@@ -92,33 +92,28 @@ specs. They remain enabled by default upstream. Consumers whose deployed stack
 does not yet support these endpoints can exclude them with `!ModelDiscovery`.
 
 `StandardK8sOnly` cuts across the other two. It marks specs that require a
-standard Kubernetes cluster and cannot run on an opinionated managed one such as
-AKS Automatic: they reshape running workloads
-directly rather than going through the `Deployer` — `ScaleDeployment` on a
-Deployment's scale subresource ([`utils/cluster.go`](utils/cluster.go)) or
-`SetInferenceSetReplicas` patching an InferenceSet
-([`utils/scaling.go`](utils/scaling.go)) — or their assertion only holds under a
-`ModelDeploymentValues` field a managed backend cannot express, or they scrape
-metrics through `pods/proxy`, directly or via the helpers in
-[`utils/metrics.go`](utils/metrics.go). When running against a managed cluster:
+standard Kubernetes cluster and cannot run on a managed control plane such as
+AKS AI Manager, even with cluster-admin access: they need a setting a managed
+backend cannot express (a manual replica count of 0, an exact-origin CORS
+allowlist), or they have not been verified on a managed control plane yet.
+Scaling shared Deployments through the scale subresource
+([`utils/cluster.go`](utils/cluster.go)), patching an InferenceSet's replicas
+([`utils/scaling.go`](utils/scaling.go)), `kubectl exec` into the Gateway, and
+scraping metrics through `pods/proxy` ([`utils/metrics.go`](utils/metrics.go))
+do not need it. When running against a managed cluster:
 
 ```bash
 E2E_LABEL='!StandardK8sOnly' make test-e2e
 ```
 
-It currently covers `bbr_outage`, `ext_authz_outage`, `epp_outage`,
-`cluster_filter_ha`, `cluster_status`, `control_plane_error`,
-`model_download_slow`, `scaling`, `scale_to_zero`, and the
-`Load distribution` Context of `model_routing` (which turns prefix-cache scoring
-off through `EPPScorerWeights` so identical prompts spread across replicas).
-It also covers `prefix_cache_routing`, `prefix_cache_perf`, the cross-model
-isolation and EPP metrics Contexts and backend 4xx counter assertion in
-`model_routing`, and the full-chain counter assertions in `filter_order`.
+It currently covers `model_unavailable`, the exact-origin `Browser CORS` Context
+of `apikey_auth`, and the two cloud provisioning-failure cases of
+`control_plane_error`.
 Label the smallest container that needs it, not the whole file: routing and
 filter-order specs that do not require these mechanisms stay runnable everywhere.
-Note it describes the MECHANISM, not the blast radius: `model_unavailable`
-empties an inference pool too, but does so through `UpgradeModelDeployment`, so
-any backend can honour it and it stays unlabelled.
+Note it describes the MECHANISM, not the blast radius: a disruptive spec stays
+unlabelled when a managed backend can honour it, such as the scaling specs that
+park a deployment at zero through autoscaling.
 
 
 ### Bring up a cluster from scratch
@@ -271,7 +266,7 @@ Conventions worth knowing when writing a spec:
   errors. `WaitForDeploymentReplicas` accepts at least the requested ready count,
   except zero, which waits for scale-down convergence. `DeploymentReplicaGuard`
   captures the original count and provides exact `ScaleAndWait` and repeatable
-  `Restore` operations for `StandardK8sOnly` fault-injection specs.
+  `Restore` operations for fault-injection specs.
   Register case teardown and restoration independently in `BeforeAll`, with
   restoration registered last so it runs first after the Ordered container.
   Keep outage attribution, labels, and recovery assertions visible in each spec.
 
@@ -175,7 +175,11 @@ var _ = Describe("API Key Authentication", Ordered, utils.GinkgoLabelAuth, utils
 		})
 	})
 
-	Context("Browser CORS", utils.GinkgoLabelCORS, func() {
+	// Exact-origin CORS needs the modelharness allowlist configured per
+	// namespace. AKS AI Manager installs the harness with the chart's wildcard
+	// default and has no setting for it, hence StandardK8sOnly; the wildcard
+	// Context below matches that default and runs everywhere.
+	Context("Browser CORS", utils.GinkgoLabelCORS, utils.GinkgoLabelStandardK8sOnly, func() {
 		const disallowedOrigin = "https://disallowed.e2e.test"
 
 		sendPreflight := func(origin, method, headers string) (*http.Response, error) {
 
@@ -55,7 +55,7 @@ import (
 // the mesh. Scaling it to zero breaks every other in-flight inference
 // request, so this suite must not run concurrently with any other spec.
 var _ = Describe("BBR outage (fail-closed cluster filter)",
-	Ordered, Serial, utils.GinkgoLabelOutage, utils.GinkgoLabelStandardK8sOnly, func() {
+	Ordered, Serial, utils.GinkgoLabelOutage, func() {
 
 		const bbrDeploymentName = "body-based-router"
 
 
@@ -49,7 +49,7 @@ import (
 //	so that the loss of ONE replica is a transparent failover and the
 //	fail-closed `502` path only fires when ALL replicas are down.
 //
-//	This suite perturbs the shared kaito-system BBR Deployment, so it is
+//	This suite perturbs the shared BBR Deployment, so it is
 //	decorated Serial — no other spec may run while BBR is degraded.
 //
 // Scope note: the structured `502 bbr_unavailable` envelope (+
@@ -59,8 +59,7 @@ import (
 // It is intentionally NOT asserted here; the all-replicas-down case below
 // asserts only that the request fails closed (5xx, never a silent 404).
 var _ = Describe("BBR cluster-filter HA",
-	Ordered, Serial, utils.GinkgoLabelOutage, utils.GinkgoLabelSmoke,
-	utils.GinkgoLabelStandardK8sOnly, func() {
+	Ordered, Serial, utils.GinkgoLabelOutage, utils.GinkgoLabelSmoke, func() {
 
 		const (
 			bbrDeployment = "body-based-router"
 
@@ -36,7 +36,7 @@ import (
 // These perturb cluster-wide singletons every other namespace shares, so the
 // suite is decorated Serial.
 var _ = Describe("Cluster Status Reporter",
-	Serial, utils.GinkgoLabelStatusReporter, utils.GinkgoLabelNoGPU, utils.GinkgoLabelStandardK8sOnly, func() {
+	Serial, utils.GinkgoLabelStatusReporter, utils.GinkgoLabelNoGPU, func() {
 
 		const (
 			// Allow a couple of resyncs plus startup grace and rollout slack.
 
@@ -51,7 +51,7 @@ import (
 //     gpu-node-mocker fakes provisioning — and the az CLI to confirm the
 //     precondition, and skip otherwise.
 var _ = Describe("Control-plane Error Reporter",
-	utils.GinkgoLabelStatusReporter, utils.GinkgoLabelNoGPU, utils.GinkgoLabelStandardK8sOnly, func() {
+	utils.GinkgoLabelStatusReporter, utils.GinkgoLabelNoGPU, func() {
 
 		const (
 			setupTimeout     = 3 * time.Minute
@@ -176,7 +176,7 @@ var _ = Describe("Control-plane Error Reporter",
 			Expect(found).To(BeFalse(), "a missing EPP Deployment must not be reported")
 		})
 
-		It("passes through the terminal provisioning failure of an instance type without quota", func() {
+		It("passes through the terminal provisioning failure of an instance type without quota", utils.GinkgoLabelStandardK8sOnly, func() {
 			requireRealProvisioner()
 			instanceType := envOr(envZeroQuotaInstanceType, "Standard_NV36ads_A10_v5")
 			family := envOr(envZeroQuotaFamily, "StandardNVADSA10v5Family")
@@ -216,7 +216,7 @@ var _ = Describe("Control-plane Error Reporter",
 			expectPassThrough(kaitoReason, isName, emitTimeout)
 		})
 
-		It("passes through an AsyncProvisioningError for an instance type the subscription cannot use", func() {
+		It("passes through an AsyncProvisioningError for an instance type the subscription cannot use", utils.GinkgoLabelStandardK8sOnly, func() {
 			requireRealProvisioner()
 			region, err := utils.ClusterRegion(ctx)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -57,8 +57,7 @@ import (
 // namespace's request path, not any cluster-wide singleton, so the suite
 // is safe to run alongside other (non-overlapping) specs.
 var _ = Describe("EPP outage (fail-closed InferencePool ext_proc)",
-	Ordered, utils.GinkgoLabelOutage, utils.GinkgoLabelNightly,
-	utils.GinkgoLabelStandardK8sOnly, func() {
+	Ordered, utils.GinkgoLabelOutage, utils.GinkgoLabelNightly, func() {
 
 		var (
 			ctx         context.Context
 
@@ -60,8 +60,7 @@ import (
 // authenticated request, so this suite must not run concurrently with any
 // other spec.
 var _ = Describe("ext_authz outage (fail-closed cluster filter)",
-	Ordered, Serial, utils.GinkgoLabelOutage, utils.GinkgoLabelAuth,
-	utils.GinkgoLabelStandardK8sOnly, func() {
+	Ordered, Serial, utils.GinkgoLabelOutage, utils.GinkgoLabelAuth, func() {
 
 		const authDeploymentName = "apikey-authz"
 
 
@@ -197,7 +197,7 @@ var _ = Describe("Filter execution order",
 		// actually deliver requests to the workload pod (vLLM).
 		// ─────────────────────────────────────────────────────────────────
 
-		Context("P0: bbr precedes EPP, full chain delivers traffic", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("P0: bbr precedes EPP, full chain delivers traffic", func() {
 
 			// B2 — Send N valid authenticated requests, then assert that
 			// vLLM's `vllm:request_success_total{model_name=<modelName>}`
@@ -281,13 +281,8 @@ var _ = Describe("Filter execution order",
 			// of the five filters we care about. This is the strongest
 			// possible assertion because it does not depend on any business
 			// request behaviour: it checks the rendered xDS config itself.
-			//
-			// Reaching the admin port means `kubectl exec` into the gateway
-			// pod, which a managed control plane does not allow — hence
-			// StandardK8sOnly. Every other spec here asserts the same
-			// ordering through request behaviour and stays runnable.
 			It("F1: HCM filter order is CORS → ext_authz → bbr → ext_proc → router",
-				utils.GinkgoLabelStandardK8sOnly, func() {
+				func() {
 					gwPod, err := firstRunningPod(ctx, caseNS, gatewayLabel)
 					Expect(err).NotTo(HaveOccurred(),
 						"per-namespace Gateway pod should be Running")
 
@@ -87,7 +87,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 
 	Context("InferenceSet and InferencePool lifecycle", utils.GinkgoLabelInfra, func() {
 
-		Context("InferenceSet lifecycle", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("InferenceSet lifecycle", func() {
 			It("should have EPP pods running for each InferencePool", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())
@@ -158,7 +158,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 			})
 		})
 
-		Context("HTTPRoute status", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("HTTPRoute status", func() {
 			It("should have HTTPRoutes with Accepted=True condition for each deployment", func() {
 				dynClient, err := utils.GetDynamicClient()
 				Expect(err).NotTo(HaveOccurred())
@@ -198,7 +198,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 
 	Context("Fake node and shadow pod lifecycle", utils.GinkgoLabelInfra, func() {
 
-		Context("Fake nodes", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("Fake nodes", func() {
 			It("should have fake nodes with correct labels", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())
@@ -240,7 +240,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 			})
 		})
 
-		Context("Shadow pods", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("Shadow pods", func() {
 			It("should have shadow pods running in the shadow namespace", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())
@@ -541,7 +541,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 			})
 		})
 
-		Context("Terminating pod reaping", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("Terminating pod reaping", func() {
 			It("should force-delete a KAITO pod stuck Terminating on a fake node", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())
@@ -664,7 +664,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 
 	Context("Garbage collection", utils.GinkgoLabelInfra, func() {
 
-		Context("Fake node GC", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("Fake node GC", func() {
 			It("should delete orphaned fake nodes and leases when the NodeClaim is removed", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())
@@ -749,7 +749,7 @@ var _ = Describe("GPU Mocker E2E", Ordered, func() {
 			})
 		})
 
-		Context("Shadow pod GC", utils.GinkgoLabelStandardK8sOnly, func() {
+		Context("Shadow pod GC", func() {
 			It("should delete shadow pods via native Kubernetes GC when the original pod is removed", func() {
 				clientset, err := utils.GetK8sClientset()
 				Expect(err).NotTo(HaveOccurred())