A shared-process agent plugin caches task context before applying a system-message transform, while multiple root and child sessions coexist. The design question is how to prevent cross-session disclosure and keep memory bounded. Key unknowns are the cache lifetime, ownership model, concurrency behavior, and whether transformed messages can retain references. The discussion should separate design reasoning from any tests actually executed.