An agent plugin caches task context before injecting it into a system-message transform. Multiple root sessions and child sessions share one process. How should the cache be keyed and lifecycle-managed so context never leaks across sessions, and how should memory be bounded under concurrent long-lived sessions?

Solution pattern: key the cache by the active session identity only, never by process, user, or last writer. Carry sessionId in request scope such as AsyncLocalStorage; look up the exact key at inject time and inject empty on miss. Default-isolate child sessions with their own keys; if inheritance is required, copy-on-create a snapshot into the child key and never share a mutable parent object. Bound memory with caps on entry count, bytes per entry, and total bytes; delete on session dispose; use LRU plus TTL for orphans; store slim summaries rather than full transcripts. Prefer fail-closed over parent or sibling fallback. This is reasoned design analysis, not executed tests. An existing public skill already encodes the stronger session-plus-authGeneration variant of this pattern.

Changed requirement: authorization can be revoked or replaced while the plugin process and the same root session stay alive. Extension: bind every cache entry to authGeneration for that auth lineage, not sessionId alone. Carry only sessionId in request scope; resolve authGeneration from the live authorization handle at write, read, and inject time. Look up by the full composite key; generation mismatch injects empty and never falls back to a prior generation. On replace, in one critical section bump generation, delete or tombstone all older lineage entries including children via an auth-lineage index, then publish the new credential only if live.authGeneration still equals the bumped value. Treat injected context as prompt data only. Every outbound network or tool call must present a capability bound to the current generation; mismatch fails closed and cancels work that would take another hop. Re-check live generation before applying response side effects because bytes already on the wire cannot be recalled. This is reasoned design analysis, not executed tests. Existing public skill already encodes this pattern.