@@ -3064,31 +3064,6 @@ jobs:
         continue-on-error: true
         run: pnpm check:startup-registry-verdict
 
-      # objectui pin-changeset guard (#4731). A frontend-only refresh reaches the
-      # platform release record ONLY through the changeset `bump-objectui.sh`
-      # writes, and that list used to be guessed off objectui's commit subjects
-      # (`feat|fix` + a silent `head -40`). On one real range the guess dropped
-      # all 13 releasing non-feat/fix commits — every breaking `refactor(...)!`
-      # among them — and pulled in 5 that release nothing. The list and the bump
-      # level now come from what objectui DECLARED (`.changeset/*.md` added over
-      # the range; empty frontmatter = release-nothing). This self-test builds
-      # throwaway git repos carrying those exact shapes, runs the real scripts
-      # over them, and asserts the emitted changeset — including that a cap which
-      # fires announces itself and that an unwalkable range degrades loudly.
-      # #4843 folded `scripts/objectui-range.mjs` — the release page's Console
-      # section — onto that same `classifyRange()` criterion, so both self-tests
-      # run here: one criterion, two consumers, no room to drift apart.
-      - name: objectui pin-changeset digest guard
-        id: objectui-pin-changeset-digest-guard
-        continue-on-error: true
-        run: pnpm check:objectui-changeset
-
-      # Rationale: `scripts/bump-objectui.selftest.sh` header (#10797).
-      - name: objectui pin write-ordering guard
-        id: objectui-pin-write-ordering-guard
-        continue-on-error: true
-        run: pnpm check:objectui-bump
-
       # Changeset-family gate self-tests (#6509). The SELF-TEST halves only —
       # the real scans stay in pr-automation.yml's `changeset-check`, and the
       # split is the whole point of this step.
 
@@ -1835,109 +1835,25 @@ jobs:
         run: node scripts/check-changeset-fixed.mjs
 
       # ──────────────────────────────────────────────────────────────────────
-      # ⛔ TOMBSTONE — the #3340 pin-currency gate that used to sit here is gone
-      # (2026-08-20 ruling, #10134). Do not re-add one.
+      # ⛔ TOMBSTONE — no objectui pin is read, built or checked here, and none
+      # is re-added (objectstack#25711, D1 ruling 「同一个版本号组」).
       #
-      # It compared `.objectui-sha` against objectui `main` at publish time and
-      # refused a release whose pin lagged. The ruling removed the question, not
-      # just the job: WHICH objectui revision this repo pins is a decision taken
-      # in an objectstack issue, never derived from another repo's HEAD, so
-      # "the pin is behind main" is not a defect a release lane may diagnose.
-      #
-      # R4's lesson (#6170 — "a gate required on a PR the publishing lane can
-      # skip is not a gate") is untouched and does not resurrect this one:
-      # #3340's actual invariant is "everything published is covered by the
-      # changeset record", and that is carried by `scripts/bump-objectui.sh` +
-      # `scripts/objectui-changeset-digest.mjs` at BUMP time — on the manual pin
-      # PR, which is now the only way the pin ever moves. Publishing an old
-      # console is therefore a published decision, not an unnoticed gap.
+      # The Console is a workspace package now: `ui/apps/console`
+      # (@object-ui/console) builds against this tree's @objectstack/* through
+      # `workspace:^`, and `@objectstack/console#build` (root turbo.json) copies
+      # that dist with the tracked sdui.manifest.json, so the `pnpm run build`
+      # below builds it with everything else. The pin-currency gate, the
+      # vendored-dist cache keyed on `.objectui-sha`, its SHA stamp check and
+      # its spec-injection check are gone with the pin: each answered "was the
+      # Console built from the objectui commit, and against the spec, this
+      # release names", and both are true by construction when the Console
+      # source and the spec are one tree at one commit. The single-zod canary
+      # survives inside packages/console/build-dist.sh, on the bytes it ships.
       # ──────────────────────────────────────────────────────────────────────
 
       - name: Build
         run: pnpm run build
 
-      - name: Read the spec's declared zod range (Console dist key input)
-        id: spec-zod
-        # Fails rather than keying on an empty or `undefined` range: a key that
-        # silently stopped carrying the range would restore across a zod move.
-        run: |
-          node -e '
-            const range = require("./packages/spec/package.json").dependencies?.zod;
-            if (typeof range !== "string" || range.trim() === "") {
-              console.error("packages/spec/package.json declares no dependencies.zod, so the Console dist key cannot carry it.");
-              process.exit(1);
-            }
-            console.log("range=" + range.trim());
-          ' >> "$GITHUB_OUTPUT"
-
-      # This key hashes the pin and the build script, and carries the spec's
-      # DECLARED zod range (the step above). ci.yml's Console Pin Gate (#4290)
-      # hashes a SUPERSET of the files: those two, the probe scripts and the
-      # spec's entry layout (#20765). So the two workflows no longer share dist
-      # entries, and each one builds its own on a miss. Keeping this key narrower
-      # is deliberate.
-      # Following ci.yml would rebuild the console on every Version Packages
-      # merge, and publishing a cached console whose spec content lags is the
-      # existing cache design.
-      #
-      # The zod range is the one spec input the cached dist is NOT allowed to
-      # lag (#21108). The console bundles a single zod instance, the console's
-      # own copy, and its build refuses a console zod outside the injected spec's
-      # declared `zod` range (objectui#11353). A dist restored after that range
-      # moved would publish a console the build never judged against it. The
-      # range is read out of packages/spec/package.json, not hashed with it: the
-      # file's `version` moves on every Version Packages merge, and hashing the
-      # whole file would turn every publish into a cold console rebuild.
-      #
-      # Split restore/save, matching ci.yml, and not the combined actions/cache
-      # action: the combined form's post-step saves even when the job FAILED,
-      # and build-console.sh writes the SHA stamp BEFORE it asserts the bundle
-      # canary — so a canary failure here would seed this shared, repo-scoped
-      # key with a stamped-but-broken dist that later runs restore and sail
-      # through. See ci.yml's split-restore note for the full rationale.
-      - name: Restore vendored Console dist (keyed on the objectui pin)
-        id: console-dist-cache
-        uses: actions/cache/restore@v6
-        with:
-          path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-
-      - name: Build vendored @objectstack/console SPA
-        # Clones objectstack-ai/objectui at the SHA pinned in .objectui-sha,
-        # builds @object-ui/console, and copies dist/ into
-        # packages/console/dist/. Must run before publish so the prepublishOnly
-        # guard in @objectstack/console passes.
-        if: steps.console-dist-cache.outputs.cache-hit != 'true'
-        run: bash scripts/build-console.sh
-
-      - name: Verify Console dist stamp matches pin
-        run: pnpm check:console-sha
-
-      # The spec-injection half of the same question, spelled exactly as
-      # ci.yml's Console Pin Gate spells it — both consumers of one cache key
-      # apply one check. check:console-sha answers only "which objectui SHA",
-      # and scripts/assert-console-spec-injection.mjs runs INSIDE
-      # build-console.sh, which the `if: cache-hit != 'true'` above skips — so
-      # on a cache hit nothing had asked whether the dist this job is about to
-      # PUBLISH bundles this tree's @objectstack/spec rather than the published
-      # tarball. --require-stamp because the vacuity check:console-sha tolerates
-      # (no dist, or a dist no build ever stamped) is wrong on a publish lane.
-      - name: Verify the restored Console dist bundles this tree's spec
-        env:
-          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-        run: pnpm check:console-injection --require-stamp
-
-      # Reached only with every console assertion above green: Actions steps
-      # default to `success()`, and nothing between the restore and here carries
-      # `if: always()` or `continue-on-error`. Saving only on a miss keeps an
-      # immutable entry from being rewritten on every release run.
-      - name: Save vendored Console dist
-        if: steps.console-dist-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v6
-        with:
-          path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-
       - name: Downstream backward-compat smoke (live hotcrm)
         # Pre-publish gate (#2035): the about-to-publish @objectstack/spec must
         # not break a real third-party consumer pinned to a published release.
@@ -2031,8 +1947,8 @@ jobs:
         run: bash scripts/release-spec-changes.sh --verify
 
       # ──────────────────────────────────────────────────────────────────────
-      # The publish itself. `pnpm run release` = build + build-console +
-      # scripts/release-publish.sh, which is `changeset publish` followed by ONE
+      # The publish itself. `pnpm run release` = build (both scopes; the turbo
+      # cache makes it the build above) + scripts/release-publish.sh, which is `changeset publish` followed by ONE
       # atomic `git push origin --tags` (#2191: the action's concurrent per-tag
       # pushes raced GitHub's ref backend and lost ~half the tags).
       #
 
@@ -55,17 +55,13 @@ jobs:
       # built `dist/`. Build the whole dependency closure (excluding the
       # showcase's own app build, which serve --dev doesn't need).
       - run: pnpm turbo run build --filter=@objectstack/example-showcase^...
-      # The console SPA served at /_console is vendored by build-console.sh
-      # (shallow-clones objectui@.objectui-sha, builds @object-ui/console, copies
-      # dist → packages/console/dist). Without it serve --dev warns "Console dist
-      # not found" and the app shell never renders.
-      - name: Vendor the pinned Console SPA
-        run: bash scripts/build-console.sh
-      # Self-test the drift guard: a fresh build-console.sh must stamp the dist
-      # with the pinned SHA so `pnpm check:console-sha` reports in-sync. Catches
-      # a regression where the stamp step is dropped or the pin/stamp diverge.
-      - name: Verify Console SHA stamp matches pin
-        run: pnpm check:console-sha
+      # The console SPA served at /_console is @objectstack/console's dist: a
+      # copy of the workspace's own ui/apps/console build, which `build` does not
+      # produce (packages/console/build-dist.sh, run by the `build:dist` task).
+      # Without it serve --dev warns "Console dist not found" and the app shell
+      # never renders.
+      - name: Build the Console SPA from ui/apps/console
+        run: pnpm console:build
       - name: Install Playwright Chromium
         working-directory: examples/app-showcase
         run: pnpm exec playwright install --with-deps chromium
 
@@ -18,12 +18,12 @@
     "prepare": "node scripts/setup-git-hooks.mjs",
     "check:merge-driver": "node scripts/git-env.mjs --self-test && node scripts/git-merge-regen.mjs --self-test && node scripts/check-regen-pending.mjs --self-test",
     "version": "node scripts/release-pending-publish.mjs annotate-shipped; changeset version && node scripts/sync-protocol-version.mjs && node scripts/sync-template-versions.mjs && node scripts/sync-docs-image-tags.mjs && node scripts/sync-release-index-currency.mjs && node scripts/check-skill-compatibility-version.mjs --fix",
-    "release": "pnpm run build && bash scripts/release-publish.sh",
+    "release": "pnpm run build && pnpm run console:build && bash scripts/release-publish.sh",
     "docs:dev": "pnpm --filter @objectstack/docs dev",
     "docs:build": "pnpm --filter @objectstack/docs build",
     "docs:start": "pnpm --filter @objectstack/docs start",
     "os": "node packages/cli/bin/run.js",
-    "console:build": "turbo run build --filter=@objectstack/console",
+    "console:build": "turbo run build:dist --filter=@objectstack/console",
     "gen:sdui-lockstep": "node scripts/check-sdui-lockstep.mjs --update",
     "lint": "node --stack-size=4000 node_modules/eslint/bin/eslint.js . --no-inline-config",
     "i18n:extract": "tsx packages/cli/bin/run-dev.js i18n extract packages/platform-objects/scripts/i18n-extract.config.ts --locales=zh-CN,ja-JP,es-ES --fill=default --source-hashes --out=packages/platform-objects/src/apps/translations",
 
@@ -47,7 +47,7 @@ const NOT_INSTALLED_HEADLINE =
   'The ObjectStack Console is not installed, so this server has no Console to serve at /_console/.';
 
 /** The framework repo's remedy. */
-const BUILD_REMEDY = 'pnpm objectui:build';
+const BUILD_REMEDY = 'pnpm console:build';
 
 /** The prefix the terminal warning carries and the HTTP answer does not. */
 const WARNING_PREFIX = '  ⚠ ';
@@ -84,7 +84,7 @@ function frameworkTree(): { root: string; consoleDir: string } {
   writeJson(path.join(root, 'package.json'), {
     name: 'framework-root',
     private: true,
-    scripts: { build: 'turbo run build', 'objectui:build': 'bash scripts/build-console.sh' },
+    scripts: { build: 'turbo run build', 'console:build': 'turbo run build:dist --filter=@objectstack/console' },
   });
   return { root, consoleDir: writeUnbuiltConsole(path.join(root, 'packages', 'console')) };
 }
@@ -124,7 +124,7 @@ describe('a framework checkout with no built Console', () => {
     request = await serve(createConsoleNotBuiltPlugin(consoleDir));
   });
 
-  it.each(CONSOLE_REQUESTS)('GET %s answers 503 naming `pnpm objectui:build`', async (p) => {
+  it.each(CONSOLE_REQUESTS)('GET %s answers 503 naming `pnpm console:build`', async (p) => {
     const res = await request(p);
     expect(res.status).toBe(503);
     expect(res.headers.get('content-type')).toMatch(/^text\/plain/);
 
@@ -307,10 +307,10 @@ export function hasConsoleDist(consolePath: string): boolean {
 // ─── "No dist" remedy — named for where the server runs ─────────────
 
 /** The framework repo's root script that builds `packages/console/dist`. */
-const CONSOLE_BUILD_SCRIPT = 'objectui:build';
+const CONSOLE_BUILD_SCRIPT = 'console:build';
 
 /**
- * The directory whose `package.json` declares `objectui:build` for this
+ * The directory whose `package.json` declares `console:build` for this
  * console package, or `null`.
  *
  * Only the NEAREST `package.json` above `consolePath` is asked. In the
@@ -320,8 +320,7 @@ const CONSOLE_BUILD_SCRIPT = 'objectui:build';
  * intermediate directories carry none — so a project that merely sits inside
  * a framework checkout is never told to run a script that does not build the
  * console it actually resolved. The signal is the script itself rather than
- * the repo's layout or its `.objectui-sha` pin, so the remedy is named only
- * where it exists.
+ * the repo's layout, so the remedy is named only where it exists.
  */
 function findConsoleBuildRoot(consolePath: string): string | null {
   let dir = path.dirname(consolePath);
@@ -351,7 +350,7 @@ function findConsoleBuildRoot(consolePath: string): string | null {
  * Three places reach it, and each gets the remedy that works there:
  *
  *   - the framework repo, where `packages/console/dist` is a gitignored build
- *     that `pnpm build` never produces — `pnpm objectui:build`, run at the
+ *     that `pnpm build` never produces — `pnpm console:build`, run at the
  *     root it was found under (it is a root script, so it does not resolve
  *     from the example directory `pnpm dev` runs in);
  *   - anywhere else, where the Console arrives prebuilt as
@@ -384,7 +383,7 @@ function describeConsoleDistMissing(consolePath: string | null, hostPaths: boole
     return (
       `Console dist not found at ${path.relative(buildRoot, dist)} — \`pnpm build\` does not produce it. ` +
       `Build it with \`pnpm ${CONSOLE_BUILD_SCRIPT}\` in ${hostPaths ? buildRoot : 'the root of the ObjectStack checkout this server runs from'} ` +
-      `(uses a ../objectui checkout if present, else clones objectui at the pinned commit — needs network).`
+      `(builds ui/apps/console, then copies its dist into packages/console).`
     );
   }
   return `Console dist not found${hostPaths ? ` at ${dist}` : ''} — ${reinstall}`;
 
@@ -54,8 +54,8 @@
  * ## The console leg is reached through `package.json` (#19922)
  *
  * The second place looked is the copy `@objectstack/console` ships in its
- * `dist/` — objectui's public-tier registry at the pinned commit, copied in by
- * `scripts/build-console.sh`. This leg used to ask for that file by its own
+ * `dist/` — the tracked repo-root `sdui.manifest.json`, copied in by
+ * `packages/console/build-dist.sh`. This leg used to ask for that file by its own
  * subpath, which the console's `exports` map does not publish (it publishes
  * `./package.json` alone): the resolve threw `ERR_PACKAGE_PATH_NOT_EXPORTED`, a
  * `catch` swallowed it, and a project with no manifest of its own was checked
@@ -105,7 +105,7 @@ export const CONSOLE_SDUI_MANIFEST = '@objectstack/console/dist/sdui.manifest.js
 /** The one subpath the console's `exports` map publishes. */
 const CONSOLE_PACKAGE_JSON = '@objectstack/console/package.json';
 
-/** Where `scripts/build-console.sh` puts the manifest, relative to the console package root. */
+/** Where `packages/console/build-dist.sh` puts the manifest, relative to the console package root. */
 const CONSOLE_MANIFEST_IN_PACKAGE = 'dist/sdui.manifest.json';
 
 /**