test(dogfood): attachments non-admin permission matrix + orphan lifecycle e2e (#2755)

The dogfood the issue asked for: the #2742 E2E only ever drove a seeded
admin. New in-process matrix boots a purpose-built fixture (att_case
public / att_secret private+owner / att_nofiles) with the REAL serve
pairing (StorageServicePlugin + AuditPlugin) via a new
BootOptions.extraPlugins seam in @objectstack/verify, signs up genuine
members, and drives the presigned three-step upload + /data path.

Pinned findings:
- anonymous upload 401; owner_id + uploaded_by server-stamped (spoof
  attempt loses)
- FILES_DISABLED enforced e2e for the first time
- ATTACHMENT_PARENT_ACCESS: member cannot attach to an invisible record
- DOGFOOD FINDING: the everyone baseline (member_default) carries NO
  delete bit (ADR-0090 D5) — an ungranted member cannot delete even
  their own attachment (PERMISSION_DENIED before the attachment gate);
  apps enable attachment management via an ordinary granted set (the
  fixture ships one), after which uploader-delete works and
  stranger-delete stays 403
- KNOWN GAP pins with follow-up pointers: sys_attachment listing does
  not inherit parent visibility; downloads stay anonymous capability
  URLs
- Part 1 e2e: tombstone on last ref, shared-file survival, re-attach
  un-tombstone, sweep reaps expired tombstones AND deletes the bytes on
  disk, NULL deleted_at / fresh tombstones / committed rows survive,
  hook-bypass re-reference is un-tombstoned by sweep-time
  re-verification, abandoned pending uploads reaped
- multiTenant cross-org block (skips without the enterprise package)

Also: guarded reap now deletes per id — the engine's delete path reads
where.id as a scalar target, so the previous $in filter was bound as an
object by the SQLite driver.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0187NT3Qer9oep5dCRb9b8Lt

Author: claude

packages/dogfood/package.json

@@ -12,8 +12,10 @@
     "@objectstack/example-crm": "workspace:*",
     "@objectstack/example-showcase": "workspace:*",
     "@objectstack/objectql": "workspace:*",
+    "@objectstack/plugin-audit": "workspace:*",
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
+    "@objectstack/service-storage": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/verify": "workspace:*"
   },

packages/dogfood/test/attachments-permission-matrix.dogfood.test.ts

@@ -0,0 +1,97 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Attachments permission-matrix fixture (#2755).
+//
+// Three tiny objects spanning the enforcement axes of the generic
+// Attachments surface (#2727):
+//
+//   att_case    — enable.files + public sharing model: any member can read
+//                 (and per Salesforce "can edit parent ⇒ can manage its
+//                 attachments", any member can detach from it).
+//   att_secret  — enable.files + DEFAULT sharing model (omitted ⇒ private,
+//                 ADR-0090) + an `owner_id` field: the sharing service
+//                 read-filters rows to the owner, so a fresh member cannot
+//                 read (→ cannot attach to) another user's record, and
+//                 `canEdit` denies non-owners (→ cannot delete another
+//                 user's attachments on it).
+//   att_nofiles — NO enable.files: the #2727 opt-in gate (FILES_DISABLED).
+//
+// No custom SecurityPlugin: a fresh signUp member falls back to the real
+// `member_default` wildcard-CRUD set — exactly the posture the issue's
+// permission matrix questions (the gates under test are the ones layered on
+// TOP of that wildcard).
+
+import { defineStack } from '@objectstack/spec';
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/security';
+import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plugin-security';
+
+export const AttCase = ObjectSchema.create({
+  name: 'att_case',
+  label: 'Attachment Case',
+  pluralLabel: 'Attachment Cases',
+  sharingModel: 'public_read_write',
+  enable: { files: true },
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+  },
+});
+
+export const AttSecret = ObjectSchema.create({
+  name: 'att_secret',
+  label: 'Attachment Secret',
+  pluralLabel: 'Attachment Secrets',
+  // sharingModel omitted — custom object defaults to PRIVATE (ADR-0090);
+  // owner_id is the sharing service's owner anchor.
+  enable: { files: true },
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+    owner_id: Field.text({ label: 'Owner' }),
+  },
+});
+
+export const AttNoFiles = ObjectSchema.create({
+  name: 'att_nofiles',
+  label: 'No Files Here',
+  pluralLabel: 'No Files Here',
+  sharingModel: 'public_read_write',
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+  },
+});
+
+/**
+ * The domain grant a real app ships when it turns the attachments panel on
+ * for members: `member_default` (the `everyone` anchor baseline) carries NO
+ * `allowDelete` (ADR-0090 D5 — delete is not a baseline right), so managing
+ * attachments requires an ordinary position-distributed set with the delete
+ * bit on `sys_attachment`. The matrix grants this to some members and pins
+ * the no-grant baseline with another.
+ */
+export const attachmentManagerSet: PermissionSet = PermissionSetSchema.parse({
+  name: 'att_attachment_manager',
+  label: 'Attachments Fixture — attachment manager',
+  objects: {
+    sys_attachment: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
+  },
+});
+
+/** SecurityPlugin carrying the platform defaults + the fixture's domain set. */
+export function attachmentsFixtureSecurity(): SecurityPlugin {
+  return new SecurityPlugin({
+    defaultPermissionSets: [...securityDefaultPermissionSets, attachmentManagerSet],
+  });
+}
+
+export const attachmentsFixtureStack = defineStack({
+  manifest: {
+    id: 'com.dogfood.attachments_fixture',
+    namespace: 'att',
+    version: '0.0.0',
+    type: 'app',
+    name: 'Attachments Permission Matrix Fixture',
+    description:
+      'Three-object app exercising the #2755 attachment permission matrix: parent visibility, uploader/editor delete, enable.files gate.',
+  },
+  objects: [AttCase, AttSecret, AttNoFiles],
+});

packages/dogfood/test/fixtures/attachments-fixture.ts

@@ -321,7 +321,7 @@ describe('LifecycleService.sweep — reap guard', () => {
     { name: 'sys_file', lifecycle: { class: 'transient', ttl: { field: 'deleted_at', expireAfter: '30d' } } },
   ];
 
-  it('deletes only guard-confirmed ids, by $in, after fetching candidates with the cutoff filter', async () => {
+  it('deletes only guard-confirmed ids, per id, after fetching candidates with the cutoff filter', async () => {
     const rows = [
       { id: 'f1', deleted_at: '2020-01-01T00:00:00Z' },
       { id: 'f2', deleted_at: '2020-01-02T00:00:00Z' },
@@ -338,9 +338,9 @@ describe('LifecycleService.sweep — reap guard', () => {
     expect(finds[0].where).toEqual({ deleted_at: { $lt: isoCutoff('30d') } });
     expect(finds[0].context).toEqual({ isSystem: true, positions: [], permissions: [] });
     expect(guard).toHaveBeenCalledWith('sys_file', rows);
-    expect(deletes).toHaveLength(1);
-    expect(deletes[0].where).toEqual({ id: { $in: ['f1', 'f3'] } });
-    expect(deletes[0].multi).toBe(true);
+    // Per-id deletes — the engine's delete path reads `where.id` as a scalar
+    // target; a `{$in}` there would be bound as an object by the driver.
+    expect(deletes.map((d) => d.where)).toEqual([{ id: 'f1' }, { id: 'f3' }]);
     expect(report.swept).toEqual([
       { object: 'sys_file', class: 'transient', policy: 'ttl', cutoff: isoCutoff('30d'), deleted: 2 },
     ]);
@@ -410,9 +410,7 @@ describe('LifecycleService.sweep — reap guard', () => {
     const report = await svc.sweep();
 
     expect(finds).toHaveLength(2);
-    expect(deletes).toHaveLength(2);
-    expect((deletes[0].where.id.$in as string[]).length).toBe(500);
-    expect((deletes[1].where.id.$in as string[]).length).toBe(10);
+    expect(deletes).toHaveLength(510); // 500 confirmed from page 1 + 10 from page 2, per id
     expect(report.swept[0].deleted).toBe(510);
   });
 });

packages/objectql/src/lifecycle/lifecycle-service.test.ts

@@ -710,14 +710,17 @@ export class LifecycleService {
       });
       if (!rows?.length) break;
       const confirmed = (await guard(object, rows)).filter((id) => id !== null && id !== undefined);
-      if (confirmed.length > 0) {
+      // Per-id deletes (NOT a `{$in}` filter): the engine's delete path reads
+      // `where.id` as a scalar target, and by-id deletes get referential
+      // cascade handling a filter-delete would bypass.
+      for (const id of confirmed) {
         await engine.delete(object, {
-          where: { id: { $in: confirmed } },
+          where: { id },
           multi: true,
           context: { ...SYSTEM_CTX },
         });
-        total += confirmed.length;
       }
+      total += confirmed.length;
       if (confirmed.length < rows.length || rows.length < REAP_GUARD_BATCH_SIZE) break;
     }
     return total;

packages/objectql/src/lifecycle/lifecycle-service.ts

@@ -93,6 +93,15 @@ export interface BootOptions {
    * default boot stays lean for apps that don't exercise flows. Default `false`.
    */
   automation?: boolean;
+  /**
+   * Extra plugins to register between the app/service pairs and the
+   * SecurityPlugin — the slot where `objectstack dev` auto-loads optional
+   * service pairs the lean harness omits (e.g. `StorageServicePlugin` +
+   * `AuditPlugin` for the attachments surface). The caller instantiates the
+   * plugins so `@objectstack/verify` gains no new dependencies. Registered in
+   * array order. Default `[]`.
+   */
+  extraPlugins?: unknown[];
 }
 
 /**
@@ -189,6 +198,13 @@ export async function bootStack(
     await kernel.use(new AutomationServicePlugin({ suspendedRunStore: 'memory' }));
   }
 
+  // Caller-supplied optional service pairs (see BootOptions.extraPlugins).
+  // Before SecurityPlugin, mirroring the CLI's ordering for service pairs.
+  for (const plugin of opts.extraPlugins ?? []) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    await kernel.use(plugin as any);
+  }
+
   await kernel.use(opts.security ?? new SecurityPlugin());
   // Sharing service — apps that declare `requires: ['sharing']` rely on it for
   // record-share grants; without it their RLS/sharing rules are inert and the