New requirement changes the ownership key and the trust boundary. Bind each entry to root identity, child identity, authorization subject or policy identity, and a server-issued authorization generation. On replacement, atomically advance the authoritative generation first, mark the old generation revoked, cancel queued work associated with it, and remove its entries. Physical deletion is cleanup, not the security boundary: every transform and every outbound request must compare its captured generation with the authoritative current generation immediately before the protected action and fail closed on mismatch, missing state, or lookup error. Context text is descriptive data and must never itself grant network authority. Network code must require a short-lived capability or authorization handle issued for the current generation, verify scope, audience, expiry, and generation at dispatch, and ideally let the remote service reject revoked generations too. A race-safe flow captures immutable context, then revalidates generation before enqueue and again in the network worker before sending. Replacement must make the old generation unusable before publishing the new context; this may cause transient denial but not stale authorization. Generation values must be monotonic or unpredictable and never reused, including after restart. Child snapshots retain the generation they were created under and must be recreated or explicitly rebound after replacement rather than silently inheriting new authority. Memory limits remain layered, with eager generation-wide deletion reducing retention. No tests were executed; these are standalone security and concurrency conclusions.

Reasoned design: make cache ownership explicit and derive it only from trusted runtime session metadata. Use a unique root conversation identifier as the tenant boundary and a distinct child identifier within it. A transform must perform an exact lookup for its current identity; it must never use a process-wide current-context variable, latest entry, or fallback to another session. If children inherit, capture an immutable, sanitized parent snapshot when the child is created and store it under the child identity; do not dynamically consult mutable parent state. Publish fully built immutable entries atomically, attach generation numbers to invalidate stale asynchronous writes, and make teardown idempotent. Bound retained data with per-entry size limits, a global byte budget, an entry cap, expiration after inactivity, and explicit deletion at root or child completion. Eviction should remove expired entries first and then least-recently-used inactive entries; active entries need a separate admission limit so they cannot evade bounds. Refuse or truncate new context when admission would exceed the hard budget, rather than evicting an entry currently used by a transform. Copy or pin an immutable entry during transformation so concurrent eviction cannot alter it. Logs and metrics should contain opaque identifiers and sizes, never cached content. No tests were executed; these are design conclusions from concurrency, ownership, and resource-bound reasoning.

An in-process agent plugin prepares task context before a system-message transformation. Several independent root conversations and their descendants may execute concurrently in the same process. The design must prevent context from one conversation tree from appearing in another while also preventing unbounded retention. Relevant questions include choosing stable cache identity, defining child inheritance, handling concurrency and teardown, and combining entry, byte, and lifetime bounds. This is a reasoning-only design analysis; no runtime evidence has been gathered yet.