From 97e740300b8b872e4b9a5b9d779336a009cfe0bd Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 10:40:43 +0800
Subject: [PATCH 1/7] process(testing): per-project test strategy at CAC-5,
 module close scoped, deploy-ready runs everything (HELD)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  1 +
 project-bin/exec.sh                    |  2 +-
 skills/checkpoints/checkpoint-build.md | 21 +++++++++++
 skills/conversion-runbook.md           |  4 +-
 skills/existing-app-change.md          |  5 ++-
 skills/iterative-build-loop.md         |  6 +--
 skills/testing-shape.md                | 18 ++++-----
 tests/wave2/test-test-strategy-docs.sh | 52 ++++++++++++++++++++++++++
 8 files changed, 93 insertions(+), 16 deletions(-)
 create mode 100644 tests/wave2/test-test-strategy-docs.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2334398a..f0955c90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- process(testing): **HELD, do not merge before the test-strategy A/B (E3) and the baseline-text A/B: each project picks its test strategy with the developer at CAC-5, and the default shifts from the full suite at module close to the module's own tests there, everything at deploy-ready.** The CAC-5 Offer in `checkpoint-build.md` shows a three-row table (every change `affected`, module close `module`, deploy-ready `full`) and records it in PROJECT.md `## Test strategy` with a Status column (`ASSUMED` in auto mode). `testing-shape.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text drop "full suite at module close" for "deploy-ready"; `existing-app-change.md` keeps "every gate is also a regression gate" but runs the baseline journeys of the touched modules per gate and the whole baseline at deploy-ready. Baseline words 75,225 to 75,221. New `tests/wave2/test-test-strategy-docs.sh` keeps the wording and the three defaults from drifting apart (9 of 10 checks fail on master). Split out of #409 — the maintainer's decision, 2026-10-16
 - fix(conformance-check): read ledger rows whose pointer cell is bare (no backticks) and treat status `planned` as not-built; a ledger whose acceptance text is also bare prose is still not measured (acceptance must hold a backticked SHOW/DESCRIBE), but it now exits 2 with a FAULT that says rows were found and the text is prose, instead of "shape changed or glob matched nothing" (TK-006, partial: that ledger shape is diagnosed, not fixed) — field report TK-006
 - fix(app-restart): **a secret with spaces in quotes is masked whole, and `Pwd` and `Credential` join the secret words.** Follow-up to #403: `--constant "Mod.ApiKey=two words"` and `--db-password 'two words'` printed everything after the first word (the quoted-flag case leaked before #403 too). `mask()` now masks each argument before quoting it for display, so the whole quoted value goes; the executed command is untouched, and a real-launch test proves the started app receives the raw argv; an env assignment at the start of a `--cmd` string keeps the whole command visible; the per-argument seds only run for arguments holding a secret word. The substring match still over-masks names like `Monkey` (Key) and `Turkey`; that is display only, kept, and pinned by a test. `tests/wave2/test-app-restart.sh` gains 22 cases, 8 of them failing on master. — review of #403
 - fix(install-manifest): **a clean toolkit checkout passes its own `project-bin/` manifest self-check, so adopters no longer see the "named by NEITHER list" warning at the top of every sync.** `coverage-check-all.sh` (found by `review-module.sh` through its `_tool` lookup in the toolkit clone) and `ts-sync.sh` (UNPROVEN and SUPERSEDED per its header) join `MXTK_PROJECT_BIN_NOINSTALL` with reasons. New `tests/wave2/test-manifest-clean-checkout.sh` fails, rather than warns, when a `project-bin/` file is in neither list. — joshuamoesa (#381)
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index a4c85a76..fa10aa12 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -365,7 +365,7 @@ fi
 change_lane() {
   case "$CHANGE_CLASS" in
     ui-only) echo "re-run the journeys of every page the change reaches (embedders of a changed snippet/layout) once + a LOOK. No .test.mdl; reviewers read the artifacts, they do not re-run" ;;
-    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Full mxcli test at module close, not here" ;;
+    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). The full suite runs at deploy-ready, per PROJECT.md ## Test strategy" ;;
   esac
 }
 [ -n "$CR_ID" ] && echo "→ Change request: $CR_ID (PROJECT.md '## Change log'; cite this run's commit in its Closed-by)"
diff --git a/skills/checkpoints/checkpoint-build.md b/skills/checkpoints/checkpoint-build.md
index 11458620..91baa42d 100644
--- a/skills/checkpoints/checkpoint-build.md
+++ b/skills/checkpoints/checkpoint-build.md
@@ -103,6 +103,27 @@ all scripts upfront. See `brd-to-build-plan.md` ("The build plan contains no MDL
 `test-plan`, `acceptance-criteria`), or `Optional artifacts: none for Stage 5` as a Stage-4
 decision.
 
+**Test strategy (in the same Offer, not a separate question).** Show the defaults and let the
+developer change any cell in the same answer:
+
+> "Testing during the build, unless you want otherwise:
+>
+> | Moment | Unit tests | Journeys |
+> |---|---|---|
+> | Every change | affected | affected |
+> | Module close | module | module |
+> | Deploy-ready | full | full |
+>
+> `affected` = the tests and journeys of what the change touched and its callers
+> (`bin/affected-tests.sh`); `module` = the module's own; `full` = everything; `none` = skip.
+> Change a cell, or say 'defaults'."
+
+**Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column
+(`CONFIRMED`, or `ASSUMED` in auto mode). `bin/affected-tests.sh --moment change|module|deploy`
+reads it; with no section it uses these defaults and says so. Unit tests stay subject to the
+intake default (`Unit tests default:` in PROJECT.md, `testing-shape.md` §2): `affected` selects
+from the tests that exist, it does not ask for new ones.
+
 ## Open Question
 
 > "Is there a deadline, a demo milestone, or a specific feature that must be working first?
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 59d7e8c6..f5800c02 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -654,8 +654,8 @@ nothing about the seams.
 
 **Read `testing-shape.md` before writing or judging any test here.** It defines what testing a
 module means, so it is the same thing every time, and it carries the **false-green register**: the
-confirmed ways a test reports green while the feature is broken. Its §3 check moments name what the
-release gate owes beyond module close. Alongside it, `measured-claims.md`
+confirmed ways a test reports green while the feature is broken. Its §3 check moments name what
+deploy-ready owes beyond module close. Alongside it, `measured-claims.md`
 holds the rule that gives evidence its force — *a claim not measured in that register may not be
 cited as evidence.*
 
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index 3ad624be..944c75fd 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -196,6 +196,9 @@ baseline from Ground Rule 1, re-run, and by nothing else.
 A module gate that is green on the new work and was never run against the baseline has answered half
 the question and reported it as the whole. Re-run the baseline at every module gate, not once at the
 end — a regression found three modules later costs the same to fix and much more to find.
+At a module gate that means the baseline journeys of the modules the change touched
+(`bin/affected-tests.sh --moment module`); the whole baseline runs at deploy-ready. A project that wants
+the whole baseline at every module gate says so in PROJECT.md `## Test strategy`.
 
 ---
 
@@ -297,5 +300,5 @@ it is the only entry mode where that is true.
 - A build plan over the change.
 - When the work arrives as a backlog: a `## Rounds` table in `PROJECT.md`, one row per round, its state current.
 - When an edit cannot go through mxcli: `docs/manual-steps.md` from `templates/manual-steps.md`, every step with its Check and a ticked Done line naming its evidence.
-- **A regression baseline that was green before the change and is green after it** — stated as N journeys over M modules, re-run at every module gate. Without this the rest is unverified.
+- **A regression baseline that was green before the change and is green after it**: stated as N journeys over M modules, re-run per module gate over the modules it touched, and whole at deploy-ready. Without this the rest is unverified.
 - Anything reusable learned about the app → `skills/learned-*.md`; process learnings → `process/process-learnings.md`.
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 01e19b05..3163f07f 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -618,9 +618,9 @@ step.
 **Verification is scoped — once per gate, not once per script.** Gate: SYNTAX and Gate: BUILD run
 inside every `exec.sh`, and they are the only per-script checks. The test passes (happy path, journeys, LOOK) run **once
 per gate round** over what that round changed, and `bin/gate-check.sh` runs **once per gate round**,
-not after every exec. What re-runs after a change, by whom, and when the full suite runs (module
-close only, never batch close) is `testing-shape.md` §3 — the single source; `exec.sh` prints the
-run's lane (`ui-only` / `logic`). Repeating a pass the artifacts already prove is the over-testing
+not after every exec. What re-runs after a change, by whom, and when the full suite runs (deploy-ready
+by default, per PROJECT.md `## Test strategy`; never batch close) is `testing-shape.md` §3, the single
+source; `exec.sh` prints the run's lane (`ui-only` / `logic`) and `bin/affected-tests.sh` lists its tests. Repeating a pass the artifacts already prove is the over-testing
 toolkit issue #274 measured: UI-only changes re-proven 5–10×.
 
 > **Older ordinals, for anyone arriving from a document that still cites them:** Gate 2 = Gate:
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 1ba1a7d8..640df6f0 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -134,7 +134,7 @@ definition of done (`iterative-build-loop.md`). Without this anchor someone decl
 > hand (journey report, screenshot, diff) does not?* If you cannot name what it would show, do not run it.
 
 **The subject set.** A re-run covers the tests whose *subject* the exec'd script(s) changed — the
-script is the change list; `bin/exec.sh` tags each run `ui-only` or `logic` and prints its lane:
+script is the change list; `bin/exec.sh` tags its lane and `bin/affected-tests.sh <script>` lists the set:
 
 | Changed in this exec | Its subject set — re-run these, only these |
 |---|---|
@@ -156,29 +156,29 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**The full suite (and the module's whole journey set) runs on the last three rows below only** — **never at batch close**, never after
-an individual fix, never because the change "felt wide". The e2e instruments are unchanged; only
-their trigger is.
+**Each project picks what runs when** with its developer at CAC-5: PROJECT.md `## Test strategy`
+(`checkpoint-build.md`). Defaults: every change `affected`, module close `module`, deploy-ready
+`full`. The full suite never runs at batch close, after a fix, or because a change "felt wide".
 
 | Event | What happens |
 |---|---|
 | A fix to an existing script | **Re-run its subject set**, in its lane. No questions, no re-authoring. |
 | A new script within agreed scope | Re-run its subject set. Extend the suite only for a *behaviour* the coverage checklist doesn't already cover. |
 | A new behaviour / scope change | The coverage checklist changes — the existing drift-sync path. The suite extends with it. |
-| Module close | The full suite, once (`module-review.md` PROVE). |
-| Release gate (before UAT/production) | The project-wide suite, once. |
+| Module close | The module's tests and journeys, once (`module-review.md` PROVE). |
+| Deploy-ready (before UAT/production) | Every test and journey, once. |
 | The user asks for a full run | Run it, that message is the trigger. |
 
 **Check moments — which checks each of those events owes.** Fast checks run during development;
-heavy checks wait for module close or the release gate. This sorts checks by *when*, not what
+heavy checks wait for module close or deploy-ready. This sorts checks by *when*, not what
 testing a module means: the §1 shape and the two lanes are unchanged. A *planned: #N* check is not
 built yet and claims nothing until it lands.
 
 | Moment | Budget | What runs |
 |---|---|---|
 | **Every exec** | ~1 minute (mxbuild 22–65 s per script, `iterative-build-loop.md` → Gate cost) | `exec.sh` includes: lock → module-brief advisory → `mxcli check` → snapshot → apply → mxbuild delta gate → auto-restore on a new error → lint ratchet. Static STOP-row scan (planned: #349); Studio Pro warning ratchet (planned: #351); human-locked baselines (planned: #348). |
-| **Module close** | minutes | The module's full suite and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
-| **Release gate** | as needed | The project-wide suite, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
+| **Module close** | minutes | The module's tests and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
+| **Deploy-ready** | as needed | Every test and journey, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
 > **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
 > change 5–10× (other modules' journeys, the reviewer re-running them, a full `mxcli test` at every
diff --git a/tests/wave2/test-test-strategy-docs.sh b/tests/wave2/test-test-strategy-docs.sh
new file mode 100644
index 00000000..431b4ac3
--- /dev/null
+++ b/tests/wave2/test-test-strategy-docs.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Fixture for the test-strategy doc shift (2026-10-16): every place that sent the full suite to
+# module close now says what the project strategy says, and the CAC-5 Offer carries the table.
+#
+# usage: bash tests/wave2/test-test-strategy-docs.sh [toolkit-root]
+#
+# Doc wording is behaviour for agent-read text, so this pins the facts that must agree:
+#   - no skill still says the full suite runs at module close, or names a "release gate" for it
+#   - testing-shape.md, the check-moments table and the Offer table carry the same three rows
+#     and the same defaults (every change affected, module close module, deploy-ready full)
+#   - existing-app-change.md keeps "every gate is also a regression gate" and adds the scoping
+#   - exec.sh's logic lane text points at the strategy, not at module close
+# The held PR that carries these edits is gated on the A/B (E3); this test only keeps the
+# files from drifting apart while it is held.
+#
+# Positive control: on master 9 of 10 checks fail; only the "kept" regression-gate guard passes.
+set -uo pipefail
+T="${1:-$(cd "$(dirname "$0")/../.." && pwd)}"
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; return 0; }
+has()  { grep -qF -- "$2" "$T/$1"; }
+echo "== subject: $T"
+
+echo "== the old full-suite-at-module-close wording is gone =="
+! has skills/testing-shape.md "| Module close | The full suite, once" && ! has skills/testing-shape.md "| Release gate (before UAT/production)" \
+  && ok "testing-shape.md event table" || bad "testing-shape.md event table still has module-close full suite or Release gate"
+! has skills/testing-shape.md "The module's full suite and journeys" && ! has skills/testing-shape.md "| **Release gate** |" \
+  && ok "testing-shape.md check-moments table" || bad "testing-shape.md check-moments table"
+! has skills/iterative-build-loop.md "(module close only, never batch close)" && has skills/iterative-build-loop.md "PROJECT.md \`## Test strategy\`" \
+  && ok "iterative-build-loop.md points at the strategy" || bad "iterative-build-loop.md"
+! has skills/conversion-runbook.md "the release gate owes" && has skills/conversion-runbook.md "deploy-ready owes" \
+  && ok "conversion-runbook.md says deploy-ready" || bad "conversion-runbook.md"
+! has project-bin/exec.sh "Full mxcli test at module close, not here" && has project-bin/exec.sh "The full suite runs at deploy-ready, per PROJECT.md ## Test strategy" \
+  && ok "exec.sh logic lane text" || bad "exec.sh logic lane text"
+
+echo "== one table, three places =="
+for f in skills/checkpoints/checkpoint-build.md; do
+  has $f "| Every change | affected | affected |" && has $f "| Module close | module | module |" && has $f "| Deploy-ready | full | full |" \
+    && ok "CAC-5 Offer table with the three defaults" || bad "Offer table"
+done
+has skills/checkpoints/checkpoint-build.md "PROJECT.md\` → \`## Test strategy\`" && has skills/checkpoints/checkpoint-build.md "CONFIRMED" \
+  && ok "Offer records the choice with a Status column" || bad "Offer record line"
+has skills/testing-shape.md "Defaults: every change \`affected\`, module close \`module\`, deploy-ready" \
+  && ok "testing-shape.md states the same defaults" || bad "testing-shape.md defaults sentence"
+
+echo "== existing-app-change.md =="
+has skills/existing-app-change.md "Re-run the baseline at every module gate" && ok "kept: every gate is also a regression gate" || bad "regression-gate rule lost"
+has skills/existing-app-change.md "the whole baseline runs at deploy-ready" && ok "whole baseline at deploy-ready" || bad "deploy-ready baseline"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From e2a42467c3cbb76352f6d8193e255c3911caedda Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 16:01:05 +0800
Subject: [PATCH 2/7] fix(testing): unit tests are off by default and
 affected-tests.sh enforces it; align the moments

Field test of the release candidate found "Unit tests default: no" read by no script, so a
unit test was offered after every change. affected-tests.sh now reads the default (no, or the
line absent, means unit off, one "unit off" line, never a .test.mdl run row), flips per module
(PROJECT.md "Unit modules: A, B", or "Unit tests: yes" in the module brief), and lets an explicit
Test strategy row win. A grant on a microflow or page the same script changes is part of that
subject and no longer selects the owning module. Moments are now every change, module done, build
complete (developer-declared) and "run everything". module-review PROVE runs the module row.
The maintainer fast-tracked this on 2026-10-16; the baseline-text A/B is waived, E3 follows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  2 +-
 project-bin/affected-tests.sh          | 94 +++++++++++++++++++++-----
 project-bin/exec.sh                    |  2 +-
 skills/brd-to-build-plan.md            |  2 +-
 skills/checkpoints/checkpoint-build.md | 33 +++++----
 skills/existing-app-change.md          |  2 +-
 skills/iterative-build-loop.md         |  6 +-
 skills/module-brief.md                 |  2 +-
 skills/module-review.md                | 15 ++--
 skills/testing-shape.md                | 25 ++++---
 tests/wave2/test-affected-tests.sh     | 60 ++++++++++++++--
 tests/wave2/test-test-strategy-docs.sh | 21 ++++--
 12 files changed, 196 insertions(+), 68 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 80897402..f00bf2af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
-- process(testing): **HELD, do not merge before the test-strategy A/B (E3) and the baseline-text A/B: each project picks its test strategy with the developer at CAC-5, and the default shifts from the full suite at module close to the module's own tests there, everything at deploy-ready.** The CAC-5 Offer in `checkpoint-build.md` shows a three-row table (every change `affected`, module close `module`, deploy-ready `full`) and records it in PROJECT.md `## Test strategy` with a Status column (`ASSUMED` in auto mode). `testing-shape.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text drop "full suite at module close" for "deploy-ready"; `existing-app-change.md` keeps "every gate is also a regression gate" but runs the baseline journeys of the touched modules per gate and the whole baseline at deploy-ready. Baseline words 75,225 to 75,221. New `tests/wave2/test-test-strategy-docs.sh` keeps the wording and the three defaults from drifting apart (9 of 10 checks fail on master). Split out of #409 — the maintainer's decision, 2026-10-16
+- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; an explicit strategy row wins over all three. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate.
 - learn(workflow skills): **a Jump has one fixed target, so one failure handler for N steps is a child workflow, not a shared node; plus three probed workflow errors (CE0117 on a `System.Workflow` argument means map `$WorkflowInstance`, CE1613 means the called workflow's parameter must be `$WorkflowContext`, and `returns` goes before `exposed as workflow action`).** `workflow-structure-rules.md` §1 and `learned-workflow-patterns.md` §9. The §9 rows were probed on mxcli v0.26.0 / Mendix 11.15.0 with native `mx check`. The third row corrects the reading that a called microflow cannot return a value. Upstream issues: mendixlabs/mxcli#1529 (CE0117), #1530 (CE1613, and `syntax workflow call-workflow` shows the failing form), #1531 (describe drops every call workflow mapping), #1533 (`returns` parse messages). Source: a five-app lab project (Mendix 11.15, mxcli v0.26.0) — five-app lab report, WF-1
 - learn(fixture-seeding): **resetting workflow data: abort instances through the runtime (Workflow Commons admin or *Change workflow state*); if SQL is unavoidable, delete the link tables first (`system$workflow_currentactivity`, `system$workflow_workflowdefinition`, `system$workflowusertask_assignees`, `system$workflowusertask_targetusers`, `system$workflowusertask_targetgroups`, plus the `system$workflowendedusertask_*` equivalents; names read from a Mendix 11.15 database), and reset a context object only after its instances are gone.** A seed reset that deleted workflow rows by SQL failed on those links (WF-5). Text only, `ondemand` skill. — five-app lab report, WF-5
 - fix(e2e/helpers): **`navTo` throws `navigation item "<title>" not found` instead of clicking nothing.** A missing menu item was a silent no-op, so when the target page was also the persona's home page the landing guard stayed green and a broken-control journey (a control that must FAIL) passed. The parent group stays soft (an open flyout needs no click); the item itself must be found. The message names the active user and the visible menu items, so the reader can tell a renamed item (fix the journey) from a role that cannot open the page (fix the grants). Callers: journey steps fail with the message, design-audit rung 7 records a fault, full-app-walkthrough records a failed `nav` step (the walk stops only when the step is `fatal`), monkey's `land` swallows the error and still checks `.mx-page`, so monkey is unchanged. `tests/wave2/test-navto-missing-item.sh` (stub page, no browser) fails on master (absent item resolves) and passes here. Field report: a five-app lab project (Mendix 11.15, mxcli v0.26.0), TK-012 — MendixMau
diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
index 2c701886..b53b007e 100755
--- a/project-bin/affected-tests.sh
+++ b/project-bin/affected-tests.sh
@@ -10,7 +10,7 @@
 #   caller    <Module.Name>  depth N     (SHOW CALLERS OF ... TRANSITIVE)
 #   callers   measured | NOT MEASURED (<reason>)
 #   data      NOT MEASURED  <kind> <Module.Name>  (entity/association/enumeration/access/module/role/userrole/constant subject)
-#   unit      <file.test.mdl>  <why>
+#   unit      <file.test.mdl>  <why>   |   unit  off  (<why unit is off>)
 #   journey   <file.journey.json>  <why>
 #   journeys  unmapped  N of M journey file(s) cannot be selected by name
 #   run       <the command to run that selection>
@@ -27,10 +27,27 @@
 # THE STRATEGY. PROJECT.md "## Test strategy" (skills/checkpoints/checkpoint-build.md writes it):
 #   | Moment | Unit tests | Journeys | Status |
 #   | Every change | affected | affected | CONFIRMED |
-#   | Module close | module | module | CONFIRMED |
-#   | Deploy-ready | full | full | CONFIRMED |
+#   | Module done | module | module | CONFIRMED |
+#   | Build complete | full | full | CONFIRMED |
 # Scopes: none | affected | module | full. No section, or no row for the moment: these defaults,
-# and the strategy row says "default". --moment picks the row (change is the default).
+# and the strategy row says "default". --moment picks the row (change is the default):
+#   change = every change (build and feedback) · module = module done · deploy = build complete and
+#   before every later deploy · all = "run everything", any time (same as deploy).
+# Old row names "Module close" and "Deploy-ready" still read.
+#
+# UNIT TESTS ARE OFF BY DEFAULT (field test of the RC, 2026-10-16: nothing read the knob, so a
+# unit test was offered after every change). Precedence for the UNIT scope, highest first:
+#   1. An explicit '## Test strategy' row for the moment (its Unit tests cell): wins outright.
+#   2. A module flipped to yes: that module's tests only, at the change and module moments (deploy
+#      and all run every existing unit test). A flip is any of: a PROJECT.md line
+#      `Unit modules: Shop, Admin` (decided at CAC-5); in the module brief
+#      (architecture/modules/<M>/module-brief.md or architecture/modules/<M>-brief.md) a line
+#      `Unit tests: yes` or the Declared-shape table row `| Unit (...) | yes | ...`.
+#   3. PROJECT.md `Unit tests default:`. `yes` keeps the built-in scope for the moment; `no`, or the
+#      line ABSENT, means unit is OFF for every module not flipped in 2. When off the script prints
+#      one `unit off` line and NEVER a `run ... .test.mdl` row. (A row you wrote is a decision;
+#      the default line is only a default.)
+# Journeys are not affected by any of this.
 #
 # HOW THE SELECTION IS MADE (judgement-free facts only; skills-over-scripts.md):
 #   1. Subjects: `bin/exec.sh --subjects <script>` (the same statement lexer as the change class).
@@ -52,7 +69,11 @@
 #      selection is never read as "nothing owed".
 #   5. module: every test file naming the module, journeys/<M>.journey.json; the modules are the
 #      subjects' modules plus every --module. full: every test file, every journey file.
-#   6. data subjects (entity, association, enumeration, access, module, module role, user role,
+#   6. A grant/revoke whose object (microflow, page, ...) the SAME script creates or modifies is
+#      part of that subject (describe output ends in one): it selects nothing by module. A grant
+#      with no such object in the script (entity, module role, other object) is an access change
+#      and is selected by owning module as in 7.
+#   7. data subjects (entity, association, enumeration, access, module, module role, user role,
 #      constant): selected by the owning module only (a user role has no module and selects
 #      nothing). Their use in another module's rule, page or microflow is not measured, and a
 #      "data NOT MEASURED" row says so for each one.
@@ -81,7 +102,8 @@ while [ $# -gt 0 ]; do
 $(cd "$(dirname "$1")" && pwd)/$(basename "$1")"; shift ;;
   esac
 done
-case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module or deploy" >&2; exit 2 ;; esac
+[ "$MOMENT" = all ] && MOMENT=deploy
+case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module, deploy or all" >&2; exit 2 ;; esac
 case "$DEPTH" in ''|*[!0-9]*) echo "✗ --depth takes a number" >&2; exit 2 ;; esac
 SCRIPTS="$(printf '%s\n' "$SCRIPTS" | sed '/^$/d')"
 [ -n "$SCRIPTS" ] || [ "$MOMENT" != change ] || { echo "✗ a change needs at least one script" >&2; usage; }
@@ -92,24 +114,45 @@ WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected.XXXXXX")"; trap 'rm -rf "$WORK"' EXI
 out() { printf '%s\n' "$*"; }
 
 # ── Strategy row ─────────────────────────────────────────────────────────────
-case "$MOMENT" in change) ROW="Every change"; DU=affected; DJ=affected ;;
-                  module) ROW="Module close"; DU=module;   DJ=module ;;
-                  deploy) ROW="Deploy-ready"; DU=full;     DJ=full ;; esac
-U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
+case "$MOMENT" in change) ROW="Every change"; ALT="Every change"; DU=affected; DJ=affected ;;
+                  module) ROW="Module done"; ALT="Module close"; DU=module; DJ=module ;;
+                  deploy) ROW="Build complete"; ALT="Deploy-ready"; DU=full; DJ=full ;; esac
+U="$DU"; J="$DJ"; UNIT_ROW=0; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
 if [ -f PROJECT.md ]; then
-  _row="$(awk -v r="$ROW" '
+  _row="$(awk -v r="$ROW" -v r2="$ALT" '
     /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
     on && /^\|/ { split($0, c, "|"); x = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", x)
-                  if (tolower(x) == tolower(r)) { u = c[3]; j = c[4]; s = c[5]
+                  if (tolower(x) == tolower(r) || tolower(x) == tolower(r2)) { u = c[3]; j = c[4]; s = c[5]
                     gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
                     print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
   if [ -n "$_row" ]; then
     _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
-    case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
+    case "$_u" in none|affected|module|full) U="$_u"; UNIT_ROW=1 ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
     case "$_j" in none|affected|module|full) J="$_j" ;; *) FROM="${FROM}row '$ROW' journey scope '$_j' unknown, default used; " ;; esac
     case "$FROM" in default:*) FROM="PROJECT.md ## Test strategy, row '$ROW'${_s:+, $_s}" ;; *) FROM="${FROM}PROJECT.md ## Test strategy" ;; esac
   fi
 fi
+
+# ── Unit gate: off unless the project default is yes, the row says so, or a module is flipped ──
+UNIT_DEFAULT="$(awk '/^[ \t*]*Unit tests default:/ { v = $0; sub(/^[^:]*:/, "", v); gsub(/[ \t*`]/, "", v); print tolower(v); exit }' PROJECT.md 2>/dev/null)"
+FLIPPED="$(awk '/^[ \t*]*Unit modules:/ { v = $0; sub(/^[^:]*:/, "", v); gsub(/[ \t*`]/, "", v); gsub(/,/, " ", v); print v; exit }' PROJECT.md 2>/dev/null)"
+for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md; do
+  [ -f "$_b" ] || continue
+  case "$_b" in */module-brief.md) _m="$(basename "$(dirname "$_b")")" ;; *) _m="$(basename "$_b" -brief.md)" ;; esac
+  if awk '
+      tolower($0) ~ /^[ \t*-]*unit tests:[ \t*]*yes([^a-z]|$)/ { f = 1 }
+      /^\|/ { split($0, c, "|"); k = tolower(c[2]); v = tolower(c[3]); gsub(/[ \t*`]/, "", v)
+              if (k ~ /^[ \t]*unit[ \t]*\(/ && v ~ /^yes/) f = 1 }
+      END { exit !f }' "$_b"; then FLIPPED="$FLIPPED $_m"; fi
+done
+UNIT_GATED=0; UNIT_OFF_WHY=""
+if [ "$UNIT_ROW" = 0 ] && [ "$MOMENT" != deploy ] && [ "${UNIT_DEFAULT#yes}" = "$UNIT_DEFAULT" ]; then
+  if [ -n "$UNIT_DEFAULT" ]; then _dw="PROJECT.md Unit tests default: $UNIT_DEFAULT"
+  else _dw="PROJECT.md has no 'Unit tests default:' line, treated as no"; fi
+  if [ -n "$FLIPPED" ]; then UNIT_GATED=1
+  else U=none; UNIT_OFF_WHY="($_dw; flip a module: PROJECT.md 'Unit modules: <M>' or 'Unit tests: yes' in its brief)"; fi
+  FROM="$FROM; unit: $_dw"
+fi
 out "strategy	$MOMENT	unit=$U journeys=$J	($FROM)"
 
 # ── Subjects ─────────────────────────────────────────────────────────────────
@@ -121,7 +164,18 @@ if [ -n "$SCRIPTS" ]; then
     done
   done > "$WORK/subjects"
 fi
-while IFS='	' read -r k n w; do out "subject	$k	$n	$w"; done < "$WORK/subjects"
+# A grant/revoke on an object this same script creates or modifies belongs to that subject.
+awk -F'\t' '
+  function scr(w,   a) { split(w, a, " of "); return a[2] }
+  NR == FNR { if ($1 != "access" && $1 != "unmapped") own[$2 "\t" scr($3)] = 1; next }
+  $1 == "access" && (($2 "\t" scr($3)) in own) { print $1 "\t" $2 "\t" $3 "\tPART" ; next }
+  { print $0 "\t" }' "$WORK/subjects" "$WORK/subjects" > "$WORK/subjects.tag"
+: > "$WORK/subjects.sel"
+while IFS='	' read -r k n w tag; do
+  if [ "$tag" = PART ]; then out "subject	$k	$n	$w	(grant on an object this script changes: part of that subject, selects nothing by module)"
+  else out "subject	$k	$n	$w"; printf '%s\t%s\t%s\n' "$k" "$n" "$w" >> "$WORK/subjects.sel"; fi
+done < "$WORK/subjects.tag"
+mv "$WORK/subjects.sel" "$WORK/subjects"
 [ -n "$SCRIPTS" ] && [ ! -s "$WORK/subjects" ] && out "subject	none	-	no model-writing statement in the script(s)"
 mod_of() { printf '%s\n' "${1%%.*}"; }
 awk -F'\t' '$2 != "-" && $1 != "userrole" { split($2, a, "."); print a[1] }' "$WORK/subjects" > "$WORK/modules"
@@ -219,9 +273,17 @@ select_journeys() {  # $1 = scope; prints "<file>\t<why>"
 }
 
 select_unit "$U" > "$WORK/unit.sel"
+if [ "$UNIT_GATED" = 1 ]; then   # default no, some modules flipped: only those modules' tests
+  : > "$WORK/unit.gated"
+  for m in $FLIPPED; do
+    while IFS='	' read -r f w; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && printf '%s\t%s\n' "$f" "$w"; done < "$WORK/unit.sel"
+  done | awk -F'\t' '!seen[$1]++' > "$WORK/unit.gated"
+  mv "$WORK/unit.gated" "$WORK/unit.sel"
+fi
 select_journeys "$J" > "$WORK/journey.sel"
-if [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
-else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match")"; fi
+if [ -n "$UNIT_OFF_WHY" ]; then out "unit	off	$UNIT_OFF_WHY"
+elif [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
+else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match${FLIPPED:+ (unit on only for:$FLIPPED)}")"; fi
 if [ -s "$WORK/journey.sel" ]; then sed 's/^/journey	/' "$WORK/journey.sel"
 else out "journey	none	scope $J: $( [ "$J" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/journeys" | tr -d ' ') journey file(s) in $JDIR/ and tests/e2e/ match")"; fi
 
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index b17429e2..3a658e42 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -414,7 +414,7 @@ fi
 change_lane() {
   case "$CHANGE_CLASS" in
     ui-only) echo "re-run the journeys of every page the change reaches (embedders of a changed snippet/layout) once + a LOOK. No .test.mdl; reviewers read the artifacts, they do not re-run" ;;
-    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). The full suite runs at deploy-ready, per PROJECT.md ## Test strategy" ;;
+    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Unit tests only for affected modules with unit on; everything runs once at build complete and before each later deploy, per PROJECT.md ## Test strategy" ;;
   esac
 }
 [ -n "$CR_ID" ] && echo "→ Change request: $CR_ID (PROJECT.md '## Change log'; cite this run's commit in its Closed-by)"
diff --git a/skills/brd-to-build-plan.md b/skills/brd-to-build-plan.md
index 05b35ce1..6c33bcdb 100644
--- a/skills/brd-to-build-plan.md
+++ b/skills/brd-to-build-plan.md
@@ -340,7 +340,7 @@ Every row is one of five kinds, sharing one numbering and one dependency graph.
   Produces names every document the row writes, shared ones included (pages, navigation,
   after-startup, shared microflows): the parallel ready set excludes overlapping writers.
 - **`PROVE`** — headless and mechanical, mid-phase. `mxcli test`, a `curl`, a `DESCRIBE` read-back.
-  On mxcli ≥ v0.19.0, `.test.mdl` suites are a first-class PROVE instrument: `@setup` really
+  On mxcli ≥ v0.19.0, `.test.mdl` suites are a unit-gated PROVE instrument: `@setup` really
   runs its microflow, `@verify` really evaluates its OQL (holds / fails-with-the-value /
   cannot-evaluate = ERROR), and `@cleanup rollback` really rolls back — **before v0.19 all
   three were parsed and ignored, so no `@verify` could ever fail**. Two consequences: prefer a
diff --git a/skills/checkpoints/checkpoint-build.md b/skills/checkpoints/checkpoint-build.md
index 91baa42d..dd1ed8b2 100644
--- a/skills/checkpoints/checkpoint-build.md
+++ b/skills/checkpoints/checkpoint-build.md
@@ -103,26 +103,31 @@ all scripts upfront. See `brd-to-build-plan.md` ("The build plan contains no MDL
 `test-plan`, `acceptance-criteria`), or `Optional artifacts: none for Stage 5` as a Stage-4
 decision.
 
-**Test strategy (in the same Offer, not a separate question).** Show the defaults and let the
-developer change any cell in the same answer:
+**Test strategy (in the same Offer, not a separate question).** Show the defaults; the
+developer may change any cell in the same answer:
 
 > "Testing during the build, unless you want otherwise:
 >
 > | Moment | Unit tests | Journeys |
 > |---|---|---|
-> | Every change | affected | affected |
-> | Module close | module | module |
-> | Deploy-ready | full | full |
+> | Every change (build and feedback) | affected | affected |
+> | Module done | module | module |
+> | Build complete, and before every later deploy | full | full |
 >
-> `affected` = the tests and journeys of what the change touched and its callers
-> (`bin/affected-tests.sh`); `module` = the module's own; `full` = everything; `none` = skip.
-> Change a cell, or say 'defaults'."
-
-**Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column
-(`CONFIRMED`, or `ASSUMED` in auto mode). `bin/affected-tests.sh --moment change|module|deploy`
-reads it; with no section it uses these defaults and says so. Unit tests stay subject to the
-intake default (`Unit tests default:` in PROJECT.md, `testing-shape.md` §2): `affected` selects
-from the tests that exist, it does not ask for new ones.
+> `affected` = what the change touched and its callers (`bin/affected-tests.sh`); `module` = the
+> module's own (`--moment module --module <M>`); `full` = everything once; `none` = skip.
+> Build complete = you say the app is ready for UAT or production; I do not declare it alone.
+> Say 'run everything' any time.
+> Unit tests: only modules you name now, written while the logic is fresh (writing is not
+> running). Default: off, except modules with calculation, money/date, mapping, REST/Java logic or
+> a fixed bug. Change a cell, name modules, or say 'defaults'."
+
+**Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column (`CONFIRMED`, or
+`ASSUMED` in auto mode), and the line `Unit modules: Shop, Admin` (`none` if none).
+`bin/affected-tests.sh --moment change|module|deploy|all` reads it; no section: these defaults.
+Unit is **off** unless `Unit tests default: yes` (whole project; absent = no), a `Unit modules:`
+entry, or `Unit tests: yes` in the module brief. A Unit cell recorded here beats all three (default
+`no`: record `none`). At build end ask "full run now?", a confirmation, not a decision.
 
 ## Open Question
 
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index 944c75fd..3a407e6e 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -197,7 +197,7 @@ A module gate that is green on the new work and was never run against the baseli
 the question and reported it as the whole. Re-run the baseline at every module gate, not once at the
 end — a regression found three modules later costs the same to fix and much more to find.
 At a module gate that means the baseline journeys of the modules the change touched
-(`bin/affected-tests.sh --moment module`); the whole baseline runs at deploy-ready. A project that wants
+(`bin/affected-tests.sh --moment module --module <M>`); the whole baseline runs at deploy-ready. A project that wants
 the whole baseline at every module gate says so in PROJECT.md `## Test strategy`.
 
 ---
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 3163f07f..c692f145 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -618,9 +618,9 @@ step.
 **Verification is scoped — once per gate, not once per script.** Gate: SYNTAX and Gate: BUILD run
 inside every `exec.sh`, and they are the only per-script checks. The test passes (happy path, journeys, LOOK) run **once
 per gate round** over what that round changed, and `bin/gate-check.sh` runs **once per gate round**,
-not after every exec. What re-runs after a change, by whom, and when the full suite runs (deploy-ready
-by default, per PROJECT.md `## Test strategy`; never batch close) is `testing-shape.md` §3, the single
-source; `exec.sh` prints the run's lane (`ui-only` / `logic`) and `bin/affected-tests.sh` lists its tests. Repeating a pass the artifacts already prove is the over-testing
+not after every exec. What re-runs after a change, by whom, and when the full suite runs (per
+PROJECT.md `## Test strategy`; never batch close) is `testing-shape.md` §3; `exec.sh` prints
+the run's lane (`ui-only` / `logic`). Repeating a pass the artifacts already prove is the over-testing
 toolkit issue #274 measured: UI-only changes re-proven 5–10×.
 
 > **Older ordinals, for anyone arriving from a document that still cites them:** Gate 2 = Gate:
diff --git a/skills/module-brief.md b/skills/module-brief.md
index e1f00c28..49ea74d4 100644
--- a/skills/module-brief.md
+++ b/skills/module-brief.md
@@ -150,7 +150,7 @@ all, and never looks at a page.
 |------|-------------|-----|
 | UI (Playwright) | **always** | — |
 | Data (source of truth) | **always** — say which: OQL count delta \| upstream REST response \| documented n/a + the query proving it | `testing-shape.md` §1: "Data" means check the source of truth, not always query a database |
-| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow — name which. The project default is intake Q13 (`Unit tests default:` in PROJECT.md), itself `no` unless the user chose otherwise (`testing-shape.md` §2) |
+| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow — name which. Project default: intake Q13 (`Unit tests default:`), `no` unless chosen (`testing-shape.md` §2). Flip: line `Unit tests: yes` |
 | Trace (OTel) | yes / no | **yes if this module calls out** to REST, an import mapping, or external data — that is where failures get swallowed, and it overrides the project default |
 
 ### Base set — the trigger  (`testing-shape.md` §3)
diff --git a/skills/module-review.md b/skills/module-review.md
index 9b99780c..dd090add 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -19,21 +19,22 @@ looking. That is how a module ships with 31/31 green checks and a broken grid on
             — conformance-check + graph-sweep + coverage-check (model-side, parallel) +
             journeys (UI/Playwright + Data/OQL + Trace/OTel, one ordered walk via
             journey-runner.js) + journeys-control (positive control — proves the journey
-            could have failed) + monkey (crash net). This IS the UI (Playwright) + Data
-            (OQL/DB) + monkey rungs named above, run as one instrument, not a second pass
-            alongside them. wiring-sweep.md (every clickable element on the page, not just
+            could have failed) + monkey (crash net). This IS the UI, Data and monkey rungs
+            named above, run as one instrument. wiring-sweep.md (every clickable element on the page, not just
             what a journey visits) runs alongside it but by hand, deliberately outside
-            verify-module.sh — skills-over-scripts.md: the verdict on an ambiguous click
-            stays a judgement call, not a script. It is NOT optional and it leaves a file:
+            verify-module.sh (a judgement call, skills-over-scripts.md). It is NOT optional and it leaves a file:
             test-agent writes .claude/loop/sweep/<Module>/sweep.md, first line the
             denominator "N of N interactive elements swept across P of P pages". No file
             means the sweep did not happen, and the gate says so. Deep form when an
             instrument is green and you cannot say what would have made it red:
             journey-proof.md
+            Module close also runs the strategy row: `./bin/affected-tests.sh --moment module
+            --module <M>`, then its `run` rows (unit only if on). Source `default`: ask the
+            developer once, record `## Test strategy`.
 4. LOOK     THE INTELLIGENCE CHECK — a human-equivalent pass over every screen in
             the module. Is it logical? Does it look right? Does it match our design?
-            Stages 1-3 cannot answer any of those. This is the stage that gets
-            skipped, and it is the stage the escaped defects come from.
+            Stages 1-3 cannot answer those. It gets skipped, and the
+            escaped defects come from it.
 5. CONFIRM  one report, explicit denominator, a human look, then next module
 ```
 
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 640df6f0..176c3ccb 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -140,7 +140,7 @@ script is the change list; `bin/exec.sh` tags its lane and `bin/affected-tests.s
 |---|---|
 | A microflow | the tests that call it, plus the tests of its callers (`SHOW CALLERS OF <Mod.Flow>`) |
 | A page, snippet or layout | the journeys of every page the change reaches: the page itself, and every page that embeds a changed snippet or uses a changed layout, in any module |
-| An entity, association, enum or access rule | the tests and journeys of the module that owns it |
+| An entity, association, enum or access rule | the tests and journeys of the module that owns it (a grant on a flow or page it also changes is part of that subject) |
 
 Anything outside that set was not at risk from this change and is not re-run.
 
@@ -156,18 +156,19 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**Each project picks what runs when** with its developer at CAC-5: PROJECT.md `## Test strategy`
-(`checkpoint-build.md`). Defaults: every change `affected`, module close `module`, deploy-ready
-`full`. The full suite never runs at batch close, after a fix, or because a change "felt wide".
+**Each project picks what runs when** at CAC-5: PROJECT.md `## Test strategy` (`checkpoint-build.md`;
+defaults `affected`, `module`, `full`). Unit tests are off unless a module is named (`Unit modules:`).
+Never at batch close, after a fix, or because a change "felt wide".
 
 | Event | What happens |
 |---|---|
 | A fix to an existing script | **Re-run its subject set**, in its lane. No questions, no re-authoring. |
 | A new script within agreed scope | Re-run its subject set. Extend the suite only for a *behaviour* the coverage checklist doesn't already cover. |
 | A new behaviour / scope change | The coverage checklist changes — the existing drift-sync path. The suite extends with it. |
-| Module close | The module's tests and journeys, once (`module-review.md` PROVE). |
-| Deploy-ready (before UAT/production) | Every test and journey, once. |
-| The user asks for a full run | Run it, that message is the trigger. |
+| Module done | That module's own journeys, once; its unit tests only if on (`module-review.md` PROVE). |
+| Build complete (developer-declared) | Everything once: all journeys, all unit tests. |
+| Before each later deploy (after feedback) | Everything once again. |
+| The user says "run everything" | Run it, any time. |
 
 **Check moments — which checks each of those events owes.** Fast checks run during development;
 heavy checks wait for module close or deploy-ready. This sorts checks by *when*, not what
@@ -177,13 +178,11 @@ built yet and claims nothing until it lands.
 | Moment | Budget | What runs |
 |---|---|---|
 | **Every exec** | ~1 minute (mxbuild 22–65 s per script, `iterative-build-loop.md` → Gate cost) | `exec.sh` includes: lock → module-brief advisory → `mxcli check` → snapshot → apply → mxbuild delta gate → auto-restore on a new error → lint ratchet. Static STOP-row scan (planned: #349); Studio Pro warning ratchet (planned: #351); human-locked baselines (planned: #348). |
-| **Module close** | minutes | The module's tests and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
-| **Deploy-ready** | as needed | Every test and journey, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
+| **Module done** | minutes | The module's journeys, unit tests if on (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
+| **Build complete / deploy** | as needed | Every test and journey, once (rows above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
-> **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
-> change 5–10× (other modules' journeys, the reviewer re-running them, a full `mxcli test` at every
-> batch close), and with no Unit default set, **143 minutes** of microflow tests found stale strings,
-> not one logic bug. A caption change owes one journey and one look.
+> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5–10×, and **143
+> minutes** of unit tests (no Unit default set) found stale strings, not one logic bug.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.
 That is what makes this affordable on a module under active development.
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
index 21894794..7e57df9a 100644
--- a/tests/wave2/test-affected-tests.sh
+++ b/tests/wave2/test-affected-tests.sh
@@ -33,7 +33,7 @@ ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
 bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
 echo "== subject: $SUBJECT"
 
-P="$WORK/proj"
+P="$WORK/proj"; BASE_PM="$WORK/base-PROJECT.md"
 mkdir -p "$P/bin" "$P/tests/unit" "$P/journeys" "$P/tests/e2e"
 printf 'not a real model\n' > "$P/Fixture.mpr"
 cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/exec.sh" "$P/bin/"
@@ -47,6 +47,8 @@ t Validate Shop.VAL_Order
 t Submit   Shop.ACT_Order_Submit
 t Lookalike Shop.SUB_Order_Total_Legacy
 t Other    Admin.ACT_Reset
+# Unit tests are off unless the project says yes: the baseline project says yes, section L varies it.
+printf '# Project\n\nUnit tests default: yes\n' > "$BASE_PM"; cp "$BASE_PM" "$P/PROJECT.md"
 echo '{"id":"J-1","steps":[]}' > "$P/journeys/Shop.journey.json"
 echo '{"id":"J-2","steps":[]}' > "$P/journeys/Admin.journey.json"
 echo '{"id":"J-3","note":"opens Shop.Order_Edit","steps":[]}' > "$P/tests/e2e/edit.clerk.journey.json"
@@ -88,7 +90,7 @@ has()   { grep -qF -- "$2" "$WORK/out.$1"; }
 lacks() { ! grep -qF -- "$2" "$WORK/out.$1"; }
 calls() { if [ -f "$P/.stub-log" ]; then wc -l < "$P/.stub-log" | tr -d ' '; else echo 0; fi; }
 
-echo "== A: one microflow change, defaults (no PROJECT.md) =="
+echo "== A: one microflow change, defaults (project says Unit tests default: yes) =="
 RC=$(run A "$TOTAL")
 [ "$RC" -eq 0 ] && ok "exit 0" || bad "A rc=$RC" "$(cat "$WORK/err.A")"
 has A "strategy	change	unit=affected journeys=affected	(default:" && ok "strategy row says default affected/affected" || bad "A strategy" "$(head -1 "$WORK/out.A")"
@@ -161,10 +163,10 @@ has E "strategy	change	unit=none journeys=module	(PROJECT.md ## Test strategy, r
 has E "unit	none	scope none: strategy says none" && ok "unit none per strategy" || bad "E unit" "$(grep ^unit "$WORK/out.E")"
 has E "journey	journeys/Shop.journey.json	module Shop" && lacks E "edit.clerk" && ok "journeys at module scope" || bad "E journeys" "$(grep ^journey "$WORK/out.E")"
 [ "$(calls)" = 0 ] && ok "no affected scope, so no mxcli call" || bad "E called mxcli"
-printf '## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
+printf 'Unit tests default: yes\n## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
 run E2 "$TOTAL" >/dev/null
 has E2 "unit scope 'sometimes' unknown, default used" && has E2 "unit=affected" && ok "an unknown scope falls back and says so" || bad "E2" "$(head -1 "$WORK/out.E2")"
-rm -f "$P/PROJECT.md"
+cp "$BASE_PM" "$P/PROJECT.md"
 
 echo "== F: deploy-ready default is the full suite =="
 run F --moment deploy "$TOTAL" >/dev/null
@@ -231,6 +233,56 @@ run K2 "$TOTAL" >/dev/null
 has K2 "caller	Shop.ZZ_New_Caller	depth 1" && has K2 "callers	measured" && ok "after the exec: the new caller is listed, callers measured" || bad "K2 stale" "$(grep -e ^caller "$WORK/out.K2")"
 [ ! -e "$P/.mxcli" ] && [ ! -e "$P/.affected-cache" ] && ok "the script keeps no cache of its own" || bad "K cache file"
 
+echo "== L: unit tests are off by default, a module flips them on, a grant on the changed object is not an access change =="
+GRANT="$WORK/flow-grant.mdl"; { cat "$TOTAL"; echo "grant execute on microflow Shop.SUB_Order_Total to Shop.User;"; } > "$GRANT"
+EGRANT="$WORK/entity-grant.mdl"; echo "grant Shop.User on Shop.Order (create, read);" > "$EGRANT"
+BRIEF_DIR="$P/architecture/modules"
+# L1: line absent
+printf '# Project\n' > "$P/PROJECT.md"
+run L1 "$TOTAL" >/dev/null
+has L1 "unit=none" && has L1 "unit	off	(PROJECT.md has no 'Unit tests default:' line, treated as no; flip a module:" && lacks L1 "unit	tests/" && lacks L1 ".test.mdl" \
+  && ok "L1 default line absent: unit off, no test file, no run row" || bad "L1 absent" "$(cat "$WORK/out.L1")"
+has L1 "journey	journeys/Shop.journey.json" && ok "journeys unaffected by the unit gate" || bad "L1 journeys"
+# L2: explicit no
+printf '# Project\n\n**Unit tests default: no**\n' > "$P/PROJECT.md"
+run L2 "$TOTAL" >/dev/null
+has L2 "unit	off	(PROJECT.md Unit tests default: no; flip a module:" && lacks L2 ".test.mdl" && ok "L2 default no: unit off, never a .test.mdl run row" || bad "L2 no" "$(cat "$WORK/out.L2")"
+run L2b "$ENTITY" >/dev/null; lacks L2b ".test.mdl" && ok "L2b default no: an entity change selects no unit test either" || bad "L2b" "$(cat "$WORK/out.L2b")"
+run L2c --moment deploy >/dev/null; [ "$(grep -c '^unit	tests/' "$WORK/out.L2c")" = 5 ] && ok "L2c default no: build complete still runs every existing unit test" || bad "L2c" "$(cat "$WORK/out.L2c")"
+run L2d --moment all >/dev/null; [ "$(grep -c '^unit	tests/' "$WORK/out.L2d")" = 5 ] && has L2d "strategy	deploy" && ok "L2d --moment all = everything" || bad "L2d" "$(cat "$WORK/out.L2d")"
+# L3: yes
+printf '# Project\n\nUnit tests default: yes\n' > "$P/PROJECT.md"
+run L3 "$TOTAL" >/dev/null
+has L3 "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && has L3 "run	./bin/test-scratch.sh -- tests/unit/Total.test.mdl" && ok "L3 default yes: today's behaviour" || bad "L3 yes" "$(cat "$WORK/out.L3")"
+# L4: module flipped, default no
+printf '# Project\n\nUnit tests default: no\n' > "$P/PROJECT.md"
+mkdir -p "$BRIEF_DIR/Shop"; printf '# Brief\n\nUnit tests: yes\n' > "$BRIEF_DIR/Shop/module-brief.md"
+run L4 "$ENTITY" >/dev/null
+has L4 "unit	tests/unit/Total.test.mdl	names module Shop" && lacks L4 "Other.test.mdl" && has L4 "run	./bin/test-scratch.sh" && ok "L4 Shop flipped by a brief line: Shop's tests are selected" || bad "L4 flip" "$(cat "$WORK/out.L4")"
+printf '# Admin\n| Part | This module | Why |\n|---|---|---|\n| Unit (`.test.mdl`) | **yes** | Java action |\n' > "$BRIEF_DIR/Admin-brief.md"
+rm -rf "$BRIEF_DIR/Shop"
+run L4b "$TOTAL" >/dev/null
+lacks L4b "Total.test.mdl" && lacks L4b "Validate.test.mdl" && ok "L4b only Admin flipped (table row, flat brief): a Shop change selects no Shop test" || bad "L4b" "$(cat "$WORK/out.L4b")"
+printf '# Admin\n| Unit (`.test.mdl`) | **no** (default) / yes | x |\n' > "$BRIEF_DIR/Admin-brief.md"
+run L4c "$ENTITY" >/dev/null; has L4c "unit	off" && ok "L4c the unfilled brief template ('no (default) / yes') is not a flip" || bad "L4c" "$(cat "$WORK/out.L4c")"
+rm -rf "$P/architecture"
+printf '# Project\n\nUnit tests default: no\nUnit modules: Admin, Other\n' > "$P/PROJECT.md"
+run L4d "$TOTAL" >/dev/null; lacks L4d "Total.test.mdl" && ok "L4d PROJECT.md 'Unit modules: Admin, Other': a Shop change selects no unit test" || bad "L4d" "$(cat "$WORK/out.L4d")"
+run L4e "$ENTITY" >/dev/null; printf '# Project\n\nUnit tests default: no\nUnit modules: Shop\n' > "$P/PROJECT.md"; run L4f "$ENTITY" >/dev/null
+has L4f "unit	tests/unit/Total.test.mdl	names module Shop" && lacks L4f "Other.test.mdl" && ok "L4f 'Unit modules: Shop' flips Shop only" || bad "L4f" "$(cat "$WORK/out.L4f")"
+# L5: an explicit row beats the default line
+printf 'Unit tests default: no\n## Test strategy\n| Every change | affected | affected | CONFIRMED |\n' > "$P/PROJECT.md"
+run L5 "$TOTAL" >/dev/null
+has L5 "unit	tests/unit/Total.test.mdl" && ok "L5 an explicit strategy row beats Unit tests default: no" || bad "L5" "$(cat "$WORK/out.L5")"
+# L6/L7: grants (unit on, so a module-wide selection would show)
+cp "$BASE_PM" "$P/PROJECT.md"
+run L6 "$GRANT" >/dev/null
+has L6 "subject	microflow	Shop.SUB_Order_Total" && has L6 "part of that subject" && lacks L6 "names module Shop" && lacks L6 "Lookalike.test.mdl" && lacks L6 "data	NOT MEASURED	access" \
+  && ok "L6 describe-style microflow plus its trailing grant: no module-wide unit selection" || bad "L6" "$(cat "$WORK/out.L6")"
+has L6 "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && ok "L6 the microflow's own test is still selected" || bad "L6 own test"
+run L7 "$EGRANT" >/dev/null
+has L7 "data	NOT MEASURED	access Shop.User" && has L7 "names module Shop (data or access change)" && ok "L7 a standalone entity grant, unit yes: selected by module" || bad "L7" "$(cat "$WORK/out.L7")"
+
 echo "== H: usage =="
 RC=$(run H --moment later "$TOTAL"); [ "$RC" -eq 2 ] && ok "bad --moment exits 2" || bad "H rc=$RC"
 RC=$(run H2 "$WORK/no-such.mdl"); [ "$RC" -eq 2 ] && ok "missing script exits 2" || bad "H2 rc=$RC"
diff --git a/tests/wave2/test-test-strategy-docs.sh b/tests/wave2/test-test-strategy-docs.sh
index 431b4ac3..bafa9c17 100644
--- a/tests/wave2/test-test-strategy-docs.sh
+++ b/tests/wave2/test-test-strategy-docs.sh
@@ -7,11 +7,11 @@
 # Doc wording is behaviour for agent-read text, so this pins the facts that must agree:
 #   - no skill still says the full suite runs at module close, or names a "release gate" for it
 #   - testing-shape.md, the check-moments table and the Offer table carry the same three rows
-#     and the same defaults (every change affected, module close module, deploy-ready full)
+#     and the same defaults (every change affected, module done module, build complete full)
 #   - existing-app-change.md keeps "every gate is also a regression gate" and adds the scoping
 #   - exec.sh's logic lane text points at the strategy, not at module close
-# The held PR that carries these edits is gated on the A/B (E3); this test only keeps the
-# files from drifting apart while it is held.
+# This test keeps those files, the Offer and affected-tests.sh from drifting apart. The
+# maintainer waived the A/B on 2026-10-16; E3 runs after merge as a check.
 #
 # Positive control: on master 9 of 10 checks fail; only the "kept" regression-gate guard passes.
 set -uo pipefail
@@ -31,22 +31,31 @@ echo "== the old full-suite-at-module-close wording is gone =="
   && ok "iterative-build-loop.md points at the strategy" || bad "iterative-build-loop.md"
 ! has skills/conversion-runbook.md "the release gate owes" && has skills/conversion-runbook.md "deploy-ready owes" \
   && ok "conversion-runbook.md says deploy-ready" || bad "conversion-runbook.md"
-! has project-bin/exec.sh "Full mxcli test at module close, not here" && has project-bin/exec.sh "The full suite runs at deploy-ready, per PROJECT.md ## Test strategy" \
+! has project-bin/exec.sh "Full mxcli test at module close, not here" && has project-bin/exec.sh "everything runs once at build complete and before each later deploy, per PROJECT.md ## Test strategy" \
   && ok "exec.sh logic lane text" || bad "exec.sh logic lane text"
 
 echo "== one table, three places =="
 for f in skills/checkpoints/checkpoint-build.md; do
-  has $f "| Every change | affected | affected |" && has $f "| Module close | module | module |" && has $f "| Deploy-ready | full | full |" \
+  has $f "| Every change (build and feedback) | affected | affected |" && has $f "| Module done | module | module |" && has $f "| Build complete, and before every later deploy | full | full |" \
     && ok "CAC-5 Offer table with the three defaults" || bad "Offer table"
 done
 has skills/checkpoints/checkpoint-build.md "PROJECT.md\` → \`## Test strategy\`" && has skills/checkpoints/checkpoint-build.md "CONFIRMED" \
   && ok "Offer records the choice with a Status column" || bad "Offer record line"
-has skills/testing-shape.md "Defaults: every change \`affected\`, module close \`module\`, deploy-ready" \
+has skills/testing-shape.md "defaults \`affected\`, \`module\`, \`full\`" \
   && ok "testing-shape.md states the same defaults" || bad "testing-shape.md defaults sentence"
 
 echo "== existing-app-change.md =="
 has skills/existing-app-change.md "Re-run the baseline at every module gate" && ok "kept: every gate is also a regression gate" || bad "regression-gate rule lost"
 has skills/existing-app-change.md "the whole baseline runs at deploy-ready" && ok "whole baseline at deploy-ready" || bad "deploy-ready baseline"
+has skills/existing-app-change.md "--moment module --module <M>" && has skills/checkpoints/checkpoint-build.md "--moment module --module <M>" \
+  && ok "the module-moment call names its module" || bad "module call without --module"
+
+echo "== unit tests off by default, wired =="
+has skills/checkpoints/checkpoint-build.md "\`Unit modules: Shop, Admin\`" && has skills/checkpoints/checkpoint-build.md "Unit tests default: yes" && has skills/checkpoints/checkpoint-build.md "Unit tests: yes" \
+  && ok "Offer records the three ways to turn unit on" || bad "unit-on syntax missing"
+has skills/checkpoints/checkpoint-build.md "Build complete = you say the app is ready" && ok "build complete is declared by the developer" || bad "build complete undefined"
+has skills/module-review.md "--moment module" && ok "module-review PROVE runs the module row" || bad "module-review not wired"
+has skills/module-brief.md "Unit tests: yes" && ok "module brief names the flip line" || bad "module brief flip line"
 
 echo; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

From b5a8de3b30d6d32eaa4f7c6544e9a23b750578cd Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 16:13:01 +0800
Subject: [PATCH 3/7] fix(testing): the strategy Unit cell is a scope, never a
 switch; robust Unit modules parsing

Review r2: a recorded Offer table (affected, module) overrode the off-by-default gate,
and a table recording none could never run a flipped module. The gate now always filters
at the change and module moments. Unit modules: strips # and (...) comments, reads a
bullet, none and any case, and warns on names matching no module. Offer shows
'modules on only'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  2 +-
 project-bin/affected-tests.sh          | 39 ++++++++++++++++++++------
 skills/checkpoints/checkpoint-build.md | 10 +++----
 tests/wave2/test-affected-tests.sh     | 30 ++++++++++++++++++--
 tests/wave2/test-test-strategy-docs.sh |  2 +-
 5 files changed, 65 insertions(+), 18 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c464847a..f163d89a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
-- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; an explicit strategy row wins over all three. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate.
+- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; the strategy row's Unit cell is a scope only and never turns unit on. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate.
 - fix(_common): **`find_java` on macOS picks the JDK that matches the model's Mendix version: 25 for 11.14 and above, 21 below (and when the version cannot be read).** It always asked for `java_home -v 21`, a pin added for 11.12.2 (JDK 25 breaks that build's gradle 8.5). On 11.15 the same pin broke the other way: mxbuild failed `release version 25 not supported` (exit 3) on the first Java-action build, 21 times in one lab phase, until `JAVA_HOME` was set by hand in `toolkit.env`. Mendix's system requirements list JDK 21 for Studio Pro 11.13 and below and JDK 25 for 11.14 and above. The version comes from `mxtk_model_version` (the .mpr's `_MetaData`). Detection uses `java_home -F -v N`, because plain `-v N` never fails on macOS (a missing JDK silently returns the default, exit 0). When the wanted JDK is missing, the default is still used, and the new `find_java_note` line is printed by exec.sh, verify-model.sh and doctor.sh (they all discard find_java's stderr). `JAVA_HOME` still wins; `MXTK_JAVA_HOME_BIN` overrides the java_home binary for tests. `tests/wave2/test-find-java-version.sh` (fake java_home that mimics the real fallback-with-exit-0, 14 cases) fails on master for 11.14, 11.15 and 12.x. Not run: a real two-JDK Mac build; the version table is taken from the Mendix docs. Field report: a five-app lab project (Mendix 11.15, mxcli v0.26.0), TK-018 — MendixMau
 - learn(workflow skills): **a Jump has one fixed target, so one failure handler for N steps is a child workflow, not a shared node; plus three probed workflow errors (CE0117 on a `System.Workflow` argument means map `$WorkflowInstance`, CE1613 means the called workflow's parameter must be `$WorkflowContext`, and `returns` goes before `exposed as workflow action`).** `workflow-structure-rules.md` §1 and `learned-workflow-patterns.md` §9. The §9 rows were probed on mxcli v0.26.0 / Mendix 11.15.0 with native `mx check`. The third row corrects the reading that a called microflow cannot return a value. Upstream issues: mendixlabs/mxcli#1529 (CE0117), #1530 (CE1613, and `syntax workflow call-workflow` shows the failing form), #1531 (describe drops every call workflow mapping), #1533 (`returns` parse messages). Source: a five-app lab project (Mendix 11.15, mxcli v0.26.0) — five-app lab report, WF-1
 - learn(fixture-seeding): **resetting workflow data: abort instances through the runtime (Workflow Commons admin or *Change workflow state*); if SQL is unavoidable, delete the link tables first (`system$workflow_currentactivity`, `system$workflow_workflowdefinition`, `system$workflowusertask_assignees`, `system$workflowusertask_targetusers`, `system$workflowusertask_targetgroups`, plus the `system$workflowendedusertask_*` equivalents; names read from a Mendix 11.15 database), and reset a context object only after its instances are gone.** A seed reset that deleted workflow rows by SQL failed on those links (WF-5). Text only, `ondemand` skill. — five-app lab report, WF-5
diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
index b53b007e..3ab3d780 100755
--- a/project-bin/affected-tests.sh
+++ b/project-bin/affected-tests.sh
@@ -37,7 +37,10 @@
 #
 # UNIT TESTS ARE OFF BY DEFAULT (field test of the RC, 2026-10-16: nothing read the knob, so a
 # unit test was offered after every change). Precedence for the UNIT scope, highest first:
-#   1. An explicit '## Test strategy' row for the moment (its Unit tests cell): wins outright.
+#   1. The '## Test strategy' Unit cell is a SCOPE only (none|affected|module|full). It never
+#      turns unit on: at the change and module moments the switches in 2 and 3 always filter it.
+#      Gate open (default yes): the cell is used as written. Gate closed: flipped modules only, with
+#      the moment's built-in scope when the cell says none.
 #   2. A module flipped to yes: that module's tests only, at the change and module moments (deploy
 #      and all run every existing unit test). A flip is any of: a PROJECT.md line
 #      `Unit modules: Shop, Admin` (decided at CAC-5); in the module brief
@@ -45,8 +48,9 @@
 #      `Unit tests: yes` or the Declared-shape table row `| Unit (...) | yes | ...`.
 #   3. PROJECT.md `Unit tests default:`. `yes` keeps the built-in scope for the moment; `no`, or the
 #      line ABSENT, means unit is OFF for every module not flipped in 2. When off the script prints
-#      one `unit off` line and NEVER a `run ... .test.mdl` row. (A row you wrote is a decision;
-#      the default line is only a default.)
+#      one `unit off` line and NEVER a `run ... .test.mdl` row. `Unit modules:` takes names split
+#      by comma or space; `#` and `( ... )` comments, a leading `- ` bullet, any case and `none`
+#      are read; a name that matches no module warns on stderr.
 # Journeys are not affected by any of this.
 #
 # HOW THE SELECTION IS MADE (judgement-free facts only; skills-over-scripts.md):
@@ -117,7 +121,7 @@ out() { printf '%s\n' "$*"; }
 case "$MOMENT" in change) ROW="Every change"; ALT="Every change"; DU=affected; DJ=affected ;;
                   module) ROW="Module done"; ALT="Module close"; DU=module; DJ=module ;;
                   deploy) ROW="Build complete"; ALT="Deploy-ready"; DU=full; DJ=full ;; esac
-U="$DU"; J="$DJ"; UNIT_ROW=0; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
+U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
 if [ -f PROJECT.md ]; then
   _row="$(awk -v r="$ROW" -v r2="$ALT" '
     /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
@@ -127,7 +131,7 @@ if [ -f PROJECT.md ]; then
                     print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
   if [ -n "$_row" ]; then
     _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
-    case "$_u" in none|affected|module|full) U="$_u"; UNIT_ROW=1 ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
+    case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
     case "$_j" in none|affected|module|full) J="$_j" ;; *) FROM="${FROM}row '$ROW' journey scope '$_j' unknown, default used; " ;; esac
     case "$FROM" in default:*) FROM="PROJECT.md ## Test strategy, row '$ROW'${_s:+, $_s}" ;; *) FROM="${FROM}PROJECT.md ## Test strategy" ;; esac
   fi
@@ -135,7 +139,10 @@ fi
 
 # ── Unit gate: off unless the project default is yes, the row says so, or a module is flipped ──
 UNIT_DEFAULT="$(awk '/^[ \t*]*Unit tests default:/ { v = $0; sub(/^[^:]*:/, "", v); gsub(/[ \t*`]/, "", v); print tolower(v); exit }' PROJECT.md 2>/dev/null)"
-FLIPPED="$(awk '/^[ \t*]*Unit modules:/ { v = $0; sub(/^[^:]*:/, "", v); gsub(/[ \t*`]/, "", v); gsub(/,/, " ", v); print v; exit }' PROJECT.md 2>/dev/null)"
+FLIPPED="$(awk 'tolower($0) ~ /^[ \t*>-]*unit modules:/ { v = $0; sub(/^[^:]*:/, "", v); sub(/#.*/, "", v); gsub(/\([^)]*\)/, "", v)
+  gsub(/[ \t*`,]+/, " ", v); n = split(v, a, " "); o = ""
+  for (i = 1; i <= n; i++) if (tolower(a[i]) != "none") o = o " " a[i]
+  print o; exit }' PROJECT.md 2>/dev/null)"
 for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md; do
   [ -f "$_b" ] || continue
   case "$_b" in */module-brief.md) _m="$(basename "$(dirname "$_b")")" ;; *) _m="$(basename "$_b" -brief.md)" ;; esac
@@ -146,10 +153,10 @@ for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md
       END { exit !f }' "$_b"; then FLIPPED="$FLIPPED $_m"; fi
 done
 UNIT_GATED=0; UNIT_OFF_WHY=""
-if [ "$UNIT_ROW" = 0 ] && [ "$MOMENT" != deploy ] && [ "${UNIT_DEFAULT#yes}" = "$UNIT_DEFAULT" ]; then
+if [ "$MOMENT" != deploy ] && [ "${UNIT_DEFAULT#yes}" = "$UNIT_DEFAULT" ]; then
   if [ -n "$UNIT_DEFAULT" ]; then _dw="PROJECT.md Unit tests default: $UNIT_DEFAULT"
   else _dw="PROJECT.md has no 'Unit tests default:' line, treated as no"; fi
-  if [ -n "$FLIPPED" ]; then UNIT_GATED=1
+  if [ -n "$FLIPPED" ]; then UNIT_GATED=1; [ "$U" = none ] && U="$DU"
   else U=none; UNIT_OFF_WHY="($_dw; flip a module: PROJECT.md 'Unit modules: <M>' or 'Unit tests: yes' in its brief)"; fi
   FROM="$FROM; unit: $_dw"
 fi
@@ -272,6 +279,22 @@ select_journeys() {  # $1 = scope; prints "<file>\t<why>"
   esac | awk -F'\t' '!seen[$1]++'
 }
 
+# Module names as typed in PROJECT.md or a brief: match case-insensitively, warn on strangers.
+if [ -n "$FLIPPED" ]; then
+  { cat "$WORK/modules"; for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md; do
+      [ -f "$_b" ] || continue
+      case "$_b" in */module-brief.md) basename "$(dirname "$_b")" ;; *) basename "$_b" -brief.md ;; esac
+    done
+    [ -s "$WORK/tests" ] && xargs grep -ohE '(^|[^A-Za-z0-9_.])[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_]' < "$WORK/tests" 2>/dev/null | sed -E 's/^[^A-Za-z_]//; s/\..*//'
+  } | sort -u > "$WORK/known"
+  _canon=""
+  for m in $FLIPPED; do
+    _k="$(awk -v m="$m" 'tolower($0) == tolower(m) { print; exit }' "$WORK/known")"
+    if [ -n "$_k" ]; then _canon="$_canon $_k"
+    else _canon="$_canon $m"; echo "warning: Unit modules names '$m', which matches no module in the tests, briefs or this change" >&2; fi
+  done
+  FLIPPED="$_canon"
+fi
 select_unit "$U" > "$WORK/unit.sel"
 if [ "$UNIT_GATED" = 1 ]; then   # default no, some modules flipped: only those modules' tests
   : > "$WORK/unit.gated"
diff --git a/skills/checkpoints/checkpoint-build.md b/skills/checkpoints/checkpoint-build.md
index dd1ed8b2..8fde1c86 100644
--- a/skills/checkpoints/checkpoint-build.md
+++ b/skills/checkpoints/checkpoint-build.md
@@ -110,8 +110,8 @@ developer may change any cell in the same answer:
 >
 > | Moment | Unit tests | Journeys |
 > |---|---|---|
-> | Every change (build and feedback) | affected | affected |
-> | Module done | module | module |
+> | Every change (build and feedback) | affected, modules on only | affected |
+> | Module done | module, modules on only | module |
 > | Build complete, and before every later deploy | full | full |
 >
 > `affected` = what the change touched and its callers (`bin/affected-tests.sh`); `module` = the
@@ -123,11 +123,11 @@ developer may change any cell in the same answer:
 > a fixed bug. Change a cell, name modules, or say 'defaults'."
 
 **Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column (`CONFIRMED`, or
-`ASSUMED` in auto mode), and the line `Unit modules: Shop, Admin` (`none` if none).
+`ASSUMED` in auto mode), and the line `Unit modules: Shop, Admin` (`none` if none). Record Unit cells as scopes as shown.
 `bin/affected-tests.sh --moment change|module|deploy|all` reads it; no section: these defaults.
 Unit is **off** unless `Unit tests default: yes` (whole project; absent = no), a `Unit modules:`
-entry, or `Unit tests: yes` in the module brief. A Unit cell recorded here beats all three (default
-`no`: record `none`). At build end ask "full run now?", a confirmation, not a decision.
+entry, or `Unit tests: yes` in the module brief; the Unit cell is a scope and never turns it on.
+At build end ask "full run now?", a confirmation, not a decision.
 
 ## Open Question
 
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
index 7e57df9a..04ebbb49 100644
--- a/tests/wave2/test-affected-tests.sh
+++ b/tests/wave2/test-affected-tests.sh
@@ -148,6 +148,8 @@ echo "== E: the project's strategy row wins =="
 cat > "$P/PROJECT.md" <<'EOF'
 # Project
 
+Unit tests default: yes
+
 ## Test strategy
 | Moment | Unit tests | Journeys | Status |
 |---|---|---|---|
@@ -270,10 +272,32 @@ printf '# Project\n\nUnit tests default: no\nUnit modules: Admin, Other\n' > "$P
 run L4d "$TOTAL" >/dev/null; lacks L4d "Total.test.mdl" && ok "L4d PROJECT.md 'Unit modules: Admin, Other': a Shop change selects no unit test" || bad "L4d" "$(cat "$WORK/out.L4d")"
 run L4e "$ENTITY" >/dev/null; printf '# Project\n\nUnit tests default: no\nUnit modules: Shop\n' > "$P/PROJECT.md"; run L4f "$ENTITY" >/dev/null
 has L4f "unit	tests/unit/Total.test.mdl	names module Shop" && lacks L4f "Other.test.mdl" && ok "L4f 'Unit modules: Shop' flips Shop only" || bad "L4f" "$(cat "$WORK/out.L4f")"
-# L5: an explicit row beats the default line
-printf 'Unit tests default: no\n## Test strategy\n| Every change | affected | affected | CONFIRMED |\n' > "$P/PROJECT.md"
+# L5 (P8): the Offer's recorded defaults are a scope, never a switch: default no, Admin flipped, Shop change = no Shop unit
+printf 'Unit tests default: no\nUnit modules: Admin\n## Test strategy\n| Moment | Unit tests | Journeys | Status |\n|---|---|---|---|\n| Every change | affected | affected | CONFIRMED |\n| Module done | module | module | CONFIRMED |\n' > "$P/PROJECT.md"
 run L5 "$TOTAL" >/dev/null
-has L5 "unit	tests/unit/Total.test.mdl" && ok "L5 an explicit strategy row beats Unit tests default: no" || bad "L5" "$(cat "$WORK/out.L5")"
+lacks L5 "Total.test.mdl" && lacks L5 "Validate.test.mdl" && ok "L5 row 'affected' + Admin flipped: a Shop change runs no Shop unit" || bad "L5" "$(cat "$WORK/out.L5")"
+run L5b --moment module --module Shop >/dev/null
+lacks L5b "Total.test.mdl" && ok "L5b module moment: Shop unit still off" || bad "L5b" "$(cat "$WORK/out.L5b")"
+# L5c (P9): row none + module turned on = that module's unit runs
+printf 'Unit tests default: no\nUnit modules: Shop\n## Test strategy\n| Every change | none | affected | CONFIRMED |\n| Module done | none | module | CONFIRMED |\n' > "$P/PROJECT.md"
+run L5c "$TOTAL" >/dev/null
+has L5c "unit	tests/unit/Total.test.mdl" && ok "L5c row none + Unit modules: Shop: Shop's unit runs" || bad "L5c" "$(cat "$WORK/out.L5c")"
+run L5d --moment module --module Shop >/dev/null
+has L5d "Total.test.mdl" && ok "L5d same at the module moment" || bad "L5d" "$(cat "$WORK/out.L5d")"
+# L8: Unit modules parsing
+um() { printf 'Unit tests default: no\n%s\n' "$1" > "$P/PROJECT.md"; }
+um 'Unit modules: shop , ADMIN'; run L8a "$ENTITY" >/dev/null 2>&1
+has L8a "Total.test.mdl" && ok "L8a names are case-insensitive" || bad "L8a" "$(cat "$WORK/out.L8a")"
+um 'Unit modules: Shop # decided at CAC-5'; run L8b "$ENTITY" >/dev/null 2>&1
+has L8b "Total.test.mdl" && ok "L8b a # comment is stripped" || bad "L8b" "$(cat "$WORK/out.L8b")"
+um 'Unit modules: Shop (decided at CAC-5)'; run L8c "$ENTITY" >/dev/null 2>&1
+has L8c "Total.test.mdl" && lacks L8c "Other.test.mdl" && ok "L8c a (...) comment is stripped" || bad "L8c" "$(cat "$WORK/out.L8c")"
+um '- Unit modules: Shop'; run L8d "$ENTITY" >/dev/null 2>&1
+has L8d "Total.test.mdl" && ok "L8d a bullet line is read" || bad "L8d" "$(cat "$WORK/out.L8d")"
+um 'Unit modules: none'; run L8e "$ENTITY" >/dev/null 2>&1
+has L8e "unit	off" && lacks L8e "unit on only for" && [ ! -s "$WORK/err.L8e" ] && ok "L8e none = no modules, no warning" || bad "L8e" "$(cat "$WORK/out.L8e" "$WORK/err.L8e")"
+um 'Unit modules: Shop, Nowhere'; run L8f "$ENTITY" >/dev/null 2>&1
+grep -q "'Nowhere'" "$WORK/err.L8f" && ! grep -q "'Shop'" "$WORK/err.L8f" && ok "L8f an unknown module warns on stderr, a known one does not" || bad "L8f" "$(cat "$WORK/err.L8f")"
 # L6/L7: grants (unit on, so a module-wide selection would show)
 cp "$BASE_PM" "$P/PROJECT.md"
 run L6 "$GRANT" >/dev/null
diff --git a/tests/wave2/test-test-strategy-docs.sh b/tests/wave2/test-test-strategy-docs.sh
index bafa9c17..2b63f55b 100644
--- a/tests/wave2/test-test-strategy-docs.sh
+++ b/tests/wave2/test-test-strategy-docs.sh
@@ -36,7 +36,7 @@ echo "== the old full-suite-at-module-close wording is gone =="
 
 echo "== one table, three places =="
 for f in skills/checkpoints/checkpoint-build.md; do
-  has $f "| Every change (build and feedback) | affected | affected |" && has $f "| Module done | module | module |" && has $f "| Build complete, and before every later deploy | full | full |" \
+  has $f "| Every change (build and feedback) | affected, modules on only | affected |" && has $f "| Module done | module, modules on only | module |" && has $f "| Build complete, and before every later deploy | full | full |" \
     && ok "CAC-5 Offer table with the three defaults" || bad "Offer table"
 done
 has skills/checkpoints/checkpoint-build.md "PROJECT.md\` → \`## Test strategy\`" && has skills/checkpoints/checkpoint-build.md "CONFIRMED" \

From aa33c97007559251d9858cf28bf37cbb98dd1b34 Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 16:15:16 +0800
Subject: [PATCH 4/7] docs(changelog): credit segment for the test-strategy
 entry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f163d89a..040d713a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
-- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; the strategy row's Unit cell is a scope only and never turns unit on. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate.
+- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; the strategy row's Unit cell is a scope only and never turns unit on. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate — the maintainer's decision, 2026-10-16
 - fix(_common): **`find_java` on macOS picks the JDK that matches the model's Mendix version: 25 for 11.14 and above, 21 below (and when the version cannot be read).** It always asked for `java_home -v 21`, a pin added for 11.12.2 (JDK 25 breaks that build's gradle 8.5). On 11.15 the same pin broke the other way: mxbuild failed `release version 25 not supported` (exit 3) on the first Java-action build, 21 times in one lab phase, until `JAVA_HOME` was set by hand in `toolkit.env`. Mendix's system requirements list JDK 21 for Studio Pro 11.13 and below and JDK 25 for 11.14 and above. The version comes from `mxtk_model_version` (the .mpr's `_MetaData`). Detection uses `java_home -F -v N`, because plain `-v N` never fails on macOS (a missing JDK silently returns the default, exit 0). When the wanted JDK is missing, the default is still used, and the new `find_java_note` line is printed by exec.sh, verify-model.sh and doctor.sh (they all discard find_java's stderr). `JAVA_HOME` still wins; `MXTK_JAVA_HOME_BIN` overrides the java_home binary for tests. `tests/wave2/test-find-java-version.sh` (fake java_home that mimics the real fallback-with-exit-0, 14 cases) fails on master for 11.14, 11.15 and 12.x. Not run: a real two-JDK Mac build; the version table is taken from the Mendix docs. Field report: a five-app lab project (Mendix 11.15, mxcli v0.26.0), TK-018 — MendixMau
 - learn(workflow skills): **a Jump has one fixed target, so one failure handler for N steps is a child workflow, not a shared node; plus three probed workflow errors (CE0117 on a `System.Workflow` argument means map `$WorkflowInstance`, CE1613 means the called workflow's parameter must be `$WorkflowContext`, and `returns` goes before `exposed as workflow action`).** `workflow-structure-rules.md` §1 and `learned-workflow-patterns.md` §9. The §9 rows were probed on mxcli v0.26.0 / Mendix 11.15.0 with native `mx check`. The third row corrects the reading that a called microflow cannot return a value. Upstream issues: mendixlabs/mxcli#1529 (CE0117), #1530 (CE1613, and `syntax workflow call-workflow` shows the failing form), #1531 (describe drops every call workflow mapping), #1533 (`returns` parse messages). Source: a five-app lab project (Mendix 11.15, mxcli v0.26.0) — five-app lab report, WF-1
 - learn(fixture-seeding): **resetting workflow data: abort instances through the runtime (Workflow Commons admin or *Change workflow state*); if SQL is unavoidable, delete the link tables first (`system$workflow_currentactivity`, `system$workflow_workflowdefinition`, `system$workflowusertask_assignees`, `system$workflowusertask_targetusers`, `system$workflowusertask_targetgroups`, plus the `system$workflowendedusertask_*` equivalents; names read from a Mendix 11.15 database), and reset a context object only after its instances are gone.** A seed reset that deleted workflow rows by SQL failed on those links (WF-5). Text only, `ondemand` skill. — five-app lab report, WF-5

From 6fc3edd9cc8294a4594209e2c6f25978153d7eb5 Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 16:43:40 +0800
Subject: [PATCH 5/7] fix(testing): match strategy row labels by prefix, read
 Offer cell wording, warn on unknown rows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 project-bin/affected-tests.sh      | 12 +++++++++---
 skills/module-brief.md             |  2 +-
 skills/testing-shape.md            |  2 +-
 tests/wave2/test-affected-tests.sh | 16 ++++++++++++++++
 4 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
index 3ab3d780..064078f5 100755
--- a/project-bin/affected-tests.sh
+++ b/project-bin/affected-tests.sh
@@ -33,7 +33,10 @@
 # and the strategy row says "default". --moment picks the row (change is the default):
 #   change = every change (build and feedback) · module = module done · deploy = build complete and
 #   before every later deploy · all = "run everything", any time (same as deploy).
-# Old row names "Module close" and "Deploy-ready" still read.
+# Old row names "Module close" and "Deploy-ready" still read. A label is matched by its first words,
+# case-insensitively: "Every change (build and feedback)" and "Build complete, and before every later
+# deploy" (the Offer's own wording) map to their moment; a cell reads up to its first comma
+# ("affected, modules on only" = affected). An unknown row label warns on stderr.
 #
 # UNIT TESTS ARE OFF BY DEFAULT (field test of the RC, 2026-10-16: nothing read the knob, so a
 # unit test was offered after every change). Precedence for the UNIT scope, highest first:
@@ -125,8 +128,11 @@ U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW'
 if [ -f PROJECT.md ]; then
   _row="$(awk -v r="$ROW" -v r2="$ALT" '
     /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
-    on && /^\|/ { split($0, c, "|"); x = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", x)
-                  if (tolower(x) == tolower(r) || tolower(x) == tolower(r2)) { u = c[3]; j = c[4]; s = c[5]
+    on && /^\|/ { split($0, c, "|"); x = tolower(c[2]); sub(/[(,].*/, "", x); gsub(/^[ \t*`]+|[ \t*`]+$/, "", x)
+                  if (x == "moment" || x ~ /^[-: ]*$/) next
+                  if (x !~ /^(every change|module done|module close|build complete|deploy-ready)$/) { y = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", y); print "warning: ## Test strategy row label \"" y "\" is not a known moment, ignored" > "/dev/stderr"; next }
+                  if (x == tolower(r) || x == tolower(r2)) { u = c[3]; j = c[4]; s = c[5]
+                    sub(/,.*/, "", u); sub(/,.*/, "", j)
                     gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
                     print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
   if [ -n "$_row" ]; then
diff --git a/skills/module-brief.md b/skills/module-brief.md
index 49ea74d4..64b2d2f5 100644
--- a/skills/module-brief.md
+++ b/skills/module-brief.md
@@ -150,7 +150,7 @@ all, and never looks at a page.
 |------|-------------|-----|
 | UI (Playwright) | **always** | — |
 | Data (source of truth) | **always** — say which: OQL count delta \| upstream REST response \| documented n/a + the query proving it | `testing-shape.md` §1: "Data" means check the source of truth, not always query a database |
-| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow — name which. Project default: intake Q13 (`Unit tests default:`), `no` unless chosen (`testing-shape.md` §2). Flip: line `Unit tests: yes` |
+| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow, name which. Project default: intake Q13 (`Unit tests default:`), `no` unless chosen (`testing-shape.md` §2). Flip: line `Unit tests: yes` |
 | Trace (OTel) | yes / no | **yes if this module calls out** to REST, an import mapping, or external data — that is where failures get swallowed, and it overrides the project default |
 
 ### Base set — the trigger  (`testing-shape.md` §3)
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 176c3ccb..04a4daaa 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -181,7 +181,7 @@ built yet and claims nothing until it lands.
 | **Module done** | minutes | The module's journeys, unit tests if on (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
 | **Build complete / deploy** | as needed | Every test and journey, once (rows above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
-> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5–10×, and **143
+> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5 to 10 times, and **143
 > minutes** of unit tests (no Unit default set) found stale strings, not one logic bug.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
index 04ebbb49..6ec26f44 100644
--- a/tests/wave2/test-affected-tests.sh
+++ b/tests/wave2/test-affected-tests.sh
@@ -298,6 +298,22 @@ um 'Unit modules: none'; run L8e "$ENTITY" >/dev/null 2>&1
 has L8e "unit	off" && lacks L8e "unit on only for" && [ ! -s "$WORK/err.L8e" ] && ok "L8e none = no modules, no warning" || bad "L8e" "$(cat "$WORK/out.L8e" "$WORK/err.L8e")"
 um 'Unit modules: Shop, Nowhere'; run L8f "$ENTITY" >/dev/null 2>&1
 grep -q "'Nowhere'" "$WORK/err.L8f" && ! grep -q "'Shop'" "$WORK/err.L8f" && ok "L8f an unknown module warns on stderr, a known one does not" || bad "L8f" "$(cat "$WORK/err.L8f")"
+# L9: the Offer table copied verbatim, edited cells must be read
+OFFER='| Moment | Unit tests | Journeys | Status |
+|---|---|---|---|
+| Every change (build and feedback) | UC | JC | CONFIRMED |
+| Module done | module, modules on only | module | CONFIRMED |
+| Build complete, and before every later deploy | full | full | CONFIRMED |'
+pm() { printf 'Unit tests default: yes\n\n## Test strategy\n%s\n' "$(printf '%s\n' "$OFFER" | sed "s/UC/$1/; s/JC/$2/")" > "$P/PROJECT.md"; }
+pm none none; run L9a "$TOTAL" >/dev/null 2>&1
+has L9a "unit=none journeys=none" && has L9a "unit	none	scope none" && lacks L9a ".test.mdl" && ok "L9a Offer label 'Every change (build and feedback)' with Unit none: no unit tests" || bad "L9a" "$(cat "$WORK/out.L9a")"
+pm 'affected, modules on only' affected; run L9b "$TOTAL" >/dev/null 2>"$WORK/err.L9b"
+has L9b "unit=affected journeys=affected" && has L9b "Total.test.mdl" && ! grep -qi "unknown" "$WORK/out.L9b" && [ ! -s "$WORK/err.L9b" ] && ok "L9b the Offer cell 'affected, modules on only' reads as affected, no message" || bad "L9b" "$(cat "$WORK/out.L9b" "$WORK/err.L9b")"
+run L9c --moment module --module Shop >/dev/null 2>&1; has L9c "unit=module" && ok "L9c 'module, modules on only' reads as module" || bad "L9c" "$(head -1 "$WORK/out.L9c")"
+run L9d --moment deploy >/dev/null 2>&1; has L9d "unit=full journeys=full" && has L9d "row 'Build complete" && ok "L9d 'Build complete, and before every later deploy' maps to build complete" || bad "L9d" "$(head -1 "$WORK/out.L9d")"
+printf 'Unit tests default: yes\n## Test strategy\n| Every chnage | none | none | CONFIRMED |\n' > "$P/PROJECT.md"; run L9e "$TOTAL" >/dev/null 2>&1
+grep -q 'row label "Every chnage"' "$WORK/err.L9e" && ok "L9e an unmappable row label warns on stderr" || bad "L9e" "$(cat "$WORK/err.L9e")"
+
 # L6/L7: grants (unit on, so a module-wide selection would show)
 cp "$BASE_PM" "$P/PROJECT.md"
 run L6 "$GRANT" >/dev/null

From d457bb169ef537fbdd6d761399c9c94051247a6b Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 16:54:20 +0800
Subject: [PATCH 6/7] docs(testing-shape): hyphen instead of en dash, keeps
 roles at or below master

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 skills/testing-shape.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 04a4daaa..6695ae3b 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -181,7 +181,7 @@ built yet and claims nothing until it lands.
 | **Module done** | minutes | The module's journeys, unit tests if on (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
 | **Build complete / deploy** | as needed | Every test and journey, once (rows above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
-> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5 to 10 times, and **143
+> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5-10x, and **143
 > minutes** of unit tests (no Unit default set) found stale strings, not one logic bug.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.

From bce55ca3bff16ca6d020290d7276dcb9271f1b49 Mon Sep 17 00:00:00 2001
From: MendixMau <mauritscgvisser@gmail.com>
Date: Fri, 16 Oct 2026 17:24:30 +0800
Subject: [PATCH 7/7] fix(testing): strategy cells cut at the first parenthesis
 or comma; unknown row labels warn after a match too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 project-bin/affected-tests.sh      | 11 ++++++-----
 tests/wave2/test-affected-tests.sh |  5 +++++
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
index 064078f5..6a2873e0 100755
--- a/project-bin/affected-tests.sh
+++ b/project-bin/affected-tests.sh
@@ -35,8 +35,8 @@
 #   before every later deploy · all = "run everything", any time (same as deploy).
 # Old row names "Module close" and "Deploy-ready" still read. A label is matched by its first words,
 # case-insensitively: "Every change (build and feedback)" and "Build complete, and before every later
-# deploy" (the Offer's own wording) map to their moment; a cell reads up to its first comma
-# ("affected, modules on only" = affected). An unknown row label warns on stderr.
+# deploy" (the Offer's own wording) map to their moment; a cell reads up to its first comma or
+# parenthesis ("affected, modules on only" = affected, "none (decided CAC-5)" = none). An unknown row label warns on stderr.
 #
 # UNIT TESTS ARE OFF BY DEFAULT (field test of the RC, 2026-10-16: nothing read the knob, so a
 # unit test was offered after every change). Precedence for the UNIT scope, highest first:
@@ -131,10 +131,11 @@ if [ -f PROJECT.md ]; then
     on && /^\|/ { split($0, c, "|"); x = tolower(c[2]); sub(/[(,].*/, "", x); gsub(/^[ \t*`]+|[ \t*`]+$/, "", x)
                   if (x == "moment" || x ~ /^[-: ]*$/) next
                   if (x !~ /^(every change|module done|module close|build complete|deploy-ready)$/) { y = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", y); print "warning: ## Test strategy row label \"" y "\" is not a known moment, ignored" > "/dev/stderr"; next }
-                  if (x == tolower(r) || x == tolower(r2)) { u = c[3]; j = c[4]; s = c[5]
-                    sub(/,.*/, "", u); sub(/,.*/, "", j)
+                  if (!done && (x == tolower(r) || x == tolower(r2))) { done = 1; u = c[3]; j = c[4]; s = c[5]
+                    sub(/[(,].*/, "", u); sub(/[(,].*/, "", j)
                     gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
-                    print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
+                    out = tolower(u) "\t" tolower(j) "\t" s } }
+    END { if (done) print out }' PROJECT.md)"
   if [ -n "$_row" ]; then
     _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
     case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
index 6ec26f44..39d45601 100644
--- a/tests/wave2/test-affected-tests.sh
+++ b/tests/wave2/test-affected-tests.sh
@@ -314,6 +314,11 @@ run L9d --moment deploy >/dev/null 2>&1; has L9d "unit=full journeys=full" && ha
 printf 'Unit tests default: yes\n## Test strategy\n| Every chnage | none | none | CONFIRMED |\n' > "$P/PROJECT.md"; run L9e "$TOTAL" >/dev/null 2>&1
 grep -q 'row label "Every chnage"' "$WORK/err.L9e" && ok "L9e an unmappable row label warns on stderr" || bad "L9e" "$(cat "$WORK/err.L9e")"
 
+pm 'none (decided CAC-5)' none; run L9f "$TOTAL" >/dev/null 2>"$WORK/err.L9f"
+has L9f "unit=none" && lacks L9f ".test.mdl" && ! grep -qi "unknown" "$WORK/out.L9f" && ok "L9f a cell 'none (decided CAC-5)' reads as none: no unit tests" || bad "L9f" "$(cat "$WORK/out.L9f")"
+printf 'Unit tests default: yes\n## Test strategy\n| Every change | none | none | CONFIRMED |\n| Modul done | none | none | CONFIRMED |\n' > "$P/PROJECT.md"; run L9g "$TOTAL" >/dev/null 2>"$WORK/err.L9g"
+has L9g "unit=none" && grep -q 'row label "Modul done"' "$WORK/err.L9g" && ok "L9g an unknown label AFTER a matched row still warns" || bad "L9g" "$(cat "$WORK/err.L9g")"
+
 # L6/L7: grants (unit on, so a module-wide selection would show)
 cp "$BASE_PM" "$P/PROJECT.md"
 run L6 "$GRANT" >/dev/null