@@ -1632,6 +1632,50 @@ jobs:
           fi
           echo "OK: fix-candidate metadata correct; flag-off is byte-identical to the pre-S0 golden"
 
+      # S0 Part B: the `own-fix subscriptions candidates` collector turns the fix
+      # metadata into a deterministic candidates.json (analysis-only). Reuses fc_on.json.
+      - name: S0 fix-candidates — own-fix collector (Part B)
+        run: |
+          on="$RUNNER_TEMP/fc_on.json"
+          printf '[weak-subscription]\nsubscribe = ["WeakEvents.AddPropertyChanged"]\n' > "$RUNNER_TEMP/fix.toml"
+          # A leaky INotifyPropertyChanged subscription -> one candidate, convert_acquire allowed.
+          python -m ownlang own-fix subscriptions candidates "$on" \
+            --config "$RUNNER_TEMP/fix.toml" \
+            --class Own.Samples.FixCandidates.InpcNoTeardown \
+            --output "$RUNNER_TEMP/cand.json" --root .
+          python -c "
+          import json, sys
+          d = json.load(open(sys.argv[1]))
+          assert d['target_api'] == {'subscribe': 'WeakEvents.AddPropertyChanged'}, d['target_api']
+          assert len(d['candidates']) == 1, d['candidates']
+          c = d['candidates'][0]
+          assert c['allowed_actions'] == ['convert_acquire', 'manual_review'], c['allowed_actions']
+          assert c['event_contract'] == 'inotify_property_changed'
+          assert c['finding_id'].startswith('OWN001:sha256:'), c['finding_id']
+          assert d['source_files'][0]['sha256'].startswith('sha256:')
+          assert d['selection']['constraints']['max_types_changed'] == 1
+          print('OK: candidate bundle well-formed')
+          " "$RUNNER_TEMP/cand.json"
+          # A name_only event -> manual_review only.
+          python -m ownlang own-fix subscriptions candidates "$on" \
+            --config "$RUNNER_TEMP/fix.toml" \
+            --class Own.Samples.FixCandidates.NameOnlySubscriber \
+            --output "$RUNNER_TEMP/cand2.json" --root .
+          python -c "import json,sys; a=json.load(open(sys.argv[1]))['candidates'][0]['allowed_actions']; sys.exit(0 if a==['manual_review'] else 1)" "$RUNNER_TEMP/cand2.json" \
+            || { echo "FAIL: name_only should be manual_review only"; exit 1; }
+          # A nested class -> hard error.
+          if python -m ownlang own-fix subscriptions candidates "$on" --config "$RUNNER_TEMP/fix.toml" \
+              --class Own.Samples.FixCandidates.OuterWithNested.Nested --output "$RUNNER_TEMP/x.json" --root . 2>/dev/null; then
+            echo "FAIL: a nested class must be refused"; exit 1
+          fi
+          # An unknown finding-id -> hard error.
+          if python -m ownlang own-fix subscriptions candidates "$on" --config "$RUNNER_TEMP/fix.toml" \
+              --class Own.Samples.FixCandidates.InpcNoTeardown --finding-id OWN001:sha256:deadbeef \
+              --output "$RUNNER_TEMP/x.json" --root . 2>/dev/null; then
+            echo "FAIL: an unknown finding-id must be refused"; exit 1
+          fi
+          echo "OK: own-fix collector — bundle, permission tiering, and hard rejections"
+
   # The OwnTS frontend spike (P-020 Own.React): the SAME OwnIR seam, fed from a
   # React .tsx instead of C#. Two analyses over the one core: (1) a useEffect
   # acquire (timer / subscribe / listener) with no cleanup return is the core's
 
@@ -403,17 +403,107 @@ def cmd_ownir(path: str, fmt: str = "human", severity: str = "error",
     return 1 if leaks else 0
 
 
+def cmd_own_fix(rest: list[str]) -> int:
+    """`own-fix subscriptions candidates <facts.json> --config <own.toml>
+    --class <FQN> [--finding-id <ID>]... --output <candidates.json> [--root <dir>]`."""
+    import json
+
+    usage = (
+        "usage: python -m ownlang own-fix subscriptions candidates <facts.json> "
+        "--config <own.toml> --class <FQN> [--finding-id <ID>]... "
+        "--output <candidates.json> [--root <dir>]"
+    )
+    if len(rest) < 2 or rest[0] != "subscriptions" or rest[1] != "candidates":
+        print(usage, file=sys.stderr)
+        return 2
+
+    args = rest[2:]
+    facts_path: str | None = None
+    config_path: str | None = None
+    class_fqn: str | None = None
+    output: str | None = None
+    root = "."
+    finding_ids: list[str] = []
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a.startswith("--"):
+            if i + 1 >= len(args):
+                print(f"own-fix: {a} requires a value", file=sys.stderr)
+                return 2
+            value = args[i + 1]
+            i += 2
+            if a == "--config":
+                config_path = value
+            elif a == "--class":
+                class_fqn = value
+            elif a == "--output":
+                output = value
+            elif a == "--root":
+                root = value
+            elif a == "--finding-id":
+                finding_ids.append(value)
+            else:
+                print(f"own-fix: unknown flag {a}", file=sys.stderr)
+                return 2
+        elif facts_path is None:
+            facts_path = a
+            i += 1
+        else:
+            print(f"own-fix: unexpected argument {a!r}", file=sys.stderr)
+            return 2
+
+    if not (facts_path and config_path and class_fqn and output):
+        print(
+            "own-fix: a facts.json, --config, --class and --output are all required",
+            file=sys.stderr,
+        )
+        print(usage, file=sys.stderr)
+        return 2
+
+    from ownlang.config import ConfigError, load_target_subscribe
+    from ownlang.fix_candidates import CollectError, collect_candidates
+
+    try:
+        target = load_target_subscribe(config_path)
+    except ConfigError as exc:
+        print(f"own-fix: {exc}", file=sys.stderr)
+        return 2
+    try:
+        with open(facts_path, encoding="utf-8") as fh:
+            facts = json.load(fh)
+    except (OSError, ValueError) as exc:
+        print(f"own-fix: cannot read facts {facts_path}: {exc}", file=sys.stderr)
+        return 2
+
+    try:
+        envelope = collect_candidates(facts, target, class_fqn, finding_ids or None, root)
+    except CollectError as exc:
+        print(f"own-fix: {exc}", file=sys.stderr)
+        return 2
+
+    with open(output, "w", encoding="utf-8") as fh:
+        fh.write(json.dumps(envelope, indent=2, ensure_ascii=False) + "\n")
+    print(f"own-fix: wrote {len(envelope['candidates'])} candidate(s) -> {output}")
+    return 0
+
+
 _FORMATS = {"human", "github", "msbuild", "sarif", "json"}
 _SEVERITIES = {"error", "warning"}
 _VERBOSITY = {"quiet", "normal", "verbose"}
 
 
 def main(argv: list[str]) -> int:
     if not argv or argv[0] not in {"check", "emit", "cfg", "report", "ownir",
-                                   "summaries", "explain", "config"}:
+                                   "summaries", "explain", "config", "own-fix"}:
         print(__doc__)
         return 2
     cmd = argv[0]
+    # `own-fix subscriptions candidates` (S0 Part B): analysis-only candidate export
+    # for the subscription-autofix pipeline. Has its own nested shape, so it is handled
+    # before the single-positional path below.
+    if cmd == "own-fix":
+        return cmd_own_fix(argv[1:])
     # `config` is the minimal P-015 carrier (P-035): read an explicit own.toml and
     # print the declared weak-subscribe "SimpleType.Method" names, one per line, for
     # own-check.sh to forward to the extractor. A malformed config is a HARD error
 
@@ -47,14 +47,15 @@ def _weak_subscribe_from(data: dict[str, object], path: str) -> list[str]:
     if not isinstance(table, dict):
         raise ConfigError(f"{path}: [weak-subscription] must be a table")
 
-    # Only `subscribe` is honoured in this slice. Reject any other key so a typo
+    # Only `subscribe` (P-035 recognition) and `target` (the S0 fix target, read by
+    # `load_target_subscribe`) are honoured. Reject any other key so a typo
     # (`subscribes`, `unsubscribe` before it is designed, ...) is a hard error, not
     # a silently-ignored no-op that hides a caller mistake.
-    unknown = sorted(set(table) - {"subscribe"})
+    unknown = sorted(set(table) - {"subscribe", "target"})
     if unknown:
         raise ConfigError(
             f"{path}: [weak-subscription] has unsupported key(s): "
-            f"{', '.join(unknown)} (only `subscribe` is supported in this slice)"
+            f"{', '.join(unknown)} (only `subscribe` and `target` are supported)"
         )
 
     entries = table.get("subscribe", [])
@@ -67,6 +68,43 @@ def _weak_subscribe_from(data: dict[str, object], path: str) -> list[str]:
     return list(entries)
 
 
+def load_target_subscribe(path: str) -> str:
+    """Return the ONE weak-subscribe wrapper the fixer should emit (S0 `target_api`).
+
+    Pinned explicitly, never guessed: either ``[weak-subscription].target`` (a single
+    ``"SimpleType.Method"``), or — as a convenience when there is no ambiguity — the sole
+    ``subscribe`` entry when the list has exactly one. Zero or several ``subscribe`` entries
+    with no explicit ``target`` is a :class:`ConfigError`: silently taking the first would
+    bake an unintended API into a public candidates contract.
+    """
+    try:
+        with open(path, "rb") as fh:
+            data = tomllib.load(fh)
+    except FileNotFoundError as exc:
+        raise ConfigError(f"config file not found: {path}") from exc
+    except tomllib.TOMLDecodeError as exc:
+        raise ConfigError(f"{path}: invalid TOML: {exc}") from exc
+
+    table = data.get("weak-subscription")
+    if not isinstance(table, dict):
+        raise ConfigError(
+            f"{path}: a [weak-subscription] table is required to pin a fix target"
+        )
+    target = table.get("target")
+    if target is not None:
+        if not isinstance(target, str):
+            raise ConfigError(f"{path}: [weak-subscription].target must be a string")
+        _validate_entry(target, path)
+        return target
+    subscribe = _weak_subscribe_from(data, path)
+    if len(subscribe) == 1:
+        return subscribe[0]
+    raise ConfigError(
+        f"{path}: cannot pin a fix target: set [weak-subscription].target, or declare "
+        f"exactly one [weak-subscription].subscribe entry (found {len(subscribe)})"
+    )
+
+
 def _validate_entry(entry: str, path: str) -> None:
     """A declared entry must be exactly ``"SimpleType.Method"``.