diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6d07c14..25b7acee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 - fix(journey-runner): **a journey file without a string `id` now warns naming the file and uses its basename as the id, so captures are named `<basename>-stepN.png` instead of `undefined-stepN.png`; two journeys ending up with the same id (explicit, or a basename that collides with an explicit id) are refused with exit 2 before the browser opens, naming both files.** The only new refusal is a duplicate id; existing id-less journey files keep running. `journey-examples.md` field table updated ([#383](https://github.com/MendixMau/mxcli-project-toolkit/issues/383)) — joshuamoesa
 - fix(lint-gate): **a ratchet rise now lists the findings that are NEW, not three arbitrary members of the rule.** The baseline keeps a multiset of findings (rule, module, document, message) next to the counts; on a rise the gate prints the surplus per rule, up to three per rule (the rest in `.claude/loop/lint-last.json`), labelled as new or changed findings next to the net rise. An old counts-only baseline falls back to the first three and says they are not necessarily new. Not done here: pre-exec snapshot attribution, a per-slice growth cap, a slice-close lint check (the rest of [#239](https://github.com/MendixMau/mxcli-project-toolkit/issues/239)). Test: `tests/wave2/test-lint-gate-new-findings.sh` — MendixMau (#239)
 - fix(conformance-check): read ledger rows whose pointer cell is bare (no backticks) and treat status `planned` as not-built; a ledger whose acceptance text is also bare prose is still not measured (acceptance must hold a backticked SHOW/DESCRIBE), but it now exits 2 with a FAULT that says rows were found and the text is prose, instead of "shape changed or glob matched nothing" (TK-006, partial: that ledger shape is diagnosed, not fixed) — field report TK-006
+- new(testing): **`project-bin/affected-tests.sh <script.mdl>` computes the unit tests and journeys a change owes (advisory, exit 0), and `exec.sh --subjects` lists the elements a script writes.** `testing-shape.md` §3 defined the per-change subject set in prose only. The script takes the subjects from `exec.sh --subjects`, gets their transitive callers (pages included on mxcli v0.26.0) from ONE batched `SHOW CALLERS OF ... TRANSITIVE` call, and prints the `.test.mdl` and `journeys/<Module>.journey.json` files owed at the moment's scope from the PROJECT.md `## Test strategy` row (defaults when absent), plus run lines; it never runs a model-writing test and says `callers NOT MEASURED` when it has no model. Caller depth for unit tests is `--depth N` or `MXTK_AFFECTED_DEPTH`, default 1. Three selection gaps found in the lab are closed here: a `journeys unmapped N of M` row counts the journey files that name-based selection can never reach (12 of 20 held no qualified name), a journey that names a transitive caller is selected, and an entity, association, enumeration, access, module, module role, user role or constant subject prints a `data NOT MEASURED` row instead of silently owing only its own module. exec.sh prints the `affected tests:` hint on every MDL run. Nothing in the docs is binding yet; the doc and default changes are the separate held PR. Golden callers output captured from mxcli v0.26.0 on a scratch copy of an empty 11.12 app (`tests/wave2/fixtures/affected-tests/CAPTURE.txt`). The unmapped count treats a file in `journeys/` as mapped only when it is named `<Module>.journey.json`. Callers are read fresh on every call: mxcli rebuilds its catalog when the .mpr changed (captured in `CAPTURE-FRESHNESS.txt`). Split out of #409 — a five-app lab project (Mendix 11.15, mxcli v0.26.0)
 - fix(app-restart): **a secret with spaces in quotes is masked whole, and `Pwd` and `Credential` join the secret words.** Follow-up to #403: `--constant "Mod.ApiKey=two words"` and `--db-password 'two words'` printed everything after the first word (the quoted-flag case leaked before #403 too). `mask()` now masks each argument before quoting it for display, so the whole quoted value goes; the executed command is untouched, and a real-launch test proves the started app receives the raw argv; an env assignment at the start of a `--cmd` string keeps the whole command visible; the per-argument seds only run for arguments holding a secret word. The substring match still over-masks names like `Monkey` (Key) and `Turkey`; that is display only, kept, and pinned by a test. `tests/wave2/test-app-restart.sh` gains 22 cases, 8 of them failing on master. — review of #403
 - fix(install-manifest): **a clean toolkit checkout passes its own `project-bin/` manifest self-check, so adopters no longer see the "named by NEITHER list" warning at the top of every sync.** `coverage-check-all.sh` (found by `review-module.sh` through its `_tool` lookup in the toolkit clone) and `ts-sync.sh` (UNPROVEN and SUPERSEDED per its header) join `MXTK_PROJECT_BIN_NOINSTALL` with reasons. New `tests/wave2/test-manifest-clean-checkout.sh` fails, rather than warns, when a `project-bin/` file is in neither list. — joshuamoesa (#381)
 - fix(sync-project): **the "Baseline-only skills cited" warning no longer fires on the toolkit's own wiring block, and no longer sizes a section that does not exist.** The check grepped all of `CLAUDE.md` for `skills/learned-mdl-preflight.md` / `skills/query-the-model.md`, and `wire-agents.sh`'s `mxtk:wiring` block cites the first, so every sync flagged the toolkit's own text; with no "mxcli-project-toolkit Integration" heading it then printed a whole-file word count as "heading to EOF". The wiring block is now stripped before the grep, and the warning is raised only when the heading exists. `tests/wave2/test-sync-dup-heading-exit.sh` T4 flips (no heading: no warning) and gains T7-T9. — joshuamoesa (#382)
diff --git a/bin/lib/install-manifest.sh b/bin/lib/install-manifest.sh
index 13a78191..f8003662 100644
--- a/bin/lib/install-manifest.sh
+++ b/bin/lib/install-manifest.sh
@@ -115,7 +115,7 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # may run itself (stops only the pid run --local recorded for THIS project), and `mxcli test` on a
 # scratch copy under the test-port lock. exec.sh names app-restart.sh in its watch advisory, so
 # it has to be installed beside it.
-MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh"
+MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh"
 
 # Files in project-bin/ that are deliberately NOT installed into projects. The reverse check
 # below flags anything named by NEITHER list, so a new file in project-bin/ has to be either
diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
new file mode 100755
index 00000000..2c701886
--- /dev/null
+++ b/project-bin/affected-tests.sh
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+# affected-tests.sh: which unit tests and journeys a change owes, per the project's test strategy.
+#
+#   ./bin/affected-tests.sh [--moment change|module|deploy] [--module <M>]... [--depth N]
+#                           [--no-model] <script.mdl>...
+#
+# Prints, one row per line, tab-separated:
+#   strategy  <moment>  unit=<scope> journeys=<scope>  (<where the scope came from>)
+#   subject   <kind>    <Module.Name>   line N of <script>
+#   caller    <Module.Name>  depth N     (SHOW CALLERS OF ... TRANSITIVE)
+#   callers   measured | NOT MEASURED (<reason>)
+#   data      NOT MEASURED  <kind> <Module.Name>  (entity/association/enumeration/access/module/role/userrole/constant subject)
+#   unit      <file.test.mdl>  <why>
+#   journey   <file.journey.json>  <why>
+#   journeys  unmapped  N of M journey file(s) cannot be selected by name
+#   run       <the command to run that selection>
+# Exit: 0 printed (an empty selection is printed as "none", never as silence) · 2 usage.
+#
+# WHY (2026-10-16). testing-shape.md §3 defined the per-change "subject set" (changed microflows
+# plus their callers, the pages the change reaches) in prose only; exec.sh printed a lane and
+# nothing computed the set. Measured in a five-app lab project (Mendix 11.15, mxcli v0.26.0):
+# one exec 28-41 s, a full mxcli test about 6 min, conformance 645 s, coverage 377 s. A change
+# that owes three tests was paying for the whole suite whenever an agent chose "to be safe".
+# The maintainer's decision: per change, gate + affected tests only; the full e2e and the full
+# unit suite run at deploy-ready, and each project picks its strategy with the developer (CAC-5).
+#
+# THE STRATEGY. PROJECT.md "## Test strategy" (skills/checkpoints/checkpoint-build.md writes it):
+#   | Moment | Unit tests | Journeys | Status |
+#   | Every change | affected | affected | CONFIRMED |
+#   | Module close | module | module | CONFIRMED |
+#   | Deploy-ready | full | full | CONFIRMED |
+# Scopes: none | affected | module | full. No section, or no row for the moment: these defaults,
+# and the strategy row says "default". --moment picks the row (change is the default).
+#
+# HOW THE SELECTION IS MADE (judgement-free facts only; skills-over-scripts.md):
+#   1. Subjects: `bin/exec.sh --subjects <script>` (the same statement lexer as the change class).
+#   2. Callers: ONE batched `mxcli -p <app>.mpr -c "SHOW CALLERS OF X TRANSITIVE; ..."` for every
+#      microflow, nanoflow, page, snippet and layout subject. Golden input: a verbatim v0.26.0
+#      capture (tests/wave2/fixtures/affected-tests/CAPTURE.txt). Transitive callers include pages
+#      (a button's CALL MICROFLOW, a SHOW PAGE) on v0.26.0. The first call builds mxcli's catalog
+#      (~19 s on a 275-flow app), later ones ~3 s. mxcli rebuilds the catalog when the .mpr
+#      changed, so a call after an exec sees the callers that exec created (measured on v0.26.0). --no-model, no project mxcli, no .mpr, or output
+#      that does not parse: "callers NOT MEASURED", and the selection is the subjects alone.
+#   3. affected unit: *.test.mdl files that name a subject, or a caller at depth <= --depth
+#      (default 1: "the tests of its callers"; MXTK_AFFECTED_DEPTH sets the default, --depth wins). Module, entity, association, enumeration and
+#      access subjects select every test file that names their module (testing-shape.md §3 table).
+#   4. affected journeys: journeys/<M>.journey.json for every module M owning a subject or ANY
+#      transitive caller (a page reached at depth 4 is still a page the change reaches), plus any
+#      journey file (journeys/ or tests/e2e/) that names a subject OR a transitive caller literally.
+#      A journey file that is not named <Module>.journey.json and holds no qualified Module.Name
+#      cannot be selected by name at all; the "journeys unmapped" row counts them, so an empty
+#      selection is never read as "nothing owed".
+#   5. module: every test file naming the module, journeys/<M>.journey.json; the modules are the
+#      subjects' modules plus every --module. full: every test file, every journey file.
+#   6. data subjects (entity, association, enumeration, access, module, module role, user role,
+#      constant): selected by the owning module only (a user role has no module and selects
+#      nothing). Their use in another module's rule, page or microflow is not measured, and a
+#      "data NOT MEASURED" row says so for each one.
+# What it does NOT do: run anything. `mxcli test` writes to the model, so the run rows go through
+# bin/test-scratch.sh (a scratch copy) and the journey runner; the caller runs them.
+#
+# Producer: exec.sh prints "affected tests: ./bin/affected-tests.sh <script>" on every MDL run.
+# Overrides: JOURNEY_DIR (default journeys/), MXCLI (default the project's ./mxcli), MPR_FILE.
+# Bash 3.2 / BSD awk / Git Bash.
+set -uo pipefail
+. "$(dirname "$0")/_common.sh"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+MOMENT="change"; DEPTH="${MXTK_AFFECTED_DEPTH:-1}"; NO_MODEL=0; MODULES=""; SCRIPTS=""
+usage() { sed -n '2,15p' "$0" >&2; exit 2; }
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --moment) MOMENT="${2:-}"; shift 2 ;;
+    --module) MODULES="$MODULES ${2:-}"; shift 2 ;;
+    --depth)  DEPTH="${2:-}"; shift 2 ;;
+    --no-model) NO_MODEL=1; shift ;;
+    -h|--help) usage ;;
+    --*) echo "✗ unknown option $1" >&2; usage ;;
+    *) [ -f "$1" ] || { echo "✗ no such script: $1" >&2; exit 2; }
+       SCRIPTS="$SCRIPTS
+$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"; shift ;;
+  esac
+done
+case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module or deploy" >&2; exit 2 ;; esac
+case "$DEPTH" in ''|*[!0-9]*) echo "✗ --depth takes a number" >&2; exit 2 ;; esac
+SCRIPTS="$(printf '%s\n' "$SCRIPTS" | sed '/^$/d')"
+[ -n "$SCRIPTS" ] || [ "$MOMENT" != change ] || { echo "✗ a change needs at least one script" >&2; usage; }
+
+cd "$PROJECT_ROOT" || exit 2
+JDIR="${JOURNEY_DIR:-journeys}"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+out() { printf '%s\n' "$*"; }
+
+# ── Strategy row ─────────────────────────────────────────────────────────────
+case "$MOMENT" in change) ROW="Every change"; DU=affected; DJ=affected ;;
+                  module) ROW="Module close"; DU=module;   DJ=module ;;
+                  deploy) ROW="Deploy-ready"; DU=full;     DJ=full ;; esac
+U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
+if [ -f PROJECT.md ]; then
+  _row="$(awk -v r="$ROW" '
+    /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
+    on && /^\|/ { split($0, c, "|"); x = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", x)
+                  if (tolower(x) == tolower(r)) { u = c[3]; j = c[4]; s = c[5]
+                    gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
+                    print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
+  if [ -n "$_row" ]; then
+    _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
+    case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
+    case "$_j" in none|affected|module|full) J="$_j" ;; *) FROM="${FROM}row '$ROW' journey scope '$_j' unknown, default used; " ;; esac
+    case "$FROM" in default:*) FROM="PROJECT.md ## Test strategy, row '$ROW'${_s:+, $_s}" ;; *) FROM="${FROM}PROJECT.md ## Test strategy" ;; esac
+  fi
+fi
+out "strategy	$MOMENT	unit=$U journeys=$J	($FROM)"
+
+# ── Subjects ─────────────────────────────────────────────────────────────────
+: > "$WORK/subjects"
+if [ -n "$SCRIPTS" ]; then
+  printf '%s\n' "$SCRIPTS" | while IFS= read -r s; do
+    bash "$HERE/exec.sh" --subjects "$s" 2>/dev/null | while IFS='	' read -r k n l; do
+      printf '%s\t%s\t%s of %s\n' "$k" "$n" "$l" "$(basename "$s")"
+    done
+  done > "$WORK/subjects"
+fi
+while IFS='	' read -r k n w; do out "subject	$k	$n	$w"; done < "$WORK/subjects"
+[ -n "$SCRIPTS" ] && [ ! -s "$WORK/subjects" ] && out "subject	none	-	no model-writing statement in the script(s)"
+mod_of() { printf '%s\n' "${1%%.*}"; }
+awk -F'\t' '$2 != "-" && $1 != "userrole" { split($2, a, "."); print a[1] }' "$WORK/subjects" > "$WORK/modules"
+for m in $MODULES; do echo "$m" >> "$WORK/modules"; done
+sort -u "$WORK/modules" -o "$WORK/modules"
+
+# ── Callers (one batched mxcli call) ─────────────────────────────────────────
+: > "$WORK/callers"
+awk -F'\t' '$1 ~ /^(microflow|nanoflow|page|snippet|layout)$/ { print $2 }' "$WORK/subjects" | sort -u > "$WORK/flowish"
+CALLERS="NOT MEASURED"
+if [ "$U" != affected ] && [ "$J" != affected ]; then
+  CALLERS="not needed (no affected scope at this moment)"
+elif [ ! -s "$WORK/flowish" ]; then
+  CALLERS="not needed (no microflow, nanoflow, page, snippet or layout subject)"
+elif [ "$NO_MODEL" = 1 ]; then
+  CALLERS="NOT MEASURED (--no-model)"
+else
+  MX="${MXCLI:-$(find_project_mxcli 2>/dev/null || true)}"
+  MPR="$(find_mpr 2>/dev/null || true)"
+  if [ -z "$MX" ] || [ ! -x "$MX" ]; then CALLERS="NOT MEASURED (no project mxcli; set MXCLI)"
+  elif [ -z "$MPR" ]; then CALLERS="NOT MEASURED (no .mpr found)"
+  else
+    Q="$(sed 's/.*/SHOW CALLERS OF & TRANSITIVE/' "$WORK/flowish" | awk '{ printf "%s%s", (NR > 1 ? "; " : ""), $0 }')"
+    "$MX" -p "$MPR" -c "$Q" > "$WORK/mx.out" 2> "$WORK/mx.err"; RC=$?
+    _blocks="$(grep -c '^Callers of ' "$WORK/mx.out" 2>/dev/null)" || _blocks=0
+    if [ "$RC" -ne 0 ] || [ "$_blocks" -ne "$(wc -l < "$WORK/flowish" | tr -d ' ')" ]; then
+      _why="$(grep -v -e '^✓' -e '^WARNING: This is a' -e '^[[:space:]]*$' "$WORK/mx.err" | head -1)"
+      CALLERS="NOT MEASURED (mxcli exit $RC, $_blocks of $(wc -l < "$WORK/flowish" | tr -d ' ') caller blocks${_why:+: $_why})"
+    else
+      CALLERS="measured (SHOW CALLERS OF ... TRANSITIVE, $_blocks subject(s))"
+      awk '/^\| *[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]* *\| *[0-9]+ *\|$/ {
+             split($0, c, "|"); n = c[2]; d = c[3]; gsub(/ /, "", n); gsub(/ /, "", d)
+             if (!(n in best) || d + 0 < best[n]) best[n] = d + 0 }
+           END { for (n in best) print n "\t" best[n] }' "$WORK/mx.out" | sort -t '	' -k2,2n -k1,1 > "$WORK/callers"
+    fi
+  fi
+fi
+while IFS='	' read -r n d; do out "caller	$n	depth $d"; done < "$WORK/callers"
+out "callers	$CALLERS"
+awk -F'\t' '$1 ~ /^(entity|association|enumeration|access|module|role|userrole|constant)$/ && $2 != "-" { print $1 "\t" $2 }' "$WORK/subjects" | sort -u |
+  while IFS='	' read -r k n; do
+    if [ "$k" = userrole ]; then out "data	NOT MEASURED	$k $n	(access change; a user role has no owning module, so no test or journey is selected by it)"
+    else out "data	NOT MEASURED	$k $n	(cross-module use not measured; selected by owning module $(mod_of "$n") only)"; fi
+  done
+
+# ── Candidate files ──────────────────────────────────────────────────────────
+find . \( -name .git -o -name .mpr-snapshots -o -name node_modules -o -name deployment \) -prune -o \
+  -type f -name '*.test.mdl' -print 2>/dev/null | sed 's|^\./||' | sort > "$WORK/tests"
+for _d in "$JDIR" tests/e2e; do [ -d "$_d" ] && find "$_d" -type f -name '*.journey.json' 2>/dev/null; done | sed 's|^\./||' | sort -u > "$WORK/journeys"
+
+# names: the strings a test or journey must contain to be selected
+names_for_unit() {
+  awk -F'\t' '$2 != "-" && $1 !~ /^(entity|association|enumeration|access|module|userrole)$/ { print $2 }' "$WORK/subjects"
+  awk -F'\t' -v d="$DEPTH" '$2 + 0 <= d { print $1 }' "$WORK/callers"
+}
+modules_for_unit() { awk -F'\t' '$2 != "-" && $1 ~ /^(entity|association|enumeration|access|module)$/ { split($2, a, "."); print a[1] }' "$WORK/subjects" | sort -u; }
+
+select_unit() {  # $1 = scope; prints "<file>\t<why>"
+  case "$1" in
+    none) ;;
+    full) sed 's/$/	full suite/' "$WORK/tests" ;;
+    module)
+      while IFS= read -r m; do [ -n "$m" ] || continue
+        while IFS= read -r f; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && echo "$f	names module $m"; done < "$WORK/tests"
+      done < "$WORK/modules" ;;
+    affected)
+      names_for_unit | sort -u > "$WORK/unames"
+      [ -s "$WORK/unames" ] && while IFS= read -r f; do
+        _hit="$(grep -o -w -F -f "$WORK/unames" "$f" 2>/dev/null | head -1)"
+        [ -n "$_hit" ] && echo "$f	names $_hit"
+      done < "$WORK/tests"
+      modules_for_unit | while IFS= read -r m; do
+        while IFS= read -r f; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && echo "$f	names module $m (data or access change)"; done < "$WORK/tests"
+      done ;;
+  esac | awk -F'\t' '!seen[$1]++'
+}
+
+select_journeys() {  # $1 = scope; prints "<file>\t<why>"
+  case "$1" in
+    none) ;;
+    full) sed 's/$/	full suite/' "$WORK/journeys" ;;
+    module|affected)
+      { cat "$WORK/modules"; [ "$1" = affected ] && cut -f1 "$WORK/callers" | sed 's/\..*//'; } | sort -u |
+        while IFS= read -r m; do
+          [ -n "$m" ] && [ -f "$JDIR/$m.journey.json" ] && echo "$JDIR/$m.journey.json	module $m"
+        done
+      if [ "$1" = affected ]; then
+        { awk -F'\t' '$2 ~ /\./ { print $2 }' "$WORK/subjects"; cut -f1 "$WORK/callers"; } | sort -u > "$WORK/jnames"
+        [ -s "$WORK/jnames" ] && while IFS= read -r f; do
+          _hit="$(grep -o -w -F -f "$WORK/jnames" "$f" 2>/dev/null | head -1)"
+          [ -n "$_hit" ] && echo "$f	names $_hit"
+        done < "$WORK/journeys"
+      fi ;;
+  esac | awk -F'\t' '!seen[$1]++'
+}
+
+select_unit "$U" > "$WORK/unit.sel"
+select_journeys "$J" > "$WORK/journey.sel"
+if [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
+else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match")"; fi
+if [ -s "$WORK/journey.sel" ]; then sed 's/^/journey	/' "$WORK/journey.sel"
+else out "journey	none	scope $J: $( [ "$J" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/journeys" | tr -d ' ') journey file(s) in $JDIR/ and tests/e2e/ match")"; fi
+
+# Journeys that name-based selection can never reach: not <JDIR>/<Module>.journey.json and no
+# qualified Module.Name inside (they navigate by menu caption). Printed whenever a name-based
+# scope is in play, so "journey none" cannot read as "nothing owed".
+if [ "$J" = affected ] || [ "$J" = module ]; then
+  _tot="$(wc -l < "$WORK/journeys" | tr -d ' ')"; _un=0
+  while IFS= read -r f; do [ -n "$f" ] || continue
+    # mapped by name only when the stem is ONE identifier: <JDIR>/<Module>.journey.json
+    case "$f" in "$JDIR"/*.journey.json)
+      _stem="${f##*/}"; _stem="${_stem%.journey.json}"
+      case "$_stem" in ''|*[!A-Za-z0-9_]*) ;; *) continue ;; esac ;; esac
+    grep -qE '(^|[^A-Za-z0-9_.])[A-Z][A-Za-z0-9_]*\.[A-Z][A-Za-z0-9_]*' "$f" 2>/dev/null || _un=$((_un+1))
+  done < "$WORK/journeys"
+  [ "$_tot" -gt 0 ] && out "journeys	unmapped	$_un of $_tot journey file(s) are not named <Module>.journey.json and hold no qualified Module.Name: selection by name cannot reach them; read them before saying nothing is owed"
+fi
+
+# ── Run rows ─────────────────────────────────────────────────────────────────
+_uf="$(cut -f1 "$WORK/unit.sel" | tr '\n' ' ' | sed 's/ $//')"
+_jf="$(cut -f1 "$WORK/journey.sel" | tr '\n' ' ' | sed 's/ $//')"
+[ -n "$_uf" ] && out "run	./bin/test-scratch.sh -- $_uf --local"
+[ -n "$_jf" ] && out "run	node tests/e2e/journey-runner.js $_jf"
+exit 0
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index a4c85a76..62479d19 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -16,6 +16,8 @@
 #        ./bin/exec.sh --change-class <script.mdl>   (advisory ui-only/logic tag; writes nothing)
 #        ./bin/exec.sh --watch-compat <script.mdl>   (advisory: can `run --local --watch` apply
 #                                                     this, or does the app need a restart; writes nothing)
+#        ./bin/exec.sh --subjects <script.mdl>       (advisory: the elements it writes, one per line;
+#                                                     bin/affected-tests.sh reads it; writes nothing)
 #        ./bin/exec.sh --cr CR-07 <script.mdl>        (any mode: tag the run with its change request)
 #        Leading flags (--cr, --commit-first, then --patch) may come in any order.
 #
@@ -167,6 +169,41 @@ mxtk_change_class() {  # $1 = MDL script; prints "<class>\t<why>"
       printf "ui-only\t%d page/snippet/layout statement(s), nothing else\n", ui
     }' "$1"
 }
+# ── Subjects (advisory, added 2026-10-16) ────────────────────────────────────
+# The elements a script writes: one "<kind>\t<Module.Name>\tline N" row per statement head,
+# kind = the object word before the first qualified name (microflow, page, entity, ...;
+# "access" for GRANT/REVOKE, "userrole" for CREATE/ALTER/DROP USER ROLE, whose name has no module). A head with no qualified name prints "unmapped\t-\tline N".
+# bin/affected-tests.sh turns these into the tests to re-run (testing-shape.md §3 subject set).
+# Same lexer and statement-head rule as the change class; read-only heads are skipped.
+mxtk_subjects() {  # $1 = MDL script
+  awk "$_MXTK_MDL_LEX"'
+    BEGIN { depth = 0; inblock = 0; indollar = 0 }
+    {
+      lex_line($0)
+      t = clean; gsub(/^[ \t]+/, "", t)
+      if (start_depth != 0 || t !~ /^[A-Za-z]/) next
+      n = split(t, o, /[ \t(;{,=]+/)
+      v = toupper(o[1])
+      if (v !~ /^(CREATE|ALTER|DROP|MOVE|GRANT|REVOKE|UPDATE)$/) next
+      if (v == "UPDATE" && toupper(o[2]) != "WIDGETS") next
+      kind = ""; name = ""
+      for (i = 2; i <= n; i++) {
+        if (o[i] ~ /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/) { name = o[i]; break }
+        u = toupper(o[i])
+        if (u ~ /^(MICROFLOW|NANOFLOW|PAGE|PAGES|SNIPPET|LAYOUT|ENTITY|ASSOCIATION|ENUMERATION|CONSTANT|WORKFLOW|RULE)$/) kind = tolower(u)
+        else if (kind == "" && u !~ /^(OR|MODIFY|REPLACE|PERSISTENT|NON-PERSISTENT|IF|NOT|EXISTS)$/) last = tolower(u)
+      }
+      if (name == "" && toupper(o[2]) == "MODULE" && o[3] ~ /^[A-Za-z_][A-Za-z0-9_]*$/) { kind = "module"; name = o[3] }
+      if (toupper(o[2]) == "USER" && toupper(o[3]) == "ROLE" && o[4] ~ /^[A-Za-z_][A-Za-z0-9_]*$/) { kind = "userrole"; name = o[4] }
+      if (v == "GRANT" || v == "REVOKE") kind = "access"
+      else if (v == "UPDATE") kind = "page"
+      else if (kind == "pages") kind = "page"
+      else if (kind == "") kind = last
+      if (name == "") printf "unmapped\t-\tline %d\n", NR
+      else printf "%s\t%s\tline %d\n", kind, name, NR
+      last = ""
+    }' "$1"
+}
 # Leading flags, parsed in ONE loop before anything needs a project, in any order:
 # --cr CR-NN, --commit-first, then optionally --patch (whose next word is the script) or one of
 # the advisory modes. A malformed --cr id, an unknown --flag, or a script name starting with
@@ -190,7 +227,7 @@ while [ $# -gt 0 ]; do
       shift 2 ;;
     --commit-first) COMMIT_FIRST=1; shift ;;
     --patch) PATCH_MODE=1; shift; break ;;
-    --change-class|--watch-compat) ADVISORY="$1"; shift; break ;;
+    --change-class|--watch-compat|--subjects) ADVISORY="$1"; shift; break ;;
     *) break ;;
   esac
 done
@@ -206,6 +243,11 @@ if [ "$ADVISORY" = "--change-class" ]; then
   mxtk_change_class "$1"
   exit 0
 fi
+if [ "$ADVISORY" = "--subjects" ]; then
+  [ -f "${1:-}" ] || { echo "Usage: ./bin/exec.sh --subjects <script.mdl>" >&2; exit 2; }
+  mxtk_subjects "$1"
+  exit 0
+fi
 
 # ── Watch compatibility (advisory, added 2026-10-13) ─────────────────────────
 # After a write, can a running `mxcli run --local --watch` apply it, or will the app keep
@@ -372,6 +414,7 @@ change_lane() {
 if [ -n "$CHANGE_CLASS" ]; then
   echo "→ Change class: $CHANGE_CLASS ($CHANGE_WHY)"
   echo "  test lane (skills/testing-shape.md §3): $(change_lane)"
+  [ "$PATCH_MODE" = "1" ] || echo "  affected tests: ./bin/affected-tests.sh $SCRIPT"
 fi
 
 cd "$PROJECT_ROOT"
diff --git a/tests/wave2/fixtures/affected-tests/CAPTURE-FRESHNESS.txt b/tests/wave2/fixtures/affected-tests/CAPTURE-FRESHNESS.txt
new file mode 100644
index 00000000..57775c1c
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/CAPTURE-FRESHNESS.txt
@@ -0,0 +1,14 @@
+Capture, mxcli v0.26.0 (2026-10-11), scratch copy of a stock Mendix 11 app, 2026-10-16.
+Question: does SHOW CALLERS after an exec see a caller that exec created (cached catalog)?
+
+1) mxcli -p App.mpr -c "SHOW CALLERS OF Administration.ChangePassword TRANSITIVE"
+   (first call: "Catalog cached to .mxcli/catalog.db", Microflows: 20, References: 506)
+   Found 4 caller(s): ChangePasswordForm 1, ShowPasswordForm 2, Account_Edit 3, Account_Overview 4
+
+2) mxcli exec -p App.mpr new-caller.mdl     (create microflow Administration.ZZ_Probe_Caller, which calls ChangePassword)
+   Created microflow: Administration.ZZ_Probe_Caller
+
+3) the same SHOW CALLERS again, 3.6 s (catalog rebuilt because the .mpr changed: Microflows: 21, References: 507)
+   Found 5 caller(s): ChangePasswordForm 1, ZZ_Probe_Caller 1, ShowPasswordForm 2, Account_Edit 3, Account_Overview 4
+
+Result: not stale. The new caller is listed at depth 1.
diff --git a/tests/wave2/fixtures/affected-tests/CAPTURE.txt b/tests/wave2/fixtures/affected-tests/CAPTURE.txt
new file mode 100644
index 00000000..fe003577
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/CAPTURE.txt
@@ -0,0 +1,33 @@
+tests/wave2/fixtures/affected-tests/ : provenance (captured 2026-10-16, macOS arm64)
+
+Every file here is captured output, except this note and shop.mdl, the MDL script that told
+mxcli what to create (it was applied, so it is also real, exec'd MDL).
+
+BINARY: mxcli version v0.26.0 (2026-10-11T18:37:07Z), the darwin-arm64 release asset.
+
+THE MODEL: a scratch copy of an empty Studio Pro 11.12.0 app, then
+    mxcli exec shop.mdl -p Neutral.mpr
+which adds module Shop: entity Order; microflows SUB_Order_Total <- VAL_Order <-
+ACT_Order_Submit (a call chain); page Order_Edit whose button calls ACT_Order_Submit;
+microflow ACT_Order_New, which shows Order_Edit; page Order_Overview whose button calls
+ACT_Order_New. So a change to SUB_Order_Total reaches two pages through five hops.
+
+THE CAPTURES (<name>.out = stdout, .err = stderr, .exit = exit code):
+  callers.*     mxcli -p Neutral.mpr -c "$(cat callers.query)"
+                Four statements in ONE call (the batch affected-tests.sh sends), the first call
+                on the copy, so stderr carries the catalog build. Shows: transitive callers
+                include pages (button CALL MICROFLOW, SHOW PAGE) with their depth; a name with
+                no callers prints "(no callers found)"; one block per statement, in order.
+  val-order.out mxcli -p Neutral.mpr -c "SHOW CALLERS OF Shop.VAL_Order TRANSITIVE", a later
+                call (warm catalog), stdout only.
+  noproj.*      mxcli -p /nonexistent.mpr -c "SHOW CALLERS OF Shop.VAL_Order TRANSITIVE"
+                exit 1, nothing on stdout.
+
+The stub in test-affected-tests.sh replays these per statement: it splits the captured stdout
+into its "Callers of X (transitive)" blocks and prints, verbatim, the block of each statement
+it is asked for, in the order asked. A statement with no captured block fails the stub (99).
+
+FIELD RUN of the script itself (2026-10-16): a scratch copy of a five-app lab project (Mendix
+11.15, mxcli v0.26.0), three of its real change scripts. Per change: 2 to 55 subjects, 8 to 17
+transitive callers, 0 to 1 of the project's unit test files and 0 to 1 of its 20 journey files
+selected, against 1 and 20 at deploy-ready. The first call 19 s (catalog build), later 3 s.
diff --git a/tests/wave2/fixtures/affected-tests/callers.err b/tests/wave2/fixtures/affected-tests/callers.err
new file mode 100644
index 00000000..4bd396ca
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.err
@@ -0,0 +1,57 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+✓ Modules: 11
+✓ Entities: 51
+✓ Attributes: 245
+✓ Entity Event Handlers: 0
+✓ Associations: 49
+✓ Enumerations: 24
+✓ Enumeration values: 151
+✓ Constants: 3
+✓ ConstantValues: 0
+✓ Java Actions: 3
+✓ Java Action Parameters: 4
+✓ JavaScript Actions: 67
+✓ Image Collections: 7
+✓ Icon Collections: 3
+✓ Menus: 2
+✓ Page Templates: 46
+✓ Data Transformers: 0
+✓ Scheduled Events: 0
+✓ Task Queues: 0
+✓ Regular Expressions: 0
+✓ Agent-editor documents: 0
+✓ Microflows: 24
+✓ Nanoflows: 13
+✓ Rules: 0
+✓ Flow parameters: 26
+✓ Activities: 318
+✓ Pages: 19
+✓ Widgets: 229
+✓ Snippets: 4
+✓ Snippet widgets: 4
+✓ Building blocks: 40
+✓ Layouts: 22
+✓ OData Clients: 0
+✓ OData Services: 0
+✓ Business Event Services: 0
+✓ widget_definitions: 42
+✓ Database Connections: 0
+✓ JAR Dependencies: 0
+✓ REST Clients: 0
+✓ Published REST Services: 0
+✓ External Entities: 0
+✓ External Actions: 0
+✓ Business Events: 0
+✓ Contract Entities: 0
+✓ Contract Messages: 0
+✓ Navigation profiles: 1
+✓ Navigation menu items: 1
+✓ RoleMappings: 8
+✓ JSON Structures: 3
+✓ Import Mappings: 2
+✓ Export Mappings: 1
+✓ XPath Expressions: 5
+✓ References: 556
+✓ Permissions: 235
+✓ strings: 1568
+✓ Catalog cached to .mxcli/catalog.db
diff --git a/tests/wave2/fixtures/affected-tests/callers.exit b/tests/wave2/fixtures/affected-tests/callers.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/affected-tests/callers.out b/tests/wave2/fixtures/affected-tests/callers.out
new file mode 100644
index 00000000..fc8cbdb1
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.out
@@ -0,0 +1,26 @@
+
+Callers of Shop.SUB_Order_Total (transitive)
+Found 5 caller(s)
+| Caller                | Depth |
+|-----------------------|-------|
+| Shop.VAL_Order        | 1     |
+| Shop.ACT_Order_Submit | 2     |
+| Shop.Order_Edit       | 3     |
+| Shop.ACT_Order_New    | 4     |
+| Shop.Order_Overview   | 5     |
+
+Callers of Shop.Order_Edit (transitive)
+Found 2 caller(s)
+| Caller              | Depth |
+|---------------------|-------|
+| Shop.ACT_Order_New  | 1     |
+| Shop.Order_Overview | 2     |
+
+Callers of Shop.ACT_Order_New (transitive)
+Found 1 caller(s)
+| Caller              | Depth |
+|---------------------|-------|
+| Shop.Order_Overview | 1     |
+
+Callers of Shop.NoSuchFlow (transitive)
+(no callers found)
diff --git a/tests/wave2/fixtures/affected-tests/callers.query b/tests/wave2/fixtures/affected-tests/callers.query
new file mode 100644
index 00000000..458285d6
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/callers.query
@@ -0,0 +1 @@
+SHOW CALLERS OF Shop.SUB_Order_Total TRANSITIVE; SHOW CALLERS OF Shop.Order_Edit TRANSITIVE; SHOW CALLERS OF Shop.ACT_Order_New TRANSITIVE; SHOW CALLERS OF Shop.NoSuchFlow TRANSITIVE
diff --git a/tests/wave2/fixtures/affected-tests/noproj.err b/tests/wave2/fixtures/affected-tests/noproj.err
new file mode 100644
index 00000000..56fc47cd
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/noproj.err
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+Error: failed to connect: mpr file not found: /nonexistent.mpr
diff --git a/tests/wave2/fixtures/affected-tests/noproj.exit b/tests/wave2/fixtures/affected-tests/noproj.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/noproj.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/affected-tests/noproj.out b/tests/wave2/fixtures/affected-tests/noproj.out
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/wave2/fixtures/affected-tests/shop.mdl b/tests/wave2/fixtures/affected-tests/shop.mdl
new file mode 100644
index 00000000..f23190ca
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/shop.mdl
@@ -0,0 +1,43 @@
+mdl 1;
+create module Shop;
+create or modify persistent entity Shop.Order (
+  Amount: Decimal,
+  Status: String(30)
+);
+create or modify microflow Shop.SUB_Order_Total ($Order: Shop.Order) returns Decimal
+begin
+  return $Order/Amount;
+end;
+create or modify microflow Shop.VAL_Order ($Order: Shop.Order) returns Boolean
+begin
+  $Total = call microflow Shop.SUB_Order_Total(Order = $Order);
+  return $Total > 0;
+end;
+create or modify microflow Shop.ACT_Order_Submit ($Order: Shop.Order)
+begin
+  $Ok = call microflow Shop.VAL_Order(Order = $Order);
+  if $Ok then
+    change $Order (Status = 'Submitted');
+    commit $Order;
+  end if;
+end;
+create or modify page Shop.Order_Edit (
+  Title: 'Order',
+  Layout: Atlas_Core.Atlas_Default,
+  Params: ( $Order: Shop.Order )
+) {
+  dataview dvOrder (DataSource: $Order) {
+    actionbutton btnSubmit (Caption: 'Submit', Action: CALL MICROFLOW Shop.ACT_Order_Submit(Order = $currentObject), ButtonStyle: Primary)
+  }
+};
+create or modify microflow Shop.ACT_Order_New ()
+begin
+  $Order = create Shop.Order (Status = 'Draft');
+  show page Shop.Order_Edit(Order = $Order);
+end;
+create or modify page Shop.Order_Overview (
+  Title: 'Orders',
+  Layout: Atlas_Core.Atlas_Default
+) {
+  actionbutton btnNew (Caption: 'New', Action: CALL MICROFLOW Shop.ACT_Order_New, ButtonStyle: Default)
+};
diff --git a/tests/wave2/fixtures/affected-tests/val-order.out b/tests/wave2/fixtures/affected-tests/val-order.out
new file mode 100644
index 00000000..dbc9b47a
--- /dev/null
+++ b/tests/wave2/fixtures/affected-tests/val-order.out
@@ -0,0 +1,9 @@
+
+Callers of Shop.VAL_Order (transitive)
+Found 4 caller(s)
+| Caller                | Depth |
+|-----------------------|-------|
+| Shop.ACT_Order_Submit | 1     |
+| Shop.Order_Edit       | 2     |
+| Shop.ACT_Order_New    | 3     |
+| Shop.Order_Overview   | 4     |
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
new file mode 100644
index 00000000..21894794
--- /dev/null
+++ b/tests/wave2/test-affected-tests.sh
@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/affected-tests.sh: which unit tests and journeys a change owes,
+# per the project's PROJECT.md "## Test strategy" row (defaults when it has none).
+#
+# usage: bash tests/wave2/test-affected-tests.sh [/path/to/affected-tests.sh]
+#
+# Golden input is captured, never written: the change scripts are line ranges of
+# fixtures/affected-tests/shop.mdl (the MDL that was exec'd to build the captured model), and
+# the stub mxcli replays, per statement, the verbatim `SHOW CALLERS OF ... TRANSITIVE` blocks
+# mxcli v0.26.0 printed for that model (provenance: fixtures/affected-tests/CAPTURE.txt).
+# The .test.mdl and journey files in the stub project are project content, not instrument
+# output: they only need to name (or not name) the captured elements.
+#
+# Gap checks (found measuring a five-app lab project, 18 of 20 journey files were named by app and
+# role, 12 of 20 held no qualified name): the unmapped-journey count is printed (A, F), a journey
+# that names a transitive CALLER is selected (A, B; --no-model does not), and a data subject
+# prints a "data NOT MEASURED" row (G, I) so an enumeration used in another module is never
+# silently owed nothing. MXTK_AFFECTED_DEPTH sets the default depth (A3).
+#
+# Positive control: against master (no affected-tests.sh) the negative guards hold and the rest
+# fail. With names_for_unit's caller rows removed, A2 and the --depth 2 case fail; with grep -w
+# dropped, A's look-alike guard fails; with the caller names dropped from jnames, the caller
+# journey case fails.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "$0")/../.." && pwd)"
+SUBJECT="${1:-$TOOLKIT/project-bin/affected-tests.sh}"
+case "$SUBJECT" in /*) ;; *) SUBJECT="$PWD/$SUBJECT" ;; esac
+FX="$TOOLKIT/tests/wave2/fixtures/affected-tests"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected-t.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+echo "== subject: $SUBJECT"
+
+P="$WORK/proj"
+mkdir -p "$P/bin" "$P/tests/unit" "$P/journeys" "$P/tests/e2e"
+printf 'not a real model\n' > "$P/Fixture.mpr"
+cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/exec.sh" "$P/bin/"
+cp "$SUBJECT" "$P/bin/affected-tests.sh"
+chmod +x "$P/bin/"*.sh
+
+# Project content: tests naming the captured elements, one look-alike, one other module.
+t() { printf '/**\n * @test %s\n */\ncall microflow %s();\n/\n' "$2" "$2" > "$P/tests/unit/$1.test.mdl"; }
+t Total    Shop.SUB_Order_Total
+t Validate Shop.VAL_Order
+t Submit   Shop.ACT_Order_Submit
+t Lookalike Shop.SUB_Order_Total_Legacy
+t Other    Admin.ACT_Reset
+echo '{"id":"J-1","steps":[]}' > "$P/journeys/Shop.journey.json"
+echo '{"id":"J-2","steps":[]}' > "$P/journeys/Admin.journey.json"
+echo '{"id":"J-3","note":"opens Shop.Order_Edit","steps":[]}' > "$P/tests/e2e/edit.clerk.journey.json"
+echo '{"id":"J-6","steps":[]}' > "$P/journeys/Shop.admin.journey.json"   # in journeys/, not <Module>.journey.json, names nothing
+echo '{"id":"J-4","steps":[]}' > "$P/tests/e2e/home.clerk.journey.json"
+echo '{"id":"J-5","note":"starts on Shop.Order_Overview","steps":[]}' > "$P/tests/e2e/overview.clerk.journey.json"
+
+# Stub mxcli: one call = one -c query; prints the captured block of each statement, in order.
+cat > "$P/mxcli" <<'MXCLI'
+#!/usr/bin/env bash
+D="$(cd "$(dirname "$0")" && pwd)"
+printf '%s\n' "$*" >> "$D/.stub-log"
+[ "${STUB_NOPROJ:-}" = 1 ] && { cat "$FX/noproj.out"; cat "$FX/noproj.err" >&2; exit "$(cat "$FX/noproj.exit")"; }
+q=""; while [ $# -gt 0 ]; do [ "$1" = -c ] && q="$2"; shift; done
+cat "$FX/callers.err" >&2
+first=1
+printf '%s\n' "$q" | tr ';' '\n' | sed -n 's/^ *SHOW CALLERS OF \([^ ]*\) TRANSITIVE *$/\1/p' | while IFS= read -r n; do
+  blk="$(cat "$FX/callers.out" "$FX/val-order.out" | awk -v n="$n" '
+    $0 == "Callers of " n " (transitive)" { on = 1 } on && /^$/ { exit } on { print }')"
+  [ -n "$blk" ] || { echo "stub: no captured block for $n" >&2; exit 99; }
+  [ "$first" = 1 ] || echo; first=0; printf '%s\n' "$blk"
+done || exit 99
+exit "$(cat "$FX/callers.exit")"
+MXCLI
+chmod +x "$P/mxcli"
+export FX
+
+lines() { sed -n "$1p" "$FX/shop.mdl" > "$WORK/$2"; echo "$WORK/$2"; }
+TOTAL="$(lines 7,10 total.mdl)"           # create or modify microflow Shop.SUB_Order_Total
+ENTITY="$(lines 3,6 entity.mdl)"          # create or modify persistent entity Shop.Order
+{ sed -n 24,32p "$FX/shop.mdl"; sed -n 33,37p "$FX/shop.mdl"; } > "$WORK/page-and-flow.mdl"
+PAGEFLOW="$WORK/page-and-flow.mdl"        # page Shop.Order_Edit + microflow Shop.ACT_Order_New
+
+run() {  # run <label> [args...]; env passes through
+  _l="$1"; shift; rm -f "$P/.stub-log"
+  ( cd "$P" && ./bin/affected-tests.sh "$@" ) > "$WORK/out.$_l" 2> "$WORK/err.$_l"; echo $?
+}
+has()   { grep -qF -- "$2" "$WORK/out.$1"; }
+lacks() { ! grep -qF -- "$2" "$WORK/out.$1"; }
+calls() { if [ -f "$P/.stub-log" ]; then wc -l < "$P/.stub-log" | tr -d ' '; else echo 0; fi; }
+
+echo "== A: one microflow change, defaults (no PROJECT.md) =="
+RC=$(run A "$TOTAL")
+[ "$RC" -eq 0 ] && ok "exit 0" || bad "A rc=$RC" "$(cat "$WORK/err.A")"
+has A "strategy	change	unit=affected journeys=affected	(default:" && ok "strategy row says default affected/affected" || bad "A strategy" "$(head -1 "$WORK/out.A")"
+has A "subject	microflow	Shop.SUB_Order_Total	line 1 of total.mdl" && ok "subject from exec.sh --subjects" || bad "A subject" "$(cat "$WORK/out.A")"
+[ "$(calls)" = 1 ] && grep -qx -- '-p .*Fixture.mpr -c SHOW CALLERS OF Shop.SUB_Order_Total TRANSITIVE' "$P/.stub-log" \
+  && ok "one mxcli call, the transitive callers query" || bad "A mxcli calls" "$(cat "$P/.stub-log" 2>/dev/null)"
+has A "caller	Shop.VAL_Order	depth 1" && has A "caller	Shop.Order_Overview	depth 5" && ok "five transitive callers, pages included" || bad "A callers" "$(grep caller "$WORK/out.A")"
+has A "callers	measured" && ok "callers measured" || bad "A measured"
+has A "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && ok "A1 the subject's own test" || bad "A1" "$(grep ^unit "$WORK/out.A")"
+has A "unit	tests/unit/Validate.test.mdl	names Shop.VAL_Order" && ok "A2 the depth-1 caller's test" || bad "A2" "$(grep ^unit "$WORK/out.A")"
+lacks A "Submit.test.mdl" && ok "A3 a depth-2 caller's test is not owed at --depth 1" || bad "A3 Submit selected at depth 1"
+lacks A "Lookalike.test.mdl" && ok "a look-alike name (SUB_Order_Total_Legacy) is not a match" || bad "A look-alike selected"
+lacks A "Other.test.mdl" && ok "another module's test not selected" || bad "A Other selected"
+has A "journey	journeys/Shop.journey.json	module Shop" && ok "the module journey of the subject and its callers" || bad "A journey" "$(grep ^journey "$WORK/out.A")"
+lacks A "Admin.journey.json" && lacks A "home.clerk" && ok "unrelated journeys not selected" || bad "A unrelated journey"
+has A "journey	tests/e2e/overview.clerk.journey.json	names Shop.Order_Overview" && ok "a journey that names a transitive CALLER is selected" || bad "A caller journey" "$(grep ^journey "$WORK/out.A")"
+has A "journeys	unmapped	2 of 6 journey file(s)" && ok "unmapped count: home.clerk AND journeys/Shop.admin.journey.json (a file in journeys/ is mapped only when named <Module>.journey.json)" || bad "A unmapped" "$(grep ^journeys "$WORK/out.A")"
+lacks A "data	NOT MEASURED" && ok "no data row for a microflow change" || bad "A data row"
+has A "run	./bin/test-scratch.sh -- tests/unit/Total.test.mdl tests/unit/Validate.test.mdl --local" && ok "run row: test-scratch on the selection" || bad "A run unit" "$(grep ^run "$WORK/out.A")"
+has A "run	node tests/e2e/journey-runner.js journeys/Shop.journey.json" && ok "run row: journey runner" || bad "A run journey"
+
+echo "== A2: --depth 2 adds the depth-2 caller's test =="
+run A2 --depth 2 "$TOTAL" >/dev/null
+has A2 "unit	tests/unit/Submit.test.mdl	names Shop.ACT_Order_Submit" && ok "Submit selected at depth 2" || bad "A2 depth 2" "$(grep ^unit "$WORK/out.A2")"
+
+echo "== A3: MXTK_AFFECTED_DEPTH sets the default depth, --depth wins =="
+MXTK_AFFECTED_DEPTH=2 run A3 "$TOTAL" >/dev/null
+has A3 "unit	tests/unit/Submit.test.mdl" && ok "env depth 2 selects Submit" || bad "A3 env" "$(grep ^unit "$WORK/out.A3")"
+MXTK_AFFECTED_DEPTH=2 run A4 --depth 1 "$TOTAL" >/dev/null
+lacks A4 "Submit.test.mdl" && ok "--depth 1 beats the env" || bad "A4 flag vs env"
+
+echo "== B: a page and a microflow in one script: ONE batched call =="
+run B "$PAGEFLOW" >/dev/null
+[ "$(calls)" = 1 ] && grep -qx -- '-p .*Fixture.mpr -c SHOW CALLERS OF Shop.ACT_Order_New TRANSITIVE; SHOW CALLERS OF Shop.Order_Edit TRANSITIVE' "$P/.stub-log" \
+  && ok "both subjects in one -c batch" || bad "B batch" "$(cat "$P/.stub-log" 2>/dev/null)"
+has B "subject	page	Shop.Order_Edit" && has B "subject	microflow	Shop.ACT_Order_New" && ok "both subjects listed" || bad "B subjects" "$(grep ^subject "$WORK/out.B")"
+has B "caller	Shop.Order_Overview	depth 1" && ok "shortest depth kept for a caller reached twice" || bad "B depth" "$(grep ^caller "$WORK/out.B")"
+has B "journey	tests/e2e/edit.clerk.journey.json	names Shop.Order_Edit" && ok "a journey that names the changed page" || bad "B named journey" "$(grep ^journey "$WORK/out.B")"
+has B "unit	none	scope affected: 0 of 5" && ok "no matching test says so (never silence)" || bad "B unit none" "$(grep ^unit "$WORK/out.B")"
+
+echo "== C: --no-model =="
+run C --no-model "$TOTAL" >/dev/null
+[ "$(calls)" = 0 ] && ok "mxcli not called" || bad "C called mxcli"
+has C "callers	NOT MEASURED (--no-model)" && ok "callers NOT MEASURED, and why" || bad "C callers" "$(grep ^callers "$WORK/out.C")"
+lacks C "overview.clerk" && ok "no callers, so no caller-named journey" || bad "C caller journey"
+has C "Total.test.mdl" && lacks C "Validate.test.mdl" && ok "selection is the subjects alone" || bad "C selection" "$(grep ^unit "$WORK/out.C")"
+
+echo "== D: mxcli cannot open the project (captured exit 1) =="
+RC=$(STUB_NOPROJ=1 run D "$TOTAL")
+[ "$RC" -eq 0 ] && ok "still exit 0 (advisory)" || bad "D rc=$RC"
+has D "callers	NOT MEASURED (mxcli exit 1, 0 of 1 caller blocks: Error: failed to connect: mpr file not found" && ok "names the exit and mxcli's error" || bad "D callers" "$(grep ^callers "$WORK/out.D")"
+has D "Total.test.mdl" && ok "falls back to the subjects" || bad "D fallback"
+
+echo "== E: the project's strategy row wins =="
+cat > "$P/PROJECT.md" <<'EOF'
+# Project
+
+## Test strategy
+| Moment | Unit tests | Journeys | Status |
+|---|---|---|---|
+| Every change | none | module | CONFIRMED |
+| Module close | module | module | CONFIRMED |
+| Deploy-ready | full | full | ASSUMED |
+
+## Next
+| Every change | full | full | not this section |
+EOF
+run E "$TOTAL" >/dev/null
+has E "strategy	change	unit=none journeys=module	(PROJECT.md ## Test strategy, row 'Every change', CONFIRMED)" && ok "row read, status carried" || bad "E strategy" "$(head -1 "$WORK/out.E")"
+has E "unit	none	scope none: strategy says none" && ok "unit none per strategy" || bad "E unit" "$(grep ^unit "$WORK/out.E")"
+has E "journey	journeys/Shop.journey.json	module Shop" && lacks E "edit.clerk" && ok "journeys at module scope" || bad "E journeys" "$(grep ^journey "$WORK/out.E")"
+[ "$(calls)" = 0 ] && ok "no affected scope, so no mxcli call" || bad "E called mxcli"
+printf '## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
+run E2 "$TOTAL" >/dev/null
+has E2 "unit scope 'sometimes' unknown, default used" && has E2 "unit=affected" && ok "an unknown scope falls back and says so" || bad "E2" "$(head -1 "$WORK/out.E2")"
+rm -f "$P/PROJECT.md"
+
+echo "== F: deploy-ready default is the full suite =="
+run F --moment deploy "$TOTAL" >/dev/null
+has F "unit=full journeys=full" && [ "$(grep -c '^unit	' "$WORK/out.F")" = 5 ] && [ "$(grep -c '^journey	' "$WORK/out.F")" = 6 ] \
+  && ok "all 5 test files, all 6 journey files" || bad "F full" "$(grep -e ^unit -e ^journey "$WORK/out.F")"
+[ "$(calls)" = 0 ] && ok "no mxcli call at deploy-ready" || bad "F called mxcli"
+run F2 --moment module --module Admin >/dev/null
+has F2 "Other.test.mdl	names module Admin" && has F2 "journeys/Admin.journey.json" && ok "module close of a named module, no script needed" || bad "F2" "$(cat "$WORK/out.F2")"
+
+echo "== G: an entity change selects its module's tests, no caller query =="
+run G "$ENTITY" >/dev/null
+has G "subject	entity	Shop.Order" && ok "entity subject" || bad "G subject" "$(grep ^subject "$WORK/out.G")"
+has G "data	NOT MEASURED	entity Shop.Order	(cross-module use not measured; selected by owning module Shop only)" && ok "data NOT MEASURED row for the entity" || bad "G data row" "$(grep ^data "$WORK/out.G")"
+has G "callers	not needed" && [ "$(calls)" = 0 ] && ok "no caller query for an entity" || bad "G callers" "$(grep ^callers "$WORK/out.G")"
+has G "Total.test.mdl	names module Shop (data or access change)" && has G "Lookalike.test.mdl" && lacks G "Other.test.mdl" \
+  && ok "every Shop test, not Admin's" || bad "G unit" "$(grep ^unit "$WORK/out.G")"
+
+echo "== I: an enumeration change, and a mixed script =="
+printf "create or modify enumeration Shop.OrderStatus (\n  Draft 'Draft',\n  Done 'Done'\n);\n" > "$WORK/enum.mdl"
+run I "$WORK/enum.mdl" >/dev/null
+has I "subject	enumeration	Shop.OrderStatus" && has I "data	NOT MEASURED	enumeration Shop.OrderStatus" && ok "enumeration: subject and NOT MEASURED row" || bad "I enum" "$(grep -e ^subject -e ^data "$WORK/out.I")"
+has I "unit	tests/unit/Total.test.mdl	names module Shop (data or access change)" && ok "still selected by owning module" || bad "I unit" "$(grep ^unit "$WORK/out.I")"
+cat "$WORK/enum.mdl" "$TOTAL" > "$WORK/mixed.mdl"
+run I2 "$WORK/mixed.mdl" >/dev/null
+[ "$(grep -c '^data	NOT MEASURED' "$WORK/out.I2")" = 1 ] && has I2 "callers	measured" && ok "mixed: one data row, callers still measured for the microflow" || bad "I2 mixed" "$(grep -e ^data -e ^callers "$WORK/out.I2")"
+
+echo "== J: role, user role and constant subjects print data NOT MEASURED =="
+cat > "$WORK/roles.mdl" <<'EOF'
+create module role Shop.Manager;
+create user role Admin (Shop.Manager);
+create or modify constant Shop.MaxItems type Integer default 5;
+EOF
+run J "$WORK/roles.mdl" >/dev/null
+has J "subject	role	Shop.Manager" && has J "subject	userrole	Admin" && has J "subject	constant	Shop.MaxItems" && ok "three subjects, none unmapped" || bad "J subjects" "$(grep ^subject "$WORK/out.J")"
+has J "data	NOT MEASURED	role Shop.Manager	(cross-module use not measured" && ok "module role row" || bad "J role" "$(grep ^data "$WORK/out.J")"
+has J "data	NOT MEASURED	constant Shop.MaxItems	(cross-module use not measured" && ok "constant row" || bad "J constant" "$(grep ^data "$WORK/out.J")"
+has J "data	NOT MEASURED	userrole Admin	(access change" && ok "user role row" || bad "J userrole" "$(grep ^data "$WORK/out.J")"
+lacks J "module Admin" && lacks J "Other.test.mdl" && ok "a user role name is never read as a module" || bad "J userrole as module" "$(cat "$WORK/out.J")"
+printf 'alter user role Admin add module roles (Shop.Manager);\ndrop user role Old;\n' > "$WORK/roles2.mdl"
+run J2 "$WORK/roles2.mdl" >/dev/null
+[ "$(grep -c '^subject	userrole	' "$WORK/out.J2")" = 2 ] && ok "ALTER and DROP USER ROLE are subjects too" || bad "J2" "$(grep ^subject "$WORK/out.J2")"
+
+echo "== K: a caller added by an exec shows up on the next call (no stale cache) =="
+# The real catalog: on mxcli v0.26.0 a scratch copy had 4 transitive callers of a microflow;
+# after `exec` created a microflow calling it, the next SHOW CALLERS rebuilt the catalog
+# ("Catalog cached to .mxcli/catalog.db", the .mpr had changed) and listed 5, the new one at
+# depth 1 (fixtures/affected-tests/CAPTURE-FRESHNESS.txt). The script keeps no state of its own,
+# so it must pass that through. The stub below behaves like that capture: output follows the .mpr.
+cat > "$P/mxcli" <<'MXCLI'
+#!/usr/bin/env bash
+D="$(cd "$(dirname "$0")" && pwd)"
+echo "Callers of Shop.SUB_Order_Total (transitive)"
+echo "| Caller | Depth |"
+echo "|---|---|"
+echo "| Shop.VAL_Order | 1 |"
+grep -q ADDED "$D/Fixture.mpr" && echo "| Shop.ZZ_New_Caller | 1 |"
+exit 0
+MXCLI
+printf 'not a real model\n' > "$P/Fixture.mpr"
+run K1 "$TOTAL" >/dev/null
+lacks K1 "Shop.ZZ_New_Caller" && ok "before the exec: the new caller is not there" || bad "K1"
+printf 'not a real model\nADDED\n' > "$P/Fixture.mpr"      # what an exec does to the model
+run K2 "$TOTAL" >/dev/null
+has K2 "caller	Shop.ZZ_New_Caller	depth 1" && has K2 "callers	measured" && ok "after the exec: the new caller is listed, callers measured" || bad "K2 stale" "$(grep -e ^caller "$WORK/out.K2")"
+[ ! -e "$P/.mxcli" ] && [ ! -e "$P/.affected-cache" ] && ok "the script keeps no cache of its own" || bad "K cache file"
+
+echo "== H: usage =="
+RC=$(run H --moment later "$TOTAL"); [ "$RC" -eq 2 ] && ok "bad --moment exits 2" || bad "H rc=$RC"
+RC=$(run H2 "$WORK/no-such.mdl"); [ "$RC" -eq 2 ] && ok "missing script exits 2" || bad "H2 rc=$RC"
+RC=$(run H3); [ "$RC" -eq 2 ] && ok "a change with no script exits 2" || bad "H3 rc=$RC"
+[ ! -e "$P/.mxcli" ] && ok "wrote nothing into the project" || bad "project written"
+
+echo "== wiring =="
+grep -q 'affected-tests.sh' "$TOOLKIT/bin/lib/install-manifest.sh" && ok "named in install-manifest.sh" || bad "not in install-manifest.sh"
+grep -q 'affected tests: ./bin/affected-tests.sh' "$TOOLKIT/project-bin/exec.sh" && ok "exec.sh points at it" || bad "exec.sh hint missing"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-exec-subjects.sh b/tests/wave2/test-exec-subjects.sh
new file mode 100644
index 00000000..bceceffe
--- /dev/null
+++ b/tests/wave2/test-exec-subjects.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Fixture for exec.sh's --subjects advisory mode (2026-10-16).
+#
+# usage: bash tests/wave2/test-exec-subjects.sh [/path/to/exec.sh]
+#
+# --subjects lists the elements a script writes, one "<kind>\t<Module.Name>\tline N" row each,
+# for project-bin/affected-tests.sh. It writes nothing and needs no .mpr.
+#
+# Golden input is captured, never written: it reads the toolkit's own shipped MDL and
+# fixtures/affected-tests/shop.mdl (the MDL that was exec'd to build that fixture's model).
+#
+# Positive control: against master's exec.sh the listings fail (it has no --subjects and treats
+# the flag as a script name); the guards that nothing is written pass.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "$0")/../.." && pwd)"
+EXEC_SH="${1:-$TOOLKIT/project-bin/exec.sh}"
+case "$EXEC_SH" in /*) ;; *) EXEC_SH="$PWD/$EXEC_SH" ;; esac
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/exec-subj.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+echo "== subject: $EXEC_SH"
+
+echo "== --subjects: real MDL =="
+mkdir -p "$WORK/empty"
+subj() { (cd "$WORK/empty" && bash "$EXEC_SH" --subjects "$1" 2>&1); }
+SHOP="$(subj "$TOOLKIT/tests/wave2/fixtures/affected-tests/shop.mdl")"
+EXP="module	Shop	line 2
+entity	Shop.Order	line 3
+microflow	Shop.SUB_Order_Total	line 7
+microflow	Shop.VAL_Order	line 11
+microflow	Shop.ACT_Order_Submit	line 16
+page	Shop.Order_Edit	line 24
+microflow	Shop.ACT_Order_New	line 33
+page	Shop.Order_Overview	line 38"
+[ "$SHOP" = "$EXP" ] && ok "shop.mdl: module, entity, 4 microflows, 2 pages, each with its line" || bad "shop.mdl" "$SHOP"
+case "$SHOP" in *SUB_Order_Total*SUB_Order_Total*) bad "a CALL MICROFLOW inside a body was listed as a subject" ;; *) ok "calls inside bodies are not subjects" ;; esac
+G="$(subj "$TOOLKIT/examples/stylegallery/mdlsource/gallery/90-gallery-home.mdl")"
+printf '%s\n' "$G" | grep -q '^page	StyleGallery.Gallery_Home	' && printf '%s\n' "$G" | grep -q '^access	StyleGallery.Gallery_Home	' \
+  && ok "CREATE PAGE + GRANT VIEW ON PAGE: page and access (gallery 90-gallery-home)" || bad "gallery" "$G"
+A="$(subj "$TOOLKIT/tests/wave2/fixtures/page-fidelity-mocks/bind-contract-alter.mdl")"
+printf '%s\n' "$A" | grep -q '^page	Demo.Catalog	line 2$' && ok "ALTER PAGE (bind-contract-alter)" || bad "alter" "$A"
+[ -z "$(ls -A "$WORK/empty")" ] && ok "--subjects wrote nothing and needed no .mpr" || bad "wrote into cwd"
+(cd "$WORK/empty" && bash "$EXEC_SH" --subjects "$WORK/no-such.mdl" >/dev/null 2>&1); rc=$?
+[ "$rc" = 2 ] && ok "missing script exits 2" || bad "missing script exited $rc"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]