diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0c7e3de4..6a4abebcb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -215,10 +215,14 @@ jobs:
           bash scripts/release-lint.sh --sync-only
 
   test:
+    # No ubuntu-latest leg: `coverage` runs this same `cargo test
+    # --workspace` (debug, default features, plus Go and vexctl) on ubuntu,
+    # instrumented, and fails on any test failure. A plain ubuntu leg ran
+    # every Linux test a second time for ~12 job-minutes per run.
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 50
     steps:
@@ -371,9 +375,10 @@ jobs:
   coverage:
     # Code coverage via cargo-llvm-cov (LLVM source-based instrumentation).
     # Reports as a markdown table in the job summary and uploads the raw
-    # lcov.info file as a workflow artifact. No threshold gating — this is
-    # report-only so contributors get visibility without flaky CI when
-    # coverage shifts naturally with test edits.
+    # lcov.info file as a workflow artifact. No threshold gating — the
+    # numbers are report-only so contributors get visibility without flaky
+    # CI when coverage shifts naturally with test edits. A failing TEST
+    # fails the job: this is the Linux leg of `test`.
     runs-on: ubuntu-latest
     timeout-minutes: 35
     permissions:
@@ -406,6 +411,29 @@ jobs:
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      - name: Install Go (for vexctl and the real-go suites)
+        # This job is the Linux leg of `test` (see there): same Go pin.
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: '1.24'
+          cache: false
+
+      - name: Install vexctl
+        # The v0.3.0 Linux release binary, as in `test`'s vexctl step.
+        env:
+          VEXCTL_VERSION: v0.3.0
+          VEXCTL_SHA256_LINUX_AMD64: cd7f8b57d20642166ed4eb3dd1fd849bbb30bbd7c5b9f5b0316b6003b57ceaba
+        run: |
+          set -euo pipefail
+          dir="$RUNNER_TEMP/vexctl-bin"
+          mkdir -p "$dir"
+          curl -fsSL --retry 5 --retry-all-errors -o "$dir/vexctl" \
+            "https://github.com/openvex/vexctl/releases/download/$VEXCTL_VERSION/vexctl-linux-amd64"
+          echo "$VEXCTL_SHA256_LINUX_AMD64  $dir/vexctl" | sha256sum -c -
+          chmod +x "$dir/vexctl"
+          "$dir/vexctl" version
+          echo "$dir" >> "$GITHUB_PATH"
+
       - name: Run tests with coverage
         # Two-step pattern: `--no-report` runs instrumented tests and
         # collects the raw profile data, then the two `report` calls
@@ -418,8 +446,14 @@ jobs:
         # docker-e2e feature — those tests need Docker images this job
         # doesn't build. The coverage-docker matrix covers them
         # separately, and coverage-merge stitches everything together.
+        #
+        # This is also the gating Linux test run (`test` has no ubuntu
+        # leg), hence `test`'s Go env and `--no-fail-fast`.
+        env:
+          SOCKET_PATCH_GO_E2E_REQUIRED: '1'
+          SOCKET_PATCH_GO_E2E_VERSION: '1.24'
         run: |
-          cargo llvm-cov --workspace \
+          cargo llvm-cov --workspace --no-fail-fast \
             --no-report
           cargo llvm-cov report --lcov --output-path coverage-host.lcov
           cargo llvm-cov report --summary-only | tee coverage-summary.txt
@@ -1479,7 +1513,7 @@ jobs:
   # steps.
   e2e-full:
     if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
-    needs: [test, e2e-build]
+    needs: [test, coverage, e2e-build]
     strategy:
       fail-fast: false
       matrix:
@@ -1616,7 +1650,7 @@ jobs:
   # ----------------------------------------------------------------------
   yarn-classic-matrix:
     name: yarn-classic ${{ matrix.release }}
-    needs: test
+    needs: [test, coverage]
     runs-on: ubuntu-latest
     timeout-minutes: 40
     strategy:
@@ -1652,7 +1686,7 @@ jobs:
 
   yarn-berry-e2e:
     name: yarn-berry ${{ matrix.yarn }} (${{ matrix.os }})
-    needs: test
+    needs: [test, coverage]
     strategy:
       fail-fast: false
       matrix:
@@ -1693,7 +1727,7 @@ jobs:
   yarn-berry-full:
     name: yarn-berry ${{ matrix.yarn }} (${{ matrix.os }})
     if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
-    needs: test
+    needs: [test, coverage]
     strategy:
       fail-fast: false
       matrix:
@@ -1714,7 +1748,7 @@ jobs:
   # e2e_safety_cargo_build (its headline test honours the knobs).
   cargo-vex-matrix:
     name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
-    needs: [test, e2e-build]
+    needs: [test, coverage, e2e-build]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
     # What .cargo/config.toml's [env] gives processes cargo launches; these
@@ -1785,7 +1819,7 @@ jobs:
   cargo-vex-matrix-full:
     name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
     if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
-    needs: [test, e2e-build]
+    needs: [test, coverage, e2e-build]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
     # What .cargo/config.toml's [env] gives processes cargo launches; these
@@ -1817,7 +1851,7 @@ jobs:
   # available; this leg pulls both images and requires them.
   cargo-old-toolchains:
     name: cargo old toolchains (manifest [patch])
-    needs: test
+    needs: [test, coverage]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps: