@@ -22,7 +22,12 @@
 //      exported: the pin script packs whole packages and refuses one whose
 //      `types` entry is missing, and a typeless tree did exactly that (consumer
 //      pointer on objectstack#24306, measured again on this branch);
-//   5. stop on the pin script's refusal, before the install.
+//   5. stop on the pin script's refusal, before the install;
+//   6. first build objectui's OWN pin (the pin script with no OBJECTSTACK_ROOT
+//      and no OS_SKIP_DTS) and keep that cache, its stamp included, outside the
+//      one the stand-in replaces: once this tree stands in, objectui's install
+//      is this tree, so only that build can be the injection assertion's
+//      reference. A rerun reuses it while its stamp names the pin.
 //
 // ## How it runs: the real script, a fake world
 //
@@ -60,10 +65,17 @@ if [[ "\${1:-}" == "install" ]]; then exit 42; fi
 exit 0
 `;
 
-/** A pin script that HAS the input: it reads OBJECTSTACK_ROOT and records it. */
+/** A pin script that HAS the input: it records OBJECTSTACK_ROOT and leaves the
+ *  cache the real one does, its stamp at the root, unless told to refuse. */
 const PIN_WITH_HOOK = `import fs from 'node:fs';
-fs.appendFileSync(process.env.SHIM_LOG, 'pin ' + process.argv.slice(2).join(' ') + ' | OBJECTSTACK_ROOT=' + (process.env.OBJECTSTACK_ROOT ?? 'unset') + ' | cwd=' + process.cwd() + '\\n');
-process.exit(Number(process.env.FAKE_PIN_EXIT ?? '0'));
+const root = process.env.OBJECTSTACK_ROOT;
+fs.appendFileSync(process.env.SHIM_LOG, 'pin ' + process.argv.slice(2).join(' ') + ' | OBJECTSTACK_ROOT=' + (root ?? 'unset') + ' | OS_SKIP_DTS=' + (process.env.OS_SKIP_DTS ?? 'unset') + ' | cwd=' + process.cwd() + '\\n');
+if (process.env.FAKE_PIN_EXIT) process.exit(Number(process.env.FAKE_PIN_EXIT));
+const cache = 'node_modules/.cache/objectstack';
+fs.rmSync(cache, { recursive: true, force: true });
+fs.mkdirSync(cache + '/spec', { recursive: true });
+const sha = fs.readFileSync('.objectstack-sha', 'utf8').trim();
+fs.writeFileSync(cache + '/.stamp.json', JSON.stringify(root ? { source: 'external', root } : { source: 'pin', sha }));
 `;
 
 /** A pin script from before the input existed: it builds its own pin, always. */
@@ -158,6 +170,8 @@ function buildConsole(pin: string, env: Record<string, string> = {}): Run {
 }
 
 const closureBuilds = (log: string[]) => log.filter((l) => l.startsWith('pnpm exec turbo run build'));
+const pinBuilds = (log: string[]) => log.filter((l) => l.startsWith('pin build'));
+const reference = (pin: string) => path.join(FW, '.cache', `objectui-${pin.slice(0, 12)}`, 'node_modules/.cache/objectstack-pin-reference');
 const installs = (log: string[]) => log.filter((l) => l.startsWith('pnpm install'));
 
 describe('build-console.sh: the .objectstack-sha branch', () => {
@@ -181,13 +195,25 @@ describe('build-console.sh: the .objectstack-sha branch', () => {
     expect(run.status, run.output).toBe(42);
     expect(run.log).toEqual([
       'pnpm exec turbo run build --filter=@objectstack/client --filter=@objectstack/spec --output-logs=new-only | OS_SKIP_DTS=unset',
-      `pin build | OBJECTSTACK_ROOT=${FW} | cwd=${run.buildRoot}`,
+      `pin build | OBJECTSTACK_ROOT=unset | OS_SKIP_DTS=unset | cwd=${run.buildRoot}`,
+      `pin build | OBJECTSTACK_ROOT=${FW} | OS_SKIP_DTS=unset | cwd=${run.buildRoot}`,
       'pnpm install --frozen-lockfile --prefer-offline --config.production=false | OS_SKIP_DTS=unset',
     ]);
+    // The pin's own cache survived the stand-in that replaced it: the reference.
+    expect(JSON.parse(fs.readFileSync(path.join(reference(HOOK_PIN), '.stamp.json'), 'utf8'))).toEqual({ source: 'pin', sha: 'a'.repeat(40) });
+    expect(fs.existsSync(path.join(reference(HOOK_PIN), 'spec'))).toBe(true);
+  });
+
+  it("a rerun reuses the reference while its stamp names the pin, and rebuilds it when it does not", () => {
+    expect(pinBuilds(buildConsole(HOOK_PIN).log)).toEqual([expect.stringContaining(`OBJECTSTACK_ROOT=${FW}`)]);
+    fs.writeFileSync(path.join(reference(HOOK_PIN), '.stamp.json'), JSON.stringify({ source: 'pin', sha: 'b'.repeat(40) }));
+    expect(pinBuilds(buildConsole(HOOK_PIN).log)).toHaveLength(2);
   });
 
   it('an inherited OS_SKIP_DTS does not reach the closure build, and the script says so', () => {
+    fs.rmSync(reference(HOOK_PIN), { recursive: true, force: true });
     const run = buildConsole(HOOK_PIN, { OS_SKIP_DTS: '1' });
+    expect(pinBuilds(run.log)[0]).toContain('OBJECTSTACK_ROOT=unset | OS_SKIP_DTS=unset');
     expect(run.status, run.output).toBe(42);
     expect(closureBuilds(run.log)).toEqual([
       'pnpm exec turbo run build --filter=@objectstack/client --filter=@objectstack/spec --output-logs=new-only | OS_SKIP_DTS=unset',
 
@@ -16,7 +16,9 @@
 //
 //   injected = this framework tree's packages/spec  (what must be bundled)
 //   vendored = the @objectstack/spec objectui's own lockfile installed
-//              (what gets bundled when the injection is missing or broken)
+//              (what gets bundled when the injection is missing or broken);
+//              on a pin carrying `.objectstack-sha`, objectui's own build of
+//              that commit — see readPinnedReference for why only that one
 //
 // ## The test is two-sided, because one side is not enough
 //
@@ -73,8 +75,9 @@
 //     --assets   <built console dist/assets>
 //
 // Exit: 0 = injection proven (or no skew to prove) · 1 = injection failed
-//       2 = inconclusive / cannot run
+//       2 = inconclusive / cannot run (including a reference that is this tree)
 
+import fs from 'node:fs';
 import path from 'node:path';
 
 import {
@@ -107,6 +110,50 @@ function parseArgs(argv) {
 
 const args = parseArgs(process.argv);
 
+/**
+ * The objectstack commit --vendored was built at, when objectui pins one; null otherwise.
+ *
+ * A pin carrying `.objectstack-sha` installs @objectstack/* by commit, and
+ * build-console.sh stands THIS tree in for that commit, so the spec objectui's
+ * install holds is this tree's own, packed. As --vendored it equals --injected:
+ * both pools are empty, the no-skew branch below passes, and the stamp records no
+ * witness for ANY bundle. What a broken pack-or-inject ships there is objectui's
+ * own build of the pinned commit, so that build is the only reference taken on
+ * such a pin. It is known by the stamp objectui's scripts/objectstack-pin.mjs
+ * writes at the root of the cache it packed into (`<cache>/.stamp.json` beside
+ * `<cache>/spec`): `source: 'pin'`, `sha` equal to the pin. A stand-in, a copy
+ * with no such stamp (the install's node_modules/@objectstack/spec) or a build of
+ * another commit is refused as cannot-judge, never read as "no skew".
+ */
+function readPinnedReference(objectuiDir, vendoredDir) {
+  const pinFile = path.join(objectuiDir, '.objectstack-sha');
+  if (!fs.existsSync(pinFile)) return null;
+  const pin = fs.readFileSync(pinFile, 'utf8').trim();
+  const stampFile = path.join(path.dirname(vendoredDir), '.stamp.json');
+  let stamp = null;
+  try {
+    stamp = JSON.parse(fs.readFileSync(stampFile, 'utf8'));
+  } catch {
+    // No readable stamp is refused below, with the rest.
+  }
+  if (stamp?.source !== 'pin' || stamp?.sha !== pin) {
+    const found = stamp ? `source ${JSON.stringify(stamp.source)} at ${String(stamp.sha).slice(0, 12)}` : 'no readable stamp';
+    fail(
+      `objectui pins objectstack ${pin.slice(0, 12)} (.objectstack-sha), so --vendored must be objectui's own\n` +
+        `  build of that commit, and \`${stampFile}\` says ${found}. On this pin objectui's install is\n` +
+        "  this tree (the OBJECTSTACK_ROOT stand-in), and judged against itself this check would pass any\n" +
+        "  bundle. build-console.sh keeps that build before standing this tree in; pass its spec.",
+    );
+  }
+  return pin;
+}
+
+const vendoredPin = readPinnedReference(path.resolve(args.objectui), path.resolve(args.vendored));
+const vendoredName = vendoredPin
+  ? `@objectstack/spec of objectui's own build of objectstack ${vendoredPin.slice(0, 12)}`
+  : 'PUBLISHED @objectstack/spec';
+const vendoredOnly = vendoredPin ? 'pin-only' : 'published-only';
+
 const assetsDir = path.resolve(args.assets);
 // The dist root is the assets dir's parent: build-console.sh passes
 // `<dist>/assets`, so this is where the .objectui-sha stamp already lives.
@@ -162,6 +209,8 @@ function stamp(skew) {
       {
         name: '@objectstack/spec',
         injectedFrom: path.resolve(args.injected),
+        vendoredFrom: path.resolve(args.vendored),
+        vendoredPin,
         skew,
         freshWitness,
         staleDetector,
@@ -175,8 +224,11 @@ function stamp(skew) {
   }
 }
 
+// With a pinned reference this is the honest case, never the vacuous one: an
+// independently built spec of the pinned commit declares the same descriptions as
+// this tree's, so a bundle carrying either carries the same text.
 if (freshCounts.pool === 0 && staleCounts.pool === 0) {
-  console.log('✓ Injected and vendored @objectstack/spec declare the same descriptions');
+  console.log(`✓ Injected and vendored @objectstack/spec declare the same descriptions${vendoredPin ? ` (vendored: ${vendoredName})` : ''}`);
   console.log('  — no observable skew, so nothing for this check to assert.');
   stamp(false);
   process.exit(0);
@@ -193,7 +245,7 @@ if (staleCounts.pool > 0 && staleDetector === null) {
   console.error("  it could look for is in the bundle, and objectui's own source at the pin carries");
   console.error('  each one too, so none can tell the published spec from objectui\'s own text.');
   console.error('  The injection is UNVERIFIED by this check.');
-  console.error(`    published-only descriptions: ${staleCounts.pool}, all of them carried by objectui's source`);
+  console.error(`    ${vendoredOnly} descriptions: ${staleCounts.pool}, all of them carried by objectui's source`);
   console.error(`    first of them: "${staleHostCarried[0]}"`);
   process.exit(2);
 }
@@ -204,19 +256,19 @@ if (freshPresent !== true && stalePresent !== true) {
   console.error('✗ Neither spec appears in the built console — no @objectstack/spec');
   console.error('  content matched. The injection is UNVERIFIED by this check.');
   console.error(`    injected-only descriptions in the bundle: ${freshCounts.inBundle} of ${freshCounts.pool}`);
-  console.error(`    published-only descriptions in the bundle: ${staleCounts.inBundle} of ${staleCounts.pool}`);
+  console.error(`    ${vendoredOnly} descriptions in the bundle: ${staleCounts.inBundle} of ${staleCounts.pool}`);
   for (const line of [...freshNote('    '), ...staleNote('    ')]) console.error(line);
   process.exit(2);
 }
 
 if (stalePresent === true) {
-  console.error("✗ Built console still carries the PUBLISHED @objectstack/spec.");
-  console.error('  The console resolved spec from objectui\'s lockfile, so any authorable');
-  console.error('  key this framework declared after the last spec publish is unreachable');
+  console.error(`✗ Built console still carries the ${vendoredName}.`);
+  console.error(`  The console resolved spec from objectui's ${vendoredPin ? 'own pin' : 'lockfile'}, so any authorable`);
+  console.error(`  key this framework declared after ${vendoredPin ? 'that commit' : 'the last spec publish'} is unreachable`);
   console.error('  in the Studio designer — the defect objectstack#8134 exists to end.');
   console.error('');
   console.error(`  Text found in the bundle that ONLY the vendored spec has (${staleCounts.inBundle} of`);
-  console.error(`  ${staleCounts.pool} published-only descriptions), the first of them:`);
+  console.error(`  ${staleCounts.pool} ${vendoredOnly} descriptions), the first of them:`);
   console.error(`    "${staleDetector}"`);
   if (staleCounts.hostCarried > 0) {
     console.error('');
@@ -241,16 +293,16 @@ if (freshPresent !== true) {
   process.exit(2);
 }
 
-console.log("✓ Console bundle carries THIS tree's @objectstack/spec, and only it.");
+console.log(`✓ Console bundle carries THIS tree's @objectstack/spec, and only it${vendoredPin ? ` (vendored: ${vendoredName})` : ''}.`);
 console.log(`    present (injected only): "${freshWitness}"`);
 console.log(`      — ${freshCounts.inBundle} of ${freshCounts.pool} injected-only descriptions are in the bundle`);
 for (const line of freshNote('        ')) console.log(line);
 if (staleDetector) {
   console.log(`    absent  (vendored only): "${staleDetector}"`);
   if (staleCounts.hostCarried === 0) {
-    console.log(`      — and all ${staleCounts.pool} published-only descriptions are absent`);
+    console.log(`      — and all ${staleCounts.pool} ${vendoredOnly} descriptions are absent`);
   } else {
-    console.log(`      — and ${staleCounts.pool - staleCounts.hostCarried} of ${staleCounts.pool} published-only descriptions are absent;`);
+    console.log(`      — and ${staleCounts.pool - staleCounts.hostCarried} of ${staleCounts.pool} ${vendoredOnly} descriptions are absent;`);
     for (const line of staleNote('        ')) console.log(line);
   }
 }
 
@@ -338,6 +338,10 @@ echo "→ Console will bundle @objectstack/spec from ${SPEC_PKG}"
 # exactly as before. A pin with it but without the hook refuses, like the two
 # vite.config.ts guards above, rather than letting objectui build its own pin.
 OBJECTSTACK_PIN_SCRIPT="${BUILD_ROOT}/scripts/objectstack-pin.mjs"
+# The spec the injection assertion at the end judges the bundle against: objectui's
+# own install, on a pin without `.objectstack-sha` (the block below says what
+# replaces it on a pin with one).
+VENDORED_SPEC="${BUILD_ROOT}/node_modules/@objectstack/spec"
 if [[ -f "${BUILD_ROOT}/.objectstack-sha" ]]; then
   if [[ ! -f "$OBJECTSTACK_PIN_SCRIPT" ]] || ! grep -q "OBJECTSTACK_ROOT" "$OBJECTSTACK_PIN_SCRIPT"; then
     echo "✗ objectui@${PINNED_SHA:0:12} carries .objectstack-sha but has no OBJECTSTACK_ROOT hook in"
@@ -383,6 +387,29 @@ if [[ -f "${BUILD_ROOT}/.objectstack-sha" ]]; then
     (cd "$FRAMEWORK_ROOT" && unset OS_SKIP_DTS && pnpm exec turbo run build "${OBJECTSTACK_TURBO_FILTERS[@]}" --output-logs=new-only)
   fi
 
+  # The REFERENCE for the injection assertion. Once this tree stands in below,
+  # objectui's install IS this tree, so its spec equals --injected and the
+  # assertion would pass any bundle with no witness. What a broken pack-or-inject
+  # ships here is objectui's own build of the commit its .objectstack-sha names, so
+  # build that first by objectui's own recipe (the pin script without
+  # OBJECTSTACK_ROOT, declarations included as it requires) and keep a copy, the
+  # pin's .stamp.json with it, outside the cache the stand-in replaces. The
+  # assertion refuses any other reference on such a pin. Reused while its stamp
+  # names this pin: the build of a fixed commit does not change.
+  OBJECTSTACK_PIN_SHA="$(tr -d '[:space:]' < "${BUILD_ROOT}/.objectstack-sha")"
+  PIN_REFERENCE="${BUILD_ROOT}/node_modules/.cache/objectstack-pin-reference"
+  REFERENCE_SHA="$(node -e '
+    try { const s = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8")); if (s.source === "pin") process.stdout.write(String(s.sha)); } catch {}
+  ' "${PIN_REFERENCE}/.stamp.json")"
+  if [[ "$REFERENCE_SHA" != "$OBJECTSTACK_PIN_SHA" ]]; then
+    echo "→ Building objectui's own @objectstack/* at its .objectstack-sha ${OBJECTSTACK_PIN_SHA:0:12}, the reference the spec assertion judges this bundle against..."
+    (cd "$BUILD_ROOT" && env -u OBJECTSTACK_ROOT -u OS_SKIP_DTS node scripts/objectstack-pin.mjs build)
+    rm -rf "$PIN_REFERENCE" "${PIN_REFERENCE}.partial"
+    cp -R "${BUILD_ROOT}/node_modules/.cache/objectstack" "${PIN_REFERENCE}.partial"
+    mv "${PIN_REFERENCE}.partial" "$PIN_REFERENCE"
+  fi
+  VENDORED_SPEC="${PIN_REFERENCE}/spec"
+
   # The pin script refuses (exit 1, reason on stderr) on a missing entry point,
   # and on two dependency mismatches between these packages and objectui's pin:
   # a packed manifest whose dependency NAMES differ from what objectui's lockfile
@@ -484,11 +511,11 @@ fi
 # --objectui is the checkout just built: objectui's own registry mirrors spec
 # descriptions, so text its tracked source carries is not evidence of either spec.
 # On a pin that installs @objectstack/* from this tree (the OBJECTSTACK_ROOT block
-# above), --vendored IS this tree's spec, packed: the script then reports no
-# skew, because objectui's install no longer holds a published spec to leak.
+# above), objectui's install is this tree's spec, packed, so --vendored is the
+# reference that block kept instead: objectui's own build of its .objectstack-sha.
 node "${FRAMEWORK_ROOT}/scripts/assert-console-spec-injection.mjs" \
   --injected "$SPEC_PKG" \
-  --vendored "${BUILD_ROOT}/node_modules/@objectstack/spec" \
+  --vendored "$VENDORED_SPEC" \
   --objectui "$BUILD_ROOT" \
   --assets "${TARGET}/assets"