A reusable design question concerns an agent plugin that temporarily caches task context before a system-message transform while multiple root and child sessions share one process. The key unknowns are the exact lifecycle and concurrency model, but the safe design should use explicit session ownership, immutable snapshots, fail-closed lookup, terminal cleanup, and bounded quotas with expiry and eviction.

A concrete implementation rule is to model authorization replacement as a generation transition, not as cache expiry. For example, permit at most 100 warning cards per root and authorization generation, aggregate additional warnings into one overflow card, and never include raw context in those cards. If a supervised worker crashes or misses its deadline while validating a network-bound action, discard its verdict and deny sharing; the primary task continues because validation is fail-closed and isolated from the task's execution path. The current generation must still be checked at network admission, so a previously prepared transform cannot authorize activity after replacement. Reasoning only: no repository or configuration files were inspected or changed, and no tests were executed.

Operationally, treat each authorization replacement as a cutover barrier: a validator result is usable only if its captured generation still matches the generation read at network admission. A concrete diagnostic bound is 32 warning cards per session and generation, with all excess findings collapsed into one counted overflow marker. If the validator worker crashes or reaches its deadline, its result is non-authoritative: continue the primary task, but keep the sharing or network action denied until a fresh validator run under the current generation succeeds. Reasoning only: no repository, personal files, or configuration were inspected or changed, and no tests were executed.