@@ -33,8 +33,9 @@ name: Cut RC
 # ---------------------------------------------------------
 # There is no objectui pin to read. The Console source is `ui/apps/console` in
 # this repository (@object-ui/console, ruling D1 「同一个版本号组」): the snapshot
-# above freezes it together with the spec it builds against, `pnpm run build`
-# builds it and `@objectstack/console` copies its dist, and the 39 published
+# above freezes it together with the spec it builds against, `pnpm run
+# console:build` builds it and copies its dist into `@objectstack/console`
+# (packages/console/build-dist.sh), and the 39 published
 # @object-ui/* packages are members of the one Changesets `fixed` group, so the
 # version pass below numbers them with everything else. Nothing here reaches
 # into another repository, and nothing moves a pin, because neither exists.
@@ -272,14 +273,18 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # The whole workspace, both scopes: @object-ui/console builds against this
-      # snapshot's @objectstack/* (`workspace:^`), and `@objectstack/console#build`
-      # (root turbo.json) copies its dist with the TRACKED repo-root
-      # sdui.manifest.json and runs the single-zod canary on what it ships
-      # (packages/console/build-dist.sh). `pnpm run release` below builds again,
-      # as a turbo cache hit.
+      # The whole workspace, both scopes, then the Console: @object-ui/console
+      # builds against this snapshot's @objectstack/* (`workspace:^`), and
+      # `@objectstack/console#build:dist` (root turbo.json) copies its dist with
+      # the TRACKED repo-root sdui.manifest.json and runs the single-zod canary on
+      # what it ships (packages/console/build-dist.sh). Built HERE, before the
+      # version commit, so a Console that cannot build stops the cut before
+      # anything is written; `pnpm run release` below builds both again, as turbo
+      # cache hits.
       - name: Build the workspace (both scopes, the Console included)
-        run: pnpm run build
+        run: |
+          pnpm run build
+          pnpm run console:build
 
       # ────────────────────────────────────────────────────────────────────────
       # PRE-VERSION GATES. Every one of these reads `.changeset/*`, so all of them
 
@@ -1840,10 +1840,11 @@ jobs:
       #
       # The Console is a workspace package now: `ui/apps/console`
       # (@object-ui/console) builds against this tree's @objectstack/* through
-      # `workspace:^`, and `@objectstack/console#build` (root turbo.json) copies
-      # that dist with the tracked sdui.manifest.json, so the `pnpm run build`
-      # below builds it with everything else. The pin-currency gate, the
-      # vendored-dist cache keyed on `.objectui-sha`, its SHA stamp check and
+      # `workspace:^`, and `@objectstack/console#build:dist` (root turbo.json)
+      # copies that dist with the tracked sdui.manifest.json; `pnpm run release`
+      # runs it (`pnpm run console:build`) after the build below. The
+      # pin-currency gate, the vendored-dist cache keyed on `.objectui-sha`,
+      # its SHA stamp check and
       # its spec-injection check are gone with the pin: each answered "was the
       # Console built from the objectui commit, and against the spec, this
       # release names", and both are true by construction when the Console
@@ -1948,8 +1949,9 @@ jobs:
 
       # ──────────────────────────────────────────────────────────────────────
       # The publish itself. `pnpm run release` = build (both scopes; the turbo
-      # cache makes it the build above) + scripts/release-publish.sh, which is `changeset publish` followed by ONE
-      # atomic `git push origin --tags` (#2191: the action's concurrent per-tag
+      # cache makes it the build above) + console:build (the Console dist into
+      # packages/console) + scripts/release-publish.sh, which is `changeset
+      # publish` followed by ONE atomic `git push origin --tags` (#2191: the action's concurrent per-tag
       # pushes raced GitHub's ref backend and lost ~half the tags).
       #
       # changesets/action is NOT used here, and that is deliberate: handed a
 
@@ -3,9 +3,9 @@
 **Prebuilt Console SPA, version-locked to the framework release that ships it.**
 
 This package contains nothing but a prebuilt `dist/` directory: the static
-assets of the ObjectStack runtime Console, baked at the commit of
-[`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui)
-recorded in [`.objectui-sha`](../../.objectui-sha) of this framework release.
+assets of the ObjectStack runtime Console, built from
+[`ui/apps/console`](../../ui/apps/console) (`@object-ui/console`) in the same
+commit of this repository as the framework release that ships it.
 
 You never install it directly. `@objectstack/cli` declares it as a
 dependency, and both ship at the same version from the Changesets `fixed`
@@ -24,8 +24,8 @@ in sync.
 
 | | `@object-ui/console` | `@objectstack/console` |
 |---|---|---|
-| Repo | [`objectstack-ai/objectui`](https://github.com/objectstack-ai/objectui) | [`objectstack-ai/objectstack`](https://github.com/objectstack-ai/objectstack) |
-| Role | Standalone Console SPA on its own release cadence | Prebuilt SPA frozen at the SHA this framework release was tested against |
+| Source | `ui/apps/console` in this repository | a copy of that build's `dist/` |
+| Role | The Console SPA, versioned with the framework in the one `fixed` group | Prebuilt SPA shipped with the framework release it was built with |
 | Use | Cloud overlays, advanced users, anyone consuming Console directly | What every `@objectstack/cli` install gets by default |
 
 The framework CLI's `resolveConsolePath()` (in
@@ -46,20 +46,20 @@ objectui edits — not a package resolution. Cloud and objectos Docker images
 overlay their own Console build into `@objectstack/console`'s `dist/` — not
 into any `@object-ui/console` directory.
 
-## Updating
+## Building
 
-1. Run `scripts/bump-objectui.sh` (or `scripts/bump-objectui.sh <sha>`) at
-   the repo root to update `.objectui-sha`. Prefer `pnpm objectui:refresh`,
-   which bumps *and* rebuilds in one step.
-2. Opening the PR runs CI's **Console Pin Gate**, which clones objectui at
-   the new SHA, builds `@object-ui/console` against this tree's
-   `@objectstack/client`, and runs `pnpm check:console-sha`. A pin that
-   cannot build fails the PR rather than the release.
-3. CI runs `scripts/build-console.sh` again before publish, which clones
-   objectui at the pinned SHA, builds `@object-ui/console`, and copies
-   `dist/` into this package.
-4. `pnpm publish` ships it at the same version as every other package in
-   the Changesets `fixed` group.
+1. `pnpm console:build` at the repo root runs turbo's
+   `@objectstack/console#build:dist`, which first builds `@object-ui/console`
+   (and its closure) against this tree's `@objectstack/*` through
+   `workspace:^`, then runs [`build-dist.sh`](./build-dist.sh): it copies
+   `ui/apps/console/dist` here, puts the tracked repo-root
+   `sdui.manifest.json` over `dist/sdui.manifest.json`, and fails unless the
+   bundle carries exactly one zod instance.
+2. `pnpm run release` runs it after the workspace build and before
+   `changeset publish`, so the publish ships it at the same version as every
+   other package in the Changesets `fixed` group.
+
+There is no pin to bump: a Console change is an ordinary change under `ui/`.
 
 The `dist/` directory is **not** committed — it's a CI publish artifact
 only.
 
@@ -485,7 +485,17 @@ export function selfTest() {
   ok(`the live tree yields occurrences (found ${live.occurrences.length})`, live.occurrences.length > 50);
   ok(`and judges a real share of them (judged ${live.judged.length})`, live.judged.length > 30);
   ok(`and the checked-in tree is clean (dead: ${live.dead.map((d) => d.value).join(', ') || 'none'})`, live.dead.length === 0);
-  ok('and the foreign scope is present and unjudged, not silently missing', (live.unjudgedByKind.foreign ?? 0) > 0);
+  // The foreign scope's live population is objectui's own scripts under `ui/`. Its
+  // first one, scripts/build-console.sh, left with the objectui pin (objectstack#25711),
+  // so a tree without `ui/` names no `@object-ui/` filter at all and the zero there is the
+  // reading, not a blind scan; a tree with `ui/` must still show them unjudged.
+  const holdsUi = existsSync(join(root, 'ui', 'package.json'));
+  ok(
+    holdsUi
+      ? 'and the foreign scope is present and unjudged, not silently missing'
+      : 'and, with no ui/ in this tree, no committed filter names the foreign scope',
+    holdsUi ? (live.unjudgedByKind.foreign ?? 0) > 0 : (live.unjudgedByKind.foreign ?? 0) === 0,
+  );
   ok(
     'the self-exemption is exactly the three files that own the rule — never a fourth',
     RULE_OWNING_FILES.length === 3
 
@@ -853,7 +853,7 @@ const DEBT = {
 // nature changes, the RECONCILED direction forces this entry out.
 const EXEMPT = {
   '@objectstack/console':
-    'Published objectui build artifact -- package.json/README/CHANGELOG plus a dist/ pulled in by `pnpm objectui:refresh`. No TypeScript sources, no tsconfig; the sources are type-checked in the objectui repo.',
+    'Published Console build artifact -- package.json/README/CHANGELOG plus a dist/ copied from ui/apps/console by its own build:dist (build-dist.sh, plain bash; objectstack#25711). No TypeScript sources, no tsconfig; the sources are type-checked as @object-ui/console under ui/.',
   '@objectstack/skills':
     'Published skills catalog -- package.json/README/CHANGELOG plus a dist/skills tree copied from the repository root skills/** by its own build (scripts/sync-catalog.mjs, plain node). No TypeScript sources, no tsconfig; the catalog is markdown and JSON, judged by the skill gates over skills/**.',
 };
 
@@ -9,7 +9,8 @@
 #   2. The changesets consumed by the release (full text — the best prose for
 #      items that have one).
 #   3. The objectui (Console UI) commit range, derived from the .objectui-sha
-#      pin at each ref.
+#      pin at each ref. After objectstack#25711 no ref carries a pin (the
+#      Console is built from ui/), and the section says so instead.
 #   4. The cloud (control plane) commits inside the release's time window.
 #      Cloud is not pinned by the framework (it tracks it via link: deps and
 #      versions independently), so the window between the two refs' commit
@@ -428,14 +429,23 @@ fi
 echo "## 3. Console UI (objectui) — pin range"
 echo
 
+# The pin is gone from every ref after objectstack#25711: the Console is built
+# from this tree's ui/, so its commits are already in section 1. A range across
+# that boundary starts at the last pin and ends at the subtree import, and only
+# the objectui repository holds the commits between the two.
 prev_sha=$(git show "${PREV_REF}:.objectui-sha" 2>/dev/null || true)
-new_sha=$(git show "${NEW_REF}:.objectui-sha" 2>/dev/null || cat .objectui-sha)
+new_sha=$(git show "${NEW_REF}:.objectui-sha" 2>/dev/null || true)
 
 echo "- previous pin: \`${prev_sha:-<none>}\`"
-echo "- this release: \`${new_sha}\`"
+echo "- this release: \`${new_sha:-<none>}\`"
 echo
 
-if [[ -z "$prev_sha" ]]; then
+if [[ -z "$new_sha" ]]; then
+  echo "_No objectui pin at ${NEW_REF}: the Console is built from ui/ in this tree (objectstack#25711), so its commits are in section 1._"
+  if [[ -n "$prev_sha" ]]; then
+    echo "_The last pin was \`${prev_sha}\`: the objectui commits from it up to the ui/ subtree import are not in section 1; read them in objectstack-ai/objectui._"
+  fi
+elif [[ -z "$prev_sha" ]]; then
   echo "_No .objectui-sha at ${PREV_REF}; cannot compute the range._"
 elif [[ "$prev_sha" == "$new_sha" ]]; then
   echo "_Console pin unchanged — no objectui delta in this release._"
 
@@ -1546,28 +1546,6 @@ export const UNJUDGED = new Map([
       + 'at :189-:193 from the `for (const root of ROOTS)` at :462, for every `.md` file under it '
       + 'minus the entry\'s own `exclude` list',
   }],
-  ['scripts/check-console-injection.mjs distDir packages', {
-    population: false,
-    base: '91f65c4ea',
-    why: 'the word is a `join()` path COMPONENT at check-console-injection.mjs:940 — the gate '
-      + 'assembles the console dist directory from four bare single-segment words, so the extractor '
-      + 'sees the top-level one and nothing else. It never walks that root: `evaluate` at :247 opens '
-      + 'the index file at :252, the stamp beside it at :268, and every JavaScript asset directly '
-      + 'inside that directory\'s assets child at :269 — `readBundle` in console-spec-probes.mjs, '
-      + 'non-recursive. Surfaced by the #17057 property widening because the component sits inside '
-      + 'the `distDir` property of the argv object, which the recogniser now reads',
-  }],
-  ['scripts/check-console-injection.mjs specDir packages', {
-    population: false,
-    base: '91f65c4ea',
-    why: 'the same shape one line down, at check-console-injection.mjs:941: a `join()` component of '
-      + 'the spec package directory, assembled from bare words. The gate reads that package\'s '
-      + 'manifest and the built JavaScript its `exports` map points at — `readSpecBlob` in '
-      + 'console-spec-probes.mjs, reached at :348 — never an arbitrary file under the top-level '
-      + 'root. ⚠️ Both of this gate\'s real populations are themselves invisible to the derivation, '
-      + 'for the DIFFERENT reason that they are assembled rather than spelled; that is a fact this '
-      + 'note records and not a verdict on what, if anything, should be declared for them',
-  }],
   ['scripts/check-doc-frontmatter.mjs ROOTS docs', {
     population: false,
     base: '91f65c4ea',
 
@@ -658,8 +658,10 @@ export function selfTest({ tier = 'full' } = {}) {
   // sources: `pr-automation.yml` (the `--base` gates), `ci.yml` (the shard
   // attestation), `engine-split-metric.yml` (`--days 90`),
   // `required-set-patrol.yml` (a complete argv behind a continuation and a
-  // redirection), `prerelease-pin-watch.yml` (`--verbose 2>&1`). The live half
-  // at the end of the block re-reads them from the workflows themselves.
+  // redirection), `prerelease-pin-watch.yml` (`--verbose 2>&1`; that workflow
+  // left with the objectui pin, objectstack#25711, and its row stays as a
+  // fixture of the shape). The live half at the end of the block re-reads the
+  // others from the workflows themselves.
   const keyWf = [
     'jobs:',
     '  gates:',
@@ -1002,10 +1004,11 @@ export function selfTest({ tier = 'full' } = {}) {
         'scripts/check-adr-0087-registration.mjs', 'scripts/check-changeset-no-major.mjs']
         .every((script) => valueBearing.some((i) => i.script === script)),
     );
+    // The card named three; the third, `scripts/check-prerelease-pin-watch.mjs
+    // --verbose`, left with the objectui pin it watched (objectstack#25711).
     t(
-      '⭐ …and the three the card called value-bearing that are really LITERAL render as runnable commands instead',
-      ['scripts/check-engine-split-ratio.mjs --days 90', 'scripts/check-required-contexts.mjs --verify-required-set',
-        'scripts/check-prerelease-pin-watch.mjs --verbose']
+      '⭐ …and the two the card called value-bearing that are really LITERAL render as runnable commands instead',
+      ['scripts/check-engine-split-ratio.mjs --days 90', 'scripts/check-required-contexts.mjs --verify-required-set']
         .every((key) => direct.some((i) => i.check === key && i.argvVariables.length === 0)),
     );
     t(
 
@@ -104,17 +104,21 @@ const HERE = dirname(fileURLToPath(import.meta.url));
  *
  * Declared, never inferred: a new foreign scope has to be added here
  * deliberately, which is the difference between a documented exemption and a
- * silent hole. `scripts/build-console.sh` runs its `@object-ui/console` filters
- * inside `$BUILD_ROOT` -- a checkout of `objectstack-ai/objectui` at the SHA
- * pinned in `.objectui-sha` -- never against this workspace, so resolving those
- * against this tree would be asking the wrong root.
+ * silent hole. The `@object-ui/` entry's first cause is gone: it was
+ * `scripts/build-console.sh`, which ran its `@object-ui/console` filters inside a
+ * checkout of `objectstack-ai/objectui` at the SHA pinned in `.objectui-sha`, and
+ * both left with the pin (objectstack#25711). It stays declared until the objectui
+ * subtree lands under `ui/` (sub-issue 5 of objectstack#25677): before that a
+ * filter naming an `@object-ui/` package matches nothing in this tree by design.
+ * ⛔ Retire the entry in the PR that lands `ui/`, where every such name becomes a
+ * workspace package this gate can judge.
  */
 export const FOREIGN_SCOPES = [
   {
     scope: '@object-ui/',
     reason:
-      'the objectui repo (objectstack-ai/objectui); scripts/build-console.sh runs these '
-      + 'filters inside that checkout, not this workspace',
+      'the objectui tree, which this workspace holds under ui/ only once the subtree import '
+      + 'of objectstack#25677 lands',
   },
 ];
 
@@ -451,9 +455,8 @@ export function extractFilters(text) {
  * THIS workspace naming a package that does not exist.
  *
  * The `cd` bail-out is the load-bearing one: a command that changes directory
- * may be filtering against another root entirely (`scripts/build-console.sh`
- * does exactly that, in the objectui checkout), and this function has no way to
- * know which. Unknown root, no verdict.
+ * may be filtering against another root entirely, and this function has no way
+ * to know which. Unknown root, no verdict.
  *
  * @param {string} command
  * @param {string} cwd