Two known gaps exposed by daemon-owned notebook loading (#598, PR #602) that share a root cause: what is the canonical document when creating a room?

1. Saved-notebook reconnect loses unsaved edits

When the daemon restarts, OpenNotebook creates a fresh room and loads from .ipynb on disk. Any unsaved edits that were in the Automerge doc (persisted to notebook-docs/*.automerge) are discarded — new_fresh deletes the persisted doc for file-path-based notebook_ids.

The fix for untitled notebooks (PR #602) preserves persisted docs for UUID-based IDs. The same approach could work for saved notebooks: prefer the persisted Automerge doc over .ipynb when it exists and is newer. But this conflicts with external edit detection — if someone edited the .ipynb outside the app, we'd want the file version.

Possible approach: On room creation, if both .ipynb and persisted Automerge doc exist, compare timestamps. If the Automerge doc is newer (unsaved edits), load it. If the .ipynb is newer (external edit), load from disk. The file watcher already handles merging external edits into a live room — the same logic could apply at room creation.

2. Trust verification for restored untitled notebooks

new_fresh calls verify_trust_from_file(PathBuf::from(notebook_id)). For UUID-based untitled notebooks, this path doesn't exist, so trust defaults to NoDependencies. If an untitled notebook had inline deps that were previously trusted, after daemon restart the deps are treated as having no dependencies — skipping the trust prompt.

Fix: After loading a persisted Automerge doc, verify trust from the doc's metadata instead of from a file path. verify_trust_from_file reads the .ipynb JSON to extract metadata — we need an equivalent verify_trust_from_doc that reads from the NotebookDoc.

Context

Both issues are pre-existing in spirit — the old code had similar gaps masked by the Tauri side carrying cells through session restore. Daemon-owned loading made the daemon the sole content owner, exposing these gaps.

Future consideration: git-based notebooks add another source of truth (working tree vs committed version). The canonical document resolution will need to account for this eventually.