Resolution (design reasoning only; no runtime tests executed). Isolation: Ban process-global lastContext or task-id-only maps. Key every cache entry by the active session id. Prefer ambient session binding (AsyncLocalStorage or equivalent) so the system-message transform reads only the current session entry; on miss, inject nothing rather than a shared default. Root vs child: Each child gets its own key. If inheritance is needed, deep-copy a snapshot at fork time; never share mutable references with the parent. Rebind ambient context at child start so parent ALS does not leak. Clear child entries on child end independently of the root. Lifecycle: Delete on session end, abort, and reset hooks. Do not rely on GC for string-keyed Maps. Memory bounds: Cap entry count and bytes per entry; LRU or TTL eviction; truncate or reject oversized context before write. Optional WeakMap keyed by a live session object if the host exposes one. Anti-patterns: module-level currentTask; coarse parent-only keys for children; miss-path fallback to a global singleton.

Requirement change: authorization can be revoked or replaced while process and root session stay alive. Extended design (reasoning only; no runtime tests): 1) Compound cache key = sessionId + authGeneration (monotonic epoch from host on each grant/replace). Optional: hash of credential id, never the secret. Stamp generation on every written entry. 2) On revoke/replace: bump live generation first, then delete all entries for that session with older generation (wipe session subtree including children). Writers must compare liveGen at commit time; if entryGen !== liveGen, discard write (closes write-after-invalidate TOCTOU). 3) Inject path: before system-message injection, require liveGen === entry.gen even on sync cache hits. Mismatch = miss, rebuild under new gen or inject nothing. Do not treat cached context as proof of auth. 4) Network gate: every outbound call checks live authGeneration (or a short-lived capability handle issued for the current generation) against the generation stamped when the request was authorized. Stale generation fails closed — no send. Prefer passing the current-generation handle into fetch rather than storing bearer tokens inside the context blob. 5) Children: inherit generation at fork and rebind ambient context. Parent replace invalidates the whole subtree (or bumps a shared generation both observe). Do not leave descendants on the old generation. 6) Memory: generation bump is primary invalidation; TTL/LRU remain secondary bounds. Anti-patterns: session-only keys that survive token rotation; caching secrets in context; inject without liveGen check; late writers restoring stale gen N after bump.

Independent subagent design review (reasoning only; no tests executed). Verdict: flawed. Concrete errors: 1) Child auth invalidation is ambiguous: inherit-at-fork plus per-session liveGen and delete-older-entries can leave children injectable after parent revoke/replace unless every child liveGen is bumped or the tree shares one live generation; entry deletion alone is insufficient if inject only checks that child's liveGen === entry.gen. 2) ALS rebind on child start without defined parent save/restore (or isolated async chain) allows parent continuations under the child store and vice versa, so inject/network can use the wrong session key. 3) Network current-generation capability unspecified at use time: a handle captured before revoke/replace may still authorize outbound sends unless resolved against live generation at send. 4) Session-id reuse after end/abort/reset unspecified; a recycled id with reset generation can collide with uncleared (sessionId, gen) entries if end-path deletion is missed or delayed. No implementation verified.