diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7202542..c7606427 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- process(testing): **each project now picks its test strategy with the developer at CAC-5, and per change the default is the gate plus the affected unit tests and journeys only; the full e2e and the full unit suite run at deploy-ready.** New `project-bin/affected-tests.sh <script.mdl>` computes the subject set `testing-shape.md` §3 only described: the elements the script writes (new `exec.sh --subjects`), their transitive callers from ONE batched `SHOW CALLERS OF ... TRANSITIVE` call (pages included on mxcli v0.26.0), then the `.test.mdl` files and `journeys/<Module>.journey.json` files they owe, scoped by the PROJECT.md `## Test strategy` row (`none`/`affected`/`module`/`full`, defaults when absent). It prints run lines, never runs a model-writing test, and says "callers NOT MEASURED" when it has no model. `exec.sh` now prints and logs per-step seconds (`steps: guards check snapshot baseline exec gate lint score`). testing-shape.md, iterative-build-loop.md, existing-app-change.md and conversion-runbook.md drop "the full suite at module close" for "the module's tests at module close, everything at deploy-ready"; baseline words net lower. Field run: a five-app lab project (Mendix 11.15, mxcli v0.26.0), where one exec is 28 to 41 s and a full `mxcli test` about 6 min; three of its real change scripts selected 0 to 1 of 20 journey files each (first call 19 s, later 3 s). Golden callers output captured from mxcli v0.26.0 on a scratch copy of an empty 11.12 app (`tests/wave2/fixtures/affected-tests/CAPTURE.txt`) — the maintainer's decision, 2026-10-16
 - fix(install-manifest): **a clean toolkit checkout passes its own `project-bin/` manifest self-check, so adopters no longer see the "named by NEITHER list" warning at the top of every sync.** `coverage-check-all.sh` (found by `review-module.sh` through its `_tool` lookup in the toolkit clone) and `ts-sync.sh` (UNPROVEN and SUPERSEDED per its header) join `MXTK_PROJECT_BIN_NOINSTALL` with reasons. New `tests/wave2/test-manifest-clean-checkout.sh` fails, rather than warns, when a `project-bin/` file is in neither list. — joshuamoesa (#381)
 - fix(sync-project): **the "Baseline-only skills cited" warning no longer fires on the toolkit's own wiring block, and no longer sizes a section that does not exist.** The check grepped all of `CLAUDE.md` for `skills/learned-mdl-preflight.md` / `skills/query-the-model.md`, and `wire-agents.sh`'s `mxtk:wiring` block cites the first, so every sync flagged the toolkit's own text; with no "mxcli-project-toolkit Integration" heading it then printed a whole-file word count as "heading to EOF". The wiring block is now stripped before the grep, and the warning is raised only when the heading exists. `tests/wave2/test-sync-dup-heading-exit.sh` T4 flips (no heading: no warning) and gains T7-T9. — joshuamoesa (#382)
 - learn(workflow, rest): **the v0.20-era workflow notes are marked superseded for mxcli v0.26.0:** `WAIT FOR NOTIFICATION` takes a name, `NOTIFY WORKFLOW` needs `TARGET Module.Workflow.Element` (CE0166 / MDL-WF16 without), mxcli writes the end-of-boundary-path marker itself so a boundary terminator is no longer a hand-add (the parallel-split terminator is a separate node and unchanged), and published REST `Authentication: (basic)` works (BUG-152 item 1: 401 / 401 / 200 proven, URL includes the resource segment). Sources: a five-app lab field run (Mendix 11.15, mxcli v0.26.0) and mxcli's public `write-workflows` skill and docs. `wf-add-path-terminators.py` already takes an `.mpr` since #294 (the reported crash was the older script). — TK-019 of a five-app lab report
diff --git a/bin/lib/install-manifest.sh b/bin/lib/install-manifest.sh
index 13a78191..f8003662 100644
--- a/bin/lib/install-manifest.sh
+++ b/bin/lib/install-manifest.sh
@@ -115,7 +115,7 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # may run itself (stops only the pid run --local recorded for THIS project), and `mxcli test` on a
 # scratch copy under the test-port lock. exec.sh names app-restart.sh in its watch advisory, so
 # it has to be installed beside it.
-MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh"
+MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh"
 
 # Files in project-bin/ that are deliberately NOT installed into projects. The reverse check
 # below flags anything named by NEITHER list, so a new file in project-bin/ has to be either
diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
new file mode 100755
index 00000000..7fc155da
--- /dev/null
+++ b/project-bin/affected-tests.sh
@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+# affected-tests.sh: which unit tests and journeys a change owes, per the project's test strategy.
+#
+#   ./bin/affected-tests.sh [--moment change|module|deploy] [--module <M>]... [--depth N]
+#                           [--no-model] <script.mdl>...
+#
+# Prints, one row per line, tab-separated:
+#   strategy  <moment>  unit=<scope> journeys=<scope>  (<where the scope came from>)
+#   subject   <kind>    <Module.Name>   line N of <script>
+#   caller    <Module.Name>  depth N     (SHOW CALLERS OF ... TRANSITIVE)
+#   callers   measured | NOT MEASURED (<reason>)
+#   unit      <file.test.mdl>  <why>
+#   journey   <file.journey.json>  <why>
+#   run       <the command to run that selection>
+# Exit: 0 printed (an empty selection is printed as "none", never as silence) · 2 usage.
+#
+# WHY (2026-10-16). testing-shape.md §3 defined the per-change "subject set" (changed microflows
+# plus their callers, the pages the change reaches) in prose only; exec.sh printed a lane and
+# nothing computed the set. Measured in a five-app lab project (Mendix 11.15, mxcli v0.26.0):
+# one exec 28-41 s, a full mxcli test about 6 min, conformance 645 s, coverage 377 s. A change
+# that owes three tests was paying for the whole suite whenever an agent chose "to be safe".
+# The maintainer's decision: per change, gate + affected tests only; the full e2e and the full
+# unit suite run at deploy-ready, and each project picks its strategy with the developer (CAC-5).
+#
+# THE STRATEGY. PROJECT.md "## Test strategy" (skills/checkpoints/checkpoint-build.md writes it):
+#   | Moment | Unit tests | Journeys | Status |
+#   | Every change | affected | affected | CONFIRMED |
+#   | Module close | module | module | CONFIRMED |
+#   | Deploy-ready | full | full | CONFIRMED |
+# Scopes: none | affected | module | full. No section, or no row for the moment: these defaults,
+# and the strategy row says "default". --moment picks the row (change is the default).
+#
+# HOW THE SELECTION IS MADE (judgement-free facts only; skills-over-scripts.md):
+#   1. Subjects: `bin/exec.sh --subjects <script>` (the same statement lexer as the change class).
+#   2. Callers: ONE batched `mxcli -p <app>.mpr -c "SHOW CALLERS OF X TRANSITIVE; ..."` for every
+#      microflow, nanoflow, page, snippet and layout subject. Golden input: a verbatim v0.26.0
+#      capture (tests/wave2/fixtures/affected-tests/CAPTURE.txt). Transitive callers include pages
+#      (a button's CALL MICROFLOW, a SHOW PAGE) on v0.26.0. The first call builds mxcli's catalog
+#      (~40 s on a 275-flow app), later ones ~4 s. --no-model, no project mxcli, no .mpr, or output
+#      that does not parse: "callers NOT MEASURED", and the selection is the subjects alone.
+#   3. affected unit: *.test.mdl files that name a subject, or a caller at depth <= --depth
+#      (default 1: "the tests of its callers"). Module, entity, association, enumeration and
+#      access subjects select every test file that names their module (testing-shape.md §3 table).
+#   4. affected journeys: journeys/<M>.journey.json for every module M owning a subject or ANY
+#      transitive caller (a page reached at depth 4 is still a page the change reaches), plus any
+#      journey file (journeys/ or tests/e2e/) that names a subject literally.
+#   5. module: every test file naming the module, journeys/<M>.journey.json; the modules are the
+#      subjects' modules plus every --module. full: every test file, every journey file.
+# What it does NOT do: run anything. `mxcli test` writes to the model, so the run rows go through
+# bin/test-scratch.sh (a scratch copy) and the journey runner; the caller runs them.
+#
+# Producer: exec.sh prints "affected tests: ./bin/affected-tests.sh <script>" on every MDL run.
+# Overrides: JOURNEY_DIR (default journeys/), MXCLI (default the project's ./mxcli), MPR_FILE.
+# Bash 3.2 / BSD awk / Git Bash.
+set -uo pipefail
+. "$(dirname "$0")/_common.sh"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+MOMENT="change"; DEPTH=1; NO_MODEL=0; MODULES=""; SCRIPTS=""
+usage() { sed -n '2,15p' "$0" >&2; exit 2; }
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --moment) MOMENT="${2:-}"; shift 2 ;;
+    --module) MODULES="$MODULES ${2:-}"; shift 2 ;;
+    --depth)  DEPTH="${2:-}"; shift 2 ;;
+    --no-model) NO_MODEL=1; shift ;;
+    -h|--help) usage ;;
+    --*) echo "✗ unknown option $1" >&2; usage ;;
+    *) [ -f "$1" ] || { echo "✗ no such script: $1" >&2; exit 2; }
+       SCRIPTS="$SCRIPTS
+$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"; shift ;;
+  esac
+done
+case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module or deploy" >&2; exit 2 ;; esac
+case "$DEPTH" in ''|*[!0-9]*) echo "✗ --depth takes a number" >&2; exit 2 ;; esac
+SCRIPTS="$(printf '%s\n' "$SCRIPTS" | sed '/^$/d')"
+[ -n "$SCRIPTS" ] || [ "$MOMENT" != change ] || { echo "✗ a change needs at least one script" >&2; usage; }
+
+cd "$PROJECT_ROOT" || exit 2
+JDIR="${JOURNEY_DIR:-journeys}"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+out() { printf '%s\n' "$*"; }
+
+# ── Strategy row ─────────────────────────────────────────────────────────────
+case "$MOMENT" in change) ROW="Every change"; DU=affected; DJ=affected ;;
+                  module) ROW="Module close"; DU=module;   DJ=module ;;
+                  deploy) ROW="Deploy-ready"; DU=full;     DJ=full ;; esac
+U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
+if [ -f PROJECT.md ]; then
+  _row="$(awk -v r="$ROW" '
+    /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
+    on && /^\|/ { split($0, c, "|"); x = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", x)
+                  if (tolower(x) == tolower(r)) { u = c[3]; j = c[4]; s = c[5]
+                    gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
+                    print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
+  if [ -n "$_row" ]; then
+    _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
+    case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
+    case "$_j" in none|affected|module|full) J="$_j" ;; *) FROM="${FROM}row '$ROW' journey scope '$_j' unknown, default used; " ;; esac
+    case "$FROM" in default:*) FROM="PROJECT.md ## Test strategy, row '$ROW'${_s:+, $_s}" ;; *) FROM="${FROM}PROJECT.md ## Test strategy" ;; esac
+  fi
+fi
+out "strategy	$MOMENT	unit=$U journeys=$J	($FROM)"
+
+# ── Subjects ─────────────────────────────────────────────────────────────────
+: > "$WORK/subjects"
+if [ -n "$SCRIPTS" ]; then
+  printf '%s\n' "$SCRIPTS" | while IFS= read -r s; do
+    bash "$HERE/exec.sh" --subjects "$s" 2>/dev/null | while IFS='	' read -r k n l; do
+      printf '%s\t%s\t%s of %s\n' "$k" "$n" "$l" "$(basename "$s")"
+    done
+  done > "$WORK/subjects"
+fi
+while IFS='	' read -r k n w; do out "subject	$k	$n	$w"; done < "$WORK/subjects"
+[ -n "$SCRIPTS" ] && [ ! -s "$WORK/subjects" ] && out "subject	none	-	no model-writing statement in the script(s)"
+mod_of() { printf '%s\n' "${1%%.*}"; }
+awk -F'\t' '$2 != "-" { split($2, a, "."); print a[1] }' "$WORK/subjects" > "$WORK/modules"
+for m in $MODULES; do echo "$m" >> "$WORK/modules"; done
+sort -u "$WORK/modules" -o "$WORK/modules"
+
+# ── Callers (one batched mxcli call) ─────────────────────────────────────────
+: > "$WORK/callers"
+awk -F'\t' '$1 ~ /^(microflow|nanoflow|page|snippet|layout)$/ { print $2 }' "$WORK/subjects" | sort -u > "$WORK/flowish"
+CALLERS="NOT MEASURED"
+if [ "$U" != affected ] && [ "$J" != affected ]; then
+  CALLERS="not needed (no affected scope at this moment)"
+elif [ ! -s "$WORK/flowish" ]; then
+  CALLERS="not needed (no microflow, nanoflow, page, snippet or layout subject)"
+elif [ "$NO_MODEL" = 1 ]; then
+  CALLERS="NOT MEASURED (--no-model)"
+else
+  MX="${MXCLI:-$(find_project_mxcli 2>/dev/null || true)}"
+  MPR="$(find_mpr 2>/dev/null || true)"
+  if [ -z "$MX" ] || [ ! -x "$MX" ]; then CALLERS="NOT MEASURED (no project mxcli; set MXCLI)"
+  elif [ -z "$MPR" ]; then CALLERS="NOT MEASURED (no .mpr found)"
+  else
+    Q="$(sed 's/.*/SHOW CALLERS OF & TRANSITIVE/' "$WORK/flowish" | awk '{ printf "%s%s", (NR > 1 ? "; " : ""), $0 }')"
+    "$MX" -p "$MPR" -c "$Q" > "$WORK/mx.out" 2> "$WORK/mx.err"; RC=$?
+    _blocks="$(grep -c '^Callers of ' "$WORK/mx.out" 2>/dev/null)" || _blocks=0
+    if [ "$RC" -ne 0 ] || [ "$_blocks" -ne "$(wc -l < "$WORK/flowish" | tr -d ' ')" ]; then
+      _why="$(grep -v -e '^✓' -e '^WARNING: This is a' -e '^[[:space:]]*$' "$WORK/mx.err" | head -1)"
+      CALLERS="NOT MEASURED (mxcli exit $RC, $_blocks of $(wc -l < "$WORK/flowish" | tr -d ' ') caller blocks${_why:+: $_why})"
+    else
+      CALLERS="measured (SHOW CALLERS OF ... TRANSITIVE, $_blocks subject(s))"
+      awk '/^\| *[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]* *\| *[0-9]+ *\|$/ {
+             split($0, c, "|"); n = c[2]; d = c[3]; gsub(/ /, "", n); gsub(/ /, "", d)
+             if (!(n in best) || d + 0 < best[n]) best[n] = d + 0 }
+           END { for (n in best) print n "\t" best[n] }' "$WORK/mx.out" | sort -t '	' -k2,2n -k1,1 > "$WORK/callers"
+    fi
+  fi
+fi
+while IFS='	' read -r n d; do out "caller	$n	depth $d"; done < "$WORK/callers"
+out "callers	$CALLERS"
+
+# ── Candidate files ──────────────────────────────────────────────────────────
+find . \( -name .git -o -name .mpr-snapshots -o -name node_modules -o -name deployment \) -prune -o \
+  -type f -name '*.test.mdl' -print 2>/dev/null | sed 's|^\./||' | sort > "$WORK/tests"
+for _d in "$JDIR" tests/e2e; do [ -d "$_d" ] && find "$_d" -type f -name '*.journey.json' 2>/dev/null; done | sed 's|^\./||' | sort -u > "$WORK/journeys"
+
+# names: the strings a test or journey must contain to be selected
+names_for_unit() {
+  awk -F'\t' '$2 != "-" && $1 !~ /^(entity|association|enumeration|access|module)$/ { print $2 }' "$WORK/subjects"
+  awk -F'\t' -v d="$DEPTH" '$2 + 0 <= d { print $1 }' "$WORK/callers"
+}
+modules_for_unit() { awk -F'\t' '$2 != "-" && $1 ~ /^(entity|association|enumeration|access|module)$/ { split($2, a, "."); print a[1] }' "$WORK/subjects" | sort -u; }
+
+select_unit() {  # $1 = scope; prints "<file>\t<why>"
+  case "$1" in
+    none) ;;
+    full) sed 's/$/	full suite/' "$WORK/tests" ;;
+    module)
+      while IFS= read -r m; do [ -n "$m" ] || continue
+        while IFS= read -r f; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && echo "$f	names module $m"; done < "$WORK/tests"
+      done < "$WORK/modules" ;;
+    affected)
+      names_for_unit | sort -u > "$WORK/unames"
+      [ -s "$WORK/unames" ] && while IFS= read -r f; do
+        _hit="$(grep -o -w -F -f "$WORK/unames" "$f" 2>/dev/null | head -1)"
+        [ -n "$_hit" ] && echo "$f	names $_hit"
+      done < "$WORK/tests"
+      modules_for_unit | while IFS= read -r m; do
+        while IFS= read -r f; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && echo "$f	names module $m (data or access change)"; done < "$WORK/tests"
+      done ;;
+  esac | awk -F'\t' '!seen[$1]++'
+}
+
+select_journeys() {  # $1 = scope; prints "<file>\t<why>"
+  case "$1" in
+    none) ;;
+    full) sed 's/$/	full suite/' "$WORK/journeys" ;;
+    module|affected)
+      { cat "$WORK/modules"; [ "$1" = affected ] && cut -f1 "$WORK/callers" | sed 's/\..*//'; } | sort -u |
+        while IFS= read -r m; do
+          [ -n "$m" ] && [ -f "$JDIR/$m.journey.json" ] && echo "$JDIR/$m.journey.json	module $m"
+        done
+      if [ "$1" = affected ]; then
+        awk -F'\t' '$2 ~ /\./ { print $2 }' "$WORK/subjects" | sort -u > "$WORK/jnames"
+        [ -s "$WORK/jnames" ] && while IFS= read -r f; do
+          _hit="$(grep -o -w -F -f "$WORK/jnames" "$f" 2>/dev/null | head -1)"
+          [ -n "$_hit" ] && echo "$f	names $_hit"
+        done < "$WORK/journeys"
+      fi ;;
+  esac | awk -F'\t' '!seen[$1]++'
+}
+
+select_unit "$U" > "$WORK/unit.sel"
+select_journeys "$J" > "$WORK/journey.sel"
+if [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
+else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match")"; fi
+if [ -s "$WORK/journey.sel" ]; then sed 's/^/journey	/' "$WORK/journey.sel"
+else out "journey	none	scope $J: $( [ "$J" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/journeys" | tr -d ' ') journey file(s) in $JDIR/ and tests/e2e/ match")"; fi
+
+# ── Run rows ─────────────────────────────────────────────────────────────────
+_uf="$(cut -f1 "$WORK/unit.sel" | tr '\n' ' ' | sed 's/ $//')"
+_jf="$(cut -f1 "$WORK/journey.sel" | tr '\n' ' ' | sed 's/ $//')"
+[ -n "$_uf" ] && out "run	./bin/test-scratch.sh -- $_uf --local"
+[ -n "$_jf" ] && out "run	node tests/e2e/journey-runner.js $_jf"
+exit 0
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index a4c85a76..93bc1c69 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -16,6 +16,8 @@
 #        ./bin/exec.sh --change-class <script.mdl>   (advisory ui-only/logic tag; writes nothing)
 #        ./bin/exec.sh --watch-compat <script.mdl>   (advisory: can `run --local --watch` apply
 #                                                     this, or does the app need a restart; writes nothing)
+#        ./bin/exec.sh --subjects <script.mdl>       (advisory: the elements it writes, one per line;
+#                                                     bin/affected-tests.sh reads it; writes nothing)
 #        ./bin/exec.sh --cr CR-07 <script.mdl>        (any mode: tag the run with its change request)
 #        Leading flags (--cr, --commit-first, then --patch) may come in any order.
 #
@@ -78,6 +80,11 @@
 #            MXTK_SCAN_OVERRIDE="<reason>" (the user only: run despite a blocking STOP-row scan hit, #349)
 set -e
 _T0=$(date +%s)
+# Per-step seconds (2026-10-16): the BUILD-LOG row used to carry only the total, so nobody could
+# say where an exec's time went (check, baseline, exec, gate, lint, score). step_done <name>
+# adds "<name> <s>s" since the previous mark; the run summary and the BUILD-LOG detail print it.
+_TLAST=$_T0; STEP_TIMES=""
+step_done() { _tn=$(date +%s); STEP_TIMES="${STEP_TIMES:+$STEP_TIMES }$1 $((_tn - _TLAST))s"; _TLAST=$_tn; }
 
 # ── Change class (advisory, added 2026-10-13) ────────────────────────────────
 # Tags each run `ui-only` or `logic`, so the run summary can say which TEST LANE applies
@@ -167,6 +174,40 @@ mxtk_change_class() {  # $1 = MDL script; prints "<class>\t<why>"
       printf "ui-only\t%d page/snippet/layout statement(s), nothing else\n", ui
     }' "$1"
 }
+# ── Subjects (advisory, added 2026-10-16) ────────────────────────────────────
+# The elements a script writes: one "<kind>\t<Module.Name>\tline N" row per statement head,
+# kind = the object word before the first qualified name (microflow, page, entity, ...;
+# "access" for GRANT/REVOKE). A head with no qualified name prints "unmapped\t-\tline N".
+# bin/affected-tests.sh turns these into the tests to re-run (testing-shape.md §3 subject set).
+# Same lexer and statement-head rule as the change class; read-only heads are skipped.
+mxtk_subjects() {  # $1 = MDL script
+  awk "$_MXTK_MDL_LEX"'
+    BEGIN { depth = 0; inblock = 0; indollar = 0 }
+    {
+      lex_line($0)
+      t = clean; gsub(/^[ \t]+/, "", t)
+      if (start_depth != 0 || t !~ /^[A-Za-z]/) next
+      n = split(t, o, /[ \t(;{,=]+/)
+      v = toupper(o[1])
+      if (v !~ /^(CREATE|ALTER|DROP|MOVE|GRANT|REVOKE|UPDATE)$/) next
+      if (v == "UPDATE" && toupper(o[2]) != "WIDGETS") next
+      kind = ""; name = ""
+      for (i = 2; i <= n; i++) {
+        if (o[i] ~ /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/) { name = o[i]; break }
+        u = toupper(o[i])
+        if (u ~ /^(MICROFLOW|NANOFLOW|PAGE|PAGES|SNIPPET|LAYOUT|ENTITY|ASSOCIATION|ENUMERATION|CONSTANT|WORKFLOW|RULE)$/) kind = tolower(u)
+        else if (kind == "" && u !~ /^(OR|MODIFY|REPLACE|PERSISTENT|NON-PERSISTENT|IF|NOT|EXISTS)$/) last = tolower(u)
+      }
+      if (name == "" && toupper(o[2]) == "MODULE" && o[3] ~ /^[A-Za-z_][A-Za-z0-9_]*$/) { kind = "module"; name = o[3] }
+      if (v == "GRANT" || v == "REVOKE") kind = "access"
+      else if (v == "UPDATE") kind = "page"
+      else if (kind == "pages") kind = "page"
+      else if (kind == "") kind = last
+      if (name == "") printf "unmapped\t-\tline %d\n", NR
+      else printf "%s\t%s\tline %d\n", kind, name, NR
+      last = ""
+    }' "$1"
+}
 # Leading flags, parsed in ONE loop before anything needs a project, in any order:
 # --cr CR-NN, --commit-first, then optionally --patch (whose next word is the script) or one of
 # the advisory modes. A malformed --cr id, an unknown --flag, or a script name starting with
@@ -190,7 +231,7 @@ while [ $# -gt 0 ]; do
       shift 2 ;;
     --commit-first) COMMIT_FIRST=1; shift ;;
     --patch) PATCH_MODE=1; shift; break ;;
-    --change-class|--watch-compat) ADVISORY="$1"; shift; break ;;
+    --change-class|--watch-compat|--subjects) ADVISORY="$1"; shift; break ;;
     *) break ;;
   esac
 done
@@ -206,6 +247,11 @@ if [ "$ADVISORY" = "--change-class" ]; then
   mxtk_change_class "$1"
   exit 0
 fi
+if [ "$ADVISORY" = "--subjects" ]; then
+  [ -f "${1:-}" ] || { echo "Usage: ./bin/exec.sh --subjects <script.mdl>" >&2; exit 2; }
+  mxtk_subjects "$1"
+  exit 0
+fi
 
 # ── Watch compatibility (advisory, added 2026-10-13) ─────────────────────────
 # After a write, can a running `mxcli run --local --watch` apply it, or will the app keep
@@ -365,13 +411,14 @@ fi
 change_lane() {
   case "$CHANGE_CLASS" in
     ui-only) echo "re-run the journeys of every page the change reaches (embedders of a changed snippet/layout) once + a LOOK. No .test.mdl; reviewers read the artifacts, they do not re-run" ;;
-    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Full mxcli test at module close, not here" ;;
+    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). The full suite runs at deploy-ready, per PROJECT.md ## Test strategy" ;;
   esac
 }
 [ -n "$CR_ID" ] && echo "→ Change request: $CR_ID (PROJECT.md '## Change log'; cite this run's commit in its Closed-by)"
 if [ -n "$CHANGE_CLASS" ]; then
   echo "→ Change class: $CHANGE_CLASS ($CHANGE_WHY)"
   echo "  test lane (skills/testing-shape.md §3): $(change_lane)"
+  [ "$PATCH_MODE" = "1" ] || echo "  affected tests: ./bin/affected-tests.sh $SCRIPT"
 fi
 
 cd "$PROJECT_ROOT"
@@ -440,7 +487,7 @@ HDR2
   # The gate cell is read from GATE_STATE rather than passed in, so no caller
   # can omit it — a blank cell in this table reads as "fine", which is the exact
   # false-green the gate exists to prevent.
-  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${SCAN_NOTE:+ · $SCAN_NOTE}${HV_NOTE:+ · $HV_NOTE}$_EXEC_APPROVAL_SUFFIX"
+  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${SCAN_NOTE:+ · $SCAN_NOTE}${HV_NOTE:+ · $HV_NOTE}$_EXEC_APPROVAL_SUFFIX${STEP_TIMES:+ · steps: $STEP_TIMES}"
   printf '| %s | `%s` | %s | %s | %s |\n' \
     "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$LOG_NAME" \
     "${GATE_STATE:-not-run}" "$1" "$_detail" >> "$BUILD_LOG"
@@ -927,9 +974,12 @@ run_lint_gate() {
 }
 # One place decides the applied-row wording, so both mxbuild-clean branches agree.
 log_applied() {  # $1 = mxbuild detail
+  step_done gate
   run_lint_gate
+  step_done lint
   LINT_RC_FOR_LEDGER="$LINT_RC"
   take_score
+  if [ "$SCORED" = 1 ]; then step_done score; fi
   if [ "$LINT_RC" -eq 1 ]; then
     log_build "⚠️ applied, LINT ROSE" "$1; $LINT_DETAIL"
   elif [ "$LINT_RC" -eq 3 ]; then
@@ -947,6 +997,7 @@ log_applied() {  # $1 = mxbuild detail
 # a passing build. SKIP_CHECK=1 for the rare script mxcli's parser rejects but
 # the model accepts (log why, in the script).
 PMXCLI="$(find_project_mxcli 2>/dev/null || true)"
+step_done guards
 if [ "$PATCH_MODE" = "1" ]; then
   echo "→ --patch: no pre-exec mxcli check (not MDL). The mxbuild gate below is this write's only check."
 elif [ "${SKIP_CHECK:-0}" != "1" ] && [ -n "$PMXCLI" ]; then
@@ -1007,8 +1058,10 @@ if [ ! -x "$MXBUILD" ] || [ ! -x "$JAVA_EXE" ]; then
   fi
 fi
 
+step_done check
 echo "→ Snapshotting model..."
 ./bin/snapshot-mpr.sh
+step_done snapshot
 # The snapshot just taken. A --patch run hands it to the script as MXPATCH_BACKUP_DIR, so the
 # .bak that bin/mxpatch.py keeps of each unit it rewrites lands beside the snapshot, OUTSIDE
 # the model tree, and is pruned with it. Until 2026-10-15 it was <unit>.mxunit.bak inside
@@ -1396,6 +1449,7 @@ fi
 # was already applied. The result was live, ungated, unlogged model changes,
 # arrived at by the guard chain exiting through the one path with no guards on
 # it. A failed exec is precisely when the gate matters most.
+step_done baseline
 echo "→ Executing $SCRIPT..."
 EXEC_STATUS=0
 if [ "$PATCH_MODE" = "1" ]; then
@@ -1520,6 +1574,7 @@ if [ "$EXEC_STATUS" -ne 0 ]; then
   echo "    failing statement is already in the model. Running the gate anyway."
 fi
 
+step_done exec
 echo ""
 echo "→ Running mxbuild model check (catches BSON corruption before SP opens)..."
 echo "  (mxbuild: $MXBUILD)"
@@ -1928,6 +1983,7 @@ echo "✓ Script applied to $MPR_BASE."
 echo ""
 _EL=$(( $(date +%s) - _T0 ))
 echo "  elapsed: ${_EL}s (check + snapshot + exec + mxbuild gate)"
+if [ -n "$STEP_TIMES" ]; then echo "  steps: $STEP_TIMES"; fi
 [ -n "$CHANGE_CLASS" ] && echo "  change class: $CHANGE_CLASS — test lane: $(change_lane)"
 # A budget, not a gate: a normal run is 30-90 s on a healthy machine. Past 4 minutes the
 # usual cause is the machine (Defender scanning every fork, OneDrive, a slow disk), and
diff --git a/skills/checkpoints/checkpoint-build.md b/skills/checkpoints/checkpoint-build.md
index 11458620..91baa42d 100644
--- a/skills/checkpoints/checkpoint-build.md
+++ b/skills/checkpoints/checkpoint-build.md
@@ -103,6 +103,27 @@ all scripts upfront. See `brd-to-build-plan.md` ("The build plan contains no MDL
 `test-plan`, `acceptance-criteria`), or `Optional artifacts: none for Stage 5` as a Stage-4
 decision.
 
+**Test strategy (in the same Offer, not a separate question).** Show the defaults and let the
+developer change any cell in the same answer:
+
+> "Testing during the build, unless you want otherwise:
+>
+> | Moment | Unit tests | Journeys |
+> |---|---|---|
+> | Every change | affected | affected |
+> | Module close | module | module |
+> | Deploy-ready | full | full |
+>
+> `affected` = the tests and journeys of what the change touched and its callers
+> (`bin/affected-tests.sh`); `module` = the module's own; `full` = everything; `none` = skip.
+> Change a cell, or say 'defaults'."
+
+**Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column
+(`CONFIRMED`, or `ASSUMED` in auto mode). `bin/affected-tests.sh --moment change|module|deploy`
+reads it; with no section it uses these defaults and says so. Unit tests stay subject to the
+intake default (`Unit tests default:` in PROJECT.md, `testing-shape.md` §2): `affected` selects
+from the tests that exist, it does not ask for new ones.
+
 ## Open Question
 
 > "Is there a deadline, a demo milestone, or a specific feature that must be working first?
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 59d7e8c6..f5800c02 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -654,8 +654,8 @@ nothing about the seams.
 
 **Read `testing-shape.md` before writing or judging any test here.** It defines what testing a
 module means, so it is the same thing every time, and it carries the **false-green register**: the
-confirmed ways a test reports green while the feature is broken. Its §3 check moments name what the
-release gate owes beyond module close. Alongside it, `measured-claims.md`
+confirmed ways a test reports green while the feature is broken. Its §3 check moments name what
+deploy-ready owes beyond module close. Alongside it, `measured-claims.md`
 holds the rule that gives evidence its force — *a claim not measured in that register may not be
 cited as evidence.*
 
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index 3ad624be..944c75fd 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -196,6 +196,9 @@ baseline from Ground Rule 1, re-run, and by nothing else.
 A module gate that is green on the new work and was never run against the baseline has answered half
 the question and reported it as the whole. Re-run the baseline at every module gate, not once at the
 end — a regression found three modules later costs the same to fix and much more to find.
+At a module gate that means the baseline journeys of the modules the change touched
+(`bin/affected-tests.sh --moment module`); the whole baseline runs at deploy-ready. A project that wants
+the whole baseline at every module gate says so in PROJECT.md `## Test strategy`.
 
 ---
 
@@ -297,5 +300,5 @@ it is the only entry mode where that is true.
 - A build plan over the change.
 - When the work arrives as a backlog: a `## Rounds` table in `PROJECT.md`, one row per round, its state current.
 - When an edit cannot go through mxcli: `docs/manual-steps.md` from `templates/manual-steps.md`, every step with its Check and a ticked Done line naming its evidence.
-- **A regression baseline that was green before the change and is green after it** — stated as N journeys over M modules, re-run at every module gate. Without this the rest is unverified.
+- **A regression baseline that was green before the change and is green after it**: stated as N journeys over M modules, re-run per module gate over the modules it touched, and whole at deploy-ready. Without this the rest is unverified.
 - Anything reusable learned about the app → `skills/learned-*.md`; process learnings → `process/process-learnings.md`.
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 01e19b05..3163f07f 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -618,9 +618,9 @@ step.
 **Verification is scoped — once per gate, not once per script.** Gate: SYNTAX and Gate: BUILD run
 inside every `exec.sh`, and they are the only per-script checks. The test passes (happy path, journeys, LOOK) run **once
 per gate round** over what that round changed, and `bin/gate-check.sh` runs **once per gate round**,
-not after every exec. What re-runs after a change, by whom, and when the full suite runs (module
-close only, never batch close) is `testing-shape.md` §3 — the single source; `exec.sh` prints the
-run's lane (`ui-only` / `logic`). Repeating a pass the artifacts already prove is the over-testing
+not after every exec. What re-runs after a change, by whom, and when the full suite runs (deploy-ready
+by default, per PROJECT.md `## Test strategy`; never batch close) is `testing-shape.md` §3, the single
+source; `exec.sh` prints the run's lane (`ui-only` / `logic`) and `bin/affected-tests.sh` lists its tests. Repeating a pass the artifacts already prove is the over-testing
 toolkit issue #274 measured: UI-only changes re-proven 5–10×.
 
 > **Older ordinals, for anyone arriving from a document that still cites them:** Gate 2 = Gate:
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 1ba1a7d8..640df6f0 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -134,7 +134,7 @@ definition of done (`iterative-build-loop.md`). Without this anchor someone decl
 > hand (journey report, screenshot, diff) does not?* If you cannot name what it would show, do not run it.
 
 **The subject set.** A re-run covers the tests whose *subject* the exec'd script(s) changed — the
-script is the change list; `bin/exec.sh` tags each run `ui-only` or `logic` and prints its lane:
+script is the change list; `bin/exec.sh` tags its lane and `bin/affected-tests.sh <script>` lists the set:
 
 | Changed in this exec | Its subject set — re-run these, only these |
 |---|---|
@@ -156,29 +156,29 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**The full suite (and the module's whole journey set) runs on the last three rows below only** — **never at batch close**, never after
-an individual fix, never because the change "felt wide". The e2e instruments are unchanged; only
-their trigger is.
+**Each project picks what runs when** with its developer at CAC-5: PROJECT.md `## Test strategy`
+(`checkpoint-build.md`). Defaults: every change `affected`, module close `module`, deploy-ready
+`full`. The full suite never runs at batch close, after a fix, or because a change "felt wide".
 
 | Event | What happens |
 |---|---|
 | A fix to an existing script | **Re-run its subject set**, in its lane. No questions, no re-authoring. |
 | A new script within agreed scope | Re-run its subject set. Extend the suite only for a *behaviour* the coverage checklist doesn't already cover. |
 | A new behaviour / scope change | The coverage checklist changes — the existing drift-sync path. The suite extends with it. |
-| Module close | The full suite, once (`module-review.md` PROVE). |
-| Release gate (before UAT/production) | The project-wide suite, once. |
+| Module close | The module's tests and journeys, once (`module-review.md` PROVE). |
+| Deploy-ready (before UAT/production) | Every test and journey, once. |
 | The user asks for a full run | Run it, that message is the trigger. |
 
 **Check moments — which checks each of those events owes.** Fast checks run during development;
-heavy checks wait for module close or the release gate. This sorts checks by *when*, not what
+heavy checks wait for module close or deploy-ready. This sorts checks by *when*, not what
 testing a module means: the §1 shape and the two lanes are unchanged. A *planned: #N* check is not
 built yet and claims nothing until it lands.
 
 | Moment | Budget | What runs |
 |---|---|---|
 | **Every exec** | ~1 minute (mxbuild 22–65 s per script, `iterative-build-loop.md` → Gate cost) | `exec.sh` includes: lock → module-brief advisory → `mxcli check` → snapshot → apply → mxbuild delta gate → auto-restore on a new error → lint ratchet. Static STOP-row scan (planned: #349); Studio Pro warning ratchet (planned: #351); human-locked baselines (planned: #348). |
-| **Module close** | minutes | The module's full suite and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
-| **Release gate** | as needed | The project-wide suite, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
+| **Module close** | minutes | The module's tests and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
+| **Deploy-ready** | as needed | Every test and journey, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
 > **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
 > change 5–10× (other modules' journeys, the reviewer re-running them, a full `mxcli test` at every
diff --git a/tests/wave2/fixtures/affected-tests/CAPTURE.txt b/tests/wave2/fixtures/affected-tests/CAPTURE.txt
new file mode 100644
index 00000000..fe003577
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/CAPTURE.txt
@@ -0,0 +1,33 @@
+tests/wave2/fixtures/affected-tests/ : provenance (captured 2026-10-16, macOS arm64)
+
+Every file here is captured output, except this note and shop.mdl, the MDL script that told
+mxcli what to create (it was applied, so it is also real, exec'd MDL).
+
+BINARY: mxcli version v0.26.0 (2026-10-11T18:37:07Z), the darwin-arm64 release asset.
+
+THE MODEL: a scratch copy of an empty Studio Pro 11.12.0 app, then
+    mxcli exec shop.mdl -p Neutral.mpr
+which adds module Shop: entity Order; microflows SUB_Order_Total <- VAL_Order <-
+ACT_Order_Submit (a call chain); page Order_Edit whose button calls ACT_Order_Submit;
+microflow ACT_Order_New, which shows Order_Edit; page Order_Overview whose button calls
+ACT_Order_New. So a change to SUB_Order_Total reaches two pages through five hops.
+
+THE CAPTURES (<name>.out = stdout, .err = stderr, .exit = exit code):
+  callers.*     mxcli -p Neutral.mpr -c "$(cat callers.query)"
+                Four statements in ONE call (the batch affected-tests.sh sends), the first call
+                on the copy, so stderr carries the catalog build. Shows: transitive callers
+                include pages (button CALL MICROFLOW, SHOW PAGE) with their depth; a name with
+                no callers prints "(no callers found)"; one block per statement, in order.
+  val-order.out mxcli -p Neutral.mpr -c "SHOW CALLERS OF Shop.VAL_Order TRANSITIVE", a later
+                call (warm catalog), stdout only.
+  noproj.*      mxcli -p /nonexistent.mpr -c "SHOW CALLERS OF Shop.VAL_Order TRANSITIVE"
+                exit 1, nothing on stdout.
+
+The stub in test-affected-tests.sh replays these per statement: it splits the captured stdout
+into its "Callers of X (transitive)" blocks and prints, verbatim, the block of each statement
+it is asked for, in the order asked. A statement with no captured block fails the stub (99).
+
+FIELD RUN of the script itself (2026-10-16): a scratch copy of a five-app lab project (Mendix
+11.15, mxcli v0.26.0), three of its real change scripts. Per change: 2 to 55 subjects, 8 to 17
+transitive callers, 0 to 1 of the project's unit test files and 0 to 1 of its 20 journey files
+selected, against 1 and 20 at deploy-ready. The first call 19 s (catalog build), later 3 s.
diff --git a/tests/wave2/fixtures/affected-tests/callers.err b/tests/wave2/fixtures/affected-tests/callers.err
new file mode 100644
index 00000000..4bd396ca
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.err
@@ -0,0 +1,57 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+✓ Modules: 11
+✓ Entities: 51
+✓ Attributes: 245
+✓ Entity Event Handlers: 0
+✓ Associations: 49
+✓ Enumerations: 24
+✓ Enumeration values: 151
+✓ Constants: 3
+✓ ConstantValues: 0
+✓ Java Actions: 3
+✓ Java Action Parameters: 4
+✓ JavaScript Actions: 67
+✓ Image Collections: 7
+✓ Icon Collections: 3
+✓ Menus: 2
+✓ Page Templates: 46
+✓ Data Transformers: 0
+✓ Scheduled Events: 0
+✓ Task Queues: 0
+✓ Regular Expressions: 0
+✓ Agent-editor documents: 0
+✓ Microflows: 24
+✓ Nanoflows: 13
+✓ Rules: 0
+✓ Flow parameters: 26
+✓ Activities: 318
+✓ Pages: 19
+✓ Widgets: 229
+✓ Snippets: 4
+✓ Snippet widgets: 4
+✓ Building blocks: 40
+✓ Layouts: 22
+✓ OData Clients: 0
+✓ OData Services: 0
+✓ Business Event Services: 0
+✓ widget_definitions: 42
+✓ Database Connections: 0
+✓ JAR Dependencies: 0
+✓ REST Clients: 0
+✓ Published REST Services: 0
+✓ External Entities: 0
+✓ External Actions: 0
+✓ Business Events: 0
+✓ Contract Entities: 0
+✓ Contract Messages: 0
+✓ Navigation profiles: 1
+✓ Navigation menu items: 1
+✓ RoleMappings: 8
+✓ JSON Structures: 3
+✓ Import Mappings: 2
+✓ Export Mappings: 1
+✓ XPath Expressions: 5
+✓ References: 556
+✓ Permissions: 235
+✓ strings: 1568
+✓ Catalog cached to .mxcli/catalog.db
diff --git a/tests/wave2/fixtures/affected-tests/callers.exit b/tests/wave2/fixtures/affected-tests/callers.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/affected-tests/callers.out b/tests/wave2/fixtures/affected-tests/callers.out
new file mode 100644
index 00000000..fc8cbdb1
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.out
@@ -0,0 +1,26 @@
+
+Callers of Shop.SUB_Order_Total (transitive)
+Found 5 caller(s)
+| Caller                | Depth |
+|-----------------------|-------|
+| Shop.VAL_Order        | 1     |
+| Shop.ACT_Order_Submit | 2     |
+| Shop.Order_Edit       | 3     |
+| Shop.ACT_Order_New    | 4     |
+| Shop.Order_Overview   | 5     |
+
+Callers of Shop.Order_Edit (transitive)
+Found 2 caller(s)
+| Caller              | Depth |
+|---------------------|-------|
+| Shop.ACT_Order_New  | 1     |
+| Shop.Order_Overview | 2     |
+
+Callers of Shop.ACT_Order_New (transitive)
+Found 1 caller(s)
+| Caller              | Depth |
+|---------------------|-------|
+| Shop.Order_Overview | 1     |
+
+Callers of Shop.NoSuchFlow (transitive)
+(no callers found)
diff --git a/tests/wave2/fixtures/affected-tests/callers.query b/tests/wave2/fixtures/affected-tests/callers.query
new file mode 100644
index 00000000..458285d6
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.query
@@ -0,0 +1 @@
+SHOW CALLERS OF Shop.SUB_Order_Total TRANSITIVE; SHOW CALLERS OF Shop.Order_Edit TRANSITIVE; SHOW CALLERS OF Shop.ACT_Order_New TRANSITIVE; SHOW CALLERS OF Shop.NoSuchFlow TRANSITIVE
diff --git a/tests/wave2/fixtures/affected-tests/noproj.err b/tests/wave2/fixtures/affected-tests/noproj.err
new file mode 100644
index 00000000..56fc47cd
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/noproj.err
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+Error: failed to connect: mpr file not found: /nonexistent.mpr
diff --git a/tests/wave2/fixtures/affected-tests/noproj.exit b/tests/wave2/fixtures/affected-tests/noproj.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/noproj.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/affected-tests/noproj.out b/tests/wave2/fixtures/affected-tests/noproj.out
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/wave2/fixtures/affected-tests/shop.mdl b/tests/wave2/fixtures/affected-tests/shop.mdl
new file mode 100644
index 00000000..f23190ca
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/shop.mdl
@@ -0,0 +1,43 @@
+mdl 1;
+create module Shop;
+create or modify persistent entity Shop.Order (
+  Amount: Decimal,
+  Status: String(30)
+);
+create or modify microflow Shop.SUB_Order_Total ($Order: Shop.Order) returns Decimal
+begin
+  return $Order/Amount;
+end;
+create or modify microflow Shop.VAL_Order ($Order: Shop.Order) returns Boolean
+begin
+  $Total = call microflow Shop.SUB_Order_Total(Order = $Order);
+  return $Total > 0;
+end;
+create or modify microflow Shop.ACT_Order_Submit ($Order: Shop.Order)
+begin
+  $Ok = call microflow Shop.VAL_Order(Order = $Order);
+  if $Ok then
+    change $Order (Status = 'Submitted');
+    commit $Order;
+  end if;
+end;
+create or modify page Shop.Order_Edit (
+  Title: 'Order',
+  Layout: Atlas_Core.Atlas_Default,
+  Params: ( $Order: Shop.Order )
+) {
+  dataview dvOrder (DataSource: $Order) {
+    actionbutton btnSubmit (Caption: 'Submit', Action: CALL MICROFLOW Shop.ACT_Order_Submit(Order = $currentObject), ButtonStyle: Primary)
+  }
+};
+create or modify microflow Shop.ACT_Order_New ()
+begin
+  $Order = create Shop.Order (Status = 'Draft');
+  show page Shop.Order_Edit(Order = $Order);
+end;
+create or modify page Shop.Order_Overview (
+  Title: 'Orders',
+  Layout: Atlas_Core.Atlas_Default
+) {
+  actionbutton btnNew (Caption: 'New', Action: CALL MICROFLOW Shop.ACT_Order_New, ButtonStyle: Default)
+};
diff --git a/tests/wave2/fixtures/affected-tests/val-order.out b/tests/wave2/fixtures/affected-tests/val-order.out
new file mode 100644
index 00000000..dbc9b47a
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/val-order.out
@@ -0,0 +1,9 @@
+
+Callers of Shop.VAL_Order (transitive)
+Found 4 caller(s)
+| Caller                | Depth |
+|-----------------------|-------|
+| Shop.ACT_Order_Submit | 1     |
+| Shop.Order_Edit       | 2     |
+| Shop.ACT_Order_New    | 3     |
+| Shop.Order_Overview   | 4     |
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
new file mode 100644
index 00000000..a9f6d225
--- /dev/null
+++ b/tests/wave2/test-affected-tests.sh
@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/affected-tests.sh: which unit tests and journeys a change owes,
+# per the project's PROJECT.md "## Test strategy" row (defaults when it has none).
+#
+# usage: bash tests/wave2/test-affected-tests.sh [/path/to/affected-tests.sh]
+#
+# Golden input is captured, never written: the change scripts are line ranges of
+# fixtures/affected-tests/shop.mdl (the MDL that was exec'd to build the captured model), and
+# the stub mxcli replays, per statement, the verbatim `SHOW CALLERS OF ... TRANSITIVE` blocks
+# mxcli v0.26.0 printed for that model (provenance: fixtures/affected-tests/CAPTURE.txt).
+# The .test.mdl and journey files in the stub project are project content, not instrument
+# output: they only need to name (or not name) the captured elements.
+#
+# Positive control: against master (no affected-tests.sh) 10 pass, 34 fail: only the negative
+# guards hold. With names_for_unit's caller rows removed, A2 and the --depth 2 case fail; with
+# grep -w dropped, A's look-alike guard fails.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "$0")/../.." && pwd)"
+SUBJECT="${1:-$TOOLKIT/project-bin/affected-tests.sh}"
+case "$SUBJECT" in /*) ;; *) SUBJECT="$PWD/$SUBJECT" ;; esac
+FX="$TOOLKIT/tests/wave2/fixtures/affected-tests"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected-t.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+echo "== subject: $SUBJECT"
+
+P="$WORK/proj"
+mkdir -p "$P/bin" "$P/tests/unit" "$P/journeys" "$P/tests/e2e"
+printf 'not a real model\n' > "$P/Fixture.mpr"
+cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/exec.sh" "$P/bin/"
+cp "$SUBJECT" "$P/bin/affected-tests.sh"
+chmod +x "$P/bin/"*.sh
+
+# Project content: tests naming the captured elements, one look-alike, one other module.
+t() { printf '/**\n * @test %s\n */\ncall microflow %s();\n/\n' "$2" "$2" > "$P/tests/unit/$1.test.mdl"; }
+t Total    Shop.SUB_Order_Total
+t Validate Shop.VAL_Order
+t Submit   Shop.ACT_Order_Submit
+t Lookalike Shop.SUB_Order_Total_Legacy
+t Other    Admin.ACT_Reset
+echo '{"id":"J-1","steps":[]}' > "$P/journeys/Shop.journey.json"
+echo '{"id":"J-2","steps":[]}' > "$P/journeys/Admin.journey.json"
+echo '{"id":"J-3","note":"opens Shop.Order_Edit","steps":[]}' > "$P/tests/e2e/edit.clerk.journey.json"
+echo '{"id":"J-4","steps":[]}' > "$P/tests/e2e/home.clerk.journey.json"
+
+# Stub mxcli: one call = one -c query; prints the captured block of each statement, in order.
+cat > "$P/mxcli" <<'MXCLI'
+#!/usr/bin/env bash
+D="$(cd "$(dirname "$0")" && pwd)"
+printf '%s\n' "$*" >> "$D/.stub-log"
+[ "${STUB_NOPROJ:-}" = 1 ] && { cat "$FX/noproj.out"; cat "$FX/noproj.err" >&2; exit "$(cat "$FX/noproj.exit")"; }
+q=""; while [ $# -gt 0 ]; do [ "$1" = -c ] && q="$2"; shift; done
+cat "$FX/callers.err" >&2
+first=1
+printf '%s\n' "$q" | tr ';' '\n' | sed -n 's/^ *SHOW CALLERS OF \([^ ]*\) TRANSITIVE *$/\1/p' | while IFS= read -r n; do
+  blk="$(cat "$FX/callers.out" "$FX/val-order.out" | awk -v n="$n" '
+    $0 == "Callers of " n " (transitive)" { on = 1 } on && /^$/ { exit } on { print }')"
+  [ -n "$blk" ] || { echo "stub: no captured block for $n" >&2; exit 99; }
+  [ "$first" = 1 ] || echo; first=0; printf '%s\n' "$blk"
+done || exit 99
+exit "$(cat "$FX/callers.exit")"
+MXCLI
+chmod +x "$P/mxcli"
+export FX
+
+lines() { sed -n "$1p" "$FX/shop.mdl" > "$WORK/$2"; echo "$WORK/$2"; }
+TOTAL="$(lines 7,10 total.mdl)"           # create or modify microflow Shop.SUB_Order_Total
+ENTITY="$(lines 3,6 entity.mdl)"          # create or modify persistent entity Shop.Order
+{ sed -n 24,32p "$FX/shop.mdl"; sed -n 33,37p "$FX/shop.mdl"; } > "$WORK/page-and-flow.mdl"
+PAGEFLOW="$WORK/page-and-flow.mdl"        # page Shop.Order_Edit + microflow Shop.ACT_Order_New
+
+run() {  # run <label> [args...]; env passes through
+  _l="$1"; shift; rm -f "$P/.stub-log"
+  ( cd "$P" && ./bin/affected-tests.sh "$@" ) > "$WORK/out.$_l" 2> "$WORK/err.$_l"; echo $?
+}
+has()   { grep -qF -- "$2" "$WORK/out.$1"; }
+lacks() { ! grep -qF -- "$2" "$WORK/out.$1"; }
+calls() { if [ -f "$P/.stub-log" ]; then wc -l < "$P/.stub-log" | tr -d ' '; else echo 0; fi; }
+
+echo "== A: one microflow change, defaults (no PROJECT.md) =="
+RC=$(run A "$TOTAL")
+[ "$RC" -eq 0 ] && ok "exit 0" || bad "A rc=$RC" "$(cat "$WORK/err.A")"
+has A "strategy	change	unit=affected journeys=affected	(default:" && ok "strategy row says default affected/affected" || bad "A strategy" "$(head -1 "$WORK/out.A")"
+has A "subject	microflow	Shop.SUB_Order_Total	line 1 of total.mdl" && ok "subject from exec.sh --subjects" || bad "A subject" "$(cat "$WORK/out.A")"
+[ "$(calls)" = 1 ] && grep -qx -- '-p .*Fixture.mpr -c SHOW CALLERS OF Shop.SUB_Order_Total TRANSITIVE' "$P/.stub-log" \
+  && ok "one mxcli call, the transitive callers query" || bad "A mxcli calls" "$(cat "$P/.stub-log" 2>/dev/null)"
+has A "caller	Shop.VAL_Order	depth 1" && has A "caller	Shop.Order_Overview	depth 5" && ok "five transitive callers, pages included" || bad "A callers" "$(grep caller "$WORK/out.A")"
+has A "callers	measured" && ok "callers measured" || bad "A measured"
+has A "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && ok "A1 the subject's own test" || bad "A1" "$(grep ^unit "$WORK/out.A")"
+has A "unit	tests/unit/Validate.test.mdl	names Shop.VAL_Order" && ok "A2 the depth-1 caller's test" || bad "A2" "$(grep ^unit "$WORK/out.A")"
+lacks A "Submit.test.mdl" && ok "A3 a depth-2 caller's test is not owed at --depth 1" || bad "A3 Submit selected at depth 1"
+lacks A "Lookalike.test.mdl" && ok "a look-alike name (SUB_Order_Total_Legacy) is not a match" || bad "A look-alike selected"
+lacks A "Other.test.mdl" && ok "another module's test not selected" || bad "A Other selected"
+has A "journey	journeys/Shop.journey.json	module Shop" && ok "the module journey of the subject and its callers" || bad "A journey" "$(grep ^journey "$WORK/out.A")"
+lacks A "Admin.journey.json" && lacks A "home.clerk" && ok "unrelated journeys not selected" || bad "A unrelated journey"
+has A "run	./bin/test-scratch.sh -- tests/unit/Total.test.mdl tests/unit/Validate.test.mdl --local" && ok "run row: test-scratch on the selection" || bad "A run unit" "$(grep ^run "$WORK/out.A")"
+has A "run	node tests/e2e/journey-runner.js journeys/Shop.journey.json" && ok "run row: journey runner" || bad "A run journey"
+
+echo "== A2: --depth 2 adds the depth-2 caller's test =="
+run A2 --depth 2 "$TOTAL" >/dev/null
+has A2 "unit	tests/unit/Submit.test.mdl	names Shop.ACT_Order_Submit" && ok "Submit selected at depth 2" || bad "A2 depth 2" "$(grep ^unit "$WORK/out.A2")"
+
+echo "== B: a page and a microflow in one script: ONE batched call =="
+run B "$PAGEFLOW" >/dev/null
+[ "$(calls)" = 1 ] && grep -qx -- '-p .*Fixture.mpr -c SHOW CALLERS OF Shop.ACT_Order_New TRANSITIVE; SHOW CALLERS OF Shop.Order_Edit TRANSITIVE' "$P/.stub-log" \
+  && ok "both subjects in one -c batch" || bad "B batch" "$(cat "$P/.stub-log" 2>/dev/null)"
+has B "subject	page	Shop.Order_Edit" && has B "subject	microflow	Shop.ACT_Order_New" && ok "both subjects listed" || bad "B subjects" "$(grep ^subject "$WORK/out.B")"
+has B "caller	Shop.Order_Overview	depth 1" && ok "shortest depth kept for a caller reached twice" || bad "B depth" "$(grep ^caller "$WORK/out.B")"
+has B "journey	tests/e2e/edit.clerk.journey.json	names Shop.Order_Edit" && ok "a journey that names the changed page" || bad "B named journey" "$(grep ^journey "$WORK/out.B")"
+has B "unit	none	scope affected: 0 of 5" && ok "no matching test says so (never silence)" || bad "B unit none" "$(grep ^unit "$WORK/out.B")"
+
+echo "== C: --no-model =="
+run C --no-model "$TOTAL" >/dev/null
+[ "$(calls)" = 0 ] && ok "mxcli not called" || bad "C called mxcli"
+has C "callers	NOT MEASURED (--no-model)" && ok "callers NOT MEASURED, and why" || bad "C callers" "$(grep ^callers "$WORK/out.C")"
+has C "Total.test.mdl" && lacks C "Validate.test.mdl" && ok "selection is the subjects alone" || bad "C selection" "$(grep ^unit "$WORK/out.C")"
+
+echo "== D: mxcli cannot open the project (captured exit 1) =="
+RC=$(STUB_NOPROJ=1 run D "$TOTAL")
+[ "$RC" -eq 0 ] && ok "still exit 0 (advisory)" || bad "D rc=$RC"
+has D "callers	NOT MEASURED (mxcli exit 1, 0 of 1 caller blocks: Error: failed to connect: mpr file not found" && ok "names the exit and mxcli's error" || bad "D callers" "$(grep ^callers "$WORK/out.D")"
+has D "Total.test.mdl" && ok "falls back to the subjects" || bad "D fallback"
+
+echo "== E: the project's strategy row wins =="
+cat > "$P/PROJECT.md" <<'EOF'
+# Project
+
+## Test strategy
+| Moment | Unit tests | Journeys | Status |
+|---|---|---|---|
+| Every change | none | module | CONFIRMED |
+| Module close | module | module | CONFIRMED |
+| Deploy-ready | full | full | ASSUMED |
+
+## Next
+| Every change | full | full | not this section |
+EOF
+run E "$TOTAL" >/dev/null
+has E "strategy	change	unit=none journeys=module	(PROJECT.md ## Test strategy, row 'Every change', CONFIRMED)" && ok "row read, status carried" || bad "E strategy" "$(head -1 "$WORK/out.E")"
+has E "unit	none	scope none: strategy says none" && ok "unit none per strategy" || bad "E unit" "$(grep ^unit "$WORK/out.E")"
+has E "journey	journeys/Shop.journey.json	module Shop" && lacks E "edit.clerk" && ok "journeys at module scope" || bad "E journeys" "$(grep ^journey "$WORK/out.E")"
+[ "$(calls)" = 0 ] && ok "no affected scope, so no mxcli call" || bad "E called mxcli"
+printf '## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
+run E2 "$TOTAL" >/dev/null
+has E2 "unit scope 'sometimes' unknown, default used" && has E2 "unit=affected" && ok "an unknown scope falls back and says so" || bad "E2" "$(head -1 "$WORK/out.E2")"
+rm -f "$P/PROJECT.md"
+
+echo "== F: deploy-ready default is the full suite =="
+run F --moment deploy "$TOTAL" >/dev/null
+has F "unit=full journeys=full" && [ "$(grep -c '^unit	' "$WORK/out.F")" = 5 ] && [ "$(grep -c '^journey	' "$WORK/out.F")" = 4 ] \
+  && ok "all 5 test files, all 4 journey files" || bad "F full" "$(grep -e ^unit -e ^journey "$WORK/out.F")"
+[ "$(calls)" = 0 ] && ok "no mxcli call at deploy-ready" || bad "F called mxcli"
+run F2 --moment module --module Admin >/dev/null
+has F2 "Other.test.mdl	names module Admin" && has F2 "journeys/Admin.journey.json" && ok "module close of a named module, no script needed" || bad "F2" "$(cat "$WORK/out.F2")"
+
+echo "== G: an entity change selects its module's tests, no caller query =="
+run G "$ENTITY" >/dev/null
+has G "subject	entity	Shop.Order" && ok "entity subject" || bad "G subject" "$(grep ^subject "$WORK/out.G")"
+has G "callers	not needed" && [ "$(calls)" = 0 ] && ok "no caller query for an entity" || bad "G callers" "$(grep ^callers "$WORK/out.G")"
+has G "Total.test.mdl	names module Shop (data or access change)" && has G "Lookalike.test.mdl" && lacks G "Other.test.mdl" \
+  && ok "every Shop test, not Admin's" || bad "G unit" "$(grep ^unit "$WORK/out.G")"
+
+echo "== H: usage =="
+RC=$(run H --moment later "$TOTAL"); [ "$RC" -eq 2 ] && ok "bad --moment exits 2" || bad "H rc=$RC"
+RC=$(run H2 "$WORK/no-such.mdl"); [ "$RC" -eq 2 ] && ok "missing script exits 2" || bad "H2 rc=$RC"
+RC=$(run H3); [ "$RC" -eq 2 ] && ok "a change with no script exits 2" || bad "H3 rc=$RC"
+[ ! -e "$P/.mxcli" ] && ok "wrote nothing into the project" || bad "project written"
+
+echo "== wiring =="
+grep -q 'affected-tests.sh' "$TOOLKIT/bin/lib/install-manifest.sh" && ok "named in install-manifest.sh" || bad "not in install-manifest.sh"
+grep -q 'affected tests: ./bin/affected-tests.sh' "$TOOLKIT/project-bin/exec.sh" && ok "exec.sh points at it" || bad "exec.sh hint missing"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-exec-step-times.sh b/tests/wave2/test-exec-step-times.sh
new file mode 100644
index 00000000..ce54b339
--- /dev/null
+++ b/tests/wave2/test-exec-step-times.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Fixture for exec.sh's per-step seconds and its --subjects advisory mode (2026-10-16).
+#
+# usage: bash tests/wave2/test-exec-step-times.sh [/path/to/exec.sh]
+#
+# WHY. A BUILD-LOG row carried only the run total, so nobody could say where an exec's time
+# went (a five-app lab project: 28-41 s per exec, split unknown). exec.sh now marks each step
+# and prints "steps: guards Ns check Ns snapshot Ns baseline Ns exec Ns gate Ns lint Ns" in
+# the summary and in the BUILD-LOG detail. --subjects lists the elements a script writes, one
+# per line, for bin/affected-tests.sh.
+#
+# Golden input is captured, never written: --subjects reads the toolkit's own shipped MDL and
+# fixtures/affected-tests/shop.mdl (exec'd to build that fixture's model). The run case reuses
+# test-exec-hash-verify.sh's stub project; its mxcli replays the verbatim v0.26.0
+# `mxcli fix hashes` / `fix --help` captures (fixtures/mxpatch/, fixtures/property-sets/).
+#
+# Positive control: against master's exec.sh 5 pass, 5 fail. The --subjects listings and the
+# steps line and cell fail; the guards (exit codes, writes nothing, elapsed) pass.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "$0")/../.." && pwd)"
+EXEC_SH="${1:-$TOOLKIT/project-bin/exec.sh}"
+case "$EXEC_SH" in /*) ;; *) EXEC_SH="$PWD/$EXEC_SH" ;; esac
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/exec-st.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+echo "== subject: $EXEC_SH"
+
+echo "== --subjects: real MDL =="
+mkdir -p "$WORK/empty"
+subj() { (cd "$WORK/empty" && bash "$EXEC_SH" --subjects "$1" 2>&1); }
+SHOP="$(subj "$TOOLKIT/tests/wave2/fixtures/affected-tests/shop.mdl")"
+EXP="module	Shop	line 2
+entity	Shop.Order	line 3
+microflow	Shop.SUB_Order_Total	line 7
+microflow	Shop.VAL_Order	line 11
+microflow	Shop.ACT_Order_Submit	line 16
+page	Shop.Order_Edit	line 24
+microflow	Shop.ACT_Order_New	line 33
+page	Shop.Order_Overview	line 38"
+[ "$SHOP" = "$EXP" ] && ok "shop.mdl: module, entity, 4 microflows, 2 pages, each with its line" || bad "shop.mdl" "$SHOP"
+case "$SHOP" in *SUB_Order_Total*SUB_Order_Total*) bad "a CALL MICROFLOW inside a body was listed as a subject" ;; *) ok "calls inside bodies are not subjects" ;; esac
+G="$(subj "$TOOLKIT/examples/stylegallery/mdlsource/gallery/90-gallery-home.mdl")"
+printf '%s\n' "$G" | grep -q '^page	StyleGallery.Gallery_Home	' && printf '%s\n' "$G" | grep -q '^access	StyleGallery.Gallery_Home	' \
+  && ok "CREATE PAGE + GRANT VIEW ON PAGE: page and access (gallery 90-gallery-home)" || bad "gallery" "$G"
+A="$(subj "$TOOLKIT/tests/wave2/fixtures/page-fidelity-mocks/bind-contract-alter.mdl")"
+printf '%s\n' "$A" | grep -q '^page	Demo.Catalog	line 2$' && ok "ALTER PAGE (bind-contract-alter)" || bad "alter" "$A"
+[ -z "$(ls -A "$WORK/empty")" ] && ok "--subjects wrote nothing and needed no .mpr" || bad "wrote into cwd"
+(cd "$WORK/empty" && bash "$EXEC_SH" --subjects "$WORK/no-such.mdl" >/dev/null 2>&1); rc=$?
+[ "$rc" = 2 ] && ok "missing script exits 2" || bad "missing script exited $rc"
+
+echo "== a run prints and logs the step seconds =="
+FX="$TOOLKIT/tests/wave2/fixtures/mxpatch"; PSFX="$TOOLKIT/tests/wave2/fixtures/property-sets"
+P="$WORK/proj"; mkdir -p "$P/bin" "$P/mprcontents/84/77" "$WORK/jdk/bin"
+printf 'not a real model\n' > "$P/Fixture.mpr"
+printf 'bson\n' > "$P/mprcontents/84/77/84776610-13b2-48cb-a265-d5e984d63129.mxunit"
+cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/restore-mpr.sh" "$P/bin/"
+cp "$EXEC_SH" "$P/bin/exec.sh"; chmod +x "$P/bin/"*.sh
+cat > "$P/bin/snapshot-mpr.sh" <<'SNAP'
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/.."
+D=".mpr-snapshots/$(date +%Y%m%d-%H%M%S)-$$-$RANDOM"
+mkdir -p "$D"; cp Fixture.mpr "$D/Fixture.mpr"; cp -r mprcontents "$D/mprcontents"
+echo "Snapshot saved: $D"
+SNAP
+chmod +x "$P/bin/snapshot-mpr.sh"
+printf '#!/usr/bin/env bash\necho "written by the patch" >> "$1"\n' > "$P/patch.sh"
+cat > "$P/mxcli" <<'MXCLI'
+#!/usr/bin/env bash
+case "$1 ${2:-}" in
+  "fix --help") cat "$PSFX/fix-help-v0.26.0.txt"; exit 0 ;;
+  "fix hashes") cat "$FX/verify-clean-v0.26.0.out"; cat "$FX/verify-clean-v0.26.0.err" >&2; exit "$(cat "$FX/verify-clean-v0.26.0.exit")" ;;
+esac
+exit 0
+MXCLI
+cat > "$WORK/mxbuild" <<'MXB'
+#!/usr/bin/env bash
+for a in "$@"; do case "$a" in --write-errors=*) printf '{"problems":[]}' > "${a#--write-errors=}" ;; esac; done
+exit 0
+MXB
+printf '#!/usr/bin/env bash\nexit 0\n' > "$WORK/jdk/bin/java"
+chmod +x "$P/mxcli" "$WORK/mxbuild" "$WORK/jdk/bin/java"
+( cd "$P" && git init -q . && git add -A && git -c user.email=t@t -c user.name=t commit -qm fixture ) >/dev/null 2>&1
+export FX PSFX
+mkdir -p "$WORK/tmp"
+( cd "$P" && TMPDIR="$WORK/tmp" SKIP_BASELINE=1 SP_RESTART=0 MXTK_NO_INSTALL=1 \
+    MXBUILD_PATH="$WORK/mxbuild" JAVA_HOME="$WORK/jdk" ./bin/exec.sh --patch patch.sh ) > "$WORK/out" 2>&1; RC=$?
+[ "$RC" -eq 0 ] && ok "run exit 0" || bad "run rc=$RC" "$(tail -20 "$WORK/out")"
+STEPS="$(grep '^  steps: ' "$WORK/out")"
+printf '%s\n' "$STEPS" | grep -qE '^  steps: guards [0-9]+s check [0-9]+s snapshot [0-9]+s baseline [0-9]+s exec [0-9]+s gate [0-9]+s lint [0-9]+s' \
+  && ok "summary: steps line in pipeline order" || bad "summary steps" "$(grep -n 'elapsed\|steps' "$WORK/out")"
+grep -q '^  elapsed: ' "$WORK/out" && ok "elapsed total still printed" || bad "no elapsed line"
+ROW="$(tail -1 "$P/docs/BUILD-LOG.md" 2>/dev/null)"
+printf '%s\n' "$ROW" | grep -qE '✅ applied .* · steps: guards [0-9]+s check [0-9]+s .*gate [0-9]+s lint [0-9]+s' \
+  && ok "BUILD-LOG detail carries the steps cell" || bad "BUILD-LOG steps" "$ROW"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]