diff --git a/docs/USAGE.md b/docs/USAGE.md
index 709a4c5..5dcb60b 100644
--- a/docs/USAGE.md
+++ b/docs/USAGE.md
@@ -68,8 +68,8 @@ All commands live under the `xmsconan` umbrella:
 | `xmsconan gen` | Render build files (`conanfile.py`, `build.py`, `CMakeLists.txt`, `_package/pyproject.toml`, …) from `build.toml`. |
 | `xmsconan ci` | Render `.github/workflows/<Lib>-CI.yaml` or `.gitlab-ci.yml`. |
 | `xmsconan build` | Run `conan install` + `cmake configure` against a single profile. Used by the generated `build.py`; also useful for one-off configures. |
-| `xmsconan coverage` | Run the unified C++/Python coverage pipeline and enforce the `[coverage]` thresholds (see §11). |
-| `xmsconan test-shards` | Run a staged gtest runner as N parallel shards inside the current container and merge their JUnit reports into one. What the generated GitLab `Run C++ Tests` job calls (see §10.2). |
+| `xmsconan coverage` | Run the unified C++/Python coverage pipeline and enforce the `[coverage]` thresholds (see §11). `--phase collect` stops after producing the reports; `--phase report` gates an existing set of them (§11.4). |
+| `xmsconan test-shards` | Run a staged gtest runner as N parallel shards inside the current container and merge their JUnit reports into one. What the generated GitLab `Run C++ Tests - <label>` jobs call (see §10.2). |
 | `xmsconan vs2019` | Drive the manual Visual Studio 2019 (msvc 192) build and publish it to the `aquaveo-vs2019` remote (see §16). Never runs in CI. |
 | `xmsconan conan-setup` | Detect a Conan profile, add the aquaveo remote, optionally login. The password comes from `--password-file`, `$CONAN_PASSWORD`, or `~/.xmsconan.toml` — there is no `--password` flag (§17). |
 | `xmsconan wheel-repair` | Run platform-appropriate wheel repair (auditwheel / delocate / delvewheel). |
@@ -200,8 +200,8 @@ These drive the CI templates. All optional.
 | `[ci].deploy` | `true` | Emit deploy jobs (only run on tag pushes). |
 | `[ci].coverage` | `false` | Emit a coverage job. On GitLab adds a `Coverage` stage + Pages upload; on GitHub adds a separate `Coverage.yaml` workflow. Both delegate to `xmsconan coverage`. Thresholds and filters come from `[coverage]` (see §5.7). |
 | `[ci].xvfb` | `false` | Wrap test execution in `xvfb-run` (use for libraries that link X11/VTK). |
-| `[ci].split_tests` | `false` | Split build and C++ test into two stages so testing artifacts can be reused. |
-| `[ci].test_shards` | `0` | When >1, run the C++ tests as N gtest shards **inside a single container**. The recipe skips `cmake.test()` in this mode, so the shards are the only thing that runs the C++ tests — a missing runner binary fails the build rather than being skipped. On GitLab it needs `split_tests = true` and reaches the `Run C++ Tests` job as `xmsconan_test_shards --shards N`, which forks N runner processes and merges their JUnit XML into one `TEST-cxxtest.xml` (§10.2). On GitHub, where the build job runs its own tests, it reaches `build.py --test-shards N` in every platform job instead. This was previously GitLab's `parallel: N`, which bought its concurrency by starting N containers — each one repeating the container start, the `pip install` and the artifact download to run one Nth of the suite. |
+| `[ci].split_tests` | `false` | Split build and C++ test into two stages so testing artifacts can be reused. The `Test` stage gets one `Run C++ Tests - <label>` job per testing configuration the build stages — `Release-testing` and `Debug-testing` on the default matrix — each naming its own artifact directory with `--label` (§10.2). |
+| `[ci].test_shards` | `0` | When >1, run the C++ tests as N gtest shards **inside a single container**. The recipe skips `cmake.test()` in this mode, so the shards are the only thing that runs the C++ tests — a missing runner binary fails the build rather than being skipped. On GitLab it needs `split_tests = true` and reaches each `Run C++ Tests - <label>` job as `xmsconan_test_shards --shards N`, which forks N runner processes and merges their JUnit XML into one `TEST-cxxtest.xml` (§10.2). The shard count is per job, so a two-configuration matrix runs `2 × N` processes across two containers. On GitHub, where the build job runs its own tests, it reaches `build.py --test-shards N` in every platform job instead. This was previously GitLab's `parallel: N`, which bought its concurrency by starting N containers — each one repeating the container start, the `pip install` and the artifact download to run one Nth of the suite. |
 | `[ci].docker_image` | `""` | Override the build container image (skips the default Aquaveo images). |
 | `[ci].python_versions` | `["3.13"]` | Python versions to build **on Windows**. macOS and Linux take the highest entry unless they are given their own list below. Set to `["3.10", "3.13"]` to build a Windows 3.10 wheel + Conan binary in addition to 3.13. See §8. |
 | `[ci].mac_python_versions` | highest of `[ci].python_versions` | Python versions the macOS matrix fans out across. Separate from `python_versions` so a Windows-only ABI (3.10 ships in Windows wheels for the desktop products) does not silently multiply the mac matrix. See §8. |
@@ -242,8 +242,8 @@ pybind = false               # this library ships no wheel
 | Key | Accepted keys | Accepted values |
 |---|---|---|
 | top level | `os`, `arch`, `build_type`, `compiler`, `compiler.version`, `compiler.cppstd`, `compiler.runtime`, `compiler.libcxx` | A **single** value that some configuration actually carries — `"Release"`, not `["Release"]` and not `"release"`. Settings a platform doesn't emit (`compiler.runtime` off Windows) are ignored there rather than matching nothing. |
-| `[filter.options]` | `wchar_t`, `pybind`, `testing`, `python_version` | `pybind` / `testing` take `true` or `false`; `wchar_t` takes `"builtin"` or `"typedef"`; `python_version` takes a **quoted** `"X.Y"` string that appears in any of `[ci].python_versions`, `[ci].linux_python_versions` or `[ci].mac_python_versions` — a version only one platform builds still counts (unquoted `3.13` is a TOML float and is rejected). |
-| `[filter.buildenv]` | the names the generated profiles set: `XMS_VERSION`, `PYTHON_TARGET_VERSION`, `CI_COMMIT_TAG`, `RELEASE_PYTHON`, `XMS_COVERAGE`, `XMS_TEST_ARTIFACTS_DIR`, `XMS_TEST_ARTIFACTS_LABEL`, `MACOSX_DEPLOYMENT_TARGET`, `_PYTHON_HOST_PLATFORM` | A single value, compared against what the profile sets. The **name** is validated, the value is not: most of these are read from the environment at build time (`XMS_VERSION`, `CI_COMMIT_TAG`), so whether a pin matches is only knowable in the build environment and `xmsconan gen` does not judge a `[filter.buildenv]` pin unbuildable. |
+| `[filter.options]` | `wchar_t`, `pybind`, `testing`, `python_version`, `coverage` | `pybind` / `testing` take `true` or `false`; `wchar_t` takes `"builtin"` or `"typedef"`; `python_version` takes a **quoted** `"X.Y"` string that appears in any of `[ci].python_versions`, `[ci].linux_python_versions` or `[ci].mac_python_versions` — a version only one platform builds still counts (unquoted `3.13` is a TOML float and is rejected). `coverage` takes only `true`, and only in a runtime `--filter` during an `xmsconan coverage` run — normal builds omit the option entirely, so a permanent pin in build.toml's `[filter]` table would exclude every normal configuration and is rejected at generation time with a message saying so. |
+| `[filter.buildenv]` | the names the generated profiles set: `XMS_VERSION`, `PYTHON_TARGET_VERSION`, `CI_COMMIT_TAG`, `RELEASE_PYTHON`, `XMS_TEST_ARTIFACTS_DIR`, `XMS_TEST_ARTIFACTS_LABEL`, `MACOSX_DEPLOYMENT_TARGET`, `_PYTHON_HOST_PLATFORM` | A single value, compared against what the profile sets. The **name** is validated, the value is not: most of these are read from the environment at build time (`XMS_VERSION`, `CI_COMMIT_TAG`), so whether a pin matches is only knowable in the build environment and `xmsconan gen` does not judge a `[filter.buildenv]` pin unbuildable. |
 
 Everything above is checked by `xmsconan gen` and `xmsconan ci`, including whether the filter as a whole selects anything: a combination no configuration can satisfy (`testing` and `pybind` both `true`, say) fails generation rather than every later build. That check reads `[matrix]` (§5.4.1) too, since that table decides which configurations exist at all — `[matrix] compiler_runtime = ["dynamic"]` with `[filter] "compiler.runtime" = "static"` is two individually valid statements that together build nothing, and is rejected by name.
 
@@ -330,12 +330,13 @@ Standard Conan: `os`, `compiler`, `build_type`, `arch`.
 | `pybind` | `True` / `False` | `False` | Build the Python binding module + wheel. Allowed for any `build_type`. |
 | `testing` | `True` / `False` | `False` | Build the test runner. Mutually exclusive with `pybind=True` in the standard packager fan-out — the coverage runner instruments each shape in a separate Conan create rather than combining them. |
 | `python_version` | `"3.10"` / `"3.13"` / `"3.14"` | `"3.13"` | Which Python ABI to target when `pybind=True`. **Dropped from `package_id` when `pybind=False`**, so non-Python builds remain a single binary regardless. |
+| `coverage` | `True` / `False` | `False` | Instrument the build (`--coverage -O0 -g`, plus `pytest-cov` on pybind builds). Part of `package_id` when `True`, so an instrumented binary can never satisfy `--build=missing` for a production build or vice versa. **Dropped from `package_id` when `False`**, so uninstrumented ids are byte-identical to the ids this recipe produced before the option existed. Set by the packager when `xmsconan coverage` runs — not something to pin by hand. |
 
 ### 7.3 Required CMake variables (set by the recipe via `tc.variables`)
 
 `PYTHON_TARGET_VERSION`, `IS_PYTHON_BUILD`, `BUILD_TESTING`, `XMS_TESTING_FRAMEWORK`, `XMS_VERSION`, `USE_TYPEDEF_WCHAR_T`. The generated `CMakeLists.txt` already wires these up; only relevant if you write `extra_cmake_text`.
 
-All of them come from a single `_cmake_variables()` on the recipe, which feeds both `generate()` (the toolchain file) and `build()` (`cmake.configure`). Those were two hand-kept copies, and `USE_TYPEDEF_WCHAR_T` is what that cost: neither of them set it. `XMS_COVERAGE` is the one variable deliberately outside the shared set — it is added in `build()` only, so an instrumented build is never baked into a cached toolchain file.
+All of them come from a single `_cmake_variables()` on the recipe, which feeds both `generate()` (the toolchain file) and `build()` (`cmake.configure`). Those were two hand-kept copies, and `USE_TYPEDEF_WCHAR_T` is what that cost: neither of them set it. `XMS_COVERAGE` is the one variable deliberately outside the shared set — set in `build()` only, and only when the recipe's `coverage` option is `True`. The option is part of the `package_id`, so conan gives the instrumented build its own build folder and the cached `-D` value can never leak into a production configuration. The generated `CMakeLists.txt` no longer reads `$ENV{XMS_COVERAGE}` as a fallback; the option is the sole driver, so instrumentation always travels with the `package_id`.
 
 ### 7.4 Third-party requirements and the VS2019 fork
 
@@ -596,12 +597,16 @@ The generated jobs follow the pattern:
 
 ### 10.2 GitLab specifics
 
+> The bullets below describe the default pipeline shape, whose Linux work is one `Conan Build` job looping every configuration and a `Coverage Build` job compiling the two instrumented ones. `[matrix].wheel_only = true` (§5.4.1) replaces both with one build job per configuration, running concurrently, with the instrumented ones measuring their own coverage in place — see §11.5. Everything here about filters, the Windows jobs, wheels, and `[ci].split_tests` applies to either shape.
+
 - Jobs invoke `build.py` without a `--filter`, so a `[filter]` table in `build.toml` (§5.8) applies with no template change — GitLab has no `build_type` matrix axis to narrow. A filter that leaves a platform with no pybind configuration drops that platform's wheel work: the `Repair Wheel` and `Wheel Deploy` jobs and the Linux `--wheel-dir` for Linux, and `Wheel Deploy - Windows` plus the in-place repair step for Windows. The two are independent — `"compiler.runtime" = "static"` takes out only the Windows side. The `Conan Deploy` jobs publish packages rather than wheels and are unaffected.
 - `Conan Build` and `Conan Deploy - Linux`: `parallel:matrix` over `PYTHON_TARGET_VERSION` from `linux_python_versions`, each leg saving/restoring its own `-py<version>` export tarball. With a single version they stay plain jobs with no `parallel:matrix`, exactly as before.
 - `Repair Wheel` and `Wheel Deploy` stay single jobs: they collect every leg's wheels and act on all of them at once.
-- `Coverage` pins both its container image and `PYTHON_TARGET_VERSION` from the resolved coverage ABI (`[coverage].python_version`, §5.7), so the interpreter inside the image and the ABI the pybind build targets are the same value. Under an explicit `[ci].docker_image` only the pin is resolved — the image is whatever the repo named, so keeping that image's interpreter in step is the repo's job. `xmsconan_coverage` exports the variable itself, so the job is correct without it; it is declared here as well so the pairing is visible in one place, and so a regression in the tool cannot pass unnoticed on GitLab specifically. Unlike `Conan Build`, `Coverage` never fans out — coverage commits to a single ABI by design.
-- `[ci].split_tests` cannot be combined with a multi-version `linux_python_versions` — the C++ test job takes the build job's artifacts by name, so a multi-ABI build would leave it testing an indeterminate one. `xmsconan ci` rejects that combination at generation time.
-- **`Run C++ Tests` shards inside one container.** With `[ci].split_tests = true` the job downloads the build job's `test_artifacts/`, then runs `xmsconan_test_shards`, which locates the testing artifact directory, restores the executable bit on the runner (a GitLab artifact round-trip drops it), relinks `test_files/` next to the runner, and forks `[ci].test_shards` runner processes with `GTEST_TOTAL_SHARDS`/`GTEST_SHARD_INDEX` set. Each shard writes its own gtest XML, which the tool merges by suite name into `TEST-cxxtest.xml` and declares as `artifacts:reports:junit`, so a failing case shows up in the MR widget by name. Per-shard console output is held and replayed as one contiguous block rather than interleaved. A shard that dies before writing XML — a timeout, a segfault — contributes a synthetic error suite to the merged report, so a red job never shows an all-green test tab. Without `test_shards` the same script runs a single shard: one code path, so the artifact discovery and `test_files` relinking do not have to exist twice. With `[ci].xvfb = true` each shard gets its own X display, because `xvfb-run -a` picks a free server number and N simultaneous starts race for it.
+- `Coverage Build` pins both its container image and `PYTHON_TARGET_VERSION` from the resolved coverage ABI (`[coverage].python_version`, §5.7), so the interpreter inside the image and the ABI the pybind build targets are the same value. Under an explicit `[ci].docker_image` only the pin is resolved — the image is whatever the repo named, so keeping that image's interpreter in step is the repo's job. `xmsconan_coverage` exports the variable itself, so the job is correct without it; it is declared here as well so the pairing is visible in one place, and so a regression in the tool cannot pass unnoticed on GitLab specifically. Unlike `Conan Build`, it never fans out — coverage commits to a single ABI by design. The `Coverage` job that follows it needs no pin at all: the report phase reads JSON, so it runs in a plain `python:<coverage ABI>` image and builds nothing.
+- `[ci].split_tests` cannot be combined with a multi-version `linux_python_versions` — the C++ test jobs take the build job's artifacts by name, so a multi-ABI build would leave them testing an indeterminate one. `xmsconan ci` rejects that combination at generation time.
+- `[ci].split_tests` is also rejected when the `[filter]` table leaves no Linux testing configuration (`options.testing = false`, or a `pybind = true` pin). Splitting makes the build job export `XMS_SKIP_CXX_TESTS=1`, so with no runner staged there is nowhere left for the suite to run — the pipeline would pass having tested nothing. Note that `[ci].build_types` is not the axis here: a `pybind = true` pin keeps Release configurations while staging no runner at all.
+- **One test job per testing configuration, each naming its own.** `[ci].split_tests` emits a `Run C++ Tests - <label>` job for every testing configuration the Linux build stages — `Release-testing` and `Debug-testing` on the default matrix — and each passes its own `--label`. They are peers in the `Test` stage off the single `Conan Build`, and each uploads only its own `test_artifacts/<label>/` (the `needs: artifacts: true` download hands every job the whole staged tree, so an unscoped path would have each one re-upload the others' runners too). Every job writes `TEST-cxxtest.xml`; GitLab keys the pipeline test report on the job name, so the configurations stay distinguishable in the MR widget. The labels are computed by the generator with the same `config_label()` the build names the directories with, so the two cannot drift — a template concatenating `<build_type>-testing` would be a second implementation free to. **This is what a single job got wrong:** it found its directory by falling back to the first of `Debug-testing`, `Release-testing` that existed, so a matrix building both compiled the Release runner on every pipeline and never executed it, with nothing red to show for it. `xmsconan_test_shards` keeps that fallback for interactive use after a local `build.py`, but no generated pipeline relies on it any more.
+- **Each job shards inside one container.** The job downloads the build job's `test_artifacts/`, then runs `xmsconan_test_shards`, which restores the executable bit on the runner (a GitLab artifact round-trip drops it), relinks `test_files/` next to the runner, and forks `[ci].test_shards` runner processes with `GTEST_TOTAL_SHARDS`/`GTEST_SHARD_INDEX` set. Each shard writes its own gtest XML, which the tool merges by suite name into `TEST-cxxtest.xml` and declares as `artifacts:reports:junit`, so a failing case shows up in the MR widget by name. Per-shard console output is held and replayed as one contiguous block rather than interleaved. A shard that dies before writing XML — a timeout, a segfault — contributes a synthetic error suite to the merged report, so a red job never shows an all-green test tab. Without `test_shards` the same script runs a single shard: one code path, so the artifact discovery and `test_files` relinking do not have to exist twice. With `[ci].xvfb = true` each shard gets its own X display, because `xvfb-run -a` picks a free server number and N simultaneous starts race for it.
 - `Conan Build - Windows`, `Conan Deploy - Windows`: `parallel:matrix` over `PYTHON_TARGET_VERSION` from `python_versions`. The matrix also sets `PY_TAG` (`py310` / `py313` / `py314`) which selects the runner via `image: GLR-${PY_TAG}`.
 - Wheel-repair always runs `cp313-cp313`'s `xmsconan_wheel_repair` inside the manylinux container; auditwheel itself doesn't care about the host Python.
 - Required CI variables: `AQUAPI_URL`, `AQUAPI_USERNAME`, `AQUAPI_PASSWORD` (for wheel deploy).
@@ -635,13 +640,13 @@ Two consequences worth knowing:
 
 ## 11. Coverage (`xmsconan coverage`)
 
-`xmsconan coverage` (also available as the legacy `xmsconan_coverage` script) runs two instrumented Conan builds and produces both C++ and Python coverage reports. Configured via the `[coverage]` table in `build.toml` (§5.7).
+`xmsconan coverage` (also available as the legacy `xmsconan_coverage` script) runs two instrumented Conan builds and produces both C++ and Python coverage reports. Configured via the `[coverage]` table in `build.toml` (§5.7). The run splits into a `collect` phase (the builds and every rendered report) and a `report` phase (the thresholds and the gate); `--phase` selects one and the default runs both, see §11.4.
 
 ```bash
 xmsconan coverage --version 0.0.0 build.toml
 ```
 
-What it does:
+What it does — steps 1-4 are the `collect` phase, step 5 the `report` phase (§11.4):
 
 1. Generates `conanfile.py`, `build.py`, and `CMakeLists.txt` from `build.toml` (via `xmsconan gen`).
 2. Sets `XMS_COVERAGE=1` and invokes `build.py` twice — **sequentially by default**, see `[coverage].parallel` (§5.7):
@@ -650,15 +655,15 @@ What it does:
 
    The two coverage builds pin the inverse of each other, and they pin *different* build types — Debug for the CxxTest half, Release for the pybind half — so a `[filter]` table (§5.8) conflicts by *requiring* `testing`/`pybind` as much as by excluding it, and any `build_type` pin cancels one of the two outright. Either way one of the builds is left with no configurations and `build.py` exits non-zero. A `python_version` pin other than `[coverage].python_version` cancels the Python build the same way. `xmsconan ci` warns about each conflict at generation time.
 
-   `XMS_COVERAGE=1` rides into the `[buildenv]` of every profile so CMake adds `--coverage` there. It no longer changes which configurations exist: the testing-only Debug variant is part of the standard packager fan-out either way, and the Python half reuses whatever pybind configuration `[matrix].pybind_build_types` already names. Pybind profiles are injected too: the binding layer is C++ that only a Python test can reach, and gcovr merges that build's `.gcda` into the C++ report. The recipe separately keys `pytest-cov` off `XMS_COVERAGE` in the inherited process environment, which is why Python coverage is collected from the same build. Requiring a Debug pybind build used to cost every dependency a `Debug`+`pybind` binary — the one combination the xms libraries do not publish — and would need a debug interpreter on Windows. `python_version` on the pybind build is pinned to one ABI (highest of `[ci].linux_python_versions` by default, or `[coverage].python_version` when set) so multi-version fan-outs cannot non-deterministically pick whichever pybind config finished last.
+   `XMS_COVERAGE=1` in the environment tells the packager to set the recipe's `coverage=True` option on every configuration — the option, not a `[buildenv]` entry, is what reaches the build, so an instrumented build carries its own `package_id` and can never satisfy `--build=missing` for a production build (or vice versa). The recipe forwards the option to CMake as `-DXMS_COVERAGE`, which adds `--coverage`. Coverage no longer changes which configurations exist: the testing-only Debug variant is part of the standard packager fan-out either way, and the Python half reuses whatever pybind configuration `[matrix].pybind_build_types` already names. Pybind builds get the option too: the binding layer is C++ that only a Python test can reach, and gcovr merges that build's `.gcda` into the C++ report. The same option keys `pytest-cov` in the recipe, which is why Python coverage is collected from the same build. Requiring a Debug pybind build used to cost every dependency a `Debug`+`pybind` binary — the one combination the xms libraries do not publish — and would need a debug interpreter on Windows. `python_version` on the pybind build is pinned to one ABI (highest of `[ci].linux_python_versions` by default, or `[coverage].python_version` when set) so multi-version fan-outs cannot non-deterministically pick whichever pybind config finished last.
 3. Locates the two build folders in the local Conan cache and runs gcovr against **both**. Each folder is read separately with its own `--root` -- one invocation cannot span two roots, and `--root` has to match the absolute paths embedded in that folder's `.gcno` files -- writing a JSON tracefile each. A final gcovr run combines them with `--add-tracefile` into `cov-cpp.xml`, `cov-cpp-summary.json`, and `coverage-html-cpp/`. Tracefile paths are relative to `--root`, so the two folders' copies of the same source line up and hit counts sum: a line the CxxTest runner never reaches still counts as covered when a Python test reaches it through the bindings. The pytest-cov artifacts are copied out of the pybind build folder as before.
    The two legs write into separate Conan build folders, but they share the local Conan cache -- which is not safe for concurrent writes -- and contend for CPU when overlapped (an identical shard measured 1.57× slower beside a second leg), which is why running them together is opt-in (§5.7). Their console output is captured per leg and replayed whole once that leg finishes rather than interleaved line by line, which would otherwise split every compiler diagnostic away from the file name printed above it. A leg that fails — or cannot start at all — is recorded and reported after both have finished, so the other leg's reports are still produced.
 4. Writes `cov-cpp.xml`, `cov-py.xml`, `cov-cpp-summary.json`, `cov-py-summary.json`, `coverage-html-cpp/`, and `coverage-html-py/` into `--output_dir`.
-5. Compares the line-coverage percent for each layer against `[coverage].cpp_threshold` / `[coverage].python_threshold` and exits non-zero on regression — with a *distinct* code for the gate, see §11.5. The tool also exits non-zero if `build.py` reported a test failure in either layer — but only *after* still producing gcovr reports, copying artifacts, and (if `$GITHUB_STEP_SUMMARY` is set) appending the markdown summary, so the coverage data and the failing-test signal are both visible in the same run. If a coverage summary file is present but missing its expected keys (gcovr/pytest-cov schema drift, truncated write), the tool raises rather than reporting a misleading 0%. A `cov-py-summary.json` that is *absent* fails the Python layer outright: the pybind build in step 2 always runs with `XMS_COVERAGE=1`, so there is no configuration in which pytest-cov legitimately writes nothing, and `python_threshold` defaults to `0` — treating the absent file as 0% would report PASS for a layer that was never measured.
+5. Re-reads the thresholds from `build.toml`, compares the line-coverage percent for each layer against `[coverage].cpp_threshold` / `[coverage].python_threshold`, and exits non-zero on regression — with a *distinct* code for the gate, see §11.6. The tool also exits non-zero if `build.py` reported a test failure in either layer — but only *after* still producing gcovr reports, copying artifacts, and (if `$GITHUB_STEP_SUMMARY` is set) appending the markdown summary, so the coverage data and the failing-test signal are both visible in the same run. If a coverage summary file is present but missing its expected keys (gcovr/pytest-cov schema drift, truncated write), the tool raises rather than reporting a misleading 0%. A `cov-cpp-summary.json` or `coverage-status.json` that is *absent* is a tool failure rather than a gate miss (exit `1`): the collect phase always writes both, so their absence means the run that should have produced them did not. A `cov-py-summary.json` that is *absent* fails the Python layer outright: the pybind build in step 2 always runs with `coverage=True`, so there is no configuration in which pytest-cov legitimately writes nothing, and `python_threshold` defaults to `0` — treating the absent file as 0% would report PASS for a layer that was never measured.
 
 ### 11.1 What this requires of the recipe
 
-- `python_namespaced_dir` **must** be set on the recipe (it is by default — `xmsconan_gen` derives it from `library_name`). With `XMS_COVERAGE=1` the recipe targets `pytest-cov` at exactly `xms.<python_namespaced_dir>` so coverage doesn't leak across `xms_dependencies` installed in the build venv. The recipe's `configure()` raises at install time if `XMS_COVERAGE=1` is set without `python_namespaced_dir`, so the run fails fast before a full instrumented build is wasted.
+- `python_namespaced_dir` **must** be set on the recipe (it is by default — `xmsconan_gen` derives it from `library_name`). With `coverage=True` the recipe targets `pytest-cov` at exactly `xms.<python_namespaced_dir>` so coverage doesn't leak across `xms_dependencies` installed in the build venv. The recipe's `configure()` raises at install time if `coverage=True` is set without `python_namespaced_dir`, so the run fails fast before a full instrumented build is wasted.
 - The compiler must support `--coverage` (GCC/Clang). MSVC is rejected by the generated `CMakeLists.txt` when `XMS_COVERAGE` is non-empty.
 - `gcovr` must be on `PATH` (the generated CI pipelines `pip install gcovr` for you).
 
@@ -670,17 +675,41 @@ If the library needs an X server to run its tests (VTK, GUI libs), `xmsconan cov
 
 | Variable | Set by | Effect |
 |---|---|---|
-| `XMS_COVERAGE` | `xmsconan coverage` | Recipe-side flag. Enables `--coverage` in `CMakeLists.txt`, installs `pytest-cov`, and passes `--cov=xms.<python_namespaced_dir>` to pytest. |
+| `XMS_COVERAGE` | `xmsconan coverage` | Packager-side switch. The packager translates it into the recipe's `coverage=True` option on every configuration; the option then enables `--coverage` in `CMakeLists.txt` (via `-DXMS_COVERAGE`), installs `pytest-cov`, and passes `--cov=xms.<python_namespaced_dir>` to pytest. The recipe itself no longer reads this variable, and neither does the generated `CMakeLists.txt` — for raw `cmake --preset` builds (where the recipe's `build()` never runs), setting it at *generation* time instead bakes `XMS_COVERAGE=1` into every generated configure preset's `cacheVariables`, so regenerating with it set is how a local consumer coverage script instruments its build. |
 | `XMS_COVERAGE_PIP_INDEX` | you | Optional extra `--extra-index-url` for the build venv's `pip install` when coverage is enabled (useful when `pytest-cov` lives on a private index). |
 | `PIP_INDEX_URL` / `PIP_EXTRA_INDEX_URL` | you | Read by pip itself, not by xmsconan. The wheel install at the end of a pybind build resolves `xms_python_dependencies` from whatever index pip is configured with; set these when any of those requirements live on a private index. |
 | `GITHUB_STEP_SUMMARY` | GitHub Actions | When set, a coverage summary table is appended. |
 
-### 11.4 GitLab vs GitHub
+### 11.4 Phases (`--phase`)
+
+`--phase` splits the run at the boundary between the part that needs a build tree and the part that only needs the numbers. The default, `all`, does both in one process — which is what a local run wants.
+
+| Phase | Does | Needs |
+|---|---|---|
+| `collect` | Steps 1-4: both instrumented Conan builds, gcovr, and every rendered artifact. Also writes `coverage-status.json`. | A toolchain, the Conan cache, and the build folders. Minutes. |
+| `measure` | Steps 1-4 for **one** leg, named by `--leg`. Builds that leg instrumented, runs its tests, and writes a gcovr *tracefile* plus that leg's slice of the status file. Renders no report — merging needs both legs, and no single job has both. | A toolchain, the Conan cache, and one build folder. Minutes. |
+| `report` | Step 5: merges any per-leg tracefiles, re-reads the thresholds from `build.toml`, reads the summaries, logs the table and the `$GITHUB_STEP_SUMMARY` rows, and applies the gate. | `cov-cpp-summary.json` *or* `cov-cpp-tracefile-*.json`, plus `cov-py-summary.json` and `coverage-status.json`. Seconds, in a bare Python image with gcovr. |
+| `all` | `collect` and then `report`. A `collect` that fails returns its own exit code without reaching the gate. | Both. |
+
+`--leg` selects which instrumented build `measure` runs: `cpp` is the Debug testing configuration, `python` the Release pybind one. It is required by `measure` and ignored by every other phase; `measure` without it is a usage error rather than a default, because there is no leg that is the obvious one to mean. An unknown leg raises.
+
+`measure` is what makes the two instrumented builds *concurrent jobs* rather than two sequential compiles in one. Each writes its artifacts under names carrying its leg — `cov-cpp-tracefile-<leg>.json`, `coverage-status-<leg>.json` — so two jobs uploading into one artifact space cannot overwrite each other, and `report` unions the status files rather than trusting whichever landed last. A leg whose build leaves no package in the Conan cache records itself unmeasured and exits `1`; it does not write an empty tracefile, which the merge would read as a layer that is genuinely 0% covered.
 
-- **GitLab**: `xmsconan ci` emits a `Coverage` stage that invokes `xmsconan_coverage` (the legacy alias used throughout the generated CI for consistency with `xmsconan_gen`, `xmsconan_conan_setup`, etc.; equivalent to `xmsconan coverage`), exposes `cov-cpp.xml` as the `cobertura` coverage report, and ships HTML to Pages. The `coverage:` regex still matches gcovr's `TOTAL` line (the `--txt` summary is printed to stdout). The `pages` stage publishes a small landing page at the Pages root linking both `cpp/` and `python/` reports (the Python link is dropped if Python coverage was not produced). Under `[ci].split_tests` the `Coverage` job carries `allow_failure: exit_codes: [3]` — the tests gate the pipeline from their own job, so a coverage *threshold* miss is advisory here, but the tool failing is not. This was `allow_failure: true`, which forgave crashes too; see §11.5.
+The split lands where it does because `_run_gcovr` passes `--root <build folder>` and `--html-details`: the rendering has to happen beside the build folder holding the compiler's copy of the sources. Rendering inside `collect` means only JSON and finished HTML ever cross a job boundary — no `.gcda` to relocate, no `GCOV_PREFIX`/`GCOV_PREFIX_STRIP`.
+
+`coverage-status.json` carries exactly what the gate needs and no report file records: whether either build leg reported a test failure, and whether each layer was measured at all. Thresholds are deliberately **not** in it — `report` re-reads `build.toml`, so raising a threshold re-gates an existing set of artifacts without rebuilding anything.
+
+`[ci].xvfb` applies to `collect` only: the re-exec under `xvfb-run` happens where the tests run, so the report phase needs no display and no `xvfb-run` on `PATH`.
+
+Beyond the CI scheduling this buys testability. The gate used to be reachable only by driving two real Conan builds, which made the logic deciding pass-vs-fail the least-tested part of the coverage tool; the report phase needs no toolchain, no Conan cache, and no build folder. After a `collect` run it is genuinely JSON in, exit code out. After `measure` legs it also shells out to gcovr once, to merge the per-leg tracefiles — still no compiler, but gcovr has to be on `PATH` in the report job too.
+
+### 11.5 GitLab vs GitHub
+
+- **GitLab, `[matrix].wheel_only = true`**: there is no `Coverage Build`. The two instrumented builds are ordinary `Build`-stage jobs in the per-configuration fan-out `wheel_only` produces (§5.4.1), each running `xmsconan_coverage --phase measure --leg <cpp|python>`, and the `Coverage` stage holds a single `Coverage` job running `--phase report` — the merge and the gate. That removes the duplicate compile the old shape paid for: `Coverage Build` recompiled the Debug testing and pybind configurations because instrumentation is part of the `package_id`, so no production binary could satisfy it, and 503 of the 1334 objects a pipeline compiled were that second copy. The `Coverage` job `needs:` the instrumented build jobs with `artifacts: true`, which is how the tracefiles reach it; the build folders never move. `allow_failure: exit_codes: [3]` under `[ci].split_tests` applies here the same way it does below.
+- **GitLab, otherwise**: `xmsconan ci` emits a `Coverage` stage holding **two** jobs, both invoking `xmsconan_coverage` (the legacy alias used throughout the generated CI for consistency with `xmsconan_gen`, `xmsconan_conan_setup`, etc.; equivalent to `xmsconan coverage`). `Coverage Build` runs `--phase collect` — the two instrumented builds and gcovr — and declares `needs: []`, so it starts at t=0 instead of queueing behind `Conan Build`. `Coverage` runs `--phase report` off its artifacts and exposes `cov-cpp.xml` as the `cobertura` coverage report. `needs: []` rather than physically moving the collect job into the `Build` stage: a `Build`-stage job would make every `Test`-stage job wait behind the instrumented compile, which is the opposite of the intent. The `coverage:` regex matches the `Coverage total: <pct>%` line the report phase prints rather than gcovr's `TOTAL` row, because gcovr now runs in the other job and GitLab scrapes only the job it is declared on. The `pages` stage takes the rendered HTML from `Coverage Build` — the job that produced it — and publishes a small landing page at the Pages root linking both `cpp/` and `python/` reports (the Python link is dropped if Python coverage was not produced). The report job deliberately does not re-upload that tree: `needs: artifacts: true` already hands it the whole thing, so listing it again would store a second copy of every gcovr detail page. Depending on the collect job also means the report publishes on a gate miss, which is the run you most want to read. Under `[ci].split_tests` the `Coverage` job carries `allow_failure: exit_codes: [3]` — the tests gate the pipeline from their own job, so a coverage *threshold* miss is advisory here, but the tool failing is not. `Coverage Build` carries no `allow_failure` at all: the collect phase cannot produce a `3`, so anything it fails on is a real breakage. This was `allow_failure: true`, which forgave crashes too; see §11.6.
 - **GitHub**: `xmsconan ci` emits a separate `Coverage.yaml` workflow that runs on `push` and `pull_request`, uploads `coverage-html-*/` and `cov-*.xml` as artifacts, and appends a summary table to the run page. The workflow runs directly on `ubuntu-latest` (no docker container), which is what lets the `--upgrade xmsconan>=…` install of §10.3 actually take effect here — the image this job used to run in baked xmsconan in, so the install no-op'd and the canary was locked to whatever the image carried. Setting `[ci].xvfb = true` apt-installs `xvfb` as an extra step; `[ci].docker_image` is honored by the build/deploy workflows but not by Coverage.
 
-### 11.5 Exit codes
+### 11.6 Exit codes
 
 `xmsconan coverage` distinguishes the coverage **gate** failing from the **tool** failing, because the generated CI treats them differently.
 
@@ -691,10 +720,12 @@ If the library needs an X server to run its tests (VTK, GUI libs), `xmsconan cov
 | `2` | argparse usage error (a bad flag). Not produced by the coverage run itself. |
 | `3` | The coverage gate failed: a layer below its threshold, an unmeasured layer (either one — a single build leg that left no package cannot fully measure its layer), or `build.py` reporting a test failure. Reports and artifacts were still produced. |
 
-Only `3` is forgiven by the generated GitLab job's `allow_failure` (§11.4), and only when `[ci].split_tests` puts the tests in a job of their own. The gate is advisory there because the tests already gate the pipeline elsewhere — but a crash, neither build leg leaving a package, or gcovr falling over must still fail the job. Collapsing both onto `1` under a blanket `allow_failure: true` is what let a `Coverage` stage report green while producing no report at all.
+Only `3` is forgiven by the generated GitLab job's `allow_failure` (§11.5), and only when `[ci].split_tests` puts the tests in a job of their own. The gate is advisory there because the tests already gate the pipeline elsewhere — but a crash, neither build leg leaving a package, or gcovr falling over must still fail the job. Collapsing both onto `1` under a blanket `allow_failure: true` is what let a `Coverage` stage report green while producing no report at all.
 
 A single failed leg is **not** an error: the surviving leg's `.gcda` still produces a partial report, and the gate then fails as a gate (`3`) because the missing layer cannot be measured. Only losing *both* legs is exit `1`.
 
+The codes are the same per phase (§11.4), with the split moving where each one can arise. `collect` can only return `0` or `1` — it renders reports and records the test-failure and measured flags rather than acting on them, so it never gates. `report` returns `3` for the gate and `1` when `coverage-status.json` or `cov-cpp-summary.json` is missing or malformed: the collect phase always writes both, so by then their absence is a broken pipeline, not a coverage regression, and reporting it as a gate miss would let `allow_failure` forgive it.
+
 ---
 
 ## 12. Wheel repair (`xmsconan wheel-repair`)
diff --git a/pyproject.toml b/pyproject.toml
index 6ef9420..4e38afb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -72,6 +72,11 @@ include = ["xmsconan*"]
 local_scheme = "no-local-version"
 
 [tool.pytest.ini_options]
+# Bare `pytest` collects tests/ and nothing else. Without this it also walks
+# the package, and every generated CI fixture or scratch tree left under the
+# working copy, so what a bare run means depends on what is lying around --
+# which is the one thing a gate command must not depend on.
+testpaths = ["tests"]
 markers = [
     "integration: end-to-end test that drives real conan + gcovr against a stub recipe. Opt-in via `pytest -m integration`; excluded from the default `pytest` run because it spins up a full coverage build (downloads boost/zlib/pybind11 from the Aquaveo remote when configured, compiles the stub library, runs pytest-cov + gcovr — multi-minute wall time).",
 ]
diff --git a/tests/ci_helpers.py b/tests/ci_helpers.py
index d2a1621..20b8b9a 100644
--- a/tests/ci_helpers.py
+++ b/tests/ci_helpers.py
@@ -32,8 +32,8 @@ def _toml_value(value):
 
 
 def write_build_toml(tmp_path, ci_type, library_name="xmssnap", description="Snap",
-                     coverage_table=None, **ci_flags):
-    """Write a minimal build.toml with the given ci_type, [ci] and [coverage] tables."""
+                     coverage_table=None, matrix_table=None, **ci_flags):
+    """Write a minimal build.toml with the given ci_type, [ci], [coverage] and [matrix] tables."""
     lines = [
         f'library_name = "{library_name}"',
         f'description = "{description}"',
@@ -45,6 +45,10 @@ def write_build_toml(tmp_path, ci_type, library_name="xmssnap", description="Sna
         lines += ["", "[coverage]"] + [
             f"{key} = {_toml_value(value)}" for key, value in coverage_table.items()
         ]
+    if matrix_table:
+        lines += ["", "[matrix]"] + [
+            f"{key} = {_toml_value(value)}" for key, value in matrix_table.items()
+        ]
     toml_file = tmp_path / "build.toml"
     toml_file.write_text("\n".join(lines) + "\n", encoding="utf-8")
     return toml_file
@@ -55,6 +59,13 @@ def write_gitlab_toml(tmp_path, **ci_flags):
     return write_build_toml(tmp_path, "gitlab", **ci_flags)
 
 
+#: The [matrix] table that opts a repository into the concurrent build stage.
+#: Spelled out at each call site rather than defaulted, because whether a
+#: pipeline has one build job per configuration or one job looping all of them
+#: is exactly what these tests are about.
+WHEEL_ONLY = {"wheel_only": True}
+
+
 def write_github_toml(tmp_path, **ci_flags):
     """Write a minimal GitHub build.toml."""
     return write_build_toml(tmp_path, "github", library_name="xmscore", description="Core", **ci_flags)
diff --git a/tests/test_build_filter.py b/tests/test_build_filter.py
index db7a17e..648493f 100644
--- a/tests/test_build_filter.py
+++ b/tests/test_build_filter.py
@@ -3,6 +3,8 @@
 
 from xmsconan.build_toml import BuildToml, CiTable
 from xmsconan.generator_tools.build_filter import (
+    _name_build_jobs,
+    ci_build_jobs,
     ci_filter_effects,
     CI_JOB_SETTINGS,
     ci_python_versions,
@@ -11,7 +13,10 @@
     empty_ci_jobs,
     load_build_filter,
 )
-from xmsconan.package_tools.packager import configurations
+from xmsconan.package_tools.packager import (
+    configurations,
+    COVERAGE_PYBIND_BUILD_TYPE,
+)
 
 
 # --- load_build_filter ---
@@ -123,12 +128,27 @@ def test_load_build_filter_accepts_a_buildenv_pin():
     generation time they are None or absent. Checking them for emptiness
     rejected every buildenv pin, making a documented feature unusable.
     """
-    for name in ("XMS_VERSION", "XMS_COVERAGE", "XMS_TEST_ARTIFACTS_LABEL"):
+    for name in ("XMS_VERSION", "PYTHON_TARGET_VERSION", "XMS_TEST_ARTIFACTS_LABEL"):
         config = BuildToml(library_name="xmscore", filter={"buildenv": {name: "1"}})
 
         assert load_build_filter(config) == {"buildenv": {name: "1"}}
 
 
+def test_load_build_filter_rejects_a_coverage_pin():
+    """[filter.options] coverage in build.toml is rejected with a targeted message.
+
+    Normal builds omit the coverage option — only `xmsconan coverage` runs
+    emit it — so a permanent pin would exclude every normal configuration.
+    Without this check the generic emptiness error blames "options that
+    cannot hold at once" and points nowhere near the pin.
+    """
+    config = BuildToml(library_name="xmscore",
+                       filter={"options": {"coverage": True}})
+
+    with pytest.raises(ValueError, match="xmsconan coverage"):
+        load_build_filter(config)
+
+
 def test_load_build_filter_still_rejects_settings_beside_a_buildenv_pin():
     """Skipping buildenv must not smuggle an impossible options table past the check."""
     config = BuildToml(library_name="xmscore", filter={
@@ -271,6 +291,40 @@ def test_ci_build_types_returns_a_fresh_list():
     assert isinstance(DEFAULT_CI_BUILD_TYPES, tuple), "the default must not be mutable"
 
 
+@pytest.mark.parametrize("build_filter,expected", [
+    pytest.param({}, ["Release-testing", "Debug-testing"], id="no-filter"),
+    pytest.param({"build_type": "Release"}, ["Release-testing"], id="pinned-release"),
+    pytest.param({"build_type": "Debug"}, ["Debug-testing"], id="pinned-debug"),
+    pytest.param({"options": {"testing": True}},
+                 ["Release-testing", "Debug-testing"], id="testing-required"),
+    # The axis build_types cannot answer: Release survives on its pybind
+    # configurations, but none of them stages a test runner.
+    pytest.param({"options": {"pybind": True}}, [], id="pybind-only-stages-no-runner"),
+    pytest.param({"options": {"testing": False}}, [], id="testing-excluded"),
+])
+def test_ci_test_labels_name_the_staged_testing_configurations(build_filter, expected):
+    """The generated test jobs come from the runners the build really stages.
+
+    Deriving them from ``build_types`` instead would emit a job for a build type
+    that survives on its pybind or plain-library configurations alone, and that
+    job would fail looking for a ``*-testing`` directory nothing wrote.
+    """
+    assert _effects(build_filter)["test_labels"] == expected
+
+
+def test_ci_test_labels_are_linux_only():
+    """Windows compiles and tests in one job, so its configurations add no labels.
+
+    Without the platform restriction the msvc matrix would contribute
+    ``Release-dynamic-testing`` and friends, and Linux test jobs would be
+    generated for artifact directories no Linux build stages.
+    """
+    labels = _effects({})["test_labels"]
+
+    assert labels == ["Release-testing", "Debug-testing"]
+    assert not [label for label in labels if "dynamic" in label or "static" in label]
+
+
 @pytest.mark.parametrize("build_filter,expected", [
     pytest.param({}, {"mac": True, "linux": True, "windows": True}, id="no-filter"),
     pytest.param({"options": {"pybind": True}},
@@ -403,3 +457,110 @@ def test_coverage_conflicts_accepts_matching_python_version():
 def test_coverage_conflicts_skips_python_version_when_unresolved():
     """Callers without a resolved coverage ABI don't get a bogus conflict."""
     assert coverage_conflicts({"options": {"python_version": "3.10"}}, None) == []
+
+
+# --- ci_build_jobs: names and instrumentation ---
+
+
+def _wheel_only_jobs(**matrix):
+    """The GitLab build jobs a wheel_only coverage pipeline would emit.
+
+    Coverage is on and the ABI pinned, because that is the shape the two axes
+    under test only exist in: without coverage nothing is instrumented, and
+    without a pinned ABI there is no "the build type the coverage run reads".
+    """
+    config = BuildToml(library_name="xmscore",
+                       matrix={"wheel_only": True, **matrix})
+    return ci_build_jobs({}, config, ["3.13"], coverage=True,
+                         coverage_python_version="3.13")
+
+
+def test_pybind_job_names_omit_the_build_type_when_the_matrix_has_one():
+    """One pybind build type needs no prefix, and must not grow one.
+
+    These names are `needs:` targets in the generated pipeline, so a prefix
+    added for an axis the matrix does not span is churn in every consumer of
+    the name in exchange for no disambiguation.
+    """
+    names = [job["name"] for job in _wheel_only_jobs()]
+    assert "Python Instrumented Build" in names
+    assert "Python Build" in names
+
+
+def test_pybind_job_names_carry_the_build_type_when_the_matrix_spans_two():
+    """[matrix].pybind_build_types = two build types puts both in the names."""
+    names = [job["name"] for job
+             in _wheel_only_jobs(pybind_build_types=["Release", "Debug"])]
+    assert "Release Python Instrumented Build - py3.13" in names
+    assert "Debug Python Build - py3.13" in names
+
+
+@pytest.mark.parametrize("matrix, versions", [
+    ({}, ["3.13"]),
+    ({"pybind_build_types": ["Release", "Debug"]}, ["3.13"]),
+    ({}, ["3.13", "3.14"]),
+    ({"pybind_build_types": ["Release", "Debug"]}, ["3.13", "3.14"]),
+    ({"compiler_runtime": ["dynamic", "static"]}, ["3.13"]),
+])
+def test_build_job_names_are_unique(matrix, versions):
+    """No two jobs share a name, across every axis the fan-out can span.
+
+    A GitLab job name is a YAML mapping key. Two jobs sharing one is not an
+    error the pipeline reports -- the later block replaces the earlier, that
+    configuration is never built, and the deploy then restores an export
+    tarball no job wrote, because the tarball is named for the config *label*
+    which does carry the build type.
+    """
+    config = BuildToml(library_name="xmscore",
+                       matrix={"wheel_only": True, **matrix})
+    jobs = ci_build_jobs({}, config, versions, coverage=True,
+                         coverage_python_version=versions[0])
+    names = [job["name"] for job in jobs]
+    assert len(names) == len(set(names)), sorted(names)
+
+
+def test_name_build_jobs_raises_when_two_jobs_would_share_a_name():
+    """A naming axis the function does not know about stops generation.
+
+    Two testing jobs at one build type stand in for whatever axis is added
+    next -- a compiler_runtime fan-out, a second toolchain. The point is that
+    it fails here rather than rendering a pipeline that quietly builds less
+    than the matrix asked for.
+    """
+    jobs = [
+        {"kind": "testing", "build_type": "Debug", "instrumented": False,
+         "python_version": "3.13", "tag_policy": "except"},
+        {"kind": "testing", "build_type": "Debug", "instrumented": False,
+         "python_version": "3.13", "tag_policy": "except"},
+    ]
+    with pytest.raises(ValueError, match=r"same name.*'Debug Build'"):
+        _name_build_jobs(jobs)
+
+
+def test_only_the_pybind_build_type_the_coverage_run_reads_is_instrumented():
+    """A second pybind build type builds clean, not instrumented.
+
+    The Python coverage leg's filter pins one build type, so a Debug pybind
+    job would compile an instrumented module `--leg python` never reads -- and
+    write coverage-status-python.json and cov-cpp-tracefile-python.json over
+    the leg that is read, since both files are named for the leg and neither
+    for the build type.
+    """
+    jobs = _wheel_only_jobs(pybind_build_types=["Release", "Debug"])
+    instrumented = {(job["kind"], job["build_type"])
+                    for job in jobs if job["instrumented"]}
+    assert ("pybind", "Release") in instrumented
+    assert ("pybind", "Debug") not in instrumented
+
+
+def test_the_instrumented_pybind_job_is_the_one_the_python_leg_builds():
+    """The CI planner and the coverage run agree on the measured build type.
+
+    Asserted against the constant the coverage leg's filter is built from
+    rather than a literal, so the two cannot be changed apart.
+    """
+    jobs = _wheel_only_jobs(pybind_build_types=["Release", "Debug"])
+    measured = [job for job in jobs
+                if job["kind"] == "pybind" and job["instrumented"]]
+    assert [job["build_type"] for job in measured] == [COVERAGE_PYBIND_BUILD_TYPE]
+    assert [job["coverage_leg"] for job in measured] == ["python"]
diff --git a/tests/test_ci_file_generator.py b/tests/test_ci_file_generator.py
index 7f5dde0..c60ea22 100644
--- a/tests/test_ci_file_generator.py
+++ b/tests/test_ci_file_generator.py
@@ -11,7 +11,12 @@
     _display_name,
     generate_ci,
 )
-from .ci_helpers import NON_JOB_SHAPE_KEYS, write_github_toml, write_gitlab_toml
+from .ci_helpers import (
+    NON_JOB_SHAPE_KEYS,
+    WHEEL_ONLY,
+    write_github_toml,
+    write_gitlab_toml,
+)
 
 
 @pytest.mark.parametrize("input_name,expected", [
@@ -631,17 +636,35 @@ def test_github_ci_sets_ctest_parallel_level(ci_toml, tmp_path):
 
 def test_gitlab_ci_split_tests_generates_separate_jobs(tmp_path):
     """When split_tests = true, generates separate Build and Test jobs."""
-    toml_file = write_gitlab_toml(tmp_path, split_tests=True, coverage=True, xvfb=True)
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, split_tests=True, coverage=True, xvfb=True)
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     ci_file = output_dir / ".gitlab-ci.yml"
     content = ci_file.read_text(encoding="utf-8")
-    assert '"Run C++ Tests":' in content
     assert "XMS_SKIP_CXX_TESTS" in content
     ci = yaml.safe_load(content)
-    # Build and Test should be separate stages
-    assert ci["Conan Build"]["stage"] == "Build"
-    assert ci["Run C++ Tests"]["stage"] == "Test"
+    # Build and Test are separate stages, and the build fans out into one job
+    # per configuration rather than one job looping them.
+    build_jobs = {}
+    for name, job in ci.items():
+        # The Windows build job shares the stage but not the shape: it is one
+        # matrix job over the ABIs, not a job per configuration.
+        if not isinstance(job, dict) or "Windows" in name:
+            continue
+        if job.get("stage") == "Build":
+            build_jobs[name] = job
+    assert build_jobs, "split_tests must emit Linux Build-stage jobs"
+    needs = {name: job.get("needs") for name, job in build_jobs.items()}
+    assert all(value == [] for value in needs.values()), (
+        "every Linux build job declares needs: [] so they start together "
+        f"rather than at their stage's turn: {needs}"
+    )
+    # The Release leg is uninstrumented, so its suite runs in a Test job. The
+    # Debug leg is instrumented under coverage = true and runs its own suite
+    # inside its build, beside the .gcno gcovr has to read the .gcda against.
+    assert '"Run C++ Tests - Release-testing":' in content
+    assert '"Run C++ Tests - Debug-testing":' not in content
+    assert ci["Run C++ Tests - Release-testing"]["stage"] == "Test"
     # Coverage is informational-only when tests run in a separate job -- but
     # only for the coverage gate itself. The tool failing still fails the job.
     # Asserted through the constant: the forgiven code must be the one the
@@ -664,7 +687,10 @@ def test_gitlab_ci_no_split_tests_by_default(tmp_path):
     assert "XMS_SKIP_CXX_TESTS" not in content
     # No Build stage — everything stays in Test
     ci = yaml.safe_load(content)
-    assert ci["Conan Build"]["stage"] == "Test"
+    build_jobs = {name: job for name, job in ci.items()
+                  if isinstance(job, dict) and "build.py" in str(job.get("script", ""))}
+    assert build_jobs, "the Linux build jobs must still be emitted"
+    assert all(job["stage"] == "Test" for job in build_jobs.values()), build_jobs
     assert "Build" not in ci.get("stages", [])
 
 
@@ -693,14 +719,15 @@ def test_gitlab_ci_test_shards_run_in_one_container(tmp_path):
     ci_file = output_dir / ".gitlab-ci.yml"
     content = ci_file.read_text(encoding="utf-8")
     ci = yaml.safe_load(content)
-    assert "parallel" not in ci["Run C++ Tests"]
+    assert "parallel" not in ci["Run C++ Tests - Debug-testing"]
     assert "--shards 4" in content
     # The GTEST_* variables are the shard runner's business now. Exporting them
     # from the job would pin every shard in the container to the same index.
     assert "GTEST_TOTAL_SHARDS" not in content
     assert "GTEST_SHARD_INDEX" not in content
     # The merged report is what makes a failing case visible in the MR widget.
-    assert ci["Run C++ Tests"]["artifacts"]["reports"]["junit"] == "TEST-cxxtest.xml"
+    junit = ci["Run C++ Tests - Debug-testing"]["artifacts"]["reports"]["junit"]
+    assert junit == "TEST-cxxtest.xml"
 
 
 def test_gitlab_ci_no_shards_without_config(tmp_path):
@@ -716,7 +743,7 @@ def test_gitlab_ci_no_shards_without_config(tmp_path):
     ci_file = output_dir / ".gitlab-ci.yml"
     content = ci_file.read_text(encoding="utf-8")
     ci = yaml.safe_load(content)
-    assert "parallel" not in ci["Run C++ Tests"]
+    assert "parallel" not in ci["Run C++ Tests - Debug-testing"]
     assert "GTEST_TOTAL_SHARDS" not in content
     assert "--shards 1" in content
 
@@ -747,10 +774,70 @@ def test_gitlab_ci_split_test_job_uses_xvfb(tmp_path):
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     ci_file = output_dir / ".gitlab-ci.yml"
     content = ci_file.read_text(encoding="utf-8")
-    # Find the "Run C++ Tests:" section
-    test_section = re.search(r'"Run C\+\+ Tests":.*?(?=\n\S|\Z)', content, re.DOTALL)
-    assert test_section is not None
-    assert "--xvfb" in test_section.group()
+    # Every test job gets it, not just whichever one happens to render first.
+    sections = re.findall(r'"Run C\+\+ Tests - .*?(?=\n\S|\Z)', content, re.DOTALL)
+    assert len(sections) == 2, sections
+    assert all("--xvfb" in section for section in sections)
+
+
+def _cxx_test_jobs(ci):
+    """The generated C++ test jobs, keyed by job name."""
+    return {name: job for name, job in ci.items() if name.startswith("Run C++ Tests")}
+
+
+def test_gitlab_split_tests_runs_every_staged_testing_configuration(tmp_path):
+    """One test job per staged testing configuration, each naming its own label.
+
+    The regression this pins: a single job found its artifact directory by
+    falling back to the first of Debug-testing, Release-testing that existed, so
+    a matrix building both compiled the Release runner on every pipeline and
+    never ran it. Nothing was red -- the suite simply went unexecuted for one of
+    the two configurations.
+    """
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, split_tests=True)
+    output_dir = tmp_path / "output"
+    generate_ci(str(toml_file), "1.0.0", str(output_dir))
+    content = (output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8")
+    ci = yaml.safe_load(content)
+
+    jobs = _cxx_test_jobs(ci)
+    assert set(jobs) == {
+        "Run C++ Tests - Release-testing",
+        "Run C++ Tests - Debug-testing",
+    }
+    for label in ("Release-testing", "Debug-testing"):
+        script = "\n".join(jobs[f"Run C++ Tests - {label}"]["script"])
+        assert f"--label {label}" in script
+    # Peers in the Test stage, each off its own build job rather than off one
+    # shared build -- which is what lets the builds run concurrently.
+    assert all(job["stage"] == "Test" for job in jobs.values())
+    assert jobs["Run C++ Tests - Release-testing"]["needs"] == [
+        {"job": "Release Build", "artifacts": True},
+    ]
+    assert jobs["Run C++ Tests - Debug-testing"]["needs"] == [
+        {"job": "Debug Build", "artifacts": True},
+    ]
+    # No invocation may reach the label fallback: passing --label is the fix.
+    assert "xmsconan_test_shards --artifacts-dir test_artifacts --shards" not in content
+
+
+def test_gitlab_split_test_job_uploads_only_its_own_configuration(tmp_path):
+    """Each test job re-uploads its own artifacts, not every other job's too.
+
+    ``needs: artifacts: true`` downloads the whole staged tree, so an unscoped
+    ``test_artifacts/`` path would have each job upload a second copy of every
+    configuration it did not run.
+    """
+    toml_file = write_gitlab_toml(tmp_path, split_tests=True)
+    output_dir = tmp_path / "output"
+    generate_ci(str(toml_file), "1.0.0", str(output_dir))
+    ci = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
+
+    for name, job in _cxx_test_jobs(ci).items():
+        label = name.removeprefix("Run C++ Tests - ")
+        assert job["artifacts"]["paths"] == [
+            f"test_artifacts/{label}/", "TEST-cxxtest.xml",
+        ]
 
 
 def test_github_coverage_yaml_generated_when_coverage_true(tmp_path):
@@ -865,30 +952,57 @@ def test_gitlab_coverage_version_is_parameterized(tmp_path):
     assert "xmsconan_coverage --version 0.0.0" not in content
 
 
+def _instrumented_build_jobs(parsed):
+    """The build jobs that compile with coverage instrumentation.
+
+    Found by what they run rather than by name. The generator names them from
+    the configuration they build ("Debug Instrumented Build", "Python
+    Instrumented Build"), and a test that hard-coded those names would be
+    asserting the naming scheme rather than the invariant it cares about --
+    and would go green if a rename left a job uninstrumented.
+    """
+    jobs = {}
+    for name, job in parsed.items():
+        if not isinstance(job, dict):
+            continue
+        script = job.get("script") or []
+        if any("--phase measure" in str(line) for line in script):
+            jobs[name] = job
+    return jobs
+
+
 def test_gitlab_coverage_job_declares_python_target_version(tmp_path):
-    """The Coverage job's ABI target and its container image come from one value.
+    """Each instrumented build's ABI target and container image come from one value.
 
-    The job has always selected its image from the resolved coverage ABI but
-    declared no ``PYTHON_TARGET_VERSION``, so the packager generated a matrix
-    for the silent 3.13 default inside a 3.14 container and the tool's
+    The old single Coverage Build selected its image from the resolved coverage
+    ABI but declared no ``PYTHON_TARGET_VERSION``, so the packager generated a
+    matrix for the silent 3.13 default inside a 3.14 container and the tool's
     ``--filter`` then matched nothing. Asserting the image and the variable
     *agree* is the point: a test on either one alone would still have passed
     while the two disagreed.
+
+    Now that the instrumented builds are separate concurrent jobs, the pair has
+    to agree on every one of them -- one job drifting is exactly the failure
+    the original bug was, reintroduced in a job the old assertion never saw.
     """
     toml_file = write_gitlab_toml(
-        tmp_path, coverage=True, linux_python_versions=["3.14"],
+        tmp_path,
+        matrix_table=WHEEL_ONLY, coverage=True, linux_python_versions=["3.14"],
     )
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
 
-    job = parsed["Coverage"]
-    pinned = job["variables"]["PYTHON_TARGET_VERSION"]
-    assert pinned == "3.14"
-    assert job["image"].endswith(f"-py{pinned}"), (
-        f"Coverage image {job['image']!r} must match its pinned ABI {pinned!r}; "
-        "a mismatch fails find_package(Python3 ... EXACT REQUIRED) at configure."
-    )
+    jobs = _instrumented_build_jobs(parsed)
+    assert jobs, "coverage = true must emit at least one instrumented build job"
+    for name, job in jobs.items():
+        pinned = job["variables"]["PYTHON_TARGET_VERSION"]
+        assert pinned == "3.14", name
+        assert job["image"].endswith(f"-py{pinned}"), (
+            f"{name} image {job['image']!r} must match its pinned ABI "
+            f"{pinned!r}; a mismatch fails "
+            "find_package(Python3 ... EXACT REQUIRED) at configure."
+        )
 
 
 def test_gitlab_coverage_pins_python_target_version_under_an_explicit_image(tmp_path):
@@ -901,16 +1015,19 @@ def test_gitlab_coverage_pins_python_target_version_under_an_explicit_image(tmp_
     default inside somebody else's container.
     """
     toml_file = write_gitlab_toml(
-        tmp_path, coverage=True, linux_python_versions=["3.14"],
+        tmp_path,
+        matrix_table=WHEEL_ONLY, coverage=True, linux_python_versions=["3.14"],
         docker_image="registry.example.com/custom:latest",
     )
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
 
-    job = parsed["Coverage"]
-    assert job["image"] == "registry.example.com/custom:latest"
-    assert job["variables"]["PYTHON_TARGET_VERSION"] == "3.14"
+    jobs = _instrumented_build_jobs(parsed)
+    assert jobs, "coverage = true must emit at least one instrumented build job"
+    for name, job in jobs.items():
+        assert job["image"] == "registry.example.com/custom:latest", name
+        assert job["variables"]["PYTHON_TARGET_VERSION"] == "3.14", name
 
 
 def test_gitlab_coverage_pins_python_target_version_under_xvfb(tmp_path):
@@ -922,22 +1039,27 @@ def test_gitlab_coverage_pins_python_target_version_under_xvfb(tmp_path):
     rather than for whichever branch happened to get a test.
     """
     toml_file = write_gitlab_toml(
-        tmp_path, coverage=True, xvfb=True, linux_python_versions=["3.14"],
+        tmp_path,
+        matrix_table=WHEEL_ONLY, coverage=True, xvfb=True, linux_python_versions=["3.14"],
     )
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
 
-    job = parsed["Coverage"]
-    pinned = job["variables"]["PYTHON_TARGET_VERSION"]
-    assert pinned == "3.14"
-    assert "x11" in job["image"], (
-        f"Coverage image {job['image']!r} must be the xvfb variant under xvfb = true"
-    )
-    assert job["image"].endswith(f"-py{pinned}"), (
-        f"Coverage image {job['image']!r} must match its pinned ABI {pinned!r}; "
-        "a mismatch fails find_package(Python3 ... EXACT REQUIRED) at configure."
-    )
+    jobs = _instrumented_build_jobs(parsed)
+    assert jobs, "coverage = true must emit at least one instrumented build job"
+    for name, job in jobs.items():
+        pinned = job["variables"]["PYTHON_TARGET_VERSION"]
+        assert pinned == "3.14", name
+        assert "x11" in job["image"], (
+            f"{name} image {job['image']!r} must be the xvfb variant "
+            "under xvfb = true"
+        )
+        assert job["image"].endswith(f"-py{pinned}"), (
+            f"{name} image {job['image']!r} must match its pinned ABI "
+            f"{pinned!r}; a mismatch fails "
+            "find_package(Python3 ... EXACT REQUIRED) at configure."
+        )
 
 
 def test_gitlab_pages_landing_links_both_coverage_reports(tmp_path):
@@ -961,6 +1083,32 @@ def test_gitlab_pages_landing_links_both_coverage_reports(tmp_path):
     assert "cp coverage-html-cpp/index.html public/index.html" not in content
 
 
+def test_gitlab_pages_takes_the_html_from_the_job_that_rendered_it(tmp_path):
+    """The HTML is published from the job that renders it.
+
+    That is now "Coverage": the instrumented builds each emit only a tracefile,
+    and the merge that turns those into HTML happens in the gate job. It
+    uploads ``when: always`` so the report still publishes on a gate miss --
+    the run you most want to read is the one that missed its threshold.
+    """
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, coverage=True)
+    output_dir = tmp_path / "output"
+    generate_ci(str(toml_file), "1.0.0", str(output_dir))
+    parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
+
+    assert parsed["pages"]["dependencies"] == ["Coverage"]
+    report = parsed["Coverage"]["artifacts"]
+    assert "coverage-html-cpp/" in report["paths"]
+    assert "coverage-html-py/" in report["paths"]
+    assert report["when"] == "always", (
+        "a gate miss must still publish its report; without when: always the "
+        "failing run is the one that publishes nothing"
+    )
+    # cov-cpp.xml stays: GitLab reads the cobertura report off the job that
+    # declares it, which has to be the one carrying the coverage: regex.
+    assert "cov-cpp.xml" in report["paths"]
+
+
 def test_github_coverage_pins_gcovr(tmp_path):
     """Generated Coverage.yaml pins the gcovr major to keep CI reproducible."""
     toml_file = tmp_path / "build.toml"
@@ -1033,6 +1181,8 @@ def test_gitlab_linux_defaults_on(tmp_path):
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     content = (output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8")
+    # "Conan Build", not the per-configuration jobs: without [matrix].wheel_only
+    # a repository keeps the single looping build job.
     assert "\nConan Build:" in content
     assert "Repair Wheel:" in content
     assert '"Wheel Deploy":' in content
@@ -1159,21 +1309,49 @@ def test_gitlab_project_gets_no_such_warning(tmp_path, caplog):
 
 def test_gitlab_linux_image_tracks_the_implicit_linux_default(tmp_path):
     """With no explicit Linux list the image follows the highest CI entry."""
-    toml_file = write_gitlab_toml(tmp_path, python_versions=["3.10", "3.14"])
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, python_versions=["3.10", "3.14"])
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     content = (output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8")
     # Linux falls back to the highest CI entry, rendered literally because there
     # is no matrix to interpolate from.
     parsed = yaml.safe_load(content)
-    assert parsed["Conan Build"]["image"].endswith("conan-gcc13-py3.14")
-    assert parsed["Conan Build"]["variables"]["PYTHON_TARGET_VERSION"] == "3.14"
+    build_jobs = {name: job for name, job in parsed.items()
+                  if isinstance(job, dict) and job.get("needs") == []}
+    assert build_jobs, "the Linux build jobs must be emitted"
+    for name, job in build_jobs.items():
+        assert job["image"].endswith("conan-gcc13-py3.14"), name
+        assert job["variables"]["PYTHON_TARGET_VERSION"] == "3.14", name
+
+
+def _linux_export_names(content):
+    """The Conan cache tarballs the Linux build jobs save, in job order.
+
+    Windows saves one too, from its own job and under a name of its own shape
+    (``-windows-py${PYTHON_TARGET_VERSION}-``). It is matched by a bare
+    ``--save .export/`` search and would be counted as a Linux export, which is
+    how a count assertion goes green for the wrong reason.
+    """
+    return [line.split("--save ")[1].strip()
+            for line in content.splitlines()
+            if "--save .export/" in line and "-linux-" in line]
 
 
-def test_gitlab_linux_fanout_adds_matching_build_and_deploy_matrices(tmp_path):
-    """Multi-entry linux_python_versions fans out the build and its deploy."""
+def test_gitlab_linux_fanout_builds_each_abi_and_deploys_them_together(tmp_path):
+    """Multi-entry linux_python_versions fans the build out and the deploy in.
+
+    The build fans out: one job per surviving configuration, so a pybind
+    configuration becomes a job per Python version and they compile
+    concurrently instead of in one job's loop.
+
+    The deploy does the opposite. It used to carry a ``parallel: matrix`` over
+    the ABIs. One job restores every tarball and uploads once instead, which is
+    one fewer way for two legs to race on the same Conan reference -- and it
+    stays correct if the exporting set ever stops being one-per-ABI.
+    """
     toml_file = write_gitlab_toml(
         tmp_path,
+        matrix_table=WHEEL_ONLY,
         python_versions=["3.10", "3.13", "3.14"],
         linux_python_versions=["3.13", "3.14"],
     )
@@ -1181,35 +1359,79 @@ def test_gitlab_linux_fanout_adds_matching_build_and_deploy_matrices(tmp_path):
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
 
-    legs = [{"PYTHON_TARGET_VERSION": "3.13"}, {"PYTHON_TARGET_VERSION": "3.14"}]
-    assert parsed["Conan Build"]["parallel"]["matrix"] == legs
-    assert parsed["Conan Deploy - Linux"]["parallel"]["matrix"] == legs
-    # The image interpolates the leg rather than naming a version.
-    assert parsed["Conan Build"]["image"].endswith("conan-gcc13-py${PYTHON_TARGET_VERSION}")
-    # A fanned-out build must not also carry a fixed PYTHON_TARGET_VERSION
-    # variable competing with the one the matrix supplies.
-    assert "PYTHON_TARGET_VERSION" not in parsed["Conan Build"].get("variables", {})
+    for version in ("3.13", "3.14"):
+        job = parsed[f"Python Build - py{version}"]
+        assert job["variables"]["PYTHON_TARGET_VERSION"] == version
+        assert job["image"].endswith(f"conan-gcc13-py{version}")
+        assert "parallel" not in job, (
+            "the ABI fan-out is the job list now; a matrix on top of it would "
+            "build every ABI in every job"
+        )
 
+    deploy = parsed["Conan Deploy - Linux"]
+    assert "parallel" not in deploy, (
+        "one job restores every tarball; legs would race on the same Conan "
+        "reference and no longer line up with the exports anyway"
+    )
+    # Every configuration a tag builds hands the deploy a package. Under
+    # wheel_only that is the clean pybind build of each ABI, and nothing else:
+    # the testing configurations are branch-only and there are no library
+    # configurations to publish.
+    assert set(deploy["dependencies"]) == {
+        "Python Build - py3.13", "Python Build - py3.14",
+    }
+    # ...and each one is restored before the single upload at the end.
+    restores = [line for line in deploy["script"] if "--restore" in line]
+    assert len(restores) == 2, restores
+    assert deploy["script"][-1].endswith("--upload"), (
+        "one upload after the whole set is restored: `conan upload <ref>` "
+        "publishes every package id, so uploading per tarball would push the "
+        "same recipe once per tarball"
+    )
 
-def test_gitlab_linux_fanout_gives_each_leg_its_own_export_tarball(tmp_path):
-    """Without a per-ABI name the parallel legs overwrite one another's export."""
-    toml_file = write_gitlab_toml(tmp_path, linux_python_versions=["3.13", "3.14"])
+
+def test_gitlab_linux_export_tarballs_are_named_per_configuration(tmp_path):
+    """Two build jobs sharing an export name would overwrite each other.
+
+    They upload into one artifact space, so a shared name leaves whichever
+    finished last as the only tarball the deploy can restore -- and the deploy
+    would still look like it succeeded, having restored *a* package and
+    uploaded it. The name is the configuration's whole label, not just its ABI,
+    so it stays unique if a build type or an option ever splits the exporting
+    set along an axis that is not the interpreter.
+    """
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, linux_python_versions=["3.13", "3.14"])
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     content = (output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8")
-    assert ".export/xmssnap-linux-py${PYTHON_TARGET_VERSION}-${PACKAGE_VERSION}.tar.gz" in content
-    assert ".export/xmssnap-linux-${PACKAGE_VERSION}.tar.gz" not in content
+    names = _linux_export_names(content)
+    assert len(names) == len(set(names)) == 2, names
+    for label in ("Release-pybind-py3.13", "Release-pybind-py3.14"):
+        expected = f".export/xmssnap-linux-{label}-${{PACKAGE_VERSION}}.tar.gz"
+        assert expected in names, (expected, names)
 
 
-def test_gitlab_single_linux_version_keeps_unsuffixed_export_tarball(tmp_path):
-    """The export name only grows the ABI suffix once there is a fan-out."""
-    toml_file = write_gitlab_toml(tmp_path, linux_python_versions=["3.13"])
+def test_gitlab_single_linux_version_still_qualifies_its_export_tarballs(tmp_path):
+    """The save and the restore have to spell the same name, fan-out or not.
+
+    With one ABI there is one exporting job, so nothing would collide on a bare
+    name -- but the deploy restores by name, and a build that saved a
+    label-qualified tarball while the deploy asked for a bare one would fail
+    only on a tag, in the job that publishes. The label is unconditional so the
+    two ends cannot disagree.
+    """
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY,
+                                  linux_python_versions=["3.13"])
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     content = (output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8")
-    assert ".export/xmssnap-linux-${PACKAGE_VERSION}.tar.gz" in content
-    # Windows legitimately carries the suffix; only the Linux name must be bare.
-    assert "xmssnap-linux-py${PYTHON_TARGET_VERSION}" not in content
+    names = _linux_export_names(content)
+    assert names == [".export/xmssnap-linux-Release-pybind-py3.13-${PACKAGE_VERSION}.tar.gz"]
+
+    parsed = yaml.safe_load(content)
+    restores = [line for line in parsed["Conan Deploy - Linux"]["script"]
+                if "--restore" in line]
+    assert len(restores) == 1 and names[0] in restores[0], (restores, names)
 
 
 def test_gitlab_split_tests_with_multiple_linux_versions_is_rejected(tmp_path):
@@ -1224,26 +1446,31 @@ def test_gitlab_split_tests_with_multiple_linux_versions_is_rejected(tmp_path):
 def test_gitlab_split_tests_with_one_linux_version_is_allowed(tmp_path):
     """The guard is about fan-out, not about split_tests itself."""
     toml_file = write_gitlab_toml(
-        tmp_path, split_tests=True, linux_python_versions=["3.14"],
+        tmp_path,
+        matrix_table=WHEEL_ONLY, split_tests=True, linux_python_versions=["3.14"],
     )
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
     # split_tests still splits, and the single-version build stays a plain job.
-    assert "Run C++ Tests" in parsed
-    assert "parallel" not in parsed["Conan Build"]
+    assert "Run C++ Tests - Debug-testing" in parsed
+    assert "parallel" not in parsed["Debug Build"]
 
 
 def test_gitlab_coverage_image_uses_the_coverage_python_version(tmp_path):
     """Coverage pins one ABI, so it tracks the coverage version, not the fan-out."""
     toml_file = write_gitlab_toml(
-        tmp_path, coverage=True, linux_python_versions=["3.13", "3.14"],
+        tmp_path,
+        matrix_table=WHEEL_ONLY, coverage=True, linux_python_versions=["3.13", "3.14"],
         coverage_table={"python_version": "3.13"},
     )
     output_dir = tmp_path / "output"
     generate_ci(str(toml_file), "1.0.0", str(output_dir))
     parsed = yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
-    assert parsed["Coverage"]["image"].endswith("conan-gcc13-py3.13")
+    jobs = _instrumented_build_jobs(parsed)
+    assert jobs, "coverage = true must emit at least one instrumented build job"
+    for name, job in jobs.items():
+        assert job["image"].endswith("conan-gcc13-py3.13"), name
 
 
 def test_github_coverage_workflow_sets_up_the_pinned_python(tmp_path):
@@ -1435,10 +1662,27 @@ def github_arm_jobs(tmp_path):
     return _github_jobs(write_github_toml(tmp_path, linux_arm=True), tmp_path)
 
 
+def _is_build_step(step):
+    """Whether a step compiles the library, rather than consuming what it built.
+
+    Matched on the prefix because a job may have more than one: the Windows job
+    emits a branch step and a tag step under mutually exclusive ``if:``
+    conditions, the tag one narrowing the filter to the configurations a
+    release publishes. It runs under ``shell: cmd``, where ``%VAR%`` expands
+    before the argument is parsed, so a filter held in a variable would break
+    its own quoting -- the other three legs carry one step and select the
+    filter with a ``env:`` expression instead.
+    """
+    return str(step.get("name", "")).startswith(BUILD_STEP_NAME)
+
+
 def _build_step_run(job, job_name):
-    """Return the ``run:`` text of one job's build step."""
+    """Return the ``run:`` text of one job's build step.
+
+    The first, which is the branch-pipeline one wherever a job has two.
+    """
     for step in job["steps"]:
-        if step.get("name") == BUILD_STEP_NAME:
+        if _is_build_step(step):
             return str(step["run"])
     raise AssertionError(f"no {BUILD_STEP_NAME!r} step in the {job_name} job")
 
@@ -1459,7 +1703,7 @@ def test_github_every_platform_job_builds(github_arm_jobs):
     """The build step exists on each platform job, and only on those."""
     building = [
         name for name, job in github_arm_jobs.items()
-        if any(step.get("name") == BUILD_STEP_NAME for step in job.get("steps", []))
+        if any(_is_build_step(step) for step in job.get("steps", []))
     ]
     assert sorted(building) == sorted(BUILDING_JOBS)
 
@@ -1493,7 +1737,7 @@ def test_github_wheel_steps_stay_release_only(github_arm_jobs):
         (name, step.get("name"), str(step.get("if", "")))
         for name, job in github_arm_jobs.items()
         for step in job.get("steps", [])
-        if step.get("name") != BUILD_STEP_NAME and _touches_the_wheelhouse(step)
+        if not _is_build_step(step) and _touches_the_wheelhouse(step)
     ]
 
     assert sorted((name, step) for name, step, _ in wheel_steps) == WHEEL_CONSUMING_STEPS
@@ -1849,6 +2093,45 @@ def test_gitlab_drops_wheel_jobs_when_pybind_filtered_off(tmp_path):
     assert "Conan Build" in parsed, "the rest of the pipeline survives"
 
 
+_SPLIT_TESTS_CI_TABLE = """
+[ci]
+split_tests = true
+"""
+
+
+def test_gitlab_test_jobs_follow_a_build_type_pin(tmp_path):
+    """A pinned build_type leaves one testing configuration, so one test job."""
+    toml_file = _write_filtered_toml(
+        tmp_path,
+        ci_type="gitlab",
+        ci_table=_SPLIT_TESTS_CI_TABLE,
+        filter_table=_RELEASE_ONLY_FILTER,
+    )
+    generate_ci(str(toml_file), "1.0.0", str(tmp_path))
+
+    parsed = yaml.safe_load((tmp_path / ".gitlab-ci.yml").read_text(encoding="utf-8"))
+    assert _cxx_test_jobs(parsed).keys() == {"Run C++ Tests - Release-testing"}
+
+
+def test_gitlab_test_jobs_survive_a_pybind_pin_that_keeps_no_runner(tmp_path):
+    """split_tests with nothing to test is rejected, not silently green.
+
+    A pybind-only filter still leaves ``ci_build_types`` non-empty -- Release
+    keeps configurations -- so deriving the test jobs from that axis would emit
+    a job looking for a runner the build never staged. The build job has already
+    exported XMS_SKIP_CXX_TESTS=1 by then, so the suite would not have run
+    anywhere.
+    """
+    toml_file = _write_filtered_toml(
+        tmp_path,
+        ci_type="gitlab",
+        ci_table=_SPLIT_TESTS_CI_TABLE,
+        filter_table="\n[filter.options]\npybind = true\n",
+    )
+    with pytest.raises(ValueError, match="no Linux testing configuration"):
+        generate_ci(str(toml_file), "1.0.0", str(tmp_path))
+
+
 def test_gitlab_drops_windows_wheel_work_when_pybind_filtered_off(tmp_path):
     """The Windows leg's wheel work goes too, and the Conan deploys stay.
 
@@ -2119,3 +2402,486 @@ def test_github_ci_shard_flag_needs_more_than_one_shard(tmp_path):
     content = workflow.read_text(encoding="utf-8")
 
     assert "--test-shards" not in content
+
+
+#: A single backslash, named so the escaping assertions below do not have
+#: to contain one -- an escape sequence in a test about escape sequences is
+#: exactly where an off-by-one level of quoting hides.
+BACKSLASH = chr(92)
+
+
+def _gate(job):
+    """How a GitLab job is gated: "always", "only:<refs>" or "except:<refs>"."""
+    if "only" in job:
+        return "only:" + ",".join(job["only"])
+    if "except" in job:
+        return "except:" + ",".join(job["except"])
+    return "always"
+
+
+def _linux_build_gates(parsed):
+    """Each Linux build job's name mapped to its gate, in pipeline order."""
+    return {name: _gate(job) for name, job in parsed.items()
+            if isinstance(job, dict) and job.get("needs") == []}
+
+
+def test_gitlab_tag_pipeline_skips_the_testing_configurations(tmp_path):
+    """A tag builds what it publishes, and nothing installs a test runner.
+
+    The pipeline used to compile the testing configurations on a tag as well,
+    because one build job looped the whole matrix and had no way to build part
+    of it. A job per configuration can be gated per configuration, and the test
+    binaries are the part a release has no use for.
+    """
+    gates = _linux_build_gates(_gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, coverage=True))
+
+    assert gates["Release Build"] == "except:tags", (
+        "the Release testing configuration is branch-only: its consumer, the "
+        "C++ test job, is branch-only too"
+    )
+    assert gates["Debug Instrumented Build"] == "except:tags", (
+        "and so is the Debug testing configuration, which is additionally "
+        "instrumented for a Coverage stage that does not run on a tag"
+    )
+
+
+def test_gitlab_tag_pipeline_keeps_the_configurations_it_publishes(tmp_path):
+    """What a release ships still runs on the tag that ships it.
+
+    The narrowing drops the testing configurations, which nothing installs. It
+    must not drop the binary the wheel wraps -- a tag that built none of the
+    matrix would publish an empty release and still go green. Under wheel_only
+    the pybind build is the whole of what a tag publishes, and it reaches the
+    tag as the clean twin of the instrumented branch build.
+    """
+    gates = _linux_build_gates(_gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, coverage=True))
+
+    assert gates["Python Build"] == "only:tags"
+    assert any(gate != "except:tags" for gate in gates.values()), (
+        "a tag pipeline with every build job gated off would publish nothing"
+    )
+
+
+def test_gitlab_instrumented_pybind_never_reaches_a_tag(tmp_path):
+    """Instrumentation is in the package_id, so it must not be published.
+
+    The pybind configuration is emitted twice under mutually exclusive gates
+    rather than once with a runtime conditional, so exactly one of them exists
+    in any given pipeline and no shell branch decides which binary ships.
+    """
+    parsed = _gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, coverage=True)
+    instrumented = parsed["Python Instrumented Build"]
+    clean = parsed["Python Build"]
+
+    assert _gate(instrumented) == "except:tags"
+    assert _gate(clean) == "only:tags"
+    assert any("--phase measure" in step for step in instrumented["script"])
+    assert not any("--phase measure" in step for step in clean["script"]), (
+        "the published wheel is built by build.py directly, with no coverage "
+        "option in its package_id"
+    )
+
+
+def test_gitlab_only_taggable_jobs_save_an_export_tarball(tmp_path):
+    """A branch-only job's tarball would never be restored.
+
+    The deploy that restores them is ``only: tags``, so exporting from a
+    branch-only job would pay the artifact upload on every branch pipeline for
+    a file nothing ever reads.
+    """
+    parsed = _gitlab_jobs(tmp_path, coverage=True)
+    for name, job in parsed.items():
+        if not isinstance(job, dict) or job.get("needs") != []:
+            continue
+        saves = any("--save .export/" in step for step in job.get("script", []))
+        assert saves == (_gate(job) != "except:tags"), (name, _gate(job), saves)
+
+
+def test_gitlab_windows_tag_pipeline_narrows_its_filter(tmp_path):
+    """Windows narrows the same way, through a rules-selected variable.
+
+    Not through two jobs the way Linux does: this is still one job, and
+    splitting it would mean either duplicating forty lines or renaming it --
+    and "Conan Build - Windows" is the name both Windows deploy jobs point at.
+    """
+    job = _gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, windows=True)["Conan Build - Windows"]
+
+    # The branch default matches every configuration, so the build line can
+    # pass --filter unconditionally and quoted rather than relying on an empty
+    # variable disappearing through unquoted word splitting.
+    assert job["variables"]["BUILD_MATRIX_FILTER"] == '{"options":{}}'
+    assert job["rules"][0]["if"] == "$CI_COMMIT_TAG"
+    assert job["rules"][0]["variables"]["BUILD_MATRIX_FILTER"] == (
+        '{"options":{"testing":false}}'
+    )
+    assert job["rules"][-1] == {"when": "on_success"}, (
+        "without a catch-all rule a non-tag pipeline would drop the job"
+    )
+    build = [step for step in job["script"] if "build.py" in step]
+    assert build == [step for step in build if '--filter "${BUILD_MATRIX_FILTER}"' in step]
+
+
+def test_github_build_legs_narrow_their_filter_on_a_tag(tmp_path):
+    """The three bash legs select the filter with a step-level expression."""
+    jobs = _github_jobs(write_github_toml(tmp_path, matrix_table=WHEEL_ONLY, linux_arm=True), tmp_path)
+
+    for job_name in ("mac", "linux", "linux-arm"):
+        steps = [step for step in jobs[job_name]["steps"]
+                 if _is_build_step(step)]
+        assert len(steps) == 1, (job_name, steps)
+        step = steps[0]
+        assert '--filter=\"${BUILD_MATRIX_FILTER}\"' in str(step["run"]), job_name
+        expression = step["env"]["BUILD_MATRIX_FILTER"]
+        assert "startsWith(github.ref, 'refs/tags/')" in expression, job_name
+        assert '"options":{{"testing":false}}' in expression, job_name
+        assert BACKSLASH not in expression, (
+            "the JSON is written plainly inside the expression. An env "
+            "var is expanded by bash after both the YAML and the shell "
+            "have finished with the line, so it needs none of the escaping "
+            "the inline form carried -- that one spelled every quote it "
+            "contained as a backslash pyramid to survive all three layers."
+        )
+
+
+def test_github_windows_leg_narrows_with_two_gated_steps(tmp_path):
+    """The Windows leg gates two steps rather than selecting a variable.
+
+    ``%VAR%`` is substituted before the argument is parsed, so a filter held in
+    a variable would break its own quoting the moment it reached the command
+    line. The Windows leg keeps the filter inline and picks between two steps.
+    """
+    jobs = _github_jobs(write_github_toml(tmp_path, matrix_table=WHEEL_ONLY, linux_arm=True), tmp_path)
+    steps = [step for step in jobs["windows"]["steps"] if _is_build_step(step)]
+
+    assert len(steps) == 2, steps
+    branch, release = steps
+    assert branch["if"] == "!startsWith(github.ref, 'refs/tags/')"
+    assert release["if"] == "startsWith(github.ref, 'refs/tags/')"
+    assert all(step["shell"] == "cmd" for step in steps)
+    assert "BUILD_MATRIX_FILTER" not in str(steps), (
+        "cmd would substitute it before the argument is parsed"
+    )
+    assert "testing" not in str(branch["run"]), (
+        "a branch build takes the whole matrix for its build type"
+    )
+    assert "testing" in str(release["run"]), (
+        "and a tag build excludes the testing configurations"
+    )
+
+
+# --- [matrix].wheel_only gates the concurrent build stage -------------------
+#
+# The per-configuration build stage, the tag narrowing and the export fan-out
+# are one change, and it is wheel_only's alone. Every repository without the
+# flag has to keep generating exactly the pipeline it generated before, so
+# these tests assert the *old* shape is what comes out -- the gate is the
+# subject, not the pipeline.
+
+
+def test_gitlab_without_wheel_only_keeps_the_single_looping_build(tmp_path):
+    """No flag, no fan-out: one "Conan Build" that loops the whole matrix.
+
+    The concurrent stage was designed and measured against a wheel_only matrix,
+    which has no library configurations. A repository that publishes library
+    packages keeps what it had until that shape is proven too, so the flag is
+    what selects between them and not, say, the presence of coverage.
+    """
+    parsed = _gitlab_jobs(tmp_path, coverage=True, deploy=True)
+
+    assert "Conan Build" in parsed
+    # "Coverage Build" declares `needs: []` in this shape too, and always has:
+    # it is what starts the instrumented compile alongside "Conan Build"
+    # rather than at its stage's turn. The per-configuration build jobs are
+    # the ones that must not be here.
+    assert set(_linux_build_gates(parsed)) == {"Coverage Build"}, (
+        "`needs: []` is what makes the per-configuration jobs concurrent; "
+        "without wheel_only there are no such jobs to make concurrent"
+    )
+    for name in ("Release Build", "Debug Instrumented Build", "Python Build"):
+        assert name not in parsed, f"{name} belongs to the wheel_only stage"
+
+
+def test_gitlab_wheel_only_is_what_turns_the_concurrent_stage_on(tmp_path):
+    """The same build.toml plus the flag renders the other shape.
+
+    Paired with the test above so the two are read together: nothing but
+    [matrix].wheel_only differs between them.
+    """
+    parsed = _gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, coverage=True, deploy=True)
+
+    assert "Conan Build" not in parsed
+    gates = _linux_build_gates(parsed)
+    assert gates, "the per-configuration jobs all declare needs: []"
+    assert "Debug Instrumented Build" in gates
+
+
+def test_gitlab_without_wheel_only_keeps_the_separate_coverage_build(tmp_path):
+    """Coverage still compiles in a job of its own, and pages reads it there.
+
+    Without the fan-out there are no instrumented build-stage jobs to take
+    tracefiles from, so removing "Coverage Build" here would leave the report
+    job merging nothing and the pipeline green with no coverage measured.
+    """
+    parsed = _gitlab_jobs(tmp_path, coverage=True)
+
+    assert "Coverage Build" in parsed
+    assert parsed["Coverage"]["needs"] == [{"job": "Coverage Build", "artifacts": True}]
+    assert parsed["pages"]["dependencies"] == ["Coverage Build"]
+
+
+def test_gitlab_without_wheel_only_split_tests_need_the_build_that_exists(tmp_path):
+    """A `needs:` naming an undefined job fails the pipeline at config time.
+
+    The wheel_only test jobs each need their own per-configuration build. Those
+    jobs do not exist here, so the test jobs have to name "Conan Build" -- and
+    this is the failure the gate is most likely to reintroduce, because it
+    breaks the whole pipeline rather than one job.
+    """
+    parsed = _gitlab_jobs(tmp_path, split_tests=True, coverage=True)
+
+    defined = set(parsed)
+    for name, job in parsed.items():
+        if not isinstance(job, dict):
+            continue
+        for need in job.get("needs", []):
+            named = need["job"] if isinstance(need, dict) else need
+            assert named in defined, f"{name} needs undefined job {named!r}"
+    test_jobs = [job for name, job in parsed.items()
+                 if isinstance(name, str) and name.startswith("Run C++ Tests")]
+    assert test_jobs, "split_tests must still emit the C++ test jobs"
+    for job in test_jobs:
+        assert job["needs"] == [{"job": "Conan Build", "artifacts": True}]
+
+
+def test_gitlab_without_wheel_only_leaves_the_windows_build_unfiltered(tmp_path):
+    """The Windows tag narrowing is part of the same change, so it waits too."""
+    parsed = _gitlab_jobs(tmp_path, windows=True, deploy=True)
+    windows = parsed["Conan Build - Windows"]
+
+    assert "BUILD_MATRIX_FILTER" not in windows.get("variables", {})
+    assert "rules" not in windows
+    build = [step for step in windows["script"] if "build.py" in step]
+    assert len(build) == 1 and "--filter" not in build[0], build
+
+
+def test_gitlab_without_wheel_only_deploys_from_the_one_tarball(tmp_path):
+    """One build job means one export, restored and uploaded in one step."""
+    parsed = _gitlab_jobs(tmp_path, deploy=True)
+
+    assert parsed["Conan Deploy - Linux"]["dependencies"] == ["Conan Build"]
+    restores = [line for line in parsed["Conan Deploy - Linux"]["script"]
+                if "--restore" in line]
+    assert len(restores) == 1 and restores[0].endswith("--upload"), restores
+
+
+def test_github_without_wheel_only_builds_the_same_on_a_tag(tmp_path):
+    """Every GitHub leg keeps its unconditional build step.
+
+    The bash legs took the filter from a step `env:` and the cmd leg split into
+    two `if:`-gated steps. Both are the tag narrowing, so both wait for the
+    flag -- checked on every leg because they are four separate blocks in the
+    template and gating three of them would be a silent asymmetry.
+    """
+    jobs = _github_jobs(write_github_toml(tmp_path, linux_arm=True), tmp_path)
+
+    for name, job in jobs.items():
+        build = [step for step in job.get("steps", [])
+                 if _is_build_step(step)]
+        if not build:
+            continue
+        assert len(build) == 1, (name, [step.get("name") for step in build])
+        step = build[0]
+        assert "env" not in step or "BUILD_MATRIX_FILTER" not in step["env"], name
+        assert "if" not in step, name
+        assert "BUILD_MATRIX_FILTER" not in step["run"], name
+
+
+# --- the wheel a branch never builds ----------------------------------------
+#
+# The restructure made the clean pybind build `only: tags`, because a branch
+# has no use for the configuration a release publishes. Repair Wheel stayed
+# ungated and so kept running on branches, where the only surviving pybind job
+# is the instrumented one -- which measures coverage and writes no wheel. The
+# job then failed every branch pipeline on an empty wheelhouse.
+
+
+def _jobs_reaching(parsed, *, tags):
+    """The jobs GitLab would put in a tag pipeline, or in a branch pipeline."""
+    reaching = {}
+    for name, job in parsed.items():
+        if not isinstance(job, dict) or "script" not in job:
+            continue
+        gate = _gate(job)
+        if gate == "always":
+            reaching[name] = job
+        elif gate.startswith("only:"):
+            if tags and gate == "only:tags":
+                reaching[name] = job
+        elif gate.startswith("except:"):
+            if not (tags and gate == "except:tags"):
+                reaching[name] = job
+    return reaching
+
+
+def _upstreams(job):
+    """The jobs a job takes artifacts from, however it spells the dependency."""
+    for need in job.get("needs", []):
+        yield need["job"] if isinstance(need, dict) else need
+    for name in job.get("dependencies", []):
+        yield name
+
+
+def _script(job):
+    return "\n".join(job.get("script", []))
+
+
+def _supplies_a_wheel(name, reaching, seen=None):
+    """Whether `name` can hand a wheel downstream in this pipeline.
+
+    Either it builds one, or it inherits one from an upstream job that is in
+    this pipeline too. Following the dependency edges is the whole point: a
+    wheel only reaches a job the artifacts flow to, so a producer running on
+    some other platform's leg is not an answer.
+    """
+    seen = seen or set()
+    if name in seen or name not in reaching:
+        return False
+    seen.add(name)
+    script = _script(reaching[name])
+    if "build.py" in script and "--wheel-dir" in script:
+        return True
+    return any(_supplies_a_wheel(up, reaching, seen)
+               for up in _upstreams(reaching[name]))
+
+
+@pytest.mark.parametrize("tags", [False, True], ids=["branch", "tag"])
+@pytest.mark.parametrize("matrix_table", [None, WHEEL_ONLY], ids=["plain", "wheel_only"])
+def test_gitlab_wheel_consumers_have_a_producer_in_their_own_pipeline(
+        tmp_path, matrix_table, tags):
+    """No pipeline reaches a wheel-consuming job the wheel cannot reach.
+
+    The general form of the bug, asserted per pipeline flavor: repairing and
+    deploying both read `wheelhouse`, and a gate that leaves a consumer with no
+    producer upstream is what failed xmsvtk pipeline 63162. Windows keeps its
+    own ungated producer, so this has to follow the dependency edges rather
+    than ask whether the pipeline builds any wheel at all -- that weaker
+    question passes while Linux is broken.
+    """
+    parsed = _gitlab_jobs(
+        tmp_path, matrix_table=matrix_table, coverage=True, deploy=True)
+    reaching = _jobs_reaching(parsed, tags=tags)
+
+    for name, job in reaching.items():
+        script = _script(job)
+        if "xmsconan_wheel_repair" not in script and "xmsconan_wheel_deploy" not in script:
+            continue
+        assert _supplies_a_wheel(name, reaching), (
+            f"{name!r} reads wheelhouse, but no job it depends on builds a "
+            f"wheel in this pipeline; its upstreams were "
+            f"{sorted(_upstreams(job))}"
+        )
+
+
+def test_gitlab_wheel_only_repairs_the_wheel_only_on_a_tag(tmp_path):
+    """Repair Wheel is gated to match the one job that builds a wheel."""
+    parsed = _gitlab_jobs(tmp_path, matrix_table=WHEEL_ONLY, coverage=True, deploy=True)
+
+    assert _gate(parsed["Repair Wheel"]) == "only:tags"
+    assert _gate(parsed["Python Build"]) == "only:tags", (
+        "the gate is only correct while the clean pybind build is the producer"
+    )
+
+
+def test_gitlab_without_wheel_only_repairs_the_wheel_on_every_pipeline(tmp_path):
+    """No flag, no gate: one ungated build still makes a wheel on a branch.
+
+    Paired with the test above. The gate belongs to the restructure, so a
+    repository without the flag has to keep repairing on branches the way it
+    always did -- adding `only: tags` there would silently drop a check.
+    """
+    parsed = _gitlab_jobs(tmp_path, coverage=True, deploy=True)
+
+    assert _gate(parsed["Repair Wheel"]) == "always"
+    assert _gate(parsed["Conan Build"]) == "always"
+
+
+# --- wheel_only: filter warnings and the keys a narrowed matrix can empty ---
+
+
+def _wheel_only_with_filter(tmp_path, filter_table, **ci_flags):
+    """Render a wheel_only GitLab pipeline whose build.toml carries a [filter].
+
+    ``write_gitlab_toml`` has no [filter] parameter -- the table is appended
+    here rather than added to the shared helper, because these are the only
+    tests that need one and the helper's callers all read better without it.
+    """
+    toml_file = write_gitlab_toml(tmp_path, matrix_table=WHEEL_ONLY, **ci_flags)
+    toml_file.write_text(toml_file.read_text(encoding="utf-8") + filter_table,
+                         encoding="utf-8")
+    output_dir = tmp_path / "output"
+    generate_ci(str(toml_file), "1.0.0", str(output_dir))
+    return yaml.safe_load((output_dir / ".gitlab-ci.yml").read_text(encoding="utf-8"))
+
+
+def test_wheel_only_empty_job_warning_does_not_name_a_job_it_never_emits(
+    tmp_path, caplog,
+):
+    """The warning has to name the fan-out, not the job wheel_only replaced.
+
+    An os pin excludes every Linux configuration, so the concurrent build stage
+    renders empty. Naming "Conan Build" there would point the reader at a block
+    this pipeline does not contain -- and looking the name up in the emitted
+    jobs, finding none, would drop the warning entirely in exactly the case it
+    exists for.
+    """
+    with caplog.at_level(logging.WARNING):
+        _wheel_only_with_filter(tmp_path, '\n[filter]\nos = "Windows"\n',
+                                coverage=True, deploy=True)
+
+    warned = [r.getMessage() for r in caplog.records
+              if "empty matrix" in r.getMessage()]
+    assert warned, "an os pin empties the whole Linux fan-out and must warn"
+    assert any("Linux build jobs" in message for message in warned), warned
+    assert not any("Conan Build'" in message for message in warned), warned
+
+
+def test_deploy_omits_dependencies_when_the_filter_leaves_nothing_exporting(
+    tmp_path,
+):
+    """An empty `dependencies:` is a null key, and GitLab rejects the file.
+
+    Only jobs that run on a tag export a cache tarball, and a testing-only
+    filter makes every Linux job branch-only -- while the deploy job stays
+    gated on [ci].deploy alone. The key has to be dropped rather than emitted
+    empty; without `dependencies:` GitLab falls back to taking every earlier
+    stage's artifacts, which is what this block narrows rather than depends on.
+    """
+    parsed = _wheel_only_with_filter(
+        tmp_path, "\n[filter.options]\ntesting = true\n", deploy=True,
+    )
+
+    deploy = parsed["Conan Deploy - Linux"]
+    assert "dependencies" not in deploy, (
+        f"dependencies: rendered with nothing under it -> "
+        f"{deploy.get('dependencies')!r}"
+    )
+
+
+def test_coverage_omits_needs_when_the_filter_instruments_nothing(tmp_path):
+    """Same null-key guard on the Coverage job's `needs:`.
+
+    A Release pin cancels the Debug C++ leg and `pybind = false` the Python
+    one, which generation warns about and then renders anyway. The warning must
+    not be followed by a pipeline GitLab refuses to parse, or it reads as a
+    template bug instead of the filter problem it is.
+    """
+    parsed = _wheel_only_with_filter(
+        tmp_path,
+        '\n[filter]\nbuild_type = "Release"\n\n[filter.options]\npybind = false\n',
+        coverage=True,
+    )
+
+    coverage = parsed["Coverage"]
+    assert "needs" not in coverage, (
+        f"needs: rendered with nothing under it -> {coverage.get('needs')!r}"
+    )
diff --git a/tests/test_coverage_generator.py b/tests/test_coverage_generator.py
index 09511cd..9c7d690 100644
--- a/tests/test_coverage_generator.py
+++ b/tests/test_coverage_generator.py
@@ -20,15 +20,25 @@
     _find_coverage_package,
     _find_pytest_cov_artifact,
     _is_simple_relative_filter_pattern,
+    _log_gcov_data_size,
+    _measure_coverage,
     _py_percent_from_summary,
+    _read_coverage_status,
     _reexec_under_xvfb,
     _resolve_coverage_python_version,
     _resolve_gcovr_filters,
     _run_coverage_builds,
     _warn_if_tracefile_empty,
+    COVERAGE_STATUS_FILE,
     DEFAULT_LEG_TIMEOUT,
     EXIT_ERROR,
     EXIT_GATE_FAILED,
+    EXIT_OK,
+    LEG_CPP,
+    LEG_PYTHON,
+    PHASE_COLLECT,
+    PHASE_MEASURE,
+    PHASE_REPORT,
     run_coverage,
 )
 from xmsconan.generator_tools.ci_file_generator import _coverage_context
@@ -218,11 +228,11 @@ class TestFindCoveragePackage:
     def test_picks_newest_matching_package(self, mock_run):
         """When multiple revisions match, the highest timestamp wins."""
         mock_run.return_value = _fake_conan_list_output([
-            {"options": {"pybind": "True", "testing": "False",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "False",
                          "python_version": "3.13"},
              "settings": {"build_type": "Release"},
              "ts": 100, "pid": "old_pid"},
-            {"options": {"pybind": "True", "testing": "False",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "False",
                          "python_version": "3.13"},
              "settings": {"build_type": "Release"},
              "ts": 200, "pid": "new_pid"},
@@ -249,7 +259,7 @@ def test_accepts_bool_and_lowercase_truthy_options(self, mock_run):
         """Conan's option repr is not contractually 'True' — accept bool/case variants."""
         mock_run.return_value = _fake_conan_list_output([
             # bool True/False (not the strings "True"/"False")
-            {"options": {"pybind": True, "testing": False,
+            {"options": {"coverage": True, "pybind": True, "testing": False,
                          "python_version": "3.13"},
              "settings": {"build_type": "Release"},
              "ts": 100, "pid": "pid"},
@@ -270,7 +280,7 @@ def test_pybind_kind_skips_debug_builds(self, mock_run):
         asked for.
         """
         mock_run.return_value = _fake_conan_list_output([
-            {"options": {"pybind": "True", "testing": "False",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "False",
                          "python_version": "3.13"},
              "settings": {"build_type": "Debug"},
              "ts": 100, "pid": "debug_pid"},
@@ -284,7 +294,7 @@ def test_pybind_kind_skips_debug_builds(self, mock_run):
     def test_testing_kind_skips_release_builds(self, mock_run):
         """kind='testing' wants Debug; gcov instruments an unoptimized build."""
         mock_run.return_value = _fake_conan_list_output([
-            {"options": {"testing": "True", "pybind": "False"},
+            {"options": {"coverage": "True", "testing": "True", "pybind": "False"},
              "settings": {"build_type": "Release"},
              "ts": 100, "pid": "release_pid"},
         ])
@@ -304,7 +314,7 @@ def test_pybind_kind_rejects_combined_testing_true_pybind_true(self, mock_run):
         non-determinism between the CxxTest and pytest-cov sources).
         """
         mock_run.return_value = _fake_conan_list_output([
-            {"options": {"pybind": "True", "testing": "True",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "True",
                          "python_version": "3.13"},
              "settings": {"build_type": "Debug"},
              "ts": 100, "pid": "combined_pid"},
@@ -323,11 +333,11 @@ def test_pins_to_requested_python_version(self, mock_run):
         the Python coverage report (non-determinism).
         """
         mock_run.return_value = _fake_conan_list_output([
-            {"options": {"pybind": "True", "testing": "False",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "False",
                          "python_version": "3.10"},
              "settings": {"build_type": "Release"},
              "ts": 999, "pid": "pid_310"},  # newer
-            {"options": {"pybind": "True", "testing": "False",
+            {"options": {"coverage": "True", "pybind": "True", "testing": "False",
                          "python_version": "3.13"},
              "settings": {"build_type": "Release"},
              "ts": 100, "pid": "pid_313"},  # older
@@ -344,9 +354,9 @@ def test_find_testing_package_matches_testing_only_debug(self, monkeypatch):
         monkeypatch.setattr(
             "xmsconan.coverage_tools.coverage_generator.subprocess.run",
             lambda *a, **kw: _fake_conan_list_output([
-                {"options": {"testing": "True", "pybind": "False"},
+                {"options": {"coverage": "True", "testing": "True", "pybind": "False"},
                  "settings": {"build_type": "Debug"}, "ts": 1},
-                {"options": {"testing": "False", "pybind": "True",
+                {"options": {"coverage": "True", "testing": "False", "pybind": "True",
                              "python_version": "3.13"},
                  "settings": {"build_type": "Release"}, "ts": 2},
             ]),
@@ -361,12 +371,12 @@ def test_find_pybind_package_matches_pybind_only_pinned_python(self, monkeypatch
         monkeypatch.setattr(
             "xmsconan.coverage_tools.coverage_generator.subprocess.run",
             lambda *a, **kw: _fake_conan_list_output([
-                {"options": {"testing": "True", "pybind": "False"},
+                {"options": {"coverage": "True", "testing": "True", "pybind": "False"},
                  "settings": {"build_type": "Debug"}, "ts": 1},
-                {"options": {"testing": "False", "pybind": "True",
+                {"options": {"coverage": "True", "testing": "False", "pybind": "True",
                              "python_version": "3.10"},
                  "settings": {"build_type": "Release"}, "ts": 2},
-                {"options": {"testing": "False", "pybind": "True",
+                {"options": {"coverage": "True", "testing": "False", "pybind": "True",
                              "python_version": "3.13"},
                  "settings": {"build_type": "Release"}, "ts": 3},
             ]),
@@ -386,6 +396,34 @@ def test_find_coverage_package_rejects_unknown_kind(self):
         with pytest.raises(ValueError, match="kind"):
             _find_coverage_package("xmscore", kind="both")
 
+    @patch("xmsconan.coverage_tools.coverage_generator.subprocess.run")
+    def test_skips_uninstrumented_sibling_package(self, mock_run):
+        """An uninstrumented sibling in the cache must never win.
+
+        Coverage becoming a recipe option means instrumented and production
+        builds coexist as sibling package_ids under one recipe revision — on
+        any machine that has run both build.py and xmsconan coverage. The
+        production sibling's package_id drops the option entirely, so its
+        options carry no coverage key at all; matching it would hand gcovr a
+        build folder with no .gcda and report near-zero coverage without an
+        error. The uninstrumented sibling here is NEWER, so a
+        timestamp-ordered pick without the option check would choose it.
+        """
+        mock_run.return_value = _fake_conan_list_output([
+            {"options": {"pybind": "True", "testing": "False",
+                         "python_version": "3.13"},
+             "settings": {"build_type": "Release"},
+             "ts": 999, "pid": "production_pid"},  # newer, no coverage key
+            {"options": {"coverage": "True", "pybind": "True",
+                         "testing": "False", "python_version": "3.13"},
+             "settings": {"build_type": "Release"},
+             "ts": 100, "pid": "instrumented_pid"},
+        ])
+        ref, pid = _find_coverage_package(
+            "xmscore", kind="pybind", python_version="3.13",
+        )
+        assert pid == "instrumented_pid"
+
 
 class TestResolveCoveragePythonVersion:
     """Picks the single python_version the coverage build pins to (issue #65)."""
@@ -781,8 +819,9 @@ def test_raises_when_line_total_zero(self, tmp_path):
             )
         msg = str(exc_info.value)
         assert str(build_folder) in msg
-        # Diagnostic must name the most likely cause (XMS_COVERAGE / #69):
-        assert "XMS_COVERAGE" in msg or "#69" in msg
+        # Diagnostic must name the most likely cause (coverage=True option
+        # not reaching the build):
+        assert "coverage=True" in msg
         # And echo the filters we actually used, so the operator can
         # compare them against the real source paths:
         assert "xmscore/" in msg
@@ -840,6 +879,68 @@ def test_passes_when_line_total_key_absent(self, tmp_path):
         _assert_gcovr_collected_data(summary, [(tmp_path, ["xmscore/"])])
 
 
+class TestLogGcovDataSize:
+    """The .gcno/.gcda volume log.
+
+    The number it reports decides whether an instrumented build folder can be
+    split across two CI jobs: gcovr needs .gcno beside .gcda, so a test run in
+    a different job than the compile has to carry every notes file with it.
+    """
+
+    _messages = staticmethod(logged_messages)
+
+    @staticmethod
+    def _make_folder(root: Path, gcno: int, gcda: int, size: int) -> Path:
+        """Build a folder holding the requested gcov files, nested one deep."""
+        nested = root / "CMakeFiles" / "runner.dir"
+        nested.mkdir(parents=True)
+        for index in range(gcno):
+            (nested / f"src{index}.cpp.gcno").write_bytes(b"x" * size)
+        for index in range(gcda):
+            (nested / f"src{index}.cpp.gcda").write_bytes(b"y" * size)
+        return root
+
+    def test_reports_counts_and_megabytes_per_folder(self, tmp_path, caplog):
+        """Each folder gets a line naming it and both file populations."""
+        cpp = self._make_folder(tmp_path / "cpp", gcno=3, gcda=2,
+                                size=512 * 1024)
+        py = self._make_folder(tmp_path / "py", gcno=1, gcda=1,
+                               size=256 * 1024)
+        with caplog.at_level(logging.INFO, logger=LOGGER_NAME):
+            _log_gcov_data_size([cpp, py])
+        text = "\n".join(self._messages(caplog))
+
+        assert str(cpp) in text and str(py) in text
+        # Counted and summed, not merely listed: 3 x 0.5 MiB of notes.
+        assert "3 .gcno (1.5 MiB)" in text
+        assert "2 .gcda (1.0 MiB)" in text
+        assert "1 .gcno (0.2 MiB)" in text
+
+    def test_finds_files_at_any_depth(self, tmp_path, caplog):
+        """Coverage data sits under CMakeFiles/<target>.dir, not at the root."""
+        folder = tmp_path / "build"
+        deep = folder / "a" / "b" / "c"
+        deep.mkdir(parents=True)
+        (deep / "buried.cpp.gcno").write_bytes(b"z" * (1024 * 1024))
+        with caplog.at_level(logging.INFO, logger=LOGGER_NAME):
+            _log_gcov_data_size([folder])
+        assert "1 .gcno (1.0 MiB)" in "\n".join(self._messages(caplog))
+
+    def test_reports_zero_rather_than_staying_silent(self, tmp_path, caplog):
+        """An uninstrumented folder is a finding, so it still gets a line.
+
+        Silence would read the same as the log statement never running, and
+        the whole point is to notice a folder that produced nothing.
+        """
+        folder = tmp_path / "empty"
+        folder.mkdir()
+        with caplog.at_level(logging.INFO, logger=LOGGER_NAME):
+            _log_gcov_data_size([folder])
+        text = "\n".join(self._messages(caplog))
+        assert str(folder) in text
+        assert "0 .gcno (0.0 MiB)" in text
+
+
 class TestWarnIfTracefileEmpty:
     """A build folder that contributes nothing must say so in the log.
 
@@ -863,7 +964,7 @@ def test_warns_when_no_files(self, tmp_path, caplog):
         assert "FILTER-SENTINEL" in text
         # Points at instrumentation, the actual cause, rather than at tests
         # not covering the code -- a compiled file appears here regardless.
-        assert "XMS_COVERAGE" in text or "#69" in text
+        assert "coverage=True" in text
 
     def test_silent_when_files_present(self, tmp_path, caplog):
         """A folder that contributed files is not worth mentioning.
@@ -2101,3 +2202,401 @@ def _record(cmd, env=None, cwd=None, timeout=None, **kwargs):
             _run_coverage_builds(_LEGS, "1.0.0", None, ".", parallel=True)
 
         assert seen["timeout"] == DEFAULT_LEG_TIMEOUT
+
+
+def _report_workspace(tmp_path, *, cpp=80.0, py=90.0, cpp_threshold=70.0,
+                      py_threshold=70.0, status=None, omit=()):
+    """Write what a finished collect phase leaves behind.
+
+    The report phase reads nothing but these files, which is the property that
+    makes the gate testable at all: it needs no conan cache, no compiler and no
+    gcovr. Before the split the same logic could only be reached by driving two
+    real builds.
+    """
+    (tmp_path / "build.toml").write_text(
+        'library_name = "xmscore"\n'
+        'description = "desc"\n'
+        "\n[coverage]\n"
+        f"cpp_threshold = {cpp_threshold}\n"
+        f"python_threshold = {py_threshold}\n",
+        encoding="utf-8",
+    )
+    files = {
+        "cov-cpp-summary.json": {"line_percent": cpp},
+        "cov-py-summary.json": {"totals": {"percent_covered": py}},
+        COVERAGE_STATUS_FILE: status if status is not None else {
+            "tests_failed": False, "cpp_measured": True, "py_measured": True,
+        },
+    }
+    for name, payload in files.items():
+        if name in omit:
+            continue
+        (tmp_path / name).write_text(json.dumps(payload), encoding="utf-8")
+    return str(tmp_path / "build.toml"), str(tmp_path)
+
+
+class TestReportPhase:
+    """The gate, split off from the builds it used to share a job with."""
+
+    def test_passes_when_both_layers_clear_their_thresholds(self, tmp_path):
+        """The happy path, reached without building anything."""
+        toml_file, output_dir = _report_workspace(tmp_path)
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_OK
+
+    def test_fails_the_gate_on_a_threshold_miss(self, tmp_path):
+        """A miss is the advisory exit code, not a hard error."""
+        toml_file, output_dir = _report_workspace(tmp_path, cpp=50.0)
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_GATE_FAILED
+
+    def test_thresholds_come_from_build_toml_not_the_status_file(self, tmp_path):
+        """Tightening a threshold takes effect without re-running the builds.
+
+        The percentages are whatever the collect phase measured; the bar they
+        are held to is read fresh, so a threshold edit can be re-gated against
+        artifacts that already exist.
+        """
+        toml_file, output_dir = _report_workspace(tmp_path, cpp=80.0,
+                                                  cpp_threshold=95.0)
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_GATE_FAILED
+
+    @pytest.mark.parametrize("unmeasured", ["cpp_measured", "py_measured"])
+    def test_an_unmeasured_layer_fails_even_at_a_zero_threshold(self, tmp_path,
+                                                                unmeasured):
+        """No measurement is not 0% coverage, and the default threshold is 0.
+
+        Without the status file the report phase could not tell the two apart:
+        a merged gcovr summary covering the binding layer alone still carries a
+        healthy line_percent, and 0.0 >= 0.0 would report PASS for a layer that
+        never ran.
+        """
+        status = {"tests_failed": False, "cpp_measured": True, "py_measured": True}
+        status[unmeasured] = False
+        toml_file, output_dir = _report_workspace(
+            tmp_path, cpp_threshold=0.0, py_threshold=0.0, status=status,
+        )
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_GATE_FAILED
+
+    def test_failed_tests_fail_the_gate_though_the_percentages_pass(self, tmp_path):
+        """build.py exiting non-zero during collection has to survive the split.
+
+        It is the one fact that lives only in the collect job's exit status, so
+        losing it would let a pipeline with failing tests gate green on the
+        coverage those same tests produced.
+        """
+        toml_file, output_dir = _report_workspace(tmp_path, status={
+            "tests_failed": True, "cpp_measured": True, "py_measured": True,
+        })
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_GATE_FAILED
+
+    def test_missing_status_file_is_an_error_not_a_gate_miss(self, tmp_path, caplog):
+        """A collect job that never delivered must not be forgiven.
+
+        The generated pipeline puts `allow_failure: exit_codes` on the gate
+        code alone, so returning it here would let a coverage run that produced
+        nothing pass as an advisory miss -- exactly the blanket
+        `allow_failure: true` failure this exit-code split exists to prevent.
+        """
+        toml_file, output_dir = _report_workspace(
+            tmp_path, omit=(COVERAGE_STATUS_FILE,),
+        )
+
+        with caplog.at_level(logging.ERROR, logger=LOGGER_NAME):
+            assert run_coverage(toml_file, "1.0.0", output_dir,
+                                phase=PHASE_REPORT) == EXIT_ERROR
+        assert any(COVERAGE_STATUS_FILE in m for m in logged_messages(caplog))
+
+    def test_missing_cpp_summary_is_an_error(self, tmp_path):
+        """Same reasoning: artifacts that did not arrive are not a threshold miss."""
+        toml_file, output_dir = _report_workspace(
+            tmp_path, omit=("cov-cpp-summary.json",),
+        )
+
+        assert run_coverage(toml_file, "1.0.0", output_dir,
+                            phase=PHASE_REPORT) == EXIT_ERROR
+
+    def test_prints_the_line_gitlab_scrapes_for_the_pipeline_percentage(
+            self, tmp_path, caplog):
+        """`coverage:` reads the gating job's log, and gcovr's TOTAL is elsewhere.
+
+        gcovr writes its own TOTAL in the collect job, whose log GitLab does not
+        scrape, so the number has to be re-emitted here or the pipeline shows no
+        coverage at all.
+        """
+        toml_file, output_dir = _report_workspace(tmp_path, cpp=82.4)
+
+        with caplog.at_level(logging.INFO, logger=LOGGER_NAME):
+            run_coverage(toml_file, "1.0.0", output_dir, phase=PHASE_REPORT)
+
+        assert "Coverage total: 82.4%" in logged_messages(caplog)
+
+    def test_an_unmeasured_cpp_layer_publishes_no_percentage(self, tmp_path, caplog):
+        """An unmeasured layer logs n/a, which the regex matches nothing in.
+
+        The regex would otherwise scrape the merged percentage -- which covers
+        the binding layer alone in that case -- and show it as the pipeline's
+        coverage.
+        """
+        toml_file, output_dir = _report_workspace(tmp_path, cpp=82.4, status={
+            "tests_failed": False, "cpp_measured": False, "py_measured": True,
+        })
+
+        with caplog.at_level(logging.INFO, logger=LOGGER_NAME):
+            run_coverage(toml_file, "1.0.0", output_dir, phase=PHASE_REPORT)
+
+        assert "Coverage total: n/a" in logged_messages(caplog)
+
+    def test_report_phase_builds_nothing(self, tmp_path):
+        """No subprocess at all: the point of the split is a job with no toolchain."""
+        toml_file, output_dir = _report_workspace(tmp_path)
+
+        with patch("xmsconan.coverage_tools.coverage_generator.subprocess.run") as run:
+            run_coverage(toml_file, "1.0.0", output_dir, phase=PHASE_REPORT)
+
+        run.assert_not_called()
+
+    def test_an_unknown_phase_is_rejected(self, tmp_path):
+        """A typo must not silently select a half of the run."""
+        toml_file, output_dir = _report_workspace(tmp_path)
+
+        with pytest.raises(ValueError, match="Unknown coverage phase"):
+            run_coverage(toml_file, "1.0.0", output_dir, phase="collct")
+
+    def test_a_failed_collect_does_not_reach_the_gate(self, tmp_path):
+        """The default phase stops on a collect error rather than gating on it.
+
+        EXIT_ERROR has to survive to the caller: mapping it onto the gate code
+        would put it inside `allow_failure: exit_codes`.
+        """
+        toml_file, output_dir = _report_workspace(tmp_path)
+
+        with patch("xmsconan.coverage_tools.coverage_generator._collect_coverage",
+                   return_value=EXIT_ERROR) as collect:
+            with patch("xmsconan.coverage_tools.coverage_generator._report_coverage") as report:
+                assert run_coverage(toml_file, "1.0.0", output_dir) == EXIT_ERROR
+
+        collect.assert_called_once()
+        report.assert_not_called()
+
+    def test_collect_phase_stops_before_the_gate(self, tmp_path):
+        """--phase collect writes the artifacts and leaves the gating to the other job."""
+        toml_file, output_dir = _report_workspace(tmp_path)
+
+        with patch("xmsconan.coverage_tools.coverage_generator._collect_coverage",
+                   return_value=EXIT_OK):
+            with patch("xmsconan.coverage_tools.coverage_generator._report_coverage") as report:
+                assert run_coverage(toml_file, "1.0.0", output_dir,
+                                    phase=PHASE_COLLECT) == EXIT_OK
+
+        report.assert_not_called()
+
+
+class TestMeasurePhase:
+    """``--phase measure``: one instrumented leg, read where it was compiled.
+
+    The phase exists so the two instrumented builds can be concurrent GitLab
+    jobs. That makes its per-leg output naming load-bearing rather than
+    cosmetic -- both jobs upload into one artifact space -- so these assert on
+    the files each leg wrote as much as on the exit code.
+    """
+
+    def _setup_workspace(self, tmp_path, *, py_percent=80.0):
+        """A build.toml plus one build folder per leg, with gcovr stubbed.
+
+        Mirrors ``TestRunCoverageEndToEnd._setup_workspace`` but stays separate:
+        that helper stages the pair for a single ``collect`` run, and the point
+        here is that one leg runs alone and still writes a complete slice.
+        """
+        toml_file = tmp_path / "build.toml"
+        toml_file.write_text(
+            'library_name = "xmscore"\n'
+            'description = "desc"\n'
+            'python_namespaced_dir = "core"\n'
+            '\n'
+            '[coverage]\n'
+            'cpp_threshold = 70\n'
+            'python_threshold = 70\n',
+            encoding="utf-8",
+        )
+        cpp_build_folder = tmp_path / "fake-cpp-build"
+        py_build_folder = tmp_path / "fake-py-build"
+        cpp_build_folder.mkdir()
+        py_build_folder.mkdir()
+        (py_build_folder / "cov-py-summary.json").write_text(
+            json.dumps({"totals": {"percent_covered": py_percent}})
+        )
+        (py_build_folder / "cov-py.xml").write_text("<coverage/>")
+
+        def fake_run(cmd, env=None, cwd=None, **_kw):
+            if isinstance(cmd, list) and cmd and cmd[0] == "gcovr":
+                if "--json" in cmd and "--json-summary" not in cmd:
+                    idx = cmd.index("--json")
+                    Path(cmd[idx + 1]).write_text(json.dumps({
+                        "files": [{"file": "xmscore/foo.cpp", "lines": []}],
+                    }))
+            return MagicMock(returncode=0)
+
+        return toml_file, cpp_build_folder, py_build_folder, fake_run
+
+    @staticmethod
+    def _wire(mock_run, mock_path, mock_find, fake_run,
+              cpp_build_folder, py_build_folder, *, missing=()):
+        """Point the package lookup at the fake build folders.
+
+        ``missing`` names the kinds whose build left no package, which is what
+        ``_find_coverage_package`` signals with RuntimeError and what
+        ``_locate_coverage_build`` turns into None.
+        """
+        mock_run.side_effect = fake_run
+
+        def find(library_name, *, kind, python_version=None):
+            if kind in missing:
+                raise RuntimeError(f"no {kind} package in the cache")
+            return ("xmscore/0.0.0", "pid-cpp" if kind == "testing" else "pid-py")
+
+        mock_find.side_effect = find
+        mock_path.side_effect = lambda ref_with_pid, folder: (
+            cpp_build_folder if "pid-cpp" in ref_with_pid else py_build_folder
+        )
+
+    # --- the dispatch guards ---
+
+    def test_measure_without_a_leg_is_an_error(self, tmp_path):
+        """``--phase measure`` with no ``--leg`` refuses rather than guessing.
+
+        Defaulting to one leg would measure a single layer while the report
+        phase gated on both, and the unmeasured layer's threshold defaults to
+        0 -- so the guess would read as a clean pass.
+        """
+        toml_file, _, _, _ = self._setup_workspace(tmp_path)
+        with pytest.raises(ValueError, match="--leg"):
+            run_coverage(str(toml_file), "0.0.0", str(tmp_path),
+                         phase=PHASE_MEASURE)
+
+    def test_measure_rejects_an_unknown_leg(self, tmp_path):
+        """A leg outside COVERAGE_LEGS raises before anything is built."""
+        toml_file, _, _, _ = self._setup_workspace(tmp_path)
+        with pytest.raises(ValueError, match="Unknown coverage leg"):
+            _measure_coverage(str(toml_file), "0.0.0", str(tmp_path), "rust")
+
+    # --- what each leg writes ---
+
+    @patch("xmsconan.coverage_tools.coverage_generator._find_coverage_package")
+    @patch("xmsconan.coverage_tools.coverage_generator._conan_cache_path")
+    @patch("xmsconan.coverage_tools.coverage_generator.subprocess.run")
+    def test_cpp_leg_writes_its_own_status_and_tracefile(
+        self, mock_run, mock_path, mock_find, tmp_path,
+    ):
+        """The C++ leg reports itself measured and the Python layer not.
+
+        Each leg reports only on itself so a leg that never ran leaves its
+        layer unmeasured, rather than inheriting the surviving leg's answer.
+        """
+        toml_file, cpp, py, fake_run = self._setup_workspace(tmp_path)
+        self._wire(mock_run, mock_path, mock_find, fake_run, cpp, py)
+
+        exit_code = _measure_coverage(str(toml_file), "0.0.0", str(tmp_path),
+                                      LEG_CPP)
+
+        assert exit_code == EXIT_OK
+        status = json.loads(
+            (tmp_path / "coverage-status-cpp.json").read_text()
+        )
+        assert status == {"tests_failed": False, "cpp_measured": True,
+                          "py_measured": False}
+        assert (tmp_path / "cov-cpp-tracefile-cpp.json").exists()
+
+    @patch("xmsconan.coverage_tools.coverage_generator._find_coverage_package")
+    @patch("xmsconan.coverage_tools.coverage_generator._conan_cache_path")
+    @patch("xmsconan.coverage_tools.coverage_generator.subprocess.run")
+    def test_python_leg_writes_its_own_status_and_lifts_pytest_cov_output(
+        self, mock_run, mock_path, mock_find, tmp_path,
+    ):
+        """The Python leg copies pytest-cov's summary out of the build folder.
+
+        ``py_measured`` is conditional on that copy: pytest-cov writing nothing
+        means the layer was not measured, and a Python threshold defaulting to
+        0 would otherwise pass a layer nothing ran.
+        """
+        toml_file, cpp, py, fake_run = self._setup_workspace(tmp_path)
+        self._wire(mock_run, mock_path, mock_find, fake_run, cpp, py)
+
+        exit_code = _measure_coverage(str(toml_file), "0.0.0", str(tmp_path),
+                                      LEG_PYTHON)
+
+        assert exit_code == EXIT_OK
+        status = json.loads(
+            (tmp_path / "coverage-status-python.json").read_text()
+        )
+        assert status == {"tests_failed": False, "cpp_measured": False,
+                          "py_measured": True}
+        assert (tmp_path / "cov-cpp-tracefile-python.json").exists()
+        assert (tmp_path / "cov-py-summary.json").exists()
+
+    @patch("xmsconan.coverage_tools.coverage_generator._find_coverage_package")
+    @patch("xmsconan.coverage_tools.coverage_generator._conan_cache_path")
+    @patch("xmsconan.coverage_tools.coverage_generator.subprocess.run")
+    def test_the_two_legs_do_not_overwrite_each_other(
+        self, mock_run, mock_path, mock_find, tmp_path,
+    ):
+        """Both legs land in one output dir and the report phase unions them.
+
+        This is the property the per-leg filenames exist for: the two measuring
+        jobs upload into a single artifact space, and a fixed filename would
+        leave whichever finished last as the only surviving answer -- a status
+        that still looks complete while asserting one layer unmeasured.
+        """
+        toml_file, cpp, py, fake_run = self._setup_workspace(tmp_path)
+        self._wire(mock_run, mock_path, mock_find, fake_run, cpp, py)
+
+        _measure_coverage(str(toml_file), "0.0.0", str(tmp_path), LEG_CPP)
+        _measure_coverage(str(toml_file), "0.0.0", str(tmp_path), LEG_PYTHON)
+
+        assert sorted(f.name for f in tmp_path.glob("coverage-status-*.json")) == [
+            "coverage-status-cpp.json", "coverage-status-python.json",
+        ]
+        assert sorted(f.name for f in tmp_path.glob("cov-cpp-tracefile-*.json")) == [
+            "cov-cpp-tracefile-cpp.json", "cov-cpp-tracefile-python.json",
+        ]
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": True,
+        }
+
+    # --- the failure the pipeline gates on ---
+
+    @patch("xmsconan.coverage_tools.coverage_generator._find_coverage_package")
+    @patch("xmsconan.coverage_tools.coverage_generator._conan_cache_path")
+    @patch("xmsconan.coverage_tools.coverage_generator.subprocess.run")
+    def test_a_leg_that_left_no_package_errors_and_records_nothing_measured(
+        self, mock_run, mock_path, mock_find, tmp_path,
+    ):
+        """No package means exit 1 and no tracefile, not an empty one.
+
+        This is what fails the build-stage job when an instrumented build dies:
+        EXIT_ERROR, not EXIT_OK. An empty tracefile would merge as a layer that
+        is genuinely 0% covered, which reads as a coverage regression rather
+        than as the broken build it is.
+        """
+        toml_file, cpp, py, fake_run = self._setup_workspace(tmp_path)
+        self._wire(mock_run, mock_path, mock_find, fake_run, cpp, py,
+                   missing=("testing",))
+
+        exit_code = _measure_coverage(str(toml_file), "0.0.0", str(tmp_path),
+                                      LEG_CPP)
+
+        assert exit_code == EXIT_ERROR
+        status = json.loads(
+            (tmp_path / "coverage-status-cpp.json").read_text()
+        )
+        assert status["cpp_measured"] is False
+        assert status["py_measured"] is False
+        assert list(tmp_path.glob("cov-cpp-tracefile-*.json")) == []
diff --git a/tests/test_coverage_status.py b/tests/test_coverage_status.py
new file mode 100644
index 0000000..47d0d2b
--- /dev/null
+++ b/tests/test_coverage_status.py
@@ -0,0 +1,153 @@
+"""The per-leg coverage status files and how the report phase unions them.
+
+A ``collect`` run measures both layers in one job and writes one status file.
+A split pipeline measures each layer in its own concurrent build job, and each
+one writes a file named for its leg. Both shapes have to reach the report phase
+as the same three answers, which is what these cover.
+"""
+import json
+from pathlib import Path
+
+from xmsconan.coverage_tools.coverage_generator import (
+    _read_coverage_status,
+    _write_coverage_status,
+    COVERAGE_STATUS_FILE,
+)
+
+
+def _write(output_dir, name, **fields):
+    """Write a status file directly, for the malformed and legacy cases."""
+    (Path(output_dir) / name).write_text(json.dumps(fields), encoding="utf-8")
+
+
+class TestWriteCoverageStatus:
+    """What ``--phase measure`` leaves behind for the report job."""
+
+    def test_no_leg_writes_the_whole_run_file(self, tmp_path):
+        """``collect`` measures both layers itself, so it owns the plain name."""
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=True)
+        assert (tmp_path / COVERAGE_STATUS_FILE).exists()
+        assert not list(tmp_path.glob("coverage-status-*.json"))
+
+    def test_a_leg_suffixes_the_filename(self, tmp_path):
+        """Two concurrent jobs must not write the same path.
+
+        They upload into one artifact space, so a fixed name would leave
+        whichever finished last as the only surviving answer -- discarding the
+        other layer's measurement while still looking like a complete status.
+        """
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=False, leg="cpp")
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert sorted(p.name for p in tmp_path.glob("coverage-status-*.json")) == [
+            "coverage-status-cpp.json", "coverage-status-python.json",
+        ]
+        assert not (tmp_path / COVERAGE_STATUS_FILE).exists()
+
+
+class TestReadCoverageStatus:
+    """The union the report phase applies over whatever the legs wrote."""
+
+    def test_absent_status_is_none(self, tmp_path):
+        """Distinguishable from a status that says nothing was measured.
+
+        The report phase treats the two differently: no file means the
+        measuring phase did not finish, which is an error rather than a gate
+        failure.
+        """
+        assert _read_coverage_status(tmp_path) is None
+
+    def test_whole_run_file_is_read_unchanged(self, tmp_path):
+        """``--phase all`` and ``--phase collect`` keep working as they were."""
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=True)
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": True,
+        }
+
+    def test_two_legs_union_into_both_layers_measured(self, tmp_path):
+        """Each leg reports only on itself; together they cover both layers."""
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=False, leg="cpp")
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": True,
+        }
+
+    def test_a_missing_leg_leaves_its_own_layer_unmeasured(self, tmp_path):
+        """The surviving leg must not vouch for the layer it did not measure.
+
+        This is the case the union exists for. Python's threshold defaults to
+        0, so a run where the Python job never uploaded would clear its gate on
+        a default and report green -- while measuring nothing.
+        """
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=False, leg="cpp")
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": False,
+        }
+
+    def test_one_leg_failing_tests_fails_the_union(self, tmp_path):
+        """Either leg's tests failing has to reach the gate."""
+        _write_coverage_status(tmp_path, tests_failed=True,
+                               cpp_measured=True, py_measured=False, leg="cpp")
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert _read_coverage_status(tmp_path)["tests_failed"] is True
+
+    def test_legacy_and_per_leg_files_union_together(self, tmp_path):
+        """A pipeline mid-migration can have both, and neither may be ignored."""
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=True, py_measured=False)
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": True,
+        }
+
+    def test_an_unreadable_leg_does_not_discard_the_readable_one(self, tmp_path):
+        """A truncated upload must not erase the leg that arrived intact."""
+        (tmp_path / "coverage-status-cpp.json").write_text("{not json",
+                                                           encoding="utf-8")
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": False, "py_measured": True,
+        }
+
+    def test_a_leg_holding_json_that_is_not_an_object_is_ignored(self, tmp_path):
+        """Valid JSON of the wrong shape must not crash the gate.
+
+        The union calls ``.get`` on every payload, so a file holding a list or
+        a bare string would reach it as a readable status and raise
+        AttributeError from inside the job whose whole purpose is to report a
+        verdict. Treated as unreadable instead, which falls through to the
+        unmeasured-layer path and fails the gate loudly.
+        """
+        (tmp_path / "coverage-status-cpp.json").write_text(
+            '["cpp_measured"]', encoding="utf-8")
+        _write_coverage_status(tmp_path, tests_failed=False,
+                               cpp_measured=False, py_measured=True, leg="python")
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": False, "py_measured": True,
+        }
+
+    def test_every_leg_holding_a_non_object_reads_as_no_status_at_all(self, tmp_path):
+        """With nothing readable left, the report phase gets None, not {}.
+
+        None is what it distinguishes "the measuring phase did not finish" by,
+        and that has to stay an error rather than a gate miss -- an empty dict
+        would gate on defaults and forgive a pipeline that measured nothing.
+        """
+        (tmp_path / "coverage-status-cpp.json").write_text("3", encoding="utf-8")
+        assert _read_coverage_status(tmp_path) is None
+
+    def test_a_leg_missing_a_field_reads_as_not_measured(self, tmp_path):
+        """An older or partial writer must not be read as a measurement."""
+        _write(tmp_path, "coverage-status-cpp.json", cpp_measured=True)
+        assert _read_coverage_status(tmp_path) == {
+            "tests_failed": False, "cpp_measured": True, "py_measured": False,
+        }
diff --git a/tests/test_packager.py b/tests/test_packager.py
index 0a53c79..08e58d6 100644
--- a/tests/test_packager.py
+++ b/tests/test_packager.py
@@ -476,23 +476,24 @@ def test_explicit_coverage_false_overrides_env():
 
 
 @patch_env(clear=True)
-def test_coverage_true_propagates_xms_coverage_into_buildenv():
-    """coverage=True must export XMS_COVERAGE into every [buildenv].
-
-    Without it the activation script never sets ``XMS_COVERAGE`` for the
-    CMake child process, so ``CMakeLists.txt.jinja``'s
-    ``if (DEFINED ENV{XMS_COVERAGE})`` guard is false, ``--coverage`` is
-    never added to the compile flags, no ``.gcno``/``.gcda`` files are
-    produced, and gcovr reports 0% with "All coverage data is filtered
-    out" (issue #69 — the 2.14.0/2.14.1/2.14.2 chain finally got the
-    pipeline to a green run, but the C++ report was empty for exactly
-    this reason).
-
-    Pybind configurations included: the binding layer is C++ that only a
-    Python test can reach, so it needs its own .gcda to be counted at all.
-    A pybind configuration is Release, but the CMake block appends ``-O0``
-    after CMake's ``-O3``, so the instrumented build is unoptimized either
-    way and the line data is as usable as a Debug build's.
+def test_coverage_instruments_only_the_legs_it_reads_data_from():
+    """coverage=True must set the recipe's coverage option, not [buildenv].
+
+    The option is what makes instrumentation part of the package_id — an
+    instrumented and a production build must never satisfy --build=missing
+    for each other. It renders as ``&:coverage=True``, so it scopes to the
+    library being built and never reaches dependency recipes that do not
+    declare it. The old XMS_COVERAGE [buildenv] ride-along (issue #69) is
+    retired with the env fallback in the CMake template.
+
+    Instrumentation is selective. Pybind configurations get it because the
+    binding layer is C++ that only a Python test can reach, so it needs its
+    own .gcda to be counted at all; a pybind configuration is Release, but
+    the CMake block appends ``-O0`` after CMake's ``-O3``, so its line data
+    is as usable as a Debug build's. The Debug testing leg gets it because
+    that is what drives C++ coverage. The Release testing leg must not --
+    it exists to exercise the configuration the shipped wheel is built
+    from, and instrumenting it would leave nothing running optimized code.
     """
     p = XmsConanPackager("xmscore", coverage=True)
     p.generate_configurations(system_platform="linux")
@@ -500,27 +501,43 @@ def test_coverage_true_propagates_xms_coverage_into_buildenv():
     assert any(c["options"].get("pybind") for c in p.configurations), (
         "this test is vacuous without at least one pybind configuration"
     )
+    assert any(c["options"].get("coverage") for c in p.configurations), (
+        "coverage mode instrumented nothing at all"
+    )
     for cfg in p.configurations:
-        assert cfg["buildenv"].get("XMS_COVERAGE") == "1", (
-            f"every configuration must export XMS_COVERAGE=1 in buildenv "
-            f"when coverage=True; missing on {cfg.get('build_type')!r} / "
-            f"options={cfg.get('options')}"
+        options = cfg["options"]
+        expected = bool(options.get("pybind")) or (
+            bool(options.get("testing")) and cfg["build_type"] == "Debug"
+        )
+        assert bool(options.get("coverage")) is expected, (
+            f"instrumentation should be {expected} on "
+            f"{cfg.get('build_type')!r} / options={options}"
+        )
+        assert "XMS_COVERAGE" not in cfg["buildenv"], (
+            f"the [buildenv] ride-along is retired; leaked on "
+            f"{cfg.get('build_type')!r} / options={options}"
         )
 
 
 @patch_env(clear=True)
-def test_coverage_false_omits_xms_coverage_from_buildenv():
-    """coverage=False must not leak XMS_COVERAGE into the build profile.
+def test_coverage_false_omits_the_coverage_option():
+    """coverage=False must not leak instrumentation into the build profile.
 
     A non-coverage run reusing the same packager invocation must not
     pull instrumentation flags into the released binary — that would
     bloat object size, defeat optimization, and (more importantly)
-    cause ``--coverage`` to be linked into the production wheel.
+    cause ``--coverage`` to be linked into the production wheel. Leaving
+    the option out entirely (rather than writing coverage=False) keeps the
+    profiles byte-identical to what they were before the option existed.
     """
     p = XmsConanPackager("xmscore", coverage=False)
     p.generate_configurations(system_platform="linux")
 
     for cfg in p.configurations:
+        assert "coverage" not in cfg["options"], (
+            f"coverage=False must not write the option; leaked on "
+            f"{cfg.get('build_type')!r} / options={cfg.get('options')}"
+        )
         assert "XMS_COVERAGE" not in cfg["buildenv"], (
             f"coverage=False must not export XMS_COVERAGE; leaked on "
             f"{cfg.get('build_type')!r} / options={cfg.get('options')}"
@@ -744,8 +761,8 @@ def test_validate_filter_dict_accepts_settings_and_nested_tables():
     validate_filter_dict({
         "build_type": "Debug",
         "compiler.runtime": "static",
-        "options": {"pybind": True, "python_version": "3.13"},
-        "buildenv": {"XMS_COVERAGE": "1"},
+        "options": {"pybind": True, "python_version": "3.13", "coverage": True},
+        "buildenv": {"XMS_VERSION": "1.0"},
     })
 
 
@@ -770,7 +787,7 @@ def test_validate_filter_dict_rejects_unknown_option():
 
 def test_validate_filter_dict_accepts_emitted_buildenv_names():
     """The buildenv names the profiles actually set are filterable."""
-    validate_filter_dict({"buildenv": {"XMS_COVERAGE": "1", "PYTHON_TARGET_VERSION": "3.13"}})
+    validate_filter_dict({"buildenv": {"XMS_VERSION": "1.0", "PYTHON_TARGET_VERSION": "3.13"}})
 
 
 def test_validate_filter_dict_rejects_unknown_buildenv_name():
@@ -783,13 +800,36 @@ def test_validate_filter_dict_rejects_unknown_buildenv_name():
 def test_emitted_buildenv_keys_covers_conditional_names():
     """The derived set includes names only some configurations carry.
 
-    Derived from the matrix rather than hand-listed, so the macOS-only and
-    coverage-only names come along without a second edit.
+    Derived from the matrix rather than hand-listed, so the macOS-only
+    names come along without a second edit.
     """
     keys = emitted_buildenv_keys()
     assert {"XMS_VERSION", "PYTHON_TARGET_VERSION"} <= keys, "unconditional names"
-    assert {"XMS_COVERAGE", "MACOSX_DEPLOYMENT_TARGET", "_PYTHON_HOST_PLATFORM"} <= keys
+    assert {"MACOSX_DEPLOYMENT_TARGET", "_PYTHON_HOST_PLATFORM"} <= keys
     assert "XMS_TEST_ARTIFACTS_LABEL" in keys, "added by run(), not generate_configurations"
+    # Coverage mode contributes the `coverage` option now, not a buildenv
+    # name — a reappearance here means the [buildenv] ride-along came back.
+    assert "XMS_COVERAGE" not in keys
+
+
+def test_validate_filter_dict_accepts_a_coverage_option_pin():
+    """options.coverage is filterable now that coverage runs emit it."""
+    validate_filter_dict({"options": {"coverage": True}})
+
+
+def test_validate_filter_dict_rejects_non_bool_coverage():
+    """A quoted 'true' would never equal the emitted bool, so it raises."""
+    with pytest.raises(ValueError, match="coverage"):
+        validate_filter_dict({"options": {"coverage": "true"}})
+
+
+def test_validate_filter_dict_rejects_coverage_false():
+    """coverage=false can never match, so it raises rather than selecting nothing.
+
+    Coverage runs emit True and normal runs omit the option entirely.
+    """
+    with pytest.raises(ValueError, match="only be true"):
+        validate_filter_dict({"options": {"coverage": False}})
 
 
 @pytest.mark.parametrize("filter_dict,expected_message", [
@@ -884,6 +924,39 @@ def test_summarize_filter_matches_reports_zero_for_impossible_combination():
     assert all(counts["total"] == 0 for counts in summary.values())
 
 
+@patch_env(clear=True)
+def test_summarize_filter_matches_labels_the_surviving_testing_configurations():
+    """The testing labels name the directories the build will stage.
+
+    They come from config_label, not from a second rendering of the same
+    naming: the CI generator turns them into ``--label`` arguments, and a copy
+    of the format would be free to drift from what run() writes into
+    XMS_TEST_ARTIFACTS_LABEL.
+    """
+    summary = summarize_filter_matches({})
+
+    assert summary["linux"]["testing_labels"] == ["Release-testing", "Debug-testing"]
+    # msvc fans out over the runtime, and the label has to keep them apart.
+    assert summary["windows"]["testing_labels"] == [
+        "Release-dynamic-testing", "Release-static-testing",
+        "Debug-dynamic-testing", "Debug-static-testing",
+    ]
+
+
+@patch_env(clear=True)
+def test_summarize_filter_matches_reports_no_testing_labels_for_a_pybind_pin():
+    """A build type can survive on pybind configurations that stage no runner.
+
+    This is the gap ``total`` leaves: it counts every survivor, so a pybind-only
+    filter reports configurations on a platform that will not produce a single
+    ``*-testing`` directory.
+    """
+    summary = summarize_filter_matches({"options": {"pybind": True}})
+
+    assert summary["linux"]["total"] > 0
+    assert summary["linux"]["testing_labels"] == []
+
+
 @patch_env(clear=True)
 def test_summarize_filter_matches_honors_python_versions():
     """The pybind fan-out follows [ci].python_versions, not just the default.
@@ -2223,6 +2296,64 @@ def test_preset_toolchain_lives_in_its_binary_dir():
         assert preset["toolchainFile"].startswith(preset["binaryDir"] + "/")
 
 
+def test_coverage_mode_bakes_xms_coverage_into_every_configure_preset():
+    """Coverage generation writes XMS_COVERAGE into the preset cache.
+
+    A raw `cmake --preset` build never runs the recipe's build(), so the
+    coverage *option* cannot reach it — and the generated CMakeLists.txt no
+    longer reads $ENV{XMS_COVERAGE}. The regenerated preset is the carrier
+    for that flow (xmsvtk's scripts/coverage.py regenerates with
+    XMS_COVERAGE=1 set, then configures through the preset).
+    """
+    document = _linux_packager(coverage=True).plan_cmake_presets()
+
+    assert document["configurePresets"], "no presets planned"
+    for preset in document["configurePresets"]:
+        assert preset["cacheVariables"].get("XMS_COVERAGE") == "1", (
+            f"preset {preset['name']!r} lost the coverage cache variable"
+        )
+
+
+def test_normal_generation_writes_an_explicit_zero_into_presets():
+    """Without coverage mode every preset pins XMS_COVERAGE to "0".
+
+    Merely omitting the key is not enough: a CMake cache variable persists
+    across reconfigures, so a build dir configured once in coverage mode
+    would stay instrumented after a normal regeneration. The explicit "0"
+    (falsey to CMake's `if (XMS_COVERAGE)`) overwrites the stale entry.
+    """
+    document = _linux_packager().plan_cmake_presets()
+
+    assert document["configurePresets"], "no presets planned"
+    for preset in document["configurePresets"]:
+        assert preset["cacheVariables"].get("XMS_COVERAGE") == "0"
+
+
+@patch_env(clear=True)
+def test_create_build_profile_renders_coverage_as_consumer_scoped():
+    """The coverage option serializes as `&:coverage=True` in the profile.
+
+    The `&:` prefix is the load-bearing half of the design: it scopes the
+    option to the library being built, so dependency recipes — which declare
+    no coverage option — are neither rebuilt instrumented nor fail on an
+    unknown option. And the retired XMS_COVERAGE ride-along must not come
+    back in [buildenv].
+    """
+    p = XmsConanPackager("xmscore", coverage=True)
+    p.generate_configurations(system_platform="linux")
+
+    # Not configurations[0] -- instrumentation is selective now, and the
+    # first configuration may well be a leg that is deliberately optimized.
+    instrumented = next(
+        c for c in p.configurations if c["options"].get("coverage"))
+    profile_path = p.create_build_profile(instrumented)
+    with open(profile_path, "r") as f:
+        content = f.read()
+
+    assert "&:coverage=True" in content
+    assert "XMS_COVERAGE" not in content
+
+
 def test_write_cmake_presets_skipped_without_generator(tmp_path):
     """With no generator pinned there is nothing to express, so no file."""
     packager = _linux_packager(profile_conf={})
diff --git a/tests/test_xms_conan2_file.py b/tests/test_xms_conan2_file.py
index 185f5e0..8acdb27 100644
--- a/tests/test_xms_conan2_file.py
+++ b/tests/test_xms_conan2_file.py
@@ -345,19 +345,20 @@ def test_runs_cxx_tests_when_env_not_set(self):
 
 
 class TestPackageId:
-    """Verify package_id drops python_version for non-pybind builds."""
+    """Verify package_id trims the option axes that do not identify the binary."""
 
     class _InfoOptions:
         """Plain stub so that ``del`` actually removes the attribute."""
 
-        def __init__(self, pybind):
+        def __init__(self, pybind, coverage=False):
             self.pybind = pybind
             self.python_version = "3.13"
+            self.coverage = coverage
 
-    def _make_obj(self, pybind):
+    def _make_obj(self, pybind, coverage=False):
         obj = object.__new__(XmsConan2File)
         obj.info = MagicMock()
-        obj.info.options = self._InfoOptions(pybind=pybind)
+        obj.info.options = self._InfoOptions(pybind=pybind, coverage=coverage)
         return obj
 
     def test_drops_python_version_when_not_pybind(self):
@@ -372,6 +373,26 @@ def test_keeps_python_version_for_pybind(self):
         obj.package_id()
         assert obj.info.options.python_version == "3.13"
 
+    def test_drops_coverage_when_not_instrumented(self):
+        """coverage=False leaves the id byte-identical to the pre-option recipe.
+
+        Deleting the False value keeps every already-released binary valid;
+        only instrumented builds get a new id.
+        """
+        obj = self._make_obj(pybind=False)
+        obj.package_id()
+        assert not hasattr(obj.info.options, "coverage")
+
+    def test_keeps_coverage_for_instrumented_builds(self):
+        """coverage=True stays in the id.
+
+        --build=missing can never confuse an instrumented binary with a
+        production one.
+        """
+        obj = self._make_obj(pybind=False, coverage=True)
+        obj.package_id()
+        assert obj.info.options.coverage is True
+
 
 class TestXmsDependencyPythonVersionPropagation:
     """Verify configure() propagates python_version into each xms_dependency.
@@ -401,6 +422,7 @@ def _make_obj(self, dep_options_override=None, dep_raises=False):
         obj.options.pybind = True
         obj.options.testing = False
         obj.options.python_version = "3.10"
+        obj.options.coverage = False
 
         # Dep options accessed via self.options[dep_name].  Mirror Conan 2's
         # empty proxy: ``in`` reports False for everything.  When the dep
@@ -457,7 +479,7 @@ def test_tolerates_dep_without_python_version_option(self):
 
 
 class TestCoverageWiring:
-    """Verify the conanfile cooperates with XMS_COVERAGE for combined builds."""
+    """Verify the conanfile keys instrumentation off the coverage option."""
 
     def test_configure_options_method_removed(self):
         """The configure_options() method that del'd pybind on non-Release is gone.
@@ -475,6 +497,7 @@ def _make_recipe_for_build(self):
         obj.options.testing = False
         obj.options.python_version = "3.13"
         obj.options.wchar_t = "builtin"
+        obj.options.coverage = False
         obj.testing_framework = "cxxtest"
         obj.python_binding_type = "pybind11"
         obj.version = "0.0.0"
@@ -487,25 +510,18 @@ def _make_recipe_for_build(self):
         return obj
 
     @patch("xmsconan.xms_conan2_file.CMake")
-    def test_build_passes_xms_coverage_as_cmake_variable_when_env_set(self, mock_cmake_cls):
-        """``XMS_COVERAGE`` from the parent env must reach CMake as a ``-D`` variable.
-
-        Conan 2's ``cmake.configure()`` runs CMake as a subprocess and
-        does *not* inherit the recipe's parent-process env unless a
-        ``VirtualBuildEnv`` generator is declared in ``generate()`` —
-        which this recipe doesn't have. The recipe's Python ``configure()``
-        sees XMS_COVERAGE fine (same process as conan-create), but CMake
-        did not, so ``CMakeLists.txt.jinja``'s
-        ``if (DEFINED ENV{XMS_COVERAGE})`` block was silently false even
-        with XMS_COVERAGE in the profile's [buildenv]. Passing it as a
-        ``-D`` variable bypasses that whole layer of uncertainty.
+    def test_build_passes_xms_coverage_as_cmake_variable_when_option_set(self, mock_cmake_cls):
+        """``coverage=True`` must reach CMake as a ``-DXMS_COVERAGE`` variable.
+
+        Conan 2's ``cmake.configure()`` runs CMake as a subprocess, so the
+        option cannot be observed there directly; the recipe forwards it as
+        a ``-D`` variable, which is also the only trigger left in the
+        generated CMakeLists (the env fallback is gone). Driving this from
+        the option is what makes instrumentation part of the package_id.
         """
         recipe = self._make_recipe_for_build()
-        os.environ["XMS_COVERAGE"] = "1"
-        try:
-            recipe.build()
-        finally:
-            del os.environ["XMS_COVERAGE"]
+        recipe.options.coverage = True
+        recipe.build()
 
         configure_mock = mock_cmake_cls.return_value.configure
         assert configure_mock.called, "cmake.configure must be invoked"
@@ -513,31 +529,78 @@ def test_build_passes_xms_coverage_as_cmake_variable_when_env_set(self, mock_cma
         variables = call_kwargs.get("variables") or {}
         assert variables.get("XMS_COVERAGE") == "1", (
             "build() must pass XMS_COVERAGE=1 as a CMake -D variable when the "
-            f"parent env has it; got variables={variables!r}"
+            f"coverage option is set; got variables={variables!r}"
         )
 
     @patch("xmsconan.xms_conan2_file.CMake")
-    def test_build_omits_xms_coverage_when_env_unset(self, mock_cmake_cls):
-        """Production builds (no ``XMS_COVERAGE`` in env) must not get ``--coverage``.
+    def test_build_registers_per_case_ctest_entries_when_instrumented(
+            self, mock_cmake_cls):
+        """An instrumented build is the one shape ctest still schedules.
+
+        Every other shape reaches the runner through xmsconan_test_shards,
+        which is why the generated CMakeLists registers the whole binary as a
+        single ctest entry. ctest cannot parallelize one entry, so the
+        coverage job's CTEST_PARALLEL_LEVEL had nothing to act on and ran the
+        instrumented suite in one process.
+        """
+        recipe = self._make_recipe_for_build()
+        recipe.options.coverage = True
+        recipe.build()
 
-        A leaked ``-DXMS_COVERAGE=1`` would link gcov instrumentation
-        into the shipping wheel — bloated binary, slower runtime, and
-        a defeat of any optimization. The check on
-        ``os.environ.get("XMS_COVERAGE")`` must be the only gate.
+        variables = (mock_cmake_cls.return_value.configure
+                     .call_args.kwargs.get("variables") or {})
+        assert variables.get("XMS_GTEST_DISCOVER_TESTS") == "ON", (
+            "an instrumented build must register per-case ctest entries so "
+            f"CTEST_PARALLEL_LEVEL has something to schedule; got "
+            f"variables={variables!r}"
+        )
+
+    @patch("xmsconan.xms_conan2_file.CMake")
+    def test_build_leaves_ctest_registration_alone_without_coverage(
+            self, mock_cmake_cls):
+        """A production build keeps the single whole-binary ctest entry.
+
+        Per-case entries pay a process spawn per test case. That is worth it
+        only where ctest is the scheduler; test_shards builds would pay it
+        for nothing, having already got their concurrency elsewhere.
+        """
+        recipe = self._make_recipe_for_build()
+        recipe.build()
+
+        variables = (mock_cmake_cls.return_value.configure
+                     .call_args.kwargs.get("variables") or {})
+        assert "XMS_GTEST_DISCOVER_TESTS" not in variables, (
+            "only instrumented builds should override the ctest registration; "
+            f"got variables={variables!r}"
+        )
+
+    @patch("xmsconan.xms_conan2_file.CMake")
+    def test_build_ignores_the_env_var_when_option_is_false(self, mock_cmake_cls,
+                                                            monkeypatch):
+        """``XMS_COVERAGE`` in the environment alone must not instrument.
+
+        The env-var era let a build instrument itself while its package_id
+        said otherwise — the exact silent mismatch the option exists to
+        close. A leaked ``-DXMS_COVERAGE=1`` would also link gcov
+        instrumentation into the shipping wheel.
         """
         recipe = self._make_recipe_for_build()
-        os.environ.pop("XMS_COVERAGE", None)
+        # monkeypatch, not a bare assignment with `finally: del`: the manual
+        # form deletes the variable on the way out rather than restoring it, so
+        # a developer running the suite with XMS_COVERAGE already exported has
+        # it silently unset for every test that follows.
+        monkeypatch.setenv("XMS_COVERAGE", "1")
         recipe.build()
 
         configure_mock = mock_cmake_cls.return_value.configure
         variables = configure_mock.call_args.kwargs.get("variables") or {}
         assert "XMS_COVERAGE" not in variables, (
-            f"build() must not leak XMS_COVERAGE into production builds; "
-            f"got variables={variables!r}"
+            f"build() must key instrumentation off the coverage option, not "
+            f"the environment; got variables={variables!r}"
         )
 
-    def test_run_python_tests_uses_pytest_cov_when_env_set(self, tmp_path):
-        """When XMS_COVERAGE=1, pytest is invoked with --cov flags."""
+    def test_run_python_tests_uses_pytest_cov_when_option_set(self, tmp_path):
+        """When coverage=True, pytest is invoked with --cov flags."""
         obj = object.__new__(XmsConan2File)
         obj.build_folder = str(tmp_path / "build")
         obj.source_folder = str(tmp_path / "source")
@@ -547,6 +610,7 @@ def test_run_python_tests_uses_pytest_cov_when_env_set(self, tmp_path):
             f.write("[pytest]\n")
         obj.options = MagicMock()
         obj.options.python_version = "3.13"
+        obj.options.coverage = True
         obj.python_namespaced_dir = "core"
         obj.xms_dependencies = []
         obj.dependencies = MagicMock()
@@ -556,11 +620,7 @@ def test_run_python_tests_uses_pytest_cov_when_env_set(self, tmp_path):
         # Stub _find_wheel so we don't need a real wheel.
         obj._find_wheel = MagicMock(return_value=str(tmp_path / "fake.whl"))
 
-        os.environ["XMS_COVERAGE"] = "1"
-        try:
-            obj.run_python_tests()
-        finally:
-            del os.environ["XMS_COVERAGE"]
+        obj.run_python_tests()
 
         pytest_calls = [c for c in obj.run.call_args_list if "-m pytest" in str(c)]
         assert pytest_calls, "expected at least one pytest invocation"
@@ -581,6 +641,7 @@ def _python_test_recipe(self, tmp_path):
             f.write("[pytest]\n")
         obj.options = MagicMock()
         obj.options.python_version = "3.13"
+        obj.options.coverage = False
         obj.python_namespaced_dir = "core"
         obj.xms_dependencies = []
         obj.dependencies = MagicMock()
@@ -717,8 +778,10 @@ def test_windows_dll_hook_warns_when_site_packages_missing(self, tmp_path):
 
         assert obj.output.warning.called
 
-    def test_run_python_tests_does_not_add_cov_when_env_unset(self, tmp_path):
-        """Without XMS_COVERAGE, no --cov flags are added."""
+    def test_run_python_tests_does_not_add_cov_when_option_unset(
+        self, tmp_path, monkeypatch,
+    ):
+        """coverage=False adds no --cov flags, even with XMS_COVERAGE in the env."""
         obj = object.__new__(XmsConan2File)
         obj.build_folder = str(tmp_path / "build")
         obj.source_folder = str(tmp_path / "source")
@@ -728,6 +791,7 @@ def test_run_python_tests_does_not_add_cov_when_env_unset(self, tmp_path):
             f.write("[pytest]\n")
         obj.options = MagicMock()
         obj.options.python_version = "3.13"
+        obj.options.coverage = False
         obj.python_namespaced_dir = "core"
         obj.xms_dependencies = []
         obj.dependencies = MagicMock()
@@ -736,25 +800,29 @@ def test_run_python_tests_does_not_add_cov_when_env_unset(self, tmp_path):
         obj.output = MagicMock()
         obj._find_wheel = MagicMock(return_value=str(tmp_path / "fake.whl"))
 
-        os.environ.pop("XMS_COVERAGE", None)
+        # See the note in test_build_ignores_the_env_var_when_option_is_false:
+        # monkeypatch restores the prior value, `finally: del` does not.
+        monkeypatch.setenv("XMS_COVERAGE", "1")
         obj.run_python_tests()
 
         pytest_cmd = str(obj.run.call_args_list[-1])
         assert "--cov" not in pytest_cmd
 
     def test_configure_raises_when_coverage_set_without_namespaced_dir(self):
-        """XMS_COVERAGE=1 + missing python_namespaced_dir fails at configure time.
+        """coverage=True + pybind=True + missing python_namespaced_dir fails early.
 
         The deep run_python_tests check still exists as defense in depth, but
         catching this in configure() avoids wasting a full instrumented build
-        before the failure surfaces.
+        before the failure surfaces. Only the pybind leg is gated — it is the
+        one that runs pytest-cov.
         """
         obj = object.__new__(XmsConan2File)
         obj.python_namespaced_dir = None
         obj.options = MagicMock()
-        obj.options.pybind = False
+        obj.options.pybind = True
         obj.options.testing = False
         obj.options.python_version = "3.13"
+        obj.options.coverage = True
         obj.xms_dependencies = []
         obj.xms_dependency_options = {}
         obj.settings = MagicMock()
@@ -762,21 +830,41 @@ def test_configure_raises_when_coverage_set_without_namespaced_dir(self):
         obj.settings.compiler = MagicMock(__str__=lambda s: "gcc")
         obj.settings.compiler.version = MagicMock(value="13.0")
 
-        os.environ["XMS_COVERAGE"] = "1"
-        try:
-            with pytest.raises(ConanException, match="python_namespaced_dir"):
-                obj.configure()
-        finally:
-            del os.environ["XMS_COVERAGE"]
+        with pytest.raises(ConanException, match="python_namespaced_dir"):
+            obj.configure()
 
     def test_configure_permits_missing_namespaced_dir_without_coverage(self):
-        """Without XMS_COVERAGE, an unset python_namespaced_dir is allowed."""
+        """With coverage=False, an unset python_namespaced_dir is allowed."""
         obj = object.__new__(XmsConan2File)
         obj.python_namespaced_dir = None
         obj.options = MagicMock()
         obj.options.pybind = False
         obj.options.testing = False
         obj.options.python_version = "3.13"
+        obj.options.coverage = False
+        obj.xms_dependencies = []
+        obj.xms_dependency_options = {}
+        obj.settings = MagicMock()
+        obj.settings.os = MagicMock(__str__=lambda s: "Linux")
+        obj.settings.compiler = MagicMock(__str__=lambda s: "gcc")
+        obj.settings.compiler.version = MagicMock(value="13.0")
+
+        obj.configure()  # must not raise
+
+    def test_configure_permits_cpp_only_coverage_without_namespaced_dir(self):
+        """coverage=True on a pybind=False leg needs no python_namespaced_dir.
+
+        The C++ legs never run pytest-cov, so a hand-written pure-C++ recipe
+        can collect C++ coverage without configuring a Python namespace it
+        does not have.
+        """
+        obj = object.__new__(XmsConan2File)
+        obj.python_namespaced_dir = None
+        obj.options = MagicMock()
+        obj.options.pybind = False
+        obj.options.testing = True
+        obj.options.python_version = "3.13"
+        obj.options.coverage = True
         obj.xms_dependencies = []
         obj.xms_dependency_options = {}
         obj.settings = MagicMock()
@@ -784,11 +872,10 @@ def test_configure_permits_missing_namespaced_dir_without_coverage(self):
         obj.settings.compiler = MagicMock(__str__=lambda s: "gcc")
         obj.settings.compiler.version = MagicMock(value="13.0")
 
-        os.environ.pop("XMS_COVERAGE", None)
         obj.configure()  # must not raise
 
     def test_run_python_tests_raises_when_cov_target_unknown(self, tmp_path):
-        """XMS_COVERAGE=1 without python_namespaced_dir must fail loudly.
+        """coverage=True without python_namespaced_dir must fail loudly.
 
         Falling back to ``--cov=xms`` would silently mix in coverage from
         xms_dependencies installed in the venv.
@@ -802,6 +889,7 @@ def test_run_python_tests_raises_when_cov_target_unknown(self, tmp_path):
             f.write("[pytest]\n")
         obj.options = MagicMock()
         obj.options.python_version = "3.13"
+        obj.options.coverage = True
         obj.python_namespaced_dir = None
         obj.xms_dependencies = []
         obj.dependencies = MagicMock()
@@ -810,12 +898,8 @@ def test_run_python_tests_raises_when_cov_target_unknown(self, tmp_path):
         obj.output = MagicMock()
         obj._find_wheel = MagicMock(return_value=str(tmp_path / "fake.whl"))
 
-        os.environ["XMS_COVERAGE"] = "1"
-        try:
-            with pytest.raises(ConanException, match="python_namespaced_dir"):
-                obj.run_python_tests()
-        finally:
-            del os.environ["XMS_COVERAGE"]
+        with pytest.raises(ConanException, match="python_namespaced_dir"):
+            obj.run_python_tests()
 
 
 class _Setting(str):
@@ -1432,6 +1516,7 @@ def _make_recipe(self, wchar_t="builtin", pybind=False):
         obj.options.testing = False
         obj.options.python_version = "3.13"
         obj.options.wchar_t = wchar_t
+        obj.options.coverage = False
         obj.testing_framework = "cxxtest"
         obj.python_binding_type = "pybind11"
         obj.version = "0.0.0"
@@ -1451,11 +1536,10 @@ def test_use_typedef_wchar_t_follows_the_option(self, wchar_t, expected):
         variables = self._make_recipe(wchar_t=wchar_t)._cmake_variables()
         assert variables["USE_TYPEDEF_WCHAR_T"] is expected
 
-    # Cleared, not merely overridden: build() adds XMS_COVERAGE to the configure
-    # set when it is set in the parent env, so on a developer machine that has
-    # exported it this test compared a toolchain set against a configure set
-    # carrying one extra key, and failed for a reason having nothing to do with
-    # drift. Nothing else under these mocks reads the environment.
+    # Cleared as a guard: build() keys XMS_COVERAGE off the coverage option
+    # now, but this test is the drift detector, and clearing proves nothing
+    # under these mocks reads the environment — a regression back to env
+    # sensitivity would fail here on a developer machine that exports it.
     @patch_env(clear=True)
     @patch("xmsconan.xms_conan2_file.CMakeDeps")
     @patch("xmsconan.xms_conan2_file.CMakeToolchain")
diff --git a/xmsconan/ci_tools/test_shards.py b/xmsconan/ci_tools/test_shards.py
index 8903805..261af64 100644
--- a/xmsconan/ci_tools/test_shards.py
+++ b/xmsconan/ci_tools/test_shards.py
@@ -49,8 +49,9 @@
 LOGGER = logging.getLogger(__name__)
 
 #: Seconds a single shard may run before it is killed. Mirrors
-#: ``XmsConanPackager.SHARD_TIMEOUT`` -- a shard is the same kind of work there.
-DEFAULT_SHARD_TIMEOUT = 600
+#: ``XmsConanPackager.SHARD_TIMEOUT`` -- a shard is the same kind of work there,
+#: including the 10-to-20-minute raise and the headroom argument behind it.
+DEFAULT_SHARD_TIMEOUT = 1200
 
 #: Where the recipe's ``_save_test_artifacts`` stages each configuration, and
 #: what the generated CI passes to ``build.py --artifacts-dir``.
@@ -318,10 +319,17 @@ def find_artifact_dir(artifacts_dir, label: Optional[str] = None) -> Path:
         )
     if len(matches) > 1:
         # The default matrix stages a testing copy of every build type, so
-        # arriving here is normal rather than exceptional and must not fail the
-        # job. Fall back in a fixed, documented order and say which one won --
-        # the objection to `ls | head -1` was that it chose silently, not that
-        # it chose.
+        # arriving here is normal rather than exceptional. Fall back in a fixed,
+        # documented order and say which one won -- the objection to
+        # `ls | head -1` was that it chose silently, not that it chose.
+        #
+        # This is now an interactive convenience only: the generated GitLab
+        # pipeline emits one job per staged testing configuration and each names
+        # its own --label, so no CI run reaches this branch. It used to, and
+        # that is how a matrix building both build types tested only Debug for
+        # as long as it did -- the warning below went to a job log nobody read.
+        # Keep the fallback for a developer running the tool by hand after a
+        # local build.py; do not let CI depend on it again.
         by_name = {match.name: match for match in matches}
         for preferred in _LABEL_PREFERENCE:
             if preferred in by_name:
diff --git a/xmsconan/coverage_tools/coverage_generator.py b/xmsconan/coverage_tools/coverage_generator.py
index 9c9e815..def5fcf 100644
--- a/xmsconan/coverage_tools/coverage_generator.py
+++ b/xmsconan/coverage_tools/coverage_generator.py
@@ -49,6 +49,7 @@
     _coverage_context,
     _resolve_coverage_python_version,
 )
+from xmsconan.package_tools.packager import COVERAGE_PYBIND_BUILD_TYPE
 
 
 LOGGER = logging.getLogger(__name__)
@@ -70,6 +71,42 @@
 EXIT_ERROR = 1
 EXIT_GATE_FAILED = 3
 
+#: The two halves of a coverage run, and the default that does both in one
+#: process.
+#:
+#: The split exists so the expensive half can move earlier in the pipeline. The
+#: instrumented builds are a second full compile of the library -- they carry
+#: their own package_id, so no production build can be reused for them -- and
+#: running that in a late Coverage stage serialized it behind the entire
+#: pipeline. ``collect`` is a Build-stage job that overlaps the production
+#: build; ``report`` is what remains, and it only reads JSON.
+#:
+#: Nothing but rendered artifacts and small JSON crosses between them, which is
+#: what makes the split viable at all: both instrumented builds stay inside the
+#: collect job, so gcovr reads its ``.gcda`` and renders its HTML beside the
+#: sources that produced them. A split placed anywhere later would have to move
+#: the conan build folder between containers and relocate the paths compiled
+#: into the ``.gcno``.
+PHASE_ALL = "all"
+PHASE_COLLECT = "collect"
+PHASE_MEASURE = "measure"
+PHASE_REPORT = "report"
+COVERAGE_PHASES = (PHASE_ALL, PHASE_COLLECT, PHASE_MEASURE, PHASE_REPORT)
+
+#: The two instrumented legs, as ``--leg`` selects them. ``collect`` runs both
+#: in one job; ``measure`` runs exactly one, which is what lets the generated
+#: GitLab pipeline compile them as two concurrent build jobs instead of one
+#: job doing both in sequence.
+LEG_CPP = "cpp"
+LEG_PYTHON = "python"
+COVERAGE_LEGS = (LEG_CPP, LEG_PYTHON)
+
+#: What ``collect`` leaves for ``report``: the facts the report phase cannot
+#: re-derive from the summary files alone. Thresholds are deliberately NOT in
+#: here -- the report phase reads them from build.toml, so a threshold edit
+#: takes effect without re-running the builds.
+COVERAGE_STATUS_FILE = "coverage-status.json"
+
 _XVFB_REEXEC_FLAG = "XMSCONAN_COVERAGE_XVFB_REEXEC"
 
 
@@ -375,6 +412,13 @@ def _find_coverage_package(
                     continue
                 if _opt_is_truthy(opts.get("testing")) != want_testing:
                     continue
+                # Instrumented and production builds coexist in the cache as
+                # sibling package_ids under one recipe revision (the recipe's
+                # coverage option). An uninstrumented sibling — whose
+                # package_id drops the option entirely, so the key is absent
+                # here — has no .gcda and must never be handed to gcovr.
+                if not _opt_is_truthy(opts.get("coverage")):
+                    continue
                 if settings.get("build_type") != want_build_type:
                     continue
                 if match_python_version is not None and \
@@ -383,8 +427,8 @@ def _find_coverage_package(
                 candidates.append((ts, exact_ref, pid))
     if not candidates:
         desc = (
-            "testing=True, pybind=False, Debug" if kind == "testing"
-            else f"pybind=True, testing=False, Release, "
+            "coverage=True, testing=True, pybind=False, Debug" if kind == "testing"
+            else f"coverage=True, pybind=True, testing=False, Release, "
                  f"python_version={match_python_version}"
         )
         raise RuntimeError(
@@ -585,10 +629,10 @@ def _assert_gcovr_collected_data(summary_path: Path, collections) -> None:
     :func:`_warn_if_tracefile_empty` instead. Three common causes, in
     descending likelihood:
 
-      1. The binary was compiled without ``--coverage``. ``XMS_COVERAGE``
-         needs to be propagated to CMake (see #69); if the recipe
-         skipped the ``add_compile_options(--coverage -O0 -g)`` block,
-         no ``.gcno`` files exist for gcovr to read.
+      1. The binary was compiled without ``--coverage``. The recipe's
+         ``coverage=True`` option drives ``-DXMS_COVERAGE`` into CMake;
+         if the ``add_compile_options(--coverage -O0 -g)`` block was
+         skipped, no ``.gcno`` files exist for gcovr to read.
       2. ``[coverage].filters`` / ``[coverage].excludes`` filtered out
          every source file. The defaults are conservative, but a custom
          filter that doesn't match the absolute paths in the ``.gcno``
@@ -621,8 +665,8 @@ def _assert_gcovr_collected_data(summary_path: Path, collections) -> None:
         "gcovr collected zero instrumented lines from any build folder. "
         "The C++ coverage report is empty. Common causes:\n"
         "  1. The binary was compiled without --coverage. Verify that "
-        "XMS_COVERAGE=1 reached the CMake configure step (see #69 — "
-        "this is the most common cause).\n"
+        "the coverage=True option reached the build (the recipe passes "
+        "it to CMake as -DXMS_COVERAGE; this is the most common cause).\n"
         "  2. The filter patterns excluded every source file. Compare each "
         "folder's filters against the absolute source paths embedded in the "
         ".gcno files under that same folder:" + per_folder + "\n"
@@ -702,13 +746,42 @@ def _warn_if_tracefile_empty(tracefile: Path, build_folder: Path,
         "gcovr collected no files from %s, so nothing from that build reaches "
         "the merged C++ report. A file compiled there would appear even with "
         "no test exercising it, so this points at compilation or "
-        "instrumentation rather than test coverage: check that XMS_COVERAGE=1 "
-        "reached the CMake configure step (#69). Filters used for this folder "
-        "were: %r",
+        "instrumentation rather than test coverage: check that the "
+        "coverage=True option reached this build's CMake configure step. "
+        "Filters used for this folder were: %r",
         build_folder, resolved_filters,
     )
 
 
+def _log_gcov_data_size(build_folders: list) -> None:
+    """Log how much gcov data each instrumented build folder holds.
+
+    ``.gcno`` is written at compile time and ``.gcda`` at run time, and gcovr
+    needs both side by side. That pairing is what makes the volume worth
+    knowing: splitting the compile and the test run into separate CI jobs
+    means staging every ``.gcno`` as an artifact for the job that runs the
+    binary, and a template-heavy translation unit's notes file is not small.
+    Measuring it here costs a directory walk beside data that already exists;
+    discovering it is too large costs a pipeline.
+
+    Args:
+        build_folders: Instrumented conan build folders, as located by
+            :func:`_locate_coverage_build`.
+    """
+    for folder in build_folders:
+        counts = {}
+        for suffix in (".gcno", ".gcda"):
+            files = list(Path(folder).rglob("*" + suffix))
+            total = sum(f.stat().st_size for f in files if f.is_file())
+            counts[suffix] = (len(files), total)
+        LOGGER.info(
+            "gcov data in %s: %d .gcno (%.1f MiB), %d .gcda (%.1f MiB)",
+            folder,
+            counts[".gcno"][0], counts[".gcno"][1] / (1024 * 1024),
+            counts[".gcda"][0], counts[".gcda"][1] / (1024 * 1024),
+        )
+
+
 def _run_gcovr(build_folders: list[Path], coverage_cfg: dict,
                output_dir: Path) -> Path:
     """Merge every build folder's C++ coverage into one report.
@@ -719,6 +792,20 @@ def _run_gcovr(build_folders: list[Path], coverage_cfg: dict,
     the CxxTest runner never reaches still counts as covered when a Python
     test reaches it through the bindings.
 
+    The combination has to happen at this level. ``.gcda`` counters carry a
+    checksum tied to the ``.gcno`` they were compiled against, so merging
+    them -- with ``gcov-tool merge`` or by letting libgcov accumulate into
+    one tree -- is only defined for runs of the *same* binary. These two
+    folders hold different binaries: one is Debug with the C++ suite linked
+    in, the other Release with the bindings. Merging their ``.gcda`` would
+    match no checksums and yield nothing usable. gcovr's JSON is already
+    resolved to source lines, which is what makes a union of the two
+    meaningful.
+
+    Within a single folder the same-binary condition does hold, which is why
+    the parallel ctest run underneath can let libgcov merge its processes'
+    counters in place.
+
     ``build_folders`` is ordered; the first is used as the merge ``--root``
     so ``--html-details`` can find sources to render. Both folders hold a
     copy of the same exported tree, so either serves.
@@ -727,27 +814,73 @@ def _run_gcovr(build_folders: list[Path], coverage_cfg: dict,
     """
     build_folders = [Path(f) for f in build_folders]
     output_dir.mkdir(parents=True, exist_ok=True)
-    html_index = output_dir / "coverage-html-cpp" / "index.html"
-    html_index.parent.mkdir(parents=True, exist_ok=True)
-    xml_path = output_dir / "cov-cpp.xml"
-    json_summary = output_dir / "cov-cpp-summary.json"
+    tracefiles, collections = _collect_tracefiles(
+        build_folders, coverage_cfg, output_dir,
+        names=[str(i) for i in range(len(build_folders))],
+    )
+    return _merge_tracefiles(
+        tracefiles, build_folders[0], output_dir, collections=collections,
+    )
+
 
+def _collect_tracefiles(build_folders: list[Path], coverage_cfg: dict,
+                        output_dir: Path, names: list) -> tuple:
+    """Read each build folder's .gcda into its own gcovr JSON tracefile.
+
+    Args:
+        build_folders: The instrumented conan build folders to read.
+        coverage_cfg: The resolved ``[coverage]`` context.
+        output_dir: Where the tracefiles are written.
+        names: One name per folder, spliced into
+            ``cov-cpp-tracefile-<name>.json``. The merge globs that pattern, so
+            the names only have to be distinct -- the collect phase numbers
+            them, and the split build jobs use their leg name so two jobs
+            writing into the same artifact space cannot land on one filename.
+
+    Returns:
+        ``(tracefiles, collections)``, where ``collections`` pairs each folder
+        with the filters resolved against it -- kept as pairs, not a flat list,
+        because the filters are anchored to one folder's absolute paths, so the
+        folder has to travel with them for any diagnostic built from them to be
+        actionable.
+    """
     tracefiles = []
-    # Kept as pairs, not a flat list: filters are anchored to one folder's
-    # absolute paths, so the folder they were resolved against has to travel
-    # with them for any diagnostic built from them to be actionable.
     collections = []
-    for i, build_folder in enumerate(build_folders):
-        tracefile = output_dir / f"cov-cpp-tracefile-{i}.json"
+    for name, build_folder in zip(names, build_folders):
+        tracefile = output_dir / f"cov-cpp-tracefile-{name}.json"
         resolved_filters = _collect_gcovr_tracefile(
             build_folder, coverage_cfg, tracefile,
         )
         tracefiles.append(tracefile)
         collections.append((build_folder, resolved_filters))
+    return tracefiles, collections
+
+
+def _merge_tracefiles(tracefiles: list[Path], root, output_dir: Path,
+                      collections=None) -> Path:
+    """Combine tracefiles into the rendered C++ report.
+
+    ``root`` only has to be a tree the tracefiles' *relative* paths resolve
+    against, which is what lets this run somewhere the build folders do not
+    exist. :func:`_collect_gcovr_tracefile` roots each tracefile at its own
+    build folder, so the paths it stores are relative to the copy of the
+    exported source tree ``cmake_layout()`` put there -- and the repository
+    checkout has that same layout. The split GitLab pipeline relies on this:
+    the two instrumented builds each emit a tracefile from a container holding
+    a conan cache, and the report job merges them from a plain python image
+    with nothing but the checkout.
+
+    Returns the path to the merged JSON summary.
+    """
+    output_dir.mkdir(parents=True, exist_ok=True)
+    html_index = output_dir / "coverage-html-cpp" / "index.html"
+    html_index.parent.mkdir(parents=True, exist_ok=True)
+    xml_path = output_dir / "cov-cpp.xml"
+    json_summary = output_dir / "cov-cpp-summary.json"
 
     cmd = [
         "gcovr",
-        "--root", str(build_folders[0]),
+        "--root", str(root),
         "--txt",
         "--html-details", str(html_index),
         "--xml", str(xml_path),
@@ -759,7 +892,7 @@ def _run_gcovr(build_folders: list[Path], coverage_cfg: dict,
     # Only an empty *merged* report fails the run. A single folder contributing
     # nothing is legitimate -- a library whose bindings are a stub has little to
     # instrument there -- and is reported as a warning by the collection step.
-    _assert_gcovr_collected_data(json_summary, collections)
+    _assert_gcovr_collected_data(json_summary, collections or [])
     return json_summary
 
 
@@ -824,18 +957,24 @@ def _append_github_summary(rows: list[tuple[str, float, Optional[float], bool]])
         f.write("\n".join(lines))
 
 
-def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Path) -> int:
+def run_coverage(toml_file_path: str | Path, version: str,
+                 output_dir: str | Path, phase: str = PHASE_ALL,
+                 leg: Optional[str] = None) -> int:
     """Drive a two-build coverage run (C++ via CxxTest + Python via pytest-cov).
 
-    The packager emits a Debug+testing-only config and a Release+pybind-only
-    config independently; this function builds both -- sequentially unless
-    ``[coverage].parallel = true`` (§5.7) overlaps them -- then runs gcovr
-    against both build folders and merges the result, and copies pytest-cov
-    artifacts out of the pybind build folder. The two builds never share a
-    binary shape, so changes to CxxTest linkage or pybind options cannot break
-    the other layer. Both are instrumented: the testing build supplies what
-    CxxTest reaches, the pybind build the binding layer and anything only a
-    Python test exercises.
+    Args:
+        toml_file_path: Path to ``build.toml``.
+        version: The build version passed through to ``xmsconan_gen`` and
+            ``build.py``. Unused by :data:`PHASE_REPORT`, which builds nothing.
+        output_dir: Workspace the artifacts are written into and read back from.
+        phase: One of :data:`COVERAGE_PHASES`. The default runs everything in
+            one process, which is what a local run and the GitHub workflow do.
+            ``measure`` builds a single leg and reads its data where it was
+            compiled, which is what lets the generated GitLab pipeline run the
+            two instrumented builds concurrently; ``report`` then merges their
+            tracefiles and gates.
+        leg: Required by :data:`PHASE_MEASURE`, and meaningless to every other
+            phase. One of :data:`COVERAGE_LEGS`.
 
     Returns the process exit code: ``EXIT_OK`` when both layers clear their
     thresholds and every leg built, ``EXIT_GATE_FAILED`` for a threshold miss,
@@ -843,7 +982,121 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
     ``EXIT_ERROR`` when neither leg left a package to report on. The
     generated CI distinguishes the gate from the error -- see the exit-code
     constants.
+
+    A failed collect short-circuits: there is nothing to gate on, and returning
+    the gate code for it would let ``allow_failure: exit_codes`` forgive a
+    coverage run that produced no report at all.
+    """
+    if phase not in COVERAGE_PHASES:
+        raise ValueError(
+            f"Unknown coverage phase {phase!r}; expected one of "
+            f"{', '.join(COVERAGE_PHASES)}."
+        )
+    if phase == PHASE_REPORT:
+        return _report_coverage(toml_file_path, output_dir)
+    if phase == PHASE_MEASURE:
+        if leg is None:
+            raise ValueError(
+                f"The {PHASE_MEASURE!r} phase measures one leg, so it needs "
+                f"--leg (one of {', '.join(COVERAGE_LEGS)}). Without it there "
+                "is no way to tell which build to run, and guessing would "
+                "silently measure one layer while reporting for both."
+            )
+        return _measure_coverage(toml_file_path, version, output_dir, leg)
+
+    exit_code = _collect_coverage(toml_file_path, version, output_dir)
+    if phase == PHASE_COLLECT or exit_code != EXIT_OK:
+        return exit_code
+    return _report_coverage(toml_file_path, output_dir)
+
+
+def _copy_pytest_cov_artifacts(py_build_folder, output_dir: Path):
+    """Lift pytest-cov's output out of the pybind build folder.
+
+    ``run_python_tests`` writes them inside the conan build folder, which is
+    private to the job that compiled it. Copying them up to ``output_dir`` is
+    what lets them survive as CI artifacts.
+
+    Args:
+        py_build_folder: The instrumented pybind build folder, or None when
+            that leg left no package.
+        output_dir: Workspace the artifacts are copied into.
+
+    Returns:
+        The source path of ``cov-py-summary.json``, or None when it was not
+        produced -- which the caller records as *no measurement*, distinct
+        from a measured 0%.
+    """
+    if py_build_folder is None:
+        return None
+    py_summary_src = _find_pytest_cov_artifact(
+        py_build_folder, "cov-py-summary.json", kind="file",
+    )
+    if py_summary_src is not None:
+        shutil.copy2(py_summary_src, output_dir / "cov-py-summary.json")
+    py_xml_src = _find_pytest_cov_artifact(
+        py_build_folder, "cov-py.xml", kind="file",
+    )
+    if py_xml_src is not None:
+        shutil.copy2(py_xml_src, output_dir / "cov-py.xml")
+    py_html_src = _find_pytest_cov_artifact(
+        py_build_folder, "coverage-html-py", kind="dir",
+    )
+    py_html_dst = output_dir / "coverage-html-py"
+    if py_html_src is not None:
+        if py_html_dst.exists():
+            shutil.rmtree(py_html_dst)
+        shutil.copytree(py_html_src, py_html_dst)
+    return py_summary_src
+
+
+def _coverage_legs(coverage_python_version: str) -> dict:
+    """The instrumented builds a coverage run drives, keyed by ``--leg`` name.
+
+    One definition, two callers: ``collect`` builds both in a single job,
+    ``measure`` builds exactly one so the generated GitLab pipeline can run
+    them as concurrent build jobs. A second copy of these filters would be a
+    copy free to drift, and the drift would be near-invisible -- a leg built
+    under a filter the reader does not use still produces a package, so the
+    run stays green and quietly measures nothing.
+    """
+    return {
+        LEG_CPP: _BuildLeg("C++", json.dumps({
+            "build_type": "Debug",
+            "options": {"testing": True, "pybind": False},
+        })),
+        LEG_PYTHON: _BuildLeg("Python", json.dumps({
+            "build_type": COVERAGE_PYBIND_BUILD_TYPE,
+            "options": {
+                "pybind": True,
+                "testing": False,
+                "python_version": coverage_python_version,
+            },
+        })),
+    }
+
+
+class _CoverageRun(NamedTuple):
+    """The setup every instrumented phase needs before it can build.
+
+    Shared so ``collect`` (both legs in one job) and ``measure`` (one leg per
+    job) cannot drift on the two things that must agree across them: the
+    ``XMS_COVERAGE`` environment that makes the generated profiles request the
+    ``coverage`` option, and the single Python ABI the filter, the package
+    lookup and the container image are all pinned to.
     """
+
+    toml_file: Path
+    output_dir: Path
+    config: object
+    library_name: str
+    coverage_cfg: dict
+    coverage_python_version: str
+    env: dict
+
+
+def _prepare_coverage_run(toml_file_path, version, output_dir) -> _CoverageRun:
+    """Read build.toml, regenerate under coverage, and build the leg env."""
     toml_file = Path(toml_file_path).resolve()
     output_dir = Path(output_dir).resolve()
     if not toml_file.exists():
@@ -859,7 +1112,8 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
     if config.ci.xvfb:
         _reexec_under_xvfb()
 
-    # 1. Generate build artifacts.
+    # Regenerate with XMS_COVERAGE set, so every profile this run builds
+    # from carries the coverage option rather than the production one.
     _run(
         ["xmsconan_gen", "--version", version, "--output_dir", str(output_dir),
          str(toml_file)],
@@ -885,6 +1139,41 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
             ambient_python_version, coverage_python_version, ambient_python_version,
         )
     env["PYTHON_TARGET_VERSION"] = coverage_python_version
+    return _CoverageRun(
+        toml_file=toml_file, output_dir=output_dir, config=config,
+        library_name=library_name, coverage_cfg=coverage_cfg,
+        coverage_python_version=coverage_python_version, env=env,
+    )
+
+
+def _collect_coverage(toml_file_path: str | Path, version: str,
+                      output_dir: str | Path) -> int:
+    """Build both instrumented legs and render every coverage artifact.
+
+    The packager emits a Debug+testing-only config and a Release+pybind-only
+    config independently; this builds both -- sequentially unless
+    ``[coverage].parallel = true`` (§5.7) overlaps them -- then runs gcovr
+    against both build folders and merges the result, and copies pytest-cov
+    artifacts out of the pybind build folder. The two builds never share a
+    binary shape, so changes to CxxTest linkage or pybind options cannot break
+    the other layer. Both are instrumented: the testing build supplies what
+    CxxTest reaches, the pybind build the binding layer and anything only a
+    Python test exercises.
+
+    Everything gcovr needs paths for happens here, beside the build folders
+    that produced the data. What leaves is portable: rendered HTML, XML, the
+    two summary JSONs, and :data:`COVERAGE_STATUS_FILE`.
+
+    Returns ``EXIT_OK`` once the artifacts are written -- including when the
+    tests failed, which is recorded for the report phase to gate on -- and
+    ``EXIT_ERROR`` when neither leg left a package to report on.
+    """
+    run = _prepare_coverage_run(toml_file_path, version, output_dir)
+    output_dir = run.output_dir
+    library_name = run.library_name
+    coverage_cfg = run.coverage_cfg
+    coverage_python_version = run.coverage_python_version
+    env = run.env
 
     # 2/3. The two coverage builds.
     #
@@ -903,20 +1192,7 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
     # overlap. Only the report step below reads both. They run in sequence by
     # default; `[coverage].parallel = true` overlaps them on a runner where
     # the conan cache race and the CPU contention do not apply.
-    legs = [
-        _BuildLeg("C++", json.dumps({
-            "build_type": "Debug",
-            "options": {"testing": True, "pybind": False},
-        })),
-        _BuildLeg("Python", json.dumps({
-            "build_type": "Release",
-            "options": {
-                "pybind": True,
-                "testing": False,
-                "python_version": coverage_python_version,
-            },
-        })),
-    ]
+    legs = list(_coverage_legs(coverage_python_version).values())
     tests_failed = _run_coverage_builds(
         legs, version, env, str(output_dir), coverage_cfg["parallel"],
     )
@@ -949,77 +1225,306 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
     # 5. Generate the C++ coverage report from both instrumented builds. The
     #    testing build covers what CxxTest reaches; the pybind build covers the
     #    binding layer and anything only a Python test exercises.
-    cpp_summary = _run_gcovr(gcovr_folders, coverage_cfg, output_dir)
+    #    Its JSON summary lands in output_dir, which is where the report phase
+    #    reads it back from -- the return value is that path.
+    _log_gcov_data_size(gcovr_folders)
+    _run_gcovr(gcovr_folders, coverage_cfg, output_dir)
 
     # 6. Locate Python coverage artifacts produced inside the pybind build
     #    folder by run_python_tests, and copy them up to the workspace root.
-    py_summary = output_dir / "cov-py-summary.json"
-    py_summary_src = None
-    if py_build_folder is not None:
-        py_summary_src = _find_pytest_cov_artifact(
-            py_build_folder, "cov-py-summary.json", kind="file",
-        )
-        if py_summary_src is not None:
-            shutil.copy2(py_summary_src, py_summary)
-        py_xml_src = _find_pytest_cov_artifact(
-            py_build_folder, "cov-py.xml", kind="file",
-        )
-        if py_xml_src is not None:
-            shutil.copy2(py_xml_src, output_dir / "cov-py.xml")
-        py_html_src = _find_pytest_cov_artifact(
-            py_build_folder, "coverage-html-py", kind="dir",
-        )
-        py_html_dst = output_dir / "coverage-html-py"
-        if py_html_src is not None:
-            if py_html_dst.exists():
-                shutil.rmtree(py_html_dst)
-            shutil.copytree(py_html_src, py_html_dst)
-
-    # 7. Threshold gating. Compare raw percentages so a 69.95% build does
-    #    not sneak past a 70.0 threshold via display rounding.
-    cpp_raw = _cpp_percent_from_summary(cpp_summary)
-    py_raw = _py_percent_from_summary(py_summary) if py_summary.exists() else 0.0
-    cpp_threshold = coverage_cfg["cpp_threshold"]
-    py_threshold = coverage_cfg["python_threshold"]
-    # A missing testing leg does not zero the C++ number: gcovr merges
-    # whatever folders survived step 4, so the percent quietly narrows to the
-    # binding layer alone, and cpp_threshold defaults to 0 -- a mostly
-    # unmeasured layer would read as PASS. Same distinction as py_measured
-    # below: no measurement is not 0% coverage, and only a full measurement
-    # may satisfy the threshold.
+    py_summary_src = _copy_pytest_cov_artifacts(py_build_folder, output_dir)
+
+    # 7. Record what only this phase can know. A missing testing leg does not
+    #    zero the C++ number -- gcovr merges whatever folders survived step 4,
+    #    so the percent quietly narrows to the binding layer alone, and
+    #    cpp_threshold defaults to 0, which would read as PASS. The report
+    #    phase cannot tell that from the summary file, so it is recorded here.
     cpp_measured = cpp_build_folder is not None
     if not cpp_measured:
         LOGGER.error(
             "No C++ coverage measurement: the testing coverage build left no "
             "build folder to read, so the C++ percent covers the binding "
-            "layer alone. Failing the gate rather than reporting a mostly "
+            "layer alone. The gate will fail rather than report a mostly "
             "unmeasured layer as passing."
         )
-    cpp_pass = cpp_measured and cpp_raw >= cpp_threshold
     # An absent summary is not 0% coverage, it is *no measurement*, and the two
     # have to be told apart: python_threshold defaults to 0, so 0.0 >= 0.0
-    # reports "Python: 0.0% -> PASS" for a layer that never ran. Step 3 always
-    # builds pybind with XMS_COVERAGE=1 and the coverage job is Linux-only in
-    # both CI templates, so the only way the file is legitimately absent is the
-    # pybind leg failing outright -- which step 4 reports and which fails the
-    # gate here either way.
+    # would report "Python: 0.0% -> PASS" for a layer that never ran. Step 3
+    # always builds pybind with the coverage option and the coverage job is
+    # Linux-only in both CI templates, so the only way the file is legitimately
+    # absent is the pybind leg failing outright.
     py_measured = py_summary_src is not None
     if not py_measured:
         if py_build_folder is None:
             LOGGER.error(
                 "No Python coverage measurement: the pybind coverage build "
                 "left no package in the cache, so its summary could not be "
-                "collected. Failing the gate rather than reporting an "
+                "collected. The gate will fail rather than report an "
                 "unmeasured layer as passing."
             )
         else:
             LOGGER.error(
                 "No cov-py-summary.json under %s. The pybind coverage build "
-                "ran, so run_python_tests should have written one -- failing "
-                "the gate rather than reporting an unmeasured layer as "
-                "passing.",
+                "ran, so run_python_tests should have written one -- the gate "
+                "will fail rather than report an unmeasured layer as passing.",
                 py_build_folder,
             )
+    _write_coverage_status(
+        output_dir,
+        tests_failed=tests_failed,
+        cpp_measured=cpp_measured,
+        py_measured=py_measured,
+    )
+    return EXIT_OK
+
+
+def _measure_coverage(toml_file_path: str | Path, version: str,
+                      output_dir: str | Path, leg_name: str) -> int:
+    """Build one instrumented leg and read its coverage where it was compiled.
+
+    The single-leg counterpart to :func:`_collect_coverage`. It exists because
+    gcovr needs the ``.gcno`` written at compile time beside the ``.gcda``
+    written at run time, so whatever reads a leg's data has to be the job that
+    compiled it -- and a single job compiling both legs is a job doing two
+    compiles in sequence. Splitting them lets the generated pipeline run the
+    legs as concurrent build jobs and merge afterwards.
+
+    What leaves is small and portable: a gcovr tracefile whose paths are
+    relative to the source tree (see :func:`_merge_tracefiles`), this leg's
+    slice of the status file, and, for the Python leg, pytest-cov's own
+    output. The build folder itself never moves -- at 245 MiB of ``.gcno``
+    against 5.5 MiB of ``.gcda`` on xmsvtk's C++ leg, moving it would cost far
+    more than the compile it saves.
+
+    Returns ``EXIT_OK`` once this leg's artifacts are written -- including when
+    its tests failed, which is recorded for the report phase to gate on -- and
+    ``EXIT_ERROR`` when the leg left no package to read.
+    """
+    if leg_name not in COVERAGE_LEGS:
+        raise ValueError(
+            f"Unknown coverage leg {leg_name!r}; expected one of "
+            f"{', '.join(COVERAGE_LEGS)}."
+        )
+    run = _prepare_coverage_run(toml_file_path, version, output_dir)
+    output_dir = run.output_dir
+    leg = _coverage_legs(run.coverage_python_version)[leg_name]
+
+    tests_failed = _run_coverage_builds(
+        [leg], version, run.env, str(output_dir), parallel=False,
+    )
+
+    if leg_name == LEG_CPP:
+        build_folder = _locate_coverage_build(run.library_name, kind="testing")
+    else:
+        build_folder = _locate_coverage_build(
+            run.library_name, kind="pybind",
+            python_version=run.coverage_python_version,
+        )
+    LOGGER.info("%s coverage build folder: %s", leg.name,
+                build_folder if build_folder else "<missing>")
+
+    if build_folder is None:
+        LOGGER.error(
+            "The %s coverage build left no package in the local Conan cache, "
+            "so there is no .gcda to read. Recording the leg as unmeasured "
+            "rather than writing an empty tracefile, which the merge would "
+            "read as a layer that is genuinely 0%% covered.",
+            leg.name,
+        )
+        _write_coverage_status(
+            output_dir, tests_failed=tests_failed,
+            cpp_measured=False, py_measured=False, leg=leg_name,
+        )
+        return EXIT_ERROR
+
+    _log_gcov_data_size([build_folder])
+    _collect_tracefiles(
+        [build_folder], run.coverage_cfg, output_dir, names=[leg_name],
+    )
+
+    py_summary_src = None
+    if leg_name == LEG_PYTHON:
+        py_summary_src = _copy_pytest_cov_artifacts(build_folder, output_dir)
+        if py_summary_src is None:
+            LOGGER.error(
+                "The pybind coverage build produced no cov-py-summary.json in "
+                "%s. Its tests ran inside the build, so run_python_tests "
+                "should have written one -- the gate will fail rather than "
+                "report an unmeasured layer as passing.", build_folder,
+            )
+
+    _write_coverage_status(
+        output_dir,
+        tests_failed=tests_failed,
+        # Each leg reports only on itself. The report phase unions the files,
+        # so a leg that never ran leaves its layer unmeasured rather than
+        # being asserted measured by the other leg's status.
+        cpp_measured=(leg_name == LEG_CPP),
+        py_measured=(leg_name == LEG_PYTHON and py_summary_src is not None),
+        leg=leg_name,
+    )
+    return EXIT_OK
+
+
+def _write_coverage_status(output_dir: Path, *, tests_failed: bool,
+                           cpp_measured: bool, py_measured: bool,
+                           leg: Optional[str] = None) -> None:
+    """Hand the report phase the facts it cannot re-derive from the summaries.
+
+    Written even on a healthy run, so its absence in the report phase is
+    unambiguous: the measuring phase did not finish, rather than finishing
+    with nothing to say.
+
+    Args:
+        output_dir: Where the file is written.
+        tests_failed: Whether any test run this phase drove failed.
+        cpp_measured: Whether the C++ layer was actually measured.
+        py_measured: Whether the Python layer was actually measured.
+        leg: The leg this status covers, which suffixes the filename. None
+            writes the whole-run file ``collect`` produces. The suffix is what
+            keeps two concurrent build jobs from overwriting each other: they
+            upload into one artifact space, and a single fixed filename would
+            leave whichever job finished last as the only surviving answer --
+            silently discarding the other layer's measurement while still
+            looking like a complete status.
+    """
+    status = {
+        "tests_failed": bool(tests_failed),
+        "cpp_measured": bool(cpp_measured),
+        "py_measured": bool(py_measured),
+    }
+    name = COVERAGE_STATUS_FILE
+    if leg is not None:
+        name = f"{Path(COVERAGE_STATUS_FILE).stem}-{leg}.json"
+    path = Path(output_dir) / name
+    path.write_text(json.dumps(status, indent=2) + "\n", encoding="utf-8")
+    LOGGER.info("Wrote %s: %s", path, status)
+
+
+def _read_one_status(path: Path) -> Optional[dict]:
+    """Read a single status file, or None when it is absent or unreadable.
+
+    "Unreadable" includes well-formed JSON that is not an object. The caller
+    unions these with ``.get()``, so a file holding a list or a bare string
+    would reach it as a valid payload and raise ``AttributeError`` from inside
+    the gate -- a crash in the job whose whole purpose is to report a verdict.
+    Treating it as a missing file instead lets the union fall through to its
+    unmeasured-layer path, which fails the gate loudly and names the file.
+    """
+    try:
+        status = json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return None
+    except (OSError, json.JSONDecodeError) as exc:
+        LOGGER.error("Could not read %s: %s", path, exc)
+        return None
+    if not isinstance(status, dict):
+        LOGGER.error("Ignoring %s: expected a JSON object, got %s",
+                     path, type(status).__name__)
+        return None
+    return status
+
+
+def _read_coverage_status(output_dir: Path) -> Optional[dict]:
+    """Read what the measuring phase recorded, or None when it left nothing.
+
+    A ``collect`` run writes one whole-run file; a split pipeline writes one
+    file per leg, and this unions them. The union is not symmetric across the
+    three fields, and each asymmetry is deliberate:
+
+    * ``tests_failed`` is an OR. Either leg's tests failing has to fail the
+      gate, and a leg that never ran cannot vouch for the other's tests.
+    * ``cpp_measured`` / ``py_measured`` are ORs over legs that each report
+      only on themselves. A missing leg therefore leaves its own layer
+      unmeasured rather than inheriting the surviving leg's answer -- which is
+      the case that matters, because an unmeasured layer whose threshold
+      defaults to 0 would otherwise read as a clean PASS.
+
+    The whole-run file is read too, so ``--phase all`` and ``--phase collect``
+    keep working unchanged.
+    """
+    output_dir = Path(output_dir)
+    paths = [output_dir / COVERAGE_STATUS_FILE]
+    stem = Path(COVERAGE_STATUS_FILE).stem
+    paths.extend(sorted(output_dir.glob(f"{stem}-*.json")))
+
+    found = [status for status in (_read_one_status(path) for path in paths)
+             if status is not None]
+    if not found:
+        return None
+    return {
+        "tests_failed": any(s.get("tests_failed") for s in found),
+        "cpp_measured": any(s.get("cpp_measured") for s in found),
+        "py_measured": any(s.get("py_measured") for s in found),
+    }
+
+
+def _report_coverage(toml_file_path: str | Path,
+                     output_dir: str | Path) -> int:
+    """Apply the ``[coverage]`` thresholds to what the collect phase produced.
+
+    Reads only JSON, so it needs neither a conan cache nor a compiler and can
+    run in a job of its own. Thresholds come from ``build.toml`` rather than
+    from the status file, so tightening one takes effect without re-running the
+    builds.
+
+    Returns ``EXIT_OK`` when both layers clear their thresholds,
+    ``EXIT_GATE_FAILED`` for a threshold miss, an unmeasured layer, or tests
+    that failed during collection, and ``EXIT_ERROR`` when the collect phase
+    left nothing to report on.
+    """
+    toml_file = Path(toml_file_path).resolve()
+    output_dir = Path(output_dir).resolve()
+    config = read_build_toml(toml_file)
+    coverage_cfg = _coverage_context(config.coverage, config.library_name)
+
+    status = _read_coverage_status(output_dir)
+    if status is None:
+        LOGGER.error(
+            "No readable %s (or per-leg %s-<leg>.json) in %s, so there is "
+            "nothing to gate on. The measuring phase writes one on every run "
+            "that gets as far as producing reports -- check that it ran and "
+            "that its artifacts reached this job.",
+            COVERAGE_STATUS_FILE, Path(COVERAGE_STATUS_FILE).stem, output_dir,
+        )
+        return EXIT_ERROR
+
+    cpp_summary = output_dir / "cov-cpp-summary.json"
+    py_summary = output_dir / "cov-py-summary.json"
+
+    # A split pipeline arrives here with per-leg tracefiles and no rendered
+    # report: each measuring job read its own build folder and stopped there,
+    # because merging needs both legs and no single build job has both. The
+    # merge happens here instead. It needs no conan cache -- the tracefiles
+    # store source paths relative to their build folder's copy of the exported
+    # tree, and the repository checkout has that same layout, so the checkout
+    # serves as --root. A `collect` run has already rendered the summary and
+    # skips this.
+    tracefiles = sorted(output_dir.glob("cov-cpp-tracefile-*.json"))
+    if tracefiles and not cpp_summary.exists():
+        LOGGER.info("Merging %d coverage tracefile(s) into the C++ report: %s",
+                    len(tracefiles), ", ".join(f.name for f in tracefiles))
+        _merge_tracefiles(tracefiles, Path.cwd(), output_dir)
+
+    if not cpp_summary.exists():
+        LOGGER.error(
+            "No %s, and no cov-cpp-tracefile-*.json to build one from. The "
+            "measuring phase writes one or the other on every run that gets "
+            "as far as reading a build folder -- check that it ran and that "
+            "its artifacts reached this job.", cpp_summary,
+        )
+        return EXIT_ERROR
+
+    # Compare raw percentages so a 69.95% build does not sneak past a 70.0
+    # threshold via display rounding.
+    cpp_raw = _cpp_percent_from_summary(cpp_summary)
+    py_raw = _py_percent_from_summary(py_summary) if py_summary.exists() else 0.0
+    cpp_threshold = coverage_cfg["cpp_threshold"]
+    py_threshold = coverage_cfg["python_threshold"]
+    cpp_measured = bool(status.get("cpp_measured"))
+    py_measured = bool(status.get("py_measured"))
+    tests_failed = bool(status.get("tests_failed"))
+    cpp_pass = cpp_measured and cpp_raw >= cpp_threshold
     py_pass = py_measured and py_raw >= py_threshold
 
     rows = [
@@ -1034,10 +1539,21 @@ def run_coverage(toml_file_path: str | Path, version: str, output_dir: str | Pat
         LOGGER.info("  %s: %s (threshold %.1f%%) -> %s",
                     layer, shown, threshold, "PASS" if passed else "FAIL")
     _append_github_summary(rows)
+    # The line GitLab's `coverage:` regex reads. Printed by this phase because
+    # this is the job that gates -- gcovr's own --txt TOTAL is written in the
+    # collect job, whose log GitLab does not scrape for the pipeline number.
+    # "n/a" when unmeasured, so an unmeasured layer cannot publish a percentage
+    # that looks like a real measurement.
+    LOGGER.info("Coverage total: %s",
+                f"{cpp_raw:.1f}%" if cpp_measured else "n/a")
 
+    if not cpp_measured:
+        LOGGER.error("Coverage gate FAIL: the C++ layer was not measured.")
+    if not py_measured:
+        LOGGER.error("Coverage gate FAIL: the Python layer was not measured.")
     if tests_failed:
-        LOGGER.error("Coverage gate FAIL: build.py exited non-zero earlier; "
-                     "see the build log above for the failing test(s).")
+        LOGGER.error("Coverage gate FAIL: build.py exited non-zero during "
+                     "collection; see that job's log for the failing test(s).")
     if cpp_pass and py_pass and not tests_failed:
         return EXIT_OK
     return EXIT_GATE_FAILED
@@ -1059,6 +1575,27 @@ def main():
         "--version", default=None,
         help="The build version. If omitted, tries setuptools-scm then falls back to 0.0.0.",
     )
+    parser.add_argument(
+        "--phase", choices=COVERAGE_PHASES, default=PHASE_ALL,
+        help=(
+            "Which part of the run to do. 'measure' builds ONE instrumented "
+            "leg (see --leg) and writes that leg's tracefile beside the build "
+            "folder that produced it; 'collect' does both legs in one process; "
+            "'report' merges whatever tracefiles it finds and applies the "
+            "[coverage] thresholds. The default does everything in one "
+            "process. The generated GitLab pipeline uses 'measure' so the two "
+            "instrumented builds are separate concurrent jobs, and 'report' "
+            "so the gate runs in a seconds-long job that needs no toolchain."
+        ),
+    )
+    parser.add_argument(
+        "--leg", choices=COVERAGE_LEGS, default=None,
+        help=(
+            "Which instrumented build to run, for --phase measure. 'cpp' is "
+            "the Debug testing configuration, 'python' the Release pybind one. "
+            "Ignored by every other phase."
+        ),
+    )
     parser.add_argument(
         "toml_file", nargs="?", default="build.toml",
         help="Path to build.toml. Defaults to ./build.toml.",
@@ -1071,7 +1608,10 @@ def main():
     version = resolve_version(args.version)
 
     try:
-        exit_code = run_coverage(args.toml_file, version, args.output_dir)
+        exit_code = run_coverage(
+            args.toml_file, version, args.output_dir, phase=args.phase,
+            leg=args.leg,
+        )
     except Exception as exc:
         # subprocess.run(..., capture_output=True, check=True) callers
         # (_find_coverage_package, _conan_cache_path) raise CalledProcessError
diff --git a/xmsconan/generator_tools/build_filter.py b/xmsconan/generator_tools/build_filter.py
index f8183d7..0c75d1a 100644
--- a/xmsconan/generator_tools/build_filter.py
+++ b/xmsconan/generator_tools/build_filter.py
@@ -15,12 +15,18 @@
 does not emit steps the filter has made unbuildable.
 """
 # 1. Standard python modules
+import collections
+import json
 from typing import Optional
 
 # 3. Aquaveo modules
 from xmsconan.build_toml import BuildToml
 from xmsconan.constants import version_sort_key
 from xmsconan.package_tools.packager import (
+    config_label,
+    COVERAGE_PYBIND_BUILD_TYPE,
+    filter_matches,
+    is_instrumented_configuration,
     summarize_filter_matches,
     validate_filter_dict,
     XmsConanPackager,
@@ -92,6 +98,17 @@ def load_build_filter(config: BuildToml) -> dict:
         validate_filter_dict(build_filter)
     except ValueError as e:
         raise ValueError(f"Invalid [filter] table in build.toml: {e}") from e
+    if "coverage" in build_filter.get("options", {}):
+        # Normal builds omit the coverage option entirely (it is only set on
+        # `xmsconan coverage` runs), so a permanent [filter] pin would
+        # exclude every normal configuration — and the generic emptiness
+        # check would blame "options that cannot hold at once".
+        raise ValueError(
+            "The [filter] table in build.toml pins options.coverage, but the "
+            "coverage option is only emitted during `xmsconan coverage` runs, "
+            "so the pin would exclude every normal build. Pass it as a "
+            "--filter to build.py during a coverage run instead."
+        )
     if build_filter:
         _reject_matrix_conflict(build_filter, config.matrix)
         python_versions = ci_python_versions(config)
@@ -226,12 +243,23 @@ def ci_filter_effects(build_filter: dict, config: BuildToml) -> dict:
             configurations this library really produces.
 
     Returns:
-        ``{'build_types': [...], 'wheel_enabled': {ci_platform: bool}}``, keyed
-        by the CI platform names in :data:`CI_WHEEL_PLATFORMS`. ``build_types``
+        ``{'build_types': [...], 'wheel_enabled': {ci_platform: bool},
+        'test_labels': [...]}``, with ``wheel_enabled`` keyed by the CI platform
+        names in :data:`CI_WHEEL_PLATFORMS`. ``build_types``
         is never empty for a filter that reached here: ``load_build_filter`` has
         already rejected one that matches nothing on every platform, so at least
         one candidate build type keeps a configuration.
 
+        ``test_labels`` names the Linux ``test_artifacts/<label>/`` directories
+        the build stages, one per surviving testing configuration, and is what
+        the split-out GitLab test jobs pass to ``xmsconan_test_shards --label``.
+        It is deliberately not derived from ``build_types``: that axis counts
+        every surviving configuration, so a filter selecting only pybind or only
+        plain-library builds leaves a build type listed there with no test
+        runner staged. Unlike ``build_types`` it *can* be empty — a filter with
+        ``options.testing = false`` builds no runner at all — and the caller
+        emits no test jobs rather than one that would fail looking for them.
+
         The wheel answer is per platform because a filter can leave one
         platform with wheels and another without. ``"compiler.runtime" =
         "static"`` is the case: msvc pybind variants are only produced for the
@@ -247,6 +275,10 @@ def ci_filter_effects(build_filter: dict, config: BuildToml) -> dict:
 
     build_types = []
     pybind = {name: 0 for name in CI_WHEEL_PLATFORMS}
+    # Linux only: [ci].split_tests splits the Linux build alone. The Windows job
+    # compiles and runs its tests in one place and so never needs to name an
+    # artifact directory.
+    test_labels = []
     for build_type in candidates:
         # Probing one build type at a time is what makes these answers per-leg
         # rather than global: the GitHub matrix drops a leg that keeps nothing,
@@ -258,13 +290,275 @@ def ci_filter_effects(build_filter: dict, config: BuildToml) -> dict:
             build_types.append(build_type)
         for name, matrix_platform in CI_WHEEL_PLATFORMS.items():
             pybind[name] += summary[matrix_platform]["pybind"]
+        for label in summary[CI_WHEEL_PLATFORMS["linux"]]["testing_labels"]:
+            if label not in test_labels:
+                test_labels.append(label)
 
     return {
         "build_types": build_types,
         "wheel_enabled": {name: count > 0 for name, count in pybind.items()},
+        "test_labels": test_labels,
     }
 
 
+def ci_build_jobs(build_filter: dict, config: BuildToml,
+                  python_versions: list, coverage: bool = False,
+                  coverage_python_version: Optional[str] = None) -> list[dict]:
+    """One GitLab build job per surviving Linux configuration.
+
+    The generated pipeline used to run a single ``Conan Build`` that looped
+    every configuration in sequence, and a ``Coverage Build`` that recompiled
+    two of them instrumented -- five compiles, three of them of source the
+    pipeline had already compiled. Emitting a job per configuration instead
+    makes the legs concurrent (they declare ``needs: []``, so they start
+    together rather than at their stage's turn) and lets each one be requested
+    in exactly the shape its consumer needs, so nothing is built twice.
+
+    Instrumentation is not decided here. It comes from
+    :func:`is_instrumented_configuration`, the same predicate the packager
+    applies when it sets the ``coverage`` option, because the two answers have
+    to agree: a job that ran an uninstrumented build and then looked for
+    ``.gcda`` would report the layer it was meant to measure as 0% covered,
+    and a job instrumented without a consumer would pay the compile for data
+    nobody reads.
+
+    Args:
+        build_filter: The validated ``[filter]`` table.
+        config: The parsed build.toml, for its [matrix] table.
+        python_versions: The Linux Python versions this pipeline builds --
+            ``[ci].linux_python_versions``, already resolved by the caller.
+            Deliberately not ``ci_python_versions``, which unions every
+            platform's list: that is the right input for a yes/no "does any
+            platform build a wheel" question, but here it would emit a build
+            job per ABI that only macOS builds, each one compiling a Python
+            version the Linux image does not have.
+        coverage: Whether this repository generates a coverage pipeline. False
+            leaves every job uninstrumented, which is also the shape a tag
+            pipeline wants.
+        coverage_python_version: The single ABI the coverage run pins to. Only
+            that pybind job is instrumented; a repository building three
+            wheels would otherwise emit three instrumented pybind jobs to feed
+            a reader that commits to one ABI up front, paying two extra
+            instrumented compiles for data nothing opens. None instruments
+            whichever pybind jobs the predicate accepts.
+
+    Returns:
+        A list of job dicts, in matrix order, each with:
+
+        ``name``
+            The GitLab job name, e.g. ``"Debug Instrumented Build"``.
+        ``label``
+            :func:`config_label` for this configuration -- the
+            ``test_artifacts/<label>/`` directory the build writes.
+        ``filter_json``
+            The ``build.py --filter`` argument selecting this one
+            configuration out of the generated matrix.
+        ``instrumented``
+            Whether this job compiles with coverage instrumentation, and so
+            whether it measures and publishes a coverage tracefile.
+        ``coverage_leg``
+            The ``xmsconan_coverage --leg`` value this job measures, or None
+            when it is not instrumented.
+        ``kind``
+            ``"testing"``, ``"pybind"`` or ``"library"``.
+        ``build_type``, ``python_version``
+            The configuration's own settings; ``python_version`` is None
+            except on pybind jobs.
+        ``tag_policy``
+            ``"always"``, ``"except"`` (branch pipelines only) or ``"only"``
+            (tag pipelines only) -- rendered as the job's ``only:``/``except:``
+            gate.
+        ``exports``
+            Whether this job saves a Conan cache tarball for the deploy to
+            restore. Assigned by the caller, not here, because it depends on
+            the whole set of jobs.
+
+        Empty when the filter leaves Linux with nothing to build, which the
+        caller reads as "emit no Linux build jobs" rather than emitting one
+        that would exit 1 looking for a configuration that was filtered away.
+    """
+    pinned = build_filter.get("build_type")
+    candidates = [pinned] if pinned is not None else list(DEFAULT_CI_BUILD_TYPES)
+    linux = CI_WHEEL_PLATFORMS["linux"]
+
+    jobs = []
+    for build_type in candidates:
+        probe = dict(build_filter, build_type=build_type)
+        for combination in filter_matches(linux, probe, python_versions,
+                                          config.matrix):
+            options = combination["options"]
+            instrumented = coverage and is_instrumented_configuration(combination)
+            # A wheel ABI the coverage run does not read. `not in` rather
+            # than two comparisons because it fits on one line: with W503 and
+            # W504 both enabled, a break at a binary operator is a lint error
+            # from whichever side it falls on.
+            abi = options.get("python_version")
+            wrong_abi = coverage_python_version not in (None, abi)
+            if instrumented and options.get("pybind") and wrong_abi:
+                instrumented = False
+            # And a wheel *build type* the coverage run does not read. The
+            # Python leg's filter pins one build type, so a library naming two
+            # in [matrix].pybind_build_types gets a second pybind
+            # configuration that `--leg python` never builds -- but
+            # is_instrumented_configuration says True for any pybind, so
+            # without this it would be planned as an instrumented job. It
+            # would then compile an instrumented module nothing reads and
+            # write coverage-status-python.json and
+            # cov-cpp-tracefile-python.json over the leg that is read, because
+            # both files are named for the leg and neither is named for the
+            # build type. Same shape as wrong_abi above, same reason for the
+            # temporary: W503 and W504 are both on, so the condition cannot
+            # break at its operators.
+            wrong_build_type = build_type != COVERAGE_PYBIND_BUILD_TYPE
+            if instrumented and options.get("pybind") and wrong_build_type:
+                instrumented = False
+            if options.get("pybind"):
+                kind = "pybind"
+                python_version = options.get("python_version")
+                selector = {"pybind": True, "testing": False,
+                            "python_version": python_version}
+            elif options.get("testing"):
+                kind = "testing"
+                python_version = None
+                selector = {"testing": True, "pybind": False}
+            else:
+                kind = "library"
+                python_version = None
+                selector = {"testing": False, "pybind": False}
+            spec = {
+                "name": None,  # assigned below, once the whole set is known
+                "label": config_label(combination),
+                # Compact separators, so the rendered YAML stays parseable.
+                # json.dumps' default ", " / ": " puts a colon-space inside
+                # the script line, and a colon-space is what ends a YAML plain
+                # scalar -- the whole build command then parses as a mapping
+                # and the pipeline is rejected before it starts.
+                "filter_json": json.dumps({
+                    "build_type": combination["build_type"],
+                    "options": selector,
+                }, separators=(",", ":")),
+                "instrumented": instrumented,
+                # The `xmsconan_coverage --leg` selector for this job, or None
+                # when it builds nothing coverage reads. Carried on the job
+                # rather than derived in the template, so the one place that
+                # decides a job is instrumented is also the place that says
+                # which leg it is.
+                "coverage_leg": (
+                    ("python" if kind == "pybind" else "cpp")
+                    if instrumented else None
+                ),
+                "kind": kind,
+                "build_type": combination["build_type"],
+                "python_version": python_version,
+                # A tag pipeline exists to publish, so it builds exactly what
+                # gets published: the library binaries downstream repositories
+                # link against, and the pybind binary the wheel wraps. A
+                # testing configuration builds a test runner -- nothing
+                # installs it and no tag pipeline runs it -- so it is
+                # branch-only. The old single build job compiled the test
+                # configurations on tags too, and for a wheel_only repository
+                # like xmsvtk, whose matrix is two testing configurations and a
+                # pybind one, that was two thirds of what a release spent its
+                # time on.
+                "tag_policy": "except" if kind == "testing" else "always",
+                # Set by _mark_export_jobs once the whole set is known: which
+                # jobs save a Conan cache tarball for the deploy to restore.
+                "exports": False,
+            }
+            if instrumented and kind == "pybind":
+                # Instrumentation is part of the package_id, so this job's
+                # binary is not the one a release publishes. It stays on
+                # branches and the clean twin below takes the tag.
+                spec["tag_policy"] = "except"
+            jobs.append(spec)
+            if instrumented and kind == "pybind":
+                # The wheel still has to be built on a tag, and it must not be
+                # the instrumented one -- `--coverage` changes the binary that
+                # gets published, and the Coverage stage that would consume the
+                # instrumentation does not run on a tag anyway. So the pybind
+                # configuration is emitted twice, under two names and two
+                # mutually exclusive tag policies: exactly one of them exists
+                # in any given pipeline.
+                jobs.append(dict(
+                    spec, instrumented=False, tag_policy="only", name=None,
+                    coverage_leg=None,
+                ))
+
+    _name_build_jobs(jobs)
+    return jobs
+
+
+def _name_build_jobs(jobs: list[dict]) -> None:
+    """Give each build job a name, in place.
+
+    Names are read by humans scanning a pipeline and by ``needs:`` in the
+    template, so they say what the job builds rather than repeating its filter:
+    ``"Release Build"``, ``"Debug Instrumented Build"``, ``"Python
+    Instrumented Build"``.
+
+    A pybind job's name disambiguates on two axes, each added only when the
+    fan-out actually spans it. GitLab job names must be unique, but naming the
+    single-ABI case ``"Python Instrumented Build - py3.14"`` would put the
+    interpreter version into a name that has no second version to be
+    distinguished from, and into ``needs:`` lines that then churn on every
+    Python bump; the same argument applies to a build type when only one
+    pybind build type exists.
+
+    * The **build type** is prefixed when ``[matrix].pybind_build_types`` names
+      more than one -- ``"Debug Python Build"`` -- matching how the library
+      jobs are named.
+    * The **Python ABI** is suffixed when more than one pybind job exists.
+
+    Whether the two axes are enough is not left to inspection: the caller
+    checks the finished names for duplicates and raises, because a duplicate
+    GitLab job name is silently last-wins rather than an error.
+    """
+    pybind_jobs = [job for job in jobs
+                   if job["kind"] == "pybind" and job["tag_policy"] != "only"]
+    # The build type is a second axis the pybind fan-out can span, and unlike
+    # the ABI it is measured over *every* pybind job including the `only: tags`
+    # twins. The ABI suffix can skip them because a twin is always the clean
+    # half of a pair and the "Instrumented" word already separates it from its
+    # own sibling -- but it does not separate it from a different build type's
+    # uninstrumented job, which carries no such word either. With
+    # pybind_build_types = ["Release", "Debug"] that is exactly the collision:
+    # the Release twin and the Debug job both want "Python Build".
+    pybind_build_types = {job["build_type"] for job in jobs
+                          if job["kind"] == "pybind"}
+    for job in jobs:
+        if job["kind"] == "pybind":
+            base = ("Python" if len(pybind_build_types) < 2
+                    else f"{job['build_type']} Python")
+        elif job["kind"] == "library":
+            base = f"{job['build_type']} Library"
+        else:
+            base = job["build_type"]
+        middle = " Instrumented" if job["instrumented"] else ""
+        name = f"{base}{middle} Build"
+        if job["kind"] == "pybind" and len(pybind_jobs) > 1:
+            name = f"{name} - py{job['python_version']}"
+        job["name"] = name
+
+    # A GitLab job name is a YAML mapping key, so two jobs sharing one is not
+    # an error the pipeline reports -- the later block silently replaces the
+    # earlier, one configuration is never built, and the deploy then restores
+    # an export tarball no job wrote (the tarball is named for the *label*,
+    # which does carry the build type). Fail here instead: a naming axis this
+    # function does not yet know about should stop generation, not ship a
+    # pipeline that quietly builds less than the matrix asked for.
+    counts = collections.Counter(job["name"] for job in jobs)
+    duplicates = sorted(name for name, count in counts.items() if count > 1)
+    if duplicates:
+        raise ValueError(
+            "Two or more CI build jobs would be generated with the same name "
+            f"({', '.join(repr(name) for name in duplicates)}), and a GitLab "
+            "job name has to be unique -- the duplicate would overwrite the "
+            "first and that configuration would never be built. This is a "
+            "generator bug: some axis of the matrix is not part of the job "
+            "name."
+        )
+
+
 def empty_ci_jobs(build_filter: dict, ci_type: str, emitted_jobs) -> list[str]:
     """Name the generated CI jobs a filter leaves with nothing to build.
 
@@ -276,14 +570,24 @@ def empty_ci_jobs(build_filter: dict, ci_type: str, emitted_jobs) -> list[str]:
     Args:
         build_filter: The validated ``[filter]`` table.
         ci_type: ``"github"`` or ``"gitlab"``.
-        emitted_jobs: Names of the jobs this generation actually writes.
+        emitted_jobs: Names of the jobs this generation actually writes. An
+            entry may instead be a ``(name, settings_name)`` pair, for a job
+            whose platform settings are registered under a different name --
+            the ``[matrix].wheel_only`` Linux fan-out emits one job per
+            configuration, and every one of them runs on the same runner
+            ``CI_JOB_SETTINGS`` knows as ``"Conan Build"``. Without the pair
+            form each generated name would have to appear in that table, and a
+            table keyed on names the generator invents is a table that goes
+            stale the next time a job is renamed.
 
     Returns:
-        The subset of ``emitted_jobs`` whose fixed settings the filter excludes.
+        The subset of ``emitted_jobs`` whose fixed settings the filter excludes,
+        as names.
     """
     empty = []
-    for job_name in emitted_jobs:
-        settings = CI_JOB_SETTINGS[ci_type][job_name]
+    for entry in emitted_jobs:
+        job_name, settings_name = entry if isinstance(entry, tuple) else (entry, entry)
+        settings = CI_JOB_SETTINGS[ci_type][settings_name]
         if any(key in settings and settings[key] != value for key, value in build_filter.items()):
             empty.append(job_name)
     return empty
diff --git a/xmsconan/generator_tools/ci_file_generator.py b/xmsconan/generator_tools/ci_file_generator.py
index c9818a8..24371c2 100644
--- a/xmsconan/generator_tools/ci_file_generator.py
+++ b/xmsconan/generator_tools/ci_file_generator.py
@@ -13,6 +13,7 @@
 from xmsconan.ci_options import repairs_windows_wheel
 from xmsconan.constants import SUPPORTED_PYTHON_VERSIONS, version_sort_key
 from xmsconan.generator_tools.build_filter import (
+    ci_build_jobs,
     ci_filter_effects,
     coverage_conflicts,
     empty_ci_jobs,
@@ -139,6 +140,31 @@ def _unsupported_python_versions(versions) -> list:
 _DEFAULT_COVERAGE_PYTHON_VERSION = "3.13"
 
 
+def _mark_export_jobs(build_jobs: list) -> list:
+    """Mark the Linux build jobs that save a Conan cache tarball, and list them.
+
+    Every job that runs on a tag, because with one build job per configuration
+    each one has its own container and its own Conan cache: ``conan cache save``
+    in the pybind job sees the pybind package and nothing else. Naming a single
+    job the exporter -- which is what a pipeline with one build job could
+    afford to do -- would publish that job's package id and silently drop every
+    other one, so a release would ship a wheel and no library for the
+    downstream repositories that link against it.
+
+    Branch-only jobs are skipped because the deploy is ``only: tags``: their
+    tarball would never be restored, and the ``.export`` upload would be paid
+    on every branch pipeline for nothing.
+
+    Sets ``exports`` on each job in place and returns the marked ones, in build
+    order. Empty when there is no Linux build job at all, which the template
+    reads as "emit no export step".
+    """
+    exporters = [job for job in build_jobs if job["tag_policy"] != "except"]
+    for job in exporters:
+        job["exports"] = True
+    return exporters
+
+
 def _resolve_coverage_python_version(config: BuildToml) -> str:
     """Pick the single python_version the coverage build should pin to.
 
@@ -224,9 +250,24 @@ def _emitted_ci_jobs(ci_type: str, context: dict) -> list:
             jobs.insert(2, "linux-arm")
         return jobs
     # [ci].linux is GitLab-only -- the GitHub linux job above is not gated on it
-    # -- and it takes "Conan Build" out with it, so a filter cannot empty a job
-    # that was never written.
-    jobs = ["Conan Build"] if context["ci_linux"] else []
+    # -- and it takes the Linux build jobs out with it, so a filter cannot empty
+    # a job that was never written.
+    jobs = []
+    if context["ci_linux"] and context["ci_wheel_only"]:
+        # Under [matrix].wheel_only there is no single "Conan Build": the
+        # template emits one job per surviving configuration, so naming the old
+        # job here would point the warning at a block the pipeline does not
+        # contain. One entry for the whole fan-out rather than one per job,
+        # for two reasons. The pins this check is about -- os, arch, compiler
+        # -- belong to the Linux runner every one of those jobs shares, so
+        # enumerating would emit N identical warnings or none. And the case
+        # worth warning about empties the fan-out to *zero* jobs, which is
+        # exactly when a list built from it would have nothing left to warn
+        # with. The settings still come from "Conan Build", which is where that
+        # shared runner is registered.
+        jobs = [("Linux build jobs", "Conan Build")]
+    elif context["ci_linux"]:
+        jobs = ["Conan Build"]
     if context["ci_windows"]:
         jobs.append("Conan Build - Windows")
     return jobs
@@ -241,9 +282,9 @@ def _warn_filter_conflicts(build_filter: dict, config: BuildToml, ci_type: str,
     """
     for job_name in empty_ci_jobs(build_filter, ci_type, _emitted_ci_jobs(ci_type, context)):
         LOGGER.warning(
-            "The [filter] table excludes everything the %r job builds — that job "
-            "will fail with an empty matrix. Drop the setting from [filter], or "
-            "stop generating the job.", job_name,
+            "The [filter] table excludes everything %r builds, leaving it with "
+            "an empty matrix. Drop the setting from [filter], or stop "
+            "generating it.", job_name,
         )
 
     if not context["ci_coverage"]:
@@ -371,10 +412,36 @@ def generate_ci(
         )
 
     build_filter = load_build_filter(config)
-    # One measurement of the filter against the real matrix, feeding both the
-    # build_type axis and the wheel-step gate below.
+    # One measurement of the filter against the real matrix, feeding the
+    # build_type axis, the wheel-step gate, and the test-job fan-out below.
     filter_effects = ci_filter_effects(build_filter, config)
 
+    # The GitLab build stage emits one job per surviving Linux configuration
+    # rather than one job looping all of them, so the legs compile in parallel
+    # and each is requested in exactly the shape its consumer needs. Coverage
+    # is passed through because it decides which of those jobs instrument --
+    # the answer comes from the packager's own predicate, not from the
+    # template guessing that "Debug means coverage".
+    linux_build_jobs = ci_build_jobs(
+        build_filter, config, ci_linux_python_versions,
+        coverage=config.ci.coverage,
+        coverage_python_version=_resolve_coverage_python_version(config),
+    )
+
+    # split_tests moves test execution out of the build job -- the build exports
+    # XMS_SKIP_CXX_TESTS=1 and the Test stage runs the staged runners instead. A
+    # filter that leaves no testing configuration therefore does not merely skip
+    # the test jobs, it removes the only place the suite would have run, and the
+    # pipeline stays green having compiled nothing to test. Fail generation
+    # rather than ship that.
+    if gitlab_split_tests and linux_enabled and not filter_effects["test_labels"]:
+        raise ValueError(
+            "build.toml sets [ci].split_tests, but its [filter] leaves no Linux "
+            "testing configuration to stage a runner from, so the generated "
+            "pipeline would skip the C++ suite entirely and still pass. Drop "
+            "split_tests or widen the filter to keep a testing configuration."
+        )
+
     from xmsconan import __version__ as xmsconan_version
 
     # Deferred: coverage_generator imports _coverage_context from this module,
@@ -396,6 +463,14 @@ def generate_ci(
         # default follows ci_type -- see repairs_windows_wheel.
         "ci_windows_wheel_repair": repairs_windows_wheel(config),
         "ci_linux": config.ci.linux_enabled,
+        # Whether this repository gets the concurrent build stage. `wheel_only`
+        # is the flag it is keyed to because that is the shape the restructure
+        # was designed and measured against: a matrix with no library
+        # configurations, where the build jobs and the coverage legs are the
+        # same small set. A repository that publishes library packages keeps
+        # the single looping "Conan Build" and its separate "Coverage Build"
+        # until the concurrent stage has been proven against that shape too.
+        "ci_wheel_only": bool(config.matrix.get("wheel_only")),
         "ci_deploy": config.ci.deploy,
         "ci_coverage": config.ci.coverage,
         "ci_xvfb": config.ci.xvfb,
@@ -423,6 +498,37 @@ def generate_ci(
         "coverage_gate_exit_code": EXIT_GATE_FAILED,
         "coverage_python_version": _resolve_coverage_python_version(config),
         "ci_build_types": filter_effects["build_types"],
+        # One GitLab test job per staged testing configuration, each naming its
+        # own artifact directory. Computed here rather than spelled
+        # "<build_type>-testing" in the template: the label format is
+        # config_label's, and a copy of it in Jinja is free to drift from what
+        # the build writes.
+        "ci_test_labels": filter_effects["test_labels"],
+        "ci_linux_build_jobs": linux_build_jobs,
+        "ci_instrumented_build_jobs": [
+            job for job in linux_build_jobs if job["instrumented"]
+        ],
+        # Only the uninstrumented testing configurations get a separate test
+        # job. An instrumented one runs its own suite inside the build, beside
+        # the .gcno it has to be read against, so splitting it out would mean
+        # moving the build folder to reach the data.
+        "ci_linux_test_jobs": [
+            job for job in linux_build_jobs
+            if job["kind"] == "testing" and not job["instrumented"]
+        ],
+        # Also sets `exports` on the job dicts themselves, which is what the
+        # build-job loop reads to decide whether to emit the save step. The two
+        # context entries hold the same dict objects, so the marking is visible
+        # through ci_linux_build_jobs no matter which entry is evaluated first.
+        "ci_linux_export_jobs": _mark_export_jobs(linux_build_jobs),
+        # Every job that can produce a wheel. There is more than one because
+        # the pybind configuration is emitted twice -- instrumented on a
+        # branch, clean on a tag. Only the clean one writes a wheel, which is
+        # why Repair Wheel is tag-gated; the list still names both so the
+        # `optional: true` need has a name to be optional about.
+        "ci_linux_wheel_jobs": [
+            job for job in linux_build_jobs if job["kind"] == "pybind"
+        ],
         # Per platform: a filter can leave one platform building wheels and
         # another not (see ci_filter_effects). linux-arm reads the Linux flag.
         "ci_wheel_enabled_mac": filter_effects["wheel_enabled"]["mac"],
diff --git a/xmsconan/generator_tools/ci_templates/github-ci.yaml.jinja b/xmsconan/generator_tools/ci_templates/github-ci.yaml.jinja
index 891ac4a..ef03b93 100644
--- a/xmsconan/generator_tools/ci_templates/github-ci.yaml.jinja
+++ b/xmsconan/generator_tools/ci_templates/github-ci.yaml.jinja
@@ -16,6 +16,26 @@
 # Generated by xmsconan_ci — do not edit manually.
 #
 # GitHub runs the C++ tests inside the build job rather than in a separate
+<# What each build leg passes to `build.py --filter`.
+
+   On a branch that is the leg's build type and nothing else: every
+   configuration of that type gets built and tested. On a tag it also excludes
+   the testing configurations, because a tag run exists to publish and nothing
+   installs a test runner -- the workflow used to compile them on every
+   release, which for a Debug leg was the whole leg.
+
+   Written as a step `env:` rather than inline in the run line. The filter used
+   to be a JSON literal inside a double-quoted YAML scalar inside a shell
+   double-quoted argument, which needed a backslash pyramid for every quote it
+   contained; an env var is expanded by bash after all of that, so the JSON
+   here is written plainly and quoted once at the point of use.
+
+   `format()` renders literal braces by doubling them, hence `{{` and `}}`
+   around the JSON's own. The Windows leg cannot use this: it runs under
+   `shell: cmd`, where `%VAR%` expands *before* the argument is parsed, so a
+   value containing double quotes would break its own quoting. That leg gets
+   two `if:`-gated steps with the filter inline instead. #>
+<% set gh_build_filter = "${{ startsWith(github.ref, 'refs/tags/') && format('{{\"build_type\":\"{0}\",\"options\":{{\"testing\":false}}}}', matrix.build_type) || format('{{\"build_type\":\"{0}\"}}', matrix.build_type) }}" %>
 # downstream job, so [ci].test_shards reaches build.py directly. The
 # packager then skips cmake.test() during the build and runs the suite
 # afterward as N in-process gtest shards on the same runner -- the GitLab
@@ -166,8 +186,12 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% if ci_wheel_enabled_mac %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
+        run: "python build.py --filter=<% if ci_wheel_only %>\"${BUILD_MATRIX_FILTER}\"<% else %>\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% endif %><% if ci_wheel_enabled_mac %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
         shell: bash
+<% if ci_wheel_only %>
+        env:
+          BUILD_MATRIX_FILTER: << gh_build_filter >>
+<% endif %>
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -311,8 +335,12 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% if ci_wheel_enabled_linux %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
+        run: "python build.py --filter=<% if ci_wheel_only %>\"${BUILD_MATRIX_FILTER}\"<% else %>\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% endif %><% if ci_wheel_enabled_linux %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
         shell: bash
+<% if ci_wheel_only %>
+        env:
+          BUILD_MATRIX_FILTER: << gh_build_filter >>
+<% endif %>
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -457,8 +485,12 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
-        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% if ci_wheel_enabled_linux %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
+        run: "python build.py --filter=<% if ci_wheel_only %>\"${BUILD_MATRIX_FILTER}\"<% else %>\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% endif %><% if ci_wheel_enabled_linux %><< ci_wheel_dir_flag >><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
         shell: bash
+<% if ci_wheel_only %>
+        env:
+          BUILD_MATRIX_FILTER: << gh_build_filter >>
+<% endif %>
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -611,8 +643,17 @@ jobs:
         run: xmsconan_gen --version ${{ env.XMS_VERSION }} build.toml
       # Build the Conan Package
       - name: Build the Conan Packages
+<% if ci_wheel_only %>
+        if: "!startsWith(github.ref, 'refs/tags/')"
+<% endif %>
         run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\"}\"<% if ci_wheel_enabled_windows %><< ci_wheel_dir_flag >><% if not ci_windows_wheel_repair %> --skip-dependency-libs<% endif %><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
         shell: cmd
+<% if ci_wheel_only %>
+      - name: Build the Conan Packages (release)
+        if: startsWith(github.ref, 'refs/tags/')
+        run: "python build.py --filter=\"{\\\"build_type\\\": \\\"${{ matrix.build_type }}\\\", \\\"options\\\": {\\\"testing\\\": false}}\"<% if ci_wheel_enabled_windows %><< ci_wheel_dir_flag >><% if not ci_windows_wheel_repair %> --skip-dependency-libs<% endif %><% endif %> --artifacts-dir test_artifacts<< gh_test_shards >>"
+        shell: cmd
+<% endif %>
       - name: Upload test artifacts
         uses: actions/upload-artifact@v4
         with:
diff --git a/xmsconan/generator_tools/ci_templates/gitlab-ci.yml.jinja b/xmsconan/generator_tools/ci_templates/gitlab-ci.yml.jinja
index bb884c8..d06ad26 100644
--- a/xmsconan/generator_tools/ci_templates/gitlab-ci.yml.jinja
+++ b/xmsconan/generator_tools/ci_templates/gitlab-ci.yml.jinja
@@ -34,6 +34,136 @@ variables:
 
 <% endif %>
 <% if ci_linux %>
+<% if ci_wheel_only %>
+<# One build job per surviving Linux configuration, not one job looping all of
+   them. The loop was sequential, so a pipeline's compiles were serialized
+   inside a single container even though the runner has the concurrency to
+   overlap them; and it was paired with a "Coverage Build" that recompiled two
+   of those same configurations instrumented, because instrumentation is part
+   of the package_id and so cannot be satisfied by a production binary. Five
+   compiles, three of them of source the pipeline had already compiled.
+
+   Emitting a job per configuration fixes both at once. `needs: []` is what
+   actually makes them concurrent -- it starts each job the moment the pipeline
+   does, rather than at its stage's turn -- and each job requests exactly the
+   shape its consumer needs, so nothing is compiled twice.
+
+   The instrumented jobs run `xmsconan_coverage --phase measure` rather than
+   build.py directly. That keeps the whole instrumented path (regenerating with
+   XMS_COVERAGE set, pinning the coverage ABI, running the suite, reading .gcda
+   beside the .gcno that were written next to it) inside the tool that already
+   owns it, and it is why no build folder has to travel: at 245 MiB of .gcno
+   against 5.5 MiB of .gcda, moving one would cost more than the compile it
+   saves. What leaves each job is a tracefile of a few hundred KB. #>
+<% for job in ci_linux_build_jobs %>
+"<< job.name >>":
+<% if ci_split_tests %>
+  stage: Build
+<% else %>
+  stage: Test
+<% endif %>
+<% if docker_image %>
+  image: << docker_image >>
+<% elif ci_xvfb %>
+  image: docker.aquaveo.com/aquaveo/conan-docker/conan-gcc13-x11-gdal-py<< coverage_python_version if job.instrumented else (job.python_version or gitlab_linux_single_py) >>
+<% else %>
+  image: docker.aquaveo.com/aquaveo/conan-docker/conan-gcc13-py<< coverage_python_version if job.instrumented else (job.python_version or gitlab_linux_single_py) >>
+<% endif %>
+  needs: []
+<% if job.tag_policy == "except" %>
+  except:
+    - tags
+<% elif job.tag_policy == "only" %>
+  only:
+    - tags
+<% endif %>
+  variables:
+    PYTHON_TARGET_VERSION: '<< coverage_python_version if job.instrumented else (job.python_version or gitlab_linux_single_py) >>'
+<# What this job has to hand downstream, decided before the block is opened.
+   A library configuration -- no testing, no pybind, not the export job --
+   produces nothing any later job reads, and emitting `artifacts: paths:` with
+   an empty list under it is not a harmless no-op: GitLab parses the key as
+   null and rejects the file. #>
+<% set job_exports = ci_deploy and job.exports %>
+<% set job_wheels = ci_wheel_enabled_linux and job.kind == "pybind" %>
+<% if job_exports or job_wheels or job.instrumented or job.kind == "testing" %>
+  artifacts:
+    expire_in: '1d'
+    when: always
+    paths:
+<% if job_exports %>
+      - .export
+<% endif %>
+<% if job_wheels %>
+      - wheelhouse/
+<% endif %>
+<% if job.instrumented %>
+<# Small and portable: a tracefile whose paths are relative to the source tree,
+   and this leg's slice of the status file. The status file is per leg because
+   both instrumented jobs upload into one artifact space -- a single fixed name
+   would leave whichever finished last as the only surviving answer, discarding
+   the other layer's measurement while still looking like a complete status. #>
+      - cov-cpp-tracefile-<< job.coverage_leg >>.json
+      - coverage-status-<< job.coverage_leg >>.json
+<% if job.coverage_leg == "python" %>
+      - cov-py.xml
+      - cov-py-summary.json
+      - coverage-html-py/
+<% endif %>
+<% elif job.kind == "testing" %>
+<# This job's own runner only. `needs: artifacts: true` downloads the whole
+   staged tree, so staging under the configuration's label keeps one test job
+   from pulling every other configuration's runner too. #>
+      - test_artifacts/<< job.label >>/
+<% endif %>
+<% endif %>
+  script:
+<% if job.instrumented %>
+    - pip install "conan~=2.31.0" "gcovr>=7,<9" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - xmsconan_conan_setup
+<# Per-case ctest entries are registered for instrumented builds, so there is
+   something for -j8 to schedule: measured against xmsvtk's suite, per-case
+   ctest -j8 ran it in 303.5s where the single whole-binary entry took 1438s. #>
+    - export CTEST_PARALLEL_LEVEL=${CTEST_PARALLEL_LEVEL:-8}
+    - export PACKAGE_VERSION=${CI_COMMIT_TAG:-0.0.0}
+    - xmsconan_coverage --phase measure --leg << job.coverage_leg >> --version ${PACKAGE_VERSION} build.toml
+<% else %>
+    - gcc --version
+    - cmake --version
+    - python --version
+    - pip install "conan~=2.31.0" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - xmsconan_conan_setup
+    - export PACKAGE_VERSION=${CI_COMMIT_TAG:-0.0.0}
+    - export CTEST_PARALLEL_LEVEL=${CTEST_PARALLEL_LEVEL:-8}
+<% if ci_split_tests and job.kind == "testing" %>
+    - export XMS_SKIP_CXX_TESTS=1
+<% endif %>
+    - xmsconan_gen --version ${PACKAGE_VERSION} build.toml
+<% if ci_xvfb %>
+    - xvfb-run -a -s "-screen 0 1280x1024x24" python build.py --version ${PACKAGE_VERSION} --filter '<< job.filter_json >>' <% if ci_wheel_enabled_linux and job.kind == "pybind" %>--wheel-dir wheelhouse <% endif %>--artifacts-dir test_artifacts
+<% else %>
+    - python build.py --version ${PACKAGE_VERSION} --filter '<< job.filter_json >>' <% if ci_wheel_enabled_linux and job.kind == "pybind" %>--wheel-dir wheelhouse <% endif %>--artifacts-dir test_artifacts
+<% endif %>
+<% if job_exports %>
+<# Named for the configuration rather than the ABI. The tarball used to be one
+   per Python version because one build job held every configuration and only
+   the ABI fan-out split it; now a job is a configuration, so the label is what
+   makes two tarballs distinct -- and a library job, which has no ABI, would
+   otherwise collide with the other build type's. #>
+    - xmsconan_conan_deploy << library_name >> ${PACKAGE_VERSION} --save .export/<< library_name >>-linux-<< job.label >>-${PACKAGE_VERSION}.tar.gz
+<% endif %>
+<% endif %>
+
+<% endfor %>
+<% else %>
+<# The pre-restructure shape, kept for every repository that is not
+   wheel_only: one job looping every configuration, paired with the
+   separate "Coverage Build" below. The concurrent stage above was
+   designed against a matrix with no library configurations and has only
+   been exercised there, so a repository that publishes library packages
+   keeps this until that shape is proven too. #>
 Conan Build:
 <% if ci_split_tests %>
   stage: Build
@@ -90,6 +220,8 @@ Conan Build:
     - xmsconan_conan_deploy << library_name >> ${PACKAGE_VERSION} --save .export/<< library_name >>-linux<< gitlab_linux_py_suffix >>-${PACKAGE_VERSION}.tar.gz
 <% endif %>
 
+<% endif %>
+<% if ci_wheel_only %>
 <% if ci_split_tests %>
 <# One job, N shards inside it -- not `parallel: N`, which is N jobs on N
    runners. Each of those paid for a container start, a pip install and a
@@ -101,10 +233,81 @@ Conan Build:
    to one log interleave line by line, so it buffers each shard's output and
    replays it whole, then merges the per-shard gtest XML into the single
    TEST-cxxtest.xml reported below. It also does the artifact spelunking that
-   used to be inline shell here -- finding the staged *-testing directory,
-   restoring the runner's executable bit, and linking test_files/ back to the
-   absolute path the binary was compiled with. #>
-"Run C++ Tests":
+   used to be inline shell here -- restoring the runner's executable bit and
+   linking test_files/ back to the absolute path the binary was compiled with.
+
+   One job per *uninstrumented* testing configuration, each naming its own
+   directory with --label and consuming its own build job's artifacts. An
+   instrumented testing configuration gets no job here: it runs its suite
+   inside its build, because gcovr has to read the .gcda it produces against
+   the .gcno written beside them at compile time, and splitting the run out
+   would mean shipping a 245 MiB build folder to reach 5.5 MiB of data.
+
+   The labels come from the same config_label() the build names its
+   directories with, so the two cannot drift. #>
+<% for job in ci_linux_test_jobs %>
+<% set test_label = job.label %>
+"Run C++ Tests - << test_label >>":
+  stage: Test
+<% if docker_image %>
+  image: << docker_image >>
+<% elif ci_xvfb %>
+  image: docker.aquaveo.com/aquaveo/conan-docker/conan-gcc13-x11-gdal-py<< gitlab_linux_image_py >>
+<% else %>
+  image: docker.aquaveo.com/aquaveo/conan-docker/conan-gcc13-py<< gitlab_linux_image_py >>
+<% endif %>
+  except:
+    - tags
+  needs:
+    - job: "<< job.name >>"
+      artifacts: true
+  artifacts:
+    expire_in: '1d'
+    when: always
+<# The merged report, so a failing case is named in the MR widget rather than
+   only in the job log. A shard that died before gtest serialized anything is
+   merged in as an explicit error case, so a red job never shows an all-green
+   test tab. Every job writes the same filename; GitLab keys the pipeline test
+   report on the job name, so the configurations stay distinguishable. #>
+    reports:
+      junit: TEST-cxxtest.xml
+    paths:
+<# This job's own configuration only. `needs: artifacts: true` downloads the
+   whole staged tree, so uploading test_artifacts/ wholesale would have each
+   job re-upload every other configuration's runner too. #>
+      - test_artifacts/<< test_label >>/
+      - TEST-cxxtest.xml
+  script:
+    - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - xmsconan_test_shards --artifacts-dir test_artifacts --label << test_label >> --shards << ci_test_shards if ci_test_shards > 1 else 1 >><% if ci_xvfb %> --xvfb<% endif %>
+
+<% endfor %>
+<% endif %>
+<% else %>
+<% if ci_split_tests %>
+<# One job, N shards inside it -- not `parallel: N`, which is N jobs on N
+   runners. Each of those paid for a container start, a pip install and a
+   download of the build artifacts to run one Nth of the suite; for a suite
+   measured in minutes that overhead was most of the wall clock, and it scaled
+   with the shard count instead of against it.
+
+   xmsconan_test_shards is what makes one container viable: N runners writing
+   to one log interleave line by line, so it buffers each shard's output and
+   replays it whole, then merges the per-shard gtest XML into the single
+   TEST-cxxtest.xml reported below. It also does the artifact spelunking that
+   used to be inline shell here -- restoring the runner's executable bit and
+   linking test_files/ back to the absolute path the binary was compiled with.
+
+   One job per staged testing configuration, each naming its own directory with
+   --label. The build stages a runner for every testing configuration it
+   compiles, but a single job could only ever run one of them: it fell back to
+   the first of Debug-testing, Release-testing that existed, so a matrix
+   building both compiled the Release runner on every pipeline and never
+   executed it. The labels come from ci_test_labels, which the generator
+   computes with the same config_label() the build names the directories with,
+   so the two cannot drift. #>
+<% for test_label in ci_test_labels %>
+"Run C++ Tests - << test_label >>":
   stage: Test
 <% if docker_image %>
   image: << docker_image >>
@@ -124,16 +327,22 @@ Conan Build:
 <# The merged report, so a failing case is named in the MR widget rather than
    only in the job log. A shard that died before gtest serialized anything is
    merged in as an explicit error case, so a red job never shows an all-green
-   test tab. #>
+   test tab. Every job writes the same filename; GitLab keys the pipeline test
+   report on the job name, so the configurations stay distinguishable. #>
     reports:
       junit: TEST-cxxtest.xml
     paths:
-      - test_artifacts/
+<# This job's own configuration only. `needs: artifacts: true` downloads the
+   whole staged tree, so uploading test_artifacts/ wholesale would have each
+   job re-upload every other configuration's runner too. #>
+      - test_artifacts/<< test_label >>/
       - TEST-cxxtest.xml
   script:
     - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
-    - xmsconan_test_shards --artifacts-dir test_artifacts --shards << ci_test_shards if ci_test_shards > 1 else 1 >><% if ci_xvfb %> --xvfb<% endif %>
+    - xmsconan_test_shards --artifacts-dir test_artifacts --label << test_label >> --shards << ci_test_shards if ci_test_shards > 1 else 1 >><% if ci_xvfb %> --xvfb<% endif %>
 
+<% endfor %>
+<% endif %>
 <% endif %>
 <% endif %>
 <% if ci_windows %>
@@ -152,6 +361,28 @@ Conan Build:
 <% endfor %>
   variables:
     AQUAPI_URL: "https://aquapi.aquaveo.com/aquaveo/dev"
+<% if ci_wheel_only %>
+<# A branch builds the whole matrix; a tag builds only what it publishes. The
+   empty options dict is a filter that matches every configuration, so the
+   script can pass `--filter` unconditionally and quoted -- the alternative,
+   an interpolated flag that is empty on branches, relies on unquoted word
+   splitting to disappear, which is a subtle thing to leave in a release path.
+
+   `rules:` rather than the two mutually exclusive jobs Linux uses. The Linux
+   builds had to become separate jobs anyway, one per configuration; this is
+   still one job, and splitting it would mean either duplicating forty lines or
+   renaming it -- and "Conan Build - Windows" is named by the `needs:` of both
+   Windows deploy jobs. #>
+    BUILD_MATRIX_FILTER: '{"options":{}}'
+  rules:
+    - if: $CI_COMMIT_TAG
+      variables:
+<# Skip the testing configurations. Nothing installs a test runner and no tag
+   pipeline runs one -- the Windows job compiled them on every release, and for
+   a wheel_only repository the testing configurations are most of the matrix. #>
+        BUILD_MATRIX_FILTER: '{"options":{"testing":false}}'
+    - when: on_success
+<% endif %>
   artifacts:
     expire_in: '1d'
     when: always
@@ -173,7 +404,11 @@ Conan Build:
     - python -m pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
     - xmsconan_conan_setup
     - xmsconan_gen --version ${PACKAGE_VERSION} build.toml
+<% if ci_wheel_only %>
+    - python build.py --version ${PACKAGE_VERSION} --filter "${BUILD_MATRIX_FILTER}"<% if ci_wheel_enabled_windows %> --wheel-dir wheelhouse<% if not ci_windows_wheel_repair %> --skip-dependency-libs<% endif %><% endif %> --artifacts-dir test_artifacts
+<% else %>
     - python build.py --version ${PACKAGE_VERSION}<% if ci_wheel_enabled_windows %> --wheel-dir wheelhouse<% if not ci_windows_wheel_repair %> --skip-dependency-libs<% endif %><% endif %> --artifacts-dir test_artifacts
+<% endif %>
 <% if ci_windows_wheel_repair and ci_wheel_enabled_windows %>
 <# Windows repairs in place rather than in a separate Package-stage job the way
    Linux does: delvewheel resolves the DLL imports of a win_amd64 .pyd and can
@@ -215,8 +450,31 @@ Repair Wheel:
 <% else %>
   image: quay.io/pypa/manylinux_2_28_x86_64
 <% endif %>
+<% if ci_wheel_only %>
+<# Tag-gated to match its only producer. Before the restructure one ungated
+   "Conan Build" built every configuration, the wheel included, so an ungated
+   Repair Wheel always had something to repair. Now the clean pybind build is
+   the only job that emits a wheel and it is `only: tags`, while the branch
+   pipeline's instrumented pybind build measures coverage and writes no wheel
+   at all. Left ungated this job ran on every branch against an empty
+   wheelhouse and failed the pipeline: xmsvtk pipeline 63162,
+   "FileNotFoundError: No .whl files found in wheelhouse". #>
+  only:
+    - tags
+<# `needs: optional: true` rather than `dependencies:`: the instrumented pybind
+   build is `except: tags`, so it does not exist in the tag pipeline this job
+   now runs in. `optional` is the construct for a dependency that may not have
+   been created; naming a job that was filtered out is an error. #>
+  needs:
+<% for job in ci_linux_wheel_jobs %>
+    - job: "<< job.name >>"
+      artifacts: true
+      optional: true
+<% endfor %>
+<% else %>
   dependencies:
     - Conan Build
+<% endif %>
   script:
     - /opt/python/cp313-cp313/bin/pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
     - /opt/python/cp313-cp313/bin/xmsconan_wheel_repair --wheel-dir wheelhouse
@@ -244,6 +502,29 @@ Repair Wheel:
 "Conan Deploy - Linux":
   stage: Deploy
   image: ubuntu:latest
+<% if ci_wheel_only %>
+<# No `parallel: matrix` any more. It existed to give each ABI's export tarball
+   a leg to restore, back when the ABI fan-out was the only thing that produced
+   more than one. Now every taggable configuration exports, and they are not
+   all ABIs -- a library build has none -- so the legs no longer line up with
+   the tarballs. One job restores the whole set and uploads once, which is also
+   one fewer way for two legs to race on the same Conan reference. #>
+<# Guarded for the same reason as `artifacts: paths:` above: an empty list
+   leaves the key with nothing under it, GitLab parses that as null, and the
+   whole file is rejected. Reachable without a deploy misconfiguration --
+   `_mark_export_jobs` marks only the jobs whose tag_policy is not "except",
+   and a [filter] narrowing the matrix to testing configurations makes every
+   Linux job branch-only, while this job stays gated on [ci].deploy alone.
+   Dropping the key beats emitting an empty one: with no `dependencies:` GitLab
+   hands the job every earlier stage's artifacts, which is the behavior this
+   block narrows rather than one it depends on. #>
+<% if ci_linux_export_jobs %>
+  dependencies:
+<% for job in ci_linux_export_jobs %>
+    - "<< job.name >>"
+<% endfor %>
+<% endif %>
+<% else %>
 <% if gitlab_linux_fanout %>
   parallel:
     matrix:
@@ -253,6 +534,7 @@ Repair Wheel:
 <% endif %>
   dependencies:
     - Conan Build
+<% endif %>
   script:
     - apt-get update
     - apt-get install -y python3-pip python3-venv
@@ -262,7 +544,18 @@ Repair Wheel:
     - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
     - xmsconan_conan_setup
     - export PACKAGE_VERSION=${CI_COMMIT_TAG:-0.0.0}
+<% if ci_wheel_only %>
+<# Restore every tarball into this job's cache first, then upload once.
+   `conan upload <ref>` publishes every package id under the reference, so the
+   single upload at the end covers the whole restored set -- and uploading per
+   tarball instead would push the same recipe repeatedly. #>
+<% for job in ci_linux_export_jobs %>
+    - xmsconan_conan_deploy << library_name >> ${PACKAGE_VERSION} --restore .export/<< library_name >>-linux-<< job.label >>-${PACKAGE_VERSION}.tar.gz
+<% endfor %>
+    - xmsconan_conan_deploy << library_name >> ${PACKAGE_VERSION} --upload
+<% else %>
     - xmsconan_conan_deploy << library_name >> ${PACKAGE_VERSION} --restore .export/<< library_name >>-linux<< gitlab_linux_py_suffix >>-${PACKAGE_VERSION}.tar.gz --upload
+<% endif %>
   only:
     - tags
 
@@ -336,22 +629,140 @@ Repair Wheel:
 <% endif %>
 
 <% if ci_coverage %>
+<% if ci_wheel_only %>
+<# There is no "Coverage Build" any more. It used to compile both instrumented
+   configurations here, in a job of its own, because instrumentation is part of
+   the package_id and so no production binary can satisfy it -- which meant the
+   pipeline compiled the Debug testing and pybind configurations twice, once
+   clean in the build stage and once instrumented here. 503 of the 1334 objects
+   a pipeline compiled were that duplicate.
+
+   The instrumented builds are now build-stage jobs like any other (see the
+   fan-out at the top), each reading its own .gcda where it was compiled. What
+   is left here is the merge and the gate. #>
+<# Merge and gate: no conan and no compiler, just gcovr combining the
+   tracefiles the instrumented builds produced and the [coverage] thresholds
+   applied to the result.
+
+   The merge can run here, away from the build folders, because each tracefile
+   stores its source paths relative to its own build folder's copy of the
+   exported tree -- and the repository checkout this job already has is that
+   same tree, so it serves as gcovr's --root. That is what keeps a 245 MiB
+   build folder from having to travel between jobs to be read. #>
 Coverage:
   stage: Coverage
+<# Same null-key guard as `dependencies:` and `artifacts: paths:` above. An
+   empty `ci_instrumented_build_jobs` is what a [filter] excluding both
+   coverage builds produces -- `build_type = "Release"` cancels the Debug C++
+   leg and `options.pybind = false` the Python one. coverage_conflicts() warns
+   about exactly that and generation continues, so the file still has to
+   render: a warning followed by a pipeline GitLab will not parse reads as a
+   template bug rather than as the filter problem it is. #>
+<% if ci_instrumented_build_jobs %>
+  needs:
+<% for job in ci_instrumented_build_jobs %>
+    - job: "<< job.name >>"
+      artifacts: true
+<% endfor %>
+<% endif %>
 <% if ci_split_tests %>
-  # Under [ci].split_tests the tests gate the pipeline from "Run C++ Tests",
-  # so this job exists for the report and a coverage *gate* miss is advisory
-  # here. Only that exit code is forgiven. The tool failing -- an exception,
-  # neither build leg leaving a package in the conan cache, gcovr falling
-  # over -- still fails the job, because `allow_failure: true` forgave those
-  # too, and a Coverage stage reporting green while producing no report at
-  # all is how a broken coverage run survived an entire release unnoticed.
+  # Under [ci].split_tests the tests gate the pipeline from the "Run C++ Tests"
+  # jobs, so a coverage *gate* miss is advisory here. Only that exit code is
+  # forgiven. The tool failing -- an exception, the collect job leaving no
+  # summary to read -- still fails the job, because `allow_failure: true`
+  # forgave those too, and a Coverage stage reporting green while producing no
+  # report at all is how a broken coverage run survived an entire release
+  # unnoticed.
   allow_failure:
     exit_codes:
       - << coverage_gate_exit_code >>
 <% endif %>
   except:
     - tags
+  image: python:<< coverage_python_version >>
+  script:
+    - pip install "gcovr>=7,<9"
+    - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - xmsconan_coverage --phase report build.toml
+  artifacts:
+<# `when: always` because a gate miss still has a report worth reading -- and
+   it is now rendered *here*, so without this the run you most want to look at
+   is the one that publishes nothing. #>
+    when: always
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: cov-cpp.xml
+    paths:
+      - cov-cpp.xml
+      - cov-cpp-summary.json
+      - cov-py.xml
+      - cov-py-summary.json
+      - coverage-html-cpp/
+      - coverage-html-py/
+<# Printed by the report phase, not gcovr: gcovr's own --txt TOTAL is written
+   in the collect job, whose log GitLab does not scrape for the pipeline
+   number. An unmeasured C++ layer prints "n/a" and matches nothing here, so it
+   cannot publish a percentage that looks like a real measurement. #>
+  coverage: '/Coverage total: (\d+\.?\d*%)/'
+
+pages:
+  stage: Pages
+<# The merged HTML is rendered in "Coverage", so take it from there. That job
+   uploads `when: always`, which means the report still publishes on a gate
+   miss -- the run you most want to read is the one that failed its threshold.
+   `pages` waits for the whole Coverage stage either way; stage ordering, not
+   this dependency, is what sequences them. #>
+  dependencies:
+    - "Coverage"
+  script:
+    - mkdir -p public
+    - cp -r coverage-html-cpp public/cpp
+    - HAS_PY=0
+    - if [ -d coverage-html-py ]; then cp -r coverage-html-py public/python; HAS_PY=1; fi
+    - |
+      {
+        echo '<!DOCTYPE html>'
+        echo '<html lang="en"><head><meta charset="utf-8">'
+        echo '<title><< library_name >> coverage</title></head><body>'
+        echo '<h1><< library_name >> coverage</h1>'
+        echo '<ul>'
+        echo '<li><a href="cpp/index.html">C++ coverage (gcovr)</a></li>'
+        [ "$HAS_PY" -eq 1 ] && echo '<li><a href="python/index.html">Python coverage (pytest-cov)</a></li>'
+        echo '</ul></body></html>'
+      } > public/index.html
+  artifacts:
+    paths:
+      - public
+  only:
+    - master
+    - main
+<% else %>
+<# The pre-restructure coverage stage: a "Coverage Build" that compiles
+   both instrumented configurations in a job of its own, and a report job
+   that reads what it produced. Kept for repositories that are not
+   wheel_only, whose build stage above is still the single looping
+   "Conan Build" and so has no instrumented jobs to take tracefiles
+   from. #>
+<# The instrumented builds, split off from the gate they used to share a job
+   with. They are a second full compile of the library -- coverage is part of
+   the package_id, so no production build can be reused for them -- and running
+   that inside the Coverage-stage job serialized it behind the entire pipeline.
+
+   `needs: []` is what actually schedules this: it starts the job the moment the
+   pipeline does, alongside "Conan Build", rather than at its stage's turn.
+   Declaring it in an earlier *stage* would not do -- every Test-stage job would
+   then wait for this compile, which is the opposite of the point.
+
+   Everything gcovr needs paths for happens here, beside the build folders that
+   produced the data: both instrumented builds, the .gcda read, and the HTML
+   render. Only rendered artifacts and small JSON cross to the gate below, so
+   nothing has to relocate the paths compiled into the .gcno. #>
+"Coverage Build":
+  stage: Coverage
+  needs: []
+  except:
+    - tags
 <% if docker_image %>
   image: << docker_image >>
 <% elif ci_xvfb %>
@@ -374,7 +785,49 @@ Coverage:
     - xmsconan_conan_setup
     - export CTEST_PARALLEL_LEVEL=${CTEST_PARALLEL_LEVEL:-8}
     - export PACKAGE_VERSION=${CI_COMMIT_TAG:-0.0.0}
-    - xmsconan_coverage --version ${PACKAGE_VERSION} build.toml
+    - xmsconan_coverage --phase collect --version ${PACKAGE_VERSION} build.toml
+  artifacts:
+    expire_in: '1d'
+<# `when: always` because the gate below has to run even when collection came
+   up short -- reporting an unmeasured layer as a failure is the whole point of
+   coverage-status.json, and it can only do that if the file survives. #>
+    when: always
+    paths:
+      - cov-cpp.xml
+      - cov-cpp-summary.json
+      - cov-py.xml
+      - cov-py-summary.json
+      - coverage-status.json
+      - coverage-html-cpp/
+      - coverage-html-py/
+
+<# Report-only: no conan, no compiler, no gcovr -- it reads the JSON the job
+   above produced and applies the [coverage] thresholds. It re-declares the
+   artifacts so `pages` keeps taking them from this job, and so the cobertura
+   report is attached to the job whose result the MR widget shows. #>
+Coverage:
+  stage: Coverage
+  needs:
+    - job: "Coverage Build"
+      artifacts: true
+<% if ci_split_tests %>
+  # Under [ci].split_tests the tests gate the pipeline from the "Run C++ Tests"
+  # jobs, so a coverage *gate* miss is advisory here. Only that exit code is
+  # forgiven. The tool failing -- an exception, the collect job leaving no
+  # summary to read -- still fails the job, because `allow_failure: true`
+  # forgave those too, and a Coverage stage reporting green while producing no
+  # report at all is how a broken coverage run survived an entire release
+  # unnoticed.
+  allow_failure:
+    exit_codes:
+      - << coverage_gate_exit_code >>
+<% endif %>
+  except:
+    - tags
+  image: python:<< coverage_python_version >>
+  script:
+    - pip install --upgrade "xmsconan>=<< xmsconan_version >>" -i https://public.aquapi.aquaveo.com/aquaveo/dev/+simple
+    - xmsconan_coverage --phase report build.toml
   artifacts:
     reports:
       coverage_report:
@@ -383,14 +836,26 @@ Coverage:
     paths:
       - cov-cpp.xml
       - cov-py.xml
-      - coverage-html-cpp/
-      - coverage-html-py/
-  coverage: '/TOTAL.*\s+(\d+%)/'
+<# The rendered HTML deliberately stays on "Coverage Build" rather than being
+   re-uploaded here. `needs: artifacts: true` already hands this job the whole
+   tree, so listing it again would store a second copy of every gcovr detail
+   page and spend the upload in a job that otherwise runs for seconds. `pages`
+   takes it from where it was produced. #>
+<# Printed by the report phase, not gcovr: gcovr's own --txt TOTAL is written
+   in the collect job, whose log GitLab does not scrape for the pipeline
+   number. An unmeasured C++ layer prints "n/a" and matches nothing here, so it
+   cannot publish a percentage that looks like a real measurement. #>
+  coverage: '/Coverage total: (\d+\.?\d*%)/'
 
 pages:
   stage: Pages
+<# "Coverage Build" is where the HTML is rendered, so take it from there. It
+   also means the report publishes on a gate miss: the run you most want to
+   read is the one that failed its threshold. `pages` still waits for the whole
+   Coverage stage either way -- stage ordering, not this dependency, is what
+   sequences them. #>
   dependencies:
-    - Coverage
+    - "Coverage Build"
   script:
     - mkdir -p public
     - cp -r coverage-html-cpp public/cpp
@@ -414,3 +879,4 @@ pages:
     - master
     - main
 <% endif %>
+<% endif %>
diff --git a/xmsconan/generator_tools/templates/CMakeLists.txt.jinja b/xmsconan/generator_tools/templates/CMakeLists.txt.jinja
index 7916c18..3aa0ee2 100644
--- a/xmsconan/generator_tools/templates/CMakeLists.txt.jinja
+++ b/xmsconan/generator_tools/templates/CMakeLists.txt.jinja
@@ -40,7 +40,9 @@ else ()
     set(CMAKE_POSITION_INDEPENDENT_CODE True)
 endif ()
 
-if (XMS_COVERAGE OR (DEFINED ENV{XMS_COVERAGE} AND NOT "$ENV{XMS_COVERAGE}" STREQUAL ""))
+# Set by the conan recipe when its `coverage` option is True — the option is
+# the only driver, so instrumentation always travels with the package_id.
+if (XMS_COVERAGE)
     if (MSVC)
         message(FATAL_ERROR "XMS_COVERAGE is GCC/Clang only")
     endif ()
diff --git a/xmsconan/package_tools/packager.py b/xmsconan/package_tools/packager.py
index 76b3aaf..8876459 100644
--- a/xmsconan/package_tools/packager.py
+++ b/xmsconan/package_tools/packager.py
@@ -81,7 +81,6 @@ class ProfilePlan(NamedTuple):
     'RELEASE_PYTHON',
     'MACOSX_DEPLOYMENT_TARGET',
     '_PYTHON_HOST_PLATFORM',
-    'XMS_COVERAGE',
     'XMS_TEST_ARTIFACTS_DIR',
 })
 
@@ -172,6 +171,7 @@ def _collect_setting_values():
     'pybind': None,          # bool
     'testing': None,         # bool
     'python_version': None,  # "X.Y" string
+    'coverage': None,        # bool; emitted only on coverage runs
 }
 FILTER_OPTION_KEYS = frozenset(FILTER_OPTION_VALUES)
 
@@ -214,11 +214,19 @@ def _validate_option(option_key, value):
             raise ValueError(
                 f"Filter option {option_key!r} must be one of {sorted(allowed)}, got {value!r}."
             )
-    elif option_key in ('pybind', 'testing'):
+    elif option_key in ('pybind', 'testing', 'coverage'):
         if not isinstance(value, bool):
             raise ValueError(
                 f"Filter option {option_key!r} must be true or false, got {value!r}."
             )
+        if option_key == 'coverage' and value is False:
+            # Coverage runs emit coverage=True and normal runs omit the
+            # option entirely, so false can never match a configuration.
+            raise ValueError(
+                "Filter option 'coverage' can only be true: coverage runs "
+                "emit coverage=True and normal runs omit the option, so "
+                "false would match nothing. Drop the pin instead."
+            )
     elif not isinstance(value, str) or not PYTHON_VERSION_RE.match(value):
         raise ValueError(
             f"Filter option {option_key!r} must be a quoted \"X.Y\" version "
@@ -312,8 +320,10 @@ def _reference_matrix(platform_name, python_versions=None, coverage=False, matri
 
     Coverage defaults to off so the matrix a filter is checked against does not
     depend on whether ``XMS_COVERAGE`` happens to be set in the environment
-    doing the generating; ``emitted_buildenv_keys`` turns it on because that
-    mode contributes a ``[buildenv]`` name of its own.
+    doing the generating. (Coverage mode now contributes the ``coverage``
+    *option* rather than a ``[buildenv]`` name; ``emitted_buildenv_keys``
+    still passes ``coverage=True`` so the derived key set tracks whatever a
+    coverage run emits.)
 
     ``python_versions`` gets the same env-independence, and for the same reason:
     passing None reaches ``_resolve_python_versions``, which falls back to
@@ -360,6 +370,120 @@ def emitted_buildenv_keys():
     return frozenset(keys)
 
 
+def config_label(combination):
+    """Return a human-readable label for a build configuration.
+
+    The label has to be *unique across the generated matrix*: it names the
+    per-configuration log file (``run(log_dir=...)``) and the test-artifact
+    directory (``XMS_TEST_ARTIFACTS_LABEL``), both of which are overwritten
+    when two configurations share a label. ``compiler.runtime`` is therefore
+    part of the label — the msvc matrices fan out over ``dynamic``/``static``,
+    so without it 14 msvc configurations collapse onto 8 labels and each static
+    build destroys the dynamic build's log. Toolchains that don't set
+    ``compiler.runtime`` (gcc, apple-clang) are unaffected and keep their
+    shorter labels.
+
+    Module-level rather than a method because the CI generator has to name the
+    same directories the build will write: ``summarize_filter_matches`` reports
+    the testing labels a platform stages, and the generated GitLab test jobs
+    pass them to ``xmsconan_test_shards --label``. Any second implementation of
+    this naming — a template concatenating ``<build_type>-testing``, say —
+    would be a copy free to drift from the one the build actually uses.
+    """
+    parts = [combination.get('build_type', 'unknown')]
+    runtime = combination.get('compiler.runtime')
+    if runtime:
+        parts.append(str(runtime))
+    opts = combination.get('options', {})
+    if opts.get('testing'):
+        parts.append('testing')
+    elif opts.get('pybind'):
+        py_version = opts.get('python_version')
+        parts.append(f'pybind-py{py_version}' if py_version else 'pybind')
+    if opts.get('wchar_t') == 'typedef':
+        parts.append('wchar_typedef')
+    return '-'.join(parts)
+
+
+#: Build types whose testing configuration carries C++ instrumentation on a
+#: coverage run. Every other testing leg stays optimized so it exercises what
+#: ships rather than an instrumented copy of it.
+COVERAGE_TESTING_BUILD_TYPES = ('Debug',)
+
+#: The build type whose pybind configuration the Python coverage leg reads.
+#: ``[matrix].pybind_build_types`` may name more than one -- a library whose
+#: consumers link a Debug module names both -- but the coverage run builds and
+#: measures exactly one of them, so the others must not be instrumented: they
+#: would compile a second instrumented module nothing reads, and write their
+#: status and tracefile under the same per-leg names as the one that is read.
+#: Shared with :func:`xmsconan.coverage_tools.coverage_generator._coverage_legs`,
+#: which pins the leg's filter, so the CI planner and the coverage run cannot
+#: disagree about which pybind build type is the measured one.
+COVERAGE_PYBIND_BUILD_TYPE = 'Release'
+
+
+def is_instrumented_configuration(combination) -> bool:
+    """Whether a configuration is compiled with coverage instrumentation.
+
+    Only the configurations coverage actually reads data from are instrumented,
+    so a coverage run still produces one optimized testing leg. Pybind is
+    always instrumented: the binding layer is C++ that only a Python test can
+    reach, so without its own .gcda it is not counted at all. The Debug testing
+    leg is instrumented because that is what drives C++ coverage. The Release
+    testing leg is not -- it exists to exercise the configuration the shipped
+    wheel is built from, and instrumenting it would leave nothing running
+    optimized code.
+
+    Module-level rather than a method for the same reason as
+    :func:`config_label`: the CI generator has to decide which *build jobs* are
+    instrumented, and it must reach that verdict through the rule the packager
+    actually applies. A second implementation in a template -- "Debug means
+    instrumented", say -- would be a copy free to drift from this one, and the
+    drift would show up as a job that compiles without coverage and then
+    reports 0% for the layer it was supposed to measure.
+
+    Args:
+        combination: One configuration from the fan-out, before its options are
+            serialized into a profile.
+
+    Returns:
+        True when this configuration should carry ``coverage=True``.
+    """
+    options = combination['options']
+    if options.get('pybind'):
+        return True
+    return bool(options.get('testing')) and (
+        combination['build_type'] in COVERAGE_TESTING_BUILD_TYPES)
+
+
+def filter_matches(platform_name, filter_dict, python_versions=None, matrix=None):
+    """Return one platform's configurations that survive a filter.
+
+    The configurations themselves, not a count of them.
+    :func:`summarize_filter_matches` answers "how many, and of what kind",
+    which is all the GitHub matrix needs; the GitLab generator emits one build
+    *job* per surviving configuration and so needs each one's build type,
+    options and Python version to write its ``build.py --filter`` argument.
+
+    Args:
+        platform_name: A key of ``configurations`` -- ``linux``, ``darwin`` or
+            ``windows``.
+        filter_dict: A filter already through ``validate_filter_dict``.
+        python_versions: Python versions the pybind fan-out should assume.
+            Defaults to the packager's own resolution.
+        matrix: The ``[matrix]`` table, so the filter is checked against the
+            configurations this library actually produces.
+
+    Returns:
+        The surviving configurations, in matrix order.
+    """
+    return [
+        configuration
+        for configuration in _reference_matrix(platform_name, python_versions, matrix=matrix)
+        if _configuration_matches(configuration, filter_dict)
+    ]
+
+
 def summarize_filter_matches(filter_dict, python_versions=None, matrix=None):
     """Report what a filter would keep on each platform.
 
@@ -376,19 +500,26 @@ def summarize_filter_matches(filter_dict, python_versions=None, matrix=None):
             unnarrowed fan-out.
 
     Returns:
-        ``{platform: {'total': int, 'pybind': int}}`` — the number of surviving
-        configurations, and how many of those build the Python bindings.
+        ``{platform: {'total': int, 'pybind': int, 'testing_labels': [str]}}``
+        — the number of surviving configurations, how many of those build the
+        Python bindings, and the :func:`config_label` of each surviving
+        *testing* configuration, in matrix order.
+
+        ``testing_labels`` is what the generated CI needs and neither count can
+        supply: ``total`` includes the pybind and plain-library configurations,
+        so a filter can leave a build type with configurations but no test
+        runner to stage. The labels name the ``test_artifacts/<label>/``
+        directories the build will actually write.
     """
     summary = {}
     for platform_name in configurations:
-        kept = [
-            configuration
-            for configuration in _reference_matrix(platform_name, python_versions, matrix=matrix)
-            if _configuration_matches(configuration, filter_dict)
-        ]
+        kept = filter_matches(platform_name, filter_dict, python_versions, matrix)
         summary[platform_name] = {
             'total': len(kept),
             'pybind': sum(1 for c in kept if c['options'].get('pybind')),
+            'testing_labels': [
+                config_label(c) for c in kept if c['options'].get('testing')
+            ],
         }
     return summary
 
@@ -396,7 +527,14 @@ def summarize_filter_matches(filter_dict, python_versions=None, matrix=None):
 class XmsConanPackager(object):
     """The packager class."""
 
-    SHARD_TIMEOUT = 600  # seconds per shard (10 minutes)
+    #: Seconds a single shard may run before it is killed. 20 minutes, raised
+    #: from the original 10: xmsvtk's slowest shard takes 497s on an idle
+    #: runner, so the old ceiling left 21% headroom and a runner busy with a
+    #: second pipeline pushed every shard past it. A killed shard reports as
+    #: "0 failed, N errored", which reads like a test failure but is a
+    #: stopwatch, so the ceiling should be far enough away that crossing it
+    #: means a hang rather than a slow day.
+    SHARD_TIMEOUT = 1200
 
     def __init__(
         self,
@@ -443,9 +581,10 @@ def __init__(
                 or to ``DEFAULT_PYTHON_VERSIONS``. Each pybind variant is
                 duplicated per version with the matching ``python_version``
                 Conan option and ``PYTHON_TARGET_VERSION`` buildenv set.
-            coverage: If True, exports ``XMS_COVERAGE=1`` into every profile's
-                ``[buildenv]`` so CMake adds ``--coverage -O0 -g``. It does not
-                change which configurations are produced: the testing-only
+            coverage: If True, sets the recipe's ``coverage=True`` option on
+                every configuration, so CMake adds ``--coverage -O0 -g`` and
+                the instrumented builds carry their own package_id. It does
+                not change which configurations are produced: the testing-only
                 Debug variant that drives C++ coverage is always emitted, and
                 the Python half of coverage uses whatever pybind configuration
                 ``[matrix]`` already names. Pybind profiles are instrumented
@@ -893,17 +1032,6 @@ def generate_configurations(self, system_platform=None):
             if self._artifacts_dir:
                 combination['buildenv']['XMS_TEST_ARTIFACTS_DIR'] = self._artifacts_dir
 
-            # XMS_COVERAGE has to ride into the profile's [buildenv] so the
-            # conan activation script exports it for the CMake child process.
-            # Without this, the recipe's Python-side `configure()` still sees
-            # XMS_COVERAGE (it inherits the parent env), but CMake's
-            # `if (DEFINED ENV{XMS_COVERAGE})` guard runs in an activated
-            # buildenv subshell that only sees [buildenv] vars — so
-            # `--coverage` is never added, no .gcno files are produced, and
-            # gcovr reports 0% (see issue #69).
-            if self._coverage:
-                combination['buildenv']['XMS_COVERAGE'] = '1'
-
             # Set macOS deployment target for consistent wheel builds
             if combination.get('os') == 'Macos':
                 combination['buildenv']['MACOSX_DEPLOYMENT_TARGET'] = '15.0'
@@ -932,6 +1060,29 @@ def generate_configurations(self, system_platform=None):
             wchar_t_updated_builds = self._wchar_t_variants(combinations)
             combinations = combinations + wchar_t_updated_builds + pybind_updated_builds + testing_updated_builds
 
+        # Coverage rides on the recipe's `coverage` *option*, not on
+        # [buildenv], so an instrumented build carries its own package_id and
+        # can never satisfy --build=missing for a production build (or vice
+        # versa). The recipe forwards the option to CMake as -DXMS_COVERAGE,
+        # which also retires the [buildenv] ride-along that issue #69 needed
+        # for env propagation.
+        #
+        # This runs here rather than in the loop above because the pybind and
+        # testing options that select a leg are only set by the variant
+        # helpers -- inside the loop every configuration still carries the
+        # reset defaults, so nothing would ever match.
+        #
+        # Instrumentation is per configuration, not blanket. The Debug testing
+        # leg and the pybind leg between them reach every line anyone
+        # measures -- the binding layer is only compiled in the latter --
+        # while the Release testing leg stays optimized on purpose: it exists
+        # to exercise the configuration the shipped wheel is built from, and
+        # an instrumented copy of it would prove nothing about what ships.
+        if self._coverage:
+            for combination in combinations:
+                if is_instrumented_configuration(combination):
+                    combination['options']['coverage'] = True
+
         self._configurations = combinations
         return combinations
 
@@ -1069,29 +1220,10 @@ def filter_configurations(self, filter_dict):
     def _config_label(self, combination):
         """Return a human-readable label for a build configuration.
 
-        The label has to be *unique across the generated matrix*: it names the
-        per-configuration log file (``run(log_dir=...)``) and the test-artifact
-        directory (``XMS_TEST_ARTIFACTS_LABEL``), both of which are overwritten
-        when two configurations share a label. ``compiler.runtime`` is
-        therefore part of the label — the msvc matrices fan out over
-        ``dynamic``/``static``, so without it 14 msvc configurations collapse
-        onto 8 labels and each static build destroys the dynamic build's log.
-        Toolchains that don't set ``compiler.runtime`` (gcc, apple-clang) are
-        unaffected and keep their shorter labels.
+        Thin delegate to the module-level :func:`config_label`; see there for
+        what the label has to guarantee.
         """
-        parts = [combination.get('build_type', 'unknown')]
-        runtime = combination.get('compiler.runtime')
-        if runtime:
-            parts.append(str(runtime))
-        opts = combination.get('options', {})
-        if opts.get('testing'):
-            parts.append('testing')
-        elif opts.get('pybind'):
-            py_version = opts.get('python_version')
-            parts.append(f'pybind-py{py_version}' if py_version else 'pybind')
-        if opts.get('wchar_t') == 'typedef':
-            parts.append('wchar_typedef')
-        return '-'.join(parts)
+        return config_label(combination)
 
     def run(self, log_dir=None):
         """Run the build process.
@@ -1845,6 +1977,15 @@ def plan_cmake_presets(self, system_platform=None):
                     # invoked from.
                     'CMAKE_INSTALL_PREFIX': '${sourceDir}/_install',
                 }
+                # Raw `cmake --preset` builds never run the recipe's build(),
+                # so the coverage option cannot reach them; the regenerated
+                # preset carries the flag instead of the retired
+                # $ENV{XMS_COVERAGE} fallback in CMakeLists.txt. Written in
+                # BOTH modes: a CMake cache variable persists across
+                # reconfigures, so omitting the key after a coverage run
+                # would leave a previously-instrumented build dir
+                # instrumented — the explicit "0" overwrites the stale entry.
+                cache_variables['XMS_COVERAGE'] = '1' if self._coverage else '0'
                 if not multi_config:
                     cache_variables['CMAKE_BUILD_TYPE'] = build_type
                 preset = {
diff --git a/xmsconan/xms_conan2_file.py b/xmsconan/xms_conan2_file.py
index 81e1653..09f5e5b 100644
--- a/xmsconan/xms_conan2_file.py
+++ b/xmsconan/xms_conan2_file.py
@@ -38,6 +38,10 @@ class XmsConan2File(ConanFile):
         "pybind": [True, False],
         "testing": [True, False],
         "python_version": ["3.10", "3.13", "3.14"],
+        # Coverage instrumentation is part of package identity: an instrumented
+        # (-O0 -g --coverage) binary must never satisfy --build=missing for a
+        # production build, or vice versa. See package_id().
+        "coverage": [True, False],
     }
     xms_dependencies = []
     # Non-XMS Conan deps, "name/version". Deduplicated by package name against
@@ -53,7 +57,7 @@ class XmsConan2File(ConanFile):
     testing_framework = "cxxtest"  # One of TESTING_FRAMEWORKS
     python_binding_type = "pybind11"  # One of PYTHON_BINDING_TYPES
     # Submodule under xms.<...> (e.g. "core"). Set by the generated subclass; required
-    # when XMS_COVERAGE=1 so pytest-cov scopes to xms.<python_namespaced_dir>.
+    # when coverage=True so pytest-cov scopes to xms.<python_namespaced_dir>.
     python_namespaced_dir = None
     # Opt in to advertising the pybind module's import library (_<name>) to C++
     # consumers instead of the static library. Windows-only by construction: a
@@ -130,6 +134,7 @@ class XmsConan2File(ConanFile):
         'pybind': False,
         'testing': False,
         'python_version': '3.13',
+        'coverage': False,
     }
 
     def _is_vs2019(self):
@@ -287,14 +292,18 @@ def requirements(self):
 
     def configure(self):
         """The configure method."""
-        # Fail fast at configure time when XMS_COVERAGE is requested but the
-        # recipe does not name a python_namespaced_dir for pytest-cov to
+        # Fail fast at configure time when Python coverage is requested but
+        # the recipe does not name a python_namespaced_dir for pytest-cov to
         # target. Surfacing this before the build avoids burning a full
-        # instrumented build only to abort deep in run_python_tests.
-        if os.environ.get("XMS_COVERAGE") and not self.python_namespaced_dir:
+        # instrumented build only to abort deep in run_python_tests. The
+        # C++-only legs (pybind=False) never run pytest-cov, so a
+        # hand-written pure-C++ recipe can still collect C++ coverage.
+        if self.options.coverage and self.options.pybind \
+                and not self.python_namespaced_dir:
             raise ConanException(
-                "XMS_COVERAGE=1 requires python_namespaced_dir to be set on the "
-                "recipe so pytest-cov measures only this library's namespace."
+                "coverage=True with pybind=True requires python_namespaced_dir "
+                "to be set on the recipe so pytest-cov measures only this "
+                "library's namespace."
             )
 
         self._validate_recipe_attributes()
@@ -407,9 +416,17 @@ def _propagate_dependency_options(self):
                 pass
 
     def package_id(self):
-        """Drop python_version from the package_id when not building Python bindings."""
+        """Trim option axes that do not affect the binary being identified.
+
+        python_version only matters when Python bindings are built. coverage
+        is dropped when False so uninstrumented ids stay byte-identical to
+        the ids this recipe produced before the option existed — no released
+        binary is invalidated — while coverage=True builds get their own id.
+        """
         if not self.info.options.pybind:
             del self.info.options.python_version
+        if not self.info.options.coverage:
+            del self.info.options.coverage
 
     # CMake refuses to reuse a binary directory configured by a different
     # generator ("Does not match the generator used previously"), so a Ninja
@@ -583,22 +600,36 @@ def build(self):
 
         variables = self._cmake_variables()
 
-        # Propagate XMS_COVERAGE as an explicit CMake -D variable when the
-        # operator set it in the parent env (e.g., xmsconan_coverage). The
-        # recipe's `configure()` already sees XMS_COVERAGE via os.environ
-        # because it runs in the same process as conan-create, but CMake
-        # is a child subprocess. Conan 2's `cmake.configure()` only
-        # exports vars from the profile's [buildenv] when a
-        # `VirtualBuildEnv` generator was declared in `generate()`, which
-        # this recipe does not — so the env-based check in
-        # CMakeLists.txt.jinja was silently false even when XMS_COVERAGE
-        # was set in [buildenv]. Passing it as a -D var bypasses every
-        # layer of env-propagation uncertainty.
-        # Deliberately not in _cmake_variables(): this one belongs to the
-        # configure step alone. Adding it to the toolchain as well would bake
-        # an instrumented build into a cached toolchain file.
-        if os.environ.get("XMS_COVERAGE"):
+        # Instrumentation is driven by the coverage *option* so it is part of
+        # the package_id — the env-var era let an instrumented and a
+        # production build share one id, and --build=missing could hand back
+        # the wrong binary (gcovr then reported near-zero coverage with no
+        # error). CMake is a child subprocess, so pass the option as an
+        # explicit -D variable; env propagation through [buildenv] was
+        # unreliable here (see issue #69) and is no longer used.
+        # Deliberately not in _cmake_variables(): generate() writes the
+        # toolchain file, and this belongs to the configure step alone. The
+        # -D value persists in CMakeCache.txt just as a toolchain entry
+        # would; what keeps that safe is that the option is part of the
+        # package_id, so conan gives the instrumented build its own build
+        # folder and the cached value can never leak into a production one.
+        if self.options.coverage:
             variables["XMS_COVERAGE"] = "1"
+            # An instrumented build is the one shape that still runs its suite
+            # through ctest. Everything else reaches the runner through
+            # xmsconan_test_shards, which supplies its own concurrency and is
+            # why the default registration is a single whole-binary entry --
+            # but ctest cannot parallelize one entry, so the coverage job's
+            # CTEST_PARALLEL_LEVEL had nothing to act on and the suite ran
+            # serially. Per-case entries hand it something to schedule.
+            #
+            # The spawn cost the single entry exists to avoid is real, and
+            # paid here on purpose: measured against this suite, per-case
+            # ctest -j8 ran the instrumented suite in 303.5s where the single
+            # serial entry took 1438s. The concurrent .gcda merging that
+            # implies is libgcov's own, and that run recorded no merge or
+            # overwrite warnings.
+            variables["XMS_GTEST_DISCOVER_TESTS"] = "ON"
 
         cmake.configure(variables=variables)
         cmake.build()
@@ -918,7 +949,7 @@ def run_python_tests(self):
         build_venv_dir = os.path.join(self.build_folder, "venv")
         tests_dest_dir = os.path.join(self.build_folder, "tests")
         python_target_version = str(self.options.python_version)
-        coverage_enabled = bool(os.environ.get("XMS_COVERAGE"))
+        coverage_enabled = bool(self.options.coverage)
 
         if sys.platform == "win32":
             python_executable = os.path.join(build_venv_dir, "Scripts", "python.exe")
@@ -983,7 +1014,7 @@ def run_python_tests(self):
         if coverage_enabled:
             if not self.python_namespaced_dir:
                 raise ConanException(
-                    "XMS_COVERAGE=1 requires python_namespaced_dir to be set on the "
+                    "coverage=True requires python_namespaced_dir to be set on the "
                     "recipe so pytest-cov measures only this library's namespace."
                 )
             cov_target = f"xms.{self.python_namespaced_dir}"