@@ -557,13 +557,12 @@ the list. The lane grows the allowlist a few proven specs at a time (see the wor
 comment), so every promotion would stale a hand-copied enumeration here; it already did
 (objectui#3488).
 
-Backend pins live in `e2e/live/ci/backend.env` and must match the `@objectstack/spec` version the
-pinned build in `pnpm-lock.yaml` declares — bump both in the same PR, or the run proves nothing.
-Since objectui#12957 the lockfile resolves `@objectstack/spec` to a directory built from the commit
-`.objectstack-sha` names (`.objectstack-pin/spec`), and the version is the one that
-directory's committed `package.json` carries (objectui#13008). ⚠️ objectstack moves that string only when it releases, so a
-pin between two releases matches the earlier release's backend by number while the console carries
-later commits; this lane still runs the published backend, and nothing here closes that gap.
+Backend pins live in `e2e/live/ci/backend.env`. Since objectui moved into the objectstack
+repository (objectstack#25803), the console builds against the workspace's own `@objectstack/spec`,
+which the lockfile records as a workspace link with no version, so there is no lockfile version
+for `OBJECTSTACK_VERSION` to match and no test compares the two. ⚠️ This lane still runs the
+published backend at that version against a console built from the current tree, and nothing
+here closes that gap.
 
 `OBJECTSTACK_VERSION` is the only `@objectstack` value that file declares, and moving it is the
 only move. The showcase-app commit the lane sparse-checks-out is **derived**, not pinned:
 
@@ -2,15 +2,13 @@
 # .github/workflows/live-e2e.yml).
 #
 # OBJECTSTACK_VERSION — the published @objectstack/* npm version the backend
-#   runs on. MUST stay aligned with the @objectstack/spec version resolved in
-#   this repo's pnpm-lock.yaml: the whole point of the lane is to smoke-test
-#   "this console x that published backend" as a matched pair. Testing a
-#   mismatched pair (backend rc.N vs console pinned rc.M) proves nothing —
-#   bump this in the same PR that bumps the console's @objectstack pins.
-#   Pinned by scripts/__tests__/ci-cd-pipeline-doc.test.ts, which reads this
-#   value and the version pnpm-lock.yaml resolves and requires them equal. It
-#   had drifted two minor versions (17.0.0-rc.2 against a 17.2.0 lockfile)
-#   before anything compared the two numbers — objectui#7689.
+#   runs on. Until objectui moved into the objectstack repository it had to
+#   match the @objectstack/spec version this repo's pnpm-lock.yaml resolved,
+#   and ci-cd-pipeline-doc.test.ts required the two equal (objectui#7689).
+#   Since the import (objectstack#25803) the console builds against the
+#   workspace's own @objectstack/spec, a lockfile link with no version, so
+#   that comparison is retired and this value is the published backend the
+#   lane runs, nothing more.
 #
 #   This file declares exactly ONE @objectstack pin, and that is the whole
 #   design: the commit is derived from it, see below.
 
@@ -9,8 +9,8 @@
  *   1. it is GREEN on this repository's real `pnpm-lock.yaml`;
  *   2. it is RED on the two real incident samples, built from that same real
  *      lockfile by a transformation this file asserts actually landed (the
- *      first, since objectui#12957 retired the version rule, in its pinned-build
- *      form);
+ *      first, since objectui#12957 retired the version rule, in its
+ *      merged-workspace form, objectstack#25803);
  *   3. it is wired — the workflow runs it, and the Dependabot merge gate
  *      classifies the check it produces.
  *
@@ -77,9 +77,15 @@ describe('green on main — the negative control', () => {
     expect(compareLockfiles(idx, idx).findings).toEqual([]);
   });
 
-  it('is clean against its own merge base in a real run', () => {
-    // Exercises the git path (`--base-ref`), not just the pure functions.
-    const out = execFileSync('node', [GATE, '--base-ref', 'origin/main'], {
+  it('is clean against its own commit in a real run', () => {
+    // Exercises the git path (`--base-ref` -> `git merge-base`, then `git show
+    // <rev>:<path>` from the workspace root), not just the pure functions. The
+    // base is HEAD, not origin/main, since the move into objectstack's tree
+    // (objectstack#25803): its Test UI job checks out at depth 1, where no
+    // origin/main exists to take a merge base with, and whether THIS change's
+    // lock is clean against main is the lockfile-integrity workflow's question,
+    // a non-blocking one (below), not a unit test's.
+    const out = execFileSync('node', [GATE, '--base-ref', 'HEAD'], {
       encoding: 'utf8',
       cwd: repoRoot,
     });
@@ -88,40 +94,42 @@ describe('green on main — the negative control', () => {
 });
 
 /**
- * Sample (a) — what is left of objectui#8326 once `@objectstack/*` resolves by
- * commit (objectui#12957). The downgrade on #7058 split the workspace across two
- * physical spec copies; the version half of that card (rule 1) is retired,
- * because the pinned build carries no version for anything to move backward.
- * The duplication half is what a partial fall-back off the pin looks like now: one
- * importer resolving the REGISTRY spec beside the pinned build is two snapshot
- * keys under one name. Built from the real lockfile by a transformation this file
- * asserts landed.
+ * Sample (a) — what is left of objectui#8326 in the merged workspace
+ * (objectstack#25803). The downgrade on #7058 split the workspace across two
+ * physical spec copies; the version half of that card (rule 1) is retired, and
+ * since the move into objectstack's tree every `@objectstack/*` package is a
+ * workspace link with no snapshot key at all, so the spec can no longer stand
+ * in for it (a registry copy beside a link is 0 -> 1, the newly-declared case
+ * rule 2 leaves alone; objectstack-pin.test.ts asserts no such key exists). The
+ * duplication half is what a partial downgrade of any declared runtime package
+ * looks like: `ai`, single-copy in the merged lock and the peer every spec
+ * consumer resolves through, gaining an older copy beside the current one is
+ * two snapshot keys under one name. Built from the real lockfile by a
+ * transformation this file asserts landed.
  */
-const PINNED_SPEC = "  '@objectstack/spec@file:.objectstack-pin/spec(ai@7.0.118(zod@4.6.7))':";
+const AI_KEY = '  ai@7.0.118(zod@4.6.7):';
 function sampleA(): string {
-  expect(realLock, 'the pinned spec snapshot key moved — rebuild this sample before trusting it').toContain(PINNED_SPEC);
-  return realLock.replace(
-    PINNED_SPEC,
-    "  '@objectstack/spec@18.0.0-next.3(ai@7.0.118(zod@4.6.7))':\n    dependencies:\n      zod: 4.6.7\n" + PINNED_SPEC,
-  );
+  expect(realLock, 'the ai snapshot key moved — rebuild this sample before trusting it').toContain(AI_KEY);
+  return realLock.replace(AI_KEY, '  ai@7.0.65(zod@4.6.7):\n    dependencies:\n      zod: 4.6.7\n' + AI_KEY);
 }
 
 /**
  * Sample (b) — objectui#8333, re-measured on `da5e4f69e` on 2026-09-08 by
  * `pnpm update better-auth --lockfile-only --recursive`, which resolved 1.7.3
  * and produced exactly this: the better-auth family forward, `zod@4.5.4` added,
- * and every `@objectstack/*` package that sits under `ai` gaining a SECOND peer
- * context at the SAME version.
+ * and every package that sits under `ai` gaining a SECOND peer context at the
+ * SAME version. Re-based on the merged lock (objectstack#25803): the
+ * `@objectstack/*` packages it forked then are workspace links now, so the forks
+ * are the two snapshot keys under `ai` that carry the zod peer.
  *
- * ⭐ That last part is the discriminator. No `@objectstack/*` version moves, so
- * a gate that only asks "did an identity move backward" is green here.
+ * ⭐ That last part is the discriminator. No version moves, so a gate that only
+ * asks "did an identity move backward" is green here.
  */
 function sampleB(): string {
   let out = realLock;
   const forked = [
-    PINNED_SPEC,
-    "  '@objectstack/formula@file:.objectstack-pin/formula(ai@7.0.118(zod@4.6.7))':",
-    "  ai@7.0.118(zod@4.6.7):",
+    "  '@ai-sdk/react@4.0.121(react@19.3.0)(zod@4.6.7)':",
+    AI_KEY,
   ];
   for (const key of forked) {
     expect(out, `snapshot key moved: ${key}`).toContain(key);
@@ -132,18 +140,19 @@ function sampleB(): string {
   return out.replace(zodKey, `${zodKey}\n  zod@4.5.4: {}`);
 }
 
-describe('cause 1 — a registry @objectstack/* copy beside the pinned build (objectui#8326, objectui#12957)', () => {
+describe('cause 1 — a second physical copy of a declared runtime package (objectui#8326, objectstack#25803)', () => {
   const reading = compareLockfiles(indexLockfile(realLock, 'base'), indexLockfile(sampleA(), 'a'));
 
   it('the sample really differs from the base (the mutation landed)', () => {
     expect(sampleA()).not.toEqual(realLock);
-    expect(sampleA()).toContain("'@objectstack/spec@18.0.0-next.3(ai@7.0.118(zod@4.6.7))':");
+    expect(sampleA()).toContain('  ai@7.0.65(zod@4.6.7):');
   });
 
-  it('goes red, naming the second physical spec', () => {
-    const spec = reading.duplicated.find((f) => f.name === '@objectstack/spec');
-    expect(spec?.headCount).toBe(2);
-    expect(spec?.added).toEqual(['@objectstack/spec@18.0.0-next.3(ai@7.0.118(zod@4.6.7))']);
+  it('goes red, naming the second physical ai', () => {
+    const ai = reading.duplicated.find((f) => f.name === 'ai');
+    expect(ai?.baseCount).toBe(1);
+    expect(ai?.headCount).toBe(2);
+    expect(ai?.added).toEqual(['ai@7.0.65(zod@4.6.7)']);
   });
 
   it('⛔ no longer orders versions: the retired rule 1 reports nothing of its own', () => {
@@ -159,24 +168,25 @@ describe('cause 2 — a declared dependency forks with no version moving (object
     expect(sampleB()).toContain('zod@4.5.4');
   });
 
-  it('⭐ still goes red: zod gained a copy, though it was never single-copy', () => {
+  it('⭐ still goes red: zod gained a copy', () => {
     const zod = reading.duplicated.find((f) => f.name === 'zod');
     expect(zod, 'the gate must not be blind to objectui#8333').toBeTruthy();
-    // ⛔ 2 -> 3, not 1 -> 2. Both cards say "forks a single-copy dependency";
-    // measured on `main`, zod is ALREADY two copies (3.25.76 + 4.4.3 then;
-    // 3.25.76 + 4.6.5 since objectui#11073, 3.25.76 + 4.6.7 since objectui#12626, re-measured), so a
-    // rule keyed on "was one, is now two" would be green here.
-    expect(zod?.baseCount).toBe(2);
-    expect(zod?.headCount).toBe(3);
+    // 1 -> 2 on the merged lock. objectui's own lock carried two zod copies
+    // (3.25.76 + 4.6.7, the 3 line through shadcn 4.18.0), and this assertion
+    // was 2 -> 3 so that a rule keyed on "was one, is now two" would be green
+    // here; shadcn ^4.22.1 (objectstack#25803) took zod 3 out, re-measured. The
+    // 2 -> 3 case stays held on a synthetic lock by the gate's own --self-test.
+    expect(zod?.baseCount).toBe(1);
+    expect(zod?.headCount).toBe(2);
   });
 
-  it('⭐ names the second physical @objectstack/spec, at one unchanged version', () => {
-    const spec = reading.duplicated.find((f) => f.name === '@objectstack/spec');
-    expect(spec?.headCount).toBe(2);
+  it('⭐ names the second physical ai, at one unchanged version', () => {
+    const ai = reading.duplicated.find((f) => f.name === 'ai');
+    expect(ai?.headCount).toBe(2);
     // This is #8326's exact bundling mechanism — two real paths, nothing
-    // dedupes them — arriving with no version change anywhere: both are the
-    // pinned build, under two peer contexts.
-    expect(spec?.head.every((k) => k.startsWith('@objectstack/spec@file:.objectstack-pin/spec('))).toBe(true);
+    // dedupes them — arriving with no version change anywhere: both are
+    // ai@7.0.118, under two peer contexts.
+    expect(ai?.head.every((k) => k.startsWith('ai@7.0.118('))).toBe(true);
   });
 });