refactor(compact): turn-agnostic retention + dedicated agent/pre-request seam

Reform the compaction blueprint so a runaway turn survives and the design
stops drifting across review rounds:

- Drop in-flight-turn protection ("layer 2"). Retention is a uniform tail→head
  whole-unit walk; the only structural guard is step-alignment. A single turn
  that alone exceeds the window now compacts its own early closed steps instead
  of being retained verbatim (the failure mode that motivated this).
- Move auto-compaction off the agent/request waterfall onto a new awaited
  agent/pre-request loop seam, fired before history derivation. Compaction
  mutates the surface; the loop derives once from the result — no double-derive,
  and a listener structurally cannot act on not-yet-derived messages.
- Tighten compactIfNeeded to required (session, system, model, signal).
- Enforce a single-pass convergence invariant in resolveConfig: reject configs
  where summarizationMaxTokens + retainTokens exceeds the threshold, so a
  compaction can never immediately re-trigger.
- Document the crash vs recoverable failure taxonomy; core session repair stays
  compaction-agnostic (a log-only orphaned compact/start is inert).
- Wire dsh-compact-basic into examples/coding-agent and add a with-key
  compaction e2e (compaction's first real-world exercise + runaway net).
- Rewrite the RFC to encode the blueprint and move it to implemented/.

The runaway-turn snapshot is a named deferred follow-up: dsh-llm-replay cannot
yet serve the interleaved summarization model call.

packages/compact/compact/src/index.ts

@@ -16,7 +16,7 @@
  * depends on `dsh-session` and `dsh-llm`: the contract's verbs are defined over
  * a `Session` and its output is the `ContentBlock` vocabulary. That deviation
  * from the "interface depends only on cordis" guidance is intentional and
- * recorded in the [compaction capability-seam RFC](../../../../docs/rfc/proposed/feature/2026-06-18-compaction-capability-seam.md).
+ * recorded in the [compaction capability-seam RFC](../../../../docs/rfc/implemented/feature/2026-06-18-compaction-capability-seam.md).
  *
  * @module @deepseek-ai/dsh-compact
  */
@@ -62,14 +62,31 @@ export abstract class CompactService extends Service {
   /**
    * Check token pressure and compact if the conversation is too large.
    *
-   * Estimates the current history size (optionally including a system prompt),
-   * and if it exceeds the backend's threshold, compacts an older range via
-   * {@link compactRegion}, keeping recent context intact.
+   * Estimates the current surface-derived history size (including the system
+   * prompt), and if it exceeds the backend's threshold, compacts an older range
+   * via {@link compactRegion}, keeping recent context intact. Returns `null`
+   * when no compaction is needed.
+   *
+   * Scope and guarantees a backend MUST honor:
+   * - **Surface-derived history only.** The decision is made against the history
+   *   derived from the session surface — the only thing compaction can act on.
+   *   Non-surface context injected downstream (into the request `messages` by a
+   *   later listener) is out of this accounting by construction.
+   * - **Head-anchored, best-effort.** Auto-compaction consolidates from the
+   *   surface HEAD up to a step-aligned cutoff, so a prior head checkpoint is
+   *   re-summarized into one fresh checkpoint (the surface holds at most one
+   *   auto-generated checkpoint, always at the head). It is best-effort over
+   *   CLOSED steps: when the only compactable content left is an un-splittable
+   *   open tail step, it declines (`null`) and retries once that step closes.
+   * - **Single-unit overflow is out of scope.** If a single retained unit (one
+   *   closed step, or a large free node such as a pasted `user/message`) ALONE
+   *   exceeds the budget, compaction cannot help and the call may go out
+   *   over-budget. Bounding an individual unit's size is a separate concern.
    *
    * @param session - the session whose surface may be compacted.
-   * @param systemPrompt - optional system prompt, counted toward the estimate.
-   * @param model - optional summarization model (falls back to backend config).
-   * @param signal - optional cancellation signal. A backend that summarizes via
+   * @param system - the assembled system prompt, counted toward the estimate.
+   * @param model - the summarization model (a backend may override via config).
+   * @param signal - cancellation signal. A backend summarizing via
    *   `ctx.llm.stream()` MUST forward this into the call's `GenerateOptions.signal`
    *   so an abort/dispose tears down the in-flight summarization rather than
    *   leaving an orphaned model call running past the cancellation.
@@ -77,9 +94,9 @@ export abstract class CompactService extends Service {
    */
   abstract compactIfNeeded(
     session: Session,
-    systemPrompt?: string,
-    model?: string,
-    signal?: AbortSignal,
+    system: string,
+    model: string,
+    signal: AbortSignal,
   ): Promise<CompactionResult | null>
 
   /**