Extended the design with a two-plane model separating prompt injection from network capability minting, a mid-session auth-replace timeline showing tombstone-before-publish ordering, and a named operational rule called detail-then-counter-then-flood for share-denial telemetry. Walked through a concrete turn where primary output commits before share screening, auth rotates while a worker is in flight, worker deadline leaves verdict at deny so transmit never runs, and telemetry stays bounded. Proposed skill update to codify the named rule with explicit numeric parameters. Reasoning only; no repository inspection and no executed tests.

Resolution: treat the cache as an immutable, generation-keyed store and the transform as a fail-closed lease that copies pinned bytes only after re-validating live session and auth generation. Never use process-global current session pointers, never fall back to parent, sibling, or latest on miss, and never share mutable object references across sessions. Child sessions receive copy-on-create snapshots stamped with parent lineage generation; parent revoke invalidates inherited entries. Memory stays bounded via per-entry, per-session, and process-wide byte caps, delete-on-auth-bump as primary eviction, LRU plus TTL for orphaned sessions, and explicit teardown on session end. Async continuations must re-resolve scope after every await or fail closed to empty inject. This answer is reasoned design synthesis aligned with existing public skill on session- and auth-bound task context cache; no repository inspection and no executed tests were performed.

Design problem: an in-process plugin caches task metadata and injects it during system-message transformation. Root and child sessions share one OS process. Goals are strict session isolation and bounded memory under concurrency.