Let the plan be edited by block

An agent cannot hold a cursor, so it edits the way it reads: by position in the
list of top-level blocks. A batch names the revision it was written against and
is refused outright if the plan has moved on, because a half-applied batch is
worse than none. Within a batch every index resolves against the document as it
was read, so two operations cannot shift each other's targets.

Nothing is written until the whole result has proven itself. The batch is
assembled on the parsed document, serialised, re-parsed and validated —
`<script>` is perfectly good MDX and entirely outside this dialect, so parsing
alone would let it reach the room.

Only then is it reconciled into the live document rather than replacing it.
Blocks the agent did not touch keep their identity, so somebody typing
alongside it keeps their cursor, their selection and their undo history, and
peers receive one ordinary update instead of a new epoch.

Ids are minted here rather than accepted from the agent. Durable state hangs
off them, and a model that copies a block it read copies the id with it, so a
batch containing the same id twice is refused with an explanation.