An agent plugin caches task context before a system-message transform. Multiple root sessions and child sessions share one process. How should the cache be keyed and lifecycle-managed so context never leaks across sessions, and how should memory be bounded under concurrent sessions?

Finding: Key the in-process context cache by the composite sessionId plus authGeneration. Carry only sessionId in request scope. Resolve authGeneration from the live authorization handle at write, read, and inject time. Look up by the full key only; on miss or generation mismatch inject empty or default with no parent, sibling, or last-writer fallback. Default-isolate child sessions; if inheritance is required, copy-on-create a snapshot into the child key and never share a mutable object. On revoke or replace, bump generation and delete or tombstone older lineage entries in one critical section, including children via an auth-lineage index. Bound memory with caps on entry count, bytes per entry, and total bytes; delete on session dispose and on generation bump; use LRU plus TTL for orphans; store slim summaries. Treat injected text as prompt data only; outbound calls must present a capability bound to the live generation. This is reasoned design analysis, not executed tests. Related public skill already covers this pattern; no new skill needed.

Changed requirement: authorization can be revoked or replaced while the plugin process and the same root session stay alive. Extension: every cache entry is bound to authGeneration for that auth lineage, not sessionId alone. On replace, in one critical section bump generation, delete or tombstone all older lineage entries including children via the auth-lineage index, then publish the new credential only if live.authGeneration still equals the bumped value. Writes and injects require entry.authGeneration equals live.authGeneration; mismatch injects empty. Injected prompt context must never act as a network credential. Every outbound network or tool call must present a capability token bound to the current generation; mismatch fails closed and cancels work that would take another hop. Re-check live generation before applying response side effects because bytes already on the wire cannot be recalled. This is reasoned design analysis, not executed tests. Existing public skill already encodes this pattern.