fix: bound Subject database retention to synchronous plugin checks

crates/workspace-server/src/server/subject_authorization.rs

@@ -955,8 +955,10 @@ impl WorkspaceApi {
                         "foreign Plugin Worker".into(),
                     ));
                 }
+                super::plugin_host::with_authority_database(&api, || {
                     plugin_execution_identity(&api, &worker).map_err(|error| error.error)
                 })
+            })
             .await
     }
 }

crates/workspace-server/src/server_plugin_host.rs

@@ -134,6 +134,20 @@ fn operation_name(op: &PluginHostOperation) -> &'static str {
     }
 }
 
+/// Retain the physical Subject database only for this synchronous check. Each
+/// policy/lineage query still reads its owner; no authorization result or lock
+/// survives the closure, and FeatureStorage continues to enforce lifecycle fences.
+pub(super) fn with_authority_database<T>(
+    api: &WorkspaceApi,
+    check: impl FnOnce() -> crate::Result<T>,
+) -> crate::Result<T> {
+    let _database = api
+        .feature_storage
+        .open(&api.subjektiv_registration)
+        .map_err(|error| Error::Store(error.to_string()))?;
+    check()
+}
+
 async fn check(
     api: Arc<WorkspaceApi>,
     context: ServerRequestContext,
@@ -220,12 +234,14 @@ async fn check_tools(
     let executor = api.config_store.db_executor();
     executor
         .run(move || {
+            with_authority_database(&api, || {
                 subject_authorization::authorize_scope(
                     &api,
                     &worker,
                     &server_api::authorization::OperationAuthorizationRequest {
                         operation: operation_name(&operation).into(),
-                    resource: server_api::authorization::PermissionResource::PluginInstallation {
+                        resource:
+                            server_api::authorization::PermissionResource::PluginInstallation {
                                 workspace_id: workspace.clone(),
                                 installation_id: installation.clone(),
                             },
@@ -244,6 +260,7 @@ async fn check_tools(
                     )
                 })
             })
+        })
         .await
         .map_err(policy::map_error)
 }

crates/workspace-server/src/server_plugin_service.rs

@@ -31,6 +31,7 @@ async fn check_service(
     let executor = api.config_store.db_executor();
     executor
         .run(move || {
+            with_authority_database(&api, || {
                 for op in ["plugin.service.consume", operation_name(&operation)] {
                     subject_authorization::authorize_scope(
                         &api,
@@ -57,6 +58,7 @@ async fn check_service(
                     )
                 })
             })
+        })
         .await
         .map_err(policy::map_error)
 }