@@ -9,6 +9,7 @@ import { fileURLToPath } from 'node:url';
 // `tsconfig.scripts.json` (`allowJs`), so no `@ts-expect-error` here —
 // re-adding one is now itself an error (TS2578). See objectui#3494.
 import { classify, scan, locate, SCANNED_BYTES, KNOWN_OFFENDERS } from '../check-control-bytes.mjs';
+import { globMatches, jobBlock, repoPath, rootCi, triggerBlock, uiFilterGlobs, uiRun, UI_JOBS, withoutComments } from './helpers/root-ci';
 
 /**
  * objectstack#5425. Two raw U+0000 bytes in
@@ -473,39 +474,40 @@ describe('objectstack#5450 — the four baselined files are clean', () => {
   });
 });
 
+/**
+ * The home is the repository root's `ci.yml` now (objectstack#25712). GitHub
+ * runs only the root `.github/workflows/`, and objectstack#25902 ported
+ * objectui's `repo-gates.yml`, this gate's old home, into the root `lint-ui`
+ * job, which spells it through its alias. Both pins read that job and the root
+ * triggers, by path.
+ */
 describe('wiring — the gate is actually reachable and actually runs', () => {
   const pkg = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
-  const workflowPath = path.join(repoRoot, '.github/workflows/repo-gates.yml');
+  const ci = rootCi();
 
   it('is exposed as a root package script', () => {
     expect(pkg.scripts['check:control-bytes']).toBe('node scripts/check-control-bytes.mjs');
   });
 
-  it('has a workflow that gates pull requests', () => {
-    expect(fs.existsSync(workflowPath), 'a check nothing runs is not a gate').toBe(true);
-    expect(fs.readFileSync(workflowPath, 'utf8')).toMatch(/pull_request:/);
-  });
-
-  it('does NOT filter that workflow by path', () => {
-    // This is the whole reason it is its own workflow rather than a step in
-    // ci.yml or lint.yml: on a markdown-only change both of those skip every
-    // expensive step, so a gate inside either would never see it. Markdown is
-    // precisely the carrier objectstack#4890 was found in, so a path filter here
-    // would rebuild the hole this guard exists to close. `changeset-guard.yml`
-    // is in the repo for the same reason and says so in its own header.
-    //
-    // Not the reason this comment used to give — "both of those `paths-ignore`
-    // markdown, `content/**`, `docs/**` and `.changeset/**`" — which
-    // objectui#4381 corrected here and in the workflow's own header. Since
-    // objectui#3523 step 2 that filter is gone from their `pull_request` trigger
-    // and survives only on `push`, so a markdown-only PR does start both and
-    // does produce their contexts (measured — PR #3856, one markdown file, 16
-    // checks). What still skips is the work inside them: the `Decide whether
-    // this change needs a full run` step excludes markdown and skips every step
-    // below itself, and the `push` lane is filtered at the trigger as before.
-    // The conclusion outlived its premise; objectui#3857 pinned the correction.
-    const workflow = fs.readFileSync(workflowPath, 'utf8');
-    expect(workflow).not.toMatch(/paths-ignore:/);
-    expect(workflow).not.toMatch(/^\s+paths:/m);
+  it('the root Lint UI job runs it, and the root ci.yml gates pull requests', () => {
+    expect(withoutComments(jobBlock(ci, UI_JOBS.lint)), 'a check nothing runs is not a gate').toContain(
+      `run: ${uiRun('check:control-bytes')}`,
+    );
+    expect(triggerBlock(ci)).toMatch(/^ {2}pull_request:/m);
+  });
+
+  it('is filtered by no path a markdown-only change could miss', () => {
+    // Markdown is precisely the carrier objectstack#4890 was found in, so a
+    // filter that skips a markdown-only change would rebuild the hole this guard
+    // exists to close. objectui's `repo-gates.yml` met that with no path filter
+    // at all. The root ci.yml filters no paths at the trigger either, and
+    // `lint-ui` runs on the `filter` job's `ui` globs, which must keep matching
+    // a markdown-only change anywhere under `ui/`.
+    expect(withoutComments(triggerBlock(ci))).not.toMatch(/^\s+paths(-ignore)?:/m);
+    const globs = uiFilterGlobs(ci);
+    const missed = ['README.md', 'content/docs/guide/ci-cd-pipeline.md', 'packages/core/README.md']
+      .map(repoPath)
+      .filter((file) => !globs.some((glob) => globMatches(glob, file)));
+    expect(missed, 'a markdown-only change under ui/ would skip Lint UI').toEqual([]);
   });
 });
@@ -34,10 +34,27 @@ import {
 } from '../check-doc-component-types.mjs';
 
 import { selfTestCases, stripAnsi } from './helpers/child-verdict';
+import {
+  globMatches,
+  jobBlock,
+  repoPath,
+  rootCi,
+  rootCiPath,
+  rootWorkflow,
+  rootWorkflowFiles,
+  uiFilterGlobs,
+  uiRun,
+  UI_JOBS,
+} from './helpers/root-ci';
 
 const ROOT = path.resolve(fileURLToPath(import.meta.url), '../../..');
 const GUARD = 'scripts/check-doc-fence-languages.mjs';
-const WORKFLOW = 'repo-gates.yml';
+const ALIAS = 'check:doc-fences';
+/**
+ * The guard's home, as failure messages name it: the root `lint-ui` job, where
+ * objectstack#25902 ported objectui's `repo-gates.yml` (objectstack#25712).
+ */
+const WORKFLOW = `ci.yml (${UI_JOBS.lint})`;
 
 /**
  * A numeral that qualifies a document-population noun, as `match: text`.
@@ -439,42 +456,58 @@ describe('check-doc-fence-languages: non-vacuity, through the shipped module', (
   });
 });
 
+/**
+ * GitHub runs only the repository root's `.github/workflows/`, so the wiring is
+ * the root `ci.yml`'s: objectstack#25902 ported objectui's `repo-gates.yml` into
+ * its `lint-ui` job, which runs the guard through its alias (objectstack#25712).
+ * Every pin below reads that file by path.
+ */
 describe('check-doc-fence-languages is wired, not merely present', () => {
-  const workflow = parseYaml(fs.readFileSync(path.join(ROOT, '.github/workflows', WORKFLOW), 'utf8'));
-  const steps: Array<Record<string, unknown>> = workflow.jobs['repo-gates'].steps;
-  const gateSteps = steps.filter((s) => typeof s.run === 'string' && (s.run as string).includes(GUARD));
+  const workflow = parseYaml(rootCi());
+  const steps: Array<Record<string, unknown>> = workflow.jobs[UI_JOBS.lint].steps;
+  const runs = (s: Record<string, unknown>) => typeof s.run === 'string' && (s.run as string).includes(uiRun(ALIAS));
+  const gateSteps = steps.filter(runs);
 
   it('the guard script exists', () => {
     expect(fs.existsSync(path.join(ROOT, GUARD))).toBe(true);
   });
 
   it('package.json aliases it, and the alias points at the script that exists', () => {
     const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
-    expect(pkg.scripts['check:doc-fences']).toContain(GUARD);
+    expect(pkg.scripts[ALIAS]).toBe(`node ${GUARD}`);
   });
 
-  it('the workflow runs it — one step, both legs', () => {
+  it('the root Lint UI job runs it — one step, both legs', () => {
     expect(gateSteps).toHaveLength(1);
     const run = gateSteps[0].run as string;
-    expect(run).toContain(`node ${GUARD} --self-test`);
-    expect(run.split('\n').some((l) => l.trim() === `node ${GUARD}`)).toBe(true);
+    expect(run).toContain(`${uiRun(ALIAS)} --self-test`);
+    expect(run.split('\n').some((l) => l.trim() === uiRun(ALIAS))).toBe(true);
   });
 
-  it('one gate, one home — no other workflow runs the same script', () => {
-    const dir = path.join(ROOT, '.github/workflows');
-    const others = fs
-      .readdirSync(dir)
-      .filter((f) => f.endsWith('.yml') && f !== WORKFLOW)
-      .filter((f) => fs.readFileSync(path.join(dir, f), 'utf8').includes(GUARD));
+  it('one gate, one home — no other job or workflow runs the same script', () => {
+    const jobs = Object.entries(workflow.jobs as Record<string, { steps?: Array<Record<string, unknown>> }>)
+      .filter(([, job]) => (job.steps ?? []).some(runs))
+      .map(([key]) => key);
+    expect(jobs).toEqual([UI_JOBS.lint]);
+    const others = rootWorkflowFiles()
+      .filter((f) => f !== path.basename(rootCiPath))
+      .filter((f) => rootWorkflow(f).includes(ALIAS) || rootWorkflow(f).includes(GUARD));
     expect(others).toEqual([]);
   });
 
   it('has no paths filter — the defect it catches arrives in a docs-only pull request', () => {
     // `on` parses as the boolean `true` in YAML 1.1; `yaml` gives back `on`.
     const on = workflow.on ?? workflow[true as unknown as string];
     expect(Object.keys(on)).toContain('pull_request');
-    expect(on.pull_request).not.toHaveProperty('paths');
-    expect(on.pull_request).not.toHaveProperty('paths-ignore');
+    expect(on.pull_request ?? {}).not.toHaveProperty('paths');
+    expect(on.pull_request ?? {}).not.toHaveProperty('paths-ignore');
+    // The root job runs on the `filter` job's `ui` globs, so those globs are the
+    // path filter that matters, and a docs-only change under `ui/` must match.
+    const globs = uiFilterGlobs(rootCi());
+    const missed = ['content/docs/guide/ci-cd-pipeline.md', 'packages/core/README.md']
+      .map(repoPath)
+      .filter((file) => !globs.some((glob) => globMatches(glob, file)));
+    expect(missed, 'a docs-only change under ui/ would skip Lint UI').toEqual([]);
   });
 
   it('subscribes to the merge queue, so it cannot stall one if it becomes required', () => {
@@ -483,10 +516,11 @@ describe('check-doc-fence-languages is wired, not merely present', () => {
   });
 
   it('needs no install — no pnpm runs before this gate in its job', () => {
-    // Since objectui#12214 the home is `repo-gates.yml`, ONE job that installs
-    // after its install-free gates: the property is now an ORDER -- nothing
-    // before this gate's step runs `pnpm install` -- and no longer an absence.
-    const gateAt = steps.findIndex((s) => typeof s.run === 'string' && (s.run as string).includes(GUARD));
+    // Since objectui#12214 the home is ONE job that installs after its
+    // install-free gates (`repo-gates.yml` then, the root `lint-ui` now): the
+    // property is an ORDER -- nothing before this gate's step runs
+    // `pnpm install` -- and no longer an absence.
+    const gateAt = steps.findIndex(runs);
     expect(gateAt).toBeGreaterThan(-1);
     const before = steps
       .slice(0, gateAt)
@@ -561,7 +595,7 @@ describe('check-doc-fence-languages is wired, not merely present', () => {
    * number is written here that a document being added would falsify.
    */
   it('its header states the population and never counts it — no count can rot here', () => {
-    const header = headerComments(fs.readFileSync(path.join(ROOT, '.github/workflows', WORKFLOW), 'utf8'));
+    const header = headerComments(jobBlock(rootCi(), UI_JOBS.lint));
 
     // objectui#7901 — the floor first, or the assertion below is vacuous. The
     // count half cannot distinguish a header that carries no counts from a
 
@@ -25,6 +25,7 @@ import {
   listEmittedSources,
   scanEmittedTemplates,
 } from '../check-doc-snippet-types.mjs';
+import { jobBlock, rootCi, uiRun, UI_JOBS, withoutComments } from './helpers/root-ci';
 
 /**
  * objectui#7864 — the emitted-code census.
@@ -404,20 +405,31 @@ describe('on this repository — the walk is non-vacuous and reaches both known
   });
 });
 
+/**
+ * The home is the repository root's `ci.yml` now (objectstack#25712). GitHub
+ * runs only the root `.github/workflows/`, and objectstack#25902 ported
+ * objectui's `repo-gates.yml` into the root `lint-ui` job, which runs the
+ * census and the gate through the `check:doc-snippets` alias, after the build
+ * that serves them. The pins read that job by path, and the alias case ties the
+ * spelling to this script.
+ */
 describe('wiring — a census nothing runs is not a census', () => {
-  const workflow = fs.readFileSync(
-    path.join(repoRoot, '.github/workflows/repo-gates.yml'),
-    'utf8',
-  );
+  const workflow = withoutComments(jobBlock(rootCi(), UI_JOBS.lint));
+  const ALIAS = 'check:doc-snippets';
+
+  it('the alias the job runs is this script', () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
+    expect(pkg.scripts[ALIAS]).toBe(`node ${SCRIPT}`);
+  });
 
-  it('runs the census in the workflow that already builds this gate\'s closure', () => {
-    expect(workflow).toContain('--emit-census');
+  it('runs the census in the job that already builds this gate\'s closure', () => {
+    expect(workflow).toContain(`${uiRun(ALIAS)} --emit-census`);
   });
 
   it('runs it AFTER the build and BEFORE the blocking gate, so a red gate cannot hide the number', () => {
-    const build = workflow.indexOf('turbo run build');
-    const census = workflow.indexOf(`node ${SCRIPT} --emit-census`);
-    const gate = workflow.search(new RegExp(`run: node ${SCRIPT.replace(/[.\\/]/g, '\\$&')}\\s*$`, 'm'));
+    const build = workflow.indexOf('id: ui-gate-build');
+    const census = workflow.indexOf(`${uiRun(ALIAS)} --emit-census`);
+    const gate = workflow.search(new RegExp(`run: ${uiRun(ALIAS).replace(/[.\\/:-]/g, '\\$&')}\\s*$`, 'm'));
     expect(build).toBeGreaterThan(-1);
     expect(census).toBeGreaterThan(build);
     expect(
 
@@ -16,6 +16,7 @@ import {
   MEASURED_PAYLOAD,
   REGISTRAR,
 } from '../check-docs-route-eager-closure.mjs';
+import { globMatches, jobBlock, repoPath, rootCi, triggerBlock, uiFilterGlobs, uiRun, UI_JOBS, withoutComments } from './helpers/root-ci';
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 
@@ -368,31 +369,49 @@ describe('the real tree -- the properties that keep this gate from being decorat
   // teach readers to fix the test rather than the import.
 });
 
+/**
+ * The home is the repository root's `ci.yml` now (objectstack#25712). GitHub
+ * runs only the root `.github/workflows/`, and objectstack#25902 ported
+ * objectui's `repo-gates.yml`, this gate's old home, into the root `lint-ui`
+ * job, which spells it through its alias. Both pins read that job and the root
+ * triggers, by path.
+ */
 describe('wiring -- the gate is actually reachable and actually runs', () => {
   const pkg = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
-  const workflowPath = path.join(repoRoot, '.github/workflows/repo-gates.yml');
+  const ci = rootCi();
 
   it('is exposed as a root package script', () => {
     expect(pkg.scripts['check:docs-route-closure']).toBe(
       'node scripts/check-docs-route-eager-closure.mjs',
     );
   });
 
-  it('has a workflow that gates pull requests and reports on a queue build', () => {
-    expect(fs.existsSync(workflowPath), 'a check nothing runs is not a gate').toBe(true);
-    const workflow = fs.readFileSync(workflowPath, 'utf8');
-    expect(workflow).toMatch(/pull_request:/);
-    expect(workflow).toMatch(/merge_group:/);
-    expect(workflow).toContain('pnpm check:docs-route-closure');
+  it('the root Lint UI job runs it, on pull requests and on a queue build', () => {
+    expect(withoutComments(jobBlock(ci, UI_JOBS.lint)), 'a check nothing runs is not a gate').toContain(
+      `run: ${uiRun('check:docs-route-closure')}`,
+    );
+    const triggers = triggerBlock(ci);
+    expect(triggers).toMatch(/^ {2}pull_request:/m);
+    expect(triggers).toMatch(/^ {2}merge_group:/m);
   });
 
-  it('does NOT filter that workflow by path', () => {
+  it('is filtered by no path its inputs could miss', () => {
     // Its inputs are the whole route graph -- `packages/**`, `apps/site/**`,
-    // `content/docs/**` -- plus its own closure in `scripts/`. A filter listing
-    // all of that is indistinguishable from no filter, and a filter that misses
-    // one of them cannot be exercised by the PR that changes it (objectui#6321).
-    const workflow = fs.readFileSync(workflowPath, 'utf8');
-    expect(workflow).not.toMatch(/paths-ignore:/);
-    expect(workflow).not.toMatch(/^\s+paths:/m);
+    // `content/docs/**` -- plus its own closure in `scripts/`. A filter that
+    // misses one of them cannot be exercised by the PR that changes it
+    // (objectui#6321). The root ci.yml filters no paths at the trigger, and
+    // `lint-ui` runs on the `filter` job's `ui` globs, which must keep matching
+    // every one of those inputs under `ui/`.
+    expect(withoutComments(triggerBlock(ci))).not.toMatch(/^\s+paths(-ignore)?:/m);
+    const globs = uiFilterGlobs(ci);
+    const missed = [
+      'packages/core/src/index.ts',
+      'apps/site/source.config.ts',
+      'content/docs/guide/ci-cd-pipeline.md',
+      'scripts/check-docs-route-eager-closure.mjs',
+    ]
+      .map(repoPath)
+      .filter((file) => !globs.some((glob) => globMatches(glob, file)));
+    expect(missed, 'a change to one of these inputs would skip Lint UI').toEqual([]);
   });
 });
@@ -764,6 +764,16 @@ export const ADJUDICATED = new Map([
       notRead: ['.changeset/README.md', 'CHANGELOG.md', 'README.md', 'apps/console/README.md'],
     },
   ],
+  // Reads no markdown: its three markdown literals are probes of the root `ci.yml`
+  // `ui` filter's globs, asserting a markdown-only change still starts Lint UI
+  // (objectstack#25712). The gate's own corpus is reached through the script.
+  [
+    'scripts/__tests__/check-control-bytes.test.ts',
+    {
+      reads: [],
+      notRead: ['README.md', 'content/docs/guide/ci-cd-pipeline.md', 'packages/core/README.md'],
+    },
+  ],
   [
     'scripts/__tests__/check-doc-component-types.test.ts',
     {
@@ -811,9 +821,11 @@ export const ADJUDICATED = new Map([
   [
     'scripts/__tests__/check-doc-fence-languages.test.ts',
     {
+      // `packages/core/README.md` is a probe of the root `ci.yml` `ui` filter's
+      // globs, not a read (objectstack#25712). The test's only directory walk was
+      // of objectui's own `.github/workflows`, which it no longer reads.
       reads: ['apps/console/docs/**', 'content/docs/**', 'docs/**'],
-      notRead: ['README.md'],
-      walker: 'markdown-tree',
+      notRead: ['README.md', 'packages/core/README.md'],
     },
   ],
   [
@@ -859,6 +871,16 @@ export const ADJUDICATED = new Map([
       walker: 'markdown-tree',
     },
   ],
+  // Reads no markdown: its one markdown literal is a probe of the root `ci.yml`
+  // `ui` filter's globs, asserting a docs-only change still starts Lint UI
+  // (objectstack#25712).
+  [
+    'scripts/__tests__/check-docs-route-eager-closure.test.ts',
+    {
+      reads: [],
+      notRead: ['content/docs/guide/ci-cd-pipeline.md'],
+    },
+  ],
   // Reads no markdown: the root-document literals are fixture INPUTS to a pure path classifier.
   [
     'scripts/__tests__/check-governed-queue-guard.test.ts',