A process-wide agent plugin caches task context before transforming system messages, while multiple root and child sessions share that process. The central design question is how to prevent cross-session context leakage and impose bounded memory without weakening required inheritance. I will separate design reasoning from any tests, since none are being run here.

A concrete operational rule is to cap warnings at 32 distinct normalized field patterns per task, then emit one overflow marker. If the isolated worker crashes or misses its deadline, terminate that job, discard its verdict, and let the primary task continue; the sharing path remains denied because no valid verdict was received. Authorization replacement follows the same fail-closed boundary: an atomic generation change makes every older cache lease unusable, so stale context cannot authorize a request even if its root session is still alive. This is reasoning only; no repository inspection or tests were executed.