[Bug][DSH] Fork loses fold inheritance without adoption diagnostics; interrupted preflight leaves child in repeated local 413 #4215

Summary

A compressed long-running DSH desktop session was forked through the host UI. The child replayed thousands of raw messages without inheriting the parent's billion-context fold state, entered multi-minute emergency preflight, disconnected after approximately five minutes, and subsequent retries consistently failed locally with 413.

Related: #3011 (DSH fork adoption failure), #3025 (retroactive adoption conflict), #3978 (long preflight + client disconnect), #4079 (overflow/recovery tracking), #4082 (request-scoped attribution).

Important distinction from #3011: we did NOT find a fork adoption ... degraded, snapshot-409, or successful-adoption log for this child. A 409 root cause is NOT established here. Please investigate silent skipping of the adoption entry path as well as recovery after interrupted preflight.

Environment / version caveat

• Windows, DSH desktop, native billion-context plugin, OpenAI Codex Responses lane.
• Model: gpt-6.1-sol; reported window: 744000.
• Incident proxy logs: v0.1.202.
• Installed bundle inspected later: 0.1.203; upstream master also inspected at c87185a05a44ecccc225f96f92089e8f309fb1d9.
• We have not recovered the incident-time native-plugin bundle; current-source suspicions below are NOT presented as a proven 0.1.202 stack trace.
• Parent/child IDs, usernames, business content, credentials and full transcripts are deliberately omitted.

Verified evidence

1. The DSH child session header has isSeeded: true and the correct parentSession. The host copies the source event prefix into the new session (buildForkSeed -> agents.create). Host Session really exposes .header; requestHeader() is a different, folded model-request-header API and should not replace that branch metadata.
2. The last successful inherited model call had totalTokens: 155439.
3. Read-only inspection of bili's persisted SQLite state found:
   • Parent: 174 blocks / 151 active at investigation time (parent had later activity; these counts are NOT claimed to be the exact branch-time counts).
   • Child: exactly 1 block / 1 active, parent_session_id = NULL, fork_point_seq = NULL, no fork-receipt metadata.
   • The child's only block was b1, created during its own emergency preflight for m02870–m02924, not an inherited parent block.
4. Child's first proxy request: processTurn: 8359 msgs; estimated context 2242367 tokens. This is a local estimate, not upstream measured billing.
5. No fork adoption log was found in the inspected incident log. That is an observation, not proof that a particular skip predicate fired.

Sanitized incident timeline (UTC)

2026-10-21T17:00:58.421Z child: stamped type:"message" on 785 type-less input item(s)
2026-10-21T17:01:06.364Z child: processTurn: 8359 msgs
2026-10-21T17:01:06.674Z child: context 2242367 tokens reached preflight target 744000; preflight compressing before forward
2026-10-21T17:01:16.187Z preflight: round 1/32 ... 405 viable range(s)
2026-10-21T17:04:04.973Z compress requested m02870–m02924
2026-10-21T17:04:13.935Z compressed ... 1 block(s), ~35259 tokens saved; b1 summary 19955ch
2026-10-21T17:04:21.672Z preflight: round 2/32
2026-10-21T17:05:55.332Z preflight: summarization aborted: client disconnected
2026-10-21T17:06:05.118Z child: preflight aborted ... not forwarding
2026-10-21T17:06:08.209Z persist: cold-loaded child ... 8353 ref(s), 1 block(s) (1 active)
2026-10-21T17:06:18.808Z preflight fail-fast 413 (retryable=false): payload core text alone is ~5742630 bytes ... >= ~765684 tokens vs model window 744000 ... NOT forwarded

Further retries produced the same local rejection with 5742677 / 5742724 / 5742771 bytes. No model request succeeded in this child. The byte-density figures are lower bounds, NOT exact tokenizer counts.

Current-source suspicion: attribution and fork discovery use different identity paths

In src/agent/dsh-native.ts at the master commit above:

• attributionOf(ctx) first uses sidScope.getStore() populated from llm/stream request options.sessionId (Why did it spike to several M tokens: after dsh attribution was lost, requests bypassed bili and were sent directly, ren | 为什么会涨到几 M tokens：dsh 归因丢失后请求绕过 bili 直发，压缩与护栏全部失效 #4082).
• forkChildOf(ctx) ONLY uses ctx.agents?.currentInitiator?.()?.session, catches exceptions and returns undefined, and silently returns when the session/header is missing.
• maybeForkAdoptBeforeSend then silently returns when the child cannot be discovered. Other silent skips include toolsReady/body/base/side-shaped-request checks.

Thus a correctly identified proxy conversation does not imply that fork-parent discovery ran. A request with a valid scoped session ID but missing/cleared ambient initiator can take the normal compression lane while skipping adoption entirely. This fits the observed absence of adoption logs, but we have not reproduced that exact scope condition in the incident.

Other relevant current-state finding: parent metadata currently has publicSnapshotTextComparable: false (snapshot ~28.5 MB). Current snapshot code would refuse opaque/multimodal comparison. We do not claim that flag had the same value at branch time or that a snapshot request/409 actually occurred.

Expected behavior

Fork a previously compressed session without unfolding its entire raw history, or explicitly stop admission with a useful, recoverable explanation when inheritance cannot be established. A failed/aborted emergency preflight should not leave the child in a retry -> immediate-413 loop with no usable recovery path.

Requested investigation / acceptance tests

1. Carry explicit branch identity with the request scope, or resolve the scoped session ID to validated host branch metadata; do not rely solely on ambient currentInitiator() for fork discovery.
2. Add structured diagnostics for EVERY skipped fork-adoption gate, distinguishing not-a-fork from missing attribution/session/header and protocol/snapshot rejection.
3. Do not silently degrade a large compressed parent into an uncompressed child when that history cannot fit. Preserve the safe overflow guard, but provide an actionable recovery/adoption path.
4. Verify retry semantics for temporarily unavailable snapshots and CHILD_CONFLICT after a first degraded request (related issues above).
5. Test interrupted preflight: persist progress and allow a subsequent request to resume shrinking rather than repeatedly fail-fast without further progress.
6. Regression matrix: normal fork; parent cold-load/eviction; valid request-scoped ID + absent ambient initiator; opaque/multimodal history; fork through a fold boundary; client disconnect mid-preflight and retry.

No live sessions, compression DB, host services, or business configuration were modified during this investigation. No full transcript/database is attached for privacy reasons. Please treat the missing inheritance + preflight/retry chain as confirmed and the exact adoption-entry skip as still requiring instrumentation/reproduction.