session-format-v3-to-v4 refuses valid sessions: system/message must not be required to be the first surface node

[Paimonshen]

Describe the bug and which rule is wrong.

Package: @deepseek-ai/dsh-session-format-v3-to-v4 (packages/session/session-format-v3-to-v4/src/relationships.ts, foldSurface)

foldSurface refuses any system/message that does not become the very first surface node of the whole log:

if (event.type === 'system/message' && this.surface.length > 0 && this.protectedHead === undefined)
  throw new SessionFormatError('system/message requires a protected first surface head')

protectedHead is assigned only when a system/message is appended onto a then-empty surface. So the guard fires for every system/message preceded by any other surface node — a session whose model-visible history starts with a user/message and whose first system/message arrives later cannot migrate, permanently, with no user-side recovery.

The native rule in @deepseek-ai/dsh-session (packages/core/session/src/surface.ts, assertSystemHeadRewrite) protects the system prompt positionally at node 0, and only while that node holds a system/message. It guards replacements only, and requires nothing about what node 0 is:

if (startIdx !== 0) return
const head = events[state.nodes[0] - baseSeq]
if (head?.type !== 'system/message') return

The package README already states the intended behaviour ("The protected first system head can be replaced only by one system message covering exactly that head"), so this looks like an implementation that drifted from its own documented rule.

Minimal reproduction

In a valid open turn and step:

turn/start  turn=1
step/start  turn=1 step=1
user/message    surfaceOp=append    <- node 0, not a system/message
system/message  surfaceOp=append

Real case: an imported 26,124-event V3 history whose first system/message is at seq 2337, with 995 surface nodes ahead of it. The artifact itself is fine — native V4 foldSurface accepts the migrated result (1,091 final surface nodes).

Suggested change

• drop the event-time guard, so a later system/message is an ordinary appended surface node
• key the protected head on node position (first === 0) rather than node identity
• promote a system/message that reaches node 0 through a replacement

A replacement still may not shadow a real node 0 system head, and a promoted head gains that protection — which the current identity check silently loses, so this also fixes the opposite direction.

Note this changes documented, tested behaviour: tests/relationships.spec.ts currently asserts that [turn/start, step/start, user/message, system/message] must throw, which is the mis-encoded rule.

Two related copies worth knowing about

1. dsh-session-persistence-jsonl bundles its own copy. lib/worker.cjs is a full independent copy of the format code, loaded with new Worker(new URL('./worker.cjs', import.meta.url)) (lib/index.js:1446-1493). It carries its own instance of this same guard, so patching the migration package alone has no effect on the worker path — a test that imports the package exercises a different code path than production.

2. session-format-v2-to-v3/src/validation.ts:43 has the same over-strict idea, plus two extra invariants that re-key head through replace.startSeq/endSeq. Removing the guard there without re-deriving head positionally was measured over 141 stored sessions and broke 125 of them, so the v3→v4 edit cannot simply be transplanted. It needs a separate fix.

Relationships.span also still guards compaction against the system head, while native V4 does not treat compaction/* as surface-eligible at all.

I have a validated fix for the v3→v4 edge (3,168 session tests pass, typecheck and lint clean) but could not open a PR — CONTRIBUTING.md states external pull requests are not accepted at the moment. Happy to provide the patch if that is useful.