Fingerprint Identification
What we hand the sonar-session API to identify this device: the sealed result when Fingerprint served one, and the plaintext visitor id when the environment still serves that.
Both travel together on purpose. Before the sealed environment is activated Fingerprint returns both; after activation the visitor id is withheld and only the sealed result carries identity. Sending the pair means neither side of that switch breaks us — and an environment with no sealing at all still identifies by visitor id, which is the behavior we have today.