@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -22,12 +22,14 @@ import {
   emittedSources,
   esmEntryOf,
   importEntry,
+  main,
   readTsconfig,
   relativeSpecifiers,
   resolvesToModule,
   scanSpecifiers,
 } from '../check-node-esm-load.mjs';
 import { SKIP_DIRS, discoverPackages } from '../check-phantom-dependencies.mjs';
+import { workspaceRoot } from '../workspace-root.mjs';
 
 /**
  * objectui#4538 — a published entry plain Node ESM cannot load.
@@ -832,3 +834,34 @@ describe('objectui#7276 — the load leg grades only what this tree produced', (
     }
   });
 });
+
+/**
+ * objectstack#26860 — the build mode runs the release's build, where the release runs it.
+ *
+ * The gate's full mode ran `pnpm build` from `ui/`, whose manifest has no
+ * `build` script, so a maintainer running the alias by hand got pnpm's exit 254
+ * and no reading. It now asks for the published-dist gate's `buildWorkspace`
+ * (the workspace root's `build` script, from the workspace root — pinned over
+ * there against what `pnpm run release` runs), so both gates read one build.
+ */
+describe('objectstack#26860 — the load leg is graded over the release build', () => {
+  it('asks for the release build at the workspace root, with --force-build as turbo --force', () => {
+    const calls: Array<{ workspace: string; force: unknown }> = [];
+    const quiet = [
+      vi.spyOn(console, 'log').mockImplementation(() => {}),
+      vi.spyOn(console, 'error').mockImplementation(() => {}),
+    ];
+    try {
+      const exit = main(['--force-build'], {
+        build: (workspace: string, options?: { force?: boolean }) => {
+          calls.push({ workspace, force: options?.force });
+          throw new Error('stop before grading: this case reads only which build was asked for');
+        },
+      });
+      expect(exit).toBe(1);
+    } finally {
+      for (const spy of quiet) spy.mockRestore();
+    }
+    expect(calls).toEqual([{ workspace: workspaceRoot(REPO_ROOT), force: true }]);
+  });
+});
@@ -20,6 +20,7 @@ import {
   toolingConventionFrom,
 } from '../check-published-dist-tooling.mjs';
 import { jobBlock, rootCi, rootWorkflow, rootWorkflowFiles, uiRun, withoutComments } from './helpers/root-ci';
+import { rootManifest, workspaceRoot } from '../workspace-root.mjs';
 
 /**
  * objectui#4846 — no published package's build output may carry tooling material.
@@ -359,41 +360,79 @@ describe('analyze', () => {
 // ── 4. a build that fails is a failure ───────────────────────────────────────
 
 describe('buildWorkspace', () => {
-  it('runs the repository build and reports how long it took', () => {
+  /** A scratch workspace root whose manifest declares the given scripts. */
+  const workspaceWith = (scripts: Record<string, string>) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'published-dist-build-'));
+    fixtures.push(root);
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'fixture-root', scripts }));
+    return root;
+  };
+
+  it("runs the workspace root's `build` script, from the workspace root, and reports how long it took", () => {
+    // objectstack#26860: the gate used to run `turbo run build` from `ui/`,
+    // 128 tasks including the docs app, which is not the build that publishes.
+    const root = workspaceWith({ build: 'turbo run build' });
     const calls: unknown[][] = [];
-    const seconds = buildWorkspace('/repo', {
+    const seconds = buildWorkspace(root, {
       exec: (...args: unknown[]) => {
         calls.push(args);
       },
     });
     expect(typeof seconds).toBe('number');
     expect(calls).toHaveLength(1);
     expect(calls[0][0]).toBe('pnpm');
-    expect(calls[0][1]).toEqual(['exec', 'turbo', 'run', 'build', '--filter=!@object-ui/site']);
+    expect(calls[0][1]).toEqual(['build']);
+    expect((calls[0][2] as { cwd: string }).cwd).toBe(root);
   });
 
   it('forwards --concurrency and --force when asked', () => {
     const calls: unknown[][] = [];
-    buildWorkspace('/repo', {
+    buildWorkspace(workspaceWith({ build: 'turbo run build' }), {
       concurrency: 2,
       force: true,
       exec: (...args: unknown[]) => {
         calls.push(args);
       },
     });
-    expect(calls[0][1]).toContain('--concurrency=2');
-    expect(calls[0][1]).toContain('--force');
+    expect(calls[0][1]).toEqual(['build', '--concurrency=2', '--force']);
+  });
+
+  it('refuses, naming the manifest, when the workspace root declares no `build` script', () => {
+    // The defect objectstack#26860 was filed from: `check:node-esm-load` ran a
+    // `build` script `ui/package.json` does not have, and pnpm's exit 254 was
+    // the whole diagnosis.
+    const root = workspaceWith({ test: 'vitest' });
+    const exec = () => {
+      throw new Error('must not run');
+    };
+    expect(() => buildWorkspace(root, { exec })).toThrow(/declares no `build` script/);
+    expect(() => buildWorkspace(root, { exec })).toThrow(new RegExp(`${root}/package\\.json`));
   });
 
   it('throws — never returns — when the build fails', () => {
     expect(() =>
-      buildWorkspace('/repo', {
+      buildWorkspace(workspaceWith({ build: 'turbo run build' }), {
         exec: () => {
           throw new Error('turbo exited 1');
         },
       }),
     ).toThrow(/nothing trustworthy to inspect/);
   });
+
+  it("is the release's build: the workspace root's `build` script, which `pnpm run release` opens with", () => {
+    // What the publish path runs before `scripts/release-publish.sh` reads the
+    // artifacts with `--no-build`. If the release ever builds something else,
+    // this gate's build mode no longer reads what publishes, and this goes red.
+    // `repoRoot` in this file is the objectui root, `ui/` under the monorepo.
+    const workspace = workspaceRoot(repoRoot);
+    const scripts = rootManifest(repoRoot).scripts as Record<string, string>;
+    expect(scripts.build).toEqual(expect.any(String));
+    expect(scripts.release.startsWith('pnpm run build && ')).toBe(true);
+    expect(withoutComments(jobBlock(rootWorkflow('release.yml'), 'publish'))).toContain('run: pnpm run build\n');
+    expect(scripts.build).toBe(
+      JSON.parse(fs.readFileSync(path.join(workspace, 'package.json'), 'utf8')).scripts.build,
+    );
+  });
 });
 
 // ── 5. scope: private out, apps/ in ──────────────────────────────────────────
 
@@ -97,7 +97,7 @@
  * about 1065x. Paying that on every run to make "I produced these" true by
  * construction is the wrong trade for a gate people run locally, so the
  * default keeps the cache and leg 3 carries the invariant for a few file
- * reads. `--force-build` buys the expensive form (`TURBO_FORCE`) for the
+ * reads. `--force-build` buys the expensive form (turbo's `--force`) for the
  * caller who wants a reading with no shared-cache question in it at all.
  *
  * Leg 2 also carries this repository's one PRODUCT boundary: three
@@ -111,8 +111,8 @@
  *   - "Scan `dist/` if it exists." With no per-PR full-repo build `dist/` is
  *     usually absent, so such a gate passes because it looked at NOTHING. Leg 1
  *     therefore reads SOURCES, which are always present, and leg 2 BUILDS
- *     rather than hoping someone else did (`--no-build` exists for callers that
- *     just built, and is wired into nothing).
+ *     rather than hoping someone else did (`--no-build` is for callers that
+ *     just ran the release's build, as ci.yml's full battery does).
  *   - "Resolve the entry." Measured and rejected above: resolution succeeded on
  *     the very package the card was filed from.
  *   - "Import it and count the successes." A run where every package failed for
@@ -141,15 +141,17 @@
  *     under objectui#5367: TypeScript's own tsconfig reader.
  */
 
-import { execFileSync, spawnSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import ts from 'typescript';
 
 import { SKIP_DIRS, TOOLING_FILE, discoverPackages, moduleSpecifiers } from './check-phantom-dependencies.mjs';
+import { buildWorkspace } from './check-published-dist-tooling.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
+import { workspaceRoot } from './workspace-root.mjs';
 import { UI_PUBLISHED_PACKAGE_FLOOR } from './__tests__/helpers/ui-package-population.mjs';
 
 const scriptDir = dirname(fileURLToPath(import.meta.url));
@@ -822,7 +824,12 @@ export function attributeMissingModule(missingPath, packages, root) {
 
 // ── the run ──────────────────────────────────────────────────────────────────
 
-function main(argv) {
+/**
+ * @param {string[]} argv
+ * @param {{ build?: typeof buildWorkspace }} [seams] `build` is the release's build (see
+ *   `buildWorkspace`); a test swaps it to read which build this gate asks for without paying one.
+ */
+function main(argv, { build = buildWorkspace } = {}) {
   const specifiersOnly = argv.includes('--specifiers-only');
   const noBuild = argv.includes('--no-build');
   // Buys the expensive form of the same invariant: with the cache off, every
@@ -909,19 +916,18 @@ function main(argv) {
   if (!noBuild) {
     console.log(
       forceBuild
-        ? '\nBuilding every published package with the cache OFF (TURBO_FORCE), so every artifact the ' +
+        ? '\nRunning the release\'s build with the cache OFF (--force), so every artifact the ' +
             'load leg grades below is one this run produced…'
-        : '\nBuilding every published package. turbo shares one cache across every worktree of this ' +
+        : '\nRunning the release\'s build. turbo shares one cache across every worktree of this ' +
             'checkout, so this build can be a replay of a sibling worktree\'s — the provenance leg ' +
             'below reads each task log and refuses to grade what this tree did not produce ' +
             '(objectui#7276)…',
     );
     try {
-      execFileSync('pnpm', ['build'], {
-        cwd: root,
-        stdio: 'inherit',
-        env: forceBuild ? { ...process.env, TURBO_FORCE: 'true' } : process.env,
-      });
+      // The release's own build, at the workspace root: `ui/` has no `build`
+      // script, and a build of some other task set would be graded as if it
+      // were the one that publishes (objectstack#26860).
+      build(workspaceRoot(root), { force: forceBuild, log: (line) => console.log(line) });
     } catch (error) {
       console.error(`\n✗ the build failed, so the load leg has nothing to grade: ${error.message}`);
       return 1;
 
@@ -54,7 +54,7 @@
  * packages) are never built there. Paying a full build on every pull request to
  * catch a defect that can only reach a user at publish time is the wrong trade;
  * this gate therefore runs where the harm materialises — the publish path
- * (`pnpm changeset:publish`) — plus nightly, at zero per-PR cost.
+ * (`scripts/release-publish.sh`) — plus `main`'s full battery, at zero per-PR cost.
  *
  * ## The vacuous form this gate must never take
  *
@@ -64,8 +64,8 @@
  * guarded. Three separate rules make that impossible here:
  *
  *   1. The gate BUILDS. It runs the repository's own build itself and fails
- *      loudly if the build fails. `--no-build` exists for callers that just
- *      built (and for the tests), and it is wired into nothing.
+ *      loudly if the build fails. `--no-build` is for callers that just ran
+ *      the release's build: the publish path and ci.yml's full battery both do.
  *   2. A published package that contributes NO file under a build output
  *      directory is a FINDING (`no-build-output`), not a skip. That is what
  *      keeps `--no-build` safe: a missing `dist/` is red, never green.
@@ -135,6 +135,7 @@ import { fileURLToPath } from 'node:url';
 
 import { PACKAGE_ROOTS, TOOLING_FILE, readReleaseGroup } from './check-phantom-dependencies.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
+import { workspaceRoot } from './workspace-root.mjs';
 import { UI_PUBLISHED_PACKAGE_FLOOR } from './__tests__/helpers/ui-package-population.mjs';
 
 const scriptDir = dirname(fileURLToPath(import.meta.url));
@@ -291,27 +292,35 @@ export function discoverPublishedPackages(root, released = readReleaseGroup(root
 // ── the build ────────────────────────────────────────────────────────────────
 
 /**
- * The repository's own build, run by the gate.
+ * The release's own build, run by the gate.
  *
- * Deliberately the same command the release workflow runs (`pnpm build`,
- * i.e. turbo's `build` task minus the docs site), so the artifacts inspected
- * below are the artifacts a release produces, rather than a second build shape
- * invented here that could differ from it.
+ * The workspace root's `build` script, run FROM the workspace root: the
+ * command `pnpm run release` opens with, the `Build` step of release.yml's
+ * `publish` job, and the build ci.yml's `UI Published Artifacts` job runs
+ * before it reads with `--no-build`. So the artifacts inspected below are the
+ * artifacts a release produces, rather than a second build shape invented here
+ * that could differ from it. Under the monorepo that root is the PARENT of the
+ * objectui tree (`workspaceRoot`), whose own manifest has no `build` script, so
+ * the objectui root is the one directory this must never run in (objectstack#26860).
  *
- * @param {string} root
+ * `--concurrency` and `--force` are appended to that script's command line,
+ * which pnpm hands through to turbo.
+ *
+ * @param {string} workspace the pnpm workspace root, `workspaceRoot(uiRoot)`
  * @param {{ concurrency?: number|null, force?: boolean, log?: (line: string) => void, exec?: Function }} options
  */
 export function buildWorkspace(
-  root,
+  workspace,
   { concurrency = null, force = false, log = () => {}, exec = execFileSync } = {},
 ) {
-  const args = ['exec', 'turbo', 'run', 'build', '--filter=!@object-ui/site'];
+  const script = readBuildScript(workspace);
+  const args = ['build'];
   if (concurrency !== null) args.push(`--concurrency=${concurrency}`);
   if (force) args.push('--force');
-  log(`Building: pnpm ${args.join(' ')}`);
+  log(`Building: pnpm ${args.join(' ')}  (in ${workspace}: ${script})`);
   const started = Date.now();
   try {
-    exec('pnpm', args, { cwd: root, stdio: 'inherit' });
+    exec('pnpm', args, { cwd: workspace, stdio: 'inherit' });
   } catch (error) {
     throw new Error(
       `the workspace build failed (${error.message}), so there is nothing trustworthy to inspect. ` +
@@ -324,6 +333,24 @@ export function buildWorkspace(
   return seconds;
 }
 
+/** The workspace root's `build` script, or a loud refusal naming where it looked. */
+function readBuildScript(workspace) {
+  const manifestPath = join(workspace, 'package.json');
+  let script;
+  try {
+    script = JSON.parse(readFileSync(manifestPath, 'utf8')).scripts?.build;
+  } catch (error) {
+    throw new Error(`cannot read ${manifestPath} (${error.message}), so the release's build is unknown.`);
+  }
+  if (typeof script !== 'string' || script.trim() === '') {
+    throw new Error(
+      `${manifestPath} declares no \`build\` script, so there is no release build to run. Run the ` +
+        "release's build yourself and pass `--no-build`.",
+    );
+  }
+  return script;
+}
+
 /** Remove each package's build output, so a stale artifact cannot be read as a fresh one. */
 export function cleanOutputs(root, packages, log = () => {}) {
   let removed = 0;
@@ -500,7 +527,7 @@ if (invokedDirectly) {
           'published package with no build output is reported as `no-build-output`.',
       );
     } else {
-      buildSeconds = buildWorkspace(root, { concurrency, force, log: (line) => console.log(line) });
+      buildSeconds = buildWorkspace(workspaceRoot(root), { concurrency, force, log: (line) => console.log(line) });
     }
     result = analyze(root, { packages });
   } catch (error) {