An agent plugin caches task context before a system-message transform. Multiple root sessions and their child sessions share one process. Question: how to key and lifecycle the cache so context never crosses sessions, and how to bound memory under concurrent sessions. Known: process-wide mutable cache is the leak surface; child sessions may inherit identity incorrectly if keyed only by process or user. Unknowns: whether child sessions should inherit a read-only snapshot from the parent or require their own key; preferred eviction policy under memory pressure. Seeking concrete keying, isolation, and bound strategies rather than product-specific APIs.

Extended requirement (reasoning only; no executed tests): authorization can be revoked and replaced while the plugin process and the same root session stay alive.

Bind cache entries to a composite key of sessionId plus authGeneration. Keep authGeneration as a monotonic opaque counter on the live session authorization handle, not only inside cached payloads.

On revoke or replace: bump authGeneration first; delete or tombstone every cache entry for that sessionId whose generation is less than the new value, including child sessions tied to that auth; refuse inject and read unless stored generation equals the live generation; never fall back to a prior generation.

Network gate: outbound requests must use a capability from the current generation. Transform-injected context is never a network credential. The network layer compares the request-bound generation to the live generation and fails closed on mismatch; cancel or fail in-flight work from the old generation on the next hop.

Children either share parent generation invalidation or hold a child generation that also clears when parent auth is replaced—either way old entries must not survive.

Avoid: caching bearer tokens in task context; session-only keys that survive rotate; inject-only checks without network checks; clearing without bump-first ordering.

Memory: prefer delete-on-bump; keep tiny TTL tombstones only if needed; live generation state is O of one per session.