diff --git a/TESTING.md b/TESTING.md
index a1c2f9476e..0f255c1f36 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -305,8 +305,8 @@ Rust feature and preloads its Python workload image into the rootless Podman
 store. The separate `driver-podman` testsuite compares OpenShell and direct
 Podman user-namespace mappings for the default, `auto`, `keep-id`, and private
 profiles. The E2E archive excludes binaries that still depend on wrapper-owned
-gateway controls, host fixtures, missing guest tools, or nondeterministic relay
-setup. The `driver-podman` suite replaces the removed `podman_userns` E2E
+gateway controls, SPIFFE fixtures, the caller driver-config setting, or other
+guest setup. The `driver-podman` suite replaces the removed `podman_userns` E2E
 binary. `tests/artifacts.nix` keeps the follow-up exclusions explicit and uses
 the same filter for the generated inventory, so excluded binaries cannot appear
 as false passes or silently re-enter the archive.
diff --git a/tests/artifacts.nix b/tests/artifacts.nix
index c86d8f6d30..72fe4c2c36 100644
--- a/tests/artifacts.nix
+++ b/tests/artifacts.nix
@@ -96,32 +96,29 @@ let
     output = "artifacts/test-archives/${muslToolchain.target}/provider-refresh-keycloak-tests.tar";
   };
 
-  # Follow-up: migrate these wrapper-coupled tests once tmachine provides their
-  # managed-gateway controls, SPIFFE fixtures, caller driver-config setting,
-  # guest tools, and matching workload-image identity behavior. The corporate
-  # proxy and gateway-start binaries currently self-skip without wrapper-owned
-  # gateway metadata, so exclude them rather than report false passes.
+  # Follow-up: binaries that do not yet run in the rootless tmachine guest. Each
+  # entry says what it needs. Entries marked "wrapper lane" still run in the
+  # wrapper-based Podman lane (`mise run e2e:podman:ci`), so they are covered
+  # there until tmachine provides what they need.
   podmanE2eFollowUpBinaries = [
-    "credential_gating"
+    # Needs the caller driver-config settings (`allow_driver_config`,
+    # `enable_bind_mounts`), which the tmachine gateway does not enable. Wrapper
+    # lane.
     "driver_config_volume"
-    "forward_proxy_graphql_l7"
-    "forward_proxy_jsonrpc_l7"
-    "forward_proxy_l7_bypass"
-    "host_gateway_alias"
-    "landlock"
+    # The next three self-skip without wrapper-owned gateway metadata (restart
+    # and configuration control), so exclude them rather than report false
+    # passes. Wrapper lane.
     "local_driver_token_restart"
-    # Standalone tmachine runs can time out while opening the localhost relay.
-    # Follow up on making the relay setup deterministic before restoring it.
-    "no_proxy"
     "podman_corporate_proxy"
     "podman_gateway_start"
-    "podman_oci_identity"
+    # Its move to conformance is deferred until the isolation work in #4120; see
+    # #4246.
     "provider_auto_create"
-    # The provider-refresh feature suite covers revoked Keycloak grants. This
-    # binary instead covers stable workload handles across repeated rotations
-    # and explicit refresh reconfiguration in a long-running sandbox.
-    "provider_refresh_handles"
+    # Needs the SPIFFE fixtures that the wrapper sets up. Wrapper lane.
     "provider_token_exchange"
+    # One test times out reaching support-container IPs from the sandbox in the
+    # rootless guest; the other tests in the binary pass. Nextest archive
+    # filters cannot select individual tests, so keep the complete binary here.
     "proxy_egress_pipeline"
     # Conformance covers stop/start workspace preservation and deletion while
     # stopped. The remaining canonical-main, TTY, attachment replay, and
@@ -130,7 +127,6 @@ let
     "sandbox_lifecycle"
     # Needs a prebuilt musl DNS probe in guest artifact mode; tracked in #3009.
     "transparent_tcp"
-    "websocket_conformance"
     "workspace_lifecycle"
   ];
   podmanE2eArchiveFilter =