Filed on maintainer ruling (2026-08-14, verbatim: 「同意」, approving item 6 of the six-item ruling list presented in chat by the objectstack PM seat, session session_018WuTtyckQa1VcXwgd52JpN). Context: the repo is now on @objectstack/* 17.0.0 GA (#1146 / PR #1147, merged 2026-08-14), and all nine objectstack mirror cards for this repo's rc-era platform findings are closed via merged PRs (objectstack-ai/objectstack#5491→PR6684, #5492→6684, #5493→6909, #5494→6153, #5495→6932, #5574→6697, #5591→6343, #7861→7974, #6080→6466). The account-book here has not caught up with the fixes. This card is the catch-up: measurement and bookkeeping only, no feature code.
Mandate
1. Apply the #1106 verdict table (posted on that card 2026-08-11, never applied because the dispatching PM's session ended): close-stale #786; promote #1093, #1086, #853; keep the remaining 30 as graded.
2. Direct-close with a provenance comment each — all verified fixed with rc.2/rc.6 retest readings already recorded on-card, most with an explicit "recommends closing" comment nobody executed: #520, #510, #509, #526, #567, #656, #651, #779. (#525, #524, #521 were closed directly by the PM under the same ruling; #703 is in group 3.)
3. Confirmation probe, then close if green:
4. GA-retest the 8 likely-live (never re-measured since rc.2, or measured-still-broken): #707 (security: allowExport bypass for org-admin), #689 (security-adjacent: full INSERT with values logged at ERROR), #682 (console-chrome i18n cluster — also check the state of its mirror objectstack-ai/objectstack#5407), #680, #701, #691, #986, #1122. For each survivor: file or refresh an objectstack mirror and nominate it for target:v17 on objectstack-ai/objectstack#8667 (Seat A decides nothing — the maintainer approves nominations). For each non-reproducer: close with the reading.
Rules
Measurement first; every close carries its reading (version, probe, result) — no bare closes. No code changes beyond probe scaffolding. Report progress on this card. The v17 bug-focus regime (objectstack-ai/objectstack#8667 / #8668) stays scoped to objectstack + objectui: nothing from this card enters those seats except maintainer-approved mirror nominations from group 4.
Filed on maintainer ruling (2026-08-14, verbatim: 「同意」, approving item 6 of the six-item ruling list presented in chat by the objectstack PM seat, session
session_018WuTtyckQa1VcXwgd52JpN). Context: the repo is now on@objectstack/*17.0.0 GA (#1146 / PR #1147, merged 2026-08-14), and all nine objectstack mirror cards for this repo's rc-era platform findings are closed via merged PRs (objectstack-ai/objectstack#5491→PR6684, #5492→6684, #5493→6909, #5494→6153, #5495→6932, #5574→6697, #5591→6343, #7861→7974, #6080→6466). The account-book here has not caught up with the fixes. This card is the catch-up: measurement and bookkeeping only, no feature code.Mandate
1. Apply the #1106 verdict table (posted on that card 2026-08-11, never applied because the dispatching PM's session ended): close-stale #786; promote #1093, #1086, #853; keep the remaining 30 as graded.
2. Direct-close with a provenance comment each — all verified fixed with rc.2/rc.6 retest readings already recorded on-card, most with an explicit "recommends closing" comment nobody executed: #520, #510, #509, #526, #567, #656, #651, #779. (#525, #524, #521 were closed directly by the PM under the same ruling; #703 is in group 3.)
3. Confirmation probe, then close if green:
member_default的*通配授权(C/R/E)并集合并进每个成员 —— 应用的 explicit-allow 对象门在建/读/改三轴上被整体架空,任何 profile 都能在任何对象上建记录 #703 — full GA permission probe: explicit-allow object gates hold,member_defaultcarries no wildcard union (rc.6 static read already showed the root cause gone; this is the closing probe)modifyAllRecords对行级写门无效,edit 级sys_record_share实际只给读 —— sales_manager 改不了任何非本人创建的记录 #705 / 回归:#547 实测通过的marketing_campaign_updatesRLS 写扩权在 rc.2 上失效(403);同 PR 的 campaign_member 扩权仍工作 #706 — RLS write-widening re-probe on GA (their mirrors landed via PRs #6684/#6909)4. GA-retest the 8 likely-live (never re-measured since rc.2, or measured-still-broken): #707 (security: allowExport bypass for org-admin), #689 (security-adjacent: full INSERT with values logged at ERROR), #682 (console-chrome i18n cluster — also check the state of its mirror objectstack-ai/objectstack#5407), #680, #701, #691, #986, #1122. For each survivor: file or refresh an objectstack mirror and nominate it for
target:v17on objectstack-ai/objectstack#8667 (Seat A decides nothing — the maintainer approves nominations). For each non-reproducer: close with the reading.Rules
Measurement first; every close carries its reading (version, probe, result) — no bare closes. No code changes beyond probe scaffolding. Report progress on this card. The v17 bug-focus regime (objectstack-ai/objectstack#8667 / #8668) stays scoped to objectstack + objectui: nothing from this card enters those seats except maintainer-approved mirror nominations from group 4.