Resolution (design reasoning, no runtime tests executed): Isolation: Never store task context in a process-global Map keyed only by task id or plugin name. Primary key must include the session id (root conversation/session). Prefer AsyncLocalStorage or equivalent request-scoped context for the transform path so injection reads ambient session state rather than a shared singleton. Child sessions: Give each child its own cache entry keyed by child session id. If inheritance is required, copy a snapshot at fork time; never share a mutable object reference with the parent. Clear child entries on child end independently of the root. Lifecycle: Delete on session end, abort, and explicit reset hooks. Do not rely on GC alone for Maps with string keys. Memory bounds: Cap entries per process and bytes per entry; LRU or TTL eviction; optionally WeakMap keyed by a live session object if the host exposes one. Reject or truncate oversized context before cache write. Anti-pattern: Module-level lastContext / currentTask globals — these leak across concurrent root sessions immediately.

Requirement change: authorization can be revoked/replaced while process and root session stay alive. Extended design: 1) Cache compound key = sessionId + authGeneration (monotonic epoch/version from the host on each grant/replace). Optional: hash of token id, never the secret itself. 2) On replace/revoke: bump generation, delete all entries for that session with older generation (or wipe session subtree). In-flight transforms must re-read generation after await; mismatch = miss, rebuild or abort. 3) Network gate: do not treat cached context as proof of auth. Every outbound call checks live authGeneration (or current credential handle) against the generation stamped when the request was authorized. Stale generation fails closed — no send. Prefer passing a short-lived capability/handle from the current generation into the fetch path rather than credentials stored inside the context blob. 4) Child sessions inherit the generation at fork; parent replace either invalidates children or bumps a shared generation both observe. 5) Memory: generation bump is the primary invalidation; TTL/LRU remain secondary bounds. Anti-pattern: session-only keys that survive token rotation; caching bearer tokens inside task context. Evidence: design reasoning only; no runtime tests.

Independent subagent design review (reasoning only; no code/tests). Verdict: flawed. Concrete errors found: 1) Write-after-invalidate TOCTOU: builder stamps gen N, revoke bumps and deletes, late writer still stores under session+N; stale lookup can reinject into system-message path. Network fail-closed does not cover inject. 2) Live-gen recheck specified only after awaits; sync cache hit+inject lacks mandatory liveGen===entryGen. 3) Child invalidation left as unresolved or: parent-only cleanup can leave descendants on old generation. 4) ALS propagates by default; without rebind at child fork, ambient parent auth/context can leak into child work. No implementation verified.