@@ -10,6 +10,6 @@ Metadata-protocol: none
 
 - **The package.** `@objectstack/console` ships the same `dist/` it shipped at 18.1.0: the built Console (`index.html`, `assets/`, the manifests it served). Two files leave the tarball: `dist/.objectui-sha`, which named the objectui commit the Console was built from, and `dist/.objectstack-injection.json`, which recorded the spec and client dists injected into that build. Both described a pin that no longer exists: the Console is built from the `ui/` tree of the same commit as the framework, so its version is the framework's version.
 - **The CLI.** When a framework checkout has no built Console, `objectstack serve` / `objectstack dev` and the 503 at `/_console/` now name `pnpm console:build`, which builds `ui/apps/console` and copies its dist into `packages/console`. The remedy used to be `pnpm objectui:build`, which cloned objectui at the pinned commit.
-- **One version.** The `@object-ui/*` packages join the `@objectstack/*` fixed group, so every public package of both scopes publishes at one version.
+- **One version.** The `@object-ui/*` packages and the private VS Code extension join the `@objectstack/*` fixed group, so every public package of both scopes publishes at one version and the extension ships at it.
 
 What to do: nothing as a consumer; install `@objectstack/console` as before. In a framework checkout, run `pnpm console:build` where you ran `pnpm objectui:build`.
@@ -119,7 +119,8 @@
       "@object-ui/react-runtime",
       "@object-ui/runner",
       "@object-ui/sdui-parser",
-      "@object-ui/types"
+      "@object-ui/types",
+      "object-ui"
     ]
   ],
   "linked": [],
 
@@ -9,7 +9,11 @@
  * Exits with code 1 (and a clear diff) if:
  *   - A public (non-private) workspace package is missing from the
  *     `fixed` group in .changeset/config.json
- *   - A name listed in the `fixed` group no longer exists in the workspace
+ *   - A name listed in the `fixed` group no longer exists in the workspace,
+ *     or names a private package that `PRIVATE_FIXED_MEMBERS` does not declare
+ *   - A declared private member is missing from the group, is not a private
+ *     workspace package, or sits there while `privatePackages.version` is not
+ *     true (Changesets would then leave it unversioned inside a lockstep group)
  *
  * The script intentionally has zero third-party dependencies so it can run
  * in minimal CI environments before `pnpm install`. The workspace walk comes
@@ -20,11 +24,32 @@
 import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 import { workspacePackages } from './workspace-enumerator.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = resolve(__dirname, '..');
 
+/**
+ * Private workspace packages that belong in the `fixed` group anyway, each with
+ * the reason it is there. Every other name in the group must be public.
+ *
+ * `object-ui` is the VS Code extension (`ui/packages/vscode-extension`). It is
+ * never published to npm, but it ships at the release's version: Tesla's ruling
+ * of 2026-10-25 (decision 17b, ruling B, objectstack#25711) keeps it in the one
+ * version group 「同一个版本号组」 the objectui merge created, as objectui's own
+ * group had. A private package outside this list is still refused in the group,
+ * so a package marked private by mistake cannot hide in it.
+ *
+ * Readers that count "published packages" (`check-lockstep-package-count.mjs`)
+ * subtract these names.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+export const PRIVATE_FIXED_MEMBERS = Object.freeze({
+  'object-ui': 'the VS Code extension: never on npm, versioned with the release (decision 17b, objectstack#25711)',
+});
+
 /**
  * Names of all non-private workspace packages.
  *
@@ -43,35 +68,60 @@ const repoRoot = resolve(__dirname, '..');
  *
  * @returns {string[]}
  */
-function listPublicPackageNames() {
-  const names = new Set();
+function listPackageNames() {
+  const publicNames = new Set();
+  const privateNames = new Set();
   for (const { manifest } of workspacePackages(repoRoot)) {
-    if (!manifest.name || manifest.private === true) continue;
-    names.add(manifest.name);
+    if (!manifest.name) continue;
+    (manifest.private === true ? privateNames : publicNames).add(manifest.name);
   }
-  return [...names].sort();
+  return { publicNames: [...publicNames].sort(), privateNames };
 }
 
-function readFixedGroups() {
+function readConfig() {
   const configPath = resolve(repoRoot, '.changeset/config.json');
-  const config = JSON.parse(readFileSync(configPath, 'utf8'));
-  if (!Array.isArray(config.fixed)) return [];
-  return config.fixed;
+  return JSON.parse(readFileSync(configPath, 'utf8'));
 }
 
-function main() {
-  const publicPackages = listPublicPackageNames();
-  const fixedGroups = readFixedGroups();
-  const fixed = new Set(fixedGroups.flat());
+/**
+ * Judges a config against the workspace. Pure, so the declared-private rules
+ * can be read without a tree.
+ *
+ * @param {{ fixed?: string[][]; privatePackages?: { version?: boolean } }} config
+ * @param {{ publicNames: string[]; privateNames: Set<string> }} packages
+ * @param {Readonly<Record<string, string>>} [declared]
+ */
+export function judge(config, { publicNames, privateNames }, declared = PRIVATE_FIXED_MEMBERS) {
+  const fixed = new Set(Array.isArray(config.fixed) ? config.fixed.flat() : []);
+  const isDeclaredPrivate = (name) => Object.hasOwn(declared, name) && privateNames.has(name);
+
+  const missing = publicNames.filter((name) => !fixed.has(name));
+  const stale = [...fixed].filter((name) => !publicNames.includes(name) && !isDeclaredPrivate(name)).sort();
+  const declaredProblems = [];
+  for (const name of Object.keys(declared).sort()) {
+    if (publicNames.includes(name)) {
+      declaredProblems.push(`${name} is declared a private member but its manifest is public; drop it from PRIVATE_FIXED_MEMBERS`);
+    } else if (!privateNames.has(name)) {
+      // No such package in this tree: `stale` already names it when the group does.
+      continue;
+    } else if (!fixed.has(name)) {
+      declaredProblems.push(`${name} (${declared[name]}) is missing from "fixed"`);
+    } else if (config.privatePackages?.version !== true) {
+      declaredProblems.push(`${name} sits in "fixed" while privatePackages.version is not true, so Changesets would not version it`);
+    }
+  }
+  return { missing, stale, declaredProblems };
+}
 
-  const missing = publicPackages.filter((name) => !fixed.has(name));
-  const stale = [...fixed]
-    .filter((name) => !publicPackages.includes(name))
-    .sort();
+function main() {
+  const packages = listPackageNames();
+  const { missing, stale, declaredProblems } = judge(readConfig(), packages);
 
-  if (missing.length === 0 && stale.length === 0) {
+  if (missing.length === 0 && stale.length === 0 && declaredProblems.length === 0) {
+    const privateCount = Object.keys(PRIVATE_FIXED_MEMBERS).filter((name) => packages.privateNames.has(name)).length;
     console.log(
-      `✓ .changeset/config.json "fixed" group is in sync with ${publicPackages.length} public workspace packages.`,
+      `✓ .changeset/config.json "fixed" group is in sync with ${packages.publicNames.length} public workspace packages` +
+        (privateCount > 0 ? ` and ${privateCount} declared private member(s).` : '.'),
     );
     return;
   }
@@ -85,15 +135,18 @@ function main() {
   }
   if (stale.length > 0) {
     console.error(
-      '\nNames in "fixed" that no longer exist in the workspace (remove them):',
+      '\nNames in "fixed" that are no public workspace package and no declared private member (remove them, or declare a private one in PRIVATE_FIXED_MEMBERS):',
     );
     for (const name of stale) console.error(`  - ${name}`);
   }
+  if (declaredProblems.length > 0) {
+    console.error('\nDeclared private members (PRIVATE_FIXED_MEMBERS):');
+    for (const problem of declaredProblems) console.error(`  - ${problem}`);
+  }
   console.error(
     '\nEdit .changeset/config.json so the "fixed" group matches the public workspace, then re-run this script.',
   );
   process.exit(1);
 }
 
-main();
-
+if (isEntrypoint(import.meta.url)) main();
@@ -68,18 +68,25 @@ import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'nod
 import * as os from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PRIVATE_FIXED_MEMBERS } from './check-changeset-fixed.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = resolve(__dirname, '..');
 
-/** Reads the one true count: the length of the lockstep `fixed` group. */
-function trueCount(root) {
+/**
+ * Reads the one true count: the length of the lockstep `fixed` group, less the
+ * private members `check-changeset-fixed.mjs` declares (`PRIVATE_FIXED_MEMBERS`,
+ * the VS Code extension since objectstack#25711). Every prose occurrence counts
+ * PUBLISHED packages, and those members ship at the release's version without
+ * ever reaching npm.
+ */
+function trueCount(root, privateMembers = PRIVATE_FIXED_MEMBERS) {
   const configPath = resolve(root, '.changeset/config.json');
   const config = JSON.parse(readFileSync(configPath, 'utf8'));
   if (!Array.isArray(config.fixed) || !Array.isArray(config.fixed[0])) {
     throw new Error(`${configPath}: "fixed" is not an array containing a group array`);
   }
-  return config.fixed[0].length;
+  return config.fixed[0].filter((name) => !Object.hasOwn(privateMembers, name)).length;
 }
 
 // Every prose restatement of the lockstep package count, as of #17039. Each
@@ -150,7 +157,7 @@ function run(root, { fix = false } = {}) {
 
 function formatReport({ truth, results }) {
   const lines = [
-    `lockstep package count (source: .changeset/config.json fixed[0].length) = ${truth}`,
+    `lockstep package count (source: .changeset/config.json fixed[0].length, less the declared private members) = ${truth}`,
   ];
   for (const r of results) {
     if (r.status === 'OK') {
@@ -268,6 +275,16 @@ function selfTest() {
       'duplicated anchor: reported as ROTTED_ANCHOR with matchCount 2',
       dupedRows.every((r) => r.status === 'ROTTED_ANCHOR' && r.matchCount === 2),
     );
+
+    // Case 5: a declared private member sits in the group but is not counted
+    // (objectstack#25711); an undeclared name is counted like any other.
+    write(
+      join(tmp, '.changeset', 'config.json'),
+      JSON.stringify({ fixed: [['@objectstack/pkg-0', '@objectstack/pkg-1', 'private-ext']] }),
+    );
+    t('declared private member: not counted', trueCount(tmp, { 'private-ext': 'fixture' }) === 2);
+    t('the same name undeclared: counted', trueCount(tmp, {}) === 3);
+    t('the real declaration is what the gate subtracts by default', trueCount(tmp) === 3);
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }
 
@@ -36,7 +36,8 @@
  * .changeset/config.json enumerates the same 112 names, but it is a DERIVED
  * declaration validated against the workspace by scripts/check-changeset-fixed.mjs
  * (which reddens both when a public package is missing from the group and
- * when a group name no longer exists) — deriving from the group would mean
+ * when a group name no longer exists), and it also holds the private members
+ * that gate declares, which are never packed here — deriving from the group would mean
  * reading a copy that a gate keeps honest, rather than the thing itself.
  */