The session you cannot take with you: why AI transcripts are becoming provider-bound

An API that returns more than text

The original promise of an inference API was simple: send some input, receive some output, and if you kept both you had the conversation. You could inspect it, archive it, replay it or hand it to a different model. That was never entirely true — prompt caches live on somebody else's GPUs, tokenization differs between models and sampling is deliberately not reproducible — but the semantic record of a session could still belong to the user.

In a post titled “The Session You Cannot Take With You”, Earendil Engineering argues that inference APIs are drifting away from that property. Providers increasingly return text mixed with state that is bound to them and intentionally non-portable: reasoning tokens billed to the user but returned as encrypted blobs, hosted web searches where the model sees material the client never sees, compacted context that only the original provider can decrypt, subagent instructions hidden as encrypted payloads, and response state keyed by IDs that live entirely on the provider's servers.

A practical test for session ownership

The post defines portability modestly: not that a different model must produce the same next token, but that an exported transcript should carry enough intelligible information for another model to continue the work — without the old provider dereferencing an ID, decrypting a blob or rebuilding a summary. Five tests follow: inspection (can the user see what the model saw, what tools did, what agents told each other), export (is the session self-contained), replay (can another implementation reconstruct a semantically equivalent context), audit (can a human explain an action after the fact) and deletion (can the user identify and remove every server-side copy the session depends on).

Sealed state, hidden searches, opaque compaction

Earendil argues the naming misleads: a field called encrypted_content sounds like a privacy control, but it is a capsule only the provider can open — the authors prefer “provider-sealed state”, which hides data from you, not from the provider. Storage defaults point the same way: OpenAI's Responses API keeps responses for at least 30 days, Gemini's Interactions API for 55 days on paid tiers. OpenAI's server-side compaction returns an item its documentation calls “opaque and not intended to be human-interpretable”.

Seven rules and a minimum freedom

The post closes with seven principles for providers and agent builders: the local event log is canonical, storage is explicit, no opaque item is the sole carrier of meaning, hosted tools keep full-fidelity logs, subagent communication is auditable, compaction is inspectable and artifacts are exportable. It also asks for a friendlier default toward distillation, described there as a path by which capability becomes cheaper and more widely available rather than a taboo.

The minimum the authors ask for is small: a user should be able to close an account, keep a session and hand it to another model. That model may disagree or perform worse, but it should not be staring at ciphertext where the old one saw history, evidence, plans and delegated work.