OpenClaw and Codex.
   successCriteria:
     - Effective tools expose sessions_spawn.
diff --git a/qa/scenarios/runtime/tools/skill-invocation.yaml b/qa/scenarios/runtime/tools/skill-invocation.yaml
index ec57ac12b246..577fd958dc63 100644
--- a/qa/scenarios/runtime/tools/skill-invocation.yaml
+++ b/qa/scenarios/runtime/tools/skill-invocation.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.skill-invocation
+      - plugins.mixed-plugin-skill-invocation
   objective: Track skill invocation parity once skill tools are represented as first-class runtime tools.
   successCriteria:
     - If skill_invoke is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/tavily-extract.yaml b/qa/scenarios/runtime/tools/tavily-extract.yaml
index c97ee41e5277..8746ab395c6e 100644
--- a/qa/scenarios/runtime/tools/tavily-extract.yaml
+++ b/qa/scenarios/runtime/tools/tavily-extract.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.tavily-extract
+      - web-search.html-extraction
   objective: Track tavily_extract parity once the tool is present in the runtime surface.
   successCriteria:
     - If tavily_extract is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/tavily-search.yaml b/qa/scenarios/runtime/tools/tavily-search.yaml
index 530ac1acbb92..149f9c188426 100644
--- a/qa/scenarios/runtime/tools/tavily-search.yaml
+++ b/qa/scenarios/runtime/tools/tavily-search.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.tavily-search
+      - web-search.api-backed-providers
   objective: Track tavily_search parity once the tool is present in the runtime surface.
   successCriteria:
     - If tavily_search is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/tts.yaml b/qa/scenarios/runtime/tools/tts.yaml
index 58f2a9efd72d..35dca8324092 100644
--- a/qa/scenarios/runtime/tools/tts.yaml
+++ b/qa/scenarios/runtime/tools/tts.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: optional
   coverage:
     primary:
-      - tools.tts
+      - media.generated-audio-persistence-and-delivery
   objective: Verify tts preserves arguments and result shape when the tool is present.
   successCriteria:
     - If tts is present, the fixture exercises happy and failure paths.
diff --git a/qa/scenarios/runtime/tools/web-fetch.yaml b/qa/scenarios/runtime/tools/web-fetch.yaml
index 12c65d7e4799..0504cbe5e03c 100644
--- a/qa/scenarios/runtime/tools/web-fetch.yaml
+++ b/qa/scenarios/runtime/tools/web-fetch.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.web-fetch
+      - web-search.web-fetch-exposure
   objective: Verify web_fetch preserves arguments and result shape across OpenClaw and Codex.
   successCriteria:
     - Effective tools expose web_fetch.
diff --git a/qa/scenarios/runtime/tools/web-search.yaml b/qa/scenarios/runtime/tools/web-search.yaml
index 15170fea0387..640ab4f18e0e 100644
--- a/qa/scenarios/runtime/tools/web-search.yaml
+++ b/qa/scenarios/runtime/tools/web-search.yaml
@@ -6,7 +6,7 @@ scenario:
   runtimeParityTier: standard
   coverage:
     primary:
-      - tools.web-search
+      - web-search.web-search-exposure
   objective: Verify web_search preserves arguments and result shape across OpenClaw and Codex.
   successCriteria:
     - Effective tools expose web_search.
diff --git a/qa/scenarios/runtime/update-run-package-self-upgrade.yaml b/qa/scenarios/runtime/update-run-package-self-upgrade.yaml
index b8079a5026d4..b4d709734a70 100644
--- a/qa/scenarios/runtime/update-run-package-self-upgrade.yaml
+++ b/qa/scenarios/runtime/update-run-package-self-upgrade.yaml
@@ -5,10 +5,9 @@ scenario:
   surface: runtime
   coverage:
     primary:
-      - runtime.update-run
+      - cli.update-status-and-rpc
     secondary:
-      - runtime.gateway-restart
-      - runtime.package-update
+      - cli.managed-gateway-restart
   objective: Verify an installed OpenClaw 2026.4.26 package upgrades to the resolved latest package through the authenticated Gateway update.run RPC and returns healthy after restart.
   successCriteria:
     - The package-backed Docker lane installs and verifies openclaw@2026.4.26 before invoking the authenticated Gateway update.run RPC directly.
diff --git a/qa/scenarios/scheduling/cron-condition-watcher.yaml b/qa/scenarios/scheduling/cron-condition-watcher.yaml
index c3f5714f02e8..0b8ca00c5900 100644
--- a/qa/scenarios/scheduling/cron-condition-watcher.yaml
+++ b/qa/scenarios/scheduling/cron-condition-watcher.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: cron
   coverage:
     primary:
-      - scheduling.cron
+      - automation.isolated-cron-execution
     secondary:
-      - scheduling.cron-rpcs
+      - automation.cron-rpcs
   objective: Verify quiet condition-watcher ticks persist state without run rows, then one natural fired tick runs the payload and disarms a once trigger.
   successCriteria:
     - At least two quiet trigger evaluations persist replacement state without creating run history.
diff --git a/qa/scenarios/scheduling/cron-model-created-one-shot-recurring.yaml b/qa/scenarios/scheduling/cron-model-created-one-shot-recurring.yaml
index 3b8f8a92238c..cc6681bfa9d3 100644
--- a/qa/scenarios/scheduling/cron-model-created-one-shot-recurring.yaml
+++ b/qa/scenarios/scheduling/cron-model-created-one-shot-recurring.yaml
@@ -6,11 +6,11 @@ scenario:
   runtimeParityTier: live-only
   coverage:
     primary:
-      - scheduling.cron
-      - agents.tool-use
+      - automation.agent-cron-tool
     secondary:
-      - scheduling.dedup
-      - scheduling.persistence
+      - automation.model-authored-cron-jobs
+      - automation.isolated-cron-execution-dedup
+      - automation.scheduler-persistence
   gatewayConfigPatch:
     commands:
       ownerAllowFrom:
diff --git a/qa/scenarios/scheduling/cron-natural-fire-no-duplicate.yaml b/qa/scenarios/scheduling/cron-natural-fire-no-duplicate.yaml
index 47fd3ac14458..e96373e8bb9a 100644
--- a/qa/scenarios/scheduling/cron-natural-fire-no-duplicate.yaml
+++ b/qa/scenarios/scheduling/cron-natural-fire-no-duplicate.yaml
@@ -5,10 +5,11 @@ scenario:
   surface: cron
   coverage:
     primary:
-      - scheduling.cron
+      - automation.isolated-cron-execution
+      - automation.run-history-cron
     secondary:
-      - channels.qa-channel
-      - scheduling.dedup
+      - channels.qa-channel-final-reply
+      - automation.run-history-dedup
   objective: Verify one naturally fired cron run in a single gateway uptime produces exactly one qa-channel delivery for its marker.
   successCriteria:
     - A one-shot cron job fires from the scheduler timer without cron.run force mode.
diff --git a/qa/scenarios/scheduling/cron-one-minute-ping.yaml b/qa/scenarios/scheduling/cron-one-minute-ping.yaml
index fc3eca256d2f..c4b7fc7829f1 100644
--- a/qa/scenarios/scheduling/cron-one-minute-ping.yaml
+++ b/qa/scenarios/scheduling/cron-one-minute-ping.yaml
@@ -5,11 +5,11 @@ scenario:
   surface: cron
   coverage:
     primary:
-      - scheduling.cron
-      - scheduling.cron-rpcs
-      - scheduling.chat-announce-delivery
+      - automation.cron-rpcs
+      - automation.chat-announce-delivery
+      - automation.agent-cron-tool
     secondary:
-      - channels.qa-channel
+      - channels.qa-channel-final-reply
   objective: Verify the agent can schedule a cron reminder one minute in the future and receive the follow-up in the QA channel.
   successCriteria:
     - Agent schedules a cron reminder roughly one minute ahead.
diff --git a/qa/scenarios/scheduling/cron-single-run-no-duplicate.yaml b/qa/scenarios/scheduling/cron-single-run-no-duplicate.yaml
index 93b93dd31a22..6b1f1a74ae4e 100644
--- a/qa/scenarios/scheduling/cron-single-run-no-duplicate.yaml
+++ b/qa/scenarios/scheduling/cron-single-run-no-duplicate.yaml
@@ -5,10 +5,11 @@ scenario:
   surface: cron
   coverage:
     primary:
-      - scheduling.cron
+      - automation.manual-cron-runs
+      - automation.run-history-cron
     secondary:
-      - channels.qa-channel
-      - scheduling.dedup
+      - channels.qa-channel-final-reply
+      - automation.run-history-dedup
   objective: Verify one forced cron run produces exactly one qa-channel delivery for its marker.
   successCriteria:
     - A single forced cron run completes successfully.
diff --git a/qa/scenarios/scheduling/heartbeat-active-hours.yaml b/qa/scenarios/scheduling/heartbeat-active-hours.yaml
index 21cb2df79690..16908c89ce09 100644
--- a/qa/scenarios/scheduling/heartbeat-active-hours.yaml
+++ b/qa/scenarios/scheduling/heartbeat-active-hours.yaml
@@ -2,8 +2,8 @@ title: Heartbeat active-hours scheduling evidence
 
 scenario:
   id: heartbeat-active-hours
-  surface: automation-cron-hooks-tasks-polling
-  category: automation-cron-hooks-tasks-polling.heartbeat
+  surface: automation
+  category: automation.heartbeat
   coverage:
     secondary:
       - automation.active-hours
diff --git a/qa/scenarios/security/secret-redaction-tool-logs.yaml b/qa/scenarios/security/secret-redaction-tool-logs.yaml
index 18e58c824e6e..26eac4d56ba6 100644
--- a/qa/scenarios/security/secret-redaction-tool-logs.yaml
+++ b/qa/scenarios/security/secret-redaction-tool-logs.yaml
@@ -5,10 +5,9 @@ scenario:
   surface: security
   coverage:
     primary:
-      - security.redaction
+      - security.redaction-security-redaction
     secondary:
-      - runtime.tool-policy
-      - qa.artifact-safety
+      - security.redaction-artifact-safety
   objective: Verify fake credential material prepared for a QA turn does not leak into outbound channel text.
   successCriteria:
     - Scenario writes a fake secret marker into the workspace.
diff --git a/qa/scenarios/ui/browser-talk-start-stop.yaml b/qa/scenarios/ui/browser-talk-start-stop.yaml
index 35020726bc12..a5252b0b50dc 100644
--- a/qa/scenarios/ui/browser-talk-start-stop.yaml
+++ b/qa/scenarios/ui/browser-talk-start-stop.yaml
@@ -2,13 +2,13 @@ title: Browser realtime Talk start-stop evidence
 
 scenario:
   id: browser-talk-start-stop
-  surface: browser-control-ui-and-webchat
-  category: browser-control-ui-and-webchat.browser-realtime-talk
+  surface: control-ui
+  category: control-ui.browser-realtime-talk
   coverage:
     primary:
       - voice.browser-talk-start-stop-ui
     secondary:
-      - ui.browser-talk-start-stop
+      - control-ui.browser-talk-start-stop
   objective: Link deterministic browser realtime Talk transport start/stop coverage to UI maturity accounting.
   successCriteria:
     - Browser Talk starts the Google Live WebSocket transport and reaches listening state.
diff --git a/qa/scenarios/ui/control-ui-assistant-media-tickets.yaml b/qa/scenarios/ui/control-ui-assistant-media-tickets.yaml
index a91d674c4f6c..42f04481a095 100644
--- a/qa/scenarios/ui/control-ui-assistant-media-tickets.yaml
+++ b/qa/scenarios/ui/control-ui-assistant-media-tickets.yaml
@@ -2,11 +2,11 @@ title: Control UI assistant media ticket evidence
 
 scenario:
   id: control-ui-assistant-media-tickets
-  surface: browser-control-ui-and-webchat
-  category: browser-control-ui-and-webchat.webchat-conversations
+  surface: control-ui
+  category: control-ui.webchat-conversations
   coverage:
     primary:
-      - ui.assistant-media-tickets
+      - control-ui.assistant-media-tickets
   objective: Link scoped assistant media ticket e2e coverage to Control UI maturity accounting.
   successCriteria:
     - Gateway metadata requests mint scoped assistant media tickets.
diff --git a/qa/scenarios/ui/control-ui-assistant-transcript-role-boundary.yaml b/qa/scenarios/ui/control-ui-assistant-transcript-role-boundary.yaml
index 6de10f6ddebc..f91a507be08b 100644
--- a/qa/scenarios/ui/control-ui-assistant-transcript-role-boundary.yaml
+++ b/qa/scenarios/ui/control-ui-assistant-transcript-role-boundary.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: control-ui
   coverage:
     secondary:
-      - channels.qa-channel
-      - runtime.delivery
-      - ui.control
+      - channels.qa-channel-final-reply
+      - channels.automatic-final-reply
+      - control-ui.chat-send-lifecycle-control
   objective: Verify transcript-role-looking Markdown emitted by an assistant stays visibly inside the assistant reply while ordinary code examples remain ordinary code.
   successCriteria:
     - A mock-model reply travels through the real Gateway and qa-channel delivery path unchanged.
diff --git a/qa/scenarios/ui/control-ui-chat-flow-playwright.yaml b/qa/scenarios/ui/control-ui-chat-flow-playwright.yaml
index 526ea8335d18..4c637ba7325e 100644
--- a/qa/scenarios/ui/control-ui-chat-flow-playwright.yaml
+++ b/qa/scenarios/ui/control-ui-chat-flow-playwright.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: control-ui
   coverage:
     primary:
-      - ui.control
+      - control-ui.gateway-hosted-ui-control
   objective: Smoke-test a Control UI chat turn through the hosted browser surface.
   successCriteria:
     - Playwright sends a chat turn and renders the final Gateway event.
diff --git a/qa/scenarios/ui/control-ui-plan-replay-reconnect.yaml b/qa/scenarios/ui/control-ui-plan-replay-reconnect.yaml
index 30a4b9bbee97..ae7317a2779e 100644
--- a/qa/scenarios/ui/control-ui-plan-replay-reconnect.yaml
+++ b/qa/scenarios/ui/control-ui-plan-replay-reconnect.yaml
@@ -5,7 +5,7 @@ scenario:
   surface: control-ui
   coverage:
     primary:
-      - ui.control
+      - control-ui.gateway-hosted-ui-control
   objective: >-
     Prove a client that connects or refreshes mid-run renders the active plan
     checklist from the replayed chat.history/chat.startup inFlightRun snapshot,
diff --git a/qa/scenarios/ui/control-ui-qa-channel-image-roundtrip.yaml b/qa/scenarios/ui/control-ui-qa-channel-image-roundtrip.yaml
index 2502daecda0b..091f0072fe52 100644
--- a/qa/scenarios/ui/control-ui-qa-channel-image-roundtrip.yaml
+++ b/qa/scenarios/ui/control-ui-qa-channel-image-roundtrip.yaml
@@ -5,11 +5,12 @@ scenario:
   surface: control-ui
   coverage:
     primary:
-      - ui.control
-      - ui.dashboard-auth-bootstrap
+      - control-ui.dashboard-open-auth-bootstrap
+      - control-ui.gateway-hosted-ui-control
+      - control-ui.chat-send-lifecycle-control
     secondary:
-      - media.image-understanding
-      - channels.qa-channel
+      - media.image-summary-image-understanding
+      - channels.inbound-routing-qa-channel
   objective: Verify the embedded Control UI can observe a qa-channel-backed session while the fake channel injects text and image turns that the agent answers correctly.
   successCriteria:
     - Control UI opens directly on the target qa-channel session.
diff --git a/qa/scenarios/workspace/lobster-invaders-build.yaml b/qa/scenarios/workspace/lobster-invaders-build.yaml
index 7b387d6f2a09..35d0db984661 100644
--- a/qa/scenarios/workspace/lobster-invaders-build.yaml
+++ b/qa/scenarios/workspace/lobster-invaders-build.yaml
@@ -5,9 +5,10 @@ scenario:
   surface: workspace
   coverage:
     primary:
-      - workspace.artifacts
+      - agent-runtime.tool-fs-write
     secondary:
-      - workspace.builds
+      - app-sdk.artifact-resources-builds
+      - agent-runtime.tool-fs-read
   objective: Verify the agent can read the repo, create a tiny playable artifact, and report what changed.
   successCriteria:
     - Agent inspects source before coding.
diff --git a/qa/scenarios/workspace/long-running-release-audit.yaml b/qa/scenarios/workspace/long-running-release-audit.yaml
index d902ab592dd7..5923b5da5aa8 100644
--- a/qa/scenarios/workspace/long-running-release-audit.yaml
+++ b/qa/scenarios/workspace/long-running-release-audit.yaml
@@ -5,10 +5,9 @@ scenario:
   surface: workspace
   coverage:
     primary:
-      - workspace.long-running-task
+      - agent-runtime.tool-fs-write
     secondary:
-      - workspace.repo-discovery
-      - workspace.artifacts
+      - agent-runtime.tool-fs-read
   objective: Verify a model can complete a sustained repo audit that requires reading several scattered files, ignoring stale decoys, writing artifacts, and checking its own output.
   successCriteria:
     - Agent starts from the seeded project README instead of guessing.
diff --git a/qa/scenarios/workspace/medium-game-plan-codex-harness.yaml b/qa/scenarios/workspace/medium-game-plan-codex-harness.yaml
index 2db693d52e3c..448591863bd1 100644
--- a/qa/scenarios/workspace/medium-game-plan-codex-harness.yaml
+++ b/qa/scenarios/workspace/medium-game-plan-codex-harness.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: workspace
   coverage:
     primary:
-      - workspace.planning
+      - openai.codex-harness-planning
     secondary:
-      - models.codex-cli
+      - openai.codex-harness-codex-cli
   plugins:
     - codex
   objective: Verify the Codex app-server harness can plan and build a medium-complex self-contained browser game.
diff --git a/qa/scenarios/workspace/medium-game-plan-openclaw-harness.yaml b/qa/scenarios/workspace/medium-game-plan-openclaw-harness.yaml
index aa27dd927d31..609cf28e656c 100644
--- a/qa/scenarios/workspace/medium-game-plan-openclaw-harness.yaml
+++ b/qa/scenarios/workspace/medium-game-plan-openclaw-harness.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: workspace
   coverage:
     primary:
-      - workspace.planning
+      - agent-runtime.external-harness-selection-planning
     secondary:
-      - agents.openclaw-harness
+      - agent-runtime.external-harness-selection-openclaw-harness
   objective: Verify GPT-5.6 Luna can use the OpenClaw harness to plan and build a medium-complex self-contained browser game.
   successCriteria:
     - A live-frontier run fails fast unless the selected primary model is openai/gpt-5.6-luna.
diff --git a/qa/scenarios/workspace/source-docs-discovery-report.yaml b/qa/scenarios/workspace/source-docs-discovery-report.yaml
index b869bad16cc1..bae19d2bdef5 100644
--- a/qa/scenarios/workspace/source-docs-discovery-report.yaml
+++ b/qa/scenarios/workspace/source-docs-discovery-report.yaml
@@ -5,9 +5,9 @@ scenario:
   surface: discovery
   coverage:
     primary:
-      - workspace.repo-discovery
+      - agent-runtime.tool-fs-read
     secondary:
-      - docs.discovery
+      - session-memory.context-visibility-discovery
   objective: Verify the agent can read repo docs and source, expand the QA plan, and publish a worked or did-not-work report.
   successCriteria:
     - Agent reads docs and source before proposing more tests.
diff --git a/src/cli/profile.test.ts b/src/cli/profile.test.ts
index 2bc2e12c1ccc..3a15d18866f6 100644
--- a/src/cli/profile.test.ts
+++ b/src/cli/profile.test.ts
@@ -120,7 +120,7 @@ describe("parseCliProfileArgs", () => {
       "--profile",
       "smoke-ci",
       "--category",
-      "agent-runtime-and-provider-execution.agent-turn-execution",
+      "agent-runtime.agent-turn-execution",
     ]);
     if (!res.ok) {
       throw new Error(res.error);
@@ -132,7 +132,7 @@ describe("parseCliProfileArgs", () => {
       "qa",
       "run",
       "--category",
-      "agent-runtime-and-provider-execution.agent-turn-execution",
+      "agent-runtime.agent-turn-execution",
     ]);
   });
 
@@ -162,7 +162,7 @@ describe("parseCliProfileArgs", () => {
       "--qa-profile",
       "smoke-ci",
       "--surface",
-      "agent-runtime-and-provider-execution",
+      "agent-runtime",
     ]);
     if (!res.ok) {
       throw new Error(res.error);
@@ -176,7 +176,7 @@ describe("parseCliProfileArgs", () => {
       "--qa-profile",
       "smoke-ci",
       "--surface",
-      "agent-runtime-and-provider-execution",
+      "agent-runtime",
     ]);
   });
 
diff --git a/taxonomy.yaml b/taxonomy.yaml
index 38bc77aa9b23..bc0026612a8c 100644
--- a/taxonomy.yaml
+++ b/taxonomy.yaml
@@ -8,161 +8,143 @@ snapshot:
 profiles:
   - id: smoke-ci
     description: Deterministic PR and merge proof with mock model providers and the
-      Crabline-backed channel driver; no live external service required.
+      Crabline-backed channel driver; categories are limited to exact owners exercised by the
+      fixed bounded CI plan.
     evidenceMode: slim
     channelDriver: crabline
     categoryIds:
-      - agent-runtime-and-provider-execution.model-and-runtime-selection
-      - agent-runtime-and-provider-execution.provider-auth
-      - agent-runtime-and-provider-execution.streaming-and-progress
-      - agent-runtime-and-provider-execution.tool-calls-and-response-handling
-      - agent-runtime-and-provider-execution.tool-execution-controls
-      - session-memory-and-context-engine.context-engine
-      - session-memory-and-context-engine.cross-client-history-and-session-parity
-      - session-memory-and-context-engine.core-prompts-and-context
-      - session-memory-and-context-engine.session-routing
-      - browser-automation-and-exec-sandbox-tools.tool-invocation-and-execution
-      - security-auth-pairing-and-secrets.approval-policy-and-tool-safeguards
-      - telemetry-diagnostics-and-observability.health-and-repair
-      - telemetry-diagnostics-and-observability.diagnostic-collection
-      - telemetry-diagnostics-and-observability.telemetry-export
-      - gateway-runtime.gateway-rpc-apis-and-events
-      - gateway-runtime.websocket-connection
-      - channel-framework.channel-actions-commands-and-approvals
-      - channel-framework.channel-setup
-      - channel-framework.conversation-routing-and-delivery
-      - channel-framework.outbound-delivery-and-reply-pipeline
-      - channel-framework.group-thread-and-ambient-room-behavior
-      - channel-framework.status-health-and-operator-controls
-      - session-memory-and-context-engine.diagnostics-maintenance-and-recovery
-      - automation-cron-hooks-tasks-polling.cron-jobs
-      - plugin-sdk-and-bundled-plugin-architecture.installing-and-running-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.provider-and-tool-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.testing-plugins
-      - media-understanding-and-media-generation.media-understanding
-      - media-understanding-and-media-generation.media-generation
-      - browser-control-ui-and-webchat.browser-ui
+      - agent-runtime.model-and-runtime-selection
+      - agent-runtime.tool-calls-and-response-handling
+      - session-memory.cross-client-history-and-session-parity
+      - session-memory.memory
+      - gateway.gateway-rpc-apis-and-events
+      - gateway.websocket-connection
+      - channels.channel-actions-commands-and-approvals
+      - channels.channel-setup
+      - channels.outbound-delivery-and-reply-pipeline
+      - plugins.installing-and-running-plugins
+      - control-ui.browser-ui
   - id: release
     description: Stable/LTS proof selector for live providers, live channels, package artifacts,
       upgrade paths, and platform proof where the claim depends on real upstreams or release
       artifacts.
     channelDriver: live
     categoryIds:
-      - gateway-runtime.approvals-and-remote-execution
-      - gateway-runtime.http-apis
-      - gateway-runtime.hosted-web-surface
-      - gateway-runtime.gateway-rpc-apis-and-events
-      - gateway-runtime.device-auth-and-pairing
-      - gateway-runtime.network-access-and-discovery
-      - gateway-runtime.nodes-and-remote-capabilities
-      - gateway-runtime.health-diagnostics-and-repair
-      - gateway-runtime.protocol-compatibility
-      - gateway-runtime.roles-and-permissions
-      - gateway-runtime.gateway-lifecycle
-      - gateway-runtime.security-controls
-      - gateway-runtime.websocket-connection
-      - cli-install-update-onboard-doctor.cli-setup
-      - cli-install-update-onboard-doctor.onboarding-and-auth-setup
-      - cli-install-update-onboard-doctor.plugin-and-channel-setup
-      - cli-install-update-onboard-doctor.gateway-service-management
-      - cli-install-update-onboard-doctor.cli-observability
-      - cli-install-update-onboard-doctor.doctor
-      - cli-install-update-onboard-doctor.updates-and-upgrades
-      - plugin-sdk-and-bundled-plugin-architecture.authoring-and-packaging-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.bundled-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.canvas-plugin
-      - plugin-sdk-and-bundled-plugin-architecture.installing-and-running-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.channel-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.provider-and-tool-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.plugin-approvals
-      - plugin-sdk-and-bundled-plugin-architecture.publishing-plugins
-      - plugin-sdk-and-bundled-plugin-architecture.testing-plugins
-      - agent-runtime-and-provider-execution.agent-turn-execution
-      - agent-runtime-and-provider-execution.external-runtimes-and-subagents
-      - agent-runtime-and-provider-execution.hosted-provider-execution
-      - agent-runtime-and-provider-execution.local-and-self-hosted-providers
-      - agent-runtime-and-provider-execution.model-and-runtime-selection
-      - agent-runtime-and-provider-execution.provider-auth
-      - agent-runtime-and-provider-execution.streaming-and-progress
-      - agent-runtime-and-provider-execution.tool-calls-and-response-handling
-      - agent-runtime-and-provider-execution.tool-execution-controls
-      - session-memory-and-context-engine.cli-session-and-transcript-management
-      - session-memory-and-context-engine.token-management
-      - session-memory-and-context-engine.context-engine
-      - session-memory-and-context-engine.cross-client-history-and-session-parity
-      - session-memory-and-context-engine.diagnostics-maintenance-and-recovery
-      - session-memory-and-context-engine.core-prompts-and-context
-      - session-memory-and-context-engine.memory
-      - session-memory-and-context-engine.session-routing
-      - session-memory-and-context-engine.transcript-persistence
-      - channel-framework.channel-actions-commands-and-approvals
-      - channel-framework.channel-setup
-      - channel-framework.group-thread-and-ambient-room-behavior
-      - channel-framework.inbound-access-and-identity-gates
-      - channel-framework.media-attachments-and-rich-channel-data
-      - channel-framework.outbound-delivery-and-reply-pipeline
-      - channel-framework.conversation-routing-and-delivery
-      - channel-framework.status-health-and-operator-controls
-      - security-auth-pairing-and-secrets.approval-policy-and-tool-safeguards
-      - security-auth-pairing-and-secrets.gateway-auth-and-remote-access
-      - security-auth-pairing-and-secrets.channel-access-control
-      - security-auth-pairing-and-secrets.device-and-node-pairing
-      - security-auth-pairing-and-secrets.plugin-trust
-      - security-auth-pairing-and-secrets.credential-and-secret-hygiene
-      - telemetry-diagnostics-and-observability.health-and-repair
-      - telemetry-diagnostics-and-observability.logging
-      - telemetry-diagnostics-and-observability.diagnostic-collection
-      - telemetry-diagnostics-and-observability.telemetry-export
-      - telemetry-diagnostics-and-observability.session-diagnostics
-      - automation-cron-hooks-tasks-polling.cron-jobs
-      - automation-cron-hooks-tasks-polling.event-ingress
-      - automation-cron-hooks-tasks-polling.automation-hooks
-      - automation-cron-hooks-tasks-polling.background-tasks-and-flows
-      - automation-cron-hooks-tasks-polling.heartbeat
-      - automation-cron-hooks-tasks-polling.polling-controls
-      - media-understanding-and-media-generation.media-understanding
-      - media-understanding-and-media-generation.media-generation
-      - browser-control-ui-and-webchat.browser-realtime-talk
-      - browser-control-ui-and-webchat.browser-access-and-trust
-      - browser-control-ui-and-webchat.configuration
-      - browser-control-ui-and-webchat.browser-ui
-      - browser-control-ui-and-webchat.webchat-conversations
-      - browser-control-ui-and-webchat.operator-console
-      - macos-gateway-host.cli-setup
-      - macos-gateway-host.local-gateway-integration
-      - macos-gateway-host.remote-gateway-mode
-      - macos-gateway-host.gateway-service-lifecycle
-      - macos-gateway-host.diagnostics-and-observability
-      - macos-gateway-host.permissions-and-native-capabilities
-      - macos-gateway-host.profiles-and-isolation
-      - macos-companion-app.canvas
-      - macos-companion-app.local-setup
-      - macos-companion-app.status-and-settings
-      - macos-companion-app.native-capabilities
-      - macos-companion-app.remote-connections
-      - macos-companion-app.voice-and-talk
-      - macos-companion-app.webchat
-      - macos-companion-app.remote-webchat
-      - linux-gateway-host.host-setup-and-updates
-      - linux-gateway-host.gateway-runtime-and-service-control
-      - linux-gateway-host.remote-access-and-security
-      - linux-gateway-host.diagnostics-and-repair
-      - linux-gateway-host.deployment-targets
-      - windows-via-wsl2.wsl-setup
-      - windows-via-wsl2.cli
-      - windows-via-wsl2.gateway-service-lifecycle
-      - windows-via-wsl2.gateway-access-and-exposure
-      - windows-via-wsl2.diagnostics-and-repair
-      - windows-via-wsl2.browser-and-control-ui
-      - native-windows-cli-and-gateway.cli
-      - raspberry-pi-small-linux-devices.setup-and-compatibility
-      - raspberry-pi-small-linux-devices.remote-access-and-auth
-      - raspberry-pi-small-linux-devices.gateway-runtime
-      - raspberry-pi-small-linux-devices.performance-and-diagnostics
-      - docker-podman-hosting.container-setup
-      - docker-podman-hosting.container-operations
-      - docker-podman-hosting.image-release-and-validation
-      - docker-podman-hosting.agent-sandbox-and-tooling
+      - gateway.approvals-and-remote-execution
+      - gateway.http-apis
+      - gateway.hosted-web-surface
+      - gateway.gateway-rpc-apis-and-events
+      - gateway.device-auth-and-pairing
+      - gateway.network-access-and-discovery
+      - gateway.nodes-and-remote-capabilities
+      - gateway.health-diagnostics-and-repair
+      - gateway.protocol-compatibility
+      - gateway.roles-and-permissions
+      - gateway.gateway-lifecycle
+      - gateway.security-controls
+      - gateway.websocket-connection
+      - cli.cli-setup
+      - cli.onboarding-and-auth-setup
+      - cli.plugin-and-channel-setup
+      - cli.gateway-service-management
+      - cli.cli-observability
+      - cli.doctor
+      - cli.updates-and-upgrades
+      - plugins.authoring-and-packaging-plugins
+      - plugins.bundled-plugins
+      - plugins.canvas-plugin
+      - plugins.installing-and-running-plugins
+      - plugins.channel-plugins
+      - plugins.provider-and-tool-plugins
+      - plugins.plugin-approvals
+      - plugins.publishing-plugins
+      - plugins.testing-plugins
+      - agent-runtime.agent-turn-execution
+      - agent-runtime.external-runtimes-and-subagents
+      - agent-runtime.hosted-provider-execution
+      - agent-runtime.local-and-self-hosted-providers
+      - agent-runtime.model-and-runtime-selection
+      - agent-runtime.provider-auth
+      - agent-runtime.streaming-and-progress
+      - agent-runtime.tool-calls-and-response-handling
+      - agent-runtime.tool-execution-controls
+      - session-memory.cli-session-and-transcript-management
+      - session-memory.token-management
+      - session-memory.context-engine
+      - session-memory.cross-client-history-and-session-parity
+      - session-memory.diagnostics-maintenance-and-recovery
+      - session-memory.core-prompts-and-context
+      - session-memory.memory
+      - session-memory.session-routing
+      - session-memory.transcript-persistence
+      - channels.channel-actions-commands-and-approvals
+      - channels.channel-setup
+      - channels.group-thread-and-ambient-room-behavior
+      - channels.inbound-access-and-identity-gates
+      - channels.media-attachments-and-rich-channel-data
+      - channels.outbound-delivery-and-reply-pipeline
+      - channels.conversation-routing-and-delivery
+      - channels.status-health-and-operator-controls
+      - security.approval-policy-and-tool-safeguards
+      - security.gateway-auth-and-remote-access
+      - security.channel-access-control
+      - security.device-and-node-pairing
+      - security.plugin-trust
+      - security.credential-and-secret-hygiene
+      - observability.health-and-repair
+      - observability.logging
+      - observability.diagnostic-collection
+      - observability.telemetry-export
+      - observability.session-diagnostics
+      - automation.cron-jobs
+      - automation.event-ingress
+      - automation.automation-hooks
+      - automation.background-tasks-and-flows
+      - automation.heartbeat
+      - automation.polling-controls
+      - media.media-understanding
+      - media.media-generation
+      - control-ui.browser-realtime-talk
+      - control-ui.browser-access-and-trust
+      - control-ui.configuration
+      - control-ui.browser-ui
+      - control-ui.webchat-conversations
+      - control-ui.operator-console
+      - macos-host.cli-setup
+      - macos-host.local-gateway-integration
+      - macos-host.remote-gateway-mode
+      - macos-host.gateway-service-lifecycle
+      - macos-host.diagnostics-and-observability
+      - macos-host.permissions-and-native-capabilities
+      - macos-host.profiles-and-isolation
+      - macos-app.canvas
+      - macos-app.local-setup
+      - macos-app.status-and-settings
+      - macos-app.native-capabilities
+      - macos-app.remote-connections
+      - macos-app.voice-and-talk
+      - macos-app.webchat
+      - macos-app.remote-webchat
+      - linux-host.host-setup-and-updates
+      - linux-host.gateway-runtime-and-service-control
+      - linux-host.remote-access-and-security
+      - linux-host.diagnostics-and-repair
+      - linux-host.deployment-targets
+      - wsl.wsl-setup
+      - wsl.cli
+      - wsl.gateway-service-lifecycle
+      - wsl.gateway-access-and-exposure
+      - wsl.diagnostics-and-repair
+      - wsl.browser-and-control-ui
+      - windows.cli
+      - small-linux.setup-and-compatibility
+      - small-linux.remote-access-and-auth
+      - small-linux.gateway-runtime
+      - small-linux.performance-and-diagnostics
+      - containers.container-setup
+      - containers.container-operations
+      - containers.image-release-and-validation
+      - containers.agent-sandbox-and-tooling
       - discord.channel-setup-and-operations
       - discord.access-and-identity
       - discord.conversation-routing-and-delivery
@@ -189,32 +171,32 @@ profiles:
       - imessage-bluebubbles.conversation-routing-and-delivery
       - imessage-bluebubbles.media-and-rich-content
       - imessage-bluebubbles.native-controls-and-approvals
-      - openai-codex-provider-path.model-and-auth
-      - openai-codex-provider-path.responses-and-tool-compatibility
-      - openai-codex-provider-path.native-codex-harness
-      - openai-codex-provider-path.image-and-multimodal-input
-      - openai-codex-provider-path.voice-and-realtime-audio
-      - anthropic-provider-path.provider-auth-and-recovery
-      - anthropic-provider-path.model-and-runtime-selection
-      - anthropic-provider-path.request-transport-and-turn-semantics
-      - anthropic-provider-path.prompt-cache-and-context
-      - anthropic-provider-path.media-inputs
-      - google-provider-path.provider-setup-and-credentials
-      - google-provider-path.model-routing-and-endpoints
-      - google-provider-path.direct-gemini-runtime
-      - google-provider-path.media-search-and-realtime
-      - google-provider-path.prompt-caching
-      - openrouter-provider-path.provider-setup-and-auth
-      - openrouter-provider-path.chat-runtime-and-normalization
-      - openrouter-provider-path.provider-recovery-and-diagnostics
-      - openrouter-provider-path.media-generation-and-speech
-      - web-search-tools.search-providers
-      - web-search-tools.setup-and-diagnostics
-      - web-search-tools.network-safety
-      - web-search-tools.tool-availability-and-fetch
-      - browser-automation-and-exec-sandbox-tools.browser-automation
-      - browser-automation-and-exec-sandbox-tools.tool-invocation-and-execution
-      - browser-automation-and-exec-sandbox-tools.sandbox-and-tool-policy
+      - openai.model-and-auth
+      - openai.responses-and-tool-compatibility
+      - openai.native-codex-harness
+      - openai.image-and-multimodal-input
+      - openai.voice-and-realtime-audio
+      - anthropic.provider-auth-and-recovery
+      - anthropic.model-and-runtime-selection
+      - anthropic.request-transport-and-turn-semantics
+      - anthropic.prompt-cache-and-context
+      - anthropic.media-inputs
+      - google-ai.provider-setup-and-credentials
+      - google-ai.model-routing-and-endpoints
+      - google-ai.direct-gemini-runtime
+      - google-ai.media-search-and-realtime
+      - google-ai.prompt-caching
+      - openrouter.provider-setup-and-auth
+      - openrouter.chat-runtime-and-normalization
+      - openrouter.provider-recovery-and-diagnostics
+      - openrouter.media-generation-and-speech
+      - web-search.search-providers
+      - web-search.setup-and-diagnostics
+      - web-search.network-safety
+      - web-search.tool-availability-and-fetch
+      - tools.browser-automation
+      - tools.tool-invocation-and-execution
+      - tools.sandbox-and-tool-policy
   - id: all
     description: Full taxonomy scorecard selector for generated maturity coverage evidence across
       every active category. Intended for explicit QA evidence workflow dispatches rather than the
@@ -253,7 +235,7 @@ levels:
     meaning: Polished, delightful, well-instrumented, and competitive with the best comparable workflow.
     promotion_bar: Stable plus user scorecard pass across representative users.
 surfaces:
-  - id: gateway-runtime
+  - id: gateway
     name: Gateway runtime
     family: core
     level: stable
@@ -324,7 +306,7 @@ surfaces:
         id: hosted-web-surface
         features:
           - name: Control UI
-            coverageIds: [gateway.control-ui-hosting]
+            coverageIds: [gateway.control-ui]
             description: Control UI hosting on the Gateway server.
           - name: WebChat hosting
             coverageIds: [gateway.webchat-hosting]
@@ -364,9 +346,15 @@ surfaces:
           - name: Usage and memory APIs
             coverageIds: [gateway.usage-and-memory-apis]
             description: Usage summaries and memory readiness RPCs.
-          - name: Session APIs
-            coverageIds: [agents.subagents, gateway.sessions-list, tools.session-status]
-            description: "`sessions.*` RPCs."
+          - name: "Session APIs — Subagents"
+            coverageIds: [gateway.session-apis-subagents]
+            description: "Exact coverage for subagents within Session APIs."
+          - name: "Session APIs — Sessions list"
+            coverageIds: [gateway.session-apis-sessions-list]
+            description: "Exact coverage for sessions list within Session APIs."
+          - name: "Session APIs — Session status"
+            coverageIds: [gateway.session-apis-session-status]
+            description: "Exact coverage for session status within Session APIs."
           - name: Chat APIs
             coverageIds: [gateway.chat-apis]
             description: "`chat.*` and `agent.wait` RPCs."
@@ -433,7 +421,7 @@ surfaces:
             coverageIds: [gateway.shared-secret-login]
             description: Shared-secret auth by token or password.
           - name: Trusted proxy auth
-            coverageIds: [security.trusted-proxy-auth]
+            coverageIds: [gateway.trusted-proxy-auth]
             description: Trusted-proxy and identity-bearing auth modes.
           - name: Private ingress mode
             coverageIds: [gateway.private-ingress-mode]
@@ -457,7 +445,7 @@ surfaces:
             coverageIds: [gateway.client-pairing]
             description: Device pairing requirements for new clients.
           - name: Node pairing
-            coverageIds: [security.node-pairing]
+            coverageIds: [gateway.node-pairing]
             description: Node pairing flows, including pending requests, approvals, expiry, and trusted-CIDR or metadata-upgrade auto-approval boundaries.
         docs:
           - docs/gateway/protocol.md
@@ -538,7 +526,7 @@ surfaces:
         id: health-diagnostics-and-repair
         features:
           - name: Health snapshots
-            coverageIds: [telemetry.health-snapshots]
+            coverageIds: [gateway.health-snapshots]
             description: "`health` and `status` snapshots."
           - name: Channel readiness
             coverageIds: [gateway.channel-readiness]
@@ -553,7 +541,7 @@ surfaces:
             coverageIds: [gateway.diagnostics-exports]
             description: Diagnostics export contents, privacy model, and CLI/chat triggers.
           - name: Doctor checks
-            coverageIds: [telemetry.doctor-checks]
+            coverageIds: [gateway.doctor-checks]
             description: Doctor checks for UI protocol freshness, service drift, auth/pairing drift, port collisions, sandbox/runtime best practices, and source-install issues.
           - name: Log tailing
             coverageIds: [gateway.log-tailing]
@@ -636,18 +624,33 @@ surfaces:
           - name: Service installation
             coverageIds: [gateway.service-installation]
             description: Supervised lifecycle installation on macOS, Linux user/systemd, and native Windows task scheduling.
-          - name: Restart and stop
-            coverageIds: [config.restart-apply, plugins.capabilities, runtime.gateway-restart]
-            description: Correct `restart` and `stop` behavior for supervised installs.
+          - name: "Restart and stop — Restart apply"
+            coverageIds: [gateway.restart-and-stop-restart-apply]
+            description: "Exact coverage for restart apply within Restart and stop."
+          - name: "Restart and stop — Capabilities"
+            coverageIds: [gateway.restart-and-stop-capabilities]
+            description: "Exact coverage for capabilities within Restart and stop."
+          - name: "Restart and stop — Gateway restart"
+            coverageIds: [gateway.restart-and-stop-gateway-restart]
+            description: "Exact coverage for gateway restart within Restart and stop."
           - name: Service status
             coverageIds: [gateway.service-status]
             description: Status behavior for supervised installs.
           - name: Bind and port settings
             coverageIds: [gateway.bind-and-port-settings]
             description: Bind and port precedence across CLI flags, env vars, config, and persisted supervisor metadata.
-          - name: Config reload
-            coverageIds: [config.hot-apply, plugins.hot-reload, plugins.lifecycle, plugins.skills]
-            description: "Config reload modes: `off`, `hot`, `restart`, and `hybrid`."
+          - name: "Config reload — Hot apply"
+            coverageIds: [gateway.config-reload-hot-apply]
+            description: "Exact coverage for hot apply within Config reload."
+          - name: "Config reload — Hot reload"
+            coverageIds: [gateway.config-reload-hot-reload]
+            description: "Exact coverage for hot reload within Config reload."
+          - name: "Config reload — Lifecycle"
+            coverageIds: [gateway.config-reload-lifecycle]
+            description: "Exact coverage for lifecycle within Config reload."
+          - name: "Config reload — Skills"
+            coverageIds: [gateway.config-reload-skills]
+            description: "Exact coverage for skills within Config reload."
           - name: Multi-gateway isolation
             coverageIds: [gateway.multi-gateway-isolation]
             description: Multiple-gateway isolation on one host, including config/state/workspace separation.
@@ -730,7 +733,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: cli-install-update-onboard-doctor
+  - id: cli
     name: CLI
     family: core
     level: stable
@@ -757,7 +760,7 @@ surfaces:
             coverageIds: [cli.source-checkout-install]
             description: Operators can run OpenClaw from a source checkout for development or recovery workflows, and update flows distinguish this path from package installs.
           - name: CLI entrypoint
-            coverageIds: [cli.entrypoint]
+            coverageIds: [cli.cli-entrypoint]
             description: The packaged openclaw launcher, openclaw --help, openclaw --version, runtime preflight, and basic recovery expectations are documented.
         docs:
           - docs/install/index.md
@@ -834,9 +837,15 @@ surfaces:
           - name: Service install and control
             coverageIds: [cli.service-install-and-control]
             description: The CLI documents install, status, start, stop, restart, and run flows for managed gateway services.
-          - name: Service auth wiring
-            coverageIds: [agents.create, channels.discord-config, config.system-agent-setup]
-            description: Gateway service installation documents how auth tokens and other sensitive values are handled.
+          - name: "Service auth wiring — Create"
+            coverageIds: [cli.service-auth-wiring-create]
+            description: "Exact coverage for create within Service auth wiring."
+          - name: "Service auth wiring — Discord config"
+            coverageIds: [cli.service-auth-wiring-discord-config]
+            description: "Exact coverage for discord config within Service auth wiring."
+          - name: "Service auth wiring — System agent setup"
+            coverageIds: [cli.service-auth-wiring-system-agent-setup]
+            description: "Exact coverage for system agent setup within Service auth wiring."
           - name: Drift and reinstall recovery
             coverageIds: [cli.drift-and-reinstall-recovery]
             description: Operators are given explicit guidance for repairing or reinstalling a broken managed gateway service.
@@ -859,7 +868,7 @@ surfaces:
             coverageIds: [cli.status-snapshots]
             description: openclaw status and related flags summarize runtime state, config health, and update context.
           - name: Health snapshots
-            coverageIds: [telemetry.health-snapshots]
+            coverageIds: [cli.health-snapshots]
             description: openclaw health gives a fast gateway health read and supports verbose or JSON output.
           - name: Remote log tailing
             coverageIds: [cli.remote-log-tailing]
@@ -893,7 +902,7 @@ surfaces:
             coverageIds: [cli.auth-and-secretref-checks]
             description: Doctor audits auth shape, token generation, and supported SecretRef-backed config paths.
           - name: Plugin validation and repair
-            coverageIds: [cli.plugin-validation-repair]
+            coverageIds: [cli.plugin-validation-and-repair]
             description: Doctor surfaces plugin-config issues and extension schema drift that block normal runtime operation.
           - name: Lint and JSON findings
             coverageIds: [cli.lint-and-json-findings]
@@ -958,7 +967,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: plugin-sdk-and-bundled-plugin-architecture
+  - id: plugins
     name: Plugins
     family: core
     level: beta
@@ -1007,7 +1016,7 @@ surfaces:
             coverageIds: [plugins.migration-shims]
             description: Deprecated or compatibility subpaths continue to resolve during author migrations.
           - name: Plugin manifest
-            coverageIds: [plugins.manifest]
+            coverageIds: [plugins.plugin-manifest]
             description: "`openclaw.plugin.json` declares plugin identity, capabilities, and config schema."
           - name: Package metadata
             coverageIds: [plugins.package-metadata]
@@ -1099,44 +1108,77 @@ surfaces:
         id: installing-and-running-plugins
         features:
           - name: Plugin setup
-            coverageIds: [plugins.setup-flows]
+            coverageIds: [plugins.plugin-setup]
             description: Operators can run plugin setup flows without fully activating runtime behavior.
-          - name: Runtime activation
-            coverageIds:
-              [
-                config.hot-apply,
-                gateway.performance,
-                models.live-openai,
-                plugins.before-prompt-build,
-                plugins.before-tool-call,
-                plugins.hot-reload,
-                plugins.kitchen-sink,
-                plugins.lifecycle,
-                plugins.plugin-tools,
-                plugins.runtime,
-                plugins.skills,
-                runtime.gateway-log-sentinel.plugin-hooks,
-              ]
-            description: Enabled plugins activate and register runtime behavior after manifest validation succeeds.
-          - name: Enable and disable
-            coverageIds: [config.hot-apply, plugins.hot-reload, plugins.lifecycle]
-            description: Operators can enable or disable installed plugins without losing install state.
-          - name: Safe load failures
-            coverageIds: [plugins.contracts.tools, runtime.gateway-log-sentinel.plugin-contracts]
-            description: Unsafe or unsupported plugin loads are blocked with diagnosable failures before runtime execution.
+          - name: "Runtime activation — Hot apply"
+            coverageIds: [plugins.activation-hot-apply]
+            description: "Exact coverage for hot apply within Runtime activation."
+          - name: "Runtime activation — Performance"
+            coverageIds: [plugins.activation-performance]
+            description: "Exact coverage for performance within Runtime activation."
+          - name: "Runtime activation — Live openai"
+            coverageIds: [plugins.activation-live-openai]
+            description: "Exact coverage for live openai within Runtime activation."
+          - name: "Runtime activation — Before prompt build"
+            coverageIds: [plugins.activation-before-prompt-build]
+            description: "Exact coverage for before prompt build within Runtime activation."
+          - name: "Runtime activation — Before tool call"
+            coverageIds: [plugins.activation-before-tool-call]
+            description: "Exact coverage for before tool call within Runtime activation."
+          - name: "Runtime activation — Hot reload"
+            coverageIds: [plugins.activation-hot-reload]
+            description: "Exact coverage for hot reload within Runtime activation."
+          - name: "Runtime activation — Kitchen sink"
+            coverageIds: [plugins.activation-kitchen-sink]
+            description: "Exact coverage for kitchen sink within Runtime activation."
+          - name: "Runtime activation — Lifecycle"
+            coverageIds: [plugins.activation-lifecycle]
+            description: "Exact coverage for lifecycle within Runtime activation."
+          - name: "Runtime activation — Plugin tools"
+            coverageIds: [plugins.activation-plugin-tools]
+            description: "Exact coverage for plugin tools within Runtime activation."
+          - name: "Runtime activation — Runtime"
+            coverageIds: [plugins.activation-runtime]
+            description: "Exact coverage for runtime within Runtime activation."
+          - name: "Runtime activation — Skills"
+            coverageIds: [plugins.activation-skills]
+            description: "Exact coverage for skills within Runtime activation."
+          - name: "Runtime activation — Gateway log sentinel plugin hooks"
+            coverageIds: [plugins.activation-gateway-log-sentinel-plugin-hooks]
+            description: "Exact coverage for gateway log sentinel plugin hooks within Runtime activation."
+          - name: "Enable and disable — Hot apply"
+            coverageIds: [plugins.enable-and-disable-hot-apply]
+            description: "Exact coverage for hot apply within Enable and disable."
+          - name: "Enable and disable — Hot reload"
+            coverageIds: [plugins.enable-and-disable-hot-reload]
+            description: "Exact coverage for hot reload within Enable and disable."
+          - name: "Enable and disable — Lifecycle"
+            coverageIds: [plugins.enable-and-disable-lifecycle]
+            description: "Exact coverage for lifecycle within Enable and disable."
+          - name: "Safe load failures — Contracts tools"
+            coverageIds: [plugins.load-failure-contracts-tools]
+            description: "Exact coverage for contracts tools within Safe load failures."
+          - name: "Safe load failures — Gateway log sentinel plugin contracts"
+            coverageIds: [plugins.load-failure-contract-sentinel]
+            description: "Exact coverage for gateway log sentinel plugin contracts within Safe load failures."
           - name: Dependency repair
             coverageIds: [plugins.dependency-repair]
             description: Runtime can detect and repair missing or stale plugin dependencies.
-          - name: Install update and uninstall
-            coverageIds:
-              [
-                plugins.hot-install,
-                plugins.skills,
-                runtime.gateway-restart,
-                runtime.package-update,
-                runtime.update-run,
-              ]
-            description: Install, update, and uninstall lifecycle behavior is defined and tested.
+          - name: "Install update and uninstall — Hot install"
+            coverageIds: [plugins.lifecycle-hot-install]
+            description: "Exact coverage for hot install within Install update and uninstall."
+          - name: "Install update and uninstall — Skills"
+            coverageIds: [plugins.lifecycle-skills]
+            description: "Exact coverage for skills within Install update and uninstall."
+          - name: "Install update and uninstall — Gateway restart"
+            coverageIds: [plugins.lifecycle-gateway-restart]
+            description: "Exact coverage for gateway restart within Install update and uninstall."
+          - name: "Install update and uninstall — Package update"
+            coverageIds: [plugins.lifecycle-package-update]
+            description: "Exact coverage for package update within Install update and uninstall."
+          - name: "Install update and uninstall — Update run"
+            coverageIds: [plugins.lifecycle-update-run]
+            description: "Exact coverage for update run within Install update and uninstall."
         docs:
           - docs/plugins/architecture.md
           - docs/plugins/architecture-internals.md
@@ -1183,21 +1225,36 @@ surfaces:
           - name: Provider plugins
             coverageIds: [plugins.provider-plugins]
             description: Provider plugins register models and capabilities with the runtime.
-          - name: Tool plugins
-            coverageIds:
-              [
-                gateway.performance,
-                models.live-openai,
-                plugins.before-prompt-build,
-                plugins.before-tool-call,
-                plugins.kitchen-sink,
-                plugins.lifecycle,
-                plugins.mcp-tools,
-                plugins.plugin-tools,
-                runtime.gateway-log-sentinel.plugin-hooks,
-                tools.invocation,
-              ]
-            description: Tool plugins register discoverable tools and static metadata without ambiguous runtime ownership.
+          - name: "Tool plugins — Performance"
+            coverageIds: [plugins.tool-plugin-performance]
+            description: "Exact coverage for performance within Tool plugins."
+          - name: "Tool plugins — Live openai"
+            coverageIds: [plugins.tool-plugin-live-openai]
+            description: "Exact coverage for live openai within Tool plugins."
+          - name: "Tool plugins — Before prompt build"
+            coverageIds: [plugins.tool-plugin-before-prompt-build]
+            description: "Exact coverage for before prompt build within Tool plugins."
+          - name: "Tool plugins — Before tool call"
+            coverageIds: [plugins.tool-plugin-before-tool-call]
+            description: "Exact coverage for before tool call within Tool plugins."
+          - name: "Tool plugins — Kitchen sink"
+            coverageIds: [plugins.tool-plugin-kitchen-sink]
+            description: "Exact coverage for kitchen sink within Tool plugins."
+          - name: "Tool plugins — Lifecycle"
+            coverageIds: [plugins.tool-plugin-lifecycle]
+            description: "Exact coverage for lifecycle within Tool plugins."
+          - name: "Tool plugins — MCP tools"
+            coverageIds: [plugins.tool-plugin-mcp-tools]
+            description: "Exact coverage for mcp tools within Tool plugins."
+          - name: "Tool plugins — Plugin tools"
+            coverageIds: [plugins.plugin-tools]
+            description: "Exact coverage for plugin tools within Tool plugins."
+          - name: "Tool plugins — Gateway log sentinel plugin hooks"
+            coverageIds: [plugins.hook-sentinel]
+            description: "Exact coverage for gateway log sentinel plugin hooks within Tool plugins."
+          - name: "Tool plugins — Invocation"
+            coverageIds: [plugins.tool-plugin-invocation]
+            description: "Exact coverage for invocation within Tool plugins."
           - name: Model catalogs
             coverageIds: [plugins.model-catalogs]
             description: Provider model catalogs are discoverable and merge cleanly into global listings.
@@ -1207,19 +1264,30 @@ surfaces:
           - name: Web search and fetch
             coverageIds: [plugins.web-search-and-fetch]
             description: Provider or tool plugins can expose web search and fetch capabilities.
-          - name: Mixed plugins
-            coverageIds:
-              [
-                config.hot-apply,
-                config.restart-apply,
-                plugins.capabilities,
-                plugins.hot-install,
-                plugins.runtime,
-                plugins.skills,
-                tools.invocation,
-                tools.skill-invocation,
-              ]
-            description: Mixed provider and tool plugins are supported without ambiguous ownership.
+          - name: "Mixed plugins — Hot apply"
+            coverageIds: [plugins.mixed-plugin-hot-apply]
+            description: "Exact coverage for hot apply within Mixed plugins."
+          - name: "Mixed plugins — Restart apply"
+            coverageIds: [plugins.mixed-plugin-restart-apply]
+            description: "Exact coverage for restart apply within Mixed plugins."
+          - name: "Mixed plugins — Capabilities"
+            coverageIds: [plugins.mixed-plugin-capabilities]
+            description: "Exact coverage for capabilities within Mixed plugins."
+          - name: "Mixed plugins — Hot install"
+            coverageIds: [plugins.mixed-plugin-hot-install]
+            description: "Exact coverage for hot install within Mixed plugins."
+          - name: "Mixed plugins — Runtime"
+            coverageIds: [plugins.mixed-plugin-runtime]
+            description: "Exact coverage for runtime within Mixed plugins."
+          - name: "Mixed plugins — Skills"
+            coverageIds: [plugins.mixed-plugin-skills]
+            description: "Exact coverage for skills within Mixed plugins."
+          - name: "Mixed plugins — Invocation"
+            coverageIds: [plugins.mixed-plugin-invocation]
+            description: "Exact coverage for invocation within Mixed plugins."
+          - name: "Mixed plugins — Skill invocation"
+            coverageIds: [plugins.mixed-plugin-skill-invocation]
+            description: "Exact coverage for skill invocation within Mixed plugins."
         docs:
           - docs/plugins/sdk-provider-plugins.md
           - docs/plugins/tool-plugins.md
@@ -1303,25 +1371,33 @@ surfaces:
           - name: Local test environment
             coverageIds: [plugins.local-test-environment]
             description: Plugin authors can set up the local test environment and scoped helper configuration for plugin testing.
-          - name: Plugin runtime harness
-            coverageIds: [plugins.contracts.tools, runtime.gateway-log-sentinel.plugin-contracts]
-            description: Plugin test harnesses cover authoring and runtime integration paths.
+          - name: "Plugin runtime harness — Contracts tools"
+            coverageIds: [plugins.harness-contracts-tools]
+            description: "Exact coverage for contracts tools within Plugin runtime harness."
+          - name: "Plugin runtime harness — Gateway log sentinel plugin contracts"
+            coverageIds: [plugins.harness-contract-sentinel]
+            description: "Exact coverage for gateway log sentinel plugin contracts within Plugin runtime harness."
           - name: Unit and integration scaffolds
             coverageIds: [plugins.unit-and-integration-scaffolds]
             description: Scoped test helpers and configuration support unit and integration testing for plugin surfaces.
           - name: Docker lifecycle suites
             coverageIds: [plugins.docker-lifecycle-suites]
             description: Docker-based end-to-end scripts validate packaged plugin lifecycle flows.
-          - name: Smoke tests
-            coverageIds:
-              [
-                gateway.performance,
-                models.live-openai,
-                plugins.kitchen-sink,
-                plugins.lifecycle,
-                plugins.plugin-tools,
-              ]
-            description: Local and packaged smoke tests catch broken installs before release.
+          - name: "Smoke tests — Performance"
+            coverageIds: [plugins.smoke-tests-performance]
+            description: "Exact coverage for performance within Smoke tests."
+          - name: "Smoke tests — Live openai"
+            coverageIds: [plugins.smoke-tests-live-openai]
+            description: "Exact coverage for live openai within Smoke tests."
+          - name: "Smoke tests — Kitchen sink"
+            coverageIds: [plugins.smoke-tests-kitchen-sink]
+            description: "Exact coverage for kitchen sink within Smoke tests."
+          - name: "Smoke tests — Lifecycle"
+            coverageIds: [plugins.smoke-tests-lifecycle]
+            description: "Exact coverage for lifecycle within Smoke tests."
+          - name: "Smoke tests — Plugin tools"
+            coverageIds: [plugins.smoke-tests-plugin-tools]
+            description: "Exact coverage for plugin tools within Smoke tests."
         docs:
           - docs/plugins/sdk-testing.md
           - docs/plugins/sdk-setup.md
@@ -1339,7 +1415,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: agent-runtime-and-provider-execution
+  - id: agent-runtime
     name: Agent Runtime
     family: core
     level: beta
@@ -1350,49 +1426,90 @@ surfaces:
       - name: Agent Turn Execution
         id: agent-turn-execution
         features:
-          - name: Turn startup and runtime choice
-            coverageIds:
-              [
-                agents.create,
-                agents.instructions,
-                channels.discord-config,
-                config.system-agent-setup,
-                runtime.first-action,
-                runtime.multi-turn-continuity,
-                runtime.long-context,
-              ]
-            description: Starting an agent turn and choosing gateway versus embedded runtime execution.
-          - name: Session and run coordination
-            coverageIds:
-              [
-                agents.subagents,
-                channels.dedup,
-                channels.dm,
-                channels.qa-channel,
-                channels.reconnect,
-                channels.streaming,
-                channels.threads,
-                commitments.heartbeat-target-none,
-                commitments.scope,
-                personal.channel-replies,
-                runtime.codex-plugin.lifecycle,
-                runtime.delivery,
-                runtime.fallback-delivery,
-                runtime.gateway-restart,
-                runtime.restart-recovery,
-                runtime.turn-ordering,
-              ]
-            description: Establishing session and run ids, queue locks, and related execution coordination.
-          - name: Abort and terminal outcomes
-            coverageIds:
-              [
-                channels.streaming,
-                runtime.delivery,
-                runtime.fallback-delivery,
-                runtime.long-context,
-                runtime.long-run-stability,
-              ]
-            description: Honoring aborts, timing provider/model work, and emitting terminal outcomes.
+          - name: "Turn startup and runtime choice — Create"
+            coverageIds: [agent-runtime.startup-create]
+            description: "Exact coverage for create within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — Instructions"
+            coverageIds: [agent-runtime.startup-instructions]
+            description: "Exact coverage for instructions within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — Discord config"
+            coverageIds: [agent-runtime.startup-discord-config]
+            description: "Exact coverage for discord config within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — System agent setup"
+            coverageIds: [agent-runtime.startup-system-agent-setup]
+            description: "Exact coverage for system agent setup within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — First action"
+            coverageIds: [agent-runtime.startup-first-action]
+            description: "Exact coverage for first action within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — Multi turn continuity"
+            coverageIds: [agent-runtime.startup-multi-turn-continuity]
+            description: "Exact coverage for multi turn continuity within Turn startup and runtime choice."
+          - name: "Turn startup and runtime choice — Long context"
+            coverageIds: [agent-runtime.startup-long-context]
+            description: "Exact coverage for long context within Turn startup and runtime choice."
+          - name: "Session and run coordination — Subagents"
+            coverageIds: [agent-runtime.session-subagents]
+            description: "Exact coverage for subagents within Session and run coordination."
+          - name: "Session and run coordination — Dedup"
+            coverageIds: [agent-runtime.session-dedup]
+            description: "Exact coverage for dedup within Session and run coordination."
+          - name: "Session and run coordination — DM"
+            coverageIds: [agent-runtime.session-dm]
+            description: "Exact coverage for dm within Session and run coordination."
+          - name: "Session and run coordination — QA channel"
+            coverageIds: [agent-runtime.session-qa-channel]
+            description: "Exact coverage for qa channel within Session and run coordination."
+          - name: "Session and run coordination — Reconnect"
+            coverageIds: [agent-runtime.session-reconnect]
+            description: "Exact coverage for reconnect within Session and run coordination."
+          - name: "Session and run coordination — Streaming"
+            coverageIds: [agent-runtime.session-streaming]
+            description: "Exact coverage for streaming within Session and run coordination."
+          - name: "Session and run coordination — Threads"
+            coverageIds: [agent-runtime.session-threads]
+            description: "Exact coverage for threads within Session and run coordination."
+          - name: "Session and run coordination — Heartbeat target none"
+            coverageIds: [agent-runtime.session-heartbeat-target-none]
+            description: "Exact coverage for heartbeat target none within Session and run coordination."
+          - name: "Session and run coordination — Scope"
+            coverageIds: [agent-runtime.session-scope]
+            description: "Exact coverage for scope within Session and run coordination."
+          - name: "Session and run coordination — Channel replies"
+            coverageIds: [agent-runtime.session-channel-replies]
+            description: "Exact coverage for channel replies within Session and run coordination."
+          - name: "Session and run coordination — Codex plugin lifecycle"
+            coverageIds: [agent-runtime.session-codex-plugin-lifecycle]
+            description: "Exact coverage for codex plugin lifecycle within Session and run coordination."
+          - name: "Session and run coordination — Delivery"
+            coverageIds: [agent-runtime.session-delivery]
+            description: "Exact coverage for delivery within Session and run coordination."
+          - name: "Session and run coordination — Fallback delivery"
+            coverageIds: [agent-runtime.session-fallback-delivery]
+            description: "Exact coverage for fallback delivery within Session and run coordination."
+          - name: "Session and run coordination — Gateway restart"
+            coverageIds: [agent-runtime.session-gateway-restart]
+            description: "Exact coverage for gateway restart within Session and run coordination."
+          - name: "Session and run coordination — Restart recovery"
+            coverageIds: [agent-runtime.session-restart-recovery]
+            description: "Exact coverage for restart recovery within Session and run coordination."
+          - name: "Session and run coordination — Turn ordering"
+            coverageIds: [agent-runtime.session-turn-ordering]
+            description: "Exact coverage for turn ordering within Session and run coordination."
+          - name: "Abort and terminal outcomes — Streaming"
+            coverageIds: [agent-runtime.terminal-streaming]
+            description: "Exact coverage for streaming within Abort and terminal outcomes."
+          - name: "Abort and terminal outcomes — Delivery"
+            coverageIds: [agent-runtime.terminal-delivery]
+            description: "Exact coverage for delivery within Abort and terminal outcomes."
+          - name: "Abort and terminal outcomes — Fallback delivery"
+            coverageIds: [agent-runtime.terminal-fallback-delivery]
+            description: "Exact coverage for fallback delivery within Abort and terminal outcomes."
+          - name: "Abort and terminal outcomes — Long context"
+            coverageIds: [agent-runtime.terminal-long-context]
+            description: "Exact coverage for long context within Abort and terminal outcomes."
+          - name: "Abort and terminal outcomes — Long run stability"
+            coverageIds: [agent-runtime.terminal-long-run-stability]
+            description: "Exact coverage for long run stability within Abort and terminal outcomes."
         docs:
           - docs/concepts/agent-loop.md
           - docs/cli/agent.md
@@ -1406,25 +1523,35 @@ surfaces:
       - name: External Runtimes and Subagents
         id: external-runtimes-and-subagents
         features:
-          - name: External harness selection
-            coverageIds: [agents.openclaw-harness, workspace.planning]
-            description: Choosing Codex app-server, ACP, and other external runtime harnesses.
+          - name: "External harness selection — Openclaw harness"
+            coverageIds: [agent-runtime.external-harness-selection-openclaw-harness]
+            description: "Exact coverage for openclaw harness within External harness selection."
+          - name: "External harness selection — Planning"
+            coverageIds: [agent-runtime.external-harness-selection-planning]
+            description: "Exact coverage for planning within External harness selection."
           - name: CLI runtime aliases
-            coverageIds: [runtime.cli-runtime-aliases]
+            coverageIds: [agent-runtime.cli-runtime-aliases]
             description: Runtime aliases and CLI-based execution paths such as Claude CLI and Gemini CLI.
-          - name: Subagent turns
-            coverageIds:
-              [
-                agents.subagents,
-                agents.synthesis,
-                channels.qa-channel,
-                gateway.sessions-list,
-                runtime.delivery,
-                tools.sessions-spawn,
-              ]
-            description: Spawning, delivering, and announcing subagent work outside the default embedded path.
+          - name: "Subagent turns — Subagents"
+            coverageIds: [agent-runtime.subagent-turns-subagents]
+            description: "Exact coverage for subagents within Subagent turns."
+          - name: "Subagent turns — Synthesis"
+            coverageIds: [agent-runtime.subagent-turns-synthesis]
+            description: "Exact coverage for synthesis within Subagent turns."
+          - name: "Subagent turns — QA channel"
+            coverageIds: [agent-runtime.subagent-turns-qa-channel]
+            description: "Exact coverage for qa channel within Subagent turns."
+          - name: "Subagent turns — Sessions list"
+            coverageIds: [agent-runtime.subagent-turns-sessions-list]
+            description: "Exact coverage for sessions list within Subagent turns."
+          - name: "Subagent turns — Delivery"
+            coverageIds: [agent-runtime.subagent-turns-delivery]
+            description: "Exact coverage for delivery within Subagent turns."
+          - name: "Subagent turns — Sessions spawn"
+            coverageIds: [agent-runtime.subagent-turns-sessions-spawn]
+            description: "Exact coverage for sessions spawn within Subagent turns."
           - name: Runtime recovery
-            coverageIds: [runtime.recovery]
+            coverageIds: [agent-runtime.runtime-recovery]
             description: Cleanup, timeout, and liveness behavior for external runtimes and subagents.
         docs:
           - docs/concepts/agent-runtimes.md
@@ -1441,19 +1568,19 @@ surfaces:
         id: hosted-provider-execution
         features:
           - name: Hosted provider turns
-            coverageIds: [runtime.hosted-provider-turns]
+            coverageIds: [agent-runtime.hosted-provider-turns]
             description: Running agent turns against hosted providers such as OpenAI, Anthropic, and Google.
           - name: Provider-specific model options
-            coverageIds: [runtime.provider-specific-model-options]
+            coverageIds: [agent-runtime.provider-specific-model-options]
             description: Provider-specific model parameters and runtime request settings exposed to users or operators.
           - name: Hosted tool use
-            coverageIds: [runtime.hosted-tool-use]
+            coverageIds: [agent-runtime.hosted-tool-use]
             description: Tool use behavior when the active runtime is a hosted provider.
           - name: Reasoning and cache controls
-            coverageIds: [runtime.reasoning-and-cache-controls]
+            coverageIds: [agent-runtime.reasoning-and-cache-controls]
             description: Provider-specific reasoning, thinking, and cache-related controls during hosted execution.
           - name: Hosted streaming and replies
-            coverageIds: [runtime.hosted-streaming-and-replies]
+            coverageIds: [agent-runtime.hosted-streaming-and-replies]
             description: Operator-visible streaming and reply behavior while hosted adapters normalize payload differences.
         docs:
           - docs/providers/openai.md
@@ -1470,19 +1597,19 @@ surfaces:
         id: local-and-self-hosted-providers
         features:
           - name: Local provider profiles
-            coverageIds: [runtime.local-provider-profiles]
+            coverageIds: [agent-runtime.local-provider-profiles]
             description: Local model profile configuration for Ollama and OpenAI-compatible local servers.
           - name: Tool-capability flags
-            coverageIds: [runtime.tool-capability-flags]
+            coverageIds: [agent-runtime.tool-capability-flags]
             description: Local provider capability flags and behavior for tool use.
           - name: Timeouts and context windows
-            coverageIds: [runtime.timeouts-and-context-windows]
+            coverageIds: [agent-runtime.timeouts-and-context-windows]
             description: Local provider timeout and context-window configuration.
           - name: Local smoke checks
-            coverageIds: [runtime.local-smoke-checks]
+            coverageIds: [agent-runtime.local-smoke-checks]
             description: Local image and model smoke checks visible to operators.
           - name: Local failure handling
-            coverageIds: [runtime.local-failure-handling]
+            coverageIds: [agent-runtime.local-failure-handling]
             description: Operator-facing failure handling for local and self-hosted providers.
         docs:
           - docs/providers/ollama.md
@@ -1497,29 +1624,38 @@ surfaces:
       - name: Model and Runtime Selection
         id: model-and-runtime-selection
         features:
-          - name: Model reference selection
-            coverageIds: [models.claude-cli, models.provider-capabilities]
-            description: Selecting the model reference for an agent turn from user or configured defaults.
-          - name: Provider and runtime overrides
-            coverageIds:
-              [
-                models.switching,
-                models.thinking,
-                runtime.session-continuity,
-                runtime.tool-continuity,
-              ]
-            description: Handling provider selection and runtime overrides for a turn.
-          - name: Thinking and context settings
-            coverageIds:
-              [
-                models.switching,
-                models.thinking,
-                runtime.reasoning-visibility,
-                runtime.session-continuity,
-              ]
-            description: Resolving thinking and context settings as part of model selection.
+          - name: "Model reference selection — Claude CLI"
+            coverageIds: [agent-runtime.model-selection-claude-cli]
+            description: "Exact coverage for claude cli within Model reference selection."
+          - name: "Model reference selection — Provider capabilities"
+            coverageIds: [agent-runtime.model-selection-provider-capabilities]
+            description: "Exact coverage for provider capabilities within Model reference selection."
+          - name: "Provider and runtime overrides — Switching"
+            coverageIds: [agent-runtime.runtime-override-switching]
+            description: "Exact coverage for switching within Provider and runtime overrides."
+          - name: "Provider and runtime overrides — Thinking"
+            coverageIds: [agent-runtime.runtime-override-thinking]
+            description: "Exact coverage for thinking within Provider and runtime overrides."
+          - name: "Provider and runtime overrides — Session continuity"
+            coverageIds: [agent-runtime.runtime-override-session-continuity]
+            description: "Exact coverage for session continuity within Provider and runtime overrides."
+          - name: "Provider and runtime overrides — Tool continuity"
+            coverageIds: [agent-runtime.runtime-override-tool-continuity]
+            description: "Exact coverage for tool continuity within Provider and runtime overrides."
+          - name: "Thinking and context settings — Switching"
+            coverageIds: [agent-runtime.thinking-switching]
+            description: "Exact coverage for switching within Thinking and context settings."
+          - name: "Thinking and context settings"
+            coverageIds: [agent-runtime.thinking]
+            description: "Resolving thinking and context settings as part of model selection."
+          - name: "Thinking and context settings — Reasoning visibility"
+            coverageIds: [agent-runtime.thinking-reasoning-visibility]
+            description: "Exact coverage for reasoning visibility within Thinking and context settings."
+          - name: "Thinking and context settings — Session continuity"
+            coverageIds: [agent-runtime.thinking-session-continuity]
+            description: "Exact coverage for session continuity within Thinking and context settings."
           - name: Invalid route recovery
-            coverageIds: [runtime.invalid-route-recovery]
+            coverageIds: [agent-runtime.invalid-route-recovery]
             description: Preserving or clearing invalid route state when selections drift or fail.
         docs:
           - docs/concepts/models.md
@@ -1535,42 +1671,56 @@ surfaces:
       - name: Provider Auth
         id: provider-auth
         features:
-          - name: Login and API-key setup
-            coverageIds: [models.anthropic, models.provider-auth]
-            description: Login, OAuth, and paste-key flows for provider access.
-          - name: Auth profile selection
-            coverageIds: [auth-profiles.provider-selection, runtime.codex-plugin.auth]
-            description: Selecting and validating provider auth profiles.
-          - name: Credential health checks
-            coverageIds:
-              [
-                gateway.performance,
-                models.live-openai,
-                plugins.kitchen-sink,
-                plugins.lifecycle,
-                plugins.plugin-tools,
-              ]
-            description: Doctor, status, and related credential health checks and repair signals.
+          - name: "Login and API-key setup — Anthropic"
+            coverageIds: [agent-runtime.auth-setup-anthropic]
+            description: "Exact coverage for anthropic within Login and API-key setup."
+          - name: "Login and API-key setup — Provider auth"
+            coverageIds: [agent-runtime.auth-setup-provider-auth]
+            description: "Exact coverage for provider auth within Login and API-key setup."
+          - name: "Auth profile selection — Provider selection"
+            coverageIds: [agent-runtime.auth-profile-selection-provider-selection]
+            description: "Exact coverage for provider selection within Auth profile selection."
+          - name: "Auth profile selection — Codex plugin auth"
+            coverageIds: [agent-runtime.auth-profile-selection-codex-plugin-auth]
+            description: "Exact coverage for codex plugin auth within Auth profile selection."
+          - name: "Credential health checks — Performance"
+            coverageIds: [agent-runtime.credential-health-checks-performance]
+            description: "Exact coverage for performance within Credential health checks."
+          - name: "Credential health checks — Live openai"
+            coverageIds: [agent-runtime.credential-health-checks-live-openai]
+            description: "Exact coverage for live openai within Credential health checks."
+          - name: "Credential health checks — Kitchen sink"
+            coverageIds: [agent-runtime.credential-health-checks-kitchen-sink]
+            description: "Exact coverage for kitchen sink within Credential health checks."
+          - name: "Credential health checks — Lifecycle"
+            coverageIds: [agent-runtime.credential-health-checks-lifecycle]
+            description: "Exact coverage for lifecycle within Credential health checks."
+          - name: "Credential health checks — Plugin tools"
+            coverageIds: [agent-runtime.credential-health-checks-plugin-tools]
+            description: "Exact coverage for plugin tools within Credential health checks."
           - name: Auth failover
-            coverageIds: [runtime.auth-failover]
+            coverageIds: [agent-runtime.auth-failover]
             description: Same-provider and cross-profile auth fallback behavior.
-          - name: Provider fallback recovery
-            coverageIds: [memory.failure-handling, runtime.fallbacks]
-            description: Provider and auth-profile fallback behavior when execution fails.
+          - name: "Provider fallback recovery — Failure handling"
+            coverageIds: [agent-runtime.provider-fallback-recovery-failure-handling]
+            description: "Exact coverage for failure handling within Provider fallback recovery."
+          - name: "Provider fallback recovery — Fallbacks"
+            coverageIds: [agent-runtime.provider-fallback-recovery-fallbacks]
+            description: "Exact coverage for fallbacks within Provider fallback recovery."
           - name: Rate-limit and capacity recovery
-            coverageIds: [runtime.rate-limit-and-capacity-recovery]
+            coverageIds: [agent-runtime.rate-limit-and-capacity-recovery]
             description: Recovery paths for quota, capacity, and rate-limit failures.
           - name: Missing-key and OAuth guidance
-            coverageIds: [runtime.missing-key-and-oauth-guidance]
+            coverageIds: [agent-runtime.missing-key-and-oauth-guidance]
             description: Operator guidance for missing keys, expired OAuth state, and related auth failures.
           - name: Restart and stale-route recovery
-            coverageIds: [runtime.restart-and-stale-route-recovery]
+            coverageIds: [agent-runtime.restart-and-stale-route-recovery]
             description: Recovery from stale route state, restart requirements, and related provider drift.
           - name: Structured provider diagnostics
-            coverageIds: [runtime.structured-provider-diagnostics]
+            coverageIds: [agent-runtime.structured-provider-diagnostics]
             description: Structured provider errors and diagnostics delivered into logs or agent replies.
           - name: Subagent credential propagation
-            coverageIds: [runtime.subagent-credential-propagation]
+            coverageIds: [agent-runtime.subagent-credential-propagation]
             description: Propagating provider credentials into subagent and delegated runtime flows.
         docs:
           - docs/concepts/models.md
@@ -1589,20 +1739,33 @@ surfaces:
       - name: Streaming and Progress
         id: streaming-and-progress
         features:
-          - name: Streaming replies
-            coverageIds: [channels.streaming, runtime.delivery, runtime.fallback-delivery]
-            description: Streaming block updates and partial assistant output before final delivery.
-          - name: Progress visibility
-            coverageIds:
-              [
-                models.thinking,
-                personal.failure-recovery,
-                personal.no-fake-progress,
-                personal.task-followthrough,
-                runtime.reasoning-visibility,
-                tools.evidence,
-              ]
-            description: Progress preview events and item lifecycle updates surfaced during execution.
+          - name: "Streaming replies"
+            coverageIds: [agent-runtime.streaming-replies]
+            description: "Streaming block updates and partial assistant output before final delivery."
+          - name: "Streaming replies — Delivery"
+            coverageIds: [agent-runtime.streaming-replies-delivery]
+            description: "Exact coverage for delivery within Streaming replies."
+          - name: "Streaming replies — Fallback delivery"
+            coverageIds: [agent-runtime.streaming-replies-fallback-delivery]
+            description: "Exact coverage for fallback delivery within Streaming replies."
+          - name: "Progress visibility — Thinking"
+            coverageIds: [agent-runtime.progress-visibility-thinking]
+            description: "Exact coverage for thinking within Progress visibility."
+          - name: "Progress visibility — Failure recovery"
+            coverageIds: [agent-runtime.progress-visibility-failure-recovery]
+            description: "Exact coverage for failure recovery within Progress visibility."
+          - name: "Progress visibility — No fake progress"
+            coverageIds: [agent-runtime.progress-visibility-no-fake-progress]
+            description: "Exact coverage for no fake progress within Progress visibility."
+          - name: "Progress visibility — Task followthrough"
+            coverageIds: [agent-runtime.progress-visibility-task-followthrough]
+            description: "Exact coverage for task followthrough within Progress visibility."
+          - name: "Progress visibility — Reasoning visibility"
+            coverageIds: [agent-runtime.progress-visibility-reasoning-visibility]
+            description: "Exact coverage for reasoning visibility within Progress visibility."
+          - name: "Progress visibility — Evidence"
+            coverageIds: [agent-runtime.progress-visibility-evidence]
+            description: "Exact coverage for evidence within Progress visibility."
         docs:
           - docs/concepts/streaming.md
           - docs/concepts/agent-loop.md
@@ -1615,43 +1778,84 @@ surfaces:
       - name: Tool Calls and Response Handling
         id: tool-calls-and-response-handling
         features:
-          - name: Tool-call handling
-            coverageIds:
-              [
-                models.switching,
-                personal.no-fake-progress,
-                personal.task-followthrough,
-                personal.tool-safety,
-                runtime.approvals,
-                runtime.codex-native-workspace.read,
-                runtime.prompt-compatibility,
-                runtime.tool-continuity,
-                tools.ask-user,
-                tools.apply-patch,
-                tools.edit,
-                tools.evidence,
-                tools.followthrough,
-                tools.fs.list,
-                tools.fs.read,
-                tools.fs.write,
-                tools.grep,
-                workspace.artifacts,
-              ]
-            description: Reliable tool-call behavior across providers, including malformed or provider-specific payload differences.
-          - name: Usage and response reporting
-            coverageIds: [agents.subagents, agents.synthesis]
-            description: Response ids and usage accounting normalized into operator-visible runtime behavior.
-          - name: Failure recovery
-            coverageIds:
-              [
-                personal.failure-recovery,
-                personal.no-fake-progress,
-                runtime.empty-response-recovery,
-                runtime.reasoning-only-recovery,
-                runtime.retry-policy,
-                tools.evidence,
-              ]
-            description: Failure-stream finalization and cleanup when provider output is malformed or incomplete.
+          - name: "Tool-call handling — Switching"
+            coverageIds: [agent-runtime.tool-switching]
+            description: "Exact coverage for switching within Tool-call handling."
+          - name: "Tool-call handling — No fake progress"
+            coverageIds: [agent-runtime.tool-no-fake-progress]
+            description: "Exact coverage for no fake progress within Tool-call handling."
+          - name: "Tool-call handling — Task followthrough"
+            coverageIds: [agent-runtime.tool-task-followthrough]
+            description: "Exact coverage for task followthrough within Tool-call handling."
+          - name: "Tool-call handling — Tool safety"
+            coverageIds: [agent-runtime.tool-safety]
+            description: "Exact coverage for tool safety within Tool-call handling."
+          - name: "Tool-call handling — Approvals"
+            coverageIds: [agent-runtime.tool-approvals]
+            description: "Exact coverage for approvals within Tool-call handling."
+          - name: "Tool-call handling — Codex native workspace read"
+            coverageIds: [agent-runtime.tool-codex-native-workspace-read]
+            description: "Exact coverage for codex native workspace read within Tool-call handling."
+          - name: "Tool-call handling — Prompt compatibility"
+            coverageIds: [agent-runtime.tool-prompt-compatibility]
+            description: "Exact coverage for prompt compatibility within Tool-call handling."
+          - name: "Tool-call handling — Tool continuity"
+            coverageIds: [agent-runtime.tool-continuity]
+            description: "Exact coverage for tool continuity within Tool-call handling."
+          - name: "Tool-call handling — Ask user"
+            coverageIds: [agent-runtime.tool-ask-user]
+            description: "Exact coverage for ask user within Tool-call handling."
+          - name: "Tool-call handling — Apply patch"
+            coverageIds: [agent-runtime.tool-apply-patch]
+            description: "Exact coverage for apply patch within Tool-call handling."
+          - name: "Tool-call handling — Edit"
+            coverageIds: [agent-runtime.tool-edit]
+            description: "Exact coverage for edit within Tool-call handling."
+          - name: "Tool-call handling — Evidence"
+            coverageIds: [agent-runtime.tool-evidence]
+            description: "Exact coverage for evidence within Tool-call handling."
+          - name: "Tool-call handling — Followthrough"
+            coverageIds: [agent-runtime.tool-followthrough]
+            description: "Exact coverage for followthrough within Tool-call handling."
+          - name: "Tool-call handling — FS list"
+            coverageIds: [agent-runtime.tool-fs-list]
+            description: "Exact coverage for fs list within Tool-call handling."
+          - name: "Tool-call handling — FS read"
+            coverageIds: [agent-runtime.tool-fs-read]
+            description: "Exact coverage for fs read within Tool-call handling."
+          - name: "Tool-call handling — FS write"
+            coverageIds: [agent-runtime.tool-fs-write]
+            description: "Exact coverage for fs write within Tool-call handling."
+          - name: "Tool-call handling — Grep"
+            coverageIds: [agent-runtime.tool-grep]
+            description: "Exact coverage for grep within Tool-call handling."
+          - name: "Tool-call handling — Artifacts"
+            coverageIds: [agent-runtime.tool-artifacts]
+            description: "Exact coverage for artifacts within Tool-call handling."
+          - name: "Usage and response reporting — Subagents"
+            coverageIds: [agent-runtime.usage-and-response-reporting-subagents]
+            description: "Exact coverage for subagents within Usage and response reporting."
+          - name: "Usage and response reporting — Synthesis"
+            coverageIds: [agent-runtime.usage-and-response-reporting-synthesis]
+            description: "Exact coverage for synthesis within Usage and response reporting."
+          - name: "Failure recovery"
+            coverageIds: [agent-runtime.failure-recovery]
+            description: "Failure-stream finalization and cleanup when provider output is malformed or incomplete."
+          - name: "Failure recovery — No fake progress"
+            coverageIds: [agent-runtime.failure-recovery-no-fake-progress]
+            description: "Exact coverage for no fake progress within Failure recovery."
+          - name: "Failure recovery — Empty response recovery"
+            coverageIds: [agent-runtime.failure-recovery-empty-response-recovery]
+            description: "Exact coverage for empty response recovery within Failure recovery."
+          - name: "Failure recovery — Reasoning only recovery"
+            coverageIds: [agent-runtime.failure-recovery-reasoning-only-recovery]
+            description: "Exact coverage for reasoning only recovery within Failure recovery."
+          - name: "Failure recovery — Retry policy"
+            coverageIds: [agent-runtime.failure-recovery-retry-policy]
+            description: "Exact coverage for retry policy within Failure recovery."
+          - name: "Failure recovery — Evidence"
+            coverageIds: [agent-runtime.failure-recovery-evidence]
+            description: "Exact coverage for evidence within Failure recovery."
         docs:
           - docs/concepts/agent-loop.md
           - docs/providers/ollama.md
@@ -1664,24 +1868,41 @@ surfaces:
       - name: Tool Execution Controls
         id: tool-execution-controls
         features:
-          - name: Tool availability rules
-            coverageIds:
-              [qa.artifact-safety, runtime.inventory, runtime.tool-policy, security.redaction]
-            description: Which tools are available during a turn after policy resolution and provider-based suppression.
+          - name: "Tool availability rules — Artifact safety"
+            coverageIds: [agent-runtime.tool-availability-rules-artifact-safety]
+            description: "Exact coverage for artifact safety within Tool availability rules."
+          - name: "Tool availability rules — Inventory"
+            coverageIds: [agent-runtime.tool-availability-rules-inventory]
+            description: "Exact coverage for inventory within Tool availability rules."
+          - name: "Tool availability rules — Tool policy"
+            coverageIds: [agent-runtime.tool-availability-rules-tool-policy]
+            description: "Exact coverage for tool policy within Tool availability rules."
+          - name: "Tool availability rules — Redaction"
+            coverageIds: [agent-runtime.tool-availability-rules-redaction]
+            description: "Exact coverage for redaction within Tool availability rules."
           - name: Sandboxed exec behavior
-            coverageIds: [runtime.sandboxed-exec-behavior]
+            coverageIds: [agent-runtime.sandboxed-exec-behavior]
             description: Exec behavior, sandbox roots, and workspace constraints visible to operators.
-          - name: Approval flow
-            coverageIds: [personal.approval-denial, runtime.approvals, tools.followthrough]
-            description: Operator approval gates for tool execution.
+          - name: "Approval flow — Approval denial"
+            coverageIds: [agent-runtime.approval-flow-approval-denial]
+            description: "Exact coverage for approval denial within Approval flow."
+          - name: "Approval flow — Approvals"
+            coverageIds: [agent-runtime.approval-flow-approvals]
+            description: "Exact coverage for approvals within Approval flow."
+          - name: "Approval flow — Followthrough"
+            coverageIds: [agent-runtime.approval-flow-followthrough]
+            description: "Exact coverage for followthrough within Approval flow."
           - name: Elevated execution
-            coverageIds: [runtime.elevated-execution]
+            coverageIds: [agent-runtime.elevated-execution]
             description: Elevated host execution rules and related controls.
-          - name: Tool safety controls
-            coverageIds: [personal.tool-safety, tools.safety]
-            description: Before-tool-call hooks and related guardrails that shape operator-visible tool behavior.
+          - name: "Tool safety controls"
+            coverageIds: [agent-runtime.tool-safety-controls]
+            description: "Before-tool-call hooks and related guardrails that shape operator-visible tool behavior."
+          - name: "Tool safety controls — Safety"
+            coverageIds: [agent-runtime.tool-safety-controls-safety]
+            description: "Exact coverage for safety within Tool safety controls."
           - name: Delegated tool access
-            coverageIds: [runtime.delegated-tool-access]
+            coverageIds: [agent-runtime.delegated-tool-access]
             description: Inherited or narrowed tool policy for subagents and delegated execution.
         docs:
           - docs/gateway/sandbox-vs-tool-policy-vs-elevated.md
@@ -1699,7 +1920,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: session-memory-and-context-engine
+  - id: session-memory
     name: Session, memory, and context engine
     family: core
     level: beta
@@ -1711,10 +1932,10 @@ surfaces:
         id: cli-session-and-transcript-management
         features:
           - name: CLI Session
-            coverageIds: [session.cli-session]
+            coverageIds: [session-memory.cli-session]
             description: Covers CLI Session across `openclaw sessions`, `openclaw transcripts`, cleanup, show/list/path behavior, TUI session history actions, and Gateway-backed session management commands.
           - name: Transcript Management
-            coverageIds: [session.transcript-management]
+            coverageIds: [session-memory.transcript-management]
             description: Covers Transcript Management across `openclaw sessions`, `openclaw transcripts`, cleanup, show/list/path behavior, TUI session history actions, and Gateway-backed session management commands.
         docs:
           - docs/concepts/session.md
@@ -1730,28 +1951,36 @@ surfaces:
       - name: Token Management
         id: token-management
         features:
-          - name: Compaction
-            coverageIds:
-              [
-                runtime.compaction,
-                runtime.empty-response-recovery,
-                runtime.reasoning-only-recovery,
-                runtime.retry-policy,
-              ]
-            description: Covers Compaction across manual and automatic compaction, preemptive overflow checks, context-window estimation, session pruning, tool-result trimming, compaction providers, retry/timeout behavior, and compacted transcript checkpoints.
+          - name: "Compaction"
+            coverageIds: [session-memory.compaction]
+            description: "Covers Compaction across manual and automatic compaction, preemptive overflow checks, context-window estimation, session pruning, tool-result trimming, compaction providers, retry/timeout behavior, and compacted transcript checkpoints."
+          - name: "Compaction — Empty response recovery"
+            coverageIds: [session-memory.compaction-empty-response-recovery]
+            description: "Exact coverage for empty response recovery within Compaction."
+          - name: "Compaction — Reasoning only recovery"
+            coverageIds: [session-memory.compaction-reasoning-only-recovery]
+            description: "Exact coverage for reasoning only recovery within Compaction."
+          - name: "Compaction — Retry policy"
+            coverageIds: [session-memory.compaction-retry-policy]
+            description: "Exact coverage for retry policy within Compaction."
           - name: Pruning
-            coverageIds: [session.pruning]
+            coverageIds: [session-memory.pruning]
             description: Covers Pruning across manual and automatic compaction, preemptive overflow checks, context-window estimation, session pruning, tool-result trimming, compaction providers, retry/timeout behavior, and compacted transcript checkpoints.
-          - name: Token Pressure
-            coverageIds:
-              [
-                runtime.codex-app-server,
-                runtime.multi-turn-continuity,
-                runtime.gateway-log-sentinel.codex-progress,
-                runtime.long-context,
-                runtime.long-run-stability,
-              ]
-            description: Covers Token Pressure across manual and automatic compaction, preemptive overflow checks, context-window estimation, session pruning, tool-result trimming, compaction providers, retry/timeout behavior, and compacted transcript checkpoints.
+          - name: "Token Pressure — Codex app server"
+            coverageIds: [session-memory.token-pressure-codex-app-server]
+            description: "Exact coverage for codex app server within Token Pressure."
+          - name: "Token Pressure — Multi turn continuity"
+            coverageIds: [session-memory.token-pressure-multi-turn-continuity]
+            description: "Exact coverage for multi turn continuity within Token Pressure."
+          - name: "Token Pressure — Gateway log sentinel Codex progress"
+            coverageIds: [session-memory.codex-progress-sentinel]
+            description: "Exact coverage for gateway log sentinel codex progress within Token Pressure."
+          - name: "Token Pressure — Long context"
+            coverageIds: [session-memory.token-pressure-long-context]
+            description: "Exact coverage for long context within Token Pressure."
+          - name: "Token Pressure — Long run stability"
+            coverageIds: [session-memory.token-pressure-long-run-stability]
+            description: "Exact coverage for long run stability within Token Pressure."
         docs:
           - docs/concepts/compaction.md
           - docs/concepts/context.md
@@ -1767,21 +1996,33 @@ surfaces:
       - name: Context Engine
         id: context-engine
         features:
-          - name: Context Engine
-            coverageIds:
-              [
-                docs.discovery,
-                workspace.artifacts,
-                workspace.long-running-task,
-                workspace.repo-discovery,
-              ]
-            description: Covers Context Engine across context-engine selection, registry, host compatibility, legacy fallback, assemble/ingest/after-turn/compact lifecycle, runtime context projection, and the boundary between OpenClaw context assembly and native harness history.
-          - name: Runtime Assembly
-            coverageIds: [agents.openclaw-harness, models.codex-cli, workspace.planning]
-            description: Covers Runtime Assembly across context-engine selection, registry, host compatibility, legacy fallback, assemble/ingest/after-turn/compact lifecycle, runtime context projection, and the boundary between OpenClaw context assembly and native harness history.
-          - name: Goal continuance
-            coverageIds: [goals.context-injection, goals.continuance]
-            description: Active session goals remain visible in current-turn context and drive concrete followthrough across later turns and compaction.
+          - name: "Context Engine — Discovery"
+            coverageIds: [session-memory.context-engine-discovery]
+            description: "Exact coverage for discovery within Context Engine."
+          - name: "Context Engine — Artifacts"
+            coverageIds: [session-memory.context-engine-artifacts]
+            description: "Exact coverage for artifacts within Context Engine."
+          - name: "Context Engine — Long running task"
+            coverageIds: [session-memory.context-engine-long-running-task]
+            description: "Exact coverage for long running task within Context Engine."
+          - name: "Context Engine — Repo discovery"
+            coverageIds: [session-memory.context-engine-repo-discovery]
+            description: "Exact coverage for repo discovery within Context Engine."
+          - name: "Runtime Assembly — Openclaw harness"
+            coverageIds: [session-memory.runtime-assembly-openclaw-harness]
+            description: "Exact coverage for openclaw harness within Runtime Assembly."
+          - name: "Runtime Assembly — Codex CLI"
+            coverageIds: [session-memory.runtime-assembly-codex-cli]
+            description: "Exact coverage for codex cli within Runtime Assembly."
+          - name: "Runtime Assembly — Planning"
+            coverageIds: [session-memory.runtime-assembly-planning]
+            description: "Exact coverage for planning within Runtime Assembly."
+          - name: "Goal continuance — Context injection"
+            coverageIds: [session-memory.goal-continuance-context-injection]
+            description: "Exact coverage for context injection within Goal continuance."
+          - name: "Goal continuance — Continuance"
+            coverageIds: [session-memory.goal-continuance-continuance]
+            description: "Exact coverage for continuance within Goal continuance."
         docs:
           - docs/concepts/context.md
           - docs/concepts/context-engine.md
@@ -1796,12 +2037,21 @@ surfaces:
       - name: Cross-client History and Session Parity
         id: cross-client-history-and-session-parity
         features:
-          - name: Cross-client History
-            coverageIds: [channels.threads, memory.thread-isolation]
-            description: Covers Cross-client History across `chat.history`, `chat.send`, WebChat display projection, TUI session actions, Android chat/session selection, OpenAI-compatible history mapping, channel history windows, and history visibility across reset/restart.
-          - name: Session Parity
-            coverageIds: [models.switching, models.thinking, runtime.session-continuity]
-            description: Covers Session Parity across `chat.history`, `chat.send`, WebChat display projection, TUI session actions, Android chat/session selection, OpenAI-compatible history mapping, channel history windows, and history visibility across reset/restart.
+          - name: "Cross-client History — Threads"
+            coverageIds: [session-memory.cross-client-history-threads]
+            description: "Exact coverage for threads within Cross-client History."
+          - name: "Cross-client History — Thread isolation"
+            coverageIds: [session-memory.cross-client-history-thread-isolation]
+            description: "Exact coverage for thread isolation within Cross-client History."
+          - name: "Session Parity — Switching"
+            coverageIds: [session-memory.session-parity-switching]
+            description: "Exact coverage for switching within Session Parity."
+          - name: "Session Parity — Thinking"
+            coverageIds: [session-memory.session-parity-thinking]
+            description: "Exact coverage for thinking within Session Parity."
+          - name: "Session Parity — Session continuity"
+            coverageIds: [session-memory.session-parity-session-continuity]
+            description: "Exact coverage for session continuity within Session Parity."
         docs:
           - docs/web/webchat.md
           - docs/platforms/android.md
@@ -1817,24 +2067,35 @@ surfaces:
         id: diagnostics-maintenance-and-recovery
         features:
           - name: Session diagnostic reports
-            coverageIds: [session.diagnostic-reports]
+            coverageIds: [session-memory.session-diagnostic-reports]
             description: Covers stuck-session diagnostics, diagnostic bundles, stability snapshots, and operator visibility into transcript and session health.
           - name: Session maintenance warnings
-            coverageIds: [session.maintenance-warnings]
+            coverageIds: [session-memory.session-maintenance-warnings]
             description: Covers restart maintenance warnings, delivery queues, memory/session cleanup signals, and operator-visible maintenance state.
-          - name: Session and transcript recovery
-            coverageIds:
-              [
-                config.restart-apply,
-                memory.failure-handling,
-                runtime.delivery,
-                runtime.fallbacks,
-                runtime.gateway-restart,
-                runtime.package-update,
-                runtime.restart-recovery,
-                runtime.update-run,
-              ]
-            description: Covers restart recovery, orphaned subagent resume, transcript repair, and safe restoration of session state after failures.
+          - name: "Session and transcript recovery — Restart apply"
+            coverageIds: [session-memory.recovery-restart-apply]
+            description: "Exact coverage for restart apply within Session and transcript recovery."
+          - name: "Session and transcript recovery — Failure handling"
+            coverageIds: [session-memory.recovery-failure-handling]
+            description: "Exact coverage for failure handling within Session and transcript recovery."
+          - name: "Session and transcript recovery — Delivery"
+            coverageIds: [session-memory.recovery-delivery]
+            description: "Exact coverage for delivery within Session and transcript recovery."
+          - name: "Session and transcript recovery — Fallbacks"
+            coverageIds: [session-memory.recovery-fallbacks]
+            description: "Exact coverage for fallbacks within Session and transcript recovery."
+          - name: "Session and transcript recovery — Gateway restart"
+            coverageIds: [session-memory.recovery-gateway-restart]
+            description: "Exact coverage for gateway restart within Session and transcript recovery."
+          - name: "Session and transcript recovery — Package update"
+            coverageIds: [session-memory.recovery-package-update]
+            description: "Exact coverage for package update within Session and transcript recovery."
+          - name: "Session and transcript recovery — Restart recovery"
+            coverageIds: [session-memory.recovery-restart-recovery]
+            description: "Exact coverage for restart recovery within Session and transcript recovery."
+          - name: "Session and transcript recovery — Update run"
+            coverageIds: [session-memory.recovery-update-run]
+            description: "Exact coverage for update run within Session and transcript recovery."
         docs:
           - docs/gateway/diagnostics.md
           - docs/reference/session-management-compaction.md
@@ -1851,14 +2112,30 @@ surfaces:
       - name: Core Prompts and Context
         id: core-prompts-and-context
         features:
-          - name: Instruction Profile
-            coverageIds:
-              [agents.instructions, character.persona, runtime.first-action, workspace.artifacts]
-            description: Covers Instruction Profile across `AGENTS.md`, `USER.md`, `IDENTITY.md`, `SOUL.md`, project context injection, bootstrap truncation, untrusted supplemental context, context visibility config, and runtime-context leakage prevention.
-          - name: Context Visibility
-            coverageIds:
-              [docs.discovery, models.codex-cli, runtime.no-meta-leak, workspace.repo-discovery]
-            description: Covers Context Visibility across `AGENTS.md`, `USER.md`, `IDENTITY.md`, `SOUL.md`, project context injection, bootstrap truncation, untrusted supplemental context, context visibility config, and runtime-context leakage prevention.
+          - name: "Instruction Profile — Instructions"
+            coverageIds: [session-memory.instruction-profile-instructions]
+            description: "Exact coverage for instructions within Instruction Profile."
+          - name: "Instruction Profile — Persona"
+            coverageIds: [session-memory.instruction-profile-persona]
+            description: "Exact coverage for persona within Instruction Profile."
+          - name: "Instruction Profile — First action"
+            coverageIds: [session-memory.instruction-profile-first-action]
+            description: "Exact coverage for first action within Instruction Profile."
+          - name: "Instruction Profile — Artifacts"
+            coverageIds: [session-memory.instruction-profile-artifacts]
+            description: "Exact coverage for artifacts within Instruction Profile."
+          - name: "Context Visibility — Discovery"
+            coverageIds: [session-memory.context-visibility-discovery]
+            description: "Exact coverage for discovery within Context Visibility."
+          - name: "Context Visibility — Codex CLI"
+            coverageIds: [session-memory.context-visibility-codex-cli]
+            description: "Exact coverage for codex cli within Context Visibility."
+          - name: "Context Visibility — No meta leak"
+            coverageIds: [session-memory.context-visibility-no-meta-leak]
+            description: "Exact coverage for no meta leak within Context Visibility."
+          - name: "Context Visibility — Repo discovery"
+            coverageIds: [session-memory.context-visibility-repo-discovery]
+            description: "Exact coverage for repo discovery within Context Visibility."
         docs:
           - docs/concepts/context.md
           - docs/reference/transcript-hygiene.md
@@ -1874,39 +2151,71 @@ surfaces:
         id: memory
         features:
           - name: Memory Backend Storage
-            coverageIds: [session.memory-backend-storage]
+            coverageIds: [session-memory.memory-backend-storage]
             description: Covers Memory Backend Storage across memory backend config, SQLite schema, vector acceleration, embedding provider selection, remote embedding fetch, QMD process/query parsing, session transcript indexing for search, extra paths, and backend security boundaries.
-          - name: Embedding Search
-            coverageIds:
-              [
-                channels.qa-channel,
-                memory.active-recall,
-                memory.ranking,
-                memory.recall,
-                personal.memory-recall,
-              ]
-            description: Covers Embedding Search across memory backend config, SQLite schema, vector acceleration, embedding provider selection, remote embedding fetch, QMD process/query parsing, session transcript indexing for search, extra paths, and backend security boundaries.
-          - name: Memory Files
-            coverageIds: [memory.dreaming, memory.promotion, qa.artifact-safety]
-            description: Covers Memory Files across root memory files, active memory, memory search/get/store tool exposure, memory prompt sections, memory flush plans, session-memory hook behavior, and memory plugin capability registration visible to agents.
-          - name: Memory search and store tools
-            coverageIds:
-              [
-                channels.group-messages,
-                channels.qa-channel,
-                memory.active-recall,
-                memory.ranking,
-                memory.recall,
-                memory.tools,
-                personal.memory-recall,
-                tools.memory.add,
-                tools.memory.recall,
-              ]
-            description: Covers memory search/get/store tool exposure, memory prompt sections, memory flush plans, session-memory hook behavior, and memory plugin capability registration visible to agents.
-          - name: Active Memory
-            coverageIds:
-              [channels.qa-channel, memory.active-recall, memory.recall, personal.memory-recall]
-            description: Covers Active Memory across root memory files, active memory, memory search/get/store tool exposure, memory prompt sections, memory flush plans, session-memory hook behavior, and memory plugin capability registration visible to agents.
+          - name: "Embedding Search — QA channel"
+            coverageIds: [session-memory.embedding-search-qa-channel]
+            description: "Exact coverage for qa channel within Embedding Search."
+          - name: "Embedding Search — Active recall"
+            coverageIds: [session-memory.embedding-search-active-recall]
+            description: "Exact coverage for active recall within Embedding Search."
+          - name: "Embedding Search — Ranking"
+            coverageIds: [session-memory.embedding-search-ranking]
+            description: "Exact coverage for ranking within Embedding Search."
+          - name: "Embedding Search — Recall"
+            coverageIds: [session-memory.embedding-search-recall]
+            description: "Exact coverage for recall within Embedding Search."
+          - name: "Embedding Search — Memory recall"
+            coverageIds: [session-memory.embedding-search-memory-recall]
+            description: "Exact coverage for memory recall within Embedding Search."
+          - name: "Memory Files — Dreaming"
+            coverageIds: [session-memory.memory-files-dreaming]
+            description: "Exact coverage for dreaming within Memory Files."
+          - name: "Memory Files — Promotion"
+            coverageIds: [session-memory.memory-files-promotion]
+            description: "Exact coverage for promotion within Memory Files."
+          - name: "Memory Files — Artifact safety"
+            coverageIds: [session-memory.memory-files-artifact-safety]
+            description: "Exact coverage for artifact safety within Memory Files."
+          - name: "Memory search and store tools — Group messages"
+            coverageIds: [session-memory.group-memory]
+            description: "Exact coverage for group messages within Memory search and store tools."
+          - name: "Memory search and store tools — QA channel"
+            coverageIds: [session-memory.qa-channel-memory]
+            description: "Exact coverage for qa channel within Memory search and store tools."
+          - name: "Memory search and store tools — Active recall"
+            coverageIds: [session-memory.memory-tools-active-recall]
+            description: "Exact coverage for active recall within Memory search and store tools."
+          - name: "Memory search and store tools — Ranking"
+            coverageIds: [session-memory.memory-ranking]
+            description: "Exact coverage for ranking within Memory search and store tools."
+          - name: "Memory search and store tools — Recall"
+            coverageIds: [session-memory.memory-recall]
+            description: "Exact coverage for recall within Memory search and store tools."
+          - name: "Memory search and store tools — Tools"
+            coverageIds: [session-memory.memory-tools]
+            description: "Exact coverage for tools within Memory search and store tools."
+          - name: "Memory search and store tools — Personal memory recall"
+            coverageIds: [session-memory.personal-memory-recall]
+            description: "Exact coverage for personal memory recall within Memory search and store tools."
+          - name: "Memory search and store tools — Memory add"
+            coverageIds: [session-memory.memory-add]
+            description: "Exact coverage for memory add within Memory search and store tools."
+          - name: "Memory search and store tools — Tools memory recall"
+            coverageIds: [session-memory.memory-recall-tool]
+            description: "Exact coverage for tools memory recall within Memory search and store tools."
+          - name: "Active Memory — QA channel"
+            coverageIds: [session-memory.active-memory-qa-channel]
+            description: "Exact coverage for qa channel within Active Memory."
+          - name: "Active Memory — Active recall"
+            coverageIds: [session-memory.active-memory-active-recall]
+            description: "Exact coverage for active recall within Active Memory."
+          - name: "Active Memory — Recall"
+            coverageIds: [session-memory.active-memory-recall]
+            description: "Exact coverage for recall within Active Memory."
+          - name: "Active Memory — Memory recall"
+            coverageIds: [session-memory.active-memory-memory-recall]
+            description: "Exact coverage for memory recall within Active Memory."
         docs:
           - docs/reference/memory-config.md
           - docs/concepts/memory-qmd.md
@@ -1929,11 +2238,17 @@ surfaces:
         id: session-routing
         features:
           - name: Session Routing
-            coverageIds: [memory.session-routing]
+            coverageIds: [session-memory.session-routing]
             description: Covers Session Routing across `sessionKey` construction, target resolution, conversation bindings, session labels, per-conversation isolation, thread binding, model selection continuity tied to sessions, and agent/workspace store targeting.
-          - name: Conversation routing
-            coverageIds: [channels.webchat, runtime.direct-reply-routing, tools.message]
-            description: Covers Conversation Binding across `sessionKey` construction, target resolution, conversation bindings, session labels, per-conversation isolation, thread binding, model selection continuity tied to sessions, and agent/workspace store targeting.
+          - name: "Conversation routing — Webchat"
+            coverageIds: [session-memory.conversation-routing-webchat]
+            description: "Exact coverage for webchat within Conversation routing."
+          - name: "Conversation routing — Direct reply routing"
+            coverageIds: [session-memory.conversation-routing-direct-reply-routing]
+            description: "Exact coverage for direct reply routing within Conversation routing."
+          - name: "Conversation routing — Message"
+            coverageIds: [session-memory.conversation-routing-message]
+            description: "Exact coverage for message within Conversation routing."
         docs:
           - docs/concepts/session.md
           - docs/channels/channel-routing.md
@@ -1949,10 +2264,10 @@ surfaces:
         id: transcript-persistence
         features:
           - name: Transcript Persistence
-            coverageIds: [session.transcript-persistence]
+            coverageIds: [session-memory.transcript-persistence]
             description: Covers Transcript Persistence across JSONL session files, transcript append and redaction, session write locks, transcript rotation/archive behavior, disk budget cleanup, provider transcript stores, and restart/repair durability.
           - name: Durability
-            coverageIds: [session.durability]
+            coverageIds: [session-memory.durability]
             description: Covers Durability across JSONL session files, transcript append and redaction, session write locks, transcript rotation/archive behavior, disk budget cleanup, provider transcript stores, and restart/repair durability.
         docs:
           - docs/reference/session-management-compaction.md
@@ -1970,7 +2285,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: channel-framework
+  - id: channels
     name: Channel framework
     family: core
     level: beta
@@ -1982,7 +2297,7 @@ surfaces:
         id: channel-actions-commands-and-approvals
         features:
           - name: Channel-native commands
-            coverageIds: [channels.native-commands]
+            coverageIds: [channels.channel-native-commands]
             description: Channel-native commands and command authorization gates
           - name: Native command session target
             coverageIds: [channels.native-command-session-target]
@@ -1994,7 +2309,7 @@ surfaces:
             coverageIds: [channels.message-tool-api-discovery]
             description: Message tool API discovery for channel actions
           - name: Channel-native approval prompts
-            coverageIds: [channels.native-approval-prompts]
+            coverageIds: [channels.channel-native-approval-prompts]
             description: Channel-native approval prompts and plugin/exec approval routing
         docs:
           - docs/channels/groups.md
@@ -2015,11 +2330,17 @@ surfaces:
             coverageIds: [channels.supported-channel-catalog]
             description: Supported channel catalog and docs index
           - name: Channel status taxonomy in channels list
-            coverageIds: [channels.status-taxonomy-in-channels-list]
+            coverageIds: [channels.channel-status-taxonomy-in-channels-list]
             description: Channel status taxonomy in channels list, channels status, and setup status output
-          - name: Setup/onboarding flows
-            coverageIds: [agents.create, channels.discord-config, config.system-agent-setup]
-            description: Setup/onboarding flows, including first-run channel selection and channel account setup
+          - name: "Setup/onboarding flows — Create"
+            coverageIds: [channels.setup-onboarding-flows-create]
+            description: "Exact coverage for create within Setup/onboarding flows."
+          - name: "Setup/onboarding flows — Discord config"
+            coverageIds: [channels.setup-onboarding-flows-discord-config]
+            description: "Exact coverage for discord config within Setup/onboarding flows."
+          - name: "Setup/onboarding flows — System agent setup"
+            coverageIds: [channels.setup-onboarding-flows-system-agent-setup]
+            description: "Exact coverage for system agent setup within Setup/onboarding flows."
           - name: Install-on-demand
             coverageIds: [channels.install-on-demand]
             description: Install-on-demand, downloadable, bundled, official external, local, npm, and ClawHub distinctions
@@ -2040,22 +2361,39 @@ surfaces:
       - name: Group Thread and Ambient Room Behavior
         id: group-thread-and-ambient-room-behavior
         features:
-          - name: Group/channel session isolation
-            coverageIds: [channels.group-messages, channels.qa-channel, memory.tools]
-            description: Group/channel session isolation and group history context
-          - name: Mention-required
-            coverageIds: [channels.group-visible-replies, channels.qa-channel, tools.message]
-            description: Mention-required, always-on, and ambient room-event modes
-          - name: Native threads
-            coverageIds:
-              [
-                channels.dm,
-                channels.qa-channel,
-                channels.threads,
-                memory.thread-isolation,
-                personal.channel-replies,
-              ]
-            description: Native threads, topics, parent-child bindings, and thread spawn behavior
+          - name: "Group/channel session isolation — Group messages"
+            coverageIds: [channels.room-session-group-messages]
+            description: "Exact coverage for group messages within Group/channel session isolation."
+          - name: "Group/channel session isolation — QA channel"
+            coverageIds: [channels.room-session-qa-channel]
+            description: "Exact coverage for qa channel within Group/channel session isolation."
+          - name: "Group/channel session isolation — Tools"
+            coverageIds: [channels.room-session-tools]
+            description: "Exact coverage for tools within Group/channel session isolation."
+          - name: "Mention-required — Group visible replies"
+            coverageIds: [channels.mention-required-group-visible-replies]
+            description: "Exact coverage for group visible replies within Mention-required."
+          - name: "Mention-required — QA channel"
+            coverageIds: [channels.mention-required-qa-channel]
+            description: "Exact coverage for qa channel within Mention-required."
+          - name: "Mention-required — Message"
+            coverageIds: [channels.mention-required-message]
+            description: "Exact coverage for message within Mention-required."
+          - name: "Native threads — DM"
+            coverageIds: [channels.native-threads-dm]
+            description: "Exact coverage for dm within Native threads."
+          - name: "Native threads — QA channel"
+            coverageIds: [channels.native-threads-qa-channel]
+            description: "Exact coverage for qa channel within Native threads."
+          - name: "Native threads"
+            coverageIds: [channels.native-threads]
+            description: "Native threads, topics, parent-child bindings, and thread spawn behavior"
+          - name: "Native threads — Thread isolation"
+            coverageIds: [channels.native-threads-thread-isolation]
+            description: "Exact coverage for thread isolation within Native threads."
+          - name: "Native threads — Channel replies"
+            coverageIds: [channels.native-threads-channel-replies]
+            description: "Exact coverage for channel replies within Native threads."
           - name: Broadcast groups
             coverageIds: [channels.broadcast-groups]
             description: Broadcast groups and multi-agent group routing
@@ -2077,17 +2415,21 @@ surfaces:
       - name: Inbound Access and Identity Gates
         id: inbound-access-and-identity-gates
         features:
-          - name: DM pairing
-            coverageIds: [security.dm-pairing, channels.pairing-gate]
-            description: DM pairing and allowFrom sender controls
-          - name: Group/channel allowlists
-            coverageIds:
-              [
-                channels.access-policy,
-                channels.allowlist-hot-reload,
-                channels.group-channel-allowlists,
-              ]
-            description: Group/channel allowlists and sender allowlists
+          - name: "DM pairing"
+            coverageIds: [channels.dm-pairing]
+            description: "DM pairing and allowFrom sender controls"
+          - name: "DM pairing — Pairing gate"
+            coverageIds: [channels.dm-pairing-pairing-gate]
+            description: "Exact coverage for pairing gate within DM pairing."
+          - name: "Group/channel allowlists — Access policy"
+            coverageIds: [channels.room-allowlist-access-policy]
+            description: "Exact coverage for access policy within Group/channel allowlists."
+          - name: "Group/channel allowlists — Allowlist hot reload"
+            coverageIds: [channels.allowlist-hot-reload]
+            description: "Exact coverage for allowlist hot reload within Group/channel allowlists."
+          - name: "Group/channel allowlists"
+            coverageIds: [channels.room-allowlist]
+            description: "Group/channel allowlists and sender allowlists"
           - name: Access group expansion
             coverageIds: [channels.access-group-expansion]
             description: Access group expansion and sender authorization helpers
@@ -2138,47 +2480,96 @@ surfaces:
       - name: Outbound Delivery and Reply Pipeline
         id: outbound-delivery-and-reply-pipeline
         features:
-          - name: Automatic final reply delivery
-            coverageIds:
-              [
-                agents.subagents,
-                channels.dedup,
-                channels.direct-visible-replies,
-                channels.dm,
-                channels.group-visible-replies,
-                channels.qa-channel,
-                channels.reconnect,
-                channels.restart-resume,
-                channels.streaming,
-                channels.threads,
-                commitments.heartbeat-target-none,
-                commitments.scope,
-                personal.channel-replies,
-                runtime.delivery,
-                runtime.fallback-delivery,
-                runtime.gateway-restart,
-                runtime.restart-recovery,
-                tools.message,
-              ]
-            description: Automatic final reply delivery and strict message-tool-only visible delivery
-          - name: Durable outbound send orchestration
-            coverageIds: [channels.dedup, channels.reconnect, runtime.delivery]
-            description: Durable outbound send orchestration, receipts, partial failures, and fallback paths
-          - name: Reply pipeline transforms
-            coverageIds: [channels.message-actions, channels.qa-channel]
-            description: Reply pipeline transforms, typing callbacks, draft streaming, and status reactions
-          - name: Provider outbound adapter bridge
-            coverageIds:
-              [
-                channels.direct-visible-replies,
-                channels.group-visible-replies,
-                channels.qa-channel,
-                channels.webchat,
-                runtime.direct-reply-routing,
-                tools.message,
-                tools.message-tool,
-              ]
-            description: Provider outbound adapter bridge and message capabilities
+          - name: "Automatic final reply delivery — Subagents"
+            coverageIds: [channels.subagent-final-reply]
+            description: "Exact coverage for subagents within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Dedup"
+            coverageIds: [channels.final-reply-dedup]
+            description: "Exact coverage for dedup within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Direct visible replies"
+            coverageIds: [channels.direct-final-reply]
+            description: "Exact coverage for direct visible replies within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — DM"
+            coverageIds: [channels.dm-final-reply]
+            description: "Exact coverage for dm within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Group visible replies"
+            coverageIds: [channels.group-final-reply]
+            description: "Exact coverage for group visible replies within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — QA channel"
+            coverageIds: [channels.qa-channel-final-reply]
+            description: "Exact coverage for qa channel within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Reconnect"
+            coverageIds: [channels.reconnect-final-reply]
+            description: "Exact coverage for reconnect within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Restart resume"
+            coverageIds: [channels.resumed-final-reply]
+            description: "Exact coverage for restart resume within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Streaming"
+            coverageIds: [channels.streaming-final-reply]
+            description: "Exact coverage for streaming within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Threads"
+            coverageIds: [channels.thread-final-reply]
+            description: "Exact coverage for threads within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Heartbeat target none"
+            coverageIds: [channels.heartbeat-none-final-reply]
+            description: "Exact coverage for heartbeat target none within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Scope"
+            coverageIds: [channels.scoped-final-reply]
+            description: "Exact coverage for scope within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Channel replies"
+            coverageIds: [channels.channel-final-reply]
+            description: "Exact coverage for channel replies within Automatic final reply delivery."
+          - name: "Automatic final reply delivery"
+            coverageIds: [channels.automatic-final-reply]
+            description: "Automatic final reply delivery and strict message-tool-only visible delivery"
+          - name: "Automatic final reply delivery — Fallback delivery"
+            coverageIds: [channels.fallback-final-reply]
+            description: "Exact coverage for fallback delivery within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Gateway restart"
+            coverageIds: [channels.post-restart-final-reply]
+            description: "Exact coverage for gateway restart within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Restart recovery"
+            coverageIds: [channels.recovered-final-reply]
+            description: "Exact coverage for restart recovery within Automatic final reply delivery."
+          - name: "Automatic final reply delivery — Message"
+            coverageIds: [channels.message-final-reply]
+            description: "Exact coverage for message within Automatic final reply delivery."
+          - name: "Durable outbound send orchestration — Dedup"
+            coverageIds: [channels.durable-send-dedup]
+            description: "Exact coverage for dedup within Durable outbound send orchestration."
+          - name: "Durable outbound send orchestration — Reconnect"
+            coverageIds: [channels.durable-send-reconnect]
+            description: "Exact coverage for reconnect within Durable outbound send orchestration."
+          - name: "Durable outbound send orchestration — Delivery"
+            coverageIds: [channels.durable-send]
+            description: "Exact coverage for delivery within Durable outbound send orchestration."
+          - name: "Reply pipeline transforms — Message actions"
+            coverageIds: [channels.reply-message-actions]
+            description: "Exact coverage for message actions within Reply pipeline transforms."
+          - name: "Reply pipeline transforms — QA channel"
+            coverageIds: [channels.qa-channel-reply-transform]
+            description: "Exact coverage for qa channel within Reply pipeline transforms."
+          - name: "Provider outbound adapter bridge — Direct visible replies"
+            coverageIds: [channels.outbound-direct-reply]
+            description: "Exact coverage for direct visible replies within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — Group visible replies"
+            coverageIds: [channels.outbound-group-reply]
+            description: "Exact coverage for group visible replies within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — QA channel"
+            coverageIds: [channels.qa-channel-outbound]
+            description: "Exact coverage for qa channel within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — Webchat"
+            coverageIds: [channels.webchat-outbound]
+            description: "Exact coverage for webchat within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — Direct reply routing"
+            coverageIds: [channels.direct-reply-routing]
+            description: "Exact coverage for direct reply routing within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — Message"
+            coverageIds: [channels.outbound-message]
+            description: "Exact coverage for message within Provider outbound adapter bridge."
+          - name: "Provider outbound adapter bridge — Message tool"
+            coverageIds: [channels.message-tool-outbound]
+            description: "Exact coverage for message tool within Provider outbound adapter bridge."
         docs:
           - docs/channels/groups.md
           - docs/channels/ambient-room-events.md
@@ -2194,12 +2585,20 @@ surfaces:
       - name: Conversation Routing and Delivery
         id: conversation-routing-and-delivery
         features:
-          - name: Inbound conversation routing
-            coverageIds:
-              [channels.dm, channels.qa-channel, channels.threads, personal.channel-replies]
-            description: Inbound and command conversation resolution across sessions, threads, and provider-owned targets.
+          - name: "Inbound conversation routing — DM"
+            coverageIds: [channels.inbound-routing-dm]
+            description: "Exact coverage for dm within Inbound conversation routing."
+          - name: "Inbound conversation routing — QA channel"
+            coverageIds: [channels.inbound-routing-qa-channel]
+            description: "Exact coverage for qa channel within Inbound conversation routing."
+          - name: "Inbound conversation routing — Threads"
+            coverageIds: [channels.inbound-routing-threads]
+            description: "Exact coverage for threads within Inbound conversation routing."
+          - name: "Inbound conversation routing — Channel replies"
+            coverageIds: [channels.inbound-routing-channel-replies]
+            description: "Exact coverage for channel replies within Inbound conversation routing."
           - name: Session key construction
-            coverageIds: [memory.session-key-construction]
+            coverageIds: [channels.session-key-construction]
             description: Session key construction and session metadata recording
           - name: Agent selection precedence
             coverageIds: [channels.agent-selection-precedence]
@@ -2210,32 +2609,65 @@ surfaces:
           - name: Thread/parent-child placement
             coverageIds: [channels.thread-parent-child-placement]
             description: Thread/parent-child placement and provider-owned target normalization
-          - name: Plugin registry resolution
-            coverageIds:
-              [
-                agents.subagents,
-                channels.direct-visible-replies,
-                channels.dm,
-                channels.group-messages,
-                channels.group-visible-replies,
-                channels.message-actions,
-                channels.qa-channel,
-                channels.threads,
-                media.image-generation,
-                media.image-understanding,
-                memory.recall,
-                personal.channel-replies,
-                personal.memory-recall,
-                personal.reminders,
-                runtime.delivery,
-                scheduling.cron,
-                scheduling.dedup,
-                tools.message,
-                ui.control,
-              ]
-            description: Plugin registry resolution and scoped channel runtime creation
+          - name: "Plugin registry resolution — Subagents"
+            coverageIds: [channels.plugin-routing-subagents]
+            description: "Exact coverage for subagents within Plugin registry resolution."
+          - name: "Plugin registry resolution — Direct visible replies"
+            coverageIds: [channels.plugin-routing-direct-visible-replies]
+            description: "Exact coverage for direct visible replies within Plugin registry resolution."
+          - name: "Plugin registry resolution — DM"
+            coverageIds: [channels.plugin-routing-dm]
+            description: "Exact coverage for dm within Plugin registry resolution."
+          - name: "Plugin registry resolution — Group messages"
+            coverageIds: [channels.plugin-routing-group-messages]
+            description: "Exact coverage for group messages within Plugin registry resolution."
+          - name: "Plugin registry resolution — Group visible replies"
+            coverageIds: [channels.plugin-routing-group-visible-replies]
+            description: "Exact coverage for group visible replies within Plugin registry resolution."
+          - name: "Plugin registry resolution — Message actions"
+            coverageIds: [channels.plugin-routing-message-actions]
+            description: "Exact coverage for message actions within Plugin registry resolution."
+          - name: "Plugin registry resolution — QA channel"
+            coverageIds: [channels.plugin-routing-qa-channel]
+            description: "Exact coverage for qa channel within Plugin registry resolution."
+          - name: "Plugin registry resolution — Threads"
+            coverageIds: [channels.plugin-routing-threads]
+            description: "Exact coverage for threads within Plugin registry resolution."
+          - name: "Plugin registry resolution — Image generation"
+            coverageIds: [channels.plugin-routing-image-generation]
+            description: "Exact coverage for image generation within Plugin registry resolution."
+          - name: "Plugin registry resolution — Image understanding"
+            coverageIds: [channels.plugin-routing-image-understanding]
+            description: "Exact coverage for image understanding within Plugin registry resolution."
+          - name: "Plugin registry resolution — Recall"
+            coverageIds: [channels.plugin-routing-recall]
+            description: "Exact coverage for recall within Plugin registry resolution."
+          - name: "Plugin registry resolution — Channel replies"
+            coverageIds: [channels.plugin-routing-channel-replies]
+            description: "Exact coverage for channel replies within Plugin registry resolution."
+          - name: "Plugin registry resolution — Memory recall"
+            coverageIds: [channels.plugin-routing-memory-recall]
+            description: "Exact coverage for memory recall within Plugin registry resolution."
+          - name: "Plugin registry resolution — Reminders"
+            coverageIds: [channels.plugin-routing-reminders]
+            description: "Exact coverage for reminders within Plugin registry resolution."
+          - name: "Plugin registry resolution — Delivery"
+            coverageIds: [channels.plugin-routing-delivery]
+            description: "Exact coverage for delivery within Plugin registry resolution."
+          - name: "Plugin registry resolution — Cron"
+            coverageIds: [channels.plugin-routing-cron]
+            description: "Exact coverage for cron within Plugin registry resolution."
+          - name: "Plugin registry resolution — Dedup"
+            coverageIds: [channels.plugin-routing-dedup]
+            description: "Exact coverage for dedup within Plugin registry resolution."
+          - name: "Plugin registry resolution — Message"
+            coverageIds: [channels.plugin-routing-message]
+            description: "Exact coverage for message within Plugin registry resolution."
+          - name: "Plugin registry resolution — Control"
+            coverageIds: [channels.plugin-routing-control]
+            description: "Exact coverage for control within Plugin registry resolution."
           - name: Channel account startup
-            coverageIds: [channels.account-startup]
+            coverageIds: [channels.channel-account-startup]
             description: Channel account startup, shutdown, logout, abort, and manual-stop state
           - name: Whole-channel lifecycle controls
             coverageIds: [channels.whole-channel-lifecycle-controls]
@@ -2267,11 +2699,17 @@ surfaces:
         id: status-health-and-operator-controls
         features:
           - name: channels.status
-            coverageIds: [channels.status]
+            coverageIds: [channels.channels-status]
             description: channels.status, probes, account snapshots, and warnings
-          - name: Channel health policy
-            coverageIds: [channels.dedup, channels.reconnect, runtime.delivery]
-            description: Channel health policy, health monitor restarts, stale socket detection, cooldowns, and restart caps
+          - name: "Channel health policy — Dedup"
+            coverageIds: [channels.channel-health-policy-dedup]
+            description: "Exact coverage for dedup within Channel health policy."
+          - name: "Channel health policy — Reconnect"
+            coverageIds: [channels.channel-health-policy-reconnect]
+            description: "Exact coverage for reconnect within Channel health policy."
+          - name: "Channel health policy — Delivery"
+            coverageIds: [channels.channel-health-policy-delivery]
+            description: "Exact coverage for delivery within Channel health policy."
           - name: Operator CLI controls
             coverageIds: [channels.operator-cli-controls]
             description: Operator CLI controls for start, stop, logout, status, restart, and troubleshoot
@@ -2295,7 +2733,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: security-auth-pairing-and-secrets
+  - id: security
     name: Security, auth, pairing, and secrets
     family: core
     level: beta
@@ -2306,16 +2744,21 @@ surfaces:
       - name: Approval Policy and Tool Safeguards
         id: approval-policy-and-tool-safeguards
         features:
-          - name: Approval Policy
-            coverageIds:
-              [
-                personal.approval-denial,
-                personal.tool-safety,
-                runtime.approvals,
-                tools.followthrough,
-                tools.safety,
-              ]
-            description: Covers Approval Policy across exec approval policy, host-local approval stores, allowlist and ask modes, dangerous tool safeguards, native/chat approval routing, plugin approval routing, approval decisions, approval binding, and operator-facing CLI management.
+          - name: "Approval Policy — Approval denial"
+            coverageIds: [security.approval-policy-approval-denial]
+            description: "Exact coverage for approval denial within Approval Policy."
+          - name: "Approval Policy — Tool safety"
+            coverageIds: [security.approval-policy-tool-safety]
+            description: "Exact coverage for tool safety within Approval Policy."
+          - name: "Approval Policy — Approvals"
+            coverageIds: [security.approval-policy-approvals]
+            description: "Exact coverage for approvals within Approval Policy."
+          - name: "Approval Policy — Followthrough"
+            coverageIds: [security.approval-policy-followthrough]
+            description: "Exact coverage for followthrough within Approval Policy."
+          - name: "Approval Policy — Safety"
+            coverageIds: [security.approval-policy-safety]
+            description: "Exact coverage for safety within Approval Policy."
           - name: Dangerous Tool Safeguards
             coverageIds: [security.dangerous-tool-safeguards]
             description: Covers Dangerous Tool Safeguards across exec approval policy, host-local approval stores, allowlist and ask modes, dangerous tool safeguards, native/chat approval routing, plugin approval routing, approval decisions, approval binding, and operator-facing CLI management.
@@ -2343,7 +2786,7 @@ surfaces:
             coverageIds: [security.trusted-proxy-identity]
             description: Trusted-proxy identity, gateway.trustedProxies, trustedProxy.userHeader, requiredHeaders, allowUsers, allowLoopback, reverse-proxy source validation, and scope behavior
           - name: Tailscale Serve/Funnel
-            coverageIds: [raspberry-pi.tailscale-serve-funnel]
+            coverageIds: [security.tailscale-serve-funnel]
             description: Tailscale Serve/Funnel and reverse-proxy exposure rules, including Tailscale identity headers, tailscale whois, Funnel password requirements, and separation between Control UI/WS identity and HTTP API auth
           - name: Bind and origin restrictions
             coverageIds: [security.bind-and-origin-restrictions]
@@ -2352,7 +2795,7 @@ surfaces:
             coverageIds: [security.websocket-handshake-auth]
             description: WebSocket handshake auth, including challenge/connect ordering, nonce-bound device auth, shared auth, browser origin checks, pre-auth limits, unauthenticated socket timeout, and stale shared-auth rotation
           - name: Operator-facing docs
-            coverageIds: [security.operator-facing-docs]
+            coverageIds: [security.remote-access-operator-docs]
             description: Operator-facing docs and runbooks for security audit, remote access, exposure rollback, Tailscale, trusted proxy, credential rotation, and explicit credential probing
           - name: Browser Control UI
             coverageIds: [security.browser-control-ui]
@@ -2430,7 +2873,7 @@ surfaces:
             coverageIds: [security.auth-migration]
             description: Auth migration and recovery errors for pre-challenge device signing, token drift, scope mismatch, and mixed gateway auth configuration
           - name: Operator-facing docs
-            coverageIds: [security.operator-facing-docs]
+            coverageIds: [security.pairing-operator-docs]
             description: Operator-facing docs for devices, pairing, WebChat, Control UI, protocol auth, and troubleshooting
           - name: Node Pairing
             coverageIds: [security.node-pairing]
@@ -2466,7 +2909,7 @@ surfaces:
             coverageIds: [security.plugin-installation-trust]
             description: Covers Plugin Installation Trust across plugin manifest trust, plugin install/update safety scans, plugin allowlists, manifest-owned auth/secret metadata, and related plugin installation trust and security boundaries behavior.
           - name: Security Boundaries
-            coverageIds: [security.boundaries]
+            coverageIds: [security.security-boundaries]
             description: Covers Security Boundaries across plugin manifest trust, plugin install/update safety scans, plugin allowlists, manifest-owned auth/secret metadata, and related plugin installation trust and security boundaries behavior.
         docs:
           - docs/plugins/manifest.md
@@ -2491,18 +2934,27 @@ surfaces:
           - name: Secrets Storage
             coverageIds: [security.secrets-storage]
             description: Covers Secrets Storage across SecretRef contract and providers, runtime secret snapshots, gateway auth SecretRefs, auth-profile and generated model residues, and related secrets storage, redaction, and configuration hygiene behavior.
-          - name: Redaction
-            coverageIds:
-              [
-                memory.dreaming,
-                memory.promotion,
-                personal.diagnostics,
-                personal.redaction,
-                qa.artifact-safety,
-                runtime.tool-policy,
-                security.redaction,
-              ]
-            description: Covers Redaction across SecretRef contract and providers, runtime secret snapshots, gateway auth SecretRefs, auth-profile and generated model residues, and related secrets storage, redaction, and configuration hygiene behavior.
+          - name: "Redaction — Dreaming"
+            coverageIds: [security.redaction-dreaming]
+            description: "Exact coverage for dreaming within Redaction."
+          - name: "Redaction — Promotion"
+            coverageIds: [security.redaction-promotion]
+            description: "Exact coverage for promotion within Redaction."
+          - name: "Redaction — Diagnostics"
+            coverageIds: [security.redaction-diagnostics]
+            description: "Exact coverage for diagnostics within Redaction."
+          - name: "Redaction — Personal redaction"
+            coverageIds: [security.redaction-personal-redaction]
+            description: "Exact coverage for personal redaction within Redaction."
+          - name: "Redaction — Artifact safety"
+            coverageIds: [security.redaction-artifact-safety]
+            description: "Exact coverage for artifact safety within Redaction."
+          - name: "Redaction — Tool policy"
+            coverageIds: [security.redaction-tool-policy]
+            description: "Exact coverage for tool policy within Redaction."
+          - name: "Redaction — Security redaction"
+            coverageIds: [security.redaction-security-redaction]
+            description: "Exact coverage for security redaction within Redaction."
           - name: Configuration Hygiene
             coverageIds: [security.configuration-hygiene]
             description: Covers Configuration Hygiene across SecretRef contract and providers, runtime secret snapshots, gateway auth SecretRefs, auth-profile and generated model residues, and related secrets storage, redaction, and configuration hygiene behavior.
@@ -2530,7 +2982,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: telemetry-diagnostics-and-observability
+  - id: observability
     name: Observability
     family: core
     level: beta
@@ -2542,49 +2994,59 @@ surfaces:
         id: health-and-repair
         features:
           - name: Background health-monitor loop
-            coverageIds: [telemetry.background-health-monitor-loop]
+            coverageIds: [observability.background-health-monitor-loop]
             description: Background health-monitor loop for configured channel accounts
           - name: Per-account enable/disable settings
-            coverageIds: [telemetry.per-account-enable-disable-settings]
+            coverageIds: [observability.per-account-enable-disable-settings]
             description: Per-account enable/disable settings behavior, status, and operator-visible verification.
           - name: Startup grace
-            coverageIds: [telemetry.startup-grace]
+            coverageIds: [observability.startup-grace]
             description: Startup grace, connect grace, stale transport activity detection, busy/stuck handling, restart cooldowns, and max restarts per hour
           - name: Restart logging
-            coverageIds: [telemetry.restart-logging]
+            coverageIds: [observability.restart-logging]
             description: Restart logging and runtime snapshot evaluation
-          - name: openclaw doctor
-            coverageIds:
-              [runtime.codex-plugin.auth, runtime.codex-plugin.lifecycle, runtime.doctor-repair]
-            description: openclaw doctor, openclaw doctor --fix, --repair, --yes, --non-interactive, --deep, and --lint
+          - name: "openclaw doctor — Codex plugin auth"
+            coverageIds: [observability.doctor-codex-plugin-auth]
+            description: "Exact coverage for codex plugin auth within openclaw doctor."
+          - name: "openclaw doctor — Codex plugin lifecycle"
+            coverageIds: [observability.doctor-codex-plugin-lifecycle]
+            description: "Exact coverage for codex plugin lifecycle within openclaw doctor."
+          - name: "openclaw doctor — Doctor repair"
+            coverageIds: [observability.doctor-repair]
+            description: "Exact coverage for doctor repair within openclaw doctor."
           - name: Structured health checks
-            coverageIds: [telemetry.structured-health-checks]
+            coverageIds: [observability.structured-health-checks]
             description: Structured health checks, findings, repair results, check selection, JSON lint output, severity filtering, and exit behavior
           - name: Core doctor checks
-            coverageIds: [telemetry.core-doctor-checks]
+            coverageIds: [observability.core-doctor-checks]
             description: Core doctor checks for gateway config, services, auth, state integrity, skills, plugins, sandbox, migrations, and provider route health
           - name: Plugin SDK doctor/health contracts
-            coverageIds: [telemetry.plugin-sdk-doctor-health-contracts]
+            coverageIds: [observability.plugin-sdk-doctor-health-contracts]
             description: Plugin SDK doctor/health contracts behavior, status, and operator-visible verification.
           - name: openclaw status
-            coverageIds: [windows.openclaw-status]
+            coverageIds: [observability.openclaw-status]
             description: openclaw status, openclaw status --all, and openclaw status --deep
           - name: openclaw health
-            coverageIds: [telemetry.openclaw-health]
+            coverageIds: [observability.openclaw-health]
             description: openclaw health, openclaw health --verbose, and openclaw health --json
           - name: Gateway RPC health
-            coverageIds: [telemetry.gateway-rpc-health]
+            coverageIds: [observability.gateway-rpc-health]
             description: Gateway RPC health and status
-          - name: Cached health snapshots
-            coverageIds:
-              [
-                gateway.performance,
-                models.live-openai,
-                plugins.kitchen-sink,
-                plugins.lifecycle,
-                plugins.plugin-tools,
-              ]
-            description: Cached health snapshots, live probe refresh, sensitive fields gated by operator admin scope, and event-loop health attachment
+          - name: "Cached health snapshots — Performance"
+            coverageIds: [observability.cached-health-snapshots-performance]
+            description: "Exact coverage for performance within Cached health snapshots."
+          - name: "Cached health snapshots — Live openai"
+            coverageIds: [observability.cached-health-snapshots-live-openai]
+            description: "Exact coverage for live openai within Cached health snapshots."
+          - name: "Cached health snapshots — Kitchen sink"
+            coverageIds: [observability.cached-health-snapshots-kitchen-sink]
+            description: "Exact coverage for kitchen sink within Cached health snapshots."
+          - name: "Cached health snapshots — Lifecycle"
+            coverageIds: [observability.cached-health-snapshots-lifecycle]
+            description: "Exact coverage for lifecycle within Cached health snapshots."
+          - name: "Cached health snapshots — Plugin tools"
+            coverageIds: [observability.cached-health-snapshots-plugin-tools]
+            description: "Exact coverage for plugin tools within Cached health snapshots."
         docs:
           - docs/gateway/health.md
           - docs/channels/telegram.md
@@ -2609,19 +3071,19 @@ surfaces:
         id: logging
         features:
           - name: Rolling Gateway JSONL file logs
-            coverageIds: [telemetry.rolling-gateway-jsonl-file-logs]
+            coverageIds: [observability.rolling-gateway-jsonl-file-logs]
             description: Rolling Gateway JSONL file logs and console output
           - name: openclaw logs
-            coverageIds: [telemetry.openclaw-logs]
+            coverageIds: [observability.openclaw-logs]
             description: openclaw logs, openclaw logs --follow, JSON/plain/color/timezone modes, and local fallback behavior
           - name: Gateway RPC logs.tail
-            coverageIds: [telemetry.gateway-rpc-logs-tail]
+            coverageIds: [observability.gateway-rpc-logs-tail]
             description: Gateway RPC logs.tail behavior, status, and operator-visible verification.
           - name: Redaction patterns and sinks
-            coverageIds: [telemetry.redaction-patterns-and-sinks]
+            coverageIds: [observability.redaction-patterns-and-sinks]
             description: console, file logs, OTLP log records, transcript text, Control UI tool-call events, support exports, and WS protocol logs
           - name: Trace correlation fields
-            coverageIds: [telemetry.trace-correlation-fields]
+            coverageIds: [observability.trace-correlation-fields]
             description: Trace correlation fields on log records and linked diagnostic events.
         docs:
           - docs/logging.md
@@ -2637,28 +3099,34 @@ surfaces:
         id: diagnostic-collection
         features:
           - name: openclaw gateway diagnostics export
-            coverageIds: [telemetry.openclaw-gateway-diagnostics-export]
+            coverageIds: [observability.openclaw-gateway-diagnostics-export]
             description: openclaw gateway diagnostics export and --json / --output / log-size options
           - name: openclaw gateway stability --bundle
-            coverageIds: [telemetry.openclaw-gateway-stability-bundle]
+            coverageIds: [observability.openclaw-gateway-stability-bundle]
             description: openclaw gateway stability --bundle latest --export
           - name: Chat /diagnostics
-            coverageIds: [telemetry.chat-diagnostics]
+            coverageIds: [observability.chat-diagnostics]
             description: Chat /diagnostics and /codex diagnostics approval flows
-          - name: Support zip composition
-            coverageIds: [personal.diagnostics, personal.redaction, qa.artifact-safety]
-            description: Support zip composition, safe relative paths, sanitized config/status/health/log/stability files, and privacy manifest
+          - name: "Support zip composition — Diagnostics"
+            coverageIds: [observability.support-zip-diagnostics]
+            description: "Exact coverage for diagnostics within Support zip composition."
+          - name: "Support zip composition — Redaction"
+            coverageIds: [observability.support-zip-redaction]
+            description: "Exact coverage for redaction within Support zip composition."
+          - name: "Support zip composition — Artifact safety"
+            coverageIds: [observability.support-zip-artifact-safety]
+            description: "Exact coverage for artifact safety within Support zip composition."
           - name: Bounded in-process stability recorder
-            coverageIds: [telemetry.bounded-in-process-stability-recorder]
+            coverageIds: [observability.bounded-in-process-stability-recorder]
             description: Bounded in-process stability recorder and diagnostics.stability RPC
           - name: openclaw gateway stability
-            coverageIds: [telemetry.openclaw-gateway-stability]
+            coverageIds: [observability.openclaw-gateway-stability]
             description: openclaw gateway stability, stability filtering, persisted stability bundles, and export-from-bundle
           - name: Memory pressure events
-            coverageIds: [telemetry.memory-pressure-events]
+            coverageIds: [observability.memory-pressure-events]
             description: Memory pressure events, event-loop liveness warnings, oversized payload events, queue/session summaries, and fatal/shutdown/restart snapshots
           - name: Critical memory pressure snapshot option
-            coverageIds: [telemetry.critical-memory-pressure-snapshot-option]
+            coverageIds: [observability.critical-memory-pressure-snapshot-option]
             description: Critical memory pressure snapshot option with V8/cgroup/session-file evidence
         docs:
           - docs/gateway/diagnostics.md
@@ -2678,56 +3146,82 @@ surfaces:
         id: telemetry-export
         features:
           - name: Diagnostic event types
-            coverageIds: [telemetry.diagnostic-event-types]
+            coverageIds: [observability.diagnostic-event-types]
             description: Diagnostic event types and trusted/internal/public subscription boundaries
           - name: Async dispatch
-            coverageIds: [automation.async-dispatch]
+            coverageIds: [observability.async-dispatch]
             description: Async dispatch, queue saturation summaries, immutable event copies, private data handling, and diagnostics enablement
           - name: W3C trace context creation
-            coverageIds: [telemetry.w3c-trace-context-creation]
+            coverageIds: [observability.w3c-trace-context-creation]
             description: W3C trace context creation, active request scopes, child spans, and trusted traceparent formatting
           - name: Plugin SDK diagnostic runtime exports
-            coverageIds: [telemetry.plugin-sdk-runtime-exports]
+            coverageIds: [observability.plugin-sdk-diagnostic-runtime-exports]
             description: Plugin SDK diagnostic runtime exports and hook context trace fields
           - name: Model-call diagnostic events
-            coverageIds: [telemetry.model-call-diagnostic-events]
+            coverageIds: [observability.model-call-diagnostic-events]
             description: Model-call, tool, exec, webhook, message, Talk, session, harness, and exporter diagnostic events.
           - name: diagnostics-otel plugin install
-            coverageIds: [telemetry.diagnostics-otel-plugin-install]
+            coverageIds: [observability.diagnostics-otel-plugin-install]
             description: diagnostics-otel plugin install, enablement, config, env overrides, sampling, flush interval, and preloaded SDK mode
-          - name: OTLP/HTTP traces
-            coverageIds: [harness.qa-lab, telemetry.otel]
-            description: OTLP/HTTP traces, metrics, and logs
+          - name: "OTLP/HTTP traces — QA lab"
+            coverageIds: [observability.otlp-http-traces-qa-lab]
+            description: "Exact coverage for qa lab within OTLP/HTTP traces."
+          - name: "OTLP/HTTP traces — OTel"
+            coverageIds: [observability.otlp-http-traces-otel]
+            description: "Exact coverage for otel within OTLP/HTTP traces."
           - name: Trusted trace context
-            coverageIds: [telemetry.trusted-trace-context]
+            coverageIds: [observability.trusted-trace-context]
             description: Trusted trace context, W3C traceparent propagation to model calls, file-log correlation, content-capture controls, and redacted/bounded attributes
-          - name: Model and runtime telemetry
-            coverageIds:
-              [
-                docker.runtime-validation,
-                harness.qa-lab,
-                harness.tool-trace-visibility,
-                personal.failure-recovery,
-                personal.no-fake-progress,
-                personal.task-followthrough,
-                runtime.qa-bus,
-                telemetry.otel,
-                telemetry.prometheus,
-                tools.evidence,
-                tools.trace,
-              ]
-            description: Model, tool, message, session, queue, Talk, exec, webhook, context assembly, harness, and exporter-health signals
+          - name: "Model and runtime telemetry — Runtime validation"
+            coverageIds: [observability.telemetry-runtime-validation]
+            description: "Exact coverage for runtime validation within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — QA lab"
+            coverageIds: [observability.telemetry-qa-lab]
+            description: "Exact coverage for qa lab within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Tool trace visibility"
+            coverageIds: [observability.telemetry-tool-trace-visibility]
+            description: "Exact coverage for tool trace visibility within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Failure recovery"
+            coverageIds: [observability.telemetry-failure-recovery]
+            description: "Exact coverage for failure recovery within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — No fake progress"
+            coverageIds: [observability.telemetry-no-fake-progress]
+            description: "Exact coverage for no fake progress within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Task followthrough"
+            coverageIds: [observability.telemetry-task-followthrough]
+            description: "Exact coverage for task followthrough within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — QA bus"
+            coverageIds: [observability.telemetry-qa-bus]
+            description: "Exact coverage for qa bus within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — OTel"
+            coverageIds: [observability.telemetry-otel]
+            description: "Exact coverage for otel within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Prometheus"
+            coverageIds: [observability.telemetry-prometheus]
+            description: "Exact coverage for prometheus within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Evidence"
+            coverageIds: [observability.telemetry-evidence]
+            description: "Exact coverage for evidence within Model and runtime telemetry."
+          - name: "Model and runtime telemetry — Trace"
+            coverageIds: [observability.telemetry-trace]
+            description: "Exact coverage for trace within Model and runtime telemetry."
           - name: diagnostics-prometheus plugin install
-            coverageIds: [telemetry.diagnostics-prometheus-plugin-install]
+            coverageIds: [observability.diagnostics-prometheus-plugin-install]
             description: diagnostics-prometheus plugin install and enablement
           - name: Gateway-authenticated GET /api/diagnostics/prometheus
-            coverageIds: [telemetry.prometheus-authenticated-gateway-export]
+            coverageIds: [observability.prometheus-api-auth]
             description: Gateway-authenticated GET /api/diagnostics/prometheus behavior, status, and operator-visible verification.
-          - name: Prometheus text exposition
-            coverageIds: [docker.runtime-validation, harness.qa-lab, telemetry.prometheus]
-            description: Prometheus text exposition, counters, gauges, histograms, label policy, series cap, and overflow metric
+          - name: "Prometheus text exposition — Runtime validation"
+            coverageIds: [observability.prometheus-runtime-validation]
+            description: "Exact coverage for runtime validation within Prometheus text exposition."
+          - name: "Prometheus text exposition — QA lab"
+            coverageIds: [observability.prometheus-qa-lab]
+            description: "Exact coverage for qa lab within Prometheus text exposition."
+          - name: "Prometheus text exposition"
+            coverageIds: [observability.prometheus]
+            description: "Prometheus text exposition, counters, gauges, histograms, label policy, series cap, and overflow metric"
           - name: Trusted diagnostic event subscription
-            coverageIds: [telemetry.trusted-diagnostic-event-subscription]
+            coverageIds: [observability.trusted-diagnostic-event-subscription]
             description: Trusted diagnostic event subscription and rendering of run, model, tool, message, Talk, queue, session, liveness, payload, memory, and exporter metrics
         docs:
           - docs/plugins/hooks.md
@@ -2753,16 +3247,16 @@ surfaces:
         id: session-diagnostics
         features:
           - name: session.state
-            coverageIds: [telemetry.session-state]
+            coverageIds: [observability.session-state]
             description: session.state, session.stuck, session.long_running, session.stalled, session.recovery.*, and session.turn.created diagnostic events
           - name: Diagnostic session activity snapshots
-            coverageIds: [telemetry.diagnostic-session-activity-snapshots]
+            coverageIds: [observability.diagnostic-session-activity-snapshots]
             description: Diagnostic session activity snapshots for embedded runs, model calls, and tool calls
           - name: Model usage
-            coverageIds: [telemetry.model-usage]
+            coverageIds: [observability.model-usage]
             description: Model usage, token/cost, model-call byte/timing, run attempts, and usage logs
           - name: Export of session signals to stability
-            coverageIds: [telemetry.export-of-session-signals-to-stability]
+            coverageIds: [observability.export-of-session-signals-to-stability]
             description: Export of session signals to stability, OpenTelemetry, and Prometheus
         docs:
           - docs/gateway/opentelemetry.md
@@ -2781,7 +3275,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: automation-cron-hooks-tasks-polling
+  - id: automation
     name: "Automation: cron, hooks, tasks, polling"
     family: core
     level: beta
@@ -2802,34 +3296,49 @@ surfaces:
             coverageIds: [automation.timezone-and-stagger]
             description: Covers Timezone and stagger across cron job creation, listing, inspection, editing, and related cron job lifecycle behavior.
           - name: Cron RPCs
-            coverageIds: [scheduling.cron-rpcs]
+            coverageIds: [automation.cron-rpcs]
             description: Covers Cron RPCs across cron job creation, listing, inspection, editing, and related cron job lifecycle behavior.
-          - name: Agent cron tool
-            coverageIds: [channels.qa-channel, personal.reminders, scheduling.cron]
-            description: Covers Agent cron tool across cron job creation, listing, inspection, editing, and related cron job lifecycle behavior.
+          - name: "Agent cron tool — QA channel"
+            coverageIds: [automation.agent-cron-tool-qa-channel]
+            description: "Exact coverage for qa channel within Agent cron tool."
+          - name: "Agent cron tool — Reminders"
+            coverageIds: [automation.agent-cron-tool-reminders]
+            description: "Exact coverage for reminders within Agent cron tool."
+          - name: "Agent cron tool"
+            coverageIds: [automation.agent-cron-tool]
+            description: "Covers Agent cron tool across cron job creation, listing, inspection, editing, and related cron job lifecycle behavior."
           - name: Model-authored cron jobs
-            coverageIds: [agents.tool-use]
+            coverageIds: [automation.model-authored-cron-jobs]
             description: Covers model-driven cron tool calls that create and manage scheduled jobs.
           - name: Manual cron runs
-            coverageIds: [scheduling.cron]
+            coverageIds: [automation.manual-cron-runs]
             description: Covers Manual cron runs across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior.
-          - name: Isolated cron execution
-            coverageIds: [scheduling.cron, scheduling.dedup]
-            description: Covers Isolated cron execution across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior.
+          - name: "Isolated cron execution"
+            coverageIds: [automation.isolated-cron-execution]
+            description: "Covers Isolated cron execution across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior."
+          - name: "Isolated cron execution — Dedup"
+            coverageIds: [automation.isolated-cron-execution-dedup]
+            description: "Exact coverage for dedup within Isolated cron execution."
           - name: Scheduler persistence
-            coverageIds: [scheduling.persistence]
+            coverageIds: [automation.scheduler-persistence]
             description: Covers scheduled job persistence and recovery across Gateway restarts.
           - name: Model/provider preflight
             coverageIds: [automation.model-provider-preflight]
             description: Covers Model/provider preflight across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior.
-          - name: Run history
-            coverageIds: [channels.qa-channel, scheduling.cron, scheduling.dedup]
-            description: Covers Run history across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior.
+          - name: "Run history — QA channel"
+            coverageIds: [automation.run-history-qa-channel]
+            description: "Exact coverage for qa channel within Run history."
+          - name: "Run history — Cron"
+            coverageIds: [automation.run-history-cron]
+            description: "Exact coverage for cron within Run history."
+          - name: "Run history — Dedup"
+            coverageIds: [automation.run-history-dedup]
+            description: "Exact coverage for dedup within Run history."
           - name: Timeout and denial diagnostics
             coverageIds: [automation.timeout-and-denial-diagnostics]
             description: Covers Timeout and denial diagnostics across scheduler dispatch, timer arming, manual/due runs, isolated agent execution, and related cron runs and diagnostics behavior.
           - name: Chat announce delivery
-            coverageIds: [scheduling.chat-announce-delivery]
+            coverageIds: [automation.chat-announce-delivery]
             description: Covers Chat announce delivery across cron output delivery modes, channel target resolution, direct delivery retries, transcript mirroring, and related cron delivery and failure alerts behavior.
           - name: Webhook delivery
             coverageIds: [automation.webhook-delivery]
@@ -3069,9 +3578,15 @@ surfaces:
           - name: Due-only heartbeat tasks
             coverageIds: [automation.due-only-heartbeat-tasks]
             description: Covers Due-only heartbeat tasks across periodic heartbeat runs, active-hours and variable schedule behavior, wake/cooldown handling, heartbeat prompts and due-only task mode, and related heartbeat and commitments behavior.
-          - name: Commitment check-ins
-            coverageIds: [commitments.heartbeat-target-none, commitments.scope, runtime.delivery]
-            description: Covers Commitment check-ins across periodic heartbeat runs, active-hours and variable schedule behavior, wake/cooldown handling, heartbeat prompts and due-only task mode, and related heartbeat and commitments behavior.
+          - name: "Commitment check-ins — Heartbeat target none"
+            coverageIds: [automation.commitment-check-ins-heartbeat-target-none]
+            description: "Exact coverage for heartbeat target none within Commitment check-ins."
+          - name: "Commitment check-ins — Scope"
+            coverageIds: [automation.commitment-check-ins-scope]
+            description: "Exact coverage for scope within Commitment check-ins."
+          - name: "Commitment check-ins — Delivery"
+            coverageIds: [automation.commitment-check-ins-delivery]
+            description: "Exact coverage for delivery within Commitment check-ins."
         docs:
           - docs/automation/index.md
           - docs/gateway/heartbeat.md
@@ -3141,7 +3656,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: media-understanding-and-media-generation
+  - id: media
     name: Media understanding and media generation
     family: core
     level: alpha
@@ -3233,7 +3748,7 @@ surfaces:
         id: media-configuration
         features:
           - name: Media capability configuration
-            coverageIds: [media.capability-configuration]
+            coverageIds: [media.media-capability-configuration]
             description: tools.media image/audio/video config, shared and per-capability media model entries, provider/CLI entry resolution, auth-backed capability selection, fallback ordering, scope rules, concurrency, active-model skip behavior, offloaded image routing, image generation tool factory availability, image generation task status/list/duplicate guard, and generated-media delivery into the reply pipeline
         docs:
           - docs/tools/media-overview.md
@@ -3283,9 +3798,15 @@ surfaces:
           - name: Audio proxy and limit handling
             coverageIds: [media.audio-proxy-and-limit-handling]
             description: Covers Audio proxy and limit handling across batch audio/STT media understanding, local CLI fallbacks, provider transcription, voice-note preflight before mention gates, and related audio transcription and voice note understanding behavior.
-          - name: Inbound image summarization
-            coverageIds: [channels.qa-channel, media.image-understanding, ui.control]
-            description: Covers Inbound image summarization across image summarization before reply routing, active-model vision skip behavior, text-only model offload through `MediaPaths`/`media://inbound`, image-model fallback resolution, and related image understanding and vision routing behavior.
+          - name: "Inbound image summarization — QA channel"
+            coverageIds: [media.image-summary-qa-channel]
+            description: "Exact coverage for qa channel within Inbound image summarization."
+          - name: "Inbound image summarization — Image understanding"
+            coverageIds: [media.image-summary-image-understanding]
+            description: "Exact coverage for image understanding within Inbound image summarization."
+          - name: "Inbound image summarization — Control"
+            coverageIds: [media.image-summary-control]
+            description: "Exact coverage for control within Inbound image summarization."
           - name: Active vision model bypass
             coverageIds: [media.active-vision-model-bypass]
             description: Covers Active vision model bypass across image summarization before reply routing, active-model vision skip behavior, text-only model offload through `MediaPaths`/`media://inbound`, image-model fallback resolution, and related image understanding and vision routing behavior.
@@ -3335,18 +3856,24 @@ surfaces:
       - name: Media Generation
         id: media-generation
         features:
-          - name: Image generation tool invocation
-            coverageIds:
-              [
-                channels.qa-channel,
-                media.image-generation,
-                tools.image-generate,
-                tools.native-image-generation,
-              ]
-            description: Covers Image generation tool invocation across `image_generate`, model selection, provider registration, provider capability listing, and related image generation tool and provider routing behavior.
-          - name: Image generation provider routing
-            coverageIds: [media.image-generation, tools.native-image-generation]
-            description: Covers image generation provider and model routing across `image_generate`, provider registration, provider capability listing, and related image generation tool behavior.
+          - name: "Image generation tool invocation — QA channel"
+            coverageIds: [media.image-tool-qa-channel]
+            description: "Exact coverage for qa channel within Image generation tool invocation."
+          - name: "Image generation tool invocation — Image generation"
+            coverageIds: [media.image-tool-image-generation]
+            description: "Exact coverage for image generation within Image generation tool invocation."
+          - name: "Image generation tool invocation — Image generate"
+            coverageIds: [media.image-tool-image-generate]
+            description: "Exact coverage for image generate within Image generation tool invocation."
+          - name: "Image generation tool invocation — Native image generation"
+            coverageIds: [media.image-tool-native-image-generation]
+            description: "Exact coverage for native image generation within Image generation tool invocation."
+          - name: "Image generation provider routing"
+            coverageIds: [media.image-routing]
+            description: "Covers image generation provider and model routing across `image_generate`, provider registration, provider capability listing, and related image generation tool behavior."
+          - name: "Image generation provider routing — Native image generation"
+            coverageIds: [media.image-routing-native-image-generation]
+            description: "Exact coverage for native image generation within Image generation provider routing."
           - name: Reference image editing
             coverageIds: [media.reference-image-editing]
             description: Covers Reference image editing across `image_generate`, model selection, provider registration, provider capability listing, and related image generation tool and provider routing behavior.
@@ -3354,7 +3881,7 @@ surfaces:
             coverageIds: [media.generated-image-task-lifecycle]
             description: Covers Generated image task lifecycle across `image_generate`, model selection, provider registration, provider capability listing, and related image generation tool and provider routing behavior.
           - name: Generated image persistence and delivery
-            coverageIds: [media.image-generation-delivery]
+            coverageIds: [media.generated-image-persistence-and-delivery]
             description: Covers Generated image persistence and delivery across `image_generate`, model selection, provider registration, provider capability listing, and related image generation tool and provider routing behavior.
           - name: Music generation tool invocation
             coverageIds: [media.music-generation-tool-invocation]
@@ -3372,7 +3899,7 @@ surfaces:
             coverageIds: [media.music-task-lifecycle-and-duplicate-status]
             description: Covers Music task lifecycle and duplicate status across `music_generate`, provider/model config, lyrics/instrumental/duration/format controls, image reference inputs where supported, and related music generation tool and provider routing behavior.
           - name: Generated audio persistence and delivery
-            coverageIds: [tools.tts]
+            coverageIds: [media.generated-audio-persistence-and-delivery]
             description: Covers Generated audio persistence and delivery across `music_generate`, provider/model config, lyrics/instrumental/duration/format controls, image reference inputs where supported, and related music generation tool and provider routing behavior.
           - name: Video generation tool invocation
             coverageIds: [media.video-generation-tool-invocation]
@@ -3427,7 +3954,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: voice-and-realtime-talk
+  - id: voice
     name: Voice and realtime talk
     family: core
     level: alpha
@@ -3448,7 +3975,7 @@ surfaces:
             coverageIds: [voice.realtime-voice-provider-sdk-contracts]
             description: Realtime voice provider SDK contracts, activation metadata, provider registry, and resolver
           - name: Provider diagnostics
-            coverageIds: [models.diagnostics]
+            coverageIds: [voice.provider-diagnostics]
             description: Provider diagnostics, reconnect behavior, tool declarations, and bridge session lifecycle
           - name: Talk catalog
             coverageIds: [voice.talk-catalog]
@@ -3529,7 +4056,7 @@ surfaces:
         id: speech-and-transcription
         features:
           - name: Voice directives
-            coverageIds: [voice.directives]
+            coverageIds: [voice.voice-directives]
             description: Voice directives and directive stripping before TTS playback.
           - name: Talk speech playback
             coverageIds: [voice.talk-speech-playback]
@@ -3538,7 +4065,7 @@ surfaces:
             coverageIds: [voice.transcription-relay-sessions]
             description: Gateway transcription relay sessions, transcript events, and cleanup behavior.
           - name: Realtime transcription providers
-            coverageIds: [models.realtime-transcription-providers]
+            coverageIds: [voice.realtime-transcription-providers]
             description: Realtime transcription provider selection, diagnostics, and provider-specific bridge behavior.
           - name: Native directive parsing
             coverageIds: [voice.native-directive-parsing]
@@ -3636,7 +4163,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: browser-control-ui-and-webchat
+  - id: control-ui
     name: Gateway Web App
     family: core
     level: beta
@@ -3648,19 +4175,19 @@ surfaces:
         id: browser-realtime-talk
         features:
           - name: Browser Talk start/stop
-            coverageIds: [ui.browser-talk-start-stop]
+            coverageIds: [control-ui.browser-talk-start-stop]
             description: Covers Browser Talk start/stop across browser Talk controls, Talk options, OpenAI browser WebRTC, Google Live/provider WebSocket, and related browser realtime talk behavior.
           - name: Provider session selection
-            coverageIds: [ui.provider-session-selection]
+            coverageIds: [control-ui.provider-session-selection]
             description: Covers Provider session selection across browser Talk controls, Talk options, OpenAI browser WebRTC, Google Live/provider WebSocket, and related browser realtime talk behavior.
           - name: Gateway relay audio
-            coverageIds: [ui.gateway-relay-audio]
+            coverageIds: [control-ui.gateway-relay-audio]
             description: Covers Gateway relay audio across browser Talk controls, Talk options, OpenAI browser WebRTC, Google Live/provider WebSocket, and related browser realtime talk behavior.
           - name: Tool-call consults
-            coverageIds: [ui.tool-call-consults]
+            coverageIds: [control-ui.tool-call-consults]
             description: Covers Tool-call consults across browser Talk controls, Talk options, OpenAI browser WebRTC, Google Live/provider WebSocket, and related browser realtime talk behavior.
           - name: Steer and cancel
-            coverageIds: [ui.steer-and-cancel]
+            coverageIds: [control-ui.steer-and-cancel]
             description: Covers Steer and cancel across browser Talk controls, Talk options, OpenAI browser WebRTC, Google Live/provider WebSocket, and related browser realtime talk behavior.
         docs:
           - docs/web/control-ui.md
@@ -3681,19 +4208,19 @@ surfaces:
         id: browser-access-and-trust
         features:
           - name: Device pairing
-            coverageIds: [ui.device-pairing]
+            coverageIds: [control-ui.device-pairing]
             description: Covers Device pairing across Control UI/WebChat Gateway connection setup, browser-origin checks, token/password auth, trusted-proxy and Tailscale Serve auth, and related gateway connection, auth, device pairing, and remote origins behavior.
           - name: Token/password auth
-            coverageIds: [ui.token-password-auth]
+            coverageIds: [control-ui.token-password-auth]
             description: Covers Token/password auth across Control UI/WebChat Gateway connection setup, browser-origin checks, token/password auth, trusted-proxy and Tailscale Serve auth, and related gateway connection, auth, device pairing, and remote origins behavior.
           - name: Tailscale Serve auth
-            coverageIds: [ui.tailscale-serve-auth]
+            coverageIds: [control-ui.tailscale-serve-auth]
             description: Covers Tailscale Serve auth across Control UI/WebChat Gateway connection setup, browser-origin checks, token/password auth, trusted-proxy and Tailscale Serve auth, and related gateway connection, auth, device pairing, and remote origins behavior.
           - name: Trusted proxy auth
-            coverageIds: [security.trusted-proxy-auth]
+            coverageIds: [control-ui.trusted-proxy-auth]
             description: Covers Trusted proxy auth across Control UI/WebChat Gateway connection setup, browser-origin checks, token/password auth, trusted-proxy and Tailscale Serve auth, and related gateway connection, auth, device pairing, and remote origins behavior.
           - name: Allowed origins/gatewayUrl
-            coverageIds: [ui.allowed-origins-gatewayurl]
+            coverageIds: [control-ui.allowed-origins-gatewayurl]
             description: Covers Allowed origins/gatewayUrl across Control UI/WebChat Gateway connection setup, browser-origin checks, token/password auth, trusted-proxy and Tailscale Serve auth, and related gateway connection, auth, device pairing, and remote origins behavior.
         docs:
           - docs/web/control-ui.md
@@ -3715,19 +4242,19 @@ surfaces:
         id: configuration
         features:
           - name: Config snapshots
-            coverageIds: [ui.config-snapshots]
+            coverageIds: [control-ui.config-snapshots]
             description: Covers Config snapshots across `config.get`, `config.set`, `config.apply`, `config.patch`, and related config schema editing and safe writes behavior.
           - name: Schema form editing
-            coverageIds: [ui.schema-form-editing]
+            coverageIds: [control-ui.schema-form-editing]
             description: Covers Schema form editing across `config.get`, `config.set`, `config.apply`, `config.patch`, and related config schema editing and safe writes behavior.
           - name: Raw JSON editing
-            coverageIds: [ui.raw-json-editing]
+            coverageIds: [control-ui.raw-json-editing]
             description: Covers Raw JSON editing across `config.get`, `config.set`, `config.apply`, `config.patch`, and related config schema editing and safe writes behavior.
           - name: Base-hash guarded writes
-            coverageIds: [ui.base-hash-guarded-writes]
+            coverageIds: [control-ui.base-hash-guarded-writes]
             description: Covers Base-hash guarded writes across `config.get`, `config.set`, `config.apply`, `config.patch`, and related config schema editing and safe writes behavior.
           - name: Apply and restart
-            coverageIds: [ui.apply-and-restart]
+            coverageIds: [control-ui.apply-and-restart]
             description: Covers Apply and restart across `config.get`, `config.set`, `config.apply`, `config.patch`, and related config schema editing and safe writes behavior.
         docs:
           - docs/web/control-ui.md
@@ -3746,35 +4273,41 @@ surfaces:
       - name: Browser UI
         id: browser-ui
         features:
-          - name: Gateway-hosted UI
-            coverageIds: [channels.qa-channel, media.image-understanding, ui.control]
-            description: Covers Gateway-hosted UI across serving the Control UI bundle from the Gateway, root and base-path routing, static asset MIME/cache behavior, public PWA assets, and related control ui shell and routing behavior.
+          - name: "Gateway-hosted UI — QA channel"
+            coverageIds: [control-ui.gateway-hosted-ui-qa-channel]
+            description: "Exact coverage for qa channel within Gateway-hosted UI."
+          - name: "Gateway-hosted UI — Image understanding"
+            coverageIds: [control-ui.gateway-hosted-ui-image-understanding]
+            description: "Exact coverage for image understanding within Gateway-hosted UI."
+          - name: "Gateway-hosted UI — Control"
+            coverageIds: [control-ui.gateway-hosted-ui-control]
+            description: "Exact coverage for control within Gateway-hosted UI."
           - name: Dashboard open/auth bootstrap
-            coverageIds: [ui.dashboard-auth-bootstrap]
+            coverageIds: [control-ui.dashboard-open-auth-bootstrap]
             description: Covers Dashboard open/auth bootstrap across serving the Control UI bundle from the Gateway, root and base-path routing, static asset MIME/cache behavior, public PWA assets, and related control ui shell and routing behavior.
           - name: Base-path routing
-            coverageIds: [ui.base-path-routing]
+            coverageIds: [control-ui.base-path-routing]
             description: Covers Base-path routing across serving the Control UI bundle from the Gateway, root and base-path routing, static asset MIME/cache behavior, public PWA assets, and related control ui shell and routing behavior.
           - name: Static asset recovery
-            coverageIds: [ui.static-asset-recovery]
+            coverageIds: [control-ui.static-asset-recovery]
             description: Covers Static asset recovery across serving the Control UI bundle from the Gateway, root and base-path routing, static asset MIME/cache behavior, public PWA assets, and related control ui shell and routing behavior.
           - name: Dev gatewayUrl target
-            coverageIds: [ui.dev-gatewayurl-target]
+            coverageIds: [control-ui.dev-gatewayurl-target]
             description: Covers Dev gatewayUrl target across serving the Control UI bundle from the Gateway, root and base-path routing, static asset MIME/cache behavior, public PWA assets, and related control ui shell and routing behavior.
           - name: PWA install metadata
-            coverageIds: [ui.pwa-install-metadata]
+            coverageIds: [control-ui.pwa-install-metadata]
             description: Covers PWA install metadata across browser PWA install metadata, production service-worker registration, push event handling, notification-click behavior, and related pwa install and web push notifications behavior.
           - name: Service worker updates
-            coverageIds: [ui.service-worker-updates]
+            coverageIds: [control-ui.service-worker-updates]
             description: Covers Service worker updates across browser PWA install metadata, production service-worker registration, push event handling, notification-click behavior, and related pwa install and web push notifications behavior.
           - name: VAPID keys
-            coverageIds: [ui.vapid-keys]
+            coverageIds: [control-ui.vapid-keys]
             description: Covers VAPID keys across browser PWA install metadata, production service-worker registration, push event handling, notification-click behavior, and related pwa install and web push notifications behavior.
           - name: Subscribe/unsubscribe
-            coverageIds: [ui.subscribe-unsubscribe]
+            coverageIds: [control-ui.subscribe-unsubscribe]
             description: Covers Subscribe/unsubscribe across browser PWA install metadata, production service-worker registration, push event handling, notification-click behavior, and related pwa install and web push notifications behavior.
           - name: Test notifications
-            coverageIds: [ui.test-notifications]
+            coverageIds: [control-ui.test-notifications]
             description: Covers Test notifications across browser PWA install metadata, production service-worker registration, push event handling, notification-click behavior, and related pwa install and web push notifications behavior.
         docs:
           - docs/web/control-ui.md
@@ -3801,57 +4334,64 @@ surfaces:
         id: webchat-conversations
         features:
           - name: Send and abort
-            coverageIds: [ui.send-and-abort]
+            coverageIds: [control-ui.send-and-abort]
             description: "Covers Send and abort across browser chat composition and display UX after an authenticated Gateway connection exists: composer controls, slash commands, session and agent filtering, model/thinking overrides, and related chat composer and message rendering behavior."
           - name: Session and agent picker
-            coverageIds: [ui.session-and-agent-picker]
+            coverageIds: [control-ui.session-and-agent-picker]
             description: "Covers Session and agent picker across browser chat composition and display UX after an authenticated Gateway connection exists: composer controls, slash commands, session and agent filtering, model/thinking overrides, and related chat composer and message rendering behavior."
           - name: Model/thinking controls
-            coverageIds: [ui.model-thinking-controls]
+            coverageIds: [control-ui.model-thinking-controls]
             description: "Covers Model/thinking controls across browser chat composition and display UX after an authenticated Gateway connection exists: composer controls, slash commands, session and agent filtering, model/thinking overrides, and related chat composer and message rendering behavior."
           - name: Attachments
-            coverageIds: [ui.attachments]
+            coverageIds: [control-ui.attachments]
             description: "Covers Attachments across browser chat composition and display UX after an authenticated Gateway connection exists: composer controls, slash commands, session and agent filtering, model/thinking overrides, and related chat composer and message rendering behavior."
           - name: Markdown/tool/media rendering
-            coverageIds: [ui.markdown-tool-media-rendering]
+            coverageIds: [control-ui.markdown-tool-media-rendering]
             description: "Covers Markdown/tool/media rendering across browser chat composition and display UX after an authenticated Gateway connection exists: composer controls, slash commands, session and agent filtering, model/thinking overrides, and related chat composer and message rendering behavior."
           - name: chat.history projection
-            coverageIds: [ui.chat-history-projection]
+            coverageIds: [control-ui.chat-history-projection]
             description: Covers chat.history projection across Gateway WebChat RPC/runtime contract, durable transcript projection, active run lifecycle, abort and partial retention, and related webchat runtime and session continuity behavior.
-          - name: chat.send lifecycle
-            coverageIds:
-              [
-                channels.qa-channel,
-                channels.webchat,
-                media.image-understanding,
-                runtime.direct-reply-routing,
-                tools.message,
-                ui.control,
-              ]
-            description: Covers chat.send lifecycle across Gateway WebChat RPC/runtime contract, durable transcript projection, active run lifecycle, abort and partial retention, and related webchat runtime and session continuity behavior.
+          - name: "chat.send lifecycle — QA channel"
+            coverageIds: [control-ui.chat-send-lifecycle-qa-channel]
+            description: "Exact coverage for qa channel within chat.send lifecycle."
+          - name: "chat.send lifecycle — Webchat"
+            coverageIds: [control-ui.chat-send-lifecycle-webchat]
+            description: "Exact coverage for webchat within chat.send lifecycle."
+          - name: "chat.send lifecycle — Image understanding"
+            coverageIds: [control-ui.chat-send-lifecycle-image-understanding]
+            description: "Exact coverage for image understanding within chat.send lifecycle."
+          - name: "chat.send lifecycle — Direct reply routing"
+            coverageIds: [control-ui.chat-send-lifecycle-direct-reply-routing]
+            description: "Exact coverage for direct reply routing within chat.send lifecycle."
+          - name: "chat.send lifecycle — Message"
+            coverageIds: [control-ui.chat-send-lifecycle-message]
+            description: "Exact coverage for message within chat.send lifecycle."
+          - name: "chat.send lifecycle — Control"
+            coverageIds: [control-ui.chat-send-lifecycle-control]
+            description: "Exact coverage for control within chat.send lifecycle."
           - name: Abort/partial retention
-            coverageIds: [ui.abort-partial-retention]
+            coverageIds: [control-ui.abort-partial-retention]
             description: Covers Abort/partial retention across Gateway WebChat RPC/runtime contract, durable transcript projection, active run lifecycle, abort and partial retention, and related webchat runtime and session continuity behavior.
           - name: Injected assistant notes
-            coverageIds: [ui.injected-assistant-notes]
+            coverageIds: [control-ui.injected-assistant-notes]
             description: Covers Injected assistant notes across Gateway WebChat RPC/runtime contract, durable transcript projection, active run lifecycle, abort and partial retention, and related webchat runtime and session continuity behavior.
           - name: Reconnect continuity
-            coverageIds: [ui.reconnect-continuity]
+            coverageIds: [control-ui.reconnect-continuity]
             description: Covers Reconnect continuity across Gateway WebChat RPC/runtime contract, durable transcript projection, active run lifecycle, abort and partial retention, and related webchat runtime and session continuity behavior.
           - name: Hosted embeds
-            coverageIds: [ui.hosted-embeds]
+            coverageIds: [control-ui.hosted-embeds]
             description: Covers Hosted embeds across `[embed ...]` rendering policy, `gateway.controlUi.embedSandbox`, external embed URL gating, CSP and frame denial, and related hosted media and embed safety behavior.
           - name: External embed gating
-            coverageIds: [ui.external-embed-gating]
+            coverageIds: [control-ui.external-embed-gating]
             description: Covers External embed gating across `[embed ...]` rendering policy, `gateway.controlUi.embedSandbox`, external embed URL gating, CSP and frame denial, and related hosted media and embed safety behavior.
           - name: Assistant media tickets
-            coverageIds: [ui.assistant-media-tickets]
+            coverageIds: [control-ui.assistant-media-tickets]
             description: Covers Assistant media tickets across `[embed ...]` rendering policy, `gateway.controlUi.embedSandbox`, external embed URL gating, CSP and frame denial, and related hosted media and embed safety behavior.
           - name: Authenticated avatars
-            coverageIds: [ui.authenticated-avatars]
+            coverageIds: [control-ui.authenticated-avatars]
             description: Covers Authenticated avatars across `[embed ...]` rendering policy, `gateway.controlUi.embedSandbox`, external embed URL gating, CSP and frame denial, and related hosted media and embed safety behavior.
           - name: CSP image policy
-            coverageIds: [ui.csp-image-policy]
+            coverageIds: [control-ui.csp-image-policy]
             description: Covers CSP image policy across `[embed ...]` rendering policy, `gateway.controlUi.embedSandbox`, external embed URL gating, CSP and frame denial, and related hosted media and embed safety behavior.
         docs:
           - docs/web/control-ui.md
@@ -3884,34 +4424,40 @@ surfaces:
         id: operator-console
         features:
           - name: Health/status/models
-            coverageIds: [ui.health-status-models]
+            coverageIds: [control-ui.health-status-models]
             description: Covers Health/status/models across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior.
           - name: Live log tail
-            coverageIds: [ui.live-log-tail]
+            coverageIds: [control-ui.live-log-tail]
             description: Covers Live log tail across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior.
-          - name: Update run/status
-            coverageIds: [runtime.gateway-restart, runtime.package-update, runtime.update-run]
-            description: Covers Update run/status across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior.
+          - name: "Update run/status — Gateway restart"
+            coverageIds: [control-ui.update-run-status-gateway-restart]
+            description: "Exact coverage for gateway restart within Update run/status."
+          - name: "Update run/status — Package update"
+            coverageIds: [control-ui.update-run-status-package-update]
+            description: "Exact coverage for package update within Update run/status."
+          - name: "Update run/status"
+            coverageIds: [control-ui.update-run-status]
+            description: "Covers Update run/status across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior."
           - name: Activity summaries
-            coverageIds: [ui.activity-summaries]
+            coverageIds: [control-ui.activity-summaries]
             description: Covers Activity summaries across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior.
           - name: RPC timing telemetry
-            coverageIds: [ui.rpc-timing-telemetry]
+            coverageIds: [control-ui.rpc-timing-telemetry]
             description: Covers RPC timing telemetry across Debug, Logs, Update, Activity, and related diagnostics, logs, update, and activity behavior.
           - name: Channels/login
-            coverageIds: [ui.channels-login]
+            coverageIds: [control-ui.channels-login]
             description: "Covers Channels/login across non-config operator panels in the browser Control UI: channels and login, instances/presence, sessions, cron jobs, skills, nodes, exec approvals, agents, usage, dreams, and the dashboard navigation that surfaces them."
           - name: Session manager and history
-            coverageIds: [ui.session-manager-and-history]
+            coverageIds: [control-ui.session-manager-and-history]
             description: Covers browser Control UI session manager, session history, instance presence, approvals, diagnostics, and log tabs.
           - name: Cron
-            coverageIds: [ui.cron]
+            coverageIds: [control-ui.cron]
             description: "Covers Cron across non-config operator panels in the browser Control UI: channels and login, instances/presence, sessions, cron jobs, skills, nodes, exec approvals, agents, usage, dreams, and the dashboard navigation that surfaces them."
           - name: Skills/nodes
-            coverageIds: [ui.skills-nodes]
+            coverageIds: [control-ui.skills-nodes]
             description: "Covers Skills/nodes across non-config operator panels in the browser Control UI: channels and login, instances/presence, sessions, cron jobs, skills, nodes, exec approvals, agents, usage, dreams, and the dashboard navigation that surfaces them."
           - name: Exec approvals/agents
-            coverageIds: [ui.exec-approvals-agents]
+            coverageIds: [control-ui.exec-approvals-agents]
             description: "Covers Exec approvals/agents across non-config operator panels in the browser Control UI: channels and login, instances/presence, sessions, cron jobs, skills, nodes, exec approvals, agents, usage, dreams, and the dashboard navigation that surfaces them."
         docs:
           - docs/web/control-ui.md
@@ -3941,7 +4487,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: tui-and-terminal-ux
+  - id: tui
     name: TUI
     family: core
     level: alpha
@@ -4038,7 +4584,7 @@ surfaces:
             coverageIds: [tui.ime-and-altgr-handling]
             description: Covers IME and AltGr handling across editor, submit handler, input history, slash/local shell routing, busy-submit behavior, paste fallback, backspace dedupe, Ctrl/Esc shortcuts, AltGr handling, and documented keyboard shortcuts.
           - name: Slash Commands
-            coverageIds: [slack.slash-commands]
+            coverageIds: [tui.slash-commands]
             description: Covers Slash Commands across slash command parsing, command forwarding, local-only commands, model/agent/session selectors, settings overlay, context mode picker, dynamic Gateway command list, session patch commands, and command docs.
           - name: Pickers
             coverageIds: [tui.pickers]
@@ -4152,7 +4698,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: clawhub-and-external-plugin-distribution
+  - id: clawhub
     name: ClawHub
     family: core
     level: alpha
@@ -4164,10 +4710,10 @@ surfaces:
         id: publishing
         features:
           - name: ClawHub package publishing owner
-            coverageIds: [clawhub.package-publishing-owner]
+            coverageIds: [clawhub.clawhub-package-publishing-owner]
             description: ClawHub package publishing owner and scope rules
           - name: OpenClaw-owned package release validation for ClawHub
-            coverageIds: [clawhub.openclaw-owned-package-release-validation-for-clawhub]
+            coverageIds: [clawhub.package-release-validation]
             description: OpenClaw-owned package release validation for ClawHub and npm
           - name: Version bump gates
             coverageIds: [clawhub.version-bump-gates]
@@ -4202,13 +4748,13 @@ surfaces:
         id: catalog-discovery
         features:
           - name: Plugin catalog search
-            coverageIds: [clawhub.openclaw-plugins-search-as-the-clawhub]
+            coverageIds: [clawhub.plugin-catalog-search]
             description: OpenClaw plugin search resolves ClawHub package lookup results.
           - name: Search result metadata
             coverageIds: [clawhub.search-result-metadata]
             description: Search results include package identity, channel, version, summary, compatibility, and source metadata.
           - name: Plugin and skill search separation
-            coverageIds: [clawhub.distinction-between-plugin-search]
+            coverageIds: [clawhub.plugin-and-skill-search-separation]
             description: Plugin search and skill search stay distinct even when both use ClawHub metadata.
           - name: Catalog lookup failure
             coverageIds: [clawhub.catalog-lookup-failure]
@@ -4235,7 +4781,7 @@ surfaces:
             coverageIds: [clawhub.openclaw-compat-pluginapi]
             description: openclaw.compat.pluginApi, build metadata, and host/gateway minimums
           - name: ClawHub package compatibility validation
-            coverageIds: [clawhub.package-compatibility-validation]
+            coverageIds: [clawhub.clawhub-package-compatibility-validation]
             description: Evidence scope for ClawHub package compatibility validation.
           - name: npm compatibility fallback to the newest
             coverageIds: [clawhub.npm-compatibility-fallback-to-the-newest]
@@ -4250,7 +4796,7 @@ surfaces:
             coverageIds: [clawhub.operator-trust-model-for-installing]
             description: Operator trust model for installing and enabling external code
           - name: ClawHub archive
-            coverageIds: [clawhub.archive]
+            coverageIds: [clawhub.clawhub-archive]
             description: ClawHub archive and ClawPack digest verification
           - name: npm integrity drift
             coverageIds: [clawhub.npm-integrity-drift]
@@ -4259,7 +4805,7 @@ surfaces:
             coverageIds: [clawhub.built-in-dangerous-code-scanner]
             description: Built-in dangerous-code scanner and break-glass override semantics
           - name: ClawHub publishing review/hidden-release behavior as upstream
-            coverageIds: [clawhub.publishing-review-hidden-release-behavior-as-upstream]
+            coverageIds: [clawhub.hidden-release-review]
             description: ClawHub publishing review/hidden-release behavior as upstream trust signal
           - name: Skill archive safety
             coverageIds: [clawhub.skill-archive-safety]
@@ -4294,7 +4840,7 @@ surfaces:
             coverageIds: [clawhub.source-prefixes]
             description: Source prefixes and shorthand resolution cover ClawHub, npm, local, archive, and marketplace plugin sources.
           - name: Bare package launch behavior
-            coverageIds: [clawhub.bare-package-behavior-during-the-launch]
+            coverageIds: [clawhub.bare-package-launch-behavior]
             description: Bare package behavior during the launch cutover
           - name: Explicit pinned versions
             coverageIds: [clawhub.explicit-pinned-versions]
@@ -4330,7 +4876,7 @@ surfaces:
             coverageIds: [clawhub.uninstall-config-index-policy-file-cleanup]
             description: Evidence scope for Uninstall config/index/policy/file cleanup.
           - name: Gateway restart and reload requirements
-            coverageIds: [clawhub.gateway-restart-reload-requirements-after]
+            coverageIds: [clawhub.gateway-restart-and-reload-requirements]
             description: Gateway restart/reload requirements after install/update/uninstall
           - name: Per-plugin managed npm project
             coverageIds: [clawhub.per-plugin-managed-npm-project]
@@ -4348,7 +4894,7 @@ surfaces:
             coverageIds: [clawhub.legacy-dependency-root-cleanup]
             description: Legacy dependency root cleanup and doctor repair
           - name: Plugin inventory commands
-            coverageIds: [clawhub.plugins-list]
+            coverageIds: [clawhub.plugin-inventory-commands]
             description: Plugin list, inspect, runtime inspect, and doctor commands expose operator inventory and diagnostics.
           - name: Local plugin index
             coverageIds: [clawhub.local-plugin-index]
@@ -4360,7 +4906,7 @@ surfaces:
             coverageIds: [clawhub.runtime-verification-after-gateway]
             description: Runtime verification after Gateway restart
           - name: ClawHub skill installs
-            coverageIds: [clawhub.skill-installs]
+            coverageIds: [clawhub.clawhub-skill-installs]
             description: Install and update ClawHub-tracked workspace or global skills.
           - name: Skill upload install path
             coverageIds: [clawhub.skill-upload-install-path]
@@ -4399,7 +4945,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: openclaw-app-sdk
+  - id: app-sdk
     name: OpenClaw App SDK
     family: core
     level: alpha
@@ -4540,9 +5086,12 @@ surfaces:
           - name: ToolSpace
             coverageIds: [app-sdk.toolspace]
             description: Tool discovery and invocation abstraction for external apps.
-          - name: Artifact resources
-            coverageIds: [workspace.artifacts, workspace.builds]
-            description: SDK helpers for workspace artifact summaries, generated build outputs, retention metadata, and downloads.
+          - name: "Artifact resources — Artifacts"
+            coverageIds: [app-sdk.artifact-resources-artifacts]
+            description: "Exact coverage for artifacts within Artifact resources."
+          - name: "Artifact resources — Builds"
+            coverageIds: [app-sdk.artifact-resources-builds]
+            description: "Exact coverage for builds within Artifact resources."
           - name: Tasks
             coverageIds: [app-sdk.tasks]
             description: SDK helpers around Gateway task APIs.
@@ -4597,7 +5146,7 @@ surfaces:
       by: codex
       source_ref: openclaw@29dd7847fd
       process_version: 3
-  - id: macos-gateway-host
+  - id: macos-host
     name: macOS Gateway host
     family: platform-app
     level: stable
@@ -4609,16 +5158,16 @@ surfaces:
         id: cli-setup
         features:
           - name: Hosted installer
-            coverageIds: [macos.hosted-installer]
+            coverageIds: [macos-host.hosted-installer]
             description: Hosted installer and local-prefix install paths on macOS
           - name: Node 24 recommendation
-            coverageIds: [macos.node-24-recommendation]
+            coverageIds: [macos-host.node-24-recommendation]
             description: Node 24.15+ recommendation and WAL-reset-safe Node runtime floor
           - name: App-triggered CLI install
-            coverageIds: [macos.app-triggered-cli-install]
+            coverageIds: [macos-host.app-triggered-cli-install]
             description: App-triggered CLI install and runtime discovery
           - name: Shell PATH and version-manager drift
-            coverageIds: [macos.shell-path-and-version-manager-drift]
+            coverageIds: [macos-host.shell-path-drift]
             description: Shell PATH, package-manager, and version-manager drift that affect the host Gateway.
         docs:
           - docs/platforms/macos.md
@@ -4634,31 +5183,31 @@ surfaces:
         id: local-gateway-integration
         features:
           - name: App local/remote connection mode
-            coverageIds: [macos.app-local-remote-connection-mode]
+            coverageIds: [macos-host.app-local-remote-connection-mode]
             description: App local/remote connection mode coordination
           - name: App-managed Gateway LaunchAgent install/restart/uninstall
-            coverageIds: [macos.app-managed-gateway-launchagent-install-restart-uninstall]
+            coverageIds: [macos-host.launchagent-lifecycle]
             description: App-managed Gateway LaunchAgent install/restart/uninstall through the CLI
           - name: CLI install detection
-            coverageIds: [macos.cli-install-detection]
+            coverageIds: [macos-host.cli-install-detection]
             description: CLI install detection and app install prompt
           - name: Attach-to-existing local Gateway compatibility
-            coverageIds: [macos.attach-to-existing-local-gateway-compatibility]
+            coverageIds: [macos-host.local-gateway-attach]
             description: Attach-to-existing local Gateway compatibility checks
           - name: Gateway endpoint
-            coverageIds: [macos.gateway-endpoint]
+            coverageIds: [macos-host.gateway-endpoint]
             description: Gateway endpoint, credential, and control-channel resolution
           - name: gateway.mode=local configuration
-            coverageIds: [macos.gateway-mode-local-configuration]
+            coverageIds: [macos-host.gateway-mode-local-configuration]
             description: gateway.mode=local configuration and defaulting during service install
           - name: Loopback bind
-            coverageIds: [macos.loopback-bind]
+            coverageIds: [macos-host.loopback-bind]
             description: Loopback bind, explicit host/bind overrides, auth requirements, and port precedence
           - name: Local app endpoint resolution
-            coverageIds: [macos.local-app-endpoint-resolution]
+            coverageIds: [macos-host.local-app-endpoint-resolution]
             description: Local app endpoint resolution, local control channel, and attach-to-existing Gateway behavior
           - name: Bonjour discovery
-            coverageIds: [macos.bonjour-discovery]
+            coverageIds: [macos-host.bonjour-discovery]
             description: Bonjour discovery and local status/probe/health surfaces
         docs:
           - docs/platforms/macos.md
@@ -4678,19 +5227,19 @@ surfaces:
         id: remote-gateway-mode
         features:
           - name: macOS app "Remote over SSH"
-            coverageIds: [macos.app-remote-over-ssh]
+            coverageIds: [macos-host.macos-app-remote-over-ssh]
             description: macOS app "Remote over SSH" and direct remote Gateway modes
           - name: SSH tunnel setup
-            coverageIds: [macos.ssh-tunnel-setup]
+            coverageIds: [macos-host.ssh-tunnel-setup]
             description: SSH tunnel setup, stable local forward ownership, and tunnel restart/backoff
           - name: Tailscale MagicDNS
-            coverageIds: [macos.tailscale-magicdns]
+            coverageIds: [macos-host.tailscale-magicdns]
             description: Tailscale MagicDNS, Serve, and Funnel guidance for remote access
           - name: Remote endpoint token/password/TLS fingerprint
-            coverageIds: [macos.remote-endpoint-token-password-tls-fingerprint]
+            coverageIds: [macos-host.remote-endpoint-auth]
             description: Remote endpoint token/password/TLS fingerprint resolution
           - name: Local node host startup
-            coverageIds: [macos.local-node-host-startup]
+            coverageIds: [macos-host.local-node-host-startup]
             description: Local node host startup and local Gateway suppression while the app is remote
         docs:
           - docs/platforms/mac/remote.md
@@ -4705,34 +5254,34 @@ surfaces:
         id: gateway-service-lifecycle
         features:
           - name: Per-user Gateway LaunchAgent install
-            coverageIds: [macos.per-user-gateway-launchagent-install]
+            coverageIds: [macos-host.per-user-gateway-launchagent-install]
             description: Per-user Gateway LaunchAgent install, stage, uninstall, start, stop, restart, and status
           - name: launchctl bootstrap
-            coverageIds: [macos.launchctl-bootstrap]
+            coverageIds: [macos-host.launchctl-bootstrap]
             description: launchctl bootstrap, bootout, enable, disable, kickstart, runtime parsing, installed-but-unloaded repair, and --disable semantics
           - name: LaunchAgent labels
-            coverageIds: [macos.launchagent-labels]
+            coverageIds: [macos-host.launchagent-labels]
             description: LaunchAgent labels, profile labels, legacy cleanup, service metadata, plist generation, KeepAlive, RunAtLoad, logs, working directory, and temp directory handling
           - name: Gateway token/env handling
-            coverageIds: [macos.gateway-token-env-handling]
+            coverageIds: [macos-host.gateway-token-env-handling]
             description: Gateway token/env handling, owner-only env files/wrappers, managed service env keys, and config audit/status output
           - name: App-managed LaunchAgent handoff
-            coverageIds: [macos.app-managed-launchagent-handoff]
+            coverageIds: [macos-host.app-managed-launchagent-handoff]
             description: macOS app integration that manages the Gateway LaunchAgent in local mode and avoids it in remote or attach-only modes.
           - name: openclaw update package/git handoff
-            coverageIds: [macos.openclaw-update-package-git-handoff]
+            coverageIds: [macos-host.openclaw-update-package-git-handoff]
             description: openclaw update package/git handoff on macOS
           - name: Managed service refresh
-            coverageIds: [macos.managed-service-refresh]
+            coverageIds: [macos-host.managed-service-refresh]
             description: Managed service refresh and LaunchAgent rebootstrap after updates
           - name: Stale updater launchd job detection
-            coverageIds: [macos.stale-updater-launchd-job-detection]
+            coverageIds: [macos-host.stale-updater-launchd-job-detection]
             description: Stale updater launchd job detection and cleanup
           - name: openclaw uninstall
-            coverageIds: [macos.openclaw-uninstall]
+            coverageIds: [macos-host.openclaw-uninstall]
             description: openclaw uninstall, service uninstall, state cleanup, and manual launchd removal
           - name: Stranded service recovery
-            coverageIds: [macos.stranded-service-recovery]
+            coverageIds: [macos-host.stranded-service-recovery]
             description: Recovery after partially updated or stranded macOS Gateway services.
         docs:
           - docs/platforms/macos.md
@@ -4754,16 +5303,16 @@ surfaces:
         id: diagnostics-and-observability
         features:
           - name: LaunchAgent log paths
-            coverageIds: [macos.launchagent-log-paths]
+            coverageIds: [macos-host.launchagent-log-paths]
             description: LaunchAgent log paths and app diagnostic log paths
           - name: openclaw gateway status --deep
-            coverageIds: [macos.openclaw-gateway-status-deep]
+            coverageIds: [macos-host.openclaw-gateway-status-deep]
             description: openclaw gateway status --deep, gateway probe, doctor, health, and logs commands
           - name: Gateway silently stops responding
-            coverageIds: [macos.gateway-silently-stops-responding]
+            coverageIds: [macos-host.gateway-silently-stops-responding]
             description: Gateway silently stops responding, ENETDOWN sleep/wake failure, port conflicts, invalid config, and memory pressure runbooks
           - name: Stale updater jobs
-            coverageIds: [macos.stale-updater-jobs]
+            coverageIds: [macos-host.stale-updater-jobs]
             description: Stale updater jobs, service config drift, and LaunchAgent environment diagnostics
         docs:
           - docs/platforms/mac/bundled-gateway.md
@@ -4780,16 +5329,16 @@ surfaces:
         id: permissions-and-native-capabilities
         features:
           - name: macOS TCC permission prompts/status
-            coverageIds: [macos.tcc-permission-prompts-status]
+            coverageIds: [macos-host.macos-tcc-permission-prompts-status]
             description: macOS TCC permission prompts/status for Accessibility, AppleScript, Screen Recording, Microphone, Speech Recognition, Camera, Location, Notifications, and Voice Wake
           - name: Native node capability exposure
-            coverageIds: [macos.native-node-capability-exposure]
+            coverageIds: [macos-host.native-node-capability-exposure]
             description: Native node capability exposure for screen/canvas/browser/system operations
           - name: system.run policy
-            coverageIds: [macos.system-run-policy]
+            coverageIds: [macos-host.system-run-policy]
             description: system.run policy and local/remote node execution expectations
           - name: Permission-driven support
-            coverageIds: [macos.permission-driven-support]
+            coverageIds: [macos-host.permission-driven-support]
             description: Permission-driven support and operator diagnostics
         docs:
           - docs/platforms/macos.md
@@ -4803,19 +5352,19 @@ surfaces:
         id: profiles-and-isolation
         features:
           - name: Profile-specific LaunchAgent labels
-            coverageIds: [macos.profile-specific-launchagent-labels]
+            coverageIds: [macos-host.profile-specific-launchagent-labels]
             description: Profile-specific LaunchAgent labels and plist paths
           - name: Profile-specific state/config/workspace roots
-            coverageIds: [macos.profile-specific-state-config-workspace-roots]
+            coverageIds: [macos-host.profile-roots]
             description: Profile-specific state, config, and workspace roots for isolated local Gateways.
           - name: Derived ports
-            coverageIds: [macos.derived-ports]
+            coverageIds: [macos-host.derived-ports]
             description: Derived ports and multi-Gateway conflict avoidance
           - name: Rescue bot setup
-            coverageIds: [macos.rescue-bot-setup]
+            coverageIds: [macos-host.rescue-bot-setup]
             description: Rescue bot setup and operator checks
           - name: Extra Gateway process detection
-            coverageIds: [macos.extra-gateway-process-detection]
+            coverageIds: [macos-host.extra-gateway-process-detection]
             description: Deep status detection for extra Gateway-like services and duplicate local processes.
         docs:
           - docs/gateway/multiple-gateways.md
@@ -4832,7 +5381,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: macos-companion-app
+  - id: macos-app
     name: macOS companion app
     family: platform-app
     level: beta
@@ -4844,16 +5393,16 @@ surfaces:
         id: canvas
         features:
           - name: Canvas panel open/hide/navigate/eval/snapshot
-            coverageIds: [macos.canvas-panel-open-hide-navigate-eval-snapshot]
+            coverageIds: [macos-app.canvas-controls]
             description: Canvas panel open/hide/navigate/eval/snapshot behavior, status, and operator-visible verification.
           - name: Local custom URL scheme
-            coverageIds: [macos.local-custom-url-scheme]
+            coverageIds: [macos-app.local-custom-url-scheme]
             description: Local custom URL scheme and session-root file serving
           - name: A2UI host auto-navigation
-            coverageIds: [macos.a2ui-host-auto-navigation]
+            coverageIds: [macos-app.a2ui-host-auto-navigation]
             description: A2UI host auto-navigation, push/reset, and action bridge
           - name: Canvas enable/disable setting
-            coverageIds: [macos.canvas-enable-disable-setting]
+            coverageIds: [macos-app.canvas-enable-disable-setting]
             description: Canvas enable/disable setting and node command behavior
         docs:
           - docs/platforms/mac/canvas.md
@@ -4868,25 +5417,25 @@ surfaces:
         id: local-setup
         features:
           - name: Local mode Gateway attach/start/stop
-            coverageIds: [macos.local-mode-gateway-attach-start-stop]
+            coverageIds: [macos-app.local-gateway-lifecycle]
             description: Local mode Gateway attach/start/stop behavior, status, and operator-visible verification.
           - name: LaunchAgent install/update/restart/uninstall
-            coverageIds: [macos.launchagent-install-update-restart-uninstall]
+            coverageIds: [macos-app.launchagent-install-update-restart-uninstall]
             description: LaunchAgent install/update/restart/uninstall through app-managed CLI calls
           - name: Existing-listener detection
-            coverageIds: [macos.existing-listener-detection]
+            coverageIds: [macos-app.existing-listener-detection]
             description: Existing-listener detection, port guarding, and launchd log path
           - name: Native first-run onboarding flow
-            coverageIds: [macos.native-first-run-onboarding-flow]
+            coverageIds: [macos-app.native-first-run-onboarding-flow]
             description: Native first-run onboarding flow and completion marker
           - name: CLI discovery
-            coverageIds: [macos.cli-discovery]
+            coverageIds: [macos-app.cli-discovery]
             description: CLI discovery and "Install CLI" prompt/install path
           - name: Local workspace selection
-            coverageIds: [macos.local-workspace-selection]
+            coverageIds: [macos-app.local-workspace-selection]
             description: Local workspace selection and Gateway wizard startup
           - name: Onboarding WebChat session separation
-            coverageIds: [macos.onboarding-webchat-session-separation]
+            coverageIds: [macos-app.onboarding-webchat-session-separation]
             description: Onboarding WebChat session separation behavior, status, and operator-visible verification.
         docs:
           - docs/platforms/mac/bundled-gateway.md
@@ -4904,19 +5453,19 @@ surfaces:
         id: status-and-settings
         features:
           - name: Menu-bar status
-            coverageIds: [macos.menu-bar-status]
+            coverageIds: [macos-app.menu-bar-status]
             description: Menu-bar status, action menu, status icon state, dock menu, dashboard/chat/canvas/talk shortcuts
           - name: Activity state ingestion
-            coverageIds: [macos.activity-state-ingestion]
+            coverageIds: [macos-app.activity-state-ingestion]
             description: Activity state ingestion and status row behavior
           - name: Settings navigation
-            coverageIds: [macos.settings-navigation]
+            coverageIds: [macos-app.settings-navigation]
             description: Settings navigation and tabs
           - name: Health polling
-            coverageIds: [macos.health-polling]
+            coverageIds: [macos-app.health-polling]
             description: Health polling, channel status, logs, debug actions, config/session/instance visibility
           - name: Channels settings
-            coverageIds: [macos.channels-settings]
+            coverageIds: [macos-app.channels-settings]
             description: Channels settings and QR/login/probe status surfaced through the app
         docs:
           - docs/platforms/mac/menu-bar.md
@@ -4936,19 +5485,19 @@ surfaces:
         id: native-capabilities
         features:
           - name: Mac node session connection
-            coverageIds: [macos.mac-node-session-connection]
+            coverageIds: [macos-app.mac-node-session-connection]
             description: Mac node session connection, capability and command advertisement
           - name: system.run
-            coverageIds: [macos.system-run]
+            coverageIds: [macos-app.system-run]
             description: system.run, system.which, system.notify, exec approvals get/set
           - name: Exec approval policy
-            coverageIds: [macos.exec-approval-policy]
+            coverageIds: [macos-app.exec-approval-policy]
             description: Exec approval policy, app exec host, local socket, and event emission
           - name: Permission requests
-            coverageIds: [macos.permission-requests]
+            coverageIds: [macos-app.permission-requests]
             description: Permission requests, status polling, settings UI, and node permission advertisement
           - name: TCC persistence
-            coverageIds: [macos.tcc-persistence]
+            coverageIds: [macos-app.tcc-persistence]
             description: TCC persistence, signing requirements, and safe app-owned permission guidance
         docs:
           - docs/platforms/macos.md
@@ -4967,13 +5516,13 @@ surfaces:
         id: remote-connections
         features:
           - name: Remote connection mode selection
-            coverageIds: [macos.remote-connection-mode-selection]
+            coverageIds: [macos-app.remote-connection-mode-selection]
             description: Remote connection mode selection and configuration
           - name: SSH tunnel
-            coverageIds: [macos.ssh-tunnel]
+            coverageIds: [macos-app.ssh-tunnel]
             description: SSH tunnel and direct ws/wss Gateway transport
           - name: Gateway discovery
-            coverageIds: [gateway.discovery]
+            coverageIds: [macos-app.gateway-discovery]
             description: Gateway discovery, TLS pin repair, and remote node-service startup
         docs:
           - docs/platforms/mac/remote.md
@@ -4988,13 +5537,13 @@ surfaces:
         id: voice-and-talk
         features:
           - name: Voice Wake runtime
-            coverageIds: [macos.voice-wake-runtime]
+            coverageIds: [macos-app.voice-wake-runtime]
             description: Voice Wake runtime, trigger detection, permissions, overlay, chimes, and forwarding
           - name: Push-to-talk
-            coverageIds: [macos.push-to-talk]
+            coverageIds: [macos-app.push-to-talk]
             description: Push-to-talk and Talk Mode capture/listen/think/speak lifecycle
           - name: Talk provider playback plan
-            coverageIds: [macos.talk-provider-playback-plan]
+            coverageIds: [macos-app.talk-provider-playback-plan]
             description: Talk provider playback plan and Gateway talk status
         docs:
           - docs/platforms/mac/voicewake.md
@@ -5010,13 +5559,13 @@ surfaces:
         id: webchat
         features:
           - name: Native SwiftUI WebChat window
-            coverageIds: [macos.native-swiftui-webchat-window]
+            coverageIds: [macos-app.native-swiftui-webchat-window]
             description: Native SwiftUI WebChat window and menu panel
           - name: Gateway chat transport
-            coverageIds: [gateway.chat-transport]
+            coverageIds: [macos-app.gateway-chat-transport]
             description: Gateway chat transport, session/model/thinking controls, event mapping, and health
           - name: Local and remote data-plane reuse
-            coverageIds: [macos.local-and-remote-data-plane-reuse]
+            coverageIds: [macos-app.data-plane-reuse]
             description: Local and remote data-plane reuse across native WebChat sessions.
         docs:
           - docs/platforms/mac/webchat.md
@@ -5031,19 +5580,19 @@ surfaces:
         id: remote-webchat
         features:
           - name: macOS WebChat transport
-            coverageIds: [macos.webchat-transport]
+            coverageIds: [macos-app.macos-webchat-transport]
             description: Covers macOS WebChat transport across native macOS WebChat, Gateway connection reuse, native chat transport mapping, window/panel presentation, and related remote webchat client bridges behavior.
           - name: SSH tunnel data plane
-            coverageIds: [macos.ssh-tunnel-data-plane]
+            coverageIds: [macos-app.ssh-tunnel-data-plane]
             description: Covers SSH tunnel data plane across native macOS WebChat, Gateway connection reuse, native chat transport mapping, window/panel presentation, and related remote webchat client bridges behavior.
           - name: Direct ws/wss remote mode
-            coverageIds: [macos.direct-ws-wss-remote-mode]
+            coverageIds: [macos-app.direct-ws-wss-remote-mode]
             description: Covers Direct ws/wss remote mode across native macOS WebChat, Gateway connection reuse, native chat transport mapping, window/panel presentation, and related remote webchat client bridges behavior.
           - name: Session continuity
-            coverageIds: [memory.session-continuity]
+            coverageIds: [macos-app.session-continuity]
             description: Covers Session continuity across native macOS WebChat, Gateway connection reuse, native chat transport mapping, window/panel presentation, and related remote webchat client bridges behavior.
           - name: Remote troubleshooting
-            coverageIds: [macos.remote-troubleshooting]
+            coverageIds: [macos-app.remote-troubleshooting]
             description: Covers Remote troubleshooting across native macOS WebChat, Gateway connection reuse, native chat transport mapping, window/panel presentation, and related remote webchat client bridges behavior.
         docs:
           - docs/platforms/mac/webchat.md
@@ -5065,7 +5614,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: linux-gateway-host
+  - id: linux-host
     name: Linux Gateway host
     family: platform-app
     level: stable
@@ -5077,16 +5626,16 @@ surfaces:
         id: host-setup-and-updates
         features:
           - name: Linux CLI install
-            coverageIds: [linux.cli-install]
+            coverageIds: [linux-host.linux-cli-install]
             description: Linux CLI installation paths and operator verification after install.
           - name: Node runtime prerequisites
-            coverageIds: [linux.node-runtime-prerequisites]
+            coverageIds: [linux-host.node-runtime-prerequisites]
             description: Node runtime version requirements and host prerequisite checks for Linux Gateway operation.
           - name: Package-manager policy
-            coverageIds: [linux.package-manager-policy]
+            coverageIds: [linux-host.package-manager-policy]
             description: Supported package-manager and platform policy for Linux install and update paths.
           - name: Update path
-            coverageIds: [linux.update-path]
+            coverageIds: [linux-host.update-path]
             description: Linux update workflow, package or git handoff, and post-update verification.
         docs:
           - docs/install/index.md
@@ -5104,22 +5653,22 @@ surfaces:
         id: gateway-runtime-and-service-control
         features:
           - name: Foreground Gateway Runtime
-            coverageIds: [linux.foreground-gateway-runtime]
+            coverageIds: [linux-host.foreground-gateway-runtime]
             description: Covers Foreground Gateway Runtime user-facing controls, state display, navigation, and rendering behavior for Foreground Gateway Runtime and Process Control.
           - name: Process Control
-            coverageIds: [linux.process-control]
+            coverageIds: [linux-host.process-control]
             description: Covers Process Control user-facing controls, state display, navigation, and rendering behavior for Foreground Gateway Runtime and Process Control.
           - name: Systemd User Service Lifecycle setup
-            coverageIds: [linux.systemd-user-service-lifecycle-setup]
+            coverageIds: [linux-host.systemd-user-service-lifecycle-setup]
             description: Defines Systemd User Service Lifecycle setup setup, credential, configuration, and operator verification behavior for Systemd User Service Lifecycle.
           - name: Systemd User Service Lifecycle operation
-            coverageIds: [linux.systemd-user-service-lifecycle-operation]
+            coverageIds: [linux-host.systemd-user-service-lifecycle-operation]
             description: Defines Systemd User Service Lifecycle operation setup, credential, configuration, and operator verification behavior for Systemd User Service Lifecycle.
           - name: Systemd User Service Lifecycle status
-            coverageIds: [linux.systemd-user-service-lifecycle-status]
+            coverageIds: [linux-host.systemd-user-service-lifecycle-status]
             description: Defines Systemd User Service Lifecycle status setup, credential, configuration, and operator verification behavior for Systemd User Service Lifecycle.
           - name: Systemd User Service Lifecycle recovery
-            coverageIds: [linux.systemd-user-service-lifecycle-recovery]
+            coverageIds: [linux-host.systemd-user-service-lifecycle-recovery]
             description: Defines Systemd User Service Lifecycle recovery setup, credential, configuration, and operator verification behavior for Systemd User Service Lifecycle.
         docs:
           - docs/gateway/index.md
@@ -5143,22 +5692,22 @@ surfaces:
         id: remote-access-and-security
         features:
           - name: Remote Network Exposure
-            coverageIds: [linux.remote-network-exposure]
+            coverageIds: [linux-host.remote-network-exposure]
             description: Defines Remote Network Exposure authorization, trust, safety boundaries, and operator controls for Remote Network Exposure, Tls, and Tailscale.
           - name: TLS
-            coverageIds: [linux.tls]
+            coverageIds: [linux-host.tls]
             description: Defines TLS authorization, trust, safety boundaries, and operator controls for Remote Network Exposure, Tls, and Tailscale.
           - name: Tailscale
-            coverageIds: [linux.tailscale]
+            coverageIds: [linux-host.tailscale]
             description: Defines Tailscale authorization, trust, safety boundaries, and operator controls for Remote Network Exposure, Tls, and Tailscale.
           - name: Gateway exposure safeguards
-            coverageIds: [linux.gateway-exposure-safeguards]
+            coverageIds: [linux-host.gateway-exposure-safeguards]
             description: Defines exposure checks, unsafe-network warnings, and operator controls for Linux Gateway security boundaries.
           - name: Gateway authentication modes
-            coverageIds: [linux.gateway-authentication-modes]
+            coverageIds: [linux-host.gateway-authentication-modes]
             description: Defines token/password auth, shared-secret resolution, and operator verification for Linux Gateway authentication.
           - name: Secret Handling
-            coverageIds: [linux.secret-handling]
+            coverageIds: [linux-host.secret-handling]
             description: Defines Secret Handling setup, credential, configuration, and operator verification behavior for Security, Auth, and Secret Handling.
         docs:
           - docs/gateway/remote.md
@@ -5183,16 +5732,16 @@ surfaces:
         id: diagnostics-and-repair
         features:
           - name: Gateway diagnostic reports
-            coverageIds: [linux.gateway-diagnostic-reports]
+            coverageIds: [linux-host.gateway-diagnostic-reports]
             description: Covers Gateway status, diagnostic output, failure handling, and operator repair for diagnostics, logs, doctor, and repair workflows.
           - name: Gateway log tailing
-            coverageIds: [linux.gateway-log-tailing]
+            coverageIds: [linux-host.gateway-log-tailing]
             description: Covers log viewing, log tailing, local fallback behavior, and operator-visible Gateway log status.
           - name: Doctor checks
-            coverageIds: [telemetry.doctor-checks]
+            coverageIds: [linux-host.doctor-checks]
             description: Covers `openclaw doctor` checks, Gateway health probes, and operator diagnostics for Linux Gateway deployments.
           - name: Operator repair guidance
-            coverageIds: [linux.operator-repair-guidance]
+            coverageIds: [linux-host.operator-repair-guidance]
             description: Covers failure handling, repair guidance, and recovery steps for Linux Gateway diagnostics and doctor findings.
         docs:
           - docs/cli/status.md
@@ -5214,13 +5763,13 @@ surfaces:
         id: deployment-targets
         features:
           - name: VPS
-            coverageIds: [linux.vps]
+            coverageIds: [linux-host.vps]
             description: Defines VPS setup, credential, configuration, and operator verification behavior for Vps, Container, and Cloud Deployment Guidance.
           - name: Container
-            coverageIds: [linux.container]
+            coverageIds: [linux-host.container]
             description: Defines Container setup, credential, configuration, and operator verification behavior for Vps, Container, and Cloud Deployment Guidance.
           - name: Cloud Deployment Guidance
-            coverageIds: [linux.cloud-deployment-guidance]
+            coverageIds: [linux-host.cloud-deployment-guidance]
             description: Defines Cloud Deployment Guidance setup, credential, configuration, and operator verification behavior for Vps, Container, and Cloud Deployment Guidance.
         docs:
           - docs/vps.md
@@ -5243,7 +5792,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: linux-companion-app
+  - id: linux-app
     name: Linux companion app
     family: platform-app
     level: planned
@@ -5255,13 +5804,13 @@ surfaces:
         id: app-distribution
         features:
           - name: Native app package
-            coverageIds: [linux.native-app-package]
+            coverageIds: [linux-app.native-app-package]
             description: Native Linux companion-app package availability and installation path.
           - name: Distro package targets
-            coverageIds: [linux.distro-package-targets]
+            coverageIds: [linux-app.distro-package-targets]
             description: Distro package targets, desktop files, icons, autostart, and update metadata
           - name: Official release metadata
-            coverageIds: [linux.official-release-metadata]
+            coverageIds: [linux-app.official-release-metadata]
             description: Official release metadata for downstream consoles
         docs:
           - docs/platforms/linux.md
@@ -5277,16 +5826,16 @@ surfaces:
         id: gateway-connectivity
         features:
           - name: Local Gateway attach and status
-            coverageIds: [linux.local-gateway-attach-and-status]
+            coverageIds: [linux-app.local-gateway-attach-and-status]
             description: Local Gateway attach, start, and status behavior from a Linux app.
           - name: Gateway pairing and auth
-            coverageIds: [linux.gateway-pairing-and-auth]
+            coverageIds: [linux-app.gateway-pairing-and-auth]
             description: Gateway auth and device pairing from a native Linux client.
           - name: Remote mode
-            coverageIds: [linux.remote-mode]
+            coverageIds: [linux-app.remote-mode]
             description: Remote mode through direct URL, SSH tunnel, or Tailscale
           - name: Local and remote resource boundaries
-            coverageIds: [linux.local-and-remote-resource-boundaries]
+            coverageIds: [linux-app.local-and-remote-resource-boundaries]
             description: Local and remote resource boundaries for a Linux companion client.
         docs:
           - docs/platforms/linux.md
@@ -5304,13 +5853,13 @@ surfaces:
         id: chat-and-sessions
         features:
           - name: Native Linux chat window
-            coverageIds: [linux.native-linux-chat-window]
+            coverageIds: [linux-app.native-linux-chat-window]
             description: Native Linux chat window behavior, status, and operator-visible verification.
           - name: Transcript
-            coverageIds: [linux.transcript]
+            coverageIds: [linux-app.transcript]
             description: Transcript, composer, session picker, model picker, send/abort/follow-up controls
           - name: Gateway chat transport
-            coverageIds: [gateway.chat-transport]
+            coverageIds: [linux-app.gateway-chat-transport]
             description: Gateway WebSocket chat transport from a Linux desktop client.
         docs:
           - docs/platforms/linux.md
@@ -5326,31 +5875,31 @@ surfaces:
         id: desktop-capabilities
         features:
           - name: Linux desktop permissions
-            coverageIds: [linux.desktop-permissions]
+            coverageIds: [linux-app.linux-desktop-permissions]
             description: Linux desktop permissions for notifications, microphone, screen, camera, accessibility, portals, and desktop-environment APIs
           - name: Secret storage
-            coverageIds: [linux.secret-storage]
+            coverageIds: [linux-app.secret-storage]
             description: Secret storage for Gateway token, device identity, approval socket token, and app settings
           - name: Sandbox/package posture
-            coverageIds: [linux.sandbox-package-posture]
+            coverageIds: [linux-app.sandbox-package-posture]
             description: Sandbox/package posture for Flatpak/Snap/AppImage or system packages
           - name: Linux native node identity
-            coverageIds: [linux.native-node-identity]
+            coverageIds: [linux-app.linux-native-node-identity]
             description: Linux native node identity and capability advertisement
           - name: Host command execution
-            coverageIds: [tools.host-command-execution]
+            coverageIds: [linux-app.host-command-execution]
             description: Host command execution through system.run and related desktop tools.
           - name: Desktop tools
-            coverageIds: [linux.desktop-tools]
+            coverageIds: [linux-app.desktop-tools]
             description: Desktop tools such as screen, camera, notifications, Canvas, and local command execution
           - name: Linux native Talk
-            coverageIds: [linux.native-talk]
+            coverageIds: [linux-app.linux-native-talk]
             description: Linux native Talk, push-to-talk, voice wake, and transcription
           - name: Microphone capture
-            coverageIds: [linux.microphone-capture]
+            coverageIds: [linux-app.microphone-capture]
             description: Microphone capture, screen/camera capture, desktop context sensing, and local media attachment flows
           - name: Native media permissions
-            coverageIds: [linux.native-media-permissions]
+            coverageIds: [linux-app.native-media-permissions]
             description: Native media permissions and foreground/background behavior
         docs:
           - docs/platforms/linux.md
@@ -5375,25 +5924,25 @@ surfaces:
         id: status-and-diagnostics
         features:
           - name: Native Linux app readiness
-            coverageIds: [linux.native-linux-app-readiness]
+            coverageIds: [linux-app.native-linux-app-readiness]
             description: Native Linux app readiness states
           - name: Gateway health/status display
-            coverageIds: [linux.gateway-health-status-display]
+            coverageIds: [linux-app.gateway-health-status-display]
             description: Gateway health/status display behavior, status, and operator-visible verification.
           - name: Log/transcript opening
-            coverageIds: [linux.log-transcript-opening]
+            coverageIds: [linux-app.log-transcript-opening]
             description: Log/transcript opening and locality-aware resource handling
           - name: Doctor/repair affordances
-            coverageIds: [linux.doctor-repair-affordances]
+            coverageIds: [linux-app.doctor-repair-affordances]
             description: Doctor/repair affordances and systemd lifecycle diagnostics
           - name: Linux tray/status item
-            coverageIds: [linux.tray-status-item]
+            coverageIds: [linux-app.linux-tray-status-item]
             description: Linux tray/status item behavior, status, and operator-visible verification.
           - name: Runtime status row
-            coverageIds: [linux.runtime-status-row]
+            coverageIds: [linux-app.runtime-status-row]
             description: Runtime status row and native notifications
           - name: Desktop-environment integration
-            coverageIds: [linux.desktop-environment-integration]
+            coverageIds: [linux-app.desktop-environment-integration]
             description: Desktop-environment integration for GNOME/KDE/Wayland/X11 tray behavior
         docs:
           - docs/platforms/linux.md
@@ -5414,7 +5963,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: windows-via-wsl2
+  - id: wsl
     name: Windows via WSL2
     family: platform-app
     level: beta
@@ -5426,22 +5975,22 @@ surfaces:
         id: wsl-setup
         features:
           - name: WSL2 + Ubuntu installation
-            coverageIds: [wsl2.ubuntu-installation]
+            coverageIds: [wsl.wsl2-ubuntu-installation]
             description: WSL2 and Ubuntu installation requirements.
           - name: Node runtime
-            coverageIds: [wsl2.node-runtime]
+            coverageIds: [wsl.node-runtime]
             description: WAL-reset-safe Node runtime requirements inside WSL2.
           - name: Linux install flow inside WSL2
-            coverageIds: [wsl2.linux-install-flow-inside-wsl2]
+            coverageIds: [wsl.linux-install-flow-inside-wsl2]
             description: Linux install and getting-started flow run inside WSL2.
           - name: WSL2 runtime boundary
-            coverageIds: [wsl2.runtime-boundary]
+            coverageIds: [wsl.wsl2-runtime-boundary]
             description: WSL2 runtime boundary and its distinction from native Windows installs.
           - name: WSL2 network-family requirements
-            coverageIds: [wsl2.network-family-requirements]
+            coverageIds: [wsl.wsl2-network-family-requirements]
             description: WSL2-specific network-family requirements that affect Gateway startup.
           - name: Source install and build inside WSL2
-            coverageIds: [wsl2.source-install-and-build-inside-wsl2]
+            coverageIds: [wsl.source-install-and-build-inside-wsl2]
             description: Source install and build workflow inside the WSL2 distribution.
         docs:
           - docs/platforms/windows.md
@@ -5457,28 +6006,28 @@ surfaces:
         id: cli
         features:
           - name: WSL2 CLI entrypoints
-            coverageIds: [wsl2.cli-entrypoints]
+            coverageIds: [wsl.wsl2-cli-entrypoints]
             description: openclaw CLI install, version, onboard, doctor, status, and update commands run inside the WSL2 Linux environment.
           - name: openclaw onboard
-            coverageIds: [windows.openclaw-onboard]
+            coverageIds: [wsl.openclaw-onboard]
             description: openclaw onboard and non-interactive onboarding run inside the WSL2 Linux environment.
           - name: openclaw doctor status and logs
-            coverageIds: [wsl2.openclaw-doctor-status-and-logs]
+            coverageIds: [wsl.openclaw-doctor-status-and-logs]
             description: openclaw doctor, status, and logs provide WSL2-specific repair and diagnostic feedback.
           - name: openclaw update
-            coverageIds: [wsl2.openclaw-update]
+            coverageIds: [wsl.openclaw-update]
             description: openclaw update, channel switching, dry-run/status diagnostics
           - name: npm/pnpm/git package-root
-            coverageIds: [wsl2.npm-pnpm-git-package-root]
+            coverageIds: [wsl.npm-pnpm-git-package-root]
             description: npm/pnpm/git package-root and install-mode switching
           - name: Managed systemd Gateway restart
-            coverageIds: [wsl2.managed-systemd-gateway-restart]
+            coverageIds: [wsl.managed-systemd-gateway-restart]
             description: Managed systemd Gateway restart and update handoff
           - name: Service metadata refresh
-            coverageIds: [wsl2.service-metadata-refresh]
+            coverageIds: [wsl.service-metadata-refresh]
             description: Service metadata refresh after WSL2 Gateway updates.
           - name: Package-manager caveats
-            coverageIds: [wsl2.package-manager-caveats]
+            coverageIds: [wsl.package-manager-caveats]
             description: Package-manager caveats seen from WSL2 source and package installs.
         docs:
           - docs/platforms/windows.md
@@ -5503,34 +6052,34 @@ surfaces:
         id: gateway-service-lifecycle
         features:
           - name: Onboarded systemd install
-            coverageIds: [wsl2.onboarded-systemd-install]
+            coverageIds: [wsl.onboarded-systemd-install]
             description: openclaw onboard daemon installation inside WSL2.
           - name: Gateway service install
-            coverageIds: [wsl2.gateway-service-install]
+            coverageIds: [wsl.gateway-service-install]
             description: openclaw gateway install behavior under WSL2 systemd.
           - name: systemd user unit rendering
-            coverageIds: [wsl2.systemd-user-unit-rendering]
+            coverageIds: [wsl.systemd-user-unit-rendering]
             description: systemd user unit rendering and lifecycle metadata.
           - name: WSL-aware systemd unavailable hints
-            coverageIds: [wsl2.wsl-aware-systemd-unavailable-hints]
+            coverageIds: [wsl.wsl-aware-systemd-unavailable-hints]
             description: Operator hints when systemd is unavailable in the WSL distribution.
           - name: Doctor service repair
-            coverageIds: [wsl2.doctor-service-repair]
+            coverageIds: [wsl.doctor-service-repair]
             description: Doctor repair behavior for WSL2 Gateway services.
           - name: WSL user-service linger
-            coverageIds: [wsl2.wsl-user-service-linger]
+            coverageIds: [wsl.wsl-user-service-linger]
             description: WSL user-service linger behavior, status, and operator-visible verification.
           - name: Systemd availability after Windows boot
-            coverageIds: [wsl2.systemd-availability-after-windows-boot]
+            coverageIds: [wsl.systemd-availability-after-windows-boot]
             description: Systemd availability after Windows boot and WSL distribution startup.
           - name: Windows startup task for WSL
-            coverageIds: [wsl2.windows-startup-task-for-wsl]
+            coverageIds: [wsl.windows-startup-task-for-wsl]
             description: Windows startup task behavior for launching WSL before login.
           - name: Verification before Windows sign-in
-            coverageIds: [wsl2.verification-before-windows-sign-in]
+            coverageIds: [wsl.verification-before-windows-sign-in]
             description: Verification before Windows sign-in behavior, status, and operator-visible verification.
           - name: Clear expectations around PC power
-            coverageIds: [wsl2.clear-expectations-around-pc-power]
+            coverageIds: [wsl.clear-expectations-around-pc-power]
             description: Clear expectations around PC power, sleep, Windows boot, WSL boot, and Gateway uptime
         docs:
           - docs/platforms/windows.md
@@ -5549,37 +6098,37 @@ surfaces:
         id: gateway-access-and-exposure
         features:
           - name: Gateway token/password auth
-            coverageIds: [wsl2.gateway-token-password-auth]
+            coverageIds: [wsl.gateway-token-password-auth]
             description: Gateway token and password auth for clients running through WSL2.
           - name: Provider credentials
-            coverageIds: [security.provider-credentials]
+            coverageIds: [wsl.provider-credentials]
             description: Provider credential storage and lookup from inside the WSL2 environment.
           - name: Gateway auth SecretRefs
-            coverageIds: [wsl2.gateway-auth-secretrefs]
+            coverageIds: [wsl.gateway-auth-secretrefs]
             description: Gateway auth SecretRef handling for WSL2-hosted Gateway processes.
           - name: Remote URL credential precedence
-            coverageIds: [wsl2.remote-url-credential-precedence]
+            coverageIds: [wsl.remote-url-credential-precedence]
             description: Remote URL credential precedence when WSL2 clients connect to local or remote Gateways.
           - name: WSL virtual network
-            coverageIds: [wsl2.wsl-virtual-network]
+            coverageIds: [wsl.wsl-virtual-network]
             description: WSL virtual network behavior and host/guest addressing.
           - name: Windows portproxy setup
-            coverageIds: [wsl2.windows-portproxy-setup]
+            coverageIds: [wsl.windows-portproxy-setup]
             description: Windows netsh interface portproxy setup for exposing WSL services.
           - name: Windows Firewall rules
-            coverageIds: [wsl2.windows-firewall-rules]
+            coverageIds: [wsl.windows-firewall-rules]
             description: Windows Firewall rules for WSL Gateway access.
           - name: Reachable Gateway URLs
-            coverageIds: [wsl2.reachable-gateway-urls]
+            coverageIds: [wsl.reachable-gateway-urls]
             description: Gateway URLs that must be reachable from Windows, WSL2, and LAN clients.
           - name: Loopback and LAN exposure
-            coverageIds: [wsl2.loopback-and-lan-exposure]
+            coverageIds: [wsl.loopback-and-lan-exposure]
             description: Loopback versus LAN listen behavior for WSL2 Gateway exposure.
           - name: WSL2 IPv4 networking
-            coverageIds: [wsl2.ipv4-networking]
+            coverageIds: [wsl.wsl2-ipv4-networking]
             description: WSL2-specific IPv4 network-family behavior.
           - name: Tailscale remote access
-            coverageIds: [wsl2.tailscale-remote-access]
+            coverageIds: [wsl.tailscale-remote-access]
             description: Tailscale and remote access behavior where it intersects WSL2 networking.
         docs:
           - docs/gateway/authentication.md
@@ -5599,24 +6148,29 @@ surfaces:
       - name: Diagnostics and Repair
         id: diagnostics-and-repair
         features:
-          - name: openclaw doctor
-            coverageIds:
-              [runtime.codex-plugin.auth, runtime.codex-plugin.lifecycle, runtime.doctor-repair]
-            description: openclaw doctor and repair/migration for WSL2 Gateway
+          - name: "openclaw doctor — Codex plugin auth"
+            coverageIds: [wsl.openclaw-doctor-codex-plugin-auth]
+            description: "Exact coverage for codex plugin auth within openclaw doctor."
+          - name: "openclaw doctor — Codex plugin lifecycle"
+            coverageIds: [wsl.openclaw-doctor-codex-plugin-lifecycle]
+            description: "Exact coverage for codex plugin lifecycle within openclaw doctor."
+          - name: "openclaw doctor — Doctor repair"
+            coverageIds: [wsl.openclaw-doctor-doctor-repair]
+            description: "Exact coverage for doctor repair within openclaw doctor."
           - name: openclaw status
-            coverageIds: [windows.openclaw-status]
+            coverageIds: [wsl.openclaw-status]
             description: openclaw status, status --all, and Gateway service/runtime summary
           - name: openclaw logs
-            coverageIds: [telemetry.openclaw-logs]
+            coverageIds: [wsl.openclaw-logs]
             description: openclaw logs and Linux systemd journal fallback
           - name: SecretRef
-            coverageIds: [wsl2.secretref]
+            coverageIds: [wsl.secretref]
             description: SecretRef and auth diagnostics visible from status/doctor
           - name: WSL/systemd unavailable hints
-            coverageIds: [wsl2.wsl-systemd-unavailable-hints]
+            coverageIds: [wsl.wsl-systemd-unavailable-hints]
             description: WSL/systemd unavailable hints and linger checks
           - name: Operator repair guidance after WSL2 service
-            coverageIds: [wsl2.operator-repair-guidance-after-wsl2-service]
+            coverageIds: [wsl.operator-repair-guidance-after-wsl2-service]
             description: Operator repair guidance after WSL2 service, config, or Gateway failures
         docs:
           - docs/platforms/windows.md
@@ -5633,22 +6187,22 @@ surfaces:
         id: browser-and-control-ui
         features:
           - name: WSL2 Gateway with Windows browser
-            coverageIds: [wsl2.gateway-with-windows-browser]
+            coverageIds: [wsl.wsl2-gateway-with-windows-browser]
             description: WSL2 Gateway with Windows browser and Windows Chrome
           - name: Windows Control UI URL
-            coverageIds: [wsl2.windows-control-ui-url]
+            coverageIds: [wsl.windows-control-ui-url]
             description: Windows Control UI URL and origin guidance
           - name: Raw remote CDP to Windows Chrome
-            coverageIds: [wsl2.raw-remote-cdp-to-windows-chrome]
+            coverageIds: [wsl.raw-remote-cdp-to-windows-chrome]
             description: Raw remote CDP access from WSL2 to a Windows Chrome instance.
           - name: Host-local Chrome MCP
-            coverageIds: [wsl2.host-local-chrome-mcp]
+            coverageIds: [wsl.host-local-chrome-mcp]
             description: Host-local Chrome MCP and existing-session boundary
           - name: Browser profile cdpUrl
-            coverageIds: [wsl2.browser-profile-cdpurl]
+            coverageIds: [wsl.browser-profile-cdpurl]
             description: Browser profile cdpUrl and attachOnly config
           - name: Layered diagnostics
-            coverageIds: [wsl2.layered-diagnostics]
+            coverageIds: [wsl.layered-diagnostics]
             description: Layered diagnostics for auth/origin/CDP failures
         docs:
           - docs/tools/browser-wsl2-windows-remote-cdp-troubleshooting.md
@@ -5666,7 +6220,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: native-windows-cli-and-gateway
+  - id: windows
     name: Native Windows
     family: platform-app
     level: alpha
@@ -5690,7 +6244,7 @@ surfaces:
             coverageIds: [windows.packaged-cli-launcher]
             description: Packaged openclaw CLI launcher, version, and doctor entrypoints.
           - name: Windows command shims
-            coverageIds: [windows.command-shims]
+            coverageIds: [windows.windows-command-shims]
             description: Windows .cmd launcher, PATHEXT, and package-manager shim compatibility.
           - name: openclaw onboard
             coverageIds: [windows.openclaw-onboard]
@@ -5731,7 +6285,7 @@ surfaces:
             coverageIds: [windows.foreground-runtime-health-readiness]
             description: Foreground runtime health/readiness and local loopback Gateway targets
           - name: Windows-specific restart/signal
-            coverageIds: [windows.specific-restart-signal]
+            coverageIds: [windows.windows-specific-restart-signal]
             description: Windows-specific restart/signal and process-control behavior
           - name: Unmanaged foreground mode
             coverageIds: [windows.unmanaged-foreground-mode]
@@ -5752,7 +6306,7 @@ surfaces:
             coverageIds: [windows.openclaw-status]
             description: openclaw status, openclaw gateway status, gateway status --deep, and Windows repair guidance.
           - name: Windows service inspection
-            coverageIds: [windows.service-inspection]
+            coverageIds: [windows.windows-service-inspection]
             description: Windows service inspection, Task Scheduler runtime parsing, Startup-folder
           - name: Post-install diagnostics
             coverageIds: [windows.post-install-diagnostics]
@@ -5813,7 +6367,7 @@ surfaces:
             coverageIds: [windows.detached-update-handoff]
             description: Detached update handoff from a running Gateway.
           - name: Windows package locks
-            coverageIds: [windows.package-locks]
+            coverageIds: [windows.windows-package-locks]
             description: Windows package locks, EBUSY/EPERM behavior, staged swaps, child-window
         docs:
           - docs/install/updating.md
@@ -5830,7 +6384,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: native-windows-companion-app
+  - id: windows-app
     name: Native Windows companion app
     family: platform-app
     level: planned
@@ -5842,16 +6396,16 @@ surfaces:
         id: installation-and-updates
         features:
           - name: Official app download
-            coverageIds: [windows.official-app-download]
+            coverageIds: [windows-app.official-app-download]
             description: Official app download or installer path for the native Windows companion app.
           - name: MSI/MSIX/App Installer/winget-style packaging
-            coverageIds: [windows.msi-msix-app-installer-winget-style-packaging]
+            coverageIds: [windows-app.installer-packaging]
             description: MSI/MSIX/App Installer/winget-style packaging, signing, update, rollback, uninstall, and desktop entries
           - name: Windows architecture handling for x64
-            coverageIds: [windows.architecture-handling-for-x64]
+            coverageIds: [windows-app.windows-architecture-handling-for-x64]
             description: Windows architecture handling for x64 and ARM64
           - name: App release channel
-            coverageIds: [windows.app-release-channel]
+            coverageIds: [windows-app.app-release-channel]
             description: App release channel, architecture handling, and update availability.
         docs:
           - docs/platforms/windows.md
@@ -5867,13 +6421,13 @@ surfaces:
         id: gateway-connection
         features:
           - name: App-managed local Gateway attach/start
-            coverageIds: [windows.app-managed-local-gateway-attach-start]
+            coverageIds: [windows-app.local-gateway-start]
             description: App-managed local Gateway attach/start and status
           - name: Remote Gateway connection modes
-            coverageIds: [windows.remote-gateway-connection-modes]
+            coverageIds: [windows-app.remote-gateway-connection-modes]
             description: Remote Gateway connection modes, token/TLS handling, and reconnect
           - name: Device/node pairing
-            coverageIds: [windows.device-node-pairing]
+            coverageIds: [windows-app.device-node-pairing]
             description: Device/node pairing, pending approval UX, and pairing recovery
         docs:
           - docs/platforms/windows.md
@@ -5891,10 +6445,10 @@ surfaces:
         id: chat-sessions
         features:
           - name: Native Windows chat window
-            coverageIds: [windows.native-windows-chat-window]
+            coverageIds: [windows-app.native-windows-chat-window]
             description: Native Windows chat window, transcript, composer, session picker, model/thinking controls, abort/follow-up actions, reconnect handling, and tool rendering
           - name: Gateway chat transport
-            coverageIds: [gateway.chat-transport]
+            coverageIds: [windows-app.gateway-chat-transport]
             description: Gateway chat transport and session control from the native Windows app.
         docs:
           - docs/platforms/windows.md
@@ -5909,19 +6463,19 @@ surfaces:
         id: status-and-repair
         features:
           - name: App health states
-            coverageIds: [windows.app-health-states]
+            coverageIds: [windows-app.app-health-states]
             description: App health states, Gateway/node readiness, diagnostic panels, log opening, update status, repair actions, and support bundle behavior
           - name: App-specific repair
-            coverageIds: [windows.app-specific-repair]
+            coverageIds: [windows-app.app-specific-repair]
             description: App-specific repair for pairing, permissions, service lifecycle, stale versions, and protocol mismatch
           - name: Windows system tray app
-            coverageIds: [windows.system-tray-app]
+            coverageIds: [windows-app.windows-system-tray-app]
             description: Windows system tray app, status icon, status menu, native notifications, and app launch/quit controls
           - name: Status indicators
-            coverageIds: [windows.status-indicators]
+            coverageIds: [windows-app.status-indicators]
             description: Status indicators for Gateway, node pairing, work activity, and updates
           - name: App-specific notification permission
-            coverageIds: [windows.app-specific-notification-permission]
+            coverageIds: [windows-app.app-specific-notification-permission]
             description: App-specific notification permission and failure handling
         docs:
           - docs/platforms/windows.md
@@ -5939,34 +6493,34 @@ surfaces:
         id: desktop-tools-and-permissions
         features:
           - name: Windows node identity
-            coverageIds: [windows.node-identity]
+            coverageIds: [windows-app.windows-node-identity]
             description: Windows node identity and capability advertisement.
           - name: Host command execution
-            coverageIds: [tools.host-command-execution]
+            coverageIds: [windows-app.host-command-execution]
             description: Host command execution through system.run and related desktop tools.
           - name: Desktop command policy
-            coverageIds: [windows.desktop-command-policy]
+            coverageIds: [windows-app.desktop-command-policy]
             description: Desktop command allow/deny policy for native Windows tools.
           - name: App approval prompts
-            coverageIds: [windows.app-approval-prompts]
+            coverageIds: [windows-app.app-approval-prompts]
             description: App UI prompts for approval-sensitive desktop commands.
           - name: Screen and media capture
-            coverageIds: [windows.screen-and-media-capture]
+            coverageIds: [windows-app.screen-and-media-capture]
             description: Screen snapshot, recording, and native media capture affordances.
           - name: Canvas host behavior
-            coverageIds: [windows.canvas-host-behavior]
+            coverageIds: [windows-app.canvas-host-behavior]
             description: Canvas and A2UI host behavior in a native Windows companion app.
           - name: Windows shell integrations
-            coverageIds: [windows.shell-integrations]
+            coverageIds: [windows-app.windows-shell-integrations]
             description: Windows shell and PowerToys-style desktop integrations.
           - name: App secrets
-            coverageIds: [windows.app-secrets]
+            coverageIds: [windows-app.app-secrets]
             description: App secrets, token persistence, secure local IPC, app signing identity, AppContainer or desktop permission posture
           - name: Windows ACL
-            coverageIds: [windows.acl]
+            coverageIds: [windows-app.windows-acl]
             description: Windows ACL and filesystem hygiene for app-owned state
           - name: Command approval
-            coverageIds: [windows.command-approval]
+            coverageIds: [windows-app.command-approval]
             description: Command approval and dangerous capability gating as surfaced to users
         docs:
           - docs/platforms/windows.md
@@ -5989,7 +6543,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: android-app
+  - id: android
     name: Android app
     family: platform-app
     level: stable
@@ -6030,7 +6584,7 @@ surfaces:
         id: connection-setup
         features:
           - name: Gateway discovery
-            coverageIds: [gateway.discovery]
+            coverageIds: [android.gateway-discovery]
             description: Gateway discovery, setup-code and manual endpoint parsing, WS/WSS connection setup, TLS trust decisions, device identity, stored device tokens, node/operator auth, and connection error handling
         docs:
           - docs/platforms/android.md
@@ -6119,7 +6673,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: ios-app
+  - id: ios
     name: iOS app
     family: platform-app
     level: stable
@@ -6216,7 +6770,7 @@ surfaces:
         id: distribution
         features:
           - name: App distribution
-            coverageIds: [ios.internal-preview-status]
+            coverageIds: [ios.app-distribution]
             description: App Store distribution, source/Xcode manual deploy, local signing, XcodeGen project generation, Fastlane App Store archive/upload, versioning/changelog/metadata, release artifacts, and official-vs-local build flags
         docs:
           - docs/platforms/ios.md
@@ -6286,7 +6840,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: watchos-companion-surfaces
+  - id: watchos
     name: watchOS companion surfaces
     family: platform-app
     level: experimental
@@ -6298,7 +6852,7 @@ surfaces:
         id: delivery-and-recovery
         features:
           - name: APNs relay/direct registration as it affects
-            coverageIds: [watchos.apns-relay-direct-registration-as-it-affects]
+            coverageIds: [watchos.apns-registration]
             description: APNs relay/direct registration as it affects watch approval wake/recovery
           - name: Silent push
             coverageIds: [watchos.silent-push]
@@ -6366,7 +6920,7 @@ surfaces:
             coverageIds: [watchos.release-metadata]
             description: Release metadata and App Store preparation evidence
           - name: Historical bug/regression themes relevant to scoring
-            coverageIds: [watchos.historical-bug-regression-themes-relevant-to-scoring]
+            coverageIds: [watchos.regression-themes]
             description: Historical bug/regression themes relevant to scoring current source quality
         docs:
           - docs/platforms/ios.md
@@ -6387,7 +6941,7 @@ surfaces:
             coverageIds: [watchos.payload-normalization]
             description: Payload normalization for title/body, prompt/session metadata, priority, risk, and action buttons
           - name: Mirrored iOS notification fallback when watch
-            coverageIds: [watchos.mirrored-ios-notification-fallback-when-watch]
+            coverageIds: [watchos.mirrored-notification-fallback]
             description: Mirrored iOS notification fallback when watch delivery is queued
           - name: Watch action buttons from generic prompt
             coverageIds: [watchos.watch-action-buttons-from-generic-prompt]
@@ -6435,7 +6989,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: raspberry-pi-small-linux-devices
+  - id: small-linux
     name: Raspberry Pi and small Linux devices
     family: platform-app
     level: beta
@@ -6447,40 +7001,40 @@ surfaces:
         id: setup-and-compatibility
         features:
           - name: Hardware and 64-bit OS requirements
-            coverageIds: [raspberry-pi.hardware-and-64-bit-os-requirements]
+            coverageIds: [small-linux.64-bit-requirements]
             description: Defines Hardware and 64-bit OS requirements setup, credential, configuration, and operator verification behavior for ARM Linux Setup and Prerequisites.
           - name: Node runtime setup
-            coverageIds: [raspberry-pi.node-runtime-setup]
+            coverageIds: [small-linux.node-runtime-setup]
             description: Defines Node runtime setup setup, credential, configuration, and operator verification behavior for ARM Linux Setup and Prerequisites.
           - name: OpenClaw install and onboarding
-            coverageIds: [raspberry-pi.openclaw-install-and-onboarding]
+            coverageIds: [small-linux.openclaw-install-and-onboarding]
             description: Defines OpenClaw install and onboarding setup, credential, configuration, and operator verification behavior for ARM Linux Setup and Prerequisites.
           - name: First-run verification
-            coverageIds: [raspberry-pi.first-run-verification]
+            coverageIds: [small-linux.first-run-verification]
             description: Defines First-run verification setup, credential, configuration, and operator verification behavior for ARM Linux Setup and Prerequisites.
           - name: Supported Pi model selection
-            coverageIds: [raspberry-pi.supported-pi-model-selection]
+            coverageIds: [small-linux.supported-pi-model-selection]
             description: Defines Supported Pi model selection setup, credential, configuration, and operator verification behavior for Hardware Support Boundary.
           - name: 64-bit ARM boundary
-            coverageIds: [raspberry-pi.64-bit-arm-boundary]
+            coverageIds: [small-linux.64-bit-arm-boundary]
             description: Defines 64-bit ARM boundary setup, credential, configuration, and operator verification behavior for Hardware Support Boundary.
           - name: Unsupported device guidance
-            coverageIds: [raspberry-pi.unsupported-device-guidance]
+            coverageIds: [small-linux.unsupported-device-guidance]
             description: Defines Unsupported device guidance setup, credential, configuration, and operator verification behavior for Hardware Support Boundary.
           - name: Slow-device caveats
-            coverageIds: [raspberry-pi.slow-device-caveats]
+            coverageIds: [small-linux.slow-device-caveats]
             description: Defines Slow-device caveats setup, credential, configuration, and operator verification behavior for Hardware Support Boundary.
           - name: npm/pnpm/Bun install modes
-            coverageIds: [raspberry-pi.npm-pnpm-bun-install-modes]
+            coverageIds: [small-linux.npm-pnpm-bun-install-modes]
             description: Defines npm/pnpm/Bun install modes setup, credential, configuration, and operator verification behavior for Package Manager and ARM Binary Compatibility.
           - name: Installer architecture detection
-            coverageIds: [raspberry-pi.installer-architecture-detection]
+            coverageIds: [small-linux.installer-architecture-detection]
             description: Defines Installer architecture detection setup, credential, configuration, and operator verification behavior for Package Manager and ARM Binary Compatibility.
           - name: Optional ARM binary checks
-            coverageIds: [raspberry-pi.optional-arm-binary-checks]
+            coverageIds: [small-linux.optional-arm-binary-checks]
             description: Defines Optional ARM binary checks setup, credential, configuration, and operator verification behavior for Package Manager and ARM Binary Compatibility.
           - name: Fallback/build guidance
-            coverageIds: [raspberry-pi.fallback-build-guidance]
+            coverageIds: [small-linux.fallback-build-guidance]
             description: Defines Fallback/build guidance setup, credential, configuration, and operator verification behavior for Package Manager and ARM Binary Compatibility.
         docs:
           - docs/install/raspberry-pi.md
@@ -6512,31 +7066,31 @@ surfaces:
         id: remote-access-and-auth
         features:
           - name: Headless API-key auth
-            coverageIds: [raspberry-pi.headless-api-key-auth]
+            coverageIds: [small-linux.headless-api-key-auth]
             description: Defines Headless API-key auth context assembly, persistence, token-pressure handling, and recovery behavior for Gateway Auth, Device Pairing, and Secrets.
           - name: Gateway shared-secret auth
-            coverageIds: [raspberry-pi.gateway-shared-secret-auth]
+            coverageIds: [small-linux.gateway-shared-secret-auth]
             description: Defines Gateway shared-secret auth context assembly, persistence, token-pressure handling, and recovery behavior for Gateway Auth, Device Pairing, and Secrets.
           - name: Device pairing approvals
-            coverageIds: [raspberry-pi.device-pairing-approvals]
+            coverageIds: [small-linux.device-pairing-approvals]
             description: Defines Device pairing approvals context assembly, persistence, token-pressure handling, and recovery behavior for Gateway Auth, Device Pairing, and Secrets.
           - name: SecretRef handling
-            coverageIds: [raspberry-pi.secretref-handling]
+            coverageIds: [small-linux.secretref-handling]
             description: Defines SecretRef handling context assembly, persistence, token-pressure handling, and recovery behavior for Gateway Auth, Device Pairing, and Secrets.
           - name: Token drift recovery
-            coverageIds: [raspberry-pi.token-drift-recovery]
+            coverageIds: [small-linux.token-drift-recovery]
             description: Defines Token drift recovery context assembly, persistence, token-pressure handling, and recovery behavior for Gateway Auth, Device Pairing, and Secrets.
           - name: SSH tunnel dashboard access
-            coverageIds: [raspberry-pi.ssh-tunnel-dashboard-access]
+            coverageIds: [small-linux.ssh-tunnel-dashboard-access]
             description: Defines SSH tunnel dashboard access setup, credential, configuration, and operator verification behavior for Remote Access and Control UI.
           - name: Tailscale Serve/Funnel
-            coverageIds: [raspberry-pi.tailscale-serve-funnel]
+            coverageIds: [small-linux.tailscale-serve-funnel]
             description: Defines Tailscale Serve/Funnel setup, credential, configuration, and operator verification behavior for Remote Access and Control UI.
           - name: Loopback/non-loopback exposure controls
-            coverageIds: [raspberry-pi.loopback-non-loopback-exposure-controls]
+            coverageIds: [small-linux.loopback-non-loopback-exposure-controls]
             description: Defines Loopback/non-loopback exposure controls setup, credential, configuration, and operator verification behavior for Remote Access and Control UI.
           - name: Authenticated Control UI access
-            coverageIds: [raspberry-pi.authenticated-control-ui-access]
+            coverageIds: [small-linux.authenticated-control-ui-access]
             description: Defines Authenticated Control UI access setup, credential, configuration, and operator verification behavior for Remote Access and Control UI.
         docs:
           - docs/install/raspberry-pi.md
@@ -6566,34 +7120,34 @@ surfaces:
         id: gateway-runtime
         features:
           - name: Always-on Gateway process
-            coverageIds: [raspberry-pi.always-on-gateway-process]
+            coverageIds: [small-linux.always-on-gateway-process]
             description: Defines Always-on Gateway process setup, credential, configuration, and operator verification behavior for Headless Gateway and Model Setup.
           - name: Cloud model configuration
-            coverageIds: [raspberry-pi.cloud-model-configuration]
+            coverageIds: [small-linux.cloud-model-configuration]
             description: Defines Cloud model configuration setup, credential, configuration, and operator verification behavior for Headless Gateway and Model Setup.
           - name: Channel startup
-            coverageIds: [raspberry-pi.channel-startup]
+            coverageIds: [small-linux.channel-startup]
             description: Defines Channel startup setup, credential, configuration, and operator verification behavior for Headless Gateway and Model Setup.
           - name: Gateway health/status
-            coverageIds: [raspberry-pi.gateway-health-status]
+            coverageIds: [small-linux.gateway-health-status]
             description: Defines Gateway health/status setup, credential, configuration, and operator verification behavior for Headless Gateway and Model Setup.
           - name: User service install
-            coverageIds: [raspberry-pi.user-service-install]
+            coverageIds: [small-linux.user-service-install]
             description: Defines User service install setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
           - name: linger/boot persistence
-            coverageIds: [raspberry-pi.linger-boot-persistence]
+            coverageIds: [small-linux.linger-boot-persistence]
             description: Defines linger/boot persistence setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
           - name: Service drop-ins
-            coverageIds: [raspberry-pi.service-drop-ins]
+            coverageIds: [small-linux.service-drop-ins]
             description: Defines Service drop-ins setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
           - name: Restart tuning
-            coverageIds: [raspberry-pi.restart-tuning]
+            coverageIds: [small-linux.restart-tuning]
             description: Defines Restart tuning setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
           - name: Status/log inspection
-            coverageIds: [raspberry-pi.status-log-inspection]
+            coverageIds: [small-linux.status-log-inspection]
             description: Defines Status/log inspection setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
           - name: Backup/restore
-            coverageIds: [raspberry-pi.backup-restore]
+            coverageIds: [small-linux.backup-restore]
             description: Defines Backup/restore setup, credential, configuration, and operator verification behavior for systemd Service and Boot Persistence.
         docs:
           - docs/gateway/index.md
@@ -6622,19 +7176,19 @@ surfaces:
         id: performance-and-diagnostics
         features:
           - name: Swap and low-RAM tuning
-            coverageIds: [raspberry-pi.swap-and-low-ram-tuning]
+            coverageIds: [small-linux.swap-and-low-ram-tuning]
             description: Defines Swap and low-RAM tuning setup, credential, configuration, and operator verification behavior for Resource Tuning and Diagnostics.
           - name: USB SSD guidance
-            coverageIds: [raspberry-pi.usb-ssd-guidance]
+            coverageIds: [small-linux.usb-ssd-guidance]
             description: Defines USB SSD guidance setup, credential, configuration, and operator verification behavior for Resource Tuning and Diagnostics.
           - name: Compile cache/no-respawn settings
-            coverageIds: [raspberry-pi.compile-cache-no-respawn-settings]
+            coverageIds: [small-linux.compile-cache-no-respawn-settings]
             description: Defines Compile cache/no-respawn settings setup, credential, configuration, and operator verification behavior for Resource Tuning and Diagnostics.
           - name: OOM/performance troubleshooting
-            coverageIds: [raspberry-pi.oom-performance-troubleshooting]
+            coverageIds: [small-linux.oom-performance-troubleshooting]
             description: Defines OOM/performance troubleshooting setup, credential, configuration, and operator verification behavior for Resource Tuning and Diagnostics.
           - name: Diagnostics bundles
-            coverageIds: [raspberry-pi.diagnostics-bundles]
+            coverageIds: [small-linux.diagnostics-bundles]
             description: Defines Diagnostics bundles setup, credential, configuration, and operator verification behavior for Resource Tuning and Diagnostics.
         docs:
           - docs/install/raspberry-pi.md
@@ -6658,7 +7212,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: docker-podman-hosting
+  - id: containers
     name: Docker and Podman hosting
     family: platform-app
     level: beta
@@ -6670,22 +7224,22 @@ surfaces:
         id: container-setup
         features:
           - name: Local Image Setup Script
-            coverageIds: [docker.local-image-setup-script]
+            coverageIds: [containers.local-image-setup-script]
             description: Covers Local Image Setup Script across `./scripts/docker/setup.sh` local-image and GHCR-image setup. Docker Compose gateway and sidecar CLI shape. First-run onboarding, token handling, bind/origin defaults, and post-start channel setup commands. Docker-only first-run notes, and related docker install, compose, and first-run setup behavior.
           - name: Docker Compose gateway
-            coverageIds: [docker.compose-gateway]
+            coverageIds: [containers.docker-compose-gateway]
             description: Docker Compose gateway and sidecar CLI shape
           - name: First-run onboarding
-            coverageIds: [docker.first-run-onboarding]
+            coverageIds: [containers.first-run-onboarding]
             description: First-run onboarding, token handling, bind/origin defaults, and post-start channel setup commands
           - name: Docker-only first-run notes
-            coverageIds: [docker.only-first-run-notes]
+            coverageIds: [containers.docker-only-first-run-notes]
             description: Docker-only first-run notes, excluding Podman rootless setup and general Gateway protocol internals
           - name: Podman setup scripts and Quadlet template
-            coverageIds: [docker.setup-scripts-and-quadlet-template]
+            coverageIds: [containers.podman-setup-scripts-and-quadlet-template]
             description: Podman setup docs, scripts/podman/setup.sh, scripts/run-openclaw-podman.sh, and scripts/podman/openclaw.container.in
           - name: Rootless Podman image setup
-            coverageIds: [docker.rootless-podman-image-setup]
+            coverageIds: [containers.rootless-podman-image-setup]
             description: Rootless Podman image setup, launch, setup/onboarding, host CLI routing, Quadlet autostart, and owner/permission checks
         docs:
           - docs/install/docker.md
@@ -6701,37 +7255,37 @@ surfaces:
         id: container-operations
         features:
           - name: Host CLI routing into running Docker/Podman
-            coverageIds: [docker.host-cli-routing-into-running-docker-podman]
+            coverageIds: [containers.host-cli-routing]
             description: Host CLI routing into running Docker/Podman containers
           - name: Container Targeting
-            coverageIds: [docker.container-targeting]
+            coverageIds: [containers.container-targeting]
             description: Covers Container Targeting across Host CLI routing into running Docker/Podman containers. `--container` and `OPENCLAW_CONTAINER` behavior, env handling, ambiguous runtime detection, loopback proxy guard, and related host cli container targeting and update lifecycle behavior.
           - name: Container update/rebuild/restart guidance for Docker
-            coverageIds: [docker.container-update-rebuild-restart-guidance-for-docker]
+            coverageIds: [containers.docker-update-guidance]
             description: Container update/rebuild/restart guidance for Docker and Podman hosts
           - name: Docker Compose mounts and secrets
-            coverageIds: [docker.compose]
+            coverageIds: [containers.docker-compose-mounts-and-secrets]
             description: Docker Compose and Podman config/workspace/auth-profile secret mounts
           - name: Gateway token generation
-            coverageIds: [docker.gateway-token-generation]
+            coverageIds: [containers.gateway-token-generation]
             description: Gateway token generation, reuse, .env persistence, and Control UI allowed origins
           - name: Ownership
-            coverageIds: [docker.ownership]
+            coverageIds: [containers.ownership]
             description: Ownership, permissions, SELinux mount behavior, and state survival across container replacement
           - name: Docker Compose network access
-            coverageIds: [docker.compose-network-access]
+            coverageIds: [containers.docker-compose-network-access]
             description: Docker Compose and Podman port publishing, bind mode, host local provider access, Bonjour, Tailscale, and Control UI origins
           - name: Container health endpoints
-            coverageIds: [docker.container-health-endpoints]
+            coverageIds: [containers.container-health-endpoints]
             description: Container health endpoints, Dockerfile/Compose healthchecks, openclaw health, logs, and metrics/OTel docs
           - name: Provider/VPS Docker hosting docs
-            coverageIds: [docker.provider-vps-docker-hosting-docs]
+            coverageIds: [containers.provider-vps-docker-hosting-docs]
             description: Provider/VPS Docker hosting docs and operational runbooks
           - name: Docker VM persistence/update guidance
-            coverageIds: [docker.vm-persistence-update-guidance]
+            coverageIds: [containers.docker-vm-persistence-update-guidance]
             description: Docker VM persistence/update guidance, Hetzner/Hostinger/DigitalOcean adjacency, Kubernetes/container warnings, and secure exposure
           - name: Operator-facing update
-            coverageIds: [docker.operator-facing-update]
+            coverageIds: [containers.operator-facing-update]
             description: Operator-facing update, backup, persistence, low-memory, and troubleshooting guidance
         docs:
           - docs/install/podman.md
@@ -6754,19 +7308,25 @@ surfaces:
         id: image-release-and-validation
         features:
           - name: Root Dockerfile build stages
-            coverageIds: [docker.root-dockerfile-build-stages]
+            coverageIds: [containers.root-dockerfile-build-stages]
             description: Root Dockerfile build stages, runtime image contents, optional browser and Docker CLI build args
           - name: Docker release workflow
-            coverageIds: [docker.release-workflow]
+            coverageIds: [containers.docker-release-workflow]
             description: Docker release workflow for GHCR publishing, multi-arch tags, manifests, and attestation verification
           - name: Docker E2E package artifact generation
-            coverageIds: [docker.package-artifact-generation]
+            coverageIds: [containers.docker-e2e-package-artifact-generation]
             description: Docker E2E package artifact generation and shared build helpers
-          - name: Docker E2E plan/scheduler scripts
-            coverageIds: [docker.runtime-validation, harness.qa-lab, telemetry.prometheus]
-            description: Docker E2E plan/scheduler scripts, lane metadata, targeted grouping, package artifact generation, and GitHub hydration action
+          - name: "Docker E2E plan/scheduler scripts — Runtime validation"
+            coverageIds: [containers.e2e-plan-runtime-validation]
+            description: "Exact coverage for runtime validation within Docker E2E plan/scheduler scripts."
+          - name: "Docker E2E plan/scheduler scripts — QA lab"
+            coverageIds: [containers.e2e-plan-qa-lab]
+            description: "Exact coverage for qa lab within Docker E2E plan/scheduler scripts."
+          - name: "Docker E2E plan/scheduler scripts — Prometheus"
+            coverageIds: [containers.e2e-plan-prometheus]
+            description: "Exact coverage for prometheus within Docker E2E plan/scheduler scripts."
           - name: Release-path install
-            coverageIds: [docker.release-path-install]
+            coverageIds: [containers.release-path-install]
             description: Release-path install, update, upgrade survivor, live-provider, plugin, Open WebUI, and cleanup scenario planning
         docs:
           - docs/install/docker.md
@@ -6783,13 +7343,13 @@ surfaces:
         id: agent-sandbox-and-tooling
         features:
           - name: Docker gateway setup
-            coverageIds: [docker.gateway-setup]
+            coverageIds: [containers.docker-gateway-setup]
             description: Docker gateway setup with OPENCLAW_SANDBOX, Docker CLI build arg, socket mount, sandbox config writes, and rollback behavior
           - name: Docker-backed agent sandbox support
-            coverageIds: [docker.backed-agent-sandbox-support]
+            coverageIds: [containers.docker-backed-agent-sandbox-support]
             description: Docker-backed agent sandbox docs, source behavior, and tests that affect container-hosted Gateway operators.
           - name: Container image dependency baking
-            coverageIds: [docker.container-image-dependency-baking]
+            coverageIds: [containers.container-image-dependency-baking]
             description: Container image dependency baking for skills/plugins/tools
         docs:
           - docs/install/docker.md
@@ -6805,7 +7365,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: kubernetes-hosting
+  - id: kubernetes
     name: Kubernetes hosting
     family: platform-app
     level: alpha
@@ -6943,7 +7503,7 @@ surfaces:
       by: codex
       source_ref: openclaw@29dd7847fd
       process_version: 3
-  - id: nix-install-path
+  - id: nix
     name: Nix install path
     family: platform-app
     level: experimental
@@ -6955,10 +7515,10 @@ surfaces:
         id: install-handoff
         features:
           - name: Nix install overview
-            coverageIds: [nix.install-overview]
+            coverageIds: [nix.nix-install-overview]
             description: Covers Nix install overview across public Nix install page, install index discoverability, docs navigation, and the handoff to the first-party `nix-openclaw` Home Manager module. It excludes the actual external `openclaw/nix-openclaw` repository implementation, and related public nix docs and nix-openclaw handoff behavior.
           - name: nix-openclaw source-of-truth
-            coverageIds: [nix.openclaw-source-of-truth]
+            coverageIds: [nix.nix-openclaw-source-of-truth]
             description: Covers nix-openclaw source-of-truth across public Nix install page, install index discoverability, docs navigation, and the handoff to the first-party `nix-openclaw` Home Manager module. It excludes the actual external `openclaw/nix-openclaw` repository implementation, and related public nix docs and nix-openclaw handoff behavior.
           - name: Install discoverability
             coverageIds: [nix.install-discoverability]
@@ -6987,7 +7547,7 @@ surfaces:
             coverageIds: [nix.declarative-plugin-selection]
             description: Covers Declarative plugin selection across plugin install/update/uninstall/enable/disable behavior in Nix mode, `/nix/store` hardlink handling, manifest registry safety, and user-facing guidance for declarative plugin selection.
           - name: Nix-store plugin loading
-            coverageIds: [nix.store-plugin-loading]
+            coverageIds: [nix.nix-store-plugin-loading]
             description: Covers Nix-store plugin loading across plugin install/update/uninstall/enable/disable behavior in Nix mode, `/nix/store` hardlink handling, manifest registry safety, and user-facing guidance for declarative plugin selection.
           - name: Hardlink safety
             coverageIds: [nix.hardlink-safety]
@@ -7081,7 +7641,7 @@ surfaces:
         id: service-runtime-and-guards
         features:
           - name: Nix profile PATH discovery
-            coverageIds: [nix.profile-path-discovery]
+            coverageIds: [nix.nix-profile-path-discovery]
             description: Covers Nix profile PATH discovery across `NIX_PROFILES` handling, `~/.nix-profile/bin` fallback, launchd/systemd service PATH generation, and adjacent safe binary resolution rules.
           - name: Profile precedence
             coverageIds: [nix.profile-precedence]
@@ -7198,10 +7758,10 @@ surfaces:
             coverageIds: [discord.allowlist-inheritance]
             description: "Covers Allowlist inheritance across Discord direct-message `dmPolicy` modes: `pairing`, `allowlist`, `open`, and `disabled`. Canonical and legacy `allowFrom` resolution across top-level Discord config, and related dm pairing and sender authorization behavior."
           - name: Pairing-code approval
-            coverageIds: [security.pairing-code-approval]
+            coverageIds: [discord.pairing-code-approval]
             description: "Covers Pairing-code approval across Discord direct-message `dmPolicy` modes: `pairing`, `allowlist`, `open`, and `disabled`. Canonical and legacy `allowFrom` resolution across top-level Discord config, and related dm pairing and sender authorization behavior."
           - name: Sender authorization
-            coverageIds: [security.sender-authorization]
+            coverageIds: [discord.sender-authorization]
             description: "Covers Sender authorization across Discord direct-message `dmPolicy` modes: `pairing`, `allowlist`, `open`, and `disabled`. Canonical and legacy `allowFrom` resolution across top-level Discord config, and related dm pairing and sender authorization behavior."
           - name: Access-group authorization
             coverageIds: [discord.access-group-authorization]
@@ -7230,7 +7790,7 @@ surfaces:
             coverageIds: [discord.guild-and-channel-admission]
             description: Covers Guild and channel admission across Guild allowlist and `groupPolicy` admission for Discord guild channels and threads. `requireMention`, bot-loop prevention, command/mention bypasses, and unmentioned room-event history. Channel, and related guild channel routing and session isolation behavior.
           - name: Mention gating
-            coverageIds: [channels.mention-gating]
+            coverageIds: [discord.mention-gating]
             description: Covers Mention gating across Guild allowlist and `groupPolicy` admission for Discord guild channels and threads. `requireMention`, bot-loop prevention, command/mention bypasses, and unmentioned room-event history. Channel, and related guild channel routing and session isolation behavior.
           - name: Session key isolation
             coverageIds: [discord.session-key-isolation]
@@ -7288,7 +7848,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [discord.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs:
           - docs/channels/discord.md
@@ -7376,7 +7936,7 @@ surfaces:
             coverageIds: [telegram.botfather-token-creation]
             description: BotFather token creation and first gateway start
           - name: TELEGRAM_BOT_TOKEN
-            coverageIds: [telegram.bot-token]
+            coverageIds: [telegram.telegram-bot-token]
             description: TELEGRAM_BOT_TOKEN, botToken, tokenFile, and account-scoped token
           - name: Setup wizard credential capture
             coverageIds: [telegram.setup-wizard-credential-capture]
@@ -7420,10 +7980,10 @@ surfaces:
             coverageIds: [telegram.dmpolicy-modes]
             description: pairing, allowlist, open, and disabled
           - name: Pairing-code approval
-            coverageIds: [security.pairing-code-approval]
+            coverageIds: [telegram.pairing-code-approval]
             description: Pairing-code approval, first-owner bootstrap, and commands.ownerAllowFrom
           - name: Numeric Telegram user ID normalization with telegram
-            coverageIds: [telegram.numeric-telegram-user-id-normalization-with-telegram]
+            coverageIds: [telegram.numeric-user-id]
             description: "and tg: prefixes"
           - name: allowFrom
             coverageIds: [telegram.allowfrom]
@@ -7432,7 +7992,7 @@ surfaces:
             coverageIds: [telegram.unauthorized-dm]
             description: Unauthorized DM, group, command, callback, and reaction handling
           - name: Group allowlists
-            coverageIds: [security.group-allowlists]
+            coverageIds: [telegram.group-allowlists]
             description: Group allowlists, groupPolicy, groupAllowFrom, and mention gating
           - name: Supergroup negative chat IDs
             coverageIds: [telegram.supergroup-negative-chat-ids]
@@ -7444,7 +8004,7 @@ surfaces:
             coverageIds: [telegram.acp-topic-routing]
             description: ACP topic binding and /acp spawn --thread
           - name: Session key construction
-            coverageIds: [memory.session-key-construction]
+            coverageIds: [telegram.session-key-construction]
             description: Session key construction, conversation route matching, and reply target
         docs:
           - docs/channels/telegram.md
@@ -7463,7 +8023,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [telegram.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs:
           - docs/channels/telegram.md
@@ -7478,7 +8038,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [telegram.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs:
           - docs/channels/telegram.md
@@ -7498,7 +8058,7 @@ surfaces:
             coverageIds: [telegram.exec-approvals-in-dms]
             description: Exec approvals in DMs, channels, topics, or both; approver resolution; plugin
           - name: Message actions
-            coverageIds: [channels.message-actions]
+            coverageIds: [telegram.message-actions]
             description: send, poll, react, delete, edit, sticker, and sticker search actions.
           - name: Action capability discovery
             coverageIds: [telegram.action-capability-discovery]
@@ -7614,7 +8174,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Group allowlists
-            coverageIds: [security.group-allowlists]
+            coverageIds: [whatsapp.group-allowlists]
             description: Group allowlists, groupPolicy, exact group JIDs, requireMention, owner
           - name: Group session keys
             coverageIds: [whatsapp.group-session-keys]
@@ -7643,7 +8203,16 @@ surfaces:
             description: Inbound media download and placeholder construction, quoted media extraction, and file handoff.
           - name: Outbound image
             coverageIds: [whatsapp.outbound-image]
-            description: Outbound image, audio, video, document, and voice-note payload construction.
+            description: Outbound image payload construction and delivery.
+          - name: Outbound document
+            coverageIds: [whatsapp.outbound-document]
+            description: Outbound document payload construction and delivery, including filename preservation.
+          - name: Outbound audio and voice notes
+            coverageIds: [whatsapp.outbound-audio]
+            description: Outbound audio and voice-note payload construction and delivery.
+          - name: Outbound video
+            coverageIds: [whatsapp.outbound-video]
+            description: Outbound video payload construction and delivery.
         docs:
           - docs/channels/whatsapp.md
         search_anchors:
@@ -7688,7 +8257,7 @@ surfaces:
             coverageIds: [slack.app-install]
             description: Covers App Install across installing `@openclaw/slack`, creating the Slack app, choosing recommended/minimal manifests, bot/app/user/signing-secret credential handling, and related app install, auth, manifest, and scopes behavior.
           - name: Slack app credentials
-            coverageIds: [slack.app-credentials]
+            coverageIds: [slack.slack-app-credentials]
             description: Covers bot/app/user tokens, signing-secret handling, and Slack credential setup for app authentication.
           - name: Manifest
             coverageIds: [slack.manifest]
@@ -7700,10 +8269,10 @@ surfaces:
             coverageIds: [slack.channel-status-diagnostics]
             description: Covers `openclaw channels status --probe`, account snapshots, token source/status fields, capability and scope diagnostics, and Slack repair guidance.
           - name: Slack account status
-            coverageIds: [slack.account-status]
+            coverageIds: [slack.slack-account-status]
             description: Covers account snapshots, token source/status fields, capability summaries, and Slack status output.
           - name: Operator Repair
-            coverageIds: [codex.operator-repair]
+            coverageIds: [slack.operator-repair]
             description: Covers Operator Repair across `openclaw channels status --probe`, account snapshots, token source/status fields, capability and scope diagnostics, and related diagnostics, status, and operator repair behavior.
           - name: Socket
             coverageIds: [slack.socket]
@@ -7745,7 +8314,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: Access and Identity
-            coverageIds: [channels.access-and-identity]
+            coverageIds: [slack.access-and-identity]
             description: Evidence scope for Access and Identity.
         docs:
           - docs/channels/slack.md
@@ -7768,10 +8337,10 @@ surfaces:
             coverageIds: [slack.session-isolation]
             description: Covers Session Isolation across channel allowlists, `groupPolicy`, channel/user gates, mention and subteam mention behavior, and related channel/thread routing and session isolation behavior.
           - name: DM Pairing
-            coverageIds: [security.dm-pairing]
+            coverageIds: [slack.dm-pairing]
             description: Covers DM Pairing across Slack DM routing, `dmPolicy`, `allowFrom`, pairing approvals, group DMs/MPIMs, account-level allowlist inheritance, command authorization in DMs, and sender identity normalization.
           - name: Sender Authorization
-            coverageIds: [security.sender-authorization]
+            coverageIds: [slack.sender-authorization]
             description: Covers Sender Authorization across Slack DM routing, `dmPolicy`, `allowFrom`, pairing approvals, group DMs/MPIMs, account-level allowlist inheritance, command authorization in DMs, and sender identity normalization.
         docs:
           - docs/channels/slack.md
@@ -7793,7 +8362,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [slack.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs:
           - docs/channels/slack.md
@@ -7822,7 +8391,7 @@ surfaces:
             coverageIds: [slack.assistant-events]
             description: Covers Assistant Events across App Home publish/open behavior, Slack assistant thread started/context-changed events, block actions, modal submissions, and related interactive replies, app home, and assistant events behavior.
           - name: Native Approvals
-            coverageIds: [security.native-approvals]
+            coverageIds: [slack.native-approvals]
             description: Covers Native Approvals across Slack native exec and plugin approvals, Block Kit approval prompts, approval auth, approval routing, and related native approvals, actions, and security-sensitive ops behavior.
           - name: Actions
             coverageIds: [slack.actions]
@@ -7869,37 +8438,37 @@ surfaces:
         id: channel-setup-and-operations
         features:
           - name: Translate legacy config
-            coverageIds: [imessage.translate-legacy-config]
+            coverageIds: [imessage-bluebubbles.translate-legacy-config]
             description: Covers Translate legacy config across removal announcement, migration guide, config reference, old `channels.bluebubbles` key translation, group registry footgun, session caveats, attachment/action parity notes, and operator cutover checklist.
           - name: Cut over safely
-            coverageIds: [imessage.cut-over-safely]
+            coverageIds: [imessage-bluebubbles.cut-over-safely]
             description: Covers Cut over safely across removal announcement, migration guide, config reference, old `channels.bluebubbles` key translation, group registry footgun, session caveats, attachment/action parity notes, and operator cutover checklist.
           - name: Handle migration caveats
-            coverageIds: [imessage.handle-migration-caveats]
+            coverageIds: [imessage-bluebubbles.handle-migration-caveats]
             description: Covers Handle migration caveats across removal announcement, migration guide, config reference, old `channels.bluebubbles` key translation, group registry footgun, session caveats, attachment/action parity notes, and operator cutover checklist.
           - name: Run local imsg
-            coverageIds: [imessage.run-local-imsg]
+            coverageIds: [imessage-bluebubbles.run-local-imsg]
             description: Covers Run local imsg across local and remote `imsg rpc`, `cliPath`, `dbPath`, `remoteHost`, and related imsg transport, host requirements, and permissions behavior.
           - name: Run through SSH wrapper
-            coverageIds: [imessage.run-through-ssh-wrapper]
+            coverageIds: [imessage-bluebubbles.run-through-ssh-wrapper]
             description: Covers Run through SSH wrapper across local and remote `imsg rpc`, `cliPath`, `dbPath`, `remoteHost`, and related imsg transport, host requirements, and permissions behavior.
           - name: Grant macOS permissions
-            coverageIds: [imessage.grant-macos-permissions]
+            coverageIds: [imessage-bluebubbles.grant-macos-permissions]
             description: Covers Grant macOS permissions across local and remote `imsg rpc`, `cliPath`, `dbPath`, `remoteHost`, and related imsg transport, host requirements, and permissions behavior.
           - name: Probe runtime health
-            coverageIds: [imessage.probe-runtime-health]
+            coverageIds: [imessage-bluebubbles.probe-runtime-health]
             description: Covers Probe runtime health across local and remote `imsg rpc`, `cliPath`, `dbPath`, `remoteHost`, and related imsg transport, host requirements, and permissions behavior.
           - name: Account setup prompts
-            coverageIds: [imessage.account-setup-prompts]
+            coverageIds: [imessage-bluebubbles.account-setup-prompts]
             description: Covers setup prompts, policy writes, account merging, default account selection, and account configuration behavior for iMessage/BlueBubbles.
           - name: Account status checks
-            coverageIds: [imessage.account-status-checks]
+            coverageIds: [imessage-bluebubbles.account-status-checks]
             description: Covers account status output, setup state, account merging, and default account selection for iMessage/BlueBubbles.
           - name: Doctor repair checks
-            coverageIds: [imessage.doctor-repair-checks]
+            coverageIds: [imessage-bluebubbles.doctor-repair-checks]
             description: Covers doctor checks, setup repair prompts, and policy verification for iMessage/BlueBubbles account configuration.
           - name: Account Config
-            coverageIds: [imessage.account-config]
+            coverageIds: [imessage-bluebubbles.account-config]
             description: Covers Account Config across setup prompts, policy writes, account merging, default account selection, and related setup, status, doctor, and account config behavior.
         docs:
           - docs/announcements/bluebubbles-imessage.md
@@ -7927,22 +8496,22 @@ surfaces:
         id: access-and-identity
         features:
           - name: Authorize direct senders
-            coverageIds: [imessage.authorize-direct-senders]
+            coverageIds: [imessage-bluebubbles.authorize-direct-senders]
             description: Covers Authorize direct senders across `dmPolicy`, `allowFrom`, pairing, sender identity normalization, and related dm pairing, access, and session routing behavior.
           - name: Route direct conversations
-            coverageIds: [imessage.route-direct-conversations]
+            coverageIds: [imessage-bluebubbles.route-direct-conversations]
             description: Covers Route direct conversations across `dmPolicy`, `allowFrom`, pairing, sender identity normalization, and related dm pairing, access, and session routing behavior.
           - name: Bind ACP sessions
-            coverageIds: [imessage.bind-acp-sessions]
+            coverageIds: [imessage-bluebubbles.bind-acp-sessions]
             description: Covers Bind ACP sessions across `dmPolicy`, `allowFrom`, pairing, sender identity normalization, and related dm pairing, access, and session routing behavior.
           - name: Group Policy
-            coverageIds: [imessage.group-policy]
+            coverageIds: [imessage-bluebubbles.group-policy]
             description: Covers Group Policy across `groupPolicy`, `groupAllowFrom`, `groups`, wildcard registry entries, `requireMention`, mention patterns, per-group tools, per-group system prompts, group sessions, and warnings for allowlist misconfiguration.
           - name: Mentions
-            coverageIds: [imessage.mentions]
+            coverageIds: [imessage-bluebubbles.mentions]
             description: Covers Mentions across `groupPolicy`, `groupAllowFrom`, `groups`, wildcard registry entries, `requireMention`, mention patterns, per-group tools, per-group system prompts, group sessions, and warnings for allowlist misconfiguration.
           - name: System Prompts
-            coverageIds: [imessage.system-prompts]
+            coverageIds: [imessage-bluebubbles.system-prompts]
             description: Covers System Prompts across `groupPolicy`, `groupAllowFrom`, `groups`, wildcard registry entries, `requireMention`, mention patterns, per-group tools, per-group system prompts, group sessions, and warnings for allowlist misconfiguration.
         docs:
           - docs/channels/imessage.md
@@ -7963,16 +8532,16 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Watch live messages
-            coverageIds: [imessage.watch-live-messages]
+            coverageIds: [imessage-bluebubbles.watch-live-messages]
             description: Covers Watch live messages across inbound `watch.subscribe`, notification parsing, echo and self-chat guards, sent-message cache, same-sender DM coalescing, DM history, reaction event routing, catchup cursor/replay, and live cursor advancement.
           - name: Coalesce split-send DMs
-            coverageIds: [imessage.coalesce-split-send-dms]
+            coverageIds: [imessage-bluebubbles.coalesce-split-send-dms]
             description: Covers Coalesce split-send DMs across inbound `watch.subscribe`, notification parsing, echo and self-chat guards, sent-message cache, same-sender DM coalescing, DM history, reaction event routing, catchup cursor/replay, and live cursor advancement.
           - name: Replay missed messages
-            coverageIds: [imessage.replay-missed-messages]
+            coverageIds: [imessage-bluebubbles.replay-missed-messages]
             description: Covers Replay missed messages across inbound `watch.subscribe`, notification parsing, echo and self-chat guards, sent-message cache, same-sender DM coalescing, DM history, reaction event routing, catchup cursor/replay, and live cursor advancement.
           - name: Seed conversation history
-            coverageIds: [imessage.seed-conversation-history]
+            coverageIds: [imessage-bluebubbles.seed-conversation-history]
             description: Covers Seed conversation history across inbound `watch.subscribe`, notification parsing, echo and self-chat guards, sent-message cache, same-sender DM coalescing, DM history, reaction event routing, catchup cursor/replay, and live cursor advancement.
         docs:
           - docs/channels/imessage.md
@@ -7987,25 +8556,25 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media
-            coverageIds: [imessage.media]
+            coverageIds: [imessage-bluebubbles.media]
             description: Covers Media across `includeAttachments`, attachment root allowlists, remote attachment roots, `remoteHost` SCP fetches, HEIC conversion, size caps, outbound media sends, `send-attachment`, text chunking, and media receipts.
           - name: Attachments
-            coverageIds: [ui.attachments]
+            coverageIds: [imessage-bluebubbles.attachments]
             description: Covers Attachments across `includeAttachments`, attachment root allowlists, remote attachment roots, `remoteHost` SCP fetches, HEIC conversion, size caps, outbound media sends, `send-attachment`, text chunking, and media receipts.
           - name: Remote Fetch
-            coverageIds: [imessage.remote-fetch]
+            coverageIds: [imessage-bluebubbles.remote-fetch]
             description: Covers Remote Fetch across `includeAttachments`, attachment root allowlists, remote attachment roots, `remoteHost` SCP fetches, HEIC conversion, size caps, outbound media sends, `send-attachment`, text chunking, and media receipts.
           - name: Chunking
-            coverageIds: [imessage.chunking]
+            coverageIds: [imessage-bluebubbles.chunking]
             description: Covers Chunking across `includeAttachments`, attachment root allowlists, remote attachment roots, `remoteHost` SCP fetches, HEIC conversion, size caps, outbound media sends, `send-attachment`, text chunking, and media receipts.
           - name: Native Actions
-            coverageIds: [imessage.native-actions]
+            coverageIds: [imessage-bluebubbles.native-actions]
             description: Covers Native Actions across private API probing, action availability, action config gates, tapback mapping, edit/unsend/reply/effects/group management, `send-rich --file`, message-tool visibility/target grammar, and action dispatch errors.
           - name: Private API
-            coverageIds: [imessage.private-api]
+            coverageIds: [imessage-bluebubbles.private-api]
             description: Covers Private API across private API probing, action availability, action config gates, tapback mapping, edit/unsend/reply/effects/group management, `send-rich --file`, message-tool visibility/target grammar, and action dispatch errors.
           - name: Message Tool
-            coverageIds: [imessage.message-tool]
+            coverageIds: [imessage-bluebubbles.message-tool]
             description: Covers Message Tool across private API probing, action availability, action config gates, tapback mapping, edit/unsend/reply/effects/group management, `send-rich --file`, message-tool visibility/target grammar, and action dispatch errors.
         docs:
           - docs/channels/imessage.md
@@ -8029,13 +8598,13 @@ surfaces:
         id: native-controls-and-approvals
         features:
           - name: Native Approvals
-            coverageIds: [security.native-approvals]
+            coverageIds: [imessage-bluebubbles.native-approvals]
             description: Covers Native Approvals across native approval delivery, exec/plugin approval routing, reaction-based approval decisions, `/approve` authorization changes, and related native approvals, reactions, and operator control behavior.
           - name: Reactions
-            coverageIds: [imessage.reactions]
+            coverageIds: [imessage-bluebubbles.reactions]
             description: Covers Reactions across native approval delivery, exec/plugin approval routing, reaction-based approval decisions, `/approve` authorization changes, and related native approvals, reactions, and operator control behavior.
           - name: Operator Control
-            coverageIds: [imessage.operator-control]
+            coverageIds: [imessage-bluebubbles.operator-control]
             description: Covers Operator Control across native approval delivery, exec/plugin approval routing, reaction-based approval decisions, `/approve` authorization changes, and related native approvals, reactions, and operator control behavior.
         docs:
           - docs/channels/imessage.md
@@ -8107,7 +8676,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: DM pairing
-            coverageIds: [security.dm-pairing]
+            coverageIds: [signal.dm-pairing]
             description: Defines DM pairing setup, credential, configuration, and operator verification behavior for DM Pairing and Access Control.
           - name: DM allowlists
             coverageIds: [signal.dm-allowlists]
@@ -8116,10 +8685,10 @@ surfaces:
             coverageIds: [signal.sender-identity-normalization]
             description: Defines Sender identity normalization setup, credential, configuration, and operator verification behavior for DM Pairing and Access Control.
           - name: Group allowlists
-            coverageIds: [security.group-allowlists]
+            coverageIds: [signal.group-allowlists]
             description: Defines Group allowlists authorization, trust, safety boundaries, and operator controls for Group Routing, Mentions, and Pending History.
           - name: Mention gates
-            coverageIds: [matrix.mention-gates]
+            coverageIds: [signal.mention-gates]
             description: Defines Mention gates authorization, trust, safety boundaries, and operator controls for Group Routing, Mentions, and Pending History.
           - name: Pending group history
             coverageIds: [signal.pending-group-history]
@@ -8144,7 +8713,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [signal.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs:
           - docs/channels/signal.md
@@ -8327,7 +8896,7 @@ surfaces:
             coverageIds: [google-chat.sender-allowlists]
             description: Covers Sender allowlists across Google Chat DMs, `dm.policy`, `dm.allowFrom`, pairing challenges, and related dm pairing and sender authorization behavior.
           - name: Google Chat identity matching
-            coverageIds: [google-chat.identity-matching]
+            coverageIds: [google-chat.google-chat-identity-matching]
             description: Covers Google Chat identity matching across Google Chat DMs, `dm.policy`, `dm.allowFrom`, pairing challenges, and related dm pairing and sender authorization behavior.
           - name: Direct session routing
             coverageIds: [google-chat.direct-session-routing]
@@ -8339,7 +8908,7 @@ surfaces:
             coverageIds: [google-chat.space-allowlists]
             description: Covers Space allowlists across Google Chat spaces and group messages, `groupPolicy`, `groups`, wildcard groups, and related space routing mentions and session isolation behavior.
           - name: Mention gating
-            coverageIds: [channels.mention-gating]
+            coverageIds: [google-chat.mention-gating]
             description: Covers Mention gating across Google Chat spaces and group messages, `groupPolicy`, `groups`, wildcard groups, and related space routing mentions and session isolation behavior.
           - name: Sender access groups
             coverageIds: [google-chat.sender-access-groups]
@@ -8348,7 +8917,7 @@ surfaces:
             coverageIds: [google-chat.group-session-isolation]
             description: Covers Group session isolation across Google Chat spaces and group messages, `groupPolicy`, `groups`, wildcard groups, and related space routing mentions and session isolation behavior.
           - name: Bot-loop protection
-            coverageIds: [channels.bot-loop-protection]
+            coverageIds: [google-chat.bot-loop-protection]
             description: Covers Bot-loop protection across Google Chat spaces and group messages, `groupPolicy`, `groups`, wildcard groups, and related space routing mentions and session isolation behavior.
           - name: Space diagnostics
             coverageIds: [google-chat.space-diagnostics]
@@ -8381,7 +8950,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [google-chat.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs:
           - docs/channels/googlechat.md
@@ -8397,7 +8966,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [google-chat.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs:
           - docs/channels/googlechat.md
@@ -8509,7 +9078,7 @@ surfaces:
         id: channel-setup-and-operations
         features:
           - name: Matrix plugin identity
-            coverageIds: [matrix.plugin-identity]
+            coverageIds: [matrix.matrix-plugin-identity]
             description: Matrix plugin identity, install metadata, runtime/setup entries, and account configuration.
           - name: Setup wizard
             coverageIds: [matrix.setup-wizard]
@@ -8518,10 +9087,10 @@ surfaces:
             coverageIds: [matrix.account-discovery]
             description: Account discovery, default account rules, env-backed accounts, and stored account metadata.
           - name: Matrix doctor warnings
-            coverageIds: [matrix.doctor-warnings]
+            coverageIds: [matrix.matrix-doctor-warnings]
             description: Matrix doctor warnings, config normalization, and stale plugin config cleanup.
           - name: Matrix probe/status
-            coverageIds: [matrix.probe-status]
+            coverageIds: [matrix.matrix-probe-status]
             description: Matrix probe/status, live directory lookup, CLI diagnostics, and QA runtime status.
         docs:
           - docs/channels/matrix.md
@@ -8543,13 +9112,13 @@ surfaces:
             coverageIds: [matrix.direct-room-classification]
             description: Direct-room classification and repair-adjacent routing decisions
           - name: Inbound route selection across sender-bound DMs
-            coverageIds: [matrix.inbound-route-selection-across-sender-bound-dms]
+            coverageIds: [matrix.sender-bound-dm-routing]
             description: Inbound route selection across sender-bound DMs, room bindings, and account-scoped routes.
           - name: Mention gates
             coverageIds: [matrix.mention-gates]
             description: Mention gates, slash command access checks, bot-loop suppression, and context admission.
           - name: Matrix thread reply routing
-            coverageIds: [matrix.thread-reply-routing]
+            coverageIds: [matrix.matrix-thread-reply-routing]
             description: Matrix thread reply routing, thread root/context extraction, and thread-aware session placement.
           - name: Persisted Matrix thread routing managers
             coverageIds: [matrix.persisted-matrix-thread-routing-managers]
@@ -8572,7 +9141,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [matrix.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs:
           - docs/channels/matrix.md
@@ -8585,7 +9154,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [matrix.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs:
           - docs/channels/matrix.md
@@ -8717,7 +9286,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: DM pairing
-            coverageIds: [security.dm-pairing]
+            coverageIds: [microsoft-teams.dm-pairing]
             description: Covers DM pairing across DM pairing, `dmPolicy`, `allowFrom`, AAD ID matching, and related dm pairing and sender access behavior.
           - name: Stable sender identity
             coverageIds: [microsoft-teams.stable-sender-identity]
@@ -8773,7 +9342,7 @@ surfaces:
             coverageIds: [microsoft-teams.mention-gated-group-access]
             description: Covers `groupPolicy`, `groupAllowFrom`, `requireMention`, and mention-gated group or channel replies.
           - name: Session routing
-            coverageIds: [memory.session-routing]
+            coverageIds: [microsoft-teams.session-routing]
             description: Covers deterministic reply routing, session keys, channel bindings, and conversation isolation for Microsoft Teams rooms and channels.
           - name: Reply and thread context
             coverageIds: [microsoft-teams.reply-and-thread-context]
@@ -8799,7 +9368,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Inbound attachments
-            coverageIds: [google-chat.inbound-attachments]
+            coverageIds: [microsoft-teams.inbound-attachments]
             description: Covers Inbound attachments across inbound attachments, inline images, `msteams://media` placeholders, Graph hosted content, and related media and file sharing behavior.
           - name: Graph-hosted media
             coverageIds: [microsoft-teams.graph-hosted-media]
@@ -8858,7 +9427,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: mattermost-line-irc-nextcloud-talk-nostr-twitch-tlon-synology-chat
+  - id: community-channels
     name: Mattermost, LINE, IRC, Nextcloud Talk, Nostr, Twitch, Tlon, Synology Chat
     family: channel
     level: alpha
@@ -8870,7 +9439,7 @@ surfaces:
         id: channel-setup-and-operations
         features:
           - name: Channel Setup and Operations
-            coverageIds: [channels.setup-operations]
+            coverageIds: [community-channels.channel-setup-and-operations]
             description: Evidence scope for Channel Setup and Operations.
         docs: []
         search_anchors:
@@ -8882,7 +9451,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: Access and Identity
-            coverageIds: [channels.access-and-identity]
+            coverageIds: [community-channels.access-and-identity]
             description: Evidence scope for Access and Identity.
         docs: []
         search_anchors:
@@ -8894,7 +9463,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [community-channels.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs: []
         search_anchors:
@@ -8906,7 +9475,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [community-channels.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs: []
         search_anchors:
@@ -8920,7 +9489,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: feishu-qq-bot-wechat-yuanbao-zalo-zalo-personal-regional-channels
+  - id: regional-channels
     name: Feishu, QQ Bot, WeChat, Yuanbao, Zalo, Zalo Personal, regional channels
     family: channel
     level: alpha
@@ -8947,7 +9516,7 @@ surfaces:
             coverageIds: [regional-channels.missing-plugin]
             description: Missing-plugin, stale-plugin, raw package-manager upgrade, and doctor/repair paths
           - name: Cross-channel ingress/access/refactor concerns
-            coverageIds: [regional-channels.cross-channel-ingress-access-refactor-concerns]
+            coverageIds: [regional-channels.cross-channel-ingress]
             description: Cross-channel ingress/access/refactor concerns for regional plugins
         docs:
           - docs/channels/index.md
@@ -8963,7 +9532,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: Access and Identity
-            coverageIds: [channels.access-and-identity]
+            coverageIds: [regional-channels.access-and-identity]
             description: Evidence scope for Access and Identity.
         docs: []
         search_anchors:
@@ -8975,7 +9544,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Conversation Routing and Delivery
-            coverageIds: [channels.conversation-routing-delivery]
+            coverageIds: [regional-channels.conversation-routing-and-delivery]
             description: Evidence scope for Conversation Routing and Delivery.
         docs: []
         search_anchors:
@@ -8987,7 +9556,7 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Media and Rich Content
-            coverageIds: [channels.media-rich-content]
+            coverageIds: [regional-channels.media-and-rich-content]
             description: Evidence scope for Media and Rich Content.
         docs: []
         search_anchors:
@@ -9001,7 +9570,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: voice-call-channel
+  - id: voice-call
     name: Voice Call channel
     family: channel
     level: experimental
@@ -9016,7 +9585,7 @@ surfaces:
             coverageIds: [voice-call.cli-rpc-agent-tool]
             description: CLI, Gateway RPC, and agent tool
           - name: Voice call setup smoke
-            coverageIds: [voice-call.setup-smoke]
+            coverageIds: [voice-call.voice-call-setup-smoke]
             description: Setup, Configuration, and Smoke
         docs:
           - docs/cli/voicecall.md
@@ -9031,7 +9600,7 @@ surfaces:
         id: access-and-identity
         features:
           - name: Voice call webhook security
-            coverageIds: [voice-call.webhook-security]
+            coverageIds: [voice-call.voice-call-webhook-security]
             description: Webhook Exposure and Security
         docs:
           - docs/plugins/voice-call.md
@@ -9044,7 +9613,7 @@ surfaces:
         id: conversation-routing-and-delivery
         features:
           - name: Voice call inbound routing
-            coverageIds: [voice-call.inbound-routing]
+            coverageIds: [voice-call.voice-call-inbound-routing]
             description: Inbound Routing, Sessions, and Lifecycle
         docs:
           - docs/plugins/voice-call.md
@@ -9056,10 +9625,10 @@ surfaces:
         id: media-and-rich-content
         features:
           - name: Voice call provider transports
-            coverageIds: [voice-call.provider-transports]
+            coverageIds: [voice-call.voice-call-provider-transports]
             description: Provider Transports and Call Control
           - name: Voice call telephony audio
-            coverageIds: [voice-call.telephony-audio]
+            coverageIds: [voice-call.voice-call-telephony-audio]
             description: Telephony TTS, playback, DTMF, and audio
         docs:
           - docs/plugins/voice-call.md
@@ -9073,10 +9642,10 @@ surfaces:
         id: realtime-voice-and-calls
         features:
           - name: Voice call realtime consult
-            coverageIds: [voice-call.realtime-consult]
+            coverageIds: [voice-call.voice-call-realtime-consult]
             description: Realtime Voice and Agent Consult
           - name: Voice call streaming transcription
-            coverageIds: [voice-call.streaming-transcription]
+            coverageIds: [voice-call.voice-call-streaming-transcription]
             description: Streaming Transcription and Auto-response
         docs:
           - docs/plugins/voice-call.md
@@ -9091,7 +9660,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: openai-codex-provider-path
+  - id: openai
     name: OpenAI and Codex provider path
     family: provider-tool
     level: beta
@@ -9102,24 +9671,32 @@ surfaces:
       - name: Model and Auth
         id: model-and-auth
         features:
-          - name: Canonical OpenAI Model Routing
-            coverageIds: [models.openai, tools.web-search]
-            description: "Covers Canonical OpenAI Model Routing across user/operator-facing model route contract: canonical `openai/gpt-*` refs, legacy `openai-codex/*` model refs, model catalog rows, context limits, and related canonical openai model routing and catalog behavior."
+          - name: "Canonical OpenAI Model Routing — Openai"
+            coverageIds: [openai.canonical-openai-model-routing-openai]
+            description: "Exact coverage for openai within Canonical OpenAI Model Routing."
+          - name: "Canonical OpenAI Model Routing — Web search"
+            coverageIds: [openai.canonical-openai-model-routing-web-search]
+            description: "Exact coverage for web search within Canonical OpenAI Model Routing."
           - name: Catalog
-            coverageIds: [codex.catalog]
+            coverageIds: [openai.catalog]
             description: "Covers Catalog across user/operator-facing model route contract: canonical `openai/gpt-*` refs, legacy `openai-codex/*` model refs, model catalog rows, context limits, and related canonical openai model routing and catalog behavior."
-          - name: Codex OAuth Profiles
-            coverageIds:
-              [auth-profiles.provider-selection, runtime.codex-plugin.auth, runtime.doctor-repair]
-            description: Covers Codex OAuth Profiles across `openai-codex` auth profiles, profile ordering, profile metadata repair, token refresh, account-id propagation, usage/cooldown handling, and auth selection for Codex-backed OpenAI agent turns.
+          - name: "Codex OAuth Profiles — Provider selection"
+            coverageIds: [openai.codex-oauth-profiles-provider-selection]
+            description: "Exact coverage for provider selection within Codex OAuth Profiles."
+          - name: "Codex OAuth Profiles — Codex plugin auth"
+            coverageIds: [openai.codex-oauth-profiles-codex-plugin-auth]
+            description: "Exact coverage for codex plugin auth within Codex OAuth Profiles."
+          - name: "Codex OAuth Profiles — Doctor repair"
+            coverageIds: [openai.codex-oauth-profiles-doctor-repair]
+            description: "Exact coverage for doctor repair within Codex OAuth Profiles."
           - name: Subscription Usage
-            coverageIds: [codex.subscription-usage]
+            coverageIds: [openai.subscription-usage]
             description: Covers Subscription Usage across `openai-codex` auth profiles, profile ordering, profile metadata repair, token refresh, account-id propagation, usage/cooldown handling, and auth selection for Codex-backed OpenAI agent turns.
           - name: Doctor Diagnostics
-            coverageIds: [runtime.codex-plugin.version]
+            coverageIds: [openai.doctor-diagnostics]
             description: "Covers Doctor Diagnostics across operator-facing repair and diagnosis for OpenAI/Codex provider path problems: stale route migration, persisted session pins, runtime pins, auth-profile sidecars, profile metadata, status/probe output, and recovery commands."
           - name: Operator Repair
-            coverageIds: [codex.operator-repair]
+            coverageIds: [openai.operator-repair]
             description: "Covers Operator Repair across operator-facing repair and diagnosis for OpenAI/Codex provider path problems: stale route migration, persisted session pins, runtime pins, auth-profile sidecars, profile metadata, status/probe output, and recovery commands."
         docs:
           - docs/providers/openai.md
@@ -9147,16 +9724,22 @@ surfaces:
         id: responses-and-tool-compatibility
         features:
           - name: Codex Responses Transport
-            coverageIds: [codex.responses-transport]
+            coverageIds: [openai.codex-responses-transport]
             description: Covers Codex Responses Transport across low-level provider request/streaming path for `openai-codex-responses` and the shared OpenAI Responses conversion code used by direct OpenAI and Codex-auth compatibility routes.
-          - name: Payload Compatibility
-            coverageIds: [runtime.prompt-compatibility, tools.fs.read]
-            description: Covers Payload Compatibility across low-level provider request/streaming path for `openai-codex-responses` and the shared OpenAI Responses conversion code used by direct OpenAI and Codex-auth compatibility routes.
-          - name: Tool Context
-            coverageIds: [runtime.codex-native-workspace.read, tools.fs.read]
-            description: Covers Tool Context across provider-facing tools, context injection, media inputs, native-vs-client tool ownership, OpenAI Responses compatibility, and how OpenAI/Codex models receive OpenClaw runtime context.
+          - name: "Payload Compatibility — Prompt compatibility"
+            coverageIds: [openai.payload-compatibility-prompt-compatibility]
+            description: "Exact coverage for prompt compatibility within Payload Compatibility."
+          - name: "Payload Compatibility — FS read"
+            coverageIds: [openai.payload-compatibility-fs-read]
+            description: "Exact coverage for fs read within Payload Compatibility."
+          - name: "Tool Context — Codex native workspace read"
+            coverageIds: [openai.tool-context-codex-native-workspace-read]
+            description: "Exact coverage for codex native workspace read within Tool Context."
+          - name: "Tool Context — FS read"
+            coverageIds: [openai.tool-context-fs-read]
+            description: "Exact coverage for fs read within Tool Context."
           - name: Capability Compatibility
-            coverageIds: [codex.capability-compatibility]
+            coverageIds: [openai.capability-compatibility]
             description: Covers Capability Compatibility across provider-facing tools, context injection, media inputs, native-vs-client tool ownership, OpenAI Responses compatibility, and how OpenAI/Codex models receive OpenClaw runtime context.
         docs:
           - docs/providers/openai.md
@@ -9177,28 +9760,42 @@ surfaces:
       - name: Native Codex Harness
         id: native-codex-harness
         features:
-          - name: Native Codex App-server Harness
-            coverageIds:
-              [
-                models.codex-cli,
-                runtime.codex-app-server,
-                runtime.gateway-log-sentinel.codex-progress,
-                runtime.long-context,
-                runtime.no-meta-leak,
-                workspace.planning,
-              ]
-            description: Covers Native Codex App-server Harness across native Codex app-server runtime path used by OpenAI agent turns when the Codex harness owns thread identity, native model loop, compaction, native tools, and native app-server controls.
-          - name: Thread Lifecycle
-            coverageIds:
-              [
-                runtime.codex-app-server,
-                runtime.codex-plugin.lifecycle,
-                runtime.doctor-repair,
-                runtime.gateway-log-sentinel.codex-progress,
-                runtime.long-context,
-                runtime.turn-ordering,
-              ]
-            description: Covers Thread Lifecycle across native Codex app-server runtime path used by OpenAI agent turns when the Codex harness owns thread identity, native model loop, compaction, native tools, and native app-server controls.
+          - name: "Native Codex App-server Harness — Codex CLI"
+            coverageIds: [openai.codex-harness-codex-cli]
+            description: "Exact coverage for codex cli within Native Codex App-server Harness."
+          - name: "Native Codex App-server Harness"
+            coverageIds: [openai.codex-harness]
+            description: "Covers Native Codex App-server Harness across native Codex app-server runtime path used by OpenAI agent turns when the Codex harness owns thread identity, native model loop, compaction, native tools, and native app-server controls."
+          - name: "Native Codex App-server Harness — Gateway log sentinel Codex progress"
+            coverageIds: [openai.codex-harness-progress-sentinel]
+            description: "Exact coverage for gateway log sentinel codex progress within Native Codex App-server Harness."
+          - name: "Native Codex App-server Harness — Long context"
+            coverageIds: [openai.codex-harness-long-context]
+            description: "Exact coverage for long context within Native Codex App-server Harness."
+          - name: "Native Codex App-server Harness — No meta leak"
+            coverageIds: [openai.codex-harness-no-meta-leak]
+            description: "Exact coverage for no meta leak within Native Codex App-server Harness."
+          - name: "Native Codex App-server Harness — Planning"
+            coverageIds: [openai.codex-harness-planning]
+            description: "Exact coverage for planning within Native Codex App-server Harness."
+          - name: "Thread Lifecycle — Codex app server"
+            coverageIds: [openai.thread-lifecycle-codex-app-server]
+            description: "Exact coverage for codex app server within Thread Lifecycle."
+          - name: "Thread Lifecycle — Codex plugin lifecycle"
+            coverageIds: [openai.thread-lifecycle-codex-plugin-lifecycle]
+            description: "Exact coverage for codex plugin lifecycle within Thread Lifecycle."
+          - name: "Thread Lifecycle — Doctor repair"
+            coverageIds: [openai.thread-lifecycle-doctor-repair]
+            description: "Exact coverage for doctor repair within Thread Lifecycle."
+          - name: "Thread Lifecycle — Gateway log sentinel Codex progress"
+            coverageIds: [openai.thread-progress-sentinel]
+            description: "Exact coverage for gateway log sentinel codex progress within Thread Lifecycle."
+          - name: "Thread Lifecycle — Long context"
+            coverageIds: [openai.thread-lifecycle-long-context]
+            description: "Exact coverage for long context within Thread Lifecycle."
+          - name: "Thread Lifecycle — Turn ordering"
+            coverageIds: [openai.thread-lifecycle-turn-ordering]
+            description: "Exact coverage for turn ordering within Thread Lifecycle."
         docs:
           - docs/plugins/codex-harness.md
           - docs/plugins/codex-harness-runtime.md
@@ -9215,10 +9812,10 @@ surfaces:
         id: image-and-multimodal-input
         features:
           - name: Image Generation Editing
-            coverageIds: [codex.image-generation-editing]
+            coverageIds: [openai.image-generation-editing]
             description: Covers Image Generation Editing across OpenAI image generation and editing, Codex OAuth image backend, transparent-background routing, Azure/private OpenAI image endpoints, and related image generation editing and multimodal input behavior.
           - name: Multimodal Input
-            coverageIds: [codex.multimodal-input]
+            coverageIds: [openai.multimodal-input]
             description: Covers Multimodal Input across OpenAI image generation and editing, Codex OAuth image backend, transparent-background routing, Azure/private OpenAI image endpoints, and related image generation editing and multimodal input behavior.
         docs:
           - docs/providers/openai.md
@@ -9235,10 +9832,10 @@ surfaces:
         id: voice-and-realtime-audio
         features:
           - name: Realtime Voice Transcription
-            coverageIds: [codex.realtime-voice-transcription]
+            coverageIds: [openai.realtime-voice-transcription]
             description: Covers Realtime Voice Transcription across OpenAI text-to-speech, batch speech-to-text, Realtime transcription, Realtime voice, browser Talk/WebRTC, backend WebSocket bridges, OAuth-backed client secret minting, Azure Realtime deployments, and voice-control behavior.
           - name: Speech
-            coverageIds: [codex.speech]
+            coverageIds: [openai.speech]
             description: Covers Speech across OpenAI text-to-speech, batch speech-to-text, Realtime transcription, Realtime voice, browser Talk/WebRTC, backend WebSocket bridges, OAuth-backed client secret minting, Azure Realtime deployments, and voice-control behavior.
         docs:
           - docs/providers/openai.md
@@ -9257,7 +9854,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: anthropic-provider-path
+  - id: anthropic
     name: Anthropic provider path
     family: provider-tool
     level: beta
@@ -9269,7 +9866,7 @@ surfaces:
         id: provider-auth-and-recovery
         features:
           - name: API-key onboarding
-            coverageIds: [gateway.api-key-onboarding]
+            coverageIds: [anthropic.api-key-onboarding]
             description: "Covers API-key onboarding across Anthropic credential surface before a model request is made: onboarding choices, API-key storage, Claude CLI credential migration, setup-token validation, and related credential setup and health behavior."
           - name: Claude CLI credential reuse
             coverageIds: [anthropic.claude-cli-credential-reuse]
@@ -9319,14 +9916,20 @@ surfaces:
           - name: Bundled Claude catalog
             coverageIds: [anthropic.bundled-claude-catalog]
             description: "Covers Bundled Claude catalog across Anthropic model catalog and policy layer: bundled model rows, model aliases, current and future Claude model id normalization, runtime-provider selection, and related model catalog and policy behavior."
-          - name: Canonical anthropic refs
-            coverageIds: [models.anthropic, models.provider-auth]
+          - name: "Canonical anthropic refs"
+            coverageIds: [anthropic.canonical-anthropic-refs]
             description: "Covers Canonical anthropic refs across Anthropic model catalog and policy layer: bundled model rows, model aliases, current and future Claude model id normalization, runtime-provider selection, and related model catalog and policy behavior."
-          - name: Claude CLI compatibility
-            coverageIds: [models.claude-cli, models.provider-capabilities]
+          - name: "Canonical anthropic refs — Provider auth"
+            coverageIds: [anthropic.canonical-anthropic-refs-provider-auth]
+            description: "Exact coverage for provider auth within Canonical anthropic refs."
+          - name: "Claude CLI compatibility"
+            coverageIds: [anthropic.claude-cli-compatibility]
             description: "Covers Claude CLI compatibility across Anthropic model catalog and policy layer: bundled model rows, model aliases, current and future Claude model id normalization, runtime-provider selection, and related model catalog and policy behavior."
+          - name: "Claude CLI compatibility — Provider capabilities"
+            coverageIds: [anthropic.claude-cli-compatibility-provider-capabilities]
+            description: "Exact coverage for provider capabilities within Claude CLI compatibility."
           - name: Model picker availability
-            coverageIds: [models.picker-availability]
+            coverageIds: [anthropic.model-picker-availability]
             description: "Covers Model picker availability across Anthropic model catalog and policy layer: bundled model rows, model aliases, current and future Claude model id normalization, runtime-provider selection, and related model catalog and policy behavior."
           - name: Capability metadata
             coverageIds: [anthropic.capability-metadata]
@@ -9335,7 +9938,7 @@ surfaces:
             coverageIds: [anthropic.runtime-selection]
             description: "Covers Runtime selection across OpenClaw's host-local Claude CLI path after auth is available: the `claude-cli` backend, its command/args/env defaults, MCP tool bridge, native tool mode, and related claude cli backend behavior."
           - name: Session continuity
-            coverageIds: [memory.session-continuity]
+            coverageIds: [anthropic.session-continuity]
             description: "Covers Session continuity across OpenClaw's host-local Claude CLI path after auth is available: the `claude-cli` backend, its command/args/env defaults, MCP tool bridge, native tool mode, and related claude cli backend behavior."
           - name: MCP/tool bridge
             coverageIds: [anthropic.mcp-tool-bridge]
@@ -9478,7 +10081,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: google-provider-path
+  - id: google-ai
     name: Google provider path
     family: provider-tool
     level: beta
@@ -9490,34 +10093,34 @@ surfaces:
         id: provider-setup-and-credentials
         features:
           - name: API key onboarding
-            coverageIds: [gateway.api-key-onboarding]
+            coverageIds: [google-ai.api-key-onboarding]
             description: Covers API key onboarding across direct `GEMINI_API_KEY` and `GOOGLE_API_KEY` auth, setup provider metadata, setup auth choices, provider config fields, and related provider auth and setup behavior.
           - name: Auth choice metadata
-            coverageIds: [google.auth-choice-metadata]
+            coverageIds: [google-ai.auth-choice-metadata]
             description: Covers Auth choice metadata across direct `GEMINI_API_KEY` and `GOOGLE_API_KEY` auth, setup provider metadata, setup auth choices, provider config fields, and related provider auth and setup behavior.
           - name: Gemini CLI OAuth setup
-            coverageIds: [google.gemini-cli-oauth-setup]
+            coverageIds: [google-ai.gemini-cli-oauth-setup]
             description: Covers Gemini CLI OAuth setup across direct `GEMINI_API_KEY` and `GOOGLE_API_KEY` auth, setup provider metadata, setup auth choices, provider config fields, and related provider auth and setup behavior.
           - name: Vertex ADC setup
-            coverageIds: [google.vertex-adc-setup]
+            coverageIds: [google-ai.vertex-adc-setup]
             description: Covers Vertex ADC setup across direct `GEMINI_API_KEY` and `GOOGLE_API_KEY` auth, setup provider metadata, setup auth choices, provider config fields, and related provider auth and setup behavior.
           - name: Daemon and fallback credentials
-            coverageIds: [google.daemon-and-fallback-credentials]
+            coverageIds: [google-ai.daemon-and-fallback-credentials]
             description: Covers Daemon and fallback credentials across direct `GEMINI_API_KEY` and `GOOGLE_API_KEY` auth, setup provider metadata, setup auth choices, provider config fields, and related provider auth and setup behavior.
           - name: CLI runtime selection
-            coverageIds: [google.cli-runtime-selection]
+            coverageIds: [google-ai.cli-runtime-selection]
             description: 'Covers CLI runtime selection across `google-gemini-cli` provider, canonical `google/*` model refs using `agentRuntime.id: "google-gemini-cli"`, legacy `google-gemini-cli/*` refs, Gemini CLI command invocation, and related gemini cli oauth behavior.'
           - name: OAuth login and refresh
-            coverageIds: [google.oauth-login-and-refresh]
+            coverageIds: [google-ai.oauth-login-and-refresh]
             description: 'Covers OAuth login and refresh across `google-gemini-cli` provider, canonical `google/*` model refs using `agentRuntime.id: "google-gemini-cli"`, legacy `google-gemini-cli/*` refs, Gemini CLI command invocation, and related gemini cli oauth behavior.'
           - name: Canonical Google model refs
-            coverageIds: [google.canonical-google-model-refs]
+            coverageIds: [google-ai.canonical-google-model-refs]
             description: 'Covers Canonical Google model refs across `google-gemini-cli` provider, canonical `google/*` model refs using `agentRuntime.id: "google-gemini-cli"`, legacy `google-gemini-cli/*` refs, Gemini CLI command invocation, and related gemini cli oauth behavior.'
           - name: CLI usage normalization
-            coverageIds: [google.cli-usage-normalization]
+            coverageIds: [google-ai.cli-usage-normalization]
             description: 'Covers CLI usage normalization across `google-gemini-cli` provider, canonical `google/*` model refs using `agentRuntime.id: "google-gemini-cli"`, legacy `google-gemini-cli/*` refs, Gemini CLI command invocation, and related gemini cli oauth behavior.'
           - name: OAuth diagnostics
-            coverageIds: [google.oauth-diagnostics]
+            coverageIds: [google-ai.oauth-diagnostics]
             description: 'Covers OAuth diagnostics across `google-gemini-cli` provider, canonical `google/*` model refs using `agentRuntime.id: "google-gemini-cli"`, legacy `google-gemini-cli/*` refs, Gemini CLI command invocation, and related gemini cli oauth behavior.'
         docs:
           - docs/providers/google.md
@@ -9539,34 +10142,34 @@ surfaces:
         id: model-routing-and-endpoints
         features:
           - name: Catalog rows and aliases
-            coverageIds: [google.catalog-rows-and-aliases]
+            coverageIds: [google-ai.catalog-rows-and-aliases]
             description: Covers Catalog rows and aliases across model catalog rows, model ID normalization, dynamic model resolution, provider hooks, and related model catalog and routing behavior.
           - name: Dynamic model resolution
-            coverageIds: [google.dynamic-model-resolution]
+            coverageIds: [google-ai.dynamic-model-resolution]
             description: Covers Dynamic model resolution across model catalog rows, model ID normalization, dynamic model resolution, provider hooks, and related model catalog and routing behavior.
           - name: Provider routing
-            coverageIds: [google.provider-routing]
+            coverageIds: [google-ai.provider-routing]
             description: Covers Provider routing across model catalog rows, model ID normalization, dynamic model resolution, provider hooks, and related model catalog and routing behavior.
           - name: Google-native config normalization
-            coverageIds: [google.native-config-normalization]
+            coverageIds: [google-ai.google-native-config-normalization]
             description: Covers Google-native config normalization across model catalog rows, model ID normalization, dynamic model resolution, provider hooks, and related model catalog and routing behavior.
           - name: Model picker availability
-            coverageIds: [models.picker-availability]
+            coverageIds: [google-ai.model-picker-availability]
             description: Covers Model picker availability across model catalog rows, model ID normalization, dynamic model resolution, provider hooks, and related model catalog and routing behavior.
           - name: Vertex provider selection
-            coverageIds: [google.vertex-provider-selection]
+            coverageIds: [google-ai.vertex-provider-selection]
             description: Covers Vertex provider selection across `google-vertex`, Vertex ADC/service-account auth, project/location endpoint construction, custom Google-compatible base URL handling, and related vertex ai and custom endpoints behavior.
           - name: ADC/service-account auth
-            coverageIds: [google.adc-service-account-auth]
+            coverageIds: [google-ai.adc-service-account-auth]
             description: Covers ADC/service-account auth across `google-vertex`, Vertex ADC/service-account auth, project/location endpoint construction, custom Google-compatible base URL handling, and related vertex ai and custom endpoints behavior.
           - name: Project/location endpoints
-            coverageIds: [google.project-location-endpoints]
+            coverageIds: [google-ai.project-location-endpoints]
             description: Covers Project/location endpoints across `google-vertex`, Vertex ADC/service-account auth, project/location endpoint construction, custom Google-compatible base URL handling, and related vertex ai and custom endpoints behavior.
           - name: Custom base URL policy
-            coverageIds: [google.custom-base-url-policy]
+            coverageIds: [google-ai.custom-base-url-policy]
             description: Covers Custom base URL policy across `google-vertex`, Vertex ADC/service-account auth, project/location endpoint construction, custom Google-compatible base URL handling, and related vertex ai and custom endpoints behavior.
           - name: Compatibility boundaries
-            coverageIds: [google.compatibility-boundaries]
+            coverageIds: [google-ai.compatibility-boundaries]
             description: Covers Compatibility boundaries across `google-vertex`, Vertex ADC/service-account auth, project/location endpoint construction, custom Google-compatible base URL handling, and related vertex ai and custom endpoints behavior.
         docs:
           - docs/providers/google.md
@@ -9590,31 +10193,31 @@ surfaces:
         id: direct-gemini-runtime
         features:
           - name: Direct Gemini chat
-            coverageIds: [google.direct-gemini-chat]
+            coverageIds: [google-ai.direct-gemini-chat]
             description: "Covers Direct Gemini chat across direct `google-generative-ai` Gemini transport and shared Google message/stream conversion: request URL construction, request config, text/image/audio/video/tool payload conversion, function response handling, and related direct gemini api behavior."
           - name: Multimodal inputs
-            coverageIds: [google.multimodal-inputs]
+            coverageIds: [google-ai.multimodal-inputs]
             description: "Covers Multimodal inputs across direct `google-generative-ai` Gemini transport and shared Google message/stream conversion: request URL construction, request config, text/image/audio/video/tool payload conversion, function response handling, and related direct gemini api behavior."
           - name: Tool-call streaming
-            coverageIds: [google.tool-call-streaming]
+            coverageIds: [google-ai.tool-call-streaming]
             description: "Covers Tool-call streaming across direct `google-generative-ai` Gemini transport and shared Google message/stream conversion: request URL construction, request config, text/image/audio/video/tool payload conversion, function response handling, and related direct gemini api behavior."
           - name: Usage and stop reasons
-            coverageIds: [anthropic.usage-and-stop-reasons]
+            coverageIds: [google-ai.usage-and-stop-reasons]
             description: "Covers Usage and stop reasons across direct `google-generative-ai` Gemini transport and shared Google message/stream conversion: request URL construction, request config, text/image/audio/video/tool payload conversion, function response handling, and related direct gemini api behavior."
           - name: Direct Gemini transport payloads
-            coverageIds: [google.direct-gemini-transport-payloads]
+            coverageIds: [google-ai.direct-gemini-transport-payloads]
             description: "Covers direct `google-generative-ai` Gemini transport and shared Google message/stream conversion: request URL construction, request config, text/image/audio/video/tool payload conversion, function response handling, and related direct Gemini API behavior."
           - name: Thinking-level mapping
-            coverageIds: [google.thinking-level-mapping]
+            coverageIds: [google-ai.thinking-level-mapping]
             description: Covers Thinking-level mapping across Gemini thinking-level mapping, adaptive thinking request shape, `thoughtSignature` capture/replay/sanitization, Google replay policy, and related thinking and turn recovery behavior.
           - name: Thought-signature replay policy
-            coverageIds: [google.thought-signature-replay]
+            coverageIds: [google-ai.thought-signature-replay-policy]
             description: Covers Gemini thinking-level mapping, adaptive thinking request shape, `thoughtSignature` capture/replay/sanitization, Google replay policy, and related thinking and turn recovery behavior.
           - name: Tool turn ordering
-            coverageIds: [google.tool-turn-ordering]
+            coverageIds: [google-ai.tool-turn-ordering]
             description: Covers Tool turn ordering across Gemini thinking-level mapping, adaptive thinking request shape, `thoughtSignature` capture/replay/sanitization, Google replay policy, and related thinking and turn recovery behavior.
           - name: Incomplete-turn recovery
-            coverageIds: [google.incomplete-turn-recovery]
+            coverageIds: [google-ai.incomplete-turn-recovery]
             description: Covers Incomplete-turn recovery across Gemini thinking-level mapping, adaptive thinking request shape, `thoughtSignature` capture/replay/sanitization, Google replay policy, and related thinking and turn recovery behavior.
         docs:
           - docs/providers/google.md
@@ -9637,34 +10240,34 @@ surfaces:
         id: media-search-and-realtime
         features:
           - name: Bundled plugin distribution
-            coverageIds: [google.bundled-plugin-distribution]
+            coverageIds: [google-ai.bundled-plugin-distribution]
             description: Covers Bundled plugin distribution across bundled `@openclaw/google-plugin` package, plugin manifest distribution, auto-enable metadata, capability-provider registration, and related google plugin adapters behavior.
           - name: Provider auto-enable metadata
-            coverageIds: [google.provider-auto-enable-metadata]
+            coverageIds: [google-ai.provider-auto-enable-metadata]
             description: Covers Provider auto-enable metadata across bundled `@openclaw/google-plugin` package, plugin manifest distribution, auto-enable metadata, capability-provider registration, and related google plugin adapters behavior.
           - name: Image and media adapters
-            coverageIds: [google.image-and-media-adapters]
+            coverageIds: [google-ai.image-and-media-adapters]
             description: Covers Image and media adapters across bundled `@openclaw/google-plugin` package, plugin manifest distribution, auto-enable metadata, capability-provider registration, and related google plugin adapters behavior.
           - name: Speech and realtime adapters
-            coverageIds: [google.speech-and-realtime-adapters]
+            coverageIds: [google-ai.speech-and-realtime-adapters]
             description: Covers Speech and realtime adapters across bundled `@openclaw/google-plugin` package, plugin manifest distribution, auto-enable metadata, capability-provider registration, and related google plugin adapters behavior.
           - name: Search and generation tools
-            coverageIds: [google.search-and-generation-tools]
+            coverageIds: [google-ai.search-and-generation-tools]
             description: Covers Search and generation tools across bundled `@openclaw/google-plugin` package, plugin manifest distribution, auto-enable metadata, capability-provider registration, and related google plugin adapters behavior.
           - name: Realtime voice sessions
-            coverageIds: [google.realtime-voice-sessions]
+            coverageIds: [google-ai.realtime-voice-sessions]
             description: Covers Realtime voice sessions across Gemini Live realtime voice provider behavior, Talk relay integration, constrained browser websocket tokens, audio queueing, and related gemini live talk behavior.
           - name: Constrained browser tokens
-            coverageIds: [google.constrained-browser-tokens]
+            coverageIds: [google-ai.constrained-browser-tokens]
             description: Covers Constrained browser tokens across Gemini Live realtime voice provider behavior, Talk relay integration, constrained browser websocket tokens, audio queueing, and related gemini live talk behavior.
           - name: Audio and transcript events
-            coverageIds: [google.audio-and-transcript-events]
+            coverageIds: [google-ai.audio-and-transcript-events]
             description: Covers Audio and transcript events across Gemini Live realtime voice provider behavior, Talk relay integration, constrained browser websocket tokens, audio queueing, and related gemini live talk behavior.
           - name: Live tool calls
-            coverageIds: [google.live-tool-calls]
+            coverageIds: [google-ai.live-tool-calls]
             description: Covers Live tool calls across Gemini Live realtime voice provider behavior, Talk relay integration, constrained browser websocket tokens, audio queueing, and related gemini live talk behavior.
           - name: Session reconnects
-            coverageIds: [google.session-reconnects]
+            coverageIds: [google-ai.session-reconnects]
             description: Covers Session reconnects across Gemini Live realtime voice provider behavior, Talk relay integration, constrained browser websocket tokens, audio queueing, and related gemini live talk behavior.
         docs:
           - docs/plugins/reference/google.md
@@ -9686,19 +10289,19 @@ surfaces:
         id: prompt-caching
         features:
           - name: Cache retention config
-            coverageIds: [google.cache-retention-config]
+            coverageIds: [google-ai.cache-retention-config]
             description: Covers Cache retention config across direct `google-generative-ai` Gemini prompt cache eligibility, `cacheRetention`, managed `cachedContents` create/reuse/refresh, manual `cachedContent` config, and related prompt caching behavior.
           - name: Managed cachedContents
-            coverageIds: [google.managed-cachedcontents]
+            coverageIds: [google-ai.managed-cachedcontents]
             description: Covers Managed cachedContents across direct `google-generative-ai` Gemini prompt cache eligibility, `cacheRetention`, managed `cachedContents` create/reuse/refresh, manual `cachedContent` config, and related prompt caching behavior.
           - name: Manual cachedContent handles
-            coverageIds: [google.manual-cachedcontent-handles]
+            coverageIds: [google-ai.manual-cachedcontent-handles]
             description: Covers Manual cachedContent handles across direct `google-generative-ai` Gemini prompt cache eligibility, `cacheRetention`, managed `cachedContents` create/reuse/refresh, manual `cachedContent` config, and related prompt caching behavior.
           - name: Cache usage accounting
-            coverageIds: [google.cache-usage-accounting]
+            coverageIds: [google-ai.cache-usage-accounting]
             description: Covers Cache usage accounting across direct `google-generative-ai` Gemini prompt cache eligibility, `cacheRetention`, managed `cachedContents` create/reuse/refresh, manual `cachedContent` config, and related prompt caching behavior.
           - name: Cache diagnostics and live proof
-            coverageIds: [google.cache-diagnostics-and-live-proof]
+            coverageIds: [google-ai.cache-diagnostics-and-live-proof]
             description: Covers Cache diagnostics and live proof across direct `google-generative-ai` Gemini prompt cache eligibility, `cacheRetention`, managed `cachedContents` create/reuse/refresh, manual `cachedContent` config, and related prompt caching behavior.
         docs:
           - docs/reference/prompt-caching.md
@@ -9719,7 +10322,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: openrouter-provider-path
+  - id: openrouter
     name: OpenRouter provider path
     family: provider-tool
     level: beta
@@ -9743,7 +10346,7 @@ surfaces:
             coverageIds: [openrouter.model-ref-examples]
             description: "Covers Model-ref examples across user-facing setup and provider registration: the `/providers/openrouter` docs, plugin manifest, provider registration hook, default model registration, and related operator setup and model selection behavior."
           - name: OPENROUTER_API_KEY
-            coverageIds: [openrouter.api-key]
+            coverageIds: [openrouter.openrouter-api-key]
             description: Covers OPENROUTER_API_KEY across `OPENROUTER_API_KEY` discovery, onboarding/auth-choice storage, `auth-profiles.json`, status/probe visibility, and related credentials and auth profiles behavior.
           - name: Auth profiles and auth order
             coverageIds: [openrouter.auth-profiles-and-auth-order]
@@ -9764,7 +10367,7 @@ surfaces:
             coverageIds: [openrouter.dynamic-models-discovery]
             description: Covers Dynamic /models discovery across static catalog rows, dynamic model capability discovery, model-id normalization, `openrouter/<provider>/<model>` references, and related model catalog and dynamic discovery behavior.
           - name: openrouter/auto and nested refs
-            coverageIds: [openrouter.auto-and-nested-refs]
+            coverageIds: [openrouter.openrouter-auto-and-nested-refs]
             description: Covers openrouter/auto and nested refs across static catalog rows, dynamic model capability discovery, model-id normalization, `openrouter/<provider>/<model>` references, and related model catalog and dynamic discovery behavior.
           - name: Free-model scan/probe
             coverageIds: [openrouter.free-model-scan-probe]
@@ -9944,7 +10547,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: local-model-providers-ollama-vllm-sglang-lm-studio
+  - id: local-models
     name: "Local model providers: Ollama, vLLM, SGLang, LM Studio"
     family: provider-tool
     level: alpha
@@ -10082,7 +10685,7 @@ surfaces:
             coverageIds: [local-models.vllm-thinking-controls]
             description: Covers vLLM thinking controls across bundled `vllm` and `sglang` provider plugins, docs, default env/base URL behavior, `/v1/models` discovery, and related vllm and sglang openai-compatible providers behavior.
           - name: OpenAI-compatible chat and tool semantics
-            coverageIds: [local-models.openai-compatible-chat-and-tool-semantics]
+            coverageIds: [local-models.openai-chat-tools]
             description: Covers OpenAI-compatible chat and tool semantics across bundled `vllm` and `sglang` provider plugins, docs, default env/base URL behavior, `/v1/models` discovery, and related vllm and sglang openai-compatible providers behavior.
           - name: SGLang compatibility guidance
             coverageIds: [local-models.sglang-compatibility-guidance]
@@ -10166,7 +10769,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: long-tail-hosted-providers
+  - id: hosted-providers
     name: Long-tail hosted providers
     family: provider-tool
     level: alpha
@@ -10255,7 +10858,7 @@ surfaces:
             coverageIds: [hosted-providers.speech-to-text-providers]
             description: Covers Speech-to-text providers across text-to-speech, speech-to-text, realtime transcription, telephony audio, and related hosted speech, transcription, and audio providers behavior.
           - name: Realtime transcription providers
-            coverageIds: [models.realtime-transcription-providers]
+            coverageIds: [hosted-providers.realtime-transcription-providers]
             description: Covers Realtime transcription providers across text-to-speech, speech-to-text, realtime transcription, telephony audio, and related hosted speech, transcription, and audio providers behavior.
           - name: Audio format diagnostics
             coverageIds: [hosted-providers.audio-format-diagnostics]
@@ -10341,7 +10944,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: web-search-tools
+  - id: web-search
     name: Web search tools
     family: provider-tool
     level: beta
@@ -10353,7 +10956,7 @@ surfaces:
         id: search-providers
         features:
           - name: API-backed providers
-            coverageIds: [tools.tavily-search]
+            coverageIds: [web-search.api-backed-providers]
             description: Covers API-backed providers provider routing, request shaping, streaming, and response normalization for Structured Search Providers.
           - name: Keyless and self-hosted providers
             coverageIds: [web-search.keyless-and-self-hosted-providers]
@@ -10452,7 +11055,7 @@ surfaces:
         id: setup-and-diagnostics
         features:
           - name: Provider credentials
-            coverageIds: [security.provider-credentials]
+            coverageIds: [web-search.provider-credentials]
             description: Defines Provider credentials setup, credential, configuration, and operator verification behavior for Setup and Credential Repair.
           - name: Default provider selection
             coverageIds: [web-search.default-provider-selection]
@@ -10470,13 +11073,13 @@ surfaces:
             coverageIds: [web-search.cache-controls]
             description: Covers Cache controls status, diagnostics, failure handling, and operator repair for Provider Reliability and Diagnostics.
           - name: Provider diagnostics
-            coverageIds: [models.diagnostics]
+            coverageIds: [web-search.provider-diagnostics]
             description: Covers Provider diagnostics status, diagnostics, failure handling, and operator repair for Provider Reliability and Diagnostics.
           - name: Retry and fallback
             coverageIds: [web-search.retry-and-fallback]
             description: Covers Retry and fallback status, diagnostics, failure handling, and operator repair for Provider Reliability and Diagnostics.
           - name: Operator repair
-            coverageIds: [codex.operator-repair]
+            coverageIds: [web-search.operator-repair]
             description: Covers Operator repair status, diagnostics, failure handling, and operator repair for Provider Reliability and Diagnostics.
         docs:
           - docs/tools/web.md
@@ -10506,7 +11109,7 @@ surfaces:
             coverageIds: [web-search.network-safety]
             description: Defines Network Safety authorization, trust, safety boundaries, and operator controls for Network Safety, Ssrf, Redirects, and Untrusted Content.
           - name: SSRF
-            coverageIds: [browser-tools.ssrf]
+            coverageIds: [web-search.ssrf]
             description: Defines SSRF authorization, trust, safety boundaries, and operator controls for Network Safety, Ssrf, Redirects, and Untrusted Content.
           - name: Redirects
             coverageIds: [web-search.redirects]
@@ -10531,11 +11134,14 @@ surfaces:
       - name: Tool Availability and Fetch
         id: tool-availability-and-fetch
         features:
-          - name: web_search exposure
-            coverageIds: [models.openai, tools.web-search]
-            description: Defines web_search exposure setup, credential, configuration, and operator verification behavior for Tool Availability and Policy.
+          - name: "web_search exposure — Openai"
+            coverageIds: [web-search.web-search-exposure-openai]
+            description: "Exact coverage for openai within web_search exposure."
+          - name: "web_search exposure"
+            coverageIds: [web-search.web-search-exposure]
+            description: "Defines web_search exposure setup, credential, configuration, and operator verification behavior for Tool Availability and Policy."
           - name: web_fetch exposure
-            coverageIds: [tools.web-fetch]
+            coverageIds: [web-search.web-fetch-exposure]
             description: Defines web_fetch exposure setup, credential, configuration, and operator verification behavior for Tool Availability and Policy.
           - name: x_search exposure
             coverageIds: [web-search.x-search-exposure]
@@ -10553,7 +11159,7 @@ surfaces:
             coverageIds: [web-search.url-fetch]
             description: Covers URL fetch tool invocation, host execution, sandbox policy, and artifact handling for Web Fetch and Content Extraction.
           - name: HTML extraction
-            coverageIds: [tools.tavily-extract]
+            coverageIds: [web-search.html-extraction]
             description: Covers HTML extraction tool invocation, host execution, sandbox policy, and artifact handling for Web Fetch and Content Extraction.
           - name: PDF/text extraction
             coverageIds: [web-search.pdf-text-extraction]
@@ -10589,7 +11195,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: browser-automation-and-exec-sandbox-tools
+  - id: tools
     name: Browser automation, exec, and sandbox tools
     family: provider-tool
     level: beta
@@ -10601,28 +11207,28 @@ surfaces:
         id: browser-automation
         features:
           - name: Browser Actions
-            coverageIds: [browser-tools.browser-actions]
+            coverageIds: [tools.browser-actions]
             description: Covers Browser Actions across browser tool action schemas, navigate/act/snapshot/screenshot operations, AI/role/ARIA snapshot formats, action ref storage, and related browser actions, snapshots, and artifacts behavior.
           - name: Snapshots
-            coverageIds: [browser-tools.snapshots]
+            coverageIds: [tools.snapshots]
             description: Covers Snapshots across browser tool action schemas, navigate/act/snapshot/screenshot operations, AI/role/ARIA snapshot formats, action ref storage, and related browser actions, snapshots, and artifacts behavior.
           - name: Artifacts
-            coverageIds: [workspace.artifacts]
+            coverageIds: [tools.artifacts]
             description: Covers Artifacts across browser tool action schemas, navigate/act/snapshot/screenshot operations, AI/role/ARIA snapshot formats, action ref storage, and related browser actions, snapshots, and artifacts behavior.
           - name: Browser Plugin Service
-            coverageIds: [browser-tools.browser-plugin-service]
+            coverageIds: [tools.browser-plugin-service]
             description: Covers Browser Plugin Service across bundled browser plugin activation, browser CLI registration, `browser.request` Gateway routing, control-service startup, and related browser plugin service and profiles behavior.
           - name: Profiles
-            coverageIds: [browser-tools.profiles]
+            coverageIds: [tools.profiles]
             description: Covers Profiles across bundled browser plugin activation, browser CLI registration, `browser.request` Gateway routing, control-service startup, and related browser plugin service and profiles behavior.
           - name: Browser Security
-            coverageIds: [browser-tools.browser-security]
+            coverageIds: [tools.browser-security]
             description: Covers Browser Security across browser-control auth, navigation URL validation, delayed navigation guards, strict private-network SSRF policy, and related browser security, ssrf, and remote control behavior.
           - name: SSRF
-            coverageIds: [browser-tools.ssrf]
+            coverageIds: [tools.ssrf]
             description: Covers SSRF across browser-control auth, navigation URL validation, delayed navigation guards, strict private-network SSRF policy, and related browser security, ssrf, and remote control behavior.
           - name: Remote Control
-            coverageIds: [browser-tools.remote-control]
+            coverageIds: [tools.remote-control]
             description: Covers Remote Control across browser-control auth, navigation URL validation, delayed navigation guards, strict private-network SSRF policy, and related browser security, ssrf, and remote control behavior.
         docs:
           - docs/tools/browser-control.md
@@ -10650,23 +11256,29 @@ surfaces:
       - name: Tool Invocation and Execution
         id: tool-invocation-and-execution
         features:
-          - name: Exec Routing
-            coverageIds: [tools.bash, tools.exec]
-            description: Covers Exec Routing across `exec` foreground and background execution, `yieldMs`, timeouts, PTY, and related exec routing and process lifecycle behavior.
+          - name: "Exec Routing — Bash"
+            coverageIds: [tools.exec-routing-bash]
+            description: "Exact coverage for bash within Exec Routing."
+          - name: "Exec Routing — Exec"
+            coverageIds: [tools.exec-routing-exec]
+            description: "Exact coverage for exec within Exec Routing."
           - name: Process Lifecycle
-            coverageIds: [workspace.long-running-task]
+            coverageIds: [tools.process-lifecycle]
             description: Covers Process Lifecycle across `exec` foreground and background execution, `yieldMs`, timeouts, PTY, and related exec routing and process lifecycle behavior.
-          - name: Direct Tool Invoke API
-            coverageIds: [plugins.mcp-tools, tools.invocation]
-            description: Covers Direct Tool Invoke API across HTTP `POST /tools/invoke`, Gateway RPC `tools.invoke`, request body and auth semantics, shared-secret operator scope restoration, and related direct tool invoke api and node system.run behavior.
+          - name: "Direct Tool Invoke API — MCP tools"
+            coverageIds: [tools.mcp-direct-invoke]
+            description: "Exact coverage for mcp tools within Direct Tool Invoke API."
+          - name: "Direct Tool Invoke API — Invocation"
+            coverageIds: [tools.direct-tool-invoke-api-invocation]
+            description: "Exact coverage for invocation within Direct Tool Invoke API."
           - name: Node System.run
-            coverageIds: [browser-tools.node-system-run]
+            coverageIds: [tools.node-system-run]
             description: Covers Node System.run across HTTP `POST /tools/invoke`, Gateway RPC `tools.invoke`, request body and auth semantics, shared-secret operator scope restoration, and related direct tool invoke api and node system.run behavior.
           - name: Host Exec Approvals
-            coverageIds: [browser-tools.host-exec-approvals]
+            coverageIds: [tools.host-exec-approvals]
             description: Covers Host Exec Approvals across exec approval policy, local approvals state, approval request registration and waiting, allow-once consumption, and related host exec approvals and elevated mode behavior.
           - name: Elevated Mode
-            coverageIds: [browser-tools.elevated-mode]
+            coverageIds: [tools.elevated-mode]
             description: Covers Elevated Mode across exec approval policy, local approvals state, approval request registration and waiting, allow-once consumption, and related host exec approvals and elevated mode behavior.
         docs:
           - docs/tools/exec.md
@@ -10696,22 +11308,22 @@ surfaces:
         id: sandbox-and-tool-policy
         features:
           - name: Sandbox Backends
-            coverageIds: [browser-tools.sandbox-backends]
+            coverageIds: [tools.sandbox-backends]
             description: Covers Sandbox Backends across sandbox modes, scopes, workspace roots, workspaceAccess, and related sandbox backends and workspace isolation behavior.
           - name: Workspace Isolation
-            coverageIds: [browser-tools.workspace-isolation]
+            coverageIds: [tools.workspace-isolation]
             description: Covers Workspace Isolation across sandbox modes, scopes, workspace roots, workspaceAccess, and related sandbox backends and workspace isolation behavior.
           - name: Sandboxed Browser
-            coverageIds: [browser-tools.sandboxed-browser]
+            coverageIds: [tools.sandboxed-browser]
             description: Covers Sandboxed Browser across sandbox browser config, Docker browser container creation, CDP relay authentication, noVNC password/token flow, and related sandboxed browser and codex dynamic tools behavior.
           - name: Codex Dynamic Tools
-            coverageIds: [browser-tools.codex-dynamic-tools]
+            coverageIds: [tools.codex-dynamic-tools]
             description: Covers Codex Dynamic Tools across sandbox browser config, Docker browser container creation, CDP relay authentication, noVNC password/token flow, and related sandboxed browser and codex dynamic tools behavior.
           - name: Tool Policy
-            coverageIds: [browser-tools.tool-policy]
+            coverageIds: [tools.tool-policy]
             description: Covers Tool Policy across tool profiles, tool groups, allow/deny policy, provider policy, and related tool policy and sandbox tool gates behavior.
           - name: Sandbox Tool Gates
-            coverageIds: [browser-tools.sandbox-tool-gates]
+            coverageIds: [tools.sandbox-tool-gates]
             description: Covers Sandbox Tool Gates across tool profiles, tool groups, allow/deny policy, provider policy, and related tool policy and sandbox tool gates behavior.
         docs:
           - docs/gateway/sandboxing.md
@@ -10740,7 +11352,7 @@ surfaces:
       by: codex
       source_ref: null
       process_version: 3
-  - id: image-video-music-generation-tools
+  - id: media-generation
     name: Image, video, and music generation tools
     family: provider-tool
     level: alpha
@@ -10752,16 +11364,16 @@ surfaces:
         id: media-routing-and-discovery
         features:
           - name: default media model config
-            coverageIds: [media-tools.default-media-model-config]
+            coverageIds: [media-generation.default-media-model-config]
             description: Covers default media model config across `imageGenerationModel`, `videoGenerationModel`, `musicGenerationModel`, provider/model refs, and related model routing and tool discovery behavior.
           - name: per-call model refs and fallbacks
-            coverageIds: [media-tools.per-call-model-refs-and-fallbacks]
+            coverageIds: [media-generation.per-call-model-fallbacks]
             description: Covers per-call model refs and fallbacks across `imageGenerationModel`, `videoGenerationModel`, `musicGenerationModel`, provider/model refs, and related model routing and tool discovery behavior.
           - name: auth-backed tool discovery
-            coverageIds: [media-tools.auth-backed-tool-discovery]
+            coverageIds: [media-generation.auth-backed-tool-discovery]
             description: Covers auth-backed tool discovery across `imageGenerationModel`, `videoGenerationModel`, `musicGenerationModel`, provider/model refs, and related model routing and tool discovery behavior.
           - name: action=list provider inspection
-            coverageIds: [media-tools.action-list-provider-inspection]
+            coverageIds: [media-generation.action-list-provider-inspection]
             description: Covers action=list provider inspection across `imageGenerationModel`, `videoGenerationModel`, `musicGenerationModel`, provider/model refs, and related model routing and tool discovery behavior.
         docs:
           - docs/gateway/config-agents.md
@@ -10779,40 +11391,40 @@ surfaces:
         id: task-lifecycle-and-delivery
         features:
           - name: background task creation
-            coverageIds: [media-tools.background-task-creation]
+            coverageIds: [media-generation.background-task-creation]
             description: Covers background task creation across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: task status/list/show/cancel
-            coverageIds: [media-tools.task-status-list-show-cancel]
+            coverageIds: [media-generation.task-status-list-show-cancel]
             description: Covers task status/list/show/cancel across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: duplicate guards
-            coverageIds: [media-tools.duplicate-guards]
+            coverageIds: [media-generation.duplicate-guards]
             description: Covers duplicate guards across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: progress keepalive
-            coverageIds: [media-tools.progress-keepalive]
+            coverageIds: [media-generation.progress-keepalive]
             description: Covers progress keepalive across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: completion/failure wake
-            coverageIds: [media-tools.completion-failure-wake]
+            coverageIds: [media-generation.completion-failure-wake]
             description: Covers completion/failure wake across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: no-session inline fallback
-            coverageIds: [media-tools.no-session-inline-fallback]
+            coverageIds: [media-generation.no-session-inline-fallback]
             description: Covers no-session inline fallback across `image_generate`, `video_generate`, and `music_generate` tool exposure, background task scheduling, and related async task lifecycle behavior.
           - name: local media persistence
-            coverageIds: [media-tools.local-media-persistence]
+            coverageIds: [media-generation.local-media-persistence]
             description: Covers local media persistence across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
           - name: MIME/filename inference
-            coverageIds: [media-tools.mime-filename-inference]
+            coverageIds: [media-generation.mime-filename-inference]
             description: Covers MIME/filename inference across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
           - name: Hosted URL fallback
-            coverageIds: [media-tools.hosted-url-fallback]
+            coverageIds: [media-generation.hosted-url-fallback]
             description: Covers hosted URL fallback across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
           - name: message-tool handoff
-            coverageIds: [media-tools.message-tool-handoff]
+            coverageIds: [media-generation.message-tool-handoff]
             description: Covers message-tool handoff across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
           - name: idempotent missing-media fallback
-            coverageIds: [media-tools.idempotent-missing-media-fallback]
+            coverageIds: [media-generation.idempotent-missing-media-fallback]
             description: Covers idempotent missing-media fallback across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
           - name: channel attachment proof
-            coverageIds: [media-tools.channel-attachment-proof]
+            coverageIds: [media-generation.channel-attachment-proof]
             description: Covers channel attachment proof across generated image/audio/video artifact objects, MIME and filename inference, local media paths, hosted media URLs, and related generated media delivery behavior.
         docs:
           - docs/tools/media-overview.md
@@ -10838,32 +11450,31 @@ surfaces:
         id: image-generation
         features:
           - name: text-to-image
-            coverageIds: [media-tools.text-to-image]
+            coverageIds: [media-generation.text-to-image]
             description: "Covers text-to-image across image generation and editing runtime behavior after a provider candidate has been selected: request normalization, timeout handling, reference-image inputs, image response parsing, and related image generation and editing behavior."
           - name: reference-image editing
-            coverageIds: [media.reference-image-editing]
+            coverageIds: [media-generation.reference-image-editing]
             description: "Covers reference-image editing across image generation and editing runtime behavior after a provider candidate has been selected: request normalization, timeout handling, reference-image inputs, image response parsing, and related image generation and editing behavior."
           - name: output hints
-            coverageIds: [media-tools.output-hints]
+            coverageIds: [media-generation.output-hints]
             description: "Covers output hints across image generation and editing runtime behavior after a provider candidate has been selected: request normalization, timeout handling, reference-image inputs, image response parsing, and related image generation and editing behavior."
           - name: action=status
-            coverageIds: [media-tools.action-status]
+            coverageIds: [media-generation.action-status]
             description: "Covers action=status across image generation and editing runtime behavior after a provider candidate has been selected: request normalization, timeout handling, reference-image inputs, image response parsing, and related image generation and editing behavior."
           - name: provider attempt metadata
-            coverageIds: [media-tools.provider-attempt-metadata]
+            coverageIds: [media-generation.provider-attempt-metadata]
             description: "Covers provider attempt metadata across image generation and editing runtime behavior after a provider candidate has been selected: request normalization, timeout handling, reference-image inputs, image response parsing, and related image generation and editing behavior."
           - name: OpenAI/Codex OAuth
-            coverageIds: [media-tools.openai-codex-oauth]
+            coverageIds: [media-generation.openai-codex-oauth]
             description: Covers OpenAI/Codex OAuth across provider registrations and auth paths for image generation and editing, including OpenAI/Codex OAuth, OpenRouter, xAI, and related image providers and auth behavior.
           - name: API-key OpenAI
-            coverageIds: [media-tools.api-key-openai]
+            coverageIds: [media-generation.api-key-openai]
             description: Covers API-key OpenAI across provider registrations and auth paths for image generation and editing, including OpenAI/Codex OAuth, OpenRouter, xAI, and related image providers and auth behavior.
           - name: OpenRouter/xAI/fal/LiteLLM/DeepInfra/Google/MiniMax/ComfyUI auth
-            coverageIds:
-              [media-tools.openrouter-xai-fal-litellm-deepinfra-google-minimax-comfyui-auth]
+            coverageIds: [media-generation.image-provider-auth]
             description: Covers OpenRouter/xAI/fal/LiteLLM/DeepInfra/Google/MiniMax/ComfyUI auth across provider registrations and auth paths for image generation and editing, including OpenAI/Codex OAuth, OpenRouter, xAI, and related image providers and auth behavior.
           - name: provider error diagnostics
-            coverageIds: [media-tools.provider-error-diagnostics]
+            coverageIds: [media-generation.provider-error-diagnostics]
             description: Covers provider error diagnostics across provider registrations and auth paths for image generation and editing, including OpenAI/Codex OAuth, OpenRouter, xAI, and related image providers and auth behavior.
         docs:
           - docs/tools/image-generation.md
@@ -10885,37 +11496,37 @@ surfaces:
         id: video-generation
         features:
           - name: text-to-video
-            coverageIds: [media-tools.text-to-video]
+            coverageIds: [media-generation.text-to-video]
             description: "Covers text-to-video across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: image-to-video
-            coverageIds: [media-tools.image-to-video]
+            coverageIds: [media-generation.image-to-video]
             description: "Covers image-to-video across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: video-to-video
-            coverageIds: [media-tools.video-to-video]
+            coverageIds: [media-generation.video-to-video]
             description: "Covers video-to-video across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: reference role validation
-            coverageIds: [media-tools.reference-role-validation]
+            coverageIds: [media-generation.reference-role-validation]
             description: "Covers reference role validation across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: audio refs
-            coverageIds: [media-tools.audio-refs]
+            coverageIds: [media-generation.audio-refs]
             description: "Covers audio refs across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: typed providerOptions
-            coverageIds: [media-tools.typed-provideroptions]
+            coverageIds: [media-generation.typed-provideroptions]
             description: "Covers typed providerOptions across video generation request normalization before provider execution: `generate`, `imageToVideo`, and `videoToVideo` modes, reference media typing and roles, and related video generation modes behavior."
           - name: queue-backed jobs
-            coverageIds: [media-tools.queue-backed-jobs]
+            coverageIds: [media-generation.queue-backed-jobs]
             description: "Covers queue-backed jobs across provider integration and async polling for video generation after request normalization: OpenAI Sora, OpenRouter, fal, Runway, and related video providers and polling behavior."
           - name: polling/timeout handling
-            coverageIds: [media-tools.polling-timeout-handling]
+            coverageIds: [media-generation.polling-timeout-handling]
             description: "Covers polling/timeout handling across provider integration and async polling for video generation after request normalization: OpenAI Sora, OpenRouter, fal, Runway, and related video providers and polling behavior."
           - name: Hosted URL download
-            coverageIds: [media-tools.hosted-url-download]
+            coverageIds: [media-generation.hosted-url-download]
             description: "Covers hosted URL download across provider integration and async polling for video generation after request normalization: OpenAI Sora, OpenRouter, fal, Runway, and related video providers and polling behavior."
           - name: provider skip explanations
-            coverageIds: [media-tools.provider-skip-explanations]
+            coverageIds: [media-generation.provider-skip-explanations]
             description: "Covers provider skip explanations across provider integration and async polling for video generation after request normalization: OpenAI Sora, OpenRouter, fal, Runway, and related video providers and polling behavior."
           - name: returned asset metadata
-            coverageIds: [media-tools.returned-asset-metadata]
+            coverageIds: [media-generation.returned-asset-metadata]
             description: "Covers returned asset metadata across provider integration and async polling for video generation after request normalization: OpenAI Sora, OpenRouter, fal, Runway, and related video providers and polling behavior."
         docs:
           - docs/tools/video-generation.md
@@ -10941,22 +11552,22 @@ surfaces:
         id: music-generation
         features:
           - name: prompt and lyrics input
-            coverageIds: [media-tools.prompt-and-lyrics-input]
+            coverageIds: [media-generation.prompt-and-lyrics-input]
             description: Covers prompt and lyrics input across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
           - name: instrumental mode
-            coverageIds: [media-tools.instrumental-mode]
+            coverageIds: [media-generation.instrumental-mode]
             description: Covers instrumental mode across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
           - name: duration/format controls
-            coverageIds: [media-tools.duration-format-controls]
+            coverageIds: [media-generation.duration-format-controls]
             description: Covers duration/format controls across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
           - name: image-reference edit lanes
-            coverageIds: [media-tools.image-reference-edit-lanes]
+            coverageIds: [media-generation.image-reference-edit-lanes]
             description: Covers image-reference edit lanes across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
           - name: generated audio outputs
-            coverageIds: [media-tools.generated-audio-outputs]
+            coverageIds: [media-generation.generated-audio-outputs]
             description: Covers generated audio outputs across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
           - name: provider fallback
-            coverageIds: [media-tools.provider-fallback]
+            coverageIds: [media-generation.provider-fallback]
             description: Covers provider fallback across `music_generate`, prompt and lyrics inputs, instrumental mode, duration, and related music generation behavior.
         docs:
           - docs/tools/music-generation.md
diff --git a/test/e2e/qa-lab/config/cli-channel-picker.ts b/test/e2e/qa-lab/config/cli-channel-picker.ts
index d47bd4d951a9..8c40750203c5 100644
--- a/test/e2e/qa-lab/config/cli-channel-picker.ts
+++ b/test/e2e/qa-lab/config/cli-channel-picker.ts
@@ -237,7 +237,6 @@ function createEvidenceWriter(options: ProducerOptions) {
       id: SCENARIO_ID,
       title: "CLI channel picker",
       sourcePath: SOURCE_PATH,
-      primaryCoverageIds: ["cli.channel-picker"],
       docsRefs: ["docs/channels/telegram.md", "docs/help/testing.md"],
       codeRefs: [SOURCE_PATH, "scripts/e2e/lib/run-with-pty.mjs", "src/flows/channel-setup.ts"],
     },
diff --git a/test/e2e/qa-lab/media/hosted-media-provider-live.test.ts b/test/e2e/qa-lab/media/hosted-media-provider-live.test.ts
index ee29c2ecca70..0b1ee5e30796 100644
--- a/test/e2e/qa-lab/media/hosted-media-provider-live.test.ts
+++ b/test/e2e/qa-lab/media/hosted-media-provider-live.test.ts
@@ -80,7 +80,7 @@ describe("hosted media provider live QA producer", () => {
     expect(classifyHostedMediaFailureStatus("provider response was malformed")).toBe("fail");
   });
 
-  it("maps video provider live coverage roles without making tool invocation primary", () => {
+  it("leaves video provider coverage mapping to the scenario catalog", () => {
     const artifactBase = path.join(os.tmpdir(), "openclaw-hosted-media-live-test");
     const options = parseHostedMediaOptions(["--suite", "video", "--artifact-base", artifactBase]);
     const evidence = buildHostedMediaEvidence({
@@ -91,11 +91,7 @@ describe("hosted media provider live QA producer", () => {
       },
     });
 
-    expect(evidence.entries[0]?.coverage).toEqual([
-      { id: "hosted-providers.video-generation-providers", role: "primary" },
-      { id: "media.reference-image-video-and-audio-inputs", role: "primary" },
-      { id: "media.video-generation-tool-invocation", role: "secondary" },
-    ]);
+    expect(evidence.entries[0]?.coverage).toEqual([]);
   });
 });
 
diff --git a/test/e2e/qa-lab/media/hosted-media-provider-live.ts b/test/e2e/qa-lab/media/hosted-media-provider-live.ts
index 76ef0528ed8f..6c3ad0bc25f2 100644
--- a/test/e2e/qa-lab/media/hosted-media-provider-live.ts
+++ b/test/e2e/qa-lab/media/hosted-media-provider-live.ts
@@ -121,8 +121,6 @@ type HostedMediaOptions = {
 type HostedMediaSuiteDefinition = {
   codeRefs: string[];
   docsRefs: string[];
-  primaryCoverageIds: string[];
-  secondaryCoverageIds?: string[];
   scenarioId: string;
   title: string;
   videoFullModes?: boolean;
@@ -139,7 +137,6 @@ const EVIDENCE_SUITES: Record<EvidenceSuiteId, HostedMediaSuiteDefinition> = {
   image: {
     scenarioId: "hosted-image-generation-providers-live",
     title: "Hosted image generation providers live",
-    primaryCoverageIds: ["hosted-providers.image-generation-providers"],
     docsRefs: [
       "docs/help/testing.md",
       "docs/tools/image-generation.md",
@@ -154,11 +151,6 @@ const EVIDENCE_SUITES: Record<EvidenceSuiteId, HostedMediaSuiteDefinition> = {
   video: {
     scenarioId: "hosted-video-generation-providers-live",
     title: "Hosted video generation providers live",
-    primaryCoverageIds: [
-      "hosted-providers.video-generation-providers",
-      "media.reference-image-video-and-audio-inputs",
-    ],
-    secondaryCoverageIds: ["media.video-generation-tool-invocation"],
     docsRefs: [
       "docs/help/testing.md",
       "docs/tools/video-generation.md",
@@ -728,8 +720,6 @@ function createHostedMediaEvidenceWriter(options: HostedMediaOptions) {
       id: definition.scenarioId,
       title: definition.title,
       sourcePath: SOURCE_PATH,
-      primaryCoverageIds: definition.primaryCoverageIds,
-      secondaryCoverageIds: definition.secondaryCoverageIds,
       docsRefs: definition.docsRefs,
       codeRefs: definition.codeRefs,
     },
diff --git a/test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts b/test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts
index 77c807b1ac0d..73942e185677 100644
--- a/test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts
+++ b/test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts
@@ -18,7 +18,6 @@ import {
 const SCENARIO_ID = "clawhub-release-candidate-checklist";
 const SCENARIO_TITLE = "ClawHub release candidate npm package install proof";
 const SOURCE_PATH = "test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts";
-const COVERAGE_ID = "clawhub.npm-pack-local-release-candidate-installs";
 const DEFAULT_TARBALL_ENV = "OPENCLAW_QA_RELEASE_CANDIDATE_TARBALL";
 const CHECKOUT_BUILD_RESULT_PREFIX = "__OPENCLAW_QA_RELEASE_CANDIDATE_TARBALL__";
 const execFileAsync = promisify(execFile);
@@ -368,7 +367,6 @@ function createClawHubEvidenceWriter(options: ProducerOptions) {
       id: SCENARIO_ID,
       title: SCENARIO_TITLE,
       sourcePath: SOURCE_PATH,
-      primaryCoverageIds: [COVERAGE_ID],
       docsRefs: ["docs/help/testing.md", "docs/concepts/qa-e2e-automation.md"],
       codeRefs: [
         SOURCE_PATH,
diff --git a/test/e2e/qa-lab/runtime/docker-artifact-proof.ts b/test/e2e/qa-lab/runtime/docker-artifact-proof.ts
index 26a65b4d481a..16426e5087d7 100644
--- a/test/e2e/qa-lab/runtime/docker-artifact-proof.ts
+++ b/test/e2e/qa-lab/runtime/docker-artifact-proof.ts
@@ -13,11 +13,9 @@ const SOURCE_PATH = "test/e2e/qa-lab/runtime/docker-artifact-proof.ts";
 
 const PROOFS = {
   "compose-setup": {
-    secondaryCoverageIds: ["docker.compose"],
     title: "Docker Compose setup evidence",
   },
   "docker-package-install": {
-    secondaryCoverageIds: ["docker.package-artifact-generation", "cli.package-manager-installs"],
     title: "Docker package install evidence",
   },
 } as const;
@@ -179,7 +177,6 @@ async function runDockerArtifactProofProducer(
       ],
       docsRefs: ["docs/install/docker.md", "docs/help/testing.md"],
       id: options.lane,
-      secondaryCoverageIds: proof.secondaryCoverageIds,
       sourcePath: SOURCE_PATH,
       title: proof.title,
     },
diff --git a/test/e2e/qa-lab/runtime/gateway-mcp-real-transports.ts b/test/e2e/qa-lab/runtime/gateway-mcp-real-transports.ts
index 86bb46d679c4..47e658fd5fae 100644
--- a/test/e2e/qa-lab/runtime/gateway-mcp-real-transports.ts
+++ b/test/e2e/qa-lab/runtime/gateway-mcp-real-transports.ts
@@ -85,11 +85,6 @@ const SCENARIOS = {
   "gateway-smoke": {
     title: "Gateway smoke evidence",
     sourcePath: "qa/scenarios/runtime/gateway-smoke.yaml",
-    primaryCoverageIds: [
-      "gateway.websocket-transport",
-      "gateway.health-apis",
-      "gateway.hello-ok-snapshot",
-    ],
     docsRefs: ["docs/gateway/index.md", "docs/concepts/qa-e2e-automation.md"],
     codeRefs: [
       SOURCE_PATH,
@@ -100,18 +95,12 @@ const SCENARIOS = {
   "mcp-gateway-connect-startup-retry": {
     title: "MCP Gateway connect startup retry",
     sourcePath: "qa/scenarios/runtime/mcp-gateway-connect-startup-retry.yaml",
-    primaryCoverageIds: [
-      "gateway.connect-request",
-      "gateway.protocol-version-negotiation",
-      "gateway.startup-retry",
-    ],
     docsRefs: ["docs/gateway/protocol.md", "docs/cli/mcp.md"],
     codeRefs: [SOURCE_PATH, "extensions/qa-lab/src/gateway-child.ts", "src/mcp/channel-bridge.ts"],
   },
   "mcp-plugin-tools-call": {
     title: "MCP plugin-tools call",
     sourcePath: "qa/scenarios/plugins/mcp-plugin-tools-call.yaml",
-    primaryCoverageIds: ["plugins.mcp-tools", "tools.invocation"],
     docsRefs: ["docs/cli/mcp.md", "docs/gateway/protocol.md"],
     codeRefs: [SOURCE_PATH, "src/mcp/plugin-tools-serve.ts", "src/mcp/plugin-tools-handlers.ts"],
   },
@@ -798,7 +787,6 @@ async function runGatewayMcpRealTransportProducer(
       id: options.scenarioId,
       title: scenario.title,
       sourcePath: scenario.sourcePath,
-      primaryCoverageIds: scenario.primaryCoverageIds,
       docsRefs: scenario.docsRefs,
       codeRefs: scenario.codeRefs,
     },
diff --git a/test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts b/test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts
index 8fa5c234d3a6..1ed2361c1883 100644
--- a/test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts
+++ b/test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts
@@ -91,7 +91,6 @@ function createWriter(options: HeartbeatRuntimeOptions) {
       id: "heartbeat-active-hours",
       title: "Heartbeat active-hours scheduler",
       sourcePath: "test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts",
-      primaryCoverageIds: ["automation.active-hours"],
       docsRefs: ["docs/gateway/heartbeat.md"],
       codeRefs: [
         "test/e2e/qa-lab/runtime/heartbeat-active-hours-runtime.ts",
diff --git a/test/e2e/qa-lab/runtime/media-talk-gateway.ts b/test/e2e/qa-lab/runtime/media-talk-gateway.ts
index 1d3e4407b5f8..42d4bcf16db4 100644
--- a/test/e2e/qa-lab/runtime/media-talk-gateway.ts
+++ b/test/e2e/qa-lab/runtime/media-talk-gateway.ts
@@ -46,7 +46,6 @@ const SCENARIOS = {
   "webchat-auto-tts": {
     title: "WebChat auto TTS delivery",
     sourcePath: "qa/scenarios/media/webchat-auto-tts.yaml",
-    primaryCoverageIds: ["media.tts", "media.outbound-voice-audio-delivery"],
     docsRefs: ["docs/tools/tts.md", "docs/tools/media-overview.md"],
     codeRefs: [
       SOURCE_PATH,
@@ -58,7 +57,6 @@ const SCENARIOS = {
   "active-talk-agent-run-status": {
     title: "Active Talk agent-run control boundaries",
     sourcePath: "qa/scenarios/runtime/active-talk-agent-run-status.yaml",
-    primaryCoverageIds: ["voice.active-talk-agent-run-status"],
     docsRefs: ["docs/nodes/talk.md", "docs/web/control-ui.md"],
     codeRefs: [
       SOURCE_PATH,
@@ -584,7 +582,6 @@ async function runMediaTalkGatewayProducer(
       id: options.scenarioId,
       title: scenario.title,
       sourcePath: scenario.sourcePath,
-      primaryCoverageIds: scenario.primaryCoverageIds,
       docsRefs: scenario.docsRefs,
       codeRefs: scenario.codeRefs,
     },
diff --git a/test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts b/test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts
index 087bc386831f..3cac4f1b27c6 100644
--- a/test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts
+++ b/test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts
@@ -1728,8 +1728,6 @@ async function main() {
       id: "qa-otel-smoke",
       title: "QA OTEL smoke evidence",
       sourcePath: "test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts",
-      primaryCoverageIds: ["telemetry.otel"],
-      secondaryCoverageIds: ["telemetry.plugin-sdk-runtime-exports"],
       docsRefs: ["docs/gateway/opentelemetry.md", "docs/concepts/qa-e2e-automation.md"],
       codeRefs: [
         "test/e2e/qa-lab/runtime/qa-otel-smoke-runtime.ts",
diff --git a/test/e2e/qa-lab/runtime/script-evidence.test.ts b/test/e2e/qa-lab/runtime/script-evidence.test.ts
index b00636f59187..e3e7fcdf6b3e 100644
--- a/test/e2e/qa-lab/runtime/script-evidence.test.ts
+++ b/test/e2e/qa-lab/runtime/script-evidence.test.ts
@@ -29,7 +29,6 @@ async function makeWriter(params: { maxDetailsBytes?: number; maxLogBytes?: numb
         id: "script-evidence-test",
         title: "Script evidence test",
         sourcePath: "test/e2e/qa-lab/runtime/script-evidence.test.ts",
-        primaryCoverageIds: ["qa.script-evidence"],
       },
     }),
   };
diff --git a/test/e2e/qa-lab/runtime/script-evidence.ts b/test/e2e/qa-lab/runtime/script-evidence.ts
index d35f64ed83b3..507859a5b744 100644
--- a/test/e2e/qa-lab/runtime/script-evidence.ts
+++ b/test/e2e/qa-lab/runtime/script-evidence.ts
@@ -29,8 +29,6 @@ type QaScriptEvidenceTarget = {
   codeRefs?: readonly string[];
   docsRefs?: readonly string[];
   id: string;
-  primaryCoverageIds?: readonly string[];
-  secondaryCoverageIds?: readonly string[];
   sourcePath: string;
   title: string;
 };
diff --git a/test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts b/test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts
index e75cae0ef429..421ccb2ca0ca 100644
--- a/test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts
+++ b/test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts
@@ -79,7 +79,6 @@ function createWriter(options: TelegramRuntimeOptions) {
       id: "telegram-bot-token",
       title: "Telegram bot token runtime startup",
       sourcePath: "test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts",
-      primaryCoverageIds: ["telegram.startup-getme"],
       docsRefs: ["docs/channels/telegram.md"],
       codeRefs: [
         "test/e2e/qa-lab/runtime/telegram-bot-token-runtime.ts",
diff --git a/test/e2e/qa-lab/runtime/update-run-package-self-upgrade.ts b/test/e2e/qa-lab/runtime/update-run-package-self-upgrade.ts
index 18f8fea20dc9..e0f90d5081d2 100644
--- a/test/e2e/qa-lab/runtime/update-run-package-self-upgrade.ts
+++ b/test/e2e/qa-lab/runtime/update-run-package-self-upgrade.ts
@@ -130,8 +130,6 @@ async function runProducer(options: ProducerOptions): Promise<QaEvidenceSummaryJ
         "docs/help/testing-updates-plugins.md",
       ],
       id: SCENARIO_ID,
-      primaryCoverageIds: ["runtime.update-run"],
-      secondaryCoverageIds: ["runtime.gateway-restart", "runtime.package-update"],
       sourcePath: SOURCE_PATH,
       title: "Gateway update.run package self-upgrade",
     },
diff --git a/test/e2e/qa-lab/runtime/voice-call-gateway.ts b/test/e2e/qa-lab/runtime/voice-call-gateway.ts
index 137a5403a6df..866e1965fa2f 100644
--- a/test/e2e/qa-lab/runtime/voice-call-gateway.ts
+++ b/test/e2e/qa-lab/runtime/voice-call-gateway.ts
@@ -328,7 +328,6 @@ async function runVoiceCallGatewayProducer(
       id: "voice-call-cli-rpc-agent-tool",
       title: "Voice Call CLI, RPC, and agent tool flow",
       sourcePath: "qa/scenarios/plugins/voice-call-cli-rpc-agent-tool.yaml",
-      primaryCoverageIds: ["voice-call.cli-rpc-agent-tool"],
       docsRefs: ["docs/cli/voicecall.md", "docs/plugins/voice-call.md"],
       codeRefs: [
         SOURCE_PATH,
diff --git a/test/scripts/ci-workflow-guards.test.ts b/test/scripts/ci-workflow-guards.test.ts
index 874bb23961fb..504f78b13b14 100644
--- a/test/scripts/ci-workflow-guards.test.ts
+++ b/test/scripts/ci-workflow-guards.test.ts
@@ -5055,12 +5055,11 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
       (step: WorkflowStep) => step.name === "Build CI manifest",
     );
     const taxonomy = parse(readFileSync("taxonomy.yaml", "utf8")) as {
-      profiles: Array<{ id: string; categoryIds: string[] }>;
+      surfaces: Array<{ id: string; categories: Array<{ id: string }> }>;
     };
-    const smokeProfile = taxonomy.profiles.find((profile) => profile.id === "smoke-ci");
-    if (!smokeProfile) {
-      throw new Error("taxonomy.yaml is missing the smoke-ci profile");
-    }
+    const taxonomyCategoryIds = taxonomy.surfaces.flatMap((surface) =>
+      surface.categories.map((category) => `${surface.id}.${category.id}`),
+    );
     const fastCoreJob = workflow.jobs["checks-fast-core"];
     const runStep = fastCoreJob.steps.find(
       (step: WorkflowStep) => step.name === "Run ${{ matrix.task }} (${{ matrix.runtime }})",
@@ -5083,8 +5082,8 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
 
     expect(preflightStep.run).not.toContain("qa-smoke-profile");
     expect(preflightStep.run).not.toContain("qa_category");
-    expect(smokeProfile.categoryIds).toHaveLength(30);
-    for (const categoryId of smokeProfile.categoryIds) {
+    expect(taxonomyCategoryIds.length).toBeGreaterThan(0);
+    for (const categoryId of taxonomyCategoryIds) {
       expect(ciWorkflowText).not.toContain(`"${categoryId}"`);
     }
     expect(runStep.run).toContain("bundled-protocol)");