@@ -4650,23 +4650,57 @@ jobs:
   # showcase app's) than the seven packages that job hands on, so it restores
   # Build Core's turbo seed instead.
   #
-  # BUDGET: the "Run the live e2e specs" step stays under 2 minutes (14-24 s,
-  # median 21 s, over the 35 runs above). The widened gate puts this step on
-  # most pull requests and on every queue entry, so a spec that would push it
-  # over stays in `test:e2e:live:nightly` instead of joining the `:ci`
-  # allowlist.
+  # BUDGET: the "Run the live e2e specs" step stays under 2 minutes. It took
+  # 14-24 s (median 21 s) over the 35 runs above, and 43-94 s (median 70 s)
+  # in the 40 slowest jobs of the ceiling's population below. The widened
+  # gate puts this step on most pull requests and on every queue entry, so a
+  # spec that would push it over stays in `test:e2e:live:nightly` instead of
+  # joining the `:ci` allowlist.
   #
-  # Ceiling: there is no CI population yet, so it is derived from one cold
-  # local run on 4 shared cores (#27154, 2026-10-28), by the rule above Lint UI:
-  # install 60 s + closure build 384 s + Console build 119 s + backend boot
-  # 19 s + specs 26 s + browser provisioning and setup ~120 s ≈ 730 s
-  # (12.2 min) => max(36.5, 27.2) => 40. Re-derive from the first population.
+  # Ceiling, by the rule above Lint UI, re-derived from the first CI population
+  # (#27228). Population: every completed `CI` run with event `push` or
+  # `schedule` on `main`, or `merge_group`, created between #27212's merge
+  # (2026-10-28T11:47:32Z) and 2026-11-06T05:50:51Z: 3,395 runs (1,177 push,
+  # 53 schedule, 2,165 merge_group). The queue runs count because this is a
+  # required context and a queue entry whose run is cancelled is ejected.
+  # Read from
+  #   GET repos/{owner}/{repo}/actions/workflows/ci.yml/runs
+  #       ?branch=main&event=push|schedule&status=completed&created=A..B
+  #   GET repos/{owner}/{repo}/actions/workflows/ci.yml/runs
+  #       ?event=merge_group&status=completed&created=A..B
+  # in one- or two-day windows (one listing answers at most 1,000 runs), and
+  # this job's check-run on each head sha from
+  #   GET repos/{owner}/{repo}/commits/{sha}/check-runs?check_name=Live E2E UI
+  # kept when its job URL names one of those runs. Every run carries the job:
+  # 3,205 success, 181 skipped, 7 failure (316-529 s), 2 cancelled (91 s,
+  # 0 s); none reached a ceiling.
+  # Duration is `completed_at` minus `started_at`, except where the platform
+  # stamped one of them late: six queue jobs on 2026-11-01 read ~4,000 s or
+  # below zero while their steps span 387-513 s, so each of the 40 slowest
+  # reported jobs (and those six) is read to its last step's end instead.
+  #   - success: n=3205, min 68 s, median 407 s, p95 563 s, p99 589 s,
+  #     max 822 s (13.7 min; job 125022934909, a queue run on a slow runner:
+  #     615 s closure build, 94 s specs) => max(41.1, 28.7) => 45.
+  #     The next slowest, to the last step, are 772, 738, 731, 702 and 699 s
+  #     (reported 775, 740, 733, 704 and 701 s), all queue runs; push and
+  #     schedule alone top out at 624 s and would give 35.
+  # `pull_request` runs are not in the population: they were not read in
+  # full, which the sibling rule ("every successful job") asks for. A sample
+  # of 93 successful ones on the same slow days (2026-11-01 to 2026-11-03)
+  # tops out at 675 s, under the 822 s that decides the value, so 45 holds
+  # either way; the next re-derivation should read them in full.
+  # The slow tail is the cold case: those jobs spend 406-615 s in the
+  # closure build, above the 384 s of the cold local run on 4 shared cores
+  # (#27154) that set the old 40 (≈ 730 s => max(36.5, 27.2) => 40), so the
+  # measured max, not that estimate, is the slowest successful run.
+  # Re-derive when the job's work changes; ui/scripts/__tests__/
+  # turbo-cache-save-bound.test.ts holds the value.
   live-e2e-ui:
     name: Live E2E UI
     needs: filter
     if: ${{ !cancelled() && needs.filter.outputs.ui_tree != 'false' && (needs.filter.outputs.ui != 'false' || needs.filter.outputs.ui_consumers != 'false' || needs.filter.outputs.core != 'false') }}
     runs-on: ubuntu-latest
-    timeout-minutes: 40
+    timeout-minutes: 45
     permissions:
       contents: read
     env:
 
@@ -6,16 +6,16 @@ import { test, expect } from '@playwright/test';
  *
  * This is the empirical pin for the defect, run against the REAL stack because
  * only the server can answer the question the issue asked: does it accept a
- * rule array in `$filter`? It does not. Measured against the published backend
- * backend this lane pins — `OBJECTSTACK_VERSION` in `e2e/live/ci/backend.env`,
- * once held to the lockfile by objectui's CI-guide pin test (objectui#7689; deleted by
- * objectstack#26058), with the showcase-app commit derived from it at boot from
- * the matching `@objectstack/cli` release tag (objectui#7964). That pin has
- * moved since this measurement was first taken, which is why it is named by
- * FILE and not by value: a version literal written here goes stale behind the
- * pin silently, and the whole point of objectui#7689 is that it did — for two
- * minor versions, in the pin itself. The showcase app is the one that release
- * checks out:
+ * rule array in `$filter`? It does not. First measured against the published
+ * release the lane then pinned; the lane now runs against the WORKSPACE
+ * backend: `ui/e2e/live/ci/start-backend.sh` boots this tree's own built
+ * `@objectstack/cli` (`objectstack dev --seed-admin --fresh`) on the app that
+ * `LIVE_BACKEND_APP` names in `ui/e2e/live/ci/backend.env`
+ * (`examples/app-showcase`), so the HEAD Console meets the HEAD backend and no
+ * published version is pinned anywhere (objectstack#27154; backend.env says
+ * why the pin retired). The backend is named by those two files, never by a
+ * version, so this note cannot go stale behind it. The showcase app is that
+ * directory:
  *
  *   GET /api/v1/data/showcase_task
  *     ?$filter=[{"field":"status","operator":"equals","value":"in_progress"}]
@@ -35,8 +35,8 @@ import { test, expect } from '@playwright/test';
  *
  * In the `test:e2e:live:ci` allowlist since objectui#3472, per live-e2e.yml's
  * promotion policy (prove flake-free first, then admit): 3/3 consecutive green
- * runs against the pinned live pair, plus a 5/5 run of the enlarged allowlist
- * to show it does not disturb the incumbent specs.
+ * runs against the live pair as it was then pinned, plus a 5/5 run of the
+ * enlarged allowlist to show it does not disturb the incumbent specs.
  */
 const APP = process.env.SHOWCASE_APP_NAME || 'showcase_app';
 
 
@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest';
 import fs from 'node:fs';
 import { parse as parseYaml } from 'yaml';
 
-import { rootCiPath, UI_JOBS } from './helpers/root-ci';
+import { rootCiPath, UI_JOBS, UI_LIVE_E2E_JOB } from './helpers/root-ci';
 
 /**
  * objectui#6577 — cache bookkeeping voided a verdict the gate had already
@@ -69,14 +69,26 @@ const CACHE_JOBS = [DEPS_JOB, ...Object.values(UI_JOBS)];
  *     was "does not rise" (#6577's ruled-out non-fix).
  *   - lint-ui, build-e2e-ui: #25869 row F13, the ceiling comment above lint-ui.
  *   - ui-deps: the derivation on that job.
+ *   - live-e2e-ui: the derivation on that job, by the lint-ui rule over its
+ *     first population, `main`'s push and schedule runs plus the merge-queue
+ *     runs (objectstack#27228). It saves no cache, so it
+ *     is pinned here for its ceiling alone, not one of `CACHE_JOBS`.
  */
 const CEILINGS: Record<string, number> = {
   [DEPS_JOB]: 25,
   [UI_JOBS.typeCheck]: 40,
   [UI_JOBS.lint]: 40,
   [UI_JOBS.buildE2e]: 35,
+  [UI_LIVE_E2E_JOB]: 45,
 };
 
+/** The pinned jobs whose ceiling in `wf` is not the pinned value, as `key: found ≠ pinned`. */
+function movedCeilings(wf: { jobs: Record<string, Job> }): string[] {
+  return Object.entries(CEILINGS)
+    .filter(([key, pinned]) => wf.jobs[key]?.['timeout-minutes'] !== pinned)
+    .map(([key, pinned]) => `${key}: ${wf.jobs[key]?.['timeout-minutes']} ≠ ${pinned}`);
+}
+
 function job(key: string): Job {
   const found = workflow.jobs[key];
   expect(found, `ci.yml must still define a \`${key}:\` job`).toBeDefined();
@@ -196,6 +208,18 @@ describe('root ci.yml — the ui jobs\' cache saves are bounded and non-fatal (o
     // check still reports `cancelled` (objectui#6577, objectui#7048). Moving
     // one is a deliberate act: re-derive it beside the job, move it here.
     expect(job(key)['timeout-minutes'], `the \`${key}\` job ceiling moved`).toBe(ceiling);
+    expect(movedCeilings(workflow).filter((m) => m.startsWith(`${key}:`))).toEqual([]);
+  });
+
+  it('the ceiling pin fires on a moved Live E2E UI ceiling — the control', () => {
+    // The value it carried before the re-derivation, and a job that lost its
+    // ceiling altogether: each must read as moved, and nothing else may.
+    const moved = structuredClone(workflow);
+    moved.jobs[UI_LIVE_E2E_JOB]['timeout-minutes'] = 40;
+    expect(movedCeilings(moved)).toEqual([`${UI_LIVE_E2E_JOB}: 40 ≠ 45`]);
+    delete moved.jobs[UI_LIVE_E2E_JOB]['timeout-minutes'];
+    expect(movedCeilings(moved)).toEqual([`${UI_LIVE_E2E_JOB}: undefined ≠ 45`]);
+    expect(movedCeilings(workflow)).toEqual([]);
   });
 });