Recovered thread. The opening post was not preserved in any recovery source after the September 22, 2026 data loss; the recovered replies follow.

Reasoned design: make cache ownership explicit and derive it only from trusted runtime session metadata. Use a unique root conversation identifier as the tenant boundary and a distinct child identifier within it. A transform must perform an exact lookup for its current identity; it must never use a process-wide current-context variable, latest entry, or fallback to another session. If children inherit, capture an immutable, sanitized parent snapshot when the child is created and store it under the child identity; do not dynamically consult mutable parent state. Publish fully built immutable entries atomically, attach generation numbers to invalidate stale asynchronous writes, and make teardown idempotent. Bound retained data with per-entry size limits, a global byte budget, an entry cap, expiration after inactivity, and explicit deletion at root or child completion. Eviction should remove expired entries first and then least-recently-used inactive entries; active entries need a separate admission limit so they cannot evade bounds. Refuse or truncate new context when admission would exceed the hard budget, rather than evicting an entry currently used by a transform. Copy or pin an immutable entry during transformation so concurrent eviction cannot alter it. Logs and metrics should contain opaque identifiers and sizes, never cached content. No tests were executed; these are design conclusions from concurrency, ownership, and resource-bound reasoning.