@@ -1036,11 +1036,12 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '⭐ the FORK predicate: head repo ≠ base repo is a proposal, never a delivery': 6,
   '⭐ the argv is CLOSED: a flag the mode does not read, or a second repository beside a bare --pr, is refused': 22,
   'the per-row repository scope (ruled B2, 2026-10-13)': 20,
+  'the nested `ui/` workspace rows, through a register handed in (#25712)': 15,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 34;
+const SELF_TEST_BATTERY_FLOOR = 35;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -1462,10 +1463,16 @@ export function assertGovernedRepo(repo, caller = 'governedPathsIn') {
  * (`surfaceTierIn`): a row whose tier holds there is handed over as the table's
  * own frozen row, any other as a frozen copy carrying Tier H. Refuses a missing
  * or unknown repository.
+ *
+ * `register` is the table read, `GOVERNED_SURFACES` unless a caller hands in
+ * another. ⛔ No production caller does: it is the seam the self-tests drive
+ * with rows that are not on the register yet (the nested `ui/` workspace rows,
+ * objectstack#25712), so the matchers are proven on those rows before the
+ * register carries them. A register handed in is read exactly as the real one.
  */
-export function governedSurfacesFor(repo) {
+export function governedSurfacesFor(repo, register = GOVERNED_SURFACES) {
   assertGovernedRepo(repo, 'governedSurfacesFor');
-  return GOVERNED_SURFACES.filter((surface) => surfaceRepos(surface).includes(repo)).map((surface) => {
+  return register.filter((surface) => surfaceRepos(surface).includes(repo)).map((surface) => {
     const tier = surfaceTierIn(surface, repo);
     return tier === surface.tier ? surface : Object.freeze({ ...surface, tier });
   });
@@ -1477,10 +1484,10 @@ export function governedSurfacesFor(repo) {
  * is REQUIRED: the rows consulted are the ones that govern it, and a call
  * without one is refused (`assertGovernedRepo`).
  */
-export function governedPathsIn(paths, repo) {
+export function governedPathsIn(paths, repo, register = GOVERNED_SURFACES) {
   assertGovernedRepo(repo, 'governedPathsIn');
   const list = Array.isArray(paths) ? paths : [];
-  return governedSurfacesFor(repo).map((surface) => ({
+  return governedSurfacesFor(repo, register).map((surface) => ({
     ...surface,
     files: list.filter((p) =>
       typeof p === 'string' && (surface.prefix ? p.startsWith(surface.prefix) : p === surface.exact),
@@ -1514,8 +1521,8 @@ export function landingTierOf(matched) {
  * list answers `H` (see `landingTierOf`). `repo` is required, as for
  * `governedPathsIn`: the rows consulted are the ones that govern it.
  */
-export function governedTierFor(paths, repo) {
-  return landingTierOf(governedPathsIn(paths, assertGovernedRepo(repo, 'governedTierFor')));
+export function governedTierFor(paths, repo, register = GOVERNED_SURFACES) {
+  return landingTierOf(governedPathsIn(paths, assertGovernedRepo(repo, 'governedTierFor'), register));
 }
 
 /** `owner/name` out of any git remote spelling, or null. Pure. */
@@ -4458,6 +4465,43 @@ async function selfTest() {
   assert('the-checkout-note-names-the-repository-judged-and-the---root-remedy', /judged for cloud \(objectstack-ai\/cloud, the checkout at --root\)/.test(checkoutRepoNote({ repo: 'cloud', slug: 'objectstack-ai/cloud' })) && /--root <its path>/.test(checkoutRepoNote({ repo: 'cloud', slug: 'objectstack-ai/cloud' })));
   assert('the-verdict-head-names-the-repository-and-counts-its-rows', renderTestVerdict(testVerdict([wf], { repo: 'cloud' })).split('\n')[0] === 'governed-surface predicate: 1 of 1 path(s) hit the register (7 surfaces govern cloud).' && renderTestVerdict(testVerdict([wf], { repo: 'objectos' })).split('\n')[0] === 'governed-surface predicate: 0 of 1 path(s) hit the register (6 surfaces govern objectos).', renderTestVerdict(testVerdict([wf], { repo: 'objectos' })).split('\n')[0]);
 
+  // ── the nested `ui/` workspace rows (#25712) ─────────────────────────────
+  //
+  // The objectui tree arrives as the `ui/` workspace of this repository, and
+  // its own register's six rows have to govern it here under that prefix. The
+  // rows land on the register in the PR that also names them in the two
+  // instruction surfaces `check-governed-prose.mjs` pins (both at their line
+  // ceiling); until then they are THIS fixture, read through the matchers'
+  // `register` seam, so the matchers are proven on them first. Both directions
+  // are pinned: each row's specimen is governed Tier H in objectstack, and a
+  // `ui/` source path, a nested copy of an instruction file and every other
+  // repository answer NOT governed. The last case pins today's register: it
+  // does not know `ui/` yet — the PR that adds the rows flips that case.
+  battery('the nested `ui/` workspace rows, through a register handed in (#25712)');
+  const UI_ROWS = Object.freeze([
+    Object.freeze({ id: 'ui-adr', prefix: 'ui/docs/adr/', glob: 'ui/docs/adr/**', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's architecture decision records" }),
+    Object.freeze({ id: 'ui-claude-tree', prefix: 'ui/.claude/', glob: 'ui/.claude/**', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's agent instruction tree" }),
+    Object.freeze({ id: 'ui-skills-catalog', prefix: 'ui/skills/', glob: 'ui/skills/**', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's published skills catalog" }),
+    Object.freeze({ id: 'ui-agents-md', exact: 'ui/AGENTS.md', glob: 'ui/AGENTS.md', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's agent instruction file" }),
+    Object.freeze({ id: 'ui-claude-md', exact: 'ui/CLAUDE.md', glob: 'ui/CLAUDE.md', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's Claude instruction file" }),
+    Object.freeze({ id: 'ui-workflows', prefix: 'ui/.github/workflows/', glob: 'ui/.github/workflows/**', tier: GOVERNED_TIER_H, repos: Object.freeze(['objectstack']), what: "the ui workspace's workflow files" }),
+  ]);
+  const WITH_UI = Object.freeze([...GOVERNED_SURFACES, ...UI_ROWS]);
+  const uiIds = (paths, repo = REPO) => governedPathsIn(paths, repo, WITH_UI).map((s) => s.id);
+  const UI_SPECIMENS = { 'ui-adr': 'ui/docs/adr/0001-master-detail-subform.md', 'ui-claude-tree': 'ui/.claude/hooks/guard-main-checkout.sh', 'ui-skills-catalog': 'ui/skills/objectui/SKILL.md', 'ui-agents-md': 'ui/AGENTS.md', 'ui-claude-md': 'ui/CLAUDE.md', 'ui-workflows': 'ui/.github/workflows/ci.yml' };
+  assert('the-fixture-rows-are-well-formed-register-rows', UI_ROWS.every((r) => (r.prefix ? r.prefix.endsWith('/') && r.glob === `${r.prefix}**` && r.exact === undefined : r.glob === r.exact) && r.tier === GOVERNED_TIER_H && surfaceRepos(r).join() === 'objectstack') && new Set(WITH_UI.map((r) => r.id)).size === WITH_UI.length, JSON.stringify(UI_ROWS.map((r) => r.id)));
+  assert('the-fixture-mirrors-the-six-rows-objectui-governs-each-under-ui', UI_ROWS.map((r) => r.glob).join() === GOVERNED_SURFACES.filter((s) => s.id !== 'north-star').map((s) => `ui/${s.glob}`).join(), UI_ROWS.map((r) => r.glob).join());
+  for (const row of UI_ROWS) {
+    assert(`the-${row.id}-specimen-is-governed-by-its-own-row-alone`, uiIds([UI_SPECIMENS[row.id]]).join() === row.id, uiIds([UI_SPECIMENS[row.id]]).join());
+  }
+  assert('every-ui-row-lands-Tier-H-the-ui-claude-tree-included', Object.values(UI_SPECIMENS).every((p) => governedTierFor([p], REPO, WITH_UI) === GOVERNED_TIER_H) && governedTierFor([UI_SPECIMENS['ui-claude-tree'], '.claude/agents/os-dev.md'], REPO, WITH_UI) === GOVERNED_TIER_H);
+  assert('a-ui-source-path-is-NOT-governed', uiIds(['ui/packages/components/src/index.ts', 'ui/apps/console/src/App.tsx', 'ui/package.json', 'ui/.changeset/config.json']).length === 0);
+  assert('nested-copies-and-near-misses-stay-out', uiIds(['ui/examples/AGENTS.md', 'ui/packages/x/AGENTS.md', 'ui/packages/x/.github/workflows/w.yml', 'ui/.claude-x/y.md', 'ui/skillsx/a.md', 'ui/docs/adrs/z.md', 'ui/.github/CODEOWNERS', 'xui/AGENTS.md']).length === 0);
+  assert('the-root-rows-do-not-reach-into-ui-and-the-ui-rows-do-not-reach-the-root', uiIds(['ui/.github/workflows/ci.yml', '.github/workflows/lint.yml', 'ui/AGENTS.md', 'AGENTS.md']).join() === 'agents-md,workflows,ui-agents-md,ui-workflows');
+  assert('the-ui-rows-govern-objectstack-alone', ['objectui', 'cloud', 'objectos', 'hotcrm'].every((r) => uiIds(Object.values(UI_SPECIMENS), r).length === 0));
+  assert('a-register-handed-in-is-counted-by-the-same-reader', governedSurfacesFor(REPO, WITH_UI).length === governedSurfacesFor(REPO).length + UI_ROWS.length);
+  assert('today-the-register-does-not-know-ui-the-pr-adding-the-rows-flips-this', ids(Object.values(UI_SPECIMENS)).length === 0 && governedSurfacesFor(REPO).length === 7);
+
   // ── the dispatch-gates declaration (#9979) ───────────────────────────────
   //
   // Enforcement cannot hold any of these: the declaration is read by another
 
@@ -106,7 +106,7 @@ const SELF_TEST_BATTERIES = Object.freeze({
   'sliceRegion': 5,
   'codeSpansIn': 3,
   'looksLikeGovernedGlob': 5,
-  'verdict': 6,
+  'verdict': 9,
   'the shipped register + regions, end to end': 5,
   'the dispatch-gates declaration (#9979)': 4,
 });
@@ -382,6 +382,15 @@ function selfTest() {
   // Non-enumeration spans in the same region are ignored by both halves.
   assert('unrelated spans are ignored', verdict(`${good} run \`pnpm check:adr-anchors\``, register), { missing: [], unknown: [] });
 
+  // The nested `ui/` workspace rows (#25712) are ordinary globs to both halves:
+  // named, they pass; on the register but not in the prose, containment names
+  // them; in the prose but not on the register, the over-claim half does.
+  const uiGlobs = ['ui/docs/adr/**', 'ui/.claude/**', 'ui/skills/**', 'ui/AGENTS.md', 'ui/CLAUDE.md', 'ui/.github/workflows/**'];
+  const withUi = `${good} Under the \`ui/\` workspace: ${uiGlobs.map((g) => `\`${g}\``).join(' + ')}.`;
+  assert('ui rows named in the prose pass both halves', verdict(withUi, [...register, ...uiGlobs]), { missing: [], unknown: [] });
+  assert('ui rows on the register but not in the prose are each missing', verdict(good, [...register, ...uiGlobs]).missing, uiGlobs);
+  assert('ui globs in the prose ahead of the register are each an over-claim', verdict(withUi, register).unknown, uiGlobs.filter((g) => g.endsWith('**')));
+
   // --- the shipped register + regions, end to end ------------------------
   battery('the shipped register + regions, end to end');
   const globs = registerGlobs();
 
@@ -670,13 +670,14 @@ export function codeownersPatternFor(surface) {
  * Every problem is a sentence naming the row or line; the list is whole, never
  * the first hit. Pure.
  */
-export function codeownersMirrorVerdict({ text, approvers = GOVERNED_APPROVERS, repo = SELF_REPO_ID } = {}) {
+export function codeownersMirrorVerdict({ text, approvers = GOVERNED_APPROVERS, repo = SELF_REPO_ID, register = GOVERNED_SURFACES } = {}) {
   const rows = codeownersRows(text);
   const wanted = [...approvers].map((a) => `@${a}`.toLowerCase()).sort();
   const sameOwners = (owners) => JSON.stringify([...owners].map((o) => o.toLowerCase()).sort()) === JSON.stringify(wanted);
   const problems = [];
   // The rows that govern THIS repository, read from the register (ruling B2: the question has a repository in it).
-  const governing = governedSurfacesFor(repo);
+  // `register` is the register's own seam (`governedSurfacesFor`): the self-test hands in rows not on it yet.
+  const governing = governedSurfacesFor(repo, register);
   const tierH = governing.filter((s) => s.tier === GOVERNED_TIER_H);
   const tierHPatterns = tierH.map(codeownersPatternFor);
   for (const surface of tierH) {
@@ -4657,6 +4658,19 @@ export async function selfTest() {
     assert('⛔ a-file-that-never-names-the-constant-is-a-problem', !silent.ok && silent.problems.length === 1 && silent.problems[0].includes('GOVERNED_APPROVERS'), silent.problems.join(' | '));
     const other = codeownersMirrorVerdict({ text: onDisk, approvers: ['someone-else'] });
     assert('⭐ the-approver-list-is-READ-not-restated-another-list-reds-the-file-on-disk', !other.ok && other.problems.length >= live.tierHPatterns.length, String(other.problems.length));
+    // The nested `ui/` workspace rows (#25712), handed in through the register's seam: each lands
+    // Tier H, so each needs its root-anchored `/ui/…` line, and the file on disk carries none yet.
+    const uiRows = GOVERNED_SURFACES.filter((s) => s.id !== 'north-star').map((s) => Object.freeze({
+      ...s, id: `ui-${s.id}`, ...(s.prefix ? { prefix: `ui/${s.prefix}` } : { exact: `ui/${s.exact}` }), glob: `ui/${s.glob}`,
+      tier: GOVERNED_TIER_H, tierRepos: undefined, repos: Object.freeze(['objectstack']),
+    }));
+    const withUi = [...GOVERNED_SURFACES, ...uiRows];
+    const uiLive = codeownersMirrorVerdict({ text: onDisk, register: withUi });
+    assert('⛔ with-the-ui-rows-handed-in-the-file-on-disk-is-short-one-line-per-ui-row', !uiLive.ok && uiLive.problems.length === uiRows.length && uiRows.every((r) => uiLive.problems.some((p) => p.includes(`\`${r.id}\``) && p.includes(`\`/${r.prefix ?? r.exact}\``))), uiLive.problems.join(' | '));
+    assert('the-ui-patterns-are-root-anchored-under-ui-the-ui-claude-tree-included', uiLive.tierHPatterns.slice(live.tierHPatterns.length).join() === '/ui/docs/adr/,/ui/.claude/,/ui/skills/,/ui/AGENTS.md,/ui/CLAUDE.md,/ui/.github/workflows/', uiLive.tierHPatterns.join());
+    const uiFull = `# mirrors GOVERNED_APPROVERS\n${uiLive.tierHPatterns.map((p) => `${p} ${owners}`).join('\n')}\n`;
+    assert('a-fixture-carrying-the-ui-lines-too-passes-against-the-ui-register', codeownersMirrorVerdict({ text: uiFull, register: withUi }).ok);
+    assert('the-ui-rows-govern-objectstack-alone-so-a-sibling-copy-needs-no-ui-line', codeownersMirrorVerdict({ text: full(), repo: 'objectui', register: withUi }).tierHPatterns.every((p) => !p.startsWith('/ui/')));
   }
 
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ────
 
@@ -9656,6 +9656,7 @@ export function ignoreVerdicts(paths, { cwd = ROOT } = {}) {
   const r = spawnSync('git', ['check-ignore', '-v', '--non-matching', '--no-index', '--stdin'], {
     cwd,
     encoding: 'utf8',
+    maxBuffer: GIT_MAX_BUFFER_BYTES,
     input: `${unique.join('\n')}\n`,
   });
   if (r.error) throw new Error(`could not run git check-ignore — ${r.error.message}`);
@@ -15044,8 +15045,24 @@ export const DEFAULT_BASE_REMOTE = 'origin';
 export const DEFAULT_BASE_BRANCH = 'main';
 export const DEFAULT_BASE_REF = `${DEFAULT_BASE_REMOTE}/${DEFAULT_BASE_BRANCH}`;
 
+/**
+ * The stdout ceiling every git child of this tool is spawned with.
+ *
+ * `spawnSync`'s default is 1 MiB, and past it node kills the child and hands
+ * back `error.code === 'ENOBUFS'` — which `runGit` turns into a thrown "could
+ * not run git", so the tool refuses instead of answering. `trackedFiles`
+ * (`git ls-files -z`) is the reader that hits it first: this tree's listing is
+ * under the default, and the same tree with the objectui workspace imported
+ * under `ui/` is not (the Lint job's dispatch-gates step went red on ENOBUFS
+ * on the verification run of that import). 64 MiB is headroom for a listing
+ * an order of magnitude past that one; the bound stays finite so a runaway
+ * child is still stopped. Raising it changes no answer on a tree that already
+ * fit — only whether a larger tree gets one.
+ */
+export const GIT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
+
 function runGit(args, cwd) {
-  const r = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: GIT_MAX_BUFFER_BYTES });
   if (r.error) throw new Error(`could not run git — ${r.error.message}`);
   return { status: r.status ?? 1, stdout: r.stdout ?? '', stderr: (r.stderr ?? '').trim() };
 }
 
@@ -69,6 +69,7 @@ import {
   DURABILITY_SEAM_GATE,
   ESCAPABLE_LITERAL_LEDGER,
   GENERATED_MODULE_SOURCES,
+  GIT_MAX_BUFFER_BYTES,
   HARVEST_SNIPPET,
   INHERITED_POPULATION_MARKER,
   MANDATORY_TIER_GLOBS,
@@ -10908,6 +10909,46 @@ export function selfTest({ tier = 'full' } = {}) {
       .lines.join('\n').includes('UNVERIFIABLE'),
   );
 
+  slow("a tracked-file listing past spawnSync's default 1 MiB stdout buffer — one temporary index", () => {
+  // ── The git stdout ceiling (objectstack#25712) ────────────────────────────
+  // `git ls-files -z` over this tree plus an imported `ui/` workspace is past
+  // node's default `maxBuffer`, and the child dies with ENOBUFS. The fixture is
+  // an index alone — `update-index --index-info` stages paths with no files on
+  // disk — sized past 1 MiB. The CONTROL spawns the same listing with the
+  // default buffer and must see ENOBUFS, so the pass below cannot be a fixture
+  // that never reached the size.
+  const bufTmp = mkdtempSync(nodePath.join(tmpdir(), 'dispatch-gates-maxbuffer-'));
+  try {
+    const init = spawnSync('git', ['init', '--initial-branch=main', '.'], { cwd: bufTmp, encoding: 'utf8' });
+    if (init.status !== 0) throw new Error(`fixture git init failed: ${init.stderr}`);
+    const EMPTY_BLOB = 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391';
+    const paths = Array.from({ length: 16000 }, (_, i) =>
+      `ui/packages/fixture-${String(i).padStart(5, '0')}/src/a-long-enough-component-name-for-a-wide-listing.tsx`);
+    const staged = spawnSync('git', ['update-index', '--index-info'], {
+      cwd: bufTmp,
+      encoding: 'utf8',
+      input: paths.map((p) => `100644 ${EMPTY_BLOB} 0\t${p}`).join('\n') + '\n',
+    });
+    if (staged.status !== 0) throw new Error(`fixture git update-index failed: ${staged.stderr}`);
+    const listingBytes = paths.reduce((n, p) => n + Buffer.byteLength(p) + 1, 0);
+    t('the fixture listing is past the 1 MiB default buffer', listingBytes > 1024 * 1024, String(listingBytes));
+    const atDefault = spawnSync('git', ['ls-files', '-z'], { cwd: bufTmp, encoding: 'utf8' });
+    t('CONTROL: the same listing spawned with the default buffer dies with ENOBUFS', atDefault.error?.code === 'ENOBUFS', String(atDefault.error?.code ?? atDefault.status));
+    let listed = null;
+    let thrown = null;
+    try {
+      listed = trackedFiles({ cwd: bufTmp });
+    } catch (e) {
+      thrown = e.message;
+    }
+    t('trackedFiles reads the whole listing instead of refusing on ENOBUFS', thrown === null && listed?.length === paths.length, thrown);
+    t('the listing comes back byte-for-byte, first and last path included', listed?.[0] === paths[0] && listed?.at(-1) === paths.at(-1));
+    t('the ceiling stays finite and above this fixture', Number.isFinite(GIT_MAX_BUFFER_BYTES) && GIT_MAX_BUFFER_BYTES > listingBytes);
+  } finally {
+    rmSync(bufTmp, { recursive: true, force: true });
+  }
+  });
+
   slow("base drift — temporary repositories and spawned children", () => {
   // ── Base drift (#11540) ───────────────────────────────────────────────────
   // The banner names the commit an answer came from; on a stale checkout that