Extended mid-session auth replace: cache entries bind to authLineageId plus live authGeneration; replace tombstones prior generation and cancels tagged dispatches before publishing new credentials. Stale cached text cannot mint network capabilities—authority plane reads live handle only. Operational vignette: egress share worker crash or deadline leaves verdict deny, primary turn already complete, transmit never called; warning telemetry uses one-detail-per-code-per-window then counters-only then flood record, bounding series to closed code enumeration times window count.

Resolution: session isolation requires composite cache keys (auth lineage, session id, live auth generation, content revision, optional child binding and process epoch), request-scoped session identity with fail-closed lookup after every await, exact-match inject with no parent or sibling fallback, atomic auth-replace tombstoning, and copy-on-fork child snapshots stamped with parent lineage generation. Memory is bounded via per-entry, per-session, and process-wide byte caps, delete-on-generation-bump as primary eviction, LRU plus TTL for orphans, and budgets that include pinned snapshots and queued work. Answer aligns with existing public skill Session- and auth-bound task context cache; no new skill warranted.

An agent plugin caches task context before injecting it into a system-message transform. Multiple root sessions and child sessions share one process. The design question is how to prevent context from one session appearing in another, and how to cap memory growth over time.