One Face ID ceremony creates a short-lived, HttpOnly cockpit session. The engine token remains encrypted server-side and never enters browser JavaScript.