fix(compact): decide step-alignment from surface tool-pairing, fire compaction pre-step (CBR-001)

Codex round 1 CBR-001: a head-anchored compaction checkpoint was
mis-classified by the log-position step-alignment scan, so a second
auto-compaction over a checkpoint-headed surface silently failed.

Root cause: `isStepAlignedStart/End` scanned the LOG by seq, but a
`replace` op lands a checkpoint at a high log seq whose SURFACE position
is the head — its log neighbours (the open step's assistant/message) are
not its surface neighbours, so the forward scan wrongly reported mid-step.

Fix, per the agreed direction:
- Replace the two log-position predicates with one surface-anchored
  helper `isToolPairingBalanced(nodes, events, beforeSeq)` in
  `dsh-session` (renamed step-boundary.ts → tool-pairing.ts). A cut is
  balanced when no unanswered tool-call precedes it on the surface; a
  region is collapsible iff both edges are balanced cuts. The open-tail
  and free-node cases fall out of the same counter. It also throws on a
  corrupt surface (a tool/result with no matching call).
- Move compaction off the in-step seam to a new "pre-step" seam fired
  after turn/start and before step/start, so a compaction's log-only
  compact/* records and its replacement node land cleanly OUTSIDE any
  step (the honest structure crash-safety relies on). Renamed the event
  agent/pre-request → agent/pre-step and switched its dispatch from
  parallel → serial (listeners mutate the surface as a side effect;
  serial isolates them so concurrent appends can't interleave). Extended
  the catalog generator to accept @mode serial.

Regression coverage: a real-loop test driving an auto-compaction asserts
the landed checkpoint is a balanced cut on both sides; unit tests pin the
checkpoint case, the mid-step injection case, multi-call steps, and the
corrupt-surface guard. Proven red on the old log-position logic.

scripts/gen-cordis-catalog.ts

@@ -23,8 +23,8 @@
  *
  * The HARNESS tier (the `@deepseek-ai/dsh-*` events + services) is rendered in
  * full from source: signature, the `@mode` badge, and the declaration's JSDoc.
- * Every harness event MUST carry an `@mode emit|waterfall|parallel` tag — the
- * generator hard-errors on a missing tag, and where the signature shape is
+ * Every harness event MUST carry an `@mode emit|waterfall|parallel|serial` tag
+ * — the generator hard-errors on a missing tag, and where the signature shape is
  * conclusive (a trailing `next: () => …` parameter is structurally a waterfall)
  * it asserts the tag agrees and hard-errors on a contradiction. The INHERITED
  * tier (cordis core + loader/hmr/timer) is pinned vendor source a plugin author
@@ -48,7 +48,7 @@ const OUT = 'docs/cordis-catalog/events-and-services.md'
 const FENCE = 'ts cordis-catalog'
 
 /** A dispatch mode, rendered as the badge after an event name. */
-type Mode = 'emit' | 'waterfall' | 'parallel'
+type Mode = 'emit' | 'waterfall' | 'parallel' | 'serial'
 
 /**
  * Cross-link map: a type name that appears in a signature → the
@@ -165,7 +165,7 @@ function parseJsDoc(raw: string): { doc: string; mode: Mode | null } {
     para = []
   }
   for (const line of inner) {
-    const m = /^@mode\s+(emit|waterfall|parallel)\s*$/.exec(line)
+    const m = /^@mode\s+(emit|waterfall|parallel|serial)\s*$/.exec(line)
     if (m) { mode = m[1] as Mode; continue }
     if (line.startsWith('@')) { flushPara(); continue } // other tags end the prose
     if (line.trim() === '') { flushPara(); continue }
@@ -223,11 +223,11 @@ export function collectEvents(scanRoot: string = root): EventEntry[] {
         const { doc, mode } = parseJsDoc(rawJsDoc(text, member))
         const src = pointer(rel, sf, member)
         if (!mode) {
-          throw new Error(`gen-cordis-catalog: event '${name}' (${src}) is missing an @mode tag. Add '@mode emit|waterfall|parallel' to its JSDoc (see AGENTS.md).`)
+          throw new Error(`gen-cordis-catalog: event '${name}' (${src}) is missing an @mode tag. Add '@mode emit|waterfall|parallel|serial' to its JSDoc (see AGENTS.md).`)
         }
         // Conclusive structural check: a trailing `next: () => …` parameter is a
-        // waterfall. (emit vs parallel is not structurally distinguishable, so
-        // it is trusted from the tag.)
+        // waterfall. (emit vs parallel vs serial is not structurally
+        // distinguishable, so it is trusted from the tag.)
         const last = member.parameters.at(-1)
         const hasNext = !!last && last.name.getText(sf) === 'next'
         if (hasNext && mode !== 'waterfall') {
@@ -394,7 +394,7 @@ function render(events: EventEntry[], services: ServiceEntry[]): string {
     '',
     '## Events',
     '',
-    `Dispatch modes: **emit** (fire-and-forget), **waterfall** (each listener gets \`next()\` and may transform or veto — see [waterfall semantics](../architecture.md#cordis-waterfall-semantics-important)), **parallel** (awaited fan-out, no veto). The harness declares ${events.length} events across ${new Set(events.map(e => e.scope)).size} scopes.`,
+    `Dispatch modes: **emit** (fire-and-forget), **waterfall** (each listener gets \`next()\` and may transform or veto — see [waterfall semantics](../architecture.md#cordis-waterfall-semantics-important)), **parallel** (awaited fan-out, no veto), **serial** (awaited, in registration order, no veto). The harness declares ${events.length} events across ${new Set(events.map(e => e.scope)).size} scopes.`,
     '',
   ]
   const scopes = [...new Set(events.map(e => e.scope))].sort()