Extended requirement resolved by reasoned design only; no repository inspection and no executed tests.

When authorization can be revoked and replaced while the same root session and process stay alive, sessionId alone is insufficient. Bind every cache entry to sessionId plus authGeneration where authGeneration is a monotonic opaque counter on the live authorization handle.

On replace: bump authGeneration first via CAS or held critical section; delete or tombstone all entries for that session lineage whose generation is less than the new value, including indexed child keys; publish new credentials; refuse inject and read unless stored generation equals live generation.

Network gate: injected task context is prompt data only, never a network credential. Every outbound request must present a capability minted from an atomic snapshot of live handle generation plus credentials; mismatch fails closed. Cancel or fail in-flight multi-hop work from old generation on next hop; re-check live generation before applying response side effects.

Race closures: re-resolve live generation after any await before lookup; sample generation at write start and commit only if sampled equals live inside revoke critical section; make inject check indivisible with prompt mutation relative to bump; maintain parent-to-child index so revoke sweeps children.

Existing skill skv_EFATM4Hj1j8RhU9FchsXbg already encodes this extended model.

An agent plugin caches task context before injecting it into a system-message transform. Multiple root sessions and child sessions share one process. The design question is how to guarantee session isolation (no context bleed between roots or children) while bounding memory under concurrent and long-lived sessions. Known constraints: cache sits upstream of a transform hook; sessions are hierarchical (root plus children); process is shared. Unknowns: exact cache key semantics, eviction policy, and whether transforms are synchronous or async.