refactor(compact): turn-agnostic retention + dedicated agent/pre-request seam

Reform the compaction blueprint so a runaway turn survives and the design
stops drifting across review rounds:

- Drop in-flight-turn protection ("layer 2"). Retention is a uniform tail→head
  whole-unit walk; the only structural guard is step-alignment. A single turn
  that alone exceeds the window now compacts its own early closed steps instead
  of being retained verbatim (the failure mode that motivated this).
- Move auto-compaction off the agent/request waterfall onto a new awaited
  agent/pre-request loop seam, fired before history derivation. Compaction
  mutates the surface; the loop derives once from the result — no double-derive,
  and a listener structurally cannot act on not-yet-derived messages.
- Tighten compactIfNeeded to required (session, system, model, signal).
- Enforce a single-pass convergence invariant in resolveConfig: reject configs
  where summarizationMaxTokens + retainTokens exceeds the threshold, so a
  compaction can never immediately re-trigger.
- Document the crash vs recoverable failure taxonomy; core session repair stays
  compaction-agnostic (a log-only orphaned compact/start is inert).
- Wire dsh-compact-basic into examples/coding-agent and add a with-key
  compaction e2e (compaction's first real-world exercise + runaway net).
- Rewrite the RFC to encode the blueprint and move it to implemented/.

The runaway-turn snapshot is a named deferred follow-up: dsh-llm-replay cannot
yet serve the interleaved summarization model call.

packages/compact/compact/README.md

@@ -10,7 +10,7 @@ This package is the interface tier of the compaction capability, split so each c
 | `@deepseek-ai/dsh-compact-basic` | a backend: char/4 estimation + token-budget retention + `llm.stream()` summarization |
 | `@deepseek-ai/dsh-tool-compact` (deferred) | the model-facing `/compact` tool over `ctx.compact` |
 
-Unlike the bash seam, this interface depends on `@deepseek-ai/dsh-session` and `@deepseek-ai/dsh-llm` — the contract's verbs are defined over a `Session` and its output is the `ContentBlock` vocabulary, so they cannot be expressed without naming those packages. That deviation from the "interface depends only on cordis" guidance is intentional and recorded in the [compaction capability-seam RFC](../../../docs/rfc/proposed/feature/2026-06-18-compaction-capability-seam.md).
+Unlike the bash seam, this interface depends on `@deepseek-ai/dsh-session` and `@deepseek-ai/dsh-llm` — the contract's verbs are defined over a `Session` and its output is the `ContentBlock` vocabulary, so they cannot be expressed without naming those packages. That deviation from the "interface depends only on cordis" guidance is intentional and recorded in the [compaction capability-seam RFC](../../../docs/rfc/implemented/feature/2026-06-18-compaction-capability-seam.md).
 
 ## Service API (`ctx.compact`)
 
@@ -18,10 +18,10 @@ Both methods are **abstract** — the backend owns the entire strategy (token es
 
 | Member | Semantics |
 |---|---|
-| `compactIfNeeded(session, systemPrompt?, model?, signal?)` | Estimate the history size; if over the backend's threshold, compact an older range via `compactRegion`, keeping recent context intact. Returns the `CompactionResult`, or `null` if nothing needed compacting. |
+| `compactIfNeeded(session, system, model, signal)` | Estimate the surface-derived history size; if over the backend's threshold, compact an older range via `compactRegion`, keeping recent context intact. Returns the `CompactionResult`, or `null` if nothing needed compacting. All parameters required — the loop's `agent/pre-request` checkpoint always supplies the assembled `system`, the `model`, and the turn `signal`. |
 | `compactRegion(session, start, end, model, signal?)` | Forcibly summarize surface nodes `[start, end]` (inclusive seqs) into a single replacement node. **Throws** if a compaction is already in progress, if `start`/`end` aren't surface nodes, or if `start` is positioned after `end` on the surface. The range is a SURFACE-POSITION span, not a numeric seq interval — after a prior replace lands a fresh high-seq summary node at the shadowed range's position, surface order no longer tracks seq order. |
 
-Both methods take an optional `signal: AbortSignal`. A backend that summarizes via `ctx.llm.stream()` **must** forward it into the call's `GenerateOptions.signal`, so an abort or fiber dispose tears down the in-flight summarization instead of leaving an orphaned model call running past the cancellation. The turn that the `compact/*` events belong to is not a parameter — it is recoverable from the log (the currently-open turn), so the backend stamps it without the caller supplying it.
+`compactIfNeeded` takes a required `signal`; `compactRegion`'s is optional. A backend that summarizes via `ctx.llm.stream()` **must** forward it into the call's `GenerateOptions.signal`, so an abort or fiber dispose tears down the in-flight summarization instead of leaving an orphaned model call running past the cancellation. The turn that the `compact/*` events belong to is not a parameter — it is recoverable from the log (the currently-open turn), so the backend stamps it without the caller supplying it.
 
 ## Surface contract
 

packages/compact/compact/src/index.ts

@@ -16,7 +16,7 @@
  * depends on `dsh-session` and `dsh-llm`: the contract's verbs are defined over
  * a `Session` and its output is the `ContentBlock` vocabulary. That deviation
  * from the "interface depends only on cordis" guidance is intentional and
- * recorded in the [compaction capability-seam RFC](../../../../docs/rfc/proposed/feature/2026-06-18-compaction-capability-seam.md).
+ * recorded in the [compaction capability-seam RFC](../../../../docs/rfc/implemented/feature/2026-06-18-compaction-capability-seam.md).
  *
  * @module @deepseek-ai/dsh-compact
  */
@@ -62,14 +62,31 @@ export abstract class CompactService extends Service {
   /**
    * Check token pressure and compact if the conversation is too large.
    *
-   * Estimates the current history size (optionally including a system prompt),
-   * and if it exceeds the backend's threshold, compacts an older range via
-   * {@link compactRegion}, keeping recent context intact.
+   * Estimates the current surface-derived history size (including the system
+   * prompt), and if it exceeds the backend's threshold, compacts an older range
+   * via {@link compactRegion}, keeping recent context intact. Returns `null`
+   * when no compaction is needed.
+   *
+   * Scope and guarantees a backend MUST honor:
+   * - **Surface-derived history only.** The decision is made against the history
+   *   derived from the session surface — the only thing compaction can act on.
+   *   Non-surface context injected downstream (into the request `messages` by a
+   *   later listener) is out of this accounting by construction.
+   * - **Head-anchored, best-effort.** Auto-compaction consolidates from the
+   *   surface HEAD up to a step-aligned cutoff, so a prior head checkpoint is
+   *   re-summarized into one fresh checkpoint (the surface holds at most one
+   *   auto-generated checkpoint, always at the head). It is best-effort over
+   *   CLOSED steps: when the only compactable content left is an un-splittable
+   *   open tail step, it declines (`null`) and retries once that step closes.
+   * - **Single-unit overflow is out of scope.** If a single retained unit (one
+   *   closed step, or a large free node such as a pasted `user/message`) ALONE
+   *   exceeds the budget, compaction cannot help and the call may go out
+   *   over-budget. Bounding an individual unit's size is a separate concern.
    *
    * @param session - the session whose surface may be compacted.
-   * @param systemPrompt - optional system prompt, counted toward the estimate.
-   * @param model - optional summarization model (falls back to backend config).
-   * @param signal - optional cancellation signal. A backend that summarizes via
+   * @param system - the assembled system prompt, counted toward the estimate.
+   * @param model - the summarization model (a backend may override via config).
+   * @param signal - cancellation signal. A backend summarizing via
    *   `ctx.llm.stream()` MUST forward this into the call's `GenerateOptions.signal`
    *   so an abort/dispose tears down the in-flight summarization rather than
    *   leaving an orphaned model call running past the cancellation.
@@ -77,9 +94,9 @@ export abstract class CompactService extends Service {
    */
   abstract compactIfNeeded(
     session: Session,
-    systemPrompt?: string,
-    model?: string,
-    signal?: AbortSignal,
+    system: string,
+    model: string,
+    signal: AbortSignal,
   ): Promise<CompactionResult | null>
 
   /**

packages/compact/compact/src/types.ts

@@ -6,7 +6,7 @@
  * events are log-only markers (lock + provenance); only the five
  * surface-eligible types can carry `surfaceOp`. The actual surface mutation is
  * performed by a separate `user/message` event carrying the summary (see the
- * [compaction capability-seam RFC](../../../../docs/rfc/proposed/feature/2026-06-18-compaction-capability-seam.md)).
+ * [compaction capability-seam RFC](../../../../docs/rfc/implemented/feature/2026-06-18-compaction-capability-seam.md)).
  *
  * Configuration lives in the backend, not here: the contract states WHAT
  * compaction produces, while every tunable (context window, thresholds,