docs(handoff): record Emma session boundaries

docs/handoffs/EMMA-CANONICALIZATION-2026-09-19.md

@@ -280,3 +280,98 @@ persistent memory.
 4. Start a new chat and confirm Emma does not claim to remember the prior chat
    unless such persistence is explicitly implemented and authorized.
 5. Record each result as PASS, FAIL, or UNVERIFIED.
+
+## EMMA-SESSION-001C Result
+
+**Status:** PASS
+
+This phase verified repeatable same-session context continuity and the
+intentional boundary between active conversation context and persistent memory.
+
+### Check 1 — New same-session continuity
+
+**Result:** PASS
+
+In a new OPAX conversation:
+
+```text
+User:
+Husk dette testtokenet kun i denne samtalen:
+OPAX-EMMA-SESSION-002.
+Svar bare: registrert
+
+Assistant:
+Registrert.
+
+User:
+Hva var testtokenet jeg ba deg huske?
+
+Assistant:
+OPAX-EMMA-SESSION-002.
+```
+
+This confirms repeatable short-term conversation continuity within an active,
+independent OPAX conversation.
+
+### Check 2 — Browser refresh behavior
+
+**Result:** NOT RESTORED
+
+After one browser refresh with Ctrl+R, the previous conversation was not
+visible or restored.
+
+This proves only that the current UI does not restore the conversation after
+refresh. It does not prove or disprove the existence of a backend persistence
+foundation.
+
+### Check 3 — New conversation boundary
+
+**Result:** PASS
+
+In a new conversation, the user asked whether Emma remembered the token from
+the previous conversation.
+
+Emma replied that it did not have access to prior conversations or persistent
+memory in the new chat.
+
+This confirms that Emma does not falsely claim cross-conversation memory and
+that observed conversation context does not bleed into a new chat.
+
+### Conclusion
+
+- Same-session conversation continuity: PASS.
+- Browser-refresh restoration: not active.
+- New-conversation privacy boundary: PASS.
+- Firestore/Morphic persistent-memory wiring: still unverified.
+- No code, test, deployment, Cloud Run, Firestore, Gitea, IAM, secret, VPC,
+  DNS, or runtime configuration change was justified by this browser-only
+  acceptance phase.
+
+## Next Phase
+
+### EMMA-PERSIST-001A
+
+**Goal:** Design and inspect the authenticated, scoped, auditable persistent
+conversation-memory contract before any implementation.
+
+The next phase must answer:
+
+1. Which trusted authenticated OPAX user identity reaches the BFF and MCP.
+2. How Conversation, Message, UserScope, WorkspaceScope, and ProjectScope are
+   represented.
+3. Which Firestore collections and fields already exist.
+4. How a conversation can be restored after refresh without allowing
+   cross-user or cross-workspace access.
+5. Retention, deletion, audit, and maximum-context rules.
+6. Whether existing `call_emma`/Firestore foundation can be reused safely,
+   without blindly enabling its local-emulator path for production browser chat.
+
+**Out of scope:**
+
+- Firestore writes.
+- Production code changes.
+- Browser/UI changes.
+- MCP changes.
+- Ticket execution.
+- Git/Gitea access.
+- Commit, push, build, deployment, or infrastructure changes.