@@ -19,6 +19,10 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(page-audit, design-audit, monkey, ui-loop): **no more leaked Mendix sessions from the toolkit's own browser helpers**: all three logged in and closed the browser without the xas logout, so each run burned a seat of a trial licence's cap and later journeys failed login as "Sign in failed"; they now log out first, and `ui-loop.md` says a hand-written screenshot script must too. Field: System.Session count +1 per run on master (page-audit 0 -> 1, design-audit 1 -> 2, monkey 2 -> 3), +0 with the fix — speed experiment E2
+- fix(page-audit, design-audit): **the audits produce their own `.claude/loop/page-scope.json`**: when it is missing or older than the model they run `bin/page-scope.sh` (`scope-ensure.js`, 2 s) instead of FAULTing on 0 pages; a failed regeneration never blanks an existing file and names the failure. Field: scope deleted -> page-audit ran on 9 pages, `touch` of the .mpr -> regenerated once — speed experiment E2
+- new(look-ledger, journey-runner, module-review): **a journey run's screenshots are LOOK evidence**: `bin/look-ledger.sh shots` (run by journey-runner after every run) maps each reached step's PNG to the one page whose widgets (`DESCRIBE PAGE`) it landed on, a URL pattern breaking ties, and lists every owed page as `OPEN` (open that PNG; the Read hook then marks the page SEEN) or `UNREACHED` (short gap-fill journey, or `page-audit.js` as before) with the line `owed N = A OPEN + B UNREACHED`; a shot older than the page's last build is not evidence and nothing is claimed when unsure. Field: 8 owed pages = 5 OPEN + 3 UNREACHED from two journey runs, no separate screenshot pass; baseline words 64,004 -> 64,193 — speed experiment E2
+- fix(affected-tests): **a page, flow or navigation change no longer selects 0 journeys because the journeys name widgets, not `Module.Name`**: the affected scope now reads the widget names of every changed page/snippet and of each calling page (`DESCRIBE PAGE`, one extra warm-catalog `mxcli` call, 0.07 s) and selects each journey whose JSON holds one; a navigation or layout change selects every journey; when callers or widgets cannot be measured (`widgets NOT MEASURED` row) it selects every journey (unsure means include). Field: 067 (Request_Edit page) 0 -> J-REQ-01, 090 (navigation) 0 -> all 5 journeys — speed experiment E2
 - process(design-artifacts, conversion-runbook): **Stage 3 runs in parallel by default, from one brief and a mechanical task list**: the lead fixes modules, canonical names and design tokens, writes `docs/progress/stage3-brief.md`, and takes the tasks from the stage-3 lines of `bin/lib/artifact-check.sh` (so no artifact is forgotten); one subagent per 1–2 screens or artifact group, a shared opening line so the start is cached, mechanical tasks on the cheap tier, 5-line replies, the lead the only writer of `PROJECT.md`. The runbook's Stage 3 fan-out row points there, and its Stage 2 row names `facts-lock.sh resolve`. Measured on one project (single runs, Sonnet, 250k auto-compact): serial 13 min / $3.60, parallel 10 min / $4.44, parallel with a brief 6 min / $4.32; 0 name mismatches in the parallel runs (serial dropped 3 entities); both parallel runs forgot the process map and swimlanes, which the task list now covers. Baseline words 64,004 before and after — Stage 3 experiment 2026-10-28
 - fix(facts-lock, gate-check): **parallel BRDs keep one spelling per identifier**: `bin/facts-lock.sh <project> resolve` freezes each casing conflict (`WIPStatus`/`WipStatus`) whose majority spelling is used by strictly more BRD sources than any other and records the count in the lock (`resolvedBy`); a tie stays contested, and `build` still never picks on its own. Stage 2 of `gate-check.sh` now reads the lock once there are 2+ BRDs: a BRD that contradicts a frozen identifier FAILs and is quoted; no lock yet is a note, never a FAIL. Measured cause: 20 parallel BRDs on PROJECT-C carried 10 casing conflicts into Stage 3 as open questions, and facts-lock.sh, documented only as advice, reached 1 of 6 projects. Fixtures: `test-facts-lock.sh` resolve cases (4), `test-bug03-gates.sh` T19 (2 of 4 fail on the previous gate-check) — speed/parallel experiments 2026-10-28
 - fix(row-groups): **a build plan whose number and Kind cells are formatted as code (`` `BUILD` ``, `` `12` ``) is read like a plain one**: before, it read 0 BUILD rows, so with `Row groups: on` grouping silently did nothing (the fast-lane agent in the 2026-10-28 speed experiment had to strip the backticks by hand). Fixture: `test-row-groups.sh` G5 (both cases fail on the previous row-groups.sh) — speed experiment 2026-10-28
 
@@ -1423,7 +1423,7 @@ EOF
   [ "$n_proof" -gt 0 ] && how="$how, $n_proof by PROOF-OF-LOOK"
   [ "$n_waived" -gt 0 ] && how="$how, $n_waived waived"
   if [ "$n_unseen" -gt 0 ]; then
-    echo "FAIL|look: $n_unseen of $n built page(s) never looked at since their last build: $unseen — screenshot each, open the PNG (a file name containing the page name), compare it to its wireframe (skills/ui-loop.md); or --waive look/<Module> --reason \"...\""
+    echo "FAIL|look: $n_unseen of $n built page(s) never looked at since their last build: $unseen — screenshot each, open the PNG (a file name containing the page name, or the journey screenshot bin/look-ledger.sh shots lists), compare it to its wireframe (skills/ui-loop.md); or --waive look/<Module> --reason \"...\""
   else
     echo "MANUAL|look: $n of $n built page(s) accounted for ($how); the rest of Stage 5 is manual"
   fi
 
@@ -107,6 +107,7 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # directory. prototype-route.js is the one reader and writer of design/prototype.html's section
 # format, so page-fidelity.js, check-page-shell.sh and check-prototype-links.js resolve it as a
 # sibling too.
+# look-shots.js joined on 2026-10-29 (speed experiment E2): look-ledger.sh shots runs it to map journey screenshots to pages.
 # look-ledger.sh joined on 2026-10-02 with exec.sh's LOOK-owed call: exec.sh resolves it as its
 # own sibling, and the PostToolUse(Read) hook install-claude-permissions.sh writes runs
 # `bash bin/look-ledger.sh seen`. Two unattended builds built every page and opened no
@@ -128,7 +129,7 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # runs it per module (informational; see project-bin/mf-canvas-facts.py header).
 # model-scope.py joined on 2026-10-21: it imports mxpatch.py (and through it mxunit_bson.py) from
 # its own directory. It puts back units a write changed only in XPath whitespace (mxcli#1596).
-MXTK_PROJECT_BIN="reload.sh module-close.sh row-groups.sh process-map.js process-map.template.html app-restart.sh test-scratch.sh script-owners.sh describe-baseline.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py model-scope.py mf-canvas-facts.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh harness-scan.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh progress-report.py done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh check-staged-secrets.sh"
+MXTK_PROJECT_BIN="reload.sh module-close.sh row-groups.sh process-map.js process-map.template.html app-restart.sh test-scratch.sh script-owners.sh describe-baseline.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py model-scope.py mf-canvas-facts.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh look-shots.js save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh harness-scan.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh progress-report.py done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh check-staged-secrets.sh"
 
 # Files in project-bin/ that are deliberately NOT installed into projects. The reverse check
 # below flags anything named by NEITHER list, so a new file in project-bin/ has to be either
@@ -216,7 +217,7 @@ MXTK_LINT_RULES_NOINSTALL="README.md STOCK-HASHES.txt STOCK-HASHES-BUNDLED.txt"
 #
 # project.config.template.js is listed separately because it is the one file a project is
 # EXPECTED to edit — installing it over an edited copy would silently revert the port.
-MXTK_PROJECT_TESTS="config.js helpers.js settle.js otel.js journey-runner.js named-controls.js journey-runner.selftest.js journey-rung4-scope.test.js monkey.js monkey.selftest.js page-audit.js page-audit-rules.js design-audit.js full-app-walkthrough.js report-normalize.js report-render.js review-report.js demo-polish.js demo-polish.selftest.js example.journey.json"
+MXTK_PROJECT_TESTS="config.js helpers.js settle.js scope-ensure.js otel.js journey-runner.js named-controls.js journey-runner.selftest.js journey-rung4-scope.test.js monkey.js monkey.selftest.js page-audit.js page-audit-rules.js design-audit.js full-app-walkthrough.js report-normalize.js report-render.js review-report.js demo-polish.js demo-polish.selftest.js example.journey.json"
 MXTK_PROJECT_TESTS_TEMPLATE="project.config.template.js"
 
 # Deliberately not installed. Same contract as the lists above.
 
@@ -89,7 +89,14 @@
 #      journey file (journeys/ or tests/e2e/) that names a subject OR a transitive caller literally.
 #      A journey file that is not named <Module>.journey.json and holds no qualified Module.Name
 #      cannot be selected by name at all; the "journeys unmapped" row counts them, so an empty
-#      selection is never read as "nothing owed".
+#      selection is never read as "nothing owed". Journeys name what they walk by WIDGET and by
+#      menu caption far more often than by Module.Name, so the affected scope also reads the
+#      widget names of every changed page/snippet and of every caller that is a page (DESCRIBE
+#      PAGE, one cheap mxcli call) and selects each journey whose JSON holds one of them
+#      ("widgets measured" row). A navigation or layout change selects EVERY journey (each walks
+#      the menu). When the widgets or the callers cannot be measured ("widgets NOT MEASURED"),
+#      the selection is EVERY journey: unsure means include. (speed experiment E2: 067 changed
+#      a page J-REQ-01 walks and 090 changed navigation; both selected 0 journeys.)
 #   5. module: every test file naming the module, journeys/<M>.journey.json; the modules are the
 #      subjects' modules plus every --module. full: every test file, every journey file.
 #   6. A grant/revoke whose object (microflow, page, ...) the SAME script creates or modifies is
@@ -324,6 +331,51 @@ select_unit() {  # $1 = scope; prints "<file>\t<why>"
   esac | awk -F'\t' '!seen[$1]++'
 }
 
+# ── Widgets (which journeys walk a changed page) ─────────────────────────────
+# Journeys are written against widget names and menu captions, not Module.Name, so name matching
+# alone selects nothing for a page change. ALLWHY non-empty = select every journey (navigation or
+# layout change, or the measurement failed: unsure means include).
+: > "$WORK/widgets"; : > "$WORK/widget-pages"
+WIDGETS="not needed"; ALLWHY=""
+if [ "$J" = affected ] && [ -n "$SCRIPTS" ]; then
+  if printf '%s\n' "$SCRIPTS" | while IFS= read -r _s; do cat "$_s"; done |
+       grep -qiE '^[[:space:]]*(create|alter|drop|move)[[:space:]]([^;]*[[:space:]])?navigation([[:space:]]|$)'; then
+    ALLWHY="navigation change: every journey walks the menu"; WIDGETS="not needed ($ALLWHY)"
+  elif awk -F'\t' '$1 == "layout" { f = 1 } END { exit !f }' "$WORK/subjects"; then
+    ALLWHY="layout change: every page, so every journey, uses it"; WIDGETS="not needed ($ALLWHY)"
+  elif [ -s "$WORK/flowish" ]; then
+    if [ "$NO_MODEL" = 1 ]; then WIDGETS="NOT MEASURED (--no-model)"
+    elif case "$CALLERS" in "NOT MEASURED"*) true ;; *) false ;; esac; then WIDGETS="NOT MEASURED (callers $CALLERS)"
+    else
+      _MX="${MXCLI:-$(find_project_mxcli 2>/dev/null || true)}"; _MPR="$(find_mpr 2>/dev/null || true)"
+      if [ -z "$_MX" ] || [ ! -x "$_MX" ] || [ -z "$_MPR" ]; then WIDGETS="NOT MEASURED (no project mxcli or .mpr)"
+      else
+        "$_MX" -p "$_MPR" -c "SHOW PAGES; SHOW SNIPPETS" > "$WORK/pg.out" 2> "$WORK/pg.err"; _rc=$?
+        # the Qualified Name column of the two tables
+        awk -F'|' '$2 ~ /^ *[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]* *$/ { n = $2; gsub(/ /, "", n); print n }' "$WORK/pg.out" | sort -u > "$WORK/allpages"
+        { cat "$WORK/flowish"; cut -f1 "$WORK/callers"; } | sort -u > "$WORK/cand"
+        comm -12 "$WORK/allpages" "$WORK/cand" > "$WORK/widget-pages"
+        if [ "$_rc" -ne 0 ] || [ ! -s "$WORK/allpages" ]; then WIDGETS="NOT MEASURED (SHOW PAGES exit $_rc, $(wc -l < "$WORK/allpages" | tr -d ' ') page(s) listed)"
+        elif [ ! -s "$WORK/widget-pages" ]; then WIDGETS="measured (0 of $(wc -l < "$WORK/cand" | tr -d ' ') changed or calling element(s) is a page or snippet)"
+        else
+          # second table in the output = SHOW SNIPPETS (its header has no Title column)
+          _snip="$(awk '/^\| Qualified Name/ { h++ } h >= 2 && /^\| *[A-Za-z_]/ { split($0, c, "|"); n = c[2]; gsub(/ /, "", n); print n }' "$WORK/pg.out")"
+          _q=""; while IFS= read -r _p; do
+            if printf '%s\n' "$_snip" | grep -qxF "$_p"; then _q="${_q:+$_q; }DESCRIBE SNIPPET $_p"; else _q="${_q:+$_q; }DESCRIBE PAGE $_p"; fi
+          done < "$WORK/widget-pages"
+          "$_MX" -p "$_MPR" -c "$_q" > "$WORK/desc.out" 2> "$WORK/desc.err"; _rc=$?
+          # widget heads: "<widgettype> <name> (" or "{" at the start of a line
+          awk '/^[ \t]*[a-z][a-z0-9]*[ \t]+[A-Za-z_][A-Za-z0-9_]*[ \t]*[({]/ && $1 != "create" && $1 != "alter" { print $2 }' "$WORK/desc.out" |
+            sed 's/[({].*//' | sort -u > "$WORK/widgets"
+          if [ "$_rc" -ne 0 ] || [ ! -s "$WORK/widgets" ]; then WIDGETS="NOT MEASURED (DESCRIBE exit $_rc, $(wc -l < "$WORK/widgets" | tr -d ' ') widget name(s) read)"
+          else WIDGETS="measured ($(wc -l < "$WORK/widgets" | tr -d ' ') widget name(s) in $(wc -l < "$WORK/widget-pages" | tr -d ' ') page/snippet(s))"; fi
+        fi
+      fi
+    fi
+    case "$WIDGETS" in "NOT MEASURED"*) ALLWHY="unsure, so every journey ($WIDGETS)" ;; esac
+  fi
+fi
+
 select_journeys() {  # $1 = scope; prints "<file>\t<why>"
   case "$1" in
     none) ;;
@@ -339,6 +391,13 @@ select_journeys() {  # $1 = scope; prints "<file>\t<why>"
           _hit="$(grep -o -w -F -f "$WORK/jnames" "$f" 2>/dev/null | head -1)"
           [ -n "$_hit" ] && echo "$f	names $_hit"
         done < "$WORK/journeys"
+        if [ -n "$ALLWHY" ]; then awk -v w="$ALLWHY" '{ print $0 "\t" w }' "$WORK/journeys"
+        elif [ -s "$WORK/widgets" ]; then
+          while IFS= read -r f; do
+            _hit="$(grep -o -w -F -f "$WORK/widgets" "$f" 2>/dev/null | head -1)"
+            [ -n "$_hit" ] && echo "$f	walks widget $_hit of a changed or calling page"
+          done < "$WORK/journeys"
+        fi
       fi ;;
   esac | awk -F'\t' '!seen[$1]++'
 }
@@ -444,6 +503,7 @@ select_journeys "$J" > "$WORK/journey.sel"
 if [ -n "$UNIT_OFF_WHY" ]; then out "unit	off	$UNIT_OFF_WHY"
 elif [ -s "$WORK/unit.sel" ]; then sed 's/^/unit	/' "$WORK/unit.sel"
 else out "unit	none	scope $U: $( [ "$U" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/tests" | tr -d ' ') .test.mdl file(s) match${FLIPPED:+ (unit on only for:$FLIPPED${LISTMODS:+; per listed flow in:$LISTMODS})}")"; fi
+[ "$J" = affected ] && [ -n "$SCRIPTS" ] && out "widgets	$WIDGETS"
 if [ -s "$WORK/journey.sel" ]; then sed 's/^/journey	/' "$WORK/journey.sel"
 else out "journey	none	scope $J: $( [ "$J" = none ] && echo 'strategy says none' || echo "0 of $(wc -l < "$WORK/journeys" | tr -d ' ') journey file(s) in $JDIR/ and tests/e2e/ match")"; fi
 
 
@@ -43,7 +43,7 @@ ROOT="${PROJECT_ROOT:-$(pwd)}"
 
 # The engine files the toolkit installs into tests/e2e/ — kept in step with install-manifest.sh's
 # MXTK_PROJECT_TESTS. A name missing here is only a false NOTE on the toolkit's own file.
-ENGINE=" config.js helpers.js settle.js otel.js journey-runner.js named-controls.js journey-runner.selftest.js journey-rung4-scope.test.js monkey.js monkey.selftest.js page-audit.js page-audit-rules.js design-audit.js full-app-walkthrough.js report-normalize.js report-render.js review-report.js demo-polish.js demo-polish.selftest.js project.config.js project.config.template.js "
+ENGINE=" config.js helpers.js settle.js otel.js journey-runner.js named-controls.js journey-runner.selftest.js journey-rung4-scope.test.js monkey.js monkey.selftest.js page-audit.js page-audit-rules.js design-audit.js full-app-walkthrough.js report-normalize.js report-render.js review-report.js demo-polish.js demo-polish.selftest.js scope-ensure.js project.config.js project.config.template.js "
 
 files=()
 for d in tests e2e acceptance; do