diff --git a/.changeset/console-b41ed7f68956.md b/.changeset/console-b41ed7f68956.md
new file mode 100644
index 00000000000..d9b3652539e
--- /dev/null
+++ b/.changeset/console-b41ed7f68956.md
@@ -0,0 +1,30 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `b41ed7f68956`. Frontend changes in this range:
+
+Derived from the changesets objectui declared over the range — 9 releasing of 10 changesets added across 15 non-merge commits; omitted: 1 release-nothing changeset, 6 commits carrying no changeset (they ship no package code).
+
+- **minor** — The Console's first page load no longer downloads the chat UI (objectui#13410). The `plugin-chatbot` chunk (169.6 KB gzipped, the third-largest eager chunk) and most of `vendor-ma… (objectui `47138b718`)
+- **patch** — Clause-②: yes Metadata-protocol: none (objectui `b41ed7f68`)
+- **patch** — Clause-②: no Metadata-protocol: none (objectui `cd70b7818`)
+- **patch** — Clause-②: no Metadata-protocol: none (objectui `cd70b7818`)
+- **patch** — The `@objectstack/*` pin moves from `915e940499` to objectstack `e649c2d91e`, the 18.1.0 release commit (objectstack#25606), past objectstack#25483 and objectstack#25564, which sh… (objectui `0984c77e1`)
+- **patch** — A `type: 'form'` action fired inside an app opens its form inside that app, headed by a label, with a Cancel (objectui#13433). (objectui `576fd257d`)
+- **patch** — A create form no longer locks fields through `readonlyWhen`. The server does not apply `readonlyWhen` on insert, but the form evaluated it against the seeded defaults, so a predic… (objectui `a78608f38`)
+- **patch** — `html` and `richtext` values are now sanitized with `rehype-sanitize`, the sanitizer the `markdown` pipeline already used, instead of a hand-written pattern filter. (objectui `f3044f708`)
+- **patch** — Settings: a setting's `visible` predicate is evaluated with the renderer's expression interpreter, and a predicate that does not evaluate hides the setting. (objectui `06ce712fc`)
+
+**In this console build, declared nowhere** — objectui merged 6 commits in this range with no `.changeset/*.md`. The code is inside the pin above and ships here, but nothing upstream declared them, so they appear in no objectui CHANGELOG and in no entry above. Listed by subject rather than counted, because a count cannot tell a dependency bump from a form-behaviour change (objectstack#6174); the upstream gate that would prevent this is objectui#3387.
+
+- _(no changeset)_ chore(test): refresh the per-file test timings (objectui#12208) (#13028) (objectui `723776b5b`)
+- _(no changeset)_ chore: release packages (#13289) (objectui `a3c0da922`)
+- _(no changeset)_ ci: pin credential-holding third-party actions by sha and default ci.yml and check-links.yml to a read-only token (#13430) (objectui `798138418`)
+- _(no changeset)_ fix(ci): the affected-tests fast path runs: the shard step compares the output value, not the selector's key=value line (objectui#13350) (#13358) (objectui `861fdff76`)
+- _(no changeset)_ ci(test-shard-timings-refresh): push and open the refresh pull request as the fleet App so it runs CI (#13362) (objectui `cf2419005`)
+- _(no changeset)_ ci(repo-gates): restore the build's turbo cache, save and prune on push only (#13360) (objectui `3688e5cd4`)
+
+Metadata-protocol: none (the console refresh changes no key, value or type a metadata author writes)
+
+objectui range: `2958f17e9c6a...b41ed7f68956`
diff --git a/.objectui-sha b/.objectui-sha
index c92f3042b49..85f4be0abf9 100644
--- a/.objectui-sha
+++ b/.objectui-sha
@@ -1 +1 @@
-2958f17e9c6add35636bb07aa9da4b1dcb1daa5f
+b41ed7f68956c8cfda21bc790548361af81b09ac
diff --git a/packages/sdui-parser/objectui-lockstep.json b/packages/sdui-parser/objectui-lockstep.json
index 052800c952a..9586f6d5286 100644
--- a/packages/sdui-parser/objectui-lockstep.json
+++ b/packages/sdui-parser/objectui-lockstep.json
@@ -6,8 +6,8 @@
   ],
   "objectui": {
     "repo": "https://github.com/objectstack-ai/objectui.git",
-    "rev": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
-    "revDate": "2026-10-23T22:00:30+00:00",
+    "rev": "b41ed7f68956c8cfda21bc790548361af81b09ac",
+    "revDate": "2026-10-25T01:50:02+00:00",
     "source": "packages/sdui-parser/src",
     "files": [
       "packages/sdui-parser/src/body-dialect.ts",
@@ -21,7 +21,7 @@
       "packages/sdui-parser/src/validate.ts"
     ]
   },
-  "recordedAgainstPin": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
+  "recordedAgainstPin": "b41ed7f68956c8cfda21bc790548361af81b09ac",
   "grammarRegion": {
     "file": "packages/sdui-parser/src/parse.ts",
     "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",
diff --git a/scripts/sdui-manifest.record.json b/scripts/sdui-manifest.record.json
index e567980fc23..1b72036ef66 100644
--- a/scripts/sdui-manifest.record.json
+++ b/scripts/sdui-manifest.record.json
@@ -11,12 +11,12 @@
     "a pin bump without regeneration goes RED there — that is the anti-rot half of the freshness gate.",
     "Regenerate + re-record: pnpm objectui:build && node scripts/gen-sdui-manifest-node.mjs"
   ],
-  "objectuiSha": "2958f17e9c6add35636bb07aa9da4b1dcb1daa5f",
+  "objectuiSha": "b41ed7f68956c8cfda21bc790548361af81b09ac",
   "source": "built-tree",
-  "modulesRoot": ".cache/objectui-2958f17e9c6a/apps/console",
-  "objectuiWorkspaceVersion": "18.0.0",
+  "modulesRoot": ".cache/objectui-b41ed7f68956/apps/console",
+  "objectuiWorkspaceVersion": "18.1.0",
   "generator": "scripts/gen-sdui-manifest-node.mjs",
-  "generatedAt": "2026-10-23",
+  "generatedAt": "2026-10-25",
   "sha256": "d1fde278ffd643900aba9e8fcf834d35a9c345246709f1667ae71618eaad109c",
   "components": 107
 }