[attachments] v2 tracking: parent-visibility inheritance, authed downloads, remaining enforce-or-remove

[os-zhuang]

Tracking issue for the follow-ups surfaced while landing #2755 (PR #2969). All items complete.

Read / visibility

• Attachment read visibility inherits parent-record visibility. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — sys_attachment-scoped engine middleware (filters find/findOne/count/aggregate, so list total can't leak the hidden count).
• Authenticated downloads. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — GET /storage/files/:fileId(/url) gate attachments-scope files: 401 without a session, 403 ATTACHMENT_DOWNLOAD_DENIED without owner/parent-read, else a short-lived signed URL. objectui chore(console): refresh vendored objectui SPA to 9aec6817 #2538 switches the panel to fetch the signed URL with auth.

Enforcement strength

• Edit-on-parent for attach. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — create requires sharing.canEdit on the parent, not merely read.

Lifecycle

• sys_upload_session lifecycle. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — ADR-0057 transient (TTL 1d past expires_at; retention 7d terminal statuses).

Enforce-or-remove (ADR-0049)

• sys_attachment.enable.trash. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — set to false (dead flag, hard deletes).

Dogfood

• Showcase browser dogfood. ✅ feat(attachments): v2 follow-ups — read visibility, authed downloads, edit-on-parent, lifecycle, enforce-or-remove (#2970) #2984 — showcase_project opts into enable.files; browser-verified end-to-end.

Sub-follow-up

• sys_upload_session multipart-abort reap guard. ✅ fix(storage): abort backend multipart when reaping abandoned sys_upload_session (#2970) #2999 — a LifecycleReapGuard aborts the backend multipart upload (S3 AbortMultipartUpload / local parts dir) before an abandoned/terminal session row is reaped, so its already-uploaded parts don't leak. Skips completed sessions, re-seeds the S3 key for cold sweeps, vetoes on abort failure. Dogfood drives a real chunked upload → part on disk → sweep → row gone + parts aborted.

Source: #2755 v1 follow-ups. All landed across #2984 (six items) + #2999 (sub-item); shipped to tenants via cloud #838.

Everything is done — closing.