@@ -106,14 +106,17 @@ K3s development default, currently v1.0.3. OpenShell also supports v0.4.6 throug
 its v1alpha1 fallback, so v0.5.0 is not the overall minimum supported version.
 
 The conformance CLI runs on the K3s node inside the tmachine guest and connects
-directly to the gateway's default ClusterIP Service on port 8080. Installation
-discovers the Service IP and registers it once; the installed disk preserves that
-registration across test boots. Automated boots wait for the API, nodes, gateway
-StatefulSet and a connected CLI before conformance. Interactive shell boots skip
-this preparation so failed gateways remain debuggable. Recreating the Service
-requires reprovisioning the fixture rather than repairing registrations at boot.
-Installation, preparation and conformance failures preserve bounded diagnostics
-under `artifacts/tmachine-diagnostics`, also uploaded by `Integration Tests`.
+directly to the gateway's default ClusterIP Service on its gRPC port. Installation
+discovers the Service address and registers it once; the installed disk preserves that
+registration across test boots. Recreating the Service requires reprovisioning
+the fixture rather than repairing registrations at boot. K3s installation and
+conformance failures preserve bounded diagnostics under
+`artifacts/tmachine-diagnostics`, also uploaded by `Integration Tests`.
+
+On every installer, the conformance playbook waits up to five minutes for
+`openshell status` to report a connected gateway before running tests, because
+each test boot restarts the gateway. Interactive shell boots skip this wait so
+failed gateways remain debuggable.
 
 ### Run only the policy advisor conformance tests
 
 
@@ -55,6 +55,20 @@
       register: openshell_cli
       changed_when: false
 
+    # Every test boot restarts the gateway, and some installers take minutes to
+    # recover. Wait once here; the runner's per-scenario preflight stays short.
+    - name: Wait for the registered gateway
+      ansible.builtin.command:
+        argv: [timeout, 10s, "{{ openshell_cli.stdout }}", status, --output, json]
+      register: gateway_status
+      changed_when: false
+      until: >-
+        gateway_status.rc == 0 and
+        (gateway_status.stdout | from_json).status == 'connected'
+      retries: 60
+      delay: 5
+      ignore_errors: true
+
     - name: Run OpenShell conformance archive
       ansible.builtin.command:
         argv:
@@ -77,13 +91,14 @@
       register: conformance_result
       changed_when: false
       failed_when: false
+      when: gateway_status is succeeded
 
     # Preserve both streams for failures without adding passing-test output to
     # every tmachine run.
     - name: Show OpenShell conformance diagnostics
       ansible.builtin.debug:
         var: conformance_result
-      when: conformance_result.rc != 0
+      when: conformance_result.rc | default(0) != 0
 
     - name: Read OpenShell gateway logs
       become: true
@@ -99,17 +114,23 @@
       register: openshell_gateway_logs
       changed_when: false
       failed_when: false
-      when: conformance_result.rc != 0
+      when: conformance_result.rc | default(1) != 0
 
     - name: Show OpenShell gateway logs
       ansible.builtin.debug:
         var: openshell_gateway_logs.stdout_lines
-      when: conformance_result.rc != 0
+      when: conformance_result.rc | default(1) != 0
 
     - name: Collect K3s conformance diagnostics
       ansible.builtin.include_role:
         name: openshell_k3s_diagnostics
-      when: conformance_result.rc != 0
+      when: conformance_result.rc | default(1) != 0
+
+    - name: Require a connected gateway
+      ansible.builtin.assert:
+        that:
+          - gateway_status is succeeded
+        fail_msg: OpenShell gateway did not connect before conformance; see gateway diagnostics
 
     - name: Require OpenShell conformance success
       ansible.builtin.assert:
 
@@ -139,16 +139,27 @@
           environment:
             KUBECONFIG: /etc/rancher/k3s/k3s.yaml
 
-        - name: Discover the gateway ClusterIP
-          ansible.builtin.command: /usr/local/bin/k3s kubectl --request-timeout=10s --namespace openshell get service openshell --output=jsonpath={.spec.clusterIP}
-          register: k3s_gateway_ip
+        - name: Discover the gateway ClusterIP and gRPC port
+          ansible.builtin.command:
+            argv:
+              - /usr/local/bin/k3s
+              - kubectl
+              - --request-timeout=10s
+              - --namespace
+              - openshell
+              - get
+              - service
+              - openshell
+              - --output=jsonpath={.spec.clusterIP}:{.spec.ports[?(@.name=="grpc")].port}
+          register: k3s_gateway_address
           changed_when: false
 
+        # Rejects headless Services (ClusterIP "None") and a missing grpc port.
         - name: Require a gateway Service address
           ansible.builtin.assert:
             that:
-              - k3s_gateway_ip.stdout | length > 0
-              - k3s_gateway_ip.stdout != 'None'
+              - k3s_gateway_address.stdout is match('^[0-9.]+:[0-9]+$')
+            fail_msg: "Unexpected gateway Service address: {{ k3s_gateway_address.stdout }}"
       rescue:
         - name: Collect K3s installation diagnostics
           ansible.builtin.include_role:
@@ -162,7 +173,6 @@
   hosts: all
   gather_facts: false
   vars:
-    openshell_client_gateway_endpoint: "http://{{ k3s_gateway_ip.stdout }}:8080"
+    openshell_client_gateway_endpoint: "http://{{ k3s_gateway_address.stdout }}"
   roles:
     - openshell_client
-    - openshell_k3s_ready
 
@@ -23,8 +23,14 @@ collect() {
     -p ExecMainPID -p ActiveEnterTimestamp -p ExecMainStartTimestamp \
     -p StartLimitIntervalUSec -p StartLimitBurst -p RestartUSec
   collect 'K3s boot journal' journalctl -b --no-pager --lines=500 -u k3s.service
-  collect 'Gateway Service routing rules' bash -c \
-    'iptables-save | awk "/openshell\/openshell:grpc/ { print }"'
+  # kube-proxy may program either iptables backend; dump whichever exist.
+  # shellcheck disable=SC2016 # Expanded by the inner shell.
+  collect 'Gateway Service routing rules' bash -c '
+    for save in iptables-nft-save iptables-legacy-save; do
+      command -v "$save" >/dev/null || continue
+      echo "# $save"
+      "$save" 2>/dev/null | awk "/openshell\/openshell:grpc/ { print }"
+    done'
   collect 'K3s version' /usr/local/bin/k3s --version
   collect 'API readiness' /usr/local/bin/k3s kubectl --request-timeout=5s get --raw=/readyz
   collect 'Nodes' /usr/local/bin/k3s kubectl --request-timeout=5s get nodes -o wide
 
@@ -26,6 +26,6 @@
     - name: Fetch K3s diagnostics
       ansible.builtin.fetch:
         src: /var/lib/openshell/diagnostics/k3s.txt
-        dest: "{{ lookup('env', 'TMACHINE_DIAGNOSTICS_DIR') | default(role_path + '/../../../../artifacts/tmachine-diagnostics', true) }}/{{ inventory_hostname }}/k3s.txt"
+        dest: "{{ role_path }}/../../../../artifacts/tmachine-diagnostics/{{ inventory_hostname }}/k3s.txt"
         flat: true
       failed_when: false
@@ -85,7 +85,6 @@ let
         name = "k3s";
         use_galaxy = false;
         playbooks = [ "ansible/playbooks/openshell-k3s.yaml" ];
-        prepare_playbooks = [ "ansible/playbooks/openshell-k3s-ready.yaml" ];
         inputs = {
           agent_sandbox_version = "0.5.0";
           openshell_cli_binary = "../artifacts/binaries/${muslTarget}/openshell";
@@ -214,7 +213,6 @@ let
       root=$(git rev-parse --show-toplevel)
       cd "$root/tests"
       export ANSIBLE_CONFIG="$PWD/ansible/ansible.cfg"
-      export TMACHINE_DIAGNOSTICS_DIR="$root/artifacts/tmachine-diagnostics"
       exec ${tmachine}/bin/tmachine --config ${config} "$@"
     '';
   };
 
@@ -40,34 +40,6 @@ pub struct Installer {
     pub use_galaxy: bool,
     pub playbooks: Vec<PathBuf>,
     pub inputs: BTreeMap<String, PathBuf>,
-    /// Readiness checks run on non-interactive test boots, including cached installations.
-    #[serde(default)]
-    pub prepare_playbooks: Vec<PathBuf>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::Installer;
-
-    #[test]
-    fn existing_installers_need_no_boot_preparation() {
-        let installer: Installer =
-            serde_saphyr::from_str("name: none\nuse_galaxy: false\nplaybooks: []\ninputs: {}\n")
-                .unwrap();
-        assert!(installer.prepare_playbooks.is_empty());
-    }
-
-    #[test]
-    fn installer_can_request_boot_preparation() {
-        let installer: Installer = serde_saphyr::from_str(
-            "name: k3s\nuse_galaxy: false\nplaybooks: []\ninputs: {}\nprepare_playbooks: [ready.yaml]\n",
-        )
-        .unwrap();
-        assert_eq!(
-            installer.prepare_playbooks,
-            [std::path::PathBuf::from("ready.yaml")]
-        );
-    }
 }
 
 #[derive(Clone, Deserialize)]
 
@@ -26,11 +26,6 @@ pub async fn test(
     let image = QemuImage::create(&install_disk, test_disk).await;
     let vm = QemuVm::start(&image).await;
 
-    // Installation readiness does not survive the shutdown of the cached VM.
-    // Keep the interactive shell accessible when diagnosing boot failures.
-    if !testsuite.interactive {
-        run_playbooks(&installer.prepare_playbooks, &installer.inputs).await?;
-    }
     run_playbooks(&testsuite.playbooks, &testsuite.inputs).await?;
 
     if testsuite.interactive {