feat(agent-loop): give each send its own turn

docs/core-data-structures/core.md

@@ -262,8 +262,9 @@ interface Agent {
   readonly ctx: Context
 
   /**
-   * Queue a user message. Starts a turn when idle; otherwise waits for the next
-   * turn. Content and the resolved source are accepted as one detached,
+   * Queue one user-message FIFO item. Unless cleared before turn start, the
+   * item becomes the sole ordinary message in its turn and waits for every
+   * preceding turn's durability checkpoint. Content and the resolved source are accepted as one detached,
    * deeply-frozen lossless-JSON record before notification or enqueue, so
    * caller or `agent/queued` listener in-place mutation cannot change later
    * log/model input. Throws synchronously when either value is not losslessly
@@ -308,8 +309,8 @@ interface Agent {
    * - drops a turn that is about to start (a `cancel()` landing in the
    *   pre-step window — after a `send()` queued but before the loop flips to
    *   `running`, or after `running` is emitted but before the first step) so
-   *   that queued prompt does not run and cannot be batched into the cancelled
-   *   turn.
+   *   that queued prompt does not run; later accepted items remain independent
+   *   queued turns.
    *
    * After `cancel()`, `whenIdle()` resolves on the post-cancel quiescent state.
    * `cancel()` on an idle agent with nothing queued or running is a safe no-op
@@ -364,7 +365,7 @@ interface HookContext {
 }
 ```
 
-`agent/prompt-submit` returns a `PromptDecision` (allow a drained queued message — optionally rewriting its `content` or attaching `additionalContext` — or block it; a batch whose every prompt is blocked opens a zero-step turn that ends `rejected`):
+`agent/prompt-submit` returns a `PromptDecision` (allow the turn's claimed queued message — optionally rewriting its `content` or attaching `additionalContext` — or record `prompt/blocked` and end that zero-step turn as `rejected`):
 
 ```ts type-equiv
 type PromptDecision =

docs/core-data-structures/session.md

@@ -19,9 +19,8 @@ interface SessionEventMap {
   /**
    * A queued prompt an `agent/prompt-submit` listener VETOED — the durable
    * record of a blocked prompt and why. Appended in place of the `user/message`
-   * the prompt would have become, so the block survives replay even in a MIXED
-   * batch where another queued prompt is allowed (there the turn does not end
-   * `rejected`, so the boundary reason alone would not preserve it). `content`
+   * the prompt would have become; that one-message turn runs zero steps and
+   * ends `rejected`. `content`
    * is the original prompt the listener rejected; `reason` is the veto text
    * ({@link PromptDecision} `block.reason`). NOT a {@link SurfaceEventType}: a
    * blocked prompt produces no LLM message and never reaches `deriveMessages()`.
@@ -268,9 +267,8 @@ interface TurnEndReasonMap {
   disposed: { kind: 'disposed' }
   'max-tokens': { kind: 'max-tokens' }
   /**
-   * The turn's entire prompt batch was BLOCKED before any step ran — every
-   * drained queued message was vetoed by an `agent/prompt-submit` listener (a
-   * hook). The turn still opened (so the boundary stays balanced and the block
+   * The turn's claimed prompt was BLOCKED before any step ran by an
+   * `agent/prompt-submit` listener (a hook). The turn still opened (so the boundary stays balanced and the block
    * is a durable in-turn fact), but ran zero steps. `reason` carries the block
    * message from the vetoing decision. Distinct from `aborted` (a user-driven
    * cancel) and `error` (a failure): the prompt was rejected by policy, not
@@ -291,7 +289,7 @@ interface TurnEndReasonMap {
 }
 ```
 
-`max-tokens` mirrors the model-call `FinishReason` of the same name: any `max-tokens` step in a turn makes the whole turn end `max-tokens` rather than `completed` (the cut-short fact wins over a later continuation), so a consumer can tell a clean stop from a truncated one — but only over `completed`: the `disposed`/`aborted`/`error` outcomes take precedence. `rejected` is a zero-step turn whose whole prompt batch an `agent/prompt-submit` hook blocked (the ACP bridge maps it to `cancelled`). `interrupted` is the one reason no loop emits — it is synthesized by crash recovery (see [persistence.md](persistence.md)). Both maps are merge-extensible.
+`max-tokens` mirrors the model-call `FinishReason` of the same name: any `max-tokens` step in a turn makes the whole turn end `max-tokens` rather than `completed` (the cut-short fact wins over a later continuation), so a consumer can tell a clean stop from a truncated one — but only over `completed`: the `disposed`/`aborted`/`error` outcomes take precedence. `rejected` is a zero-step turn whose claimed prompt an `agent/prompt-submit` hook blocked (the ACP bridge maps it to `cancelled`). `interrupted` is the one reason no loop emits — it is synthesized by crash recovery (see [persistence.md](persistence.md)). Both maps are merge-extensible.
 
 ## The turn-enclosure invariant