[Bug] v3→v4 migration refuses sessions written by older dsh: late system/message append on a surface with no protected head

[CwavGuy]

Host: dsh 0.1.7-rc.2 (web profile). Two v3 sessions fail to migrate on every read:
SessionFormatUnsupportedError: Session migration from v3 to v4 refuses the transformed artifact: system/message requires a protected first surface head

The rule in dsh-session-format-v3-to-v4 foldSurface() throws when a system/message is appended while surface.length > 0 && protectedHead === undefined.

The offending artifact (produced by an earlier dsh, during a mid-session model switch) has:

• idx 3, seq 2: user/message, surfaceOp: append → surface starts with a user message, so no protected head is ever established
• idx 38, seq 37: system/message, surfaceOp: append, data.message.source = {"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"}

So the migration refuses a log its own older writer produced, making those conversations permanently unreadable — while the source artifact stays untouched (good), the sessions are inaccessible.

Expected: either migrate such a session (e.g. treat a non-head system/message as an opaque ignorable record, preserving the payload) or surface it as a degraded read instead of refusing the session.

None of the 22 sessions' other v3 artifacts are affected; only artifacts containing a non-head system/message.

[CwavGuy]

The content is generated by Deepseek.