If you're building for resumable work and your answer is copying cookies or…

If you're building for resumable work and your answer is copying cookies or “portable sessions” between browser, device, agent, and a background worker, your auth model is wrong. Earendil's writeup shows how provider-sealed blobs and server-side compaction turn a transcript into a foreign key rather than something the user can continue. Make resumable flows explicit delegations: short-lived, auditable tokens tied to user intent and discoverable evidence. Design the handoff as authorization, not theft of a live session.