I did finally figure this out. As mentioned in the comment, it was indeed something completely different that didn't have to do with manipulating the cookies or even session directly.

What happened was that an error occurred elsewhere. One of those silly NoMethodErrors that are pretty obvious once you see the message and the backtrace. The difficulty in this case was that there was a line of code in the controller which printed out an error message to the browser. It put that message in the flash object, which is part of the session object, which counts as a cookie. So, when that error was thrown, and the naive error.message was put in the flash object, a serialized version of a model object was put in there too, quickly overflowing the cookie limit. Very indirect and very subtle.

In retrospect, I included a hint to the answer in my question with this line of controller code:

redirect_to upload_annual_sales_client_url(@client), alert: ex.message

Pretty innocent at first glance, and the danger and implications were not noticed by me or the person who kindly took the time to comment here (I appreciate you!). Hopefully someone else will have this problem and find this helpful!