@@ -796,7 +796,7 @@ cargo test --manifest-path e2e/rust/Cargo.toml --features e2e --test sync
 Run a single Docker-only test directly with cargo:
 
 ```shell
-cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test docker_preflight
+cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test docker_corporate_proxy
 ```
 
 The harness (`e2e/rust/src/harness/`) provides:
 
@@ -0,0 +1,142 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! `openshell doctor check` against a fake `docker` on `PATH`, so the result
+//! doesn't depend on the host's Docker.
+
+#![cfg(unix)]
+
+use std::fs;
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+struct Doctor {
+    combined: String,
+    code: i32,
+    elapsed: Duration,
+}
+
+/// Run `openshell doctor check` with only `bin` on `PATH`.
+fn doctor_check(bin: &Path) -> Doctor {
+    let home = tempfile::tempdir().expect("create isolated config dir");
+    let start = Instant::now();
+    let output = Command::new(env!("CARGO_BIN_EXE_openshell"))
+        .args(["doctor", "check"])
+        .env("XDG_CONFIG_HOME", home.path())
+        .env("HOME", home.path())
+        .env("PATH", bin)
+        .env("NO_COLOR", "1")
+        .env_remove("DOCKER_HOST")
+        .env_remove("OPENSHELL_GATEWAY")
+        .env_remove("OPENSHELL_GATEWAY_ENDPOINT")
+        .stdin(Stdio::null())
+        .output()
+        .expect("run openshell doctor check");
+    Doctor {
+        combined: format!(
+            "{}{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        ),
+        code: output.status.code().unwrap_or(-1),
+        elapsed: start.elapsed(),
+    }
+}
+
+/// Write an executable `docker` script to `bin` that records its arguments
+/// in `bin/docker-args` and then runs `body`.
+fn fake_docker(bin: &Path, body: &str) {
+    let docker = bin.join("docker");
+    let args = bin.join("docker-args");
+    fs::write(
+        &docker,
+        format!(
+            "#!/bin/sh\nprintf '%s\\n' \"$*\" > '{}'\n{body}\n",
+            args.display()
+        ),
+    )
+    .expect("write fake docker");
+    fs::set_permissions(&docker, fs::Permissions::from_mode(0o755)).expect("chmod fake docker");
+}
+
+fn docker_args(bin: &Path) -> String {
+    fs::read_to_string(bin.join("docker-args")).unwrap_or_default()
+}
+
+#[test]
+fn doctor_check_passes_when_docker_info_succeeds() {
+    let bin = tempfile::tempdir().expect("create fake bin dir");
+    fake_docker(bin.path(), "echo 27.3.1");
+
+    let doctor = doctor_check(bin.path());
+    assert_eq!(doctor.code, 0, "doctor check failed:\n{}", doctor.combined);
+    assert_eq!(
+        docker_args(bin.path()).trim(),
+        "info --format {{.ServerVersion}}",
+        "doctor check ran docker with unexpected arguments"
+    );
+    for expected in ["Docker", "ok (version 27.3.1)", "All checks passed"] {
+        assert!(
+            doctor.combined.contains(expected),
+            "expected {expected:?} in doctor check output:\n{}",
+            doctor.combined
+        );
+    }
+}
+
+#[test]
+fn doctor_check_fails_fast_when_docker_info_fails() {
+    let bin = tempfile::tempdir().expect("create fake bin dir");
+    fake_docker(
+        bin.path(),
+        "echo 'Cannot connect to the Docker daemon' >&2\nexit 1",
+    );
+
+    let doctor = doctor_check(bin.path());
+    assert_ne!(
+        doctor.code, 0,
+        "doctor check passed although docker info failed:\n{}",
+        doctor.combined
+    );
+    assert!(
+        doctor.elapsed < Duration::from_secs(10),
+        "doctor check took {:?}",
+        doctor.elapsed
+    );
+    for expected in [
+        "Docker",
+        "FAILED",
+        "docker info failed",
+        "Cannot connect to the Docker daemon",
+    ] {
+        assert!(
+            doctor.combined.contains(expected),
+            "expected {expected:?} in doctor check output:\n{}",
+            doctor.combined
+        );
+    }
+    assert!(
+        !doctor.combined.contains("All checks passed"),
+        "doctor check reported success:\n{}",
+        doctor.combined
+    );
+}
+
+#[test]
+fn doctor_check_fails_without_docker_on_path() {
+    let bin = tempfile::tempdir().expect("create empty bin dir");
+
+    let doctor = doctor_check(bin.path());
+    assert_ne!(
+        doctor.code, 0,
+        "doctor check passed without docker:\n{}",
+        doctor.combined
+    );
+    assert!(
+        doctor.combined.contains("failed to execute docker info"),
+        "doctor check did not report that docker could not run:\n{}",
+        doctor.combined
+    );
+}
@@ -0,0 +1,137 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! An incoherent driver proxy table is fatal, rather than leaving every dial
+//! direct while looking configured. A bypass list without a proxy URL means
+//! the operator believed proxying was in effect.
+
+#![cfg(unix)]
+
+use std::fs;
+use std::path::PathBuf;
+use std::process::Output;
+use std::time::Duration;
+
+/// Drivers with an upstream proxy table, compiled into this gateway.
+const DRIVERS: &[&str] = &[
+    #[cfg(feature = "compute-driver-docker")]
+    "docker",
+    #[cfg(feature = "compute-driver-podman")]
+    "podman",
+    #[cfg(feature = "compute-driver-vm")]
+    "vm",
+];
+
+struct Fixture {
+    root: tempfile::TempDir,
+    config: PathBuf,
+}
+
+impl Fixture {
+    /// A gateway config that selects `driver` and sets only `no_proxy` in its
+    /// table.
+    fn incoherent(driver: &str) -> Self {
+        let root = tempfile::tempdir().expect("fixture root");
+        let config = root.path().join("gateway.toml");
+        fs::write(
+            &config,
+            format!(
+                "[openshell]
+version = 2
+[openshell.gateway]
+disable_tls = true
+bind_address = \"127.0.0.1:0\"
+compute_driver = {driver:?}
+[openshell.gateway.auth]
+allow_unauthenticated_users = true
+[openshell.drivers.{driver}]
+no_proxy = \"10.0.0.0/8\"
+"
+            ),
+        )
+        .expect("gateway configuration");
+        Self { root, config }
+    }
+
+    async fn run(&self, args: &[&str]) -> Output {
+        let mut command = tokio::process::Command::new(env!("CARGO_BIN_EXE_openshell-gateway"));
+        command
+            .env_clear()
+            .env("HOME", self.root.path())
+            .env("PATH", "/usr/bin:/bin")
+            .env("NO_COLOR", "1")
+            .env("XDG_CONFIG_HOME", self.root.path().join("config-home"))
+            .env("XDG_STATE_HOME", self.root.path().join("state-home"))
+            .args(args)
+            .kill_on_drop(true);
+        tokio::time::timeout(Duration::from_secs(30), command.output())
+            .await
+            .expect("the gateway must exit instead of starting")
+            .expect("run openshell-gateway")
+    }
+
+    fn config_path(&self) -> &str {
+        self.config.to_str().expect("UTF-8 config path")
+    }
+}
+
+fn combined(output: &Output) -> String {
+    format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    )
+}
+
+#[test]
+fn proxy_drivers_are_compiled_in() {
+    assert!(
+        !DRIVERS.is_empty(),
+        "build with a compute driver that has a proxy table"
+    );
+}
+
+#[tokio::test]
+async fn preflight_rejects_no_proxy_without_proxy() {
+    for driver in DRIVERS {
+        let fixture = Fixture::incoherent(driver);
+        let original = fs::read(&fixture.config).expect("original config");
+        let output = fixture
+            .run(&["config", "preflight", "--path", fixture.config_path()])
+            .await;
+        assert!(
+            !output.status.success(),
+            "preflight accepted an incoherent [openshell.drivers.{driver}] proxy table:\n{}",
+            combined(&output)
+        );
+        assert!(
+            combined(&output).contains("category=malformed"),
+            "preflight did not classify the {driver} config as malformed:\n{}",
+            combined(&output)
+        );
+        assert_eq!(
+            fs::read(&fixture.config).expect("config after preflight"),
+            original,
+            "preflight changed the {driver} config"
+        );
+    }
+}
+
+#[tokio::test]
+async fn startup_rejects_no_proxy_without_proxy_and_names_the_keys() {
+    for driver in DRIVERS {
+        let fixture = Fixture::incoherent(driver);
+        let output = fixture.run(&["--config", fixture.config_path()]).await;
+        let report = combined(&output);
+        assert!(
+            !output.status.success(),
+            "the gateway started with an incoherent [openshell.drivers.{driver}] proxy table:\n{report}"
+        );
+        // Matched on the key names, not the wording, so error wrapping can
+        // change.
+        assert!(
+            report.contains("no_proxy") && report.contains("https_proxy"),
+            "the {driver} startup error does not name the offending keys:\n{report}"
+        );
+    }
+}
@@ -3099,11 +3099,21 @@ mod tests {
 
     async fn start_plaintext_gateway_listener()
     -> (SocketAddr, watch::Sender<bool>, tokio::task::JoinHandle<()>) {
+        start_plaintext_gateway_listener_with_tunnel(false).await
+    }
+
+    async fn start_plaintext_gateway_listener_with_tunnel(
+        enable_websocket_tunnel: bool,
+    ) -> (SocketAddr, watch::Sender<bool>, tokio::task::JoinHandle<()>) {
         let listener = TcpListener::bind("127.0.0.1:0")
             .await
             .expect("failed to bind test listener");
         let listen_addr = listener.local_addr().expect("failed to read local addr");
-        let state = test_state(listen_addr, false).await;
+        let mut state = test_state(listen_addr, false).await;
+        Arc::get_mut(&mut state)
+            .expect("test server state should be uniquely owned")
+            .config
+            .enable_websocket_tunnel = enable_websocket_tunnel;
         let service = MultiplexService::new(state);
         let (shutdown_tx, shutdown_rx) = watch::channel(false);
         let handle = tokio::spawn(serve_gateway_listener(
@@ -3159,6 +3169,68 @@ mod tests {
         stop_listener(shutdown, handle).await;
     }
 
+    /// The edge-tunnel client path: gRPC carried in binary frames over a
+    /// WebSocket to `/_ws_tunnel` on the production listener reaches the
+    /// gateway's own services.
+    #[tokio::test]
+    async fn production_gateway_listener_serves_grpc_through_websocket_tunnel() {
+        use futures::{SinkExt as _, StreamExt as _};
+        use openshell_core::proto::{
+            HealthRequest, ServiceStatus, open_shell_client::OpenShellClient,
+        };
+        use tokio_tungstenite::tungstenite::Message;
+
+        let (addr, shutdown, handle) = start_plaintext_gateway_listener_with_tunnel(true).await;
+        let ws_url = format!("ws://127.0.0.1:{}/_ws_tunnel", addr.port());
+        let channel = tonic::transport::Endpoint::from_static("http://edge-tunnel.invalid")
+            .connect_with_connector(tower::service_fn(move |_| {
+                let ws_url = ws_url.clone();
+                async move {
+                    let (ws, _) = tokio_tungstenite::connect_async(ws_url)
+                        .await
+                        .map_err(Error::other)?;
+                    let (mut ws_sink, mut ws_source) = ws.split();
+                    let (client, bridge) = tokio::io::duplex(64 * 1024);
+                    let (mut bridge_read, mut bridge_write) = tokio::io::split(bridge);
+                    tokio::spawn(async move {
+                        let mut buf = vec![0u8; 32 * 1024];
+                        while let Ok(n @ 1..) = bridge_read.read(&mut buf).await {
+                            if ws_sink
+                                .send(Message::Binary(buf[..n].to_vec().into()))
+                                .await
+                                .is_err()
+                            {
+                                break;
+                            }
+                        }
+                        let _ = ws_sink.close().await;
+                    });
+                    tokio::spawn(async move {
+                        while let Some(Ok(Message::Binary(data))) = ws_source.next().await {
+                            if bridge_write.write_all(&data).await.is_err() {
+                                break;
+                            }
+                        }
+                        let _ = bridge_write.shutdown().await;
+                    });
+                    Ok::<_, Error>(hyper_util::rt::TokioIo::new(client))
+                }
+            }))
+            .await
+            .expect("gRPC channel through the WebSocket tunnel");
+
+        let response = tokio::time::timeout(
+            Duration::from_secs(10),
+            OpenShellClient::new(channel).health(HealthRequest {}),
+        )
+        .await
+        .expect("health RPC through the tunnel timed out")
+        .expect("health RPC through the tunnel");
+        assert_eq!(response.get_ref().status, ServiceStatus::Healthy as i32);
+
+        stop_listener(shutdown, handle).await;
+    }
+
     async fn send_plain_http(addr: SocketAddr, request: String) -> String {
         let connect_addr: SocketAddr = format!("127.0.0.1:{}", addr.port())
             .parse()