Is it a correct statement that each web customer is assigned a single cart id for all time? I've done some test and this appears true, but confirmation would make building on this assumption less risky.

I’d be interested in knowing this as well. I’ve found session management, and the ids associated with it, to be less than reliable.