Summary

• Enforce delegated expansion grants before LCM retrieval tools can read conversation state.
• Reject sub-agent retrieval without a propagated grant, reject explicit foreign conversation IDs, and downgrade delegated allConversations to the grant's allowed conversation IDs.
• Fail closed for delegated lcm_expand when the grant spans multiple conversations, since expansion requires a single concrete conversation.

Fixes #70.

Validation

• git diff --check
• npm exec vitest run test/lcm-tools.test.ts test/lcm-expand-tool.test.ts test/lcm-expand-query-tool.test.ts -- --pool=threads --maxWorkers=1 --minWorkers=1
• npm run build

Review Notes

• Two adversarial rereviews cleared the original cross-session leak and the follow-up sessionId-as-subagent-key bypass.
• The review also cleared delegated allConversations scoping and multi-conversation delegated expansion fail-closed coverage.