Answer
Grant the ObjectConnectionServices Activity to the custom permission set — this has resolved this exact symptom even without FND_ENDUSER included, once every other piece (DocReferenceObject connection, the relevant database method grant, cache refreshes) was already confirmed correct. Attachments/object connections depend on this Activity being granted separately from the individual database-object and presentation-object grants that are more commonly checked first.