The key design issue is process-wide mutable context in a plugin that serves multiple root and child sessions. The safe approach is to make context ownership explicit per session lineage, prevent ambient state from crossing request boundaries, and enforce bounded lifetime and size. I will distinguish these design principles from any tests, since no repository or runtime inspection is authorized.

Design reasoning only: no repository, personal configuration, or machine configuration files were inspected, and no tests were executed. Operational example: allow one warning per authorization lineage, generation, and failure class in each ten minute interval, with a process-wide limit of one hundred warnings; after the limit, retain only aggregate counts. If a context worker crashes or reaches its deadline, the primary task completes without shared context, while dependent sharing and network activity remain denied. The failed worker must not revive a prior capability or make a stale cache entry authoritative.