…CellType fallback ladder

Completes Phase 5's read-method carve-out. createModelToolsClient is the sole
client and always provides getCellBasics, so the per-field getCellSql/getCellType
fallbacks in dispatch and applyNotebookState were unreachable in production.
Removes the interface optionals, both method bodies, the orphaned findCellSoft
helper, and rewrites the tests that relied on the fallback onto getCellBasics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

…e-export cleanup

Un-exports six notebooks/ module symbols referenced only within their own file,
removes the always-false `activate` knob from the create/duplicate options and
both call sites, fixes four import-then-re-export cases by pointing consumers at
each symbol's real source, repairs a leaked comment fragment in bufferOwnership,
and removes the obsolete SIMPLIFY_PLAN.md (UNIFY_PLAN.md already gone).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

On a mounted notebook, the live runCell wrapper inferred its result by
object-identity diff against the pre-run result. When a user's manual Run
superseded the agent's in-flight run, the cell then held the user's result,
which the wrapper misattributed to the agent — returning success:false/pending
with no unverified note for a write that had actually committed, so the agent
could re-run it and duplicate the DML.

Thread a `superseded` flag out of the live run (useCellExecution → provider
runCell) as a `CellRunOutcome`, and on supersession have the controller return
the SUPERSEDED_RUN_NOTE the headless path already emits, instead of reading the
newer run's result back. Adds Given/When/Then tests for the live runCell
supersede, normal-record, and no-op cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

…tch (phase 5)

Lands phase 5 additively on top of the #1 supersede fix and the phase-6 sweep,
reconciled so both survive.

- NotebookController -> { bufferId, kind, mutate, readView, runCell }; drop the
  named ops and makeNotebookControllerOps; dispatch builds a transition and
  calls withBoundNotebook(ctrl.mutate) / readView directly
- strip ModelToolsClient to the quest + workspace surface; delete the
  isLiveController pre-checks (validation already lives in the transitions)
- move read serializers into notebookSnapshot; buildSnapshot reads via readView
- preserve the live runCell CellRunOutcome/superseded reporting from the #1 fix
  in the collapsed wrapper, plus its re-homed unknown_cell guard
- keep the sweep's NotebookToolError source import and the dropped activate knob

Original phase-5 authored on machine A; reconciled onto origin here.

Co-Authored-By: emrberk <emreberk5699@gmail.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

list_cells (summarizeCells) omitted the cell `name`, while get_cell and
get_notebook_state return it — an inconsistency a model/caller could trip on
when correlating cells by name. Surface `name` on NotebookCellSummary when set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

…ss the read-only gate

A write the validator rejects (e.g. a type-mismatched INSERT) returns an error
result, so classifyStatements maps it to `ERROR`, not `DDL_DML`. The permission
gates only denied on `DDL_DML`, so an ERROR-classified write PASSED the gate and
was sent to /exec — verified live via MCP: a read-only agent's INSERT reached the
server (blocked only by demo's own 403; a writable instance would have run it).

Fail closed: under read-only permission, only confirmed DQL may execute. Any
statement the validator can't confirm as a read (klass ERROR) is treated as a
possible write — run_query / run_cell deny it, add_cell auto-run skips it. The
validator's error is surfaced in the message so the agent knows why. classifyStatements
now carries the validator error on ERROR statements.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQfYWS6dFLNBxZ2ncyTNyW

…n't bypass the read-only gate"

This reverts commit 0569fd4.

…ssive-notebook-edits

…ssive-notebook-edits