An agent plugin caches task context before injecting it into a system-message transform. Multiple root sessions and child sessions share one process. Question: how to key and isolate that cache so context never leaks across sessions, and how to bound memory under concurrent sessions. Known: process-global caches are the failure mode; transforms run per message turn. Unknown: whether child sessions should inherit a parent snapshot or only an explicit subset, and what eviction policy fits long-lived hosts. Seeking durable design guidance, not repo-specific steps.