[tannerpolley]

Summary

Adds safe notebook persistence and owned-kernel lifecycle to the optional notebook service. Revision and disk-hash checks preserve drafts on conflict; viewer and agent leases control idle cleanup; trusted server-local profiles reference secrets and verify the project environment.

NotebookService → canonical document lock → revision/hash check → temporary file → rename + acknowledgement
        ↓
viewer/agent leases → idle deadline → owned-kernel cleanup journal

Closes #211

Evidence

• Independent Codex checker accepted 2b24524beb2b68226850f4cae62f16ef2fef1462, independently rerunning 25 affected tests.
• Before: concurrent opens created duplicate owners, unknown executions could be idle-deleted, cancellation left saves unacknowledged, and journal/subscription races broke ownership or event ordering. After: Deferred/TestClock regressions cover all six findings and pass.
• Server and contracts package typechecks and changed-file lint passed. The changed-file gate passes format, lint, GraphQL and 61 selected tests; the overall gate retains established baseline mobile type errors and unrelated Knip findings (3 files, 74 exports).
• After merging current main without conflicts, server and contracts package typechecks passed again, together with 76 affected tests across six files.
• Local authenticated Jupyter probes verified interpreter, cwd, project imports, mismatch rejection and owned-kernel DELETE/404 handling; the captured test server was stopped. No T3 restart, install or release was performed.
• External editors can still race the final hash-check/rename window. A crash between kernel creation and journaling may leave an unrecorded orphan. Unsaved drafts are process-local; 16 retained sessions have no eviction/discard/reload yet. Unknown execution requires explicit recovery. UI and MCP remain Notebooks 3/4: run cells from the side-pane notebook viewer #212–Notebooks 4/4: agent MCP tools for notebooks (create, edit, run, read outputs, list kernels) #213.

Merge Danger

Door: Two-way

Blast Radius: Server

Optional project profiles and notebook-owned persistence/journal files; no automatic code execution on open or notebook-metadata installation.

Implemented and independently checked with Codex GPT-6.1 Sol through T3 Code's Codex harness.