diff --git a/CHANGELOG.md b/CHANGELOG.md
index d76e227f..ee699ada 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- process(testing): **unit tests are now off by default and `affected-tests.sh` enforces it; each project picks its test strategy with the developer at CAC-5.** Fast-tracked by the maintainer on 2026-10-16 because users report tests firing on every change (the baseline-text A/B is waived; E3 follows as a check). Moments: every change = gate plus what it touched (unit only for affected modules with unit on); module done = that module's journeys (+ its unit tests if on); build complete and before every later deploy = everything once; "run everything" any time. The CAC-5 Offer records it in PROJECT.md `## Test strategy` (Status `ASSUMED` in auto mode). `affected-tests.sh` reads `Unit tests default:` (`no` or absent means unit off, one `unit off` line, never a `.test.mdl` run row); turn unit on per project with `Unit tests default: yes`, per module with `Unit modules: Shop, Admin` in PROJECT.md or `Unit tests: yes` in the module brief; the strategy row's Unit cell is a scope only and never turns unit on. A grant on a microflow or page the same script changes is part of that subject and no longer selects the owning module's tests. `module-review.md` PROVE now runs `--moment module --module <M>`. `testing-shape.md`, `checkpoint-build.md`, `iterative-build-loop.md`, `conversion-runbook.md` and the exec.sh logic lane text updated. `tests/wave2/test-test-strategy-docs.sh` and the extended `test-affected-tests.sh` pin it. Baseline words stay at or below master (75,219 vs 75,225). Split out of #409; found by the field test of the release candidate — the maintainer's decision, 2026-10-16
 - learn(skills): **five lab findings land as compact rows, each paid for by trimming prose in the same files, so always-loaded words do not grow (baseline 75,225 to 75,204, budget 80,000).** Enum value `New` and `AutoCreatedDate`/`AutoOwner` (detection gaps), `[%CurrentDateTime%]` not `currentDateTime()`, expression return types (Decimal from date diffs and `div`, absolute `secondsBetween`, `formatDecimal` on pages), CE2729 from the default home page and page microflow grants, Atlas selector carriers for list views, page body and timelines, `-small` spacing suffixes do not exist, `display: contents` rows paint nothing, CSS pseudo text is invisible to `innerText` — lab field runs, Refs #276 (TK-020, TK-021, TK-022, TK-024)
 - fix(design-check): **a design system whose palette lives only in scoped `:root.<theme>` blocks no longer reads as "0 of N tokens carry the design's value".** Pass 2b compared every token against a bare `:root` of the built sheet, so a themed-only palette always warned, a false warning that teaches agents to ignore the check. A token the design declares only in scoped blocks is now compared block for block against the same-named block in the built sheet, and a wrong value is still named with its block (knob binding stays bare-only: a knob bound inside a theme the app is not wearing is not bound). Synthetic fixtures `ds-themed.css`, `built-themed.css`, `built-themed-wrong.css`; 5 new cases in `test-design-reaches-app.sh` (50 total) — TK-015 part (b)
 - fix(tests): **`test-exec-hash-verify.sh` case K passes on macOS.** `$TMPDIR` ends in `/`, so the bare `mktemp` path held `//` and the exact `MXPATCH_BACKUP_DIR` path assert could not match; `WORK` is now `cd`-ed into and read back with `pwd -P`. Test only, no script change. 42 pass / 1 fail before, 43 / 0 after — #384 review
diff --git a/project-bin/affected-tests.sh b/project-bin/affected-tests.sh
index 2c701886..6a2873e0 100755
--- a/project-bin/affected-tests.sh
+++ b/project-bin/affected-tests.sh
@@ -10,7 +10,7 @@
 #   caller    <Module.Name>  depth N     (SHOW CALLERS OF ... TRANSITIVE)
 #   callers   measured | NOT MEASURED (<reason>)
 #   data      NOT MEASURED  <kind> <Module.Name>  (entity/association/enumeration/access/module/role/userrole/constant subject)
-#   unit      <file.test.mdl>  <why>
+#   unit      <file.test.mdl>  <why>   |   unit  off  (<why unit is off>)
 #   journey   <file.journey.json>  <why>
 #   journeys  unmapped  N of M journey file(s) cannot be selected by name
 #   run       <the command to run that selection>
@@ -27,10 +27,34 @@
 # THE STRATEGY. PROJECT.md "## Test strategy" (skills/checkpoints/checkpoint-build.md writes it):
 #   | Moment | Unit tests | Journeys | Status |
 #   | Every change | affected | affected | CONFIRMED |
-#   | Module close | module | module | CONFIRMED |
-#   | Deploy-ready | full | full | CONFIRMED |
+#   | Module done | module | module | CONFIRMED |
+#   | Build complete | full | full | CONFIRMED |
 # Scopes: none | affected | module | full. No section, or no row for the moment: these defaults,
-# and the strategy row says "default". --moment picks the row (change is the default).
+# and the strategy row says "default". --moment picks the row (change is the default):
+#   change = every change (build and feedback) · module = module done · deploy = build complete and
+#   before every later deploy · all = "run everything", any time (same as deploy).
+# Old row names "Module close" and "Deploy-ready" still read. A label is matched by its first words,
+# case-insensitively: "Every change (build and feedback)" and "Build complete, and before every later
+# deploy" (the Offer's own wording) map to their moment; a cell reads up to its first comma or
+# parenthesis ("affected, modules on only" = affected, "none (decided CAC-5)" = none). An unknown row label warns on stderr.
+#
+# UNIT TESTS ARE OFF BY DEFAULT (field test of the RC, 2026-10-16: nothing read the knob, so a
+# unit test was offered after every change). Precedence for the UNIT scope, highest first:
+#   1. The '## Test strategy' Unit cell is a SCOPE only (none|affected|module|full). It never
+#      turns unit on: at the change and module moments the switches in 2 and 3 always filter it.
+#      Gate open (default yes): the cell is used as written. Gate closed: flipped modules only, with
+#      the moment's built-in scope when the cell says none.
+#   2. A module flipped to yes: that module's tests only, at the change and module moments (deploy
+#      and all run every existing unit test). A flip is any of: a PROJECT.md line
+#      `Unit modules: Shop, Admin` (decided at CAC-5); in the module brief
+#      (architecture/modules/<M>/module-brief.md or architecture/modules/<M>-brief.md) a line
+#      `Unit tests: yes` or the Declared-shape table row `| Unit (...) | yes | ...`.
+#   3. PROJECT.md `Unit tests default:`. `yes` keeps the built-in scope for the moment; `no`, or the
+#      line ABSENT, means unit is OFF for every module not flipped in 2. When off the script prints
+#      one `unit off` line and NEVER a `run ... .test.mdl` row. `Unit modules:` takes names split
+#      by comma or space; `#` and `( ... )` comments, a leading `- ` bullet, any case and `none`
+#      are read; a name that matches no module warns on stderr.
+# Journeys are not affected by any of this.
 #
 # HOW THE SELECTION IS MADE (judgement-free facts only; skills-over-scripts.md):
 #   1. Subjects: `bin/exec.sh --subjects <script>` (the same statement lexer as the change class).
@@ -52,7 +76,11 @@
 #      selection is never read as "nothing owed".
 #   5. module: every test file naming the module, journeys/<M>.journey.json; the modules are the
 #      subjects' modules plus every --module. full: every test file, every journey file.
-#   6. data subjects (entity, association, enumeration, access, module, module role, user role,
+#   6. A grant/revoke whose object (microflow, page, ...) the SAME script creates or modifies is
+#      part of that subject (describe output ends in one): it selects nothing by module. A grant
+#      with no such object in the script (entity, module role, other object) is an access change
+#      and is selected by owning module as in 7.
+#   7. data subjects (entity, association, enumeration, access, module, module role, user role,
 #      constant): selected by the owning module only (a user role has no module and selects
 #      nothing). Their use in another module's rule, page or microflow is not measured, and a
 #      "data NOT MEASURED" row says so for each one.
@@ -81,7 +109,8 @@ while [ $# -gt 0 ]; do
 $(cd "$(dirname "$1")" && pwd)/$(basename "$1")"; shift ;;
   esac
 done
-case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module or deploy" >&2; exit 2 ;; esac
+[ "$MOMENT" = all ] && MOMENT=deploy
+case "$MOMENT" in change|module|deploy) ;; *) echo "✗ --moment takes change, module, deploy or all" >&2; exit 2 ;; esac
 case "$DEPTH" in ''|*[!0-9]*) echo "✗ --depth takes a number" >&2; exit 2 ;; esac
 SCRIPTS="$(printf '%s\n' "$SCRIPTS" | sed '/^$/d')"
 [ -n "$SCRIPTS" ] || [ "$MOMENT" != change ] || { echo "✗ a change needs at least one script" >&2; usage; }
@@ -92,17 +121,21 @@ WORK="$(mktemp -d "${TMPDIR:-/tmp}/affected.XXXXXX")"; trap 'rm -rf "$WORK"' EXI
 out() { printf '%s\n' "$*"; }
 
 # ── Strategy row ─────────────────────────────────────────────────────────────
-case "$MOMENT" in change) ROW="Every change"; DU=affected; DJ=affected ;;
-                  module) ROW="Module close"; DU=module;   DJ=module ;;
-                  deploy) ROW="Deploy-ready"; DU=full;     DJ=full ;; esac
+case "$MOMENT" in change) ROW="Every change"; ALT="Every change"; DU=affected; DJ=affected ;;
+                  module) ROW="Module done"; ALT="Module close"; DU=module; DJ=module ;;
+                  deploy) ROW="Build complete"; ALT="Deploy-ready"; DU=full; DJ=full ;; esac
 U="$DU"; J="$DJ"; FROM="default: PROJECT.md has no '## Test strategy' row '$ROW' (CAC-5 records it)"
 if [ -f PROJECT.md ]; then
-  _row="$(awk -v r="$ROW" '
+  _row="$(awk -v r="$ROW" -v r2="$ALT" '
     /^## /{ on = ($0 ~ /^## Test strategy/) ; next }
-    on && /^\|/ { split($0, c, "|"); x = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", x)
-                  if (tolower(x) == tolower(r)) { u = c[3]; j = c[4]; s = c[5]
+    on && /^\|/ { split($0, c, "|"); x = tolower(c[2]); sub(/[(,].*/, "", x); gsub(/^[ \t*`]+|[ \t*`]+$/, "", x)
+                  if (x == "moment" || x ~ /^[-: ]*$/) next
+                  if (x !~ /^(every change|module done|module close|build complete|deploy-ready)$/) { y = c[2]; gsub(/^[ \t]+|[ \t]+$/, "", y); print "warning: ## Test strategy row label \"" y "\" is not a known moment, ignored" > "/dev/stderr"; next }
+                  if (!done && (x == tolower(r) || x == tolower(r2))) { done = 1; u = c[3]; j = c[4]; s = c[5]
+                    sub(/[(,].*/, "", u); sub(/[(,].*/, "", j)
                     gsub(/[ \t`*]/, "", u); gsub(/[ \t`*]/, "", j); gsub(/^[ \t]+|[ \t]+$/, "", s)
-                    print tolower(u) "\t" tolower(j) "\t" s; exit } }' PROJECT.md)"
+                    out = tolower(u) "\t" tolower(j) "\t" s } }
+    END { if (done) print out }' PROJECT.md)"
   if [ -n "$_row" ]; then
     _u="$(printf '%s' "$_row" | cut -f1)"; _j="$(printf '%s' "$_row" | cut -f2)"; _s="$(printf '%s' "$_row" | cut -f3)"
     case "$_u" in none|affected|module|full) U="$_u" ;; *) FROM="row '$ROW' unit scope '$_u' unknown, default used; " ;; esac
@@ -110,6 +143,30 @@ if [ -f PROJECT.md ]; then
     case "$FROM" in default:*) FROM="PROJECT.md ## Test strategy, row '$ROW'${_s:+, $_s}" ;; *) FROM="${FROM}PROJECT.md ## Test strategy" ;; esac
   fi
 fi
+
+# ── Unit gate: off unless the project default is yes, the row says so, or a module is flipped ──
+UNIT_DEFAULT="$(awk '/^[ \t*]*Unit tests default:/ { v = $0; sub(/^[^:]*:/, "", v); gsub(/[ \t*`]/, "", v); print tolower(v); exit }' PROJECT.md 2>/dev/null)"
+FLIPPED="$(awk 'tolower($0) ~ /^[ \t*>-]*unit modules:/ { v = $0; sub(/^[^:]*:/, "", v); sub(/#.*/, "", v); gsub(/\([^)]*\)/, "", v)
+  gsub(/[ \t*`,]+/, " ", v); n = split(v, a, " "); o = ""
+  for (i = 1; i <= n; i++) if (tolower(a[i]) != "none") o = o " " a[i]
+  print o; exit }' PROJECT.md 2>/dev/null)"
+for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md; do
+  [ -f "$_b" ] || continue
+  case "$_b" in */module-brief.md) _m="$(basename "$(dirname "$_b")")" ;; *) _m="$(basename "$_b" -brief.md)" ;; esac
+  if awk '
+      tolower($0) ~ /^[ \t*-]*unit tests:[ \t*]*yes([^a-z]|$)/ { f = 1 }
+      /^\|/ { split($0, c, "|"); k = tolower(c[2]); v = tolower(c[3]); gsub(/[ \t*`]/, "", v)
+              if (k ~ /^[ \t]*unit[ \t]*\(/ && v ~ /^yes/) f = 1 }
+      END { exit !f }' "$_b"; then FLIPPED="$FLIPPED $_m"; fi
+done
+UNIT_GATED=0; UNIT_OFF_WHY=""
+if [ "$MOMENT" != deploy ] && [ "${UNIT_DEFAULT#yes}" = "$UNIT_DEFAULT" ]; then
+  if [ -n "$UNIT_DEFAULT" ]; then _dw="PROJECT.md Unit tests default: $UNIT_DEFAULT"
+  else _dw="PROJECT.md has no 'Unit tests default:' line, treated as no"; fi
+  if [ -n "$FLIPPED" ]; then UNIT_GATED=1; [ "$U" = none ] && U="$DU"
+  else U=none; UNIT_OFF_WHY="($_dw; flip a module: PROJECT.md 'Unit modules: <M>' or 'Unit tests: yes' in its brief)"; fi
+  FROM="$FROM; unit: $_dw"
+fi
 out "strategy	$MOMENT	unit=$U journeys=$J	($FROM)"
 
 # ── Subjects ─────────────────────────────────────────────────────────────────
@@ -121,7 +178,18 @@ if [ -n "$SCRIPTS" ]; then
     done
   done > "$WORK/subjects"
 fi
-while IFS='	' read -r k n w; do out "subject	$k	$n	$w"; done < "$WORK/subjects"
+# A grant/revoke on an object this same script creates or modifies belongs to that subject.
+awk -F'\t' '
+  function scr(w,   a) { split(w, a, " of "); return a[2] }
+  NR == FNR { if ($1 != "access" && $1 != "unmapped") own[$2 "\t" scr($3)] = 1; next }
+  $1 == "access" && (($2 "\t" scr($3)) in own) { print $1 "\t" $2 "\t" $3 "\tPART" ; next }
+  { print $0 "\t" }' "$WORK/subjects" "$WORK/subjects" > "$WORK/subjects.tag"
+: > "$WORK/subjects.sel"
+while IFS='	' read -r k n w tag; do
+  if [ "$tag" = PART ]; then out "subject	$k	$n	$w	(grant on an object this script changes: part of that subject, selects nothing by module)"
+  else out "subject	$k	$n	$w"; printf '%s\t%s\t%s\n' "$k" "$n" "$w" >> "$WORK/subjects.sel"; fi
+done < "$WORK/subjects.tag"
+mv "$WORK/subjects.sel" "$WORK/subjects"
 [ -n "$SCRIPTS" ] && [ ! -s "$WORK/subjects" ] && out "subject	none	-	no model-writing statement in the script(s)"
 mod_of() { printf '%s\n' "${1%%.*}"; }
 awk -F'\t' '$2 != "-" && $1 != "userrole" { split($2, a, "."); print a[1] }' "$WORK/subjects" > "$WORK/modules"
@@ -218,10 +286,34 @@ select_journeys() {  # $1 = scope; prints "<file>\t<why>"
   esac | awk -F'\t' '!seen[$1]++'
 }
 
+# Module names as typed in PROJECT.md or a brief: match case-insensitively, warn on strangers.
+if [ -n "$FLIPPED" ]; then
+  { cat "$WORK/modules"; for _b in architecture/modules/*/module-brief.md architecture/modules/*-brief.md; do
+      [ -f "$_b" ] || continue
+      case "$_b" in */module-brief.md) basename "$(dirname "$_b")" ;; *) basename "$_b" -brief.md ;; esac
+    done
+    [ -s "$WORK/tests" ] && xargs grep -ohE '(^|[^A-Za-z0-9_.])[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_]' < "$WORK/tests" 2>/dev/null | sed -E 's/^[^A-Za-z_]//; s/\..*//'
+  } | sort -u > "$WORK/known"
+  _canon=""
+  for m in $FLIPPED; do
+    _k="$(awk -v m="$m" 'tolower($0) == tolower(m) { print; exit }' "$WORK/known")"
+    if [ -n "$_k" ]; then _canon="$_canon $_k"
+    else _canon="$_canon $m"; echo "warning: Unit modules names '$m', which matches no module in the tests, briefs or this change" >&2; fi
+  done
+  FLIPPED="$_canon"
+fi
 select_unit "$U" > "$WORK/unit.sel"
+if [ "$UNIT_GATED" = 1 ]; then   # default no, some modules flipped: only those modules' tests
+  : > "$WORK/unit.gated"
+  for m in $FLIPPED; do
+    while IFS='	' read -r f w; do grep -qE "(^|[^A-Za-z0-9_])$m\." "$f" 2>/dev/null && printf '%s\t%s\n' "$f" "$w"; done < "$WORK/unit.sel"
+  done | awk -F'\t' '!seen[$1]++' > "$WORK/unit.gated"
+  mv "$WORK/unit.gated" "$WORK/unit.sel"
+fi
 select_journeys "$J" > "$WORK/journey.sel"
-if [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
-else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match")"; fi
+if [ -n "$UNIT_OFF_WHY" ]; then out "unit	off	$UNIT_OFF_WHY"
+elif [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
+else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match${FLIPPED:+ (unit on only for:$FLIPPED)}")"; fi
 if [ -s "$WORK/journey.sel" ]; then sed 's/^/journey	/' "$WORK/journey.sel"
 else out "journey	none	scope $J: $( [ "$J" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/journeys" | tr -d ' ') journey file(s) in $JDIR/ and tests/e2e/ match")"; fi
 
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index c3a7ec20..1236b755 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -414,7 +414,7 @@ fi
 change_lane() {
   case "$CHANGE_CLASS" in
     ui-only) echo "re-run the journeys of every page the change reaches (embedders of a changed snippet/layout) once + a LOOK. No .test.mdl; reviewers read the artifacts, they do not re-run" ;;
-    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Full mxcli test at module close, not here" ;;
+    logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Unit tests only for affected modules with unit on; everything runs once at build complete and before each later deploy, per PROJECT.md ## Test strategy" ;;
   esac
 }
 [ -n "$CR_ID" ] && echo "→ Change request: $CR_ID (PROJECT.md '## Change log'; cite this run's commit in its Closed-by)"
diff --git a/skills/brd-to-build-plan.md b/skills/brd-to-build-plan.md
index 05b35ce1..6c33bcdb 100644
--- a/skills/brd-to-build-plan.md
+++ b/skills/brd-to-build-plan.md
@@ -340,7 +340,7 @@ Every row is one of five kinds, sharing one numbering and one dependency graph.
   Produces names every document the row writes, shared ones included (pages, navigation,
   after-startup, shared microflows): the parallel ready set excludes overlapping writers.
 - **`PROVE`** — headless and mechanical, mid-phase. `mxcli test`, a `curl`, a `DESCRIBE` read-back.
-  On mxcli ≥ v0.19.0, `.test.mdl` suites are a first-class PROVE instrument: `@setup` really
+  On mxcli ≥ v0.19.0, `.test.mdl` suites are a unit-gated PROVE instrument: `@setup` really
   runs its microflow, `@verify` really evaluates its OQL (holds / fails-with-the-value /
   cannot-evaluate = ERROR), and `@cleanup rollback` really rolls back — **before v0.19 all
   three were parsed and ignored, so no `@verify` could ever fail**. Two consequences: prefer a
diff --git a/skills/checkpoints/checkpoint-build.md b/skills/checkpoints/checkpoint-build.md
index 11458620..8fde1c86 100644
--- a/skills/checkpoints/checkpoint-build.md
+++ b/skills/checkpoints/checkpoint-build.md
@@ -103,6 +103,32 @@ all scripts upfront. See `brd-to-build-plan.md` ("The build plan contains no MDL
 `test-plan`, `acceptance-criteria`), or `Optional artifacts: none for Stage 5` as a Stage-4
 decision.
 
+**Test strategy (in the same Offer, not a separate question).** Show the defaults; the
+developer may change any cell in the same answer:
+
+> "Testing during the build, unless you want otherwise:
+>
+> | Moment | Unit tests | Journeys |
+> |---|---|---|
+> | Every change (build and feedback) | affected, modules on only | affected |
+> | Module done | module, modules on only | module |
+> | Build complete, and before every later deploy | full | full |
+>
+> `affected` = what the change touched and its callers (`bin/affected-tests.sh`); `module` = the
+> module's own (`--moment module --module <M>`); `full` = everything once; `none` = skip.
+> Build complete = you say the app is ready for UAT or production; I do not declare it alone.
+> Say 'run everything' any time.
+> Unit tests: only modules you name now, written while the logic is fresh (writing is not
+> running). Default: off, except modules with calculation, money/date, mapping, REST/Java logic or
+> a fixed bug. Change a cell, name modules, or say 'defaults'."
+
+**Record as:** `PROJECT.md` → `## Test strategy`, the table plus a `Status` column (`CONFIRMED`, or
+`ASSUMED` in auto mode), and the line `Unit modules: Shop, Admin` (`none` if none). Record Unit cells as scopes as shown.
+`bin/affected-tests.sh --moment change|module|deploy|all` reads it; no section: these defaults.
+Unit is **off** unless `Unit tests default: yes` (whole project; absent = no), a `Unit modules:`
+entry, or `Unit tests: yes` in the module brief; the Unit cell is a scope and never turns it on.
+At build end ask "full run now?", a confirmation, not a decision.
+
 ## Open Question
 
 > "Is there a deadline, a demo milestone, or a specific feature that must be working first?
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 59d7e8c6..f5800c02 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -654,8 +654,8 @@ nothing about the seams.
 
 **Read `testing-shape.md` before writing or judging any test here.** It defines what testing a
 module means, so it is the same thing every time, and it carries the **false-green register**: the
-confirmed ways a test reports green while the feature is broken. Its §3 check moments name what the
-release gate owes beyond module close. Alongside it, `measured-claims.md`
+confirmed ways a test reports green while the feature is broken. Its §3 check moments name what
+deploy-ready owes beyond module close. Alongside it, `measured-claims.md`
 holds the rule that gives evidence its force — *a claim not measured in that register may not be
 cited as evidence.*
 
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index 3ad624be..3a407e6e 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -196,6 +196,9 @@ baseline from Ground Rule 1, re-run, and by nothing else.
 A module gate that is green on the new work and was never run against the baseline has answered half
 the question and reported it as the whole. Re-run the baseline at every module gate, not once at the
 end — a regression found three modules later costs the same to fix and much more to find.
+At a module gate that means the baseline journeys of the modules the change touched
+(`bin/affected-tests.sh --moment module --module <M>`); the whole baseline runs at deploy-ready. A project that wants
+the whole baseline at every module gate says so in PROJECT.md `## Test strategy`.
 
 ---
 
@@ -297,5 +300,5 @@ it is the only entry mode where that is true.
 - A build plan over the change.
 - When the work arrives as a backlog: a `## Rounds` table in `PROJECT.md`, one row per round, its state current.
 - When an edit cannot go through mxcli: `docs/manual-steps.md` from `templates/manual-steps.md`, every step with its Check and a ticked Done line naming its evidence.
-- **A regression baseline that was green before the change and is green after it** — stated as N journeys over M modules, re-run at every module gate. Without this the rest is unverified.
+- **A regression baseline that was green before the change and is green after it**: stated as N journeys over M modules, re-run per module gate over the modules it touched, and whole at deploy-ready. Without this the rest is unverified.
 - Anything reusable learned about the app → `skills/learned-*.md`; process learnings → `process/process-learnings.md`.
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 01e19b05..c692f145 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -618,9 +618,9 @@ step.
 **Verification is scoped — once per gate, not once per script.** Gate: SYNTAX and Gate: BUILD run
 inside every `exec.sh`, and they are the only per-script checks. The test passes (happy path, journeys, LOOK) run **once
 per gate round** over what that round changed, and `bin/gate-check.sh` runs **once per gate round**,
-not after every exec. What re-runs after a change, by whom, and when the full suite runs (module
-close only, never batch close) is `testing-shape.md` §3 — the single source; `exec.sh` prints the
-run's lane (`ui-only` / `logic`). Repeating a pass the artifacts already prove is the over-testing
+not after every exec. What re-runs after a change, by whom, and when the full suite runs (per
+PROJECT.md `## Test strategy`; never batch close) is `testing-shape.md` §3; `exec.sh` prints
+the run's lane (`ui-only` / `logic`). Repeating a pass the artifacts already prove is the over-testing
 toolkit issue #274 measured: UI-only changes re-proven 5–10×.
 
 > **Older ordinals, for anyone arriving from a document that still cites them:** Gate 2 = Gate:
diff --git a/skills/module-brief.md b/skills/module-brief.md
index e1f00c28..64b2d2f5 100644
--- a/skills/module-brief.md
+++ b/skills/module-brief.md
@@ -150,7 +150,7 @@ all, and never looks at a page.
 |------|-------------|-----|
 | UI (Playwright) | **always** | — |
 | Data (source of truth) | **always** — say which: OQL count delta \| upstream REST response \| documented n/a + the query proving it | `testing-shape.md` §1: "Data" means check the source of truth, not always query a database |
-| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow — name which. The project default is intake Q13 (`Unit tests default:` in PROJECT.md), itself `no` unless the user chose otherwise (`testing-shape.md` §2) |
+| Unit (`.test.mdl`) | **no** (default) / yes | **no** unless this module has calculation, mapping or date/money logic, calls a Java action or REST, or had a bug fixed in that flow, name which. Project default: intake Q13 (`Unit tests default:`), `no` unless chosen (`testing-shape.md` §2). Flip: line `Unit tests: yes` |
 | Trace (OTel) | yes / no | **yes if this module calls out** to REST, an import mapping, or external data — that is where failures get swallowed, and it overrides the project default |
 
 ### Base set — the trigger  (`testing-shape.md` §3)
diff --git a/skills/module-review.md b/skills/module-review.md
index 9b99780c..dd090add 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -19,21 +19,22 @@ looking. That is how a module ships with 31/31 green checks and a broken grid on
             — conformance-check + graph-sweep + coverage-check (model-side, parallel) +
             journeys (UI/Playwright + Data/OQL + Trace/OTel, one ordered walk via
             journey-runner.js) + journeys-control (positive control — proves the journey
-            could have failed) + monkey (crash net). This IS the UI (Playwright) + Data
-            (OQL/DB) + monkey rungs named above, run as one instrument, not a second pass
-            alongside them. wiring-sweep.md (every clickable element on the page, not just
+            could have failed) + monkey (crash net). This IS the UI, Data and monkey rungs
+            named above, run as one instrument. wiring-sweep.md (every clickable element on the page, not just
             what a journey visits) runs alongside it but by hand, deliberately outside
-            verify-module.sh — skills-over-scripts.md: the verdict on an ambiguous click
-            stays a judgement call, not a script. It is NOT optional and it leaves a file:
+            verify-module.sh (a judgement call, skills-over-scripts.md). It is NOT optional and it leaves a file:
             test-agent writes .claude/loop/sweep/<Module>/sweep.md, first line the
             denominator "N of N interactive elements swept across P of P pages". No file
             means the sweep did not happen, and the gate says so. Deep form when an
             instrument is green and you cannot say what would have made it red:
             journey-proof.md
+            Module close also runs the strategy row: `./bin/affected-tests.sh --moment module
+            --module <M>`, then its `run` rows (unit only if on). Source `default`: ask the
+            developer once, record `## Test strategy`.
 4. LOOK     THE INTELLIGENCE CHECK — a human-equivalent pass over every screen in
             the module. Is it logical? Does it look right? Does it match our design?
-            Stages 1-3 cannot answer any of those. This is the stage that gets
-            skipped, and it is the stage the escaped defects come from.
+            Stages 1-3 cannot answer those. It gets skipped, and the
+            escaped defects come from it.
 5. CONFIRM  one report, explicit denominator, a human look, then next module
 ```
 
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index b9defd0f..bf233550 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -134,13 +134,13 @@ definition of done (`iterative-build-loop.md`). Without this anchor someone decl
 > hand (journey report, screenshot, diff) does not?* If you cannot name what it would show, do not run it.
 
 **The subject set.** A re-run covers the tests whose *subject* the exec'd script(s) changed — the
-script is the change list; `bin/exec.sh` tags each run `ui-only` or `logic` and prints its lane:
+script is the change list; `bin/exec.sh` tags its lane and `bin/affected-tests.sh <script>` lists the set:
 
 | Changed in this exec | Its subject set — re-run these, only these |
 |---|---|
 | A microflow | the tests that call it, plus the tests of its callers (`SHOW CALLERS OF <Mod.Flow>`) |
 | A page, snippet or layout | the journeys of every page the change reaches: the page itself, and every page that embeds a changed snippet or uses a changed layout, in any module |
-| An entity, association, enum or access rule | the tests and journeys of the module that owns it |
+| An entity, association, enum or access rule | the tests and journeys of the module that owns it (a grant on a flow or page it also changes is part of that subject) |
 
 Anything outside that set was not at risk from this change and is not re-run.
 
@@ -156,34 +156,33 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**The full suite (and the module's whole journey set) runs on the last three rows below only** — **never at batch close**, never after
-an individual fix, never because the change "felt wide". The e2e instruments are unchanged; only
-their trigger is.
+**Each project picks what runs when** at CAC-5: PROJECT.md `## Test strategy` (`checkpoint-build.md`;
+defaults `affected`, `module`, `full`). Unit tests are off unless a module is named (`Unit modules:`).
+Never at batch close, after a fix, or because a change "felt wide".
 
 | Event | What happens |
 |---|---|
 | A fix to an existing script | **Re-run its subject set**, in its lane. No questions, no re-authoring. |
 | A new script within agreed scope | Re-run its subject set. Extend the suite only for a *behaviour* the coverage checklist doesn't already cover. |
 | A new behaviour / scope change | The coverage checklist changes — the existing drift-sync path. The suite extends with it. |
-| Module close | The full suite, once (`module-review.md` PROVE). |
-| Release gate (before UAT/production) | The project-wide suite, once. |
-| The user asks for a full run | Run it, that message is the trigger. |
+| Module done | That module's own journeys, once; its unit tests only if on (`module-review.md` PROVE). |
+| Build complete (developer-declared) | Everything once: all journeys, all unit tests. |
+| Before each later deploy (after feedback) | Everything once again. |
+| The user says "run everything" | Run it, any time. |
 
 **Check moments — which checks each of those events owes.** Fast checks run during development;
-heavy checks wait for module close or the release gate. This sorts checks by *when*, not what
+heavy checks wait for module close or deploy-ready. This sorts checks by *when*, not what
 testing a module means: the §1 shape and the two lanes are unchanged. A *planned: #N* check is not
 built yet and claims nothing until it lands.
 
 | Moment | Budget | What runs |
 |---|---|---|
 | **Every exec** | ~1 minute (mxbuild 22–65 s per script, `iterative-build-loop.md` → Gate cost) | `exec.sh` includes: lock → module-brief advisory → `mxcli check` → snapshot → apply → mxbuild delta gate → auto-restore on a new error → lint ratchet. Static STOP-row scan (planned: #349); Studio Pro warning ratchet (planned: #351); human-locked baselines (planned: #348). |
-| **Module close** | minutes | The module's full suite and journeys (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
-| **Release gate** | as needed | The project-wide suite, once (row above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
+| **Module done** | minutes | The module's journeys, unit tests if on (row above). New page or action has a test (planned: #354); that module's server-side security tests (planned: #352). |
+| **Build complete / deploy** | as needed | Every test and journey, once (rows above). Page × role smoke on the production DB engine (planned: #353); full security report (planned: #352); language/RTL layout, multi-language apps only (planned: #354). |
 
-> **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
-> change 5–10× (other modules' journeys, the reviewer re-running them, a full `mxcli test` at every
-> batch close), and with no Unit default set, **143 minutes** of microflow tests found stale strings,
-> not one logic bug. A caption change owes one journey and one look.
+> **Why scoped (#274):** unscoped regression re-proved each UI-only change 5-10x, and **143
+> minutes** of unit tests (no Unit default set) found stale strings, not one logic bug.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.
 That is what makes this affordable on a module under active development.
diff --git a/tests/wave2/test-affected-tests.sh b/tests/wave2/test-affected-tests.sh
index 21894794..39d45601 100644
--- a/tests/wave2/test-affected-tests.sh
+++ b/tests/wave2/test-affected-tests.sh
@@ -33,7 +33,7 @@ ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
 bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
 echo "== subject: $SUBJECT"
 
-P="$WORK/proj"
+P="$WORK/proj"; BASE_PM="$WORK/base-PROJECT.md"
 mkdir -p "$P/bin" "$P/tests/unit" "$P/journeys" "$P/tests/e2e"
 printf 'not a real model\n' > "$P/Fixture.mpr"
 cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/exec.sh" "$P/bin/"
@@ -47,6 +47,8 @@ t Validate Shop.VAL_Order
 t Submit   Shop.ACT_Order_Submit
 t Lookalike Shop.SUB_Order_Total_Legacy
 t Other    Admin.ACT_Reset
+# Unit tests are off unless the project says yes: the baseline project says yes, section L varies it.
+printf '# Project\n\nUnit tests default: yes\n' > "$BASE_PM"; cp "$BASE_PM" "$P/PROJECT.md"
 echo '{"id":"J-1","steps":[]}' > "$P/journeys/Shop.journey.json"
 echo '{"id":"J-2","steps":[]}' > "$P/journeys/Admin.journey.json"
 echo '{"id":"J-3","note":"opens Shop.Order_Edit","steps":[]}' > "$P/tests/e2e/edit.clerk.journey.json"
@@ -88,7 +90,7 @@ has()   { grep -qF -- "$2" "$WORK/out.$1"; }
 lacks() { ! grep -qF -- "$2" "$WORK/out.$1"; }
 calls() { if [ -f "$P/.stub-log" ]; then wc -l < "$P/.stub-log" | tr -d ' '; else echo 0; fi; }
 
-echo "== A: one microflow change, defaults (no PROJECT.md) =="
+echo "== A: one microflow change, defaults (project says Unit tests default: yes) =="
 RC=$(run A "$TOTAL")
 [ "$RC" -eq 0 ] && ok "exit 0" || bad "A rc=$RC" "$(cat "$WORK/err.A")"
 has A "strategy	change	unit=affected journeys=affected	(default:" && ok "strategy row says default affected/affected" || bad "A strategy" "$(head -1 "$WORK/out.A")"
@@ -146,6 +148,8 @@ echo "== E: the project's strategy row wins =="
 cat > "$P/PROJECT.md" <<'EOF'
 # Project
 
+Unit tests default: yes
+
 ## Test strategy
 | Moment | Unit tests | Journeys | Status |
 |---|---|---|---|
@@ -161,10 +165,10 @@ has E "strategy	change	unit=none journeys=module	(PROJECT.md ## Test strategy, r
 has E "unit	none	scope none: strategy says none" && ok "unit none per strategy" || bad "E unit" "$(grep ^unit "$WORK/out.E")"
 has E "journey	journeys/Shop.journey.json	module Shop" && lacks E "edit.clerk" && ok "journeys at module scope" || bad "E journeys" "$(grep ^journey "$WORK/out.E")"
 [ "$(calls)" = 0 ] && ok "no affected scope, so no mxcli call" || bad "E called mxcli"
-printf '## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
+printf 'Unit tests default: yes\n## Test strategy\n| Every change | sometimes | affected | ASSUMED |\n' > "$P/PROJECT.md"
 run E2 "$TOTAL" >/dev/null
 has E2 "unit scope 'sometimes' unknown, default used" && has E2 "unit=affected" && ok "an unknown scope falls back and says so" || bad "E2" "$(head -1 "$WORK/out.E2")"
-rm -f "$P/PROJECT.md"
+cp "$BASE_PM" "$P/PROJECT.md"
 
 echo "== F: deploy-ready default is the full suite =="
 run F --moment deploy "$TOTAL" >/dev/null
@@ -231,6 +235,99 @@ run K2 "$TOTAL" >/dev/null
 has K2 "caller	Shop.ZZ_New_Caller	depth 1" && has K2 "callers	measured" && ok "after the exec: the new caller is listed, callers measured" || bad "K2 stale" "$(grep -e ^caller "$WORK/out.K2")"
 [ ! -e "$P/.mxcli" ] && [ ! -e "$P/.affected-cache" ] && ok "the script keeps no cache of its own" || bad "K cache file"
 
+echo "== L: unit tests are off by default, a module flips them on, a grant on the changed object is not an access change =="
+GRANT="$WORK/flow-grant.mdl"; { cat "$TOTAL"; echo "grant execute on microflow Shop.SUB_Order_Total to Shop.User;"; } > "$GRANT"
+EGRANT="$WORK/entity-grant.mdl"; echo "grant Shop.User on Shop.Order (create, read);" > "$EGRANT"
+BRIEF_DIR="$P/architecture/modules"
+# L1: line absent
+printf '# Project\n' > "$P/PROJECT.md"
+run L1 "$TOTAL" >/dev/null
+has L1 "unit=none" && has L1 "unit	off	(PROJECT.md has no 'Unit tests default:' line, treated as no; flip a module:" && lacks L1 "unit	tests/" && lacks L1 ".test.mdl" \
+  && ok "L1 default line absent: unit off, no test file, no run row" || bad "L1 absent" "$(cat "$WORK/out.L1")"
+has L1 "journey	journeys/Shop.journey.json" && ok "journeys unaffected by the unit gate" || bad "L1 journeys"
+# L2: explicit no
+printf '# Project\n\n**Unit tests default: no**\n' > "$P/PROJECT.md"
+run L2 "$TOTAL" >/dev/null
+has L2 "unit	off	(PROJECT.md Unit tests default: no; flip a module:" && lacks L2 ".test.mdl" && ok "L2 default no: unit off, never a .test.mdl run row" || bad "L2 no" "$(cat "$WORK/out.L2")"
+run L2b "$ENTITY" >/dev/null; lacks L2b ".test.mdl" && ok "L2b default no: an entity change selects no unit test either" || bad "L2b" "$(cat "$WORK/out.L2b")"
+run L2c --moment deploy >/dev/null; [ "$(grep -c '^unit	tests/' "$WORK/out.L2c")" = 5 ] && ok "L2c default no: build complete still runs every existing unit test" || bad "L2c" "$(cat "$WORK/out.L2c")"
+run L2d --moment all >/dev/null; [ "$(grep -c '^unit	tests/' "$WORK/out.L2d")" = 5 ] && has L2d "strategy	deploy" && ok "L2d --moment all = everything" || bad "L2d" "$(cat "$WORK/out.L2d")"
+# L3: yes
+printf '# Project\n\nUnit tests default: yes\n' > "$P/PROJECT.md"
+run L3 "$TOTAL" >/dev/null
+has L3 "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && has L3 "run	./bin/test-scratch.sh -- tests/unit/Total.test.mdl" && ok "L3 default yes: today's behaviour" || bad "L3 yes" "$(cat "$WORK/out.L3")"
+# L4: module flipped, default no
+printf '# Project\n\nUnit tests default: no\n' > "$P/PROJECT.md"
+mkdir -p "$BRIEF_DIR/Shop"; printf '# Brief\n\nUnit tests: yes\n' > "$BRIEF_DIR/Shop/module-brief.md"
+run L4 "$ENTITY" >/dev/null
+has L4 "unit	tests/unit/Total.test.mdl	names module Shop" && lacks L4 "Other.test.mdl" && has L4 "run	./bin/test-scratch.sh" && ok "L4 Shop flipped by a brief line: Shop's tests are selected" || bad "L4 flip" "$(cat "$WORK/out.L4")"
+printf '# Admin\n| Part | This module | Why |\n|---|---|---|\n| Unit (`.test.mdl`) | **yes** | Java action |\n' > "$BRIEF_DIR/Admin-brief.md"
+rm -rf "$BRIEF_DIR/Shop"
+run L4b "$TOTAL" >/dev/null
+lacks L4b "Total.test.mdl" && lacks L4b "Validate.test.mdl" && ok "L4b only Admin flipped (table row, flat brief): a Shop change selects no Shop test" || bad "L4b" "$(cat "$WORK/out.L4b")"
+printf '# Admin\n| Unit (`.test.mdl`) | **no** (default) / yes | x |\n' > "$BRIEF_DIR/Admin-brief.md"
+run L4c "$ENTITY" >/dev/null; has L4c "unit	off" && ok "L4c the unfilled brief template ('no (default) / yes') is not a flip" || bad "L4c" "$(cat "$WORK/out.L4c")"
+rm -rf "$P/architecture"
+printf '# Project\n\nUnit tests default: no\nUnit modules: Admin, Other\n' > "$P/PROJECT.md"
+run L4d "$TOTAL" >/dev/null; lacks L4d "Total.test.mdl" && ok "L4d PROJECT.md 'Unit modules: Admin, Other': a Shop change selects no unit test" || bad "L4d" "$(cat "$WORK/out.L4d")"
+run L4e "$ENTITY" >/dev/null; printf '# Project\n\nUnit tests default: no\nUnit modules: Shop\n' > "$P/PROJECT.md"; run L4f "$ENTITY" >/dev/null
+has L4f "unit	tests/unit/Total.test.mdl	names module Shop" && lacks L4f "Other.test.mdl" && ok "L4f 'Unit modules: Shop' flips Shop only" || bad "L4f" "$(cat "$WORK/out.L4f")"
+# L5 (P8): the Offer's recorded defaults are a scope, never a switch: default no, Admin flipped, Shop change = no Shop unit
+printf 'Unit tests default: no\nUnit modules: Admin\n## Test strategy\n| Moment | Unit tests | Journeys | Status |\n|---|---|---|---|\n| Every change | affected | affected | CONFIRMED |\n| Module done | module | module | CONFIRMED |\n' > "$P/PROJECT.md"
+run L5 "$TOTAL" >/dev/null
+lacks L5 "Total.test.mdl" && lacks L5 "Validate.test.mdl" && ok "L5 row 'affected' + Admin flipped: a Shop change runs no Shop unit" || bad "L5" "$(cat "$WORK/out.L5")"
+run L5b --moment module --module Shop >/dev/null
+lacks L5b "Total.test.mdl" && ok "L5b module moment: Shop unit still off" || bad "L5b" "$(cat "$WORK/out.L5b")"
+# L5c (P9): row none + module turned on = that module's unit runs
+printf 'Unit tests default: no\nUnit modules: Shop\n## Test strategy\n| Every change | none | affected | CONFIRMED |\n| Module done | none | module | CONFIRMED |\n' > "$P/PROJECT.md"
+run L5c "$TOTAL" >/dev/null
+has L5c "unit	tests/unit/Total.test.mdl" && ok "L5c row none + Unit modules: Shop: Shop's unit runs" || bad "L5c" "$(cat "$WORK/out.L5c")"
+run L5d --moment module --module Shop >/dev/null
+has L5d "Total.test.mdl" && ok "L5d same at the module moment" || bad "L5d" "$(cat "$WORK/out.L5d")"
+# L8: Unit modules parsing
+um() { printf 'Unit tests default: no\n%s\n' "$1" > "$P/PROJECT.md"; }
+um 'Unit modules: shop , ADMIN'; run L8a "$ENTITY" >/dev/null 2>&1
+has L8a "Total.test.mdl" && ok "L8a names are case-insensitive" || bad "L8a" "$(cat "$WORK/out.L8a")"
+um 'Unit modules: Shop # decided at CAC-5'; run L8b "$ENTITY" >/dev/null 2>&1
+has L8b "Total.test.mdl" && ok "L8b a # comment is stripped" || bad "L8b" "$(cat "$WORK/out.L8b")"
+um 'Unit modules: Shop (decided at CAC-5)'; run L8c "$ENTITY" >/dev/null 2>&1
+has L8c "Total.test.mdl" && lacks L8c "Other.test.mdl" && ok "L8c a (...) comment is stripped" || bad "L8c" "$(cat "$WORK/out.L8c")"
+um '- Unit modules: Shop'; run L8d "$ENTITY" >/dev/null 2>&1
+has L8d "Total.test.mdl" && ok "L8d a bullet line is read" || bad "L8d" "$(cat "$WORK/out.L8d")"
+um 'Unit modules: none'; run L8e "$ENTITY" >/dev/null 2>&1
+has L8e "unit	off" && lacks L8e "unit on only for" && [ ! -s "$WORK/err.L8e" ] && ok "L8e none = no modules, no warning" || bad "L8e" "$(cat "$WORK/out.L8e" "$WORK/err.L8e")"
+um 'Unit modules: Shop, Nowhere'; run L8f "$ENTITY" >/dev/null 2>&1
+grep -q "'Nowhere'" "$WORK/err.L8f" && ! grep -q "'Shop'" "$WORK/err.L8f" && ok "L8f an unknown module warns on stderr, a known one does not" || bad "L8f" "$(cat "$WORK/err.L8f")"
+# L9: the Offer table copied verbatim, edited cells must be read
+OFFER='| Moment | Unit tests | Journeys | Status |
+|---|---|---|---|
+| Every change (build and feedback) | UC | JC | CONFIRMED |
+| Module done | module, modules on only | module | CONFIRMED |
+| Build complete, and before every later deploy | full | full | CONFIRMED |'
+pm() { printf 'Unit tests default: yes\n\n## Test strategy\n%s\n' "$(printf '%s\n' "$OFFER" | sed "s/UC/$1/; s/JC/$2/")" > "$P/PROJECT.md"; }
+pm none none; run L9a "$TOTAL" >/dev/null 2>&1
+has L9a "unit=none journeys=none" && has L9a "unit	none	scope none" && lacks L9a ".test.mdl" && ok "L9a Offer label 'Every change (build and feedback)' with Unit none: no unit tests" || bad "L9a" "$(cat "$WORK/out.L9a")"
+pm 'affected, modules on only' affected; run L9b "$TOTAL" >/dev/null 2>"$WORK/err.L9b"
+has L9b "unit=affected journeys=affected" && has L9b "Total.test.mdl" && ! grep -qi "unknown" "$WORK/out.L9b" && [ ! -s "$WORK/err.L9b" ] && ok "L9b the Offer cell 'affected, modules on only' reads as affected, no message" || bad "L9b" "$(cat "$WORK/out.L9b" "$WORK/err.L9b")"
+run L9c --moment module --module Shop >/dev/null 2>&1; has L9c "unit=module" && ok "L9c 'module, modules on only' reads as module" || bad "L9c" "$(head -1 "$WORK/out.L9c")"
+run L9d --moment deploy >/dev/null 2>&1; has L9d "unit=full journeys=full" && has L9d "row 'Build complete" && ok "L9d 'Build complete, and before every later deploy' maps to build complete" || bad "L9d" "$(head -1 "$WORK/out.L9d")"
+printf 'Unit tests default: yes\n## Test strategy\n| Every chnage | none | none | CONFIRMED |\n' > "$P/PROJECT.md"; run L9e "$TOTAL" >/dev/null 2>&1
+grep -q 'row label "Every chnage"' "$WORK/err.L9e" && ok "L9e an unmappable row label warns on stderr" || bad "L9e" "$(cat "$WORK/err.L9e")"
+
+pm 'none (decided CAC-5)' none; run L9f "$TOTAL" >/dev/null 2>"$WORK/err.L9f"
+has L9f "unit=none" && lacks L9f ".test.mdl" && ! grep -qi "unknown" "$WORK/out.L9f" && ok "L9f a cell 'none (decided CAC-5)' reads as none: no unit tests" || bad "L9f" "$(cat "$WORK/out.L9f")"
+printf 'Unit tests default: yes\n## Test strategy\n| Every change | none | none | CONFIRMED |\n| Modul done | none | none | CONFIRMED |\n' > "$P/PROJECT.md"; run L9g "$TOTAL" >/dev/null 2>"$WORK/err.L9g"
+has L9g "unit=none" && grep -q 'row label "Modul done"' "$WORK/err.L9g" && ok "L9g an unknown label AFTER a matched row still warns" || bad "L9g" "$(cat "$WORK/err.L9g")"
+
+# L6/L7: grants (unit on, so a module-wide selection would show)
+cp "$BASE_PM" "$P/PROJECT.md"
+run L6 "$GRANT" >/dev/null
+has L6 "subject	microflow	Shop.SUB_Order_Total" && has L6 "part of that subject" && lacks L6 "names module Shop" && lacks L6 "Lookalike.test.mdl" && lacks L6 "data	NOT MEASURED	access" \
+  && ok "L6 describe-style microflow plus its trailing grant: no module-wide unit selection" || bad "L6" "$(cat "$WORK/out.L6")"
+has L6 "unit	tests/unit/Total.test.mdl	names Shop.SUB_Order_Total" && ok "L6 the microflow's own test is still selected" || bad "L6 own test"
+run L7 "$EGRANT" >/dev/null
+has L7 "data	NOT MEASURED	access Shop.User" && has L7 "names module Shop (data or access change)" && ok "L7 a standalone entity grant, unit yes: selected by module" || bad "L7" "$(cat "$WORK/out.L7")"
+
 echo "== H: usage =="
 RC=$(run H --moment later "$TOTAL"); [ "$RC" -eq 2 ] && ok "bad --moment exits 2" || bad "H rc=$RC"
 RC=$(run H2 "$WORK/no-such.mdl"); [ "$RC" -eq 2 ] && ok "missing script exits 2" || bad "H2 rc=$RC"
diff --git a/tests/wave2/test-test-strategy-docs.sh b/tests/wave2/test-test-strategy-docs.sh
new file mode 100644
index 00000000..2b63f55b
--- /dev/null
+++ b/tests/wave2/test-test-strategy-docs.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Fixture for the test-strategy doc shift (2026-10-16): every place that sent the full suite to
+# module close now says what the project strategy says, and the CAC-5 Offer carries the table.
+#
+# usage: bash tests/wave2/test-test-strategy-docs.sh [toolkit-root]
+#
+# Doc wording is behaviour for agent-read text, so this pins the facts that must agree:
+#   - no skill still says the full suite runs at module close, or names a "release gate" for it
+#   - testing-shape.md, the check-moments table and the Offer table carry the same three rows
+#     and the same defaults (every change affected, module done module, build complete full)
+#   - existing-app-change.md keeps "every gate is also a regression gate" and adds the scoping
+#   - exec.sh's logic lane text points at the strategy, not at module close
+# This test keeps those files, the Offer and affected-tests.sh from drifting apart. The
+# maintainer waived the A/B on 2026-10-16; E3 runs after merge as a check.
+#
+# Positive control: on master 9 of 10 checks fail; only the "kept" regression-gate guard passes.
+set -uo pipefail
+T="${1:-$(cd "$(dirname "$0")/../.." && pwd)}"
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; return 0; }
+has()  { grep -qF -- "$2" "$T/$1"; }
+echo "== subject: $T"
+
+echo "== the old full-suite-at-module-close wording is gone =="
+! has skills/testing-shape.md "| Module close | The full suite, once" && ! has skills/testing-shape.md "| Release gate (before UAT/production)" \
+  && ok "testing-shape.md event table" || bad "testing-shape.md event table still has module-close full suite or Release gate"
+! has skills/testing-shape.md "The module's full suite and journeys" && ! has skills/testing-shape.md "| **Release gate** |" \
+  && ok "testing-shape.md check-moments table" || bad "testing-shape.md check-moments table"
+! has skills/iterative-build-loop.md "(module close only, never batch close)" && has skills/iterative-build-loop.md "PROJECT.md \`## Test strategy\`" \
+  && ok "iterative-build-loop.md points at the strategy" || bad "iterative-build-loop.md"
+! has skills/conversion-runbook.md "the release gate owes" && has skills/conversion-runbook.md "deploy-ready owes" \
+  && ok "conversion-runbook.md says deploy-ready" || bad "conversion-runbook.md"
+! has project-bin/exec.sh "Full mxcli test at module close, not here" && has project-bin/exec.sh "everything runs once at build complete and before each later deploy, per PROJECT.md ## Test strategy" \
+  && ok "exec.sh logic lane text" || bad "exec.sh logic lane text"
+
+echo "== one table, three places =="
+for f in skills/checkpoints/checkpoint-build.md; do
+  has $f "| Every change (build and feedback) | affected, modules on only | affected |" && has $f "| Module done | module, modules on only | module |" && has $f "| Build complete, and before every later deploy | full | full |" \
+    && ok "CAC-5 Offer table with the three defaults" || bad "Offer table"
+done
+has skills/checkpoints/checkpoint-build.md "PROJECT.md\` → \`## Test strategy\`" && has skills/checkpoints/checkpoint-build.md "CONFIRMED" \
+  && ok "Offer records the choice with a Status column" || bad "Offer record line"
+has skills/testing-shape.md "defaults \`affected\`, \`module\`, \`full\`" \
+  && ok "testing-shape.md states the same defaults" || bad "testing-shape.md defaults sentence"
+
+echo "== existing-app-change.md =="
+has skills/existing-app-change.md "Re-run the baseline at every module gate" && ok "kept: every gate is also a regression gate" || bad "regression-gate rule lost"
+has skills/existing-app-change.md "the whole baseline runs at deploy-ready" && ok "whole baseline at deploy-ready" || bad "deploy-ready baseline"
+has skills/existing-app-change.md "--moment module --module <M>" && has skills/checkpoints/checkpoint-build.md "--moment module --module <M>" \
+  && ok "the module-moment call names its module" || bad "module call without --module"
+
+echo "== unit tests off by default, wired =="
+has skills/checkpoints/checkpoint-build.md "\`Unit modules: Shop, Admin\`" && has skills/checkpoints/checkpoint-build.md "Unit tests default: yes" && has skills/checkpoints/checkpoint-build.md "Unit tests: yes" \
+  && ok "Offer records the three ways to turn unit on" || bad "unit-on syntax missing"
+has skills/checkpoints/checkpoint-build.md "Build complete = you say the app is ready" && ok "build complete is declared by the developer" || bad "build complete undefined"
+has skills/module-review.md "--moment module" && ok "module-review PROVE runs the module row" || bad "module-review not wired"
+has skills/module-brief.md "Unit tests: yes" && ok "module brief names the flip line" || bad "module brief flip line"
+
+echo; echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]