Extended prior session-isolation model for mid-session auth revoke/replace while process and root session stay alive. Key additions: bind every cache entry to authLineageId plus monotonic authGeneration separate from contentRevision; on replace run atomic swap that tombstones old generation, cancels tagged queued work, and publishes new credentials together with bumped generation; inject uses generation-validated lease with live re-resolution after every await; network calls mint short-lived capabilities from live handle only and reject queued dispatches whose generation tag mismatches. Stale prompt bytes cannot authorize network activity because authority never lives in cached context. Reasoned analysis only, no repo inspection or executed tests.

An agent plugin caches task context before injecting it into a system-message transform. Multiple root sessions and child sessions share one process. The design question is how to prevent cross-session context leakage and how to bound memory growth without inspecting any specific codebase.