  Computational notebooks have emerged as the platform of choice for data
science and analytical workflows, enabling rapid iteration and exploration. By
keeping intermediate program state in memory and segmenting units of execution
into so-called "cells", notebooks allow users to execute their workflows
interactively and enjoy particularly tight feedback. However, as cells are
added, removed, reordered, and rerun, this hidden intermediate state
accumulates in a way that is not necessarily correlated with the code visible
in the notebook's cells, making execution behavior difficult to reason about,
and leading to errors and lack of reproducibility. We present NBSafety, a
custom Jupyter kernel that uses runtime tracing and static analysis to
automatically manage lineage associated with cell execution and global notebook
state. NBSafety detects and prevents errors that users make during unaided
notebook interactions, all while preserving the flexibility of existing
notebook semantics. We evaluate NBSafety's ability to prevent erroneous
interactions by replaying and analyzing 666 real notebook sessions. Of these,
NBSafety identified 117 sessions with potential safety errors, and in the
remaining 549 sessions, the cells that NBSafety identified as resolving safety
issues were more than $7\times$ more likely to be selected by users for
re-execution compared to a random baseline, even though the users were not
using NBSafety and were therefore not influenced by its suggestions.
