fix(dsh): complete automatic-path diagnostics and recall presentation

[knqiufan]

Which issue or RFC does this PR close?

Closes #1457. Refs #1450 (B). Depends on #1452 (A) and #1464 (Windows Server cursor-key fix).

This Draft layers B on A's fix, reapplied as 30c65c3f on upstream master fc75f927 (including #1438). A's remote branch is unchanged. The upstream PR base is master because A's branch is in the contributor fork.
B-only comparison.
After A merges, rebase B onto upstream master and rebuild the generated bundle. Live-model acceptance is also pending: the configured official DeepSeek endpoint returned HTTP 401.
The Windows native-service failure was traced to #1463: Windows text-mode writes expanded binary cursor keys, preventing Server restarts. The independent fix from #1464 is included as d2b3ee25; all 17 checks pass on this commit. Repository rerun permissions were unrelated to the test failure.

Rationale for this change

An ordinary DSH conversation can silently lose automatic Scope diagnostics or discard valid prepared context when capture or a diagnostic writer fails. Successfully injected context also lacks the host's snapshot metadata. The new registered-entry regressions reproduce these defects on A: 20 failures out of 28 initial tests.

B reuses A's error classification, endpoint semantics and Scope cancellation support, and completes their automatic pre-step integration. This fixes existing host contracts and requires no RFC.

What changes are included in this PR?

• Report Scope/prepare/capture/flush/injection failures at their own boundaries. Logger exceptions and rejected promises are best effort; existing safe fields and outcome-based 60-second cooldown remain.
• Stop automatic work after Scope failure or overall cancellation. Preserve prepare/capture independence, accepted Source results, and the complete downstream decision, including startsRequestSeries.
• Attach one native snapshot with a PowerContext section whose text exactly matches the injected message. Preserve the Server content, citations, byte validation and untrusted-history framing through normal host persistence.
• Fix two compatibility defects exposed by actual host acceptance: omit absent request_id fields so tool output is lossless JSON, and declare command input so Web routes /pc doctor and /pc capabilities as commands.
• Add registered-entry regressions and a pinned real-DSH runtime test package. CI now runs make dsh-runtime-test after make js-test, loading the built distributable with real host services and a real PowerContext Server.
• Rebuild lib, document behavior in English/Chinese, and add reproducible runtime instructions plus an acceptance record. Fix Windows e2e Server teardown to stop its owned child process tree.
• Include the independent Server fix from fix(server): preserve binary cursor keys on Windows #1464, with deterministic binary-key/restart regressions in Windows CI and direct Server log output on native-service failure.

Are there any user-facing changes?

Background failures leave normal conversation handling with DSH while reporting a safe stage-specific diagnostic. Prepared context remains usable when capture or flush fails, and appears in the native snapshot view. Scope failures stop subsequent automatic requests without fallback.

In the tested Web versions, expand the turn's context-injection row to view PowerContext. Terminal diagnostics require a native logger exporter with warning level enabled. Source acceptance and successful Memory generation remain separate outcomes. HTTP contracts, Scope policy, capture policy, and retry/request budgets are unchanged.

How was this change tested?

Acceptance record, sanitized observations, build identity and Web screenshot.

Validation	Result
Upstream CI at d2b3ee25	17/17 checks passed, including native Windows service and deterministic cursor regressions, native Linux/macOS services, Python 3.11–3.14, DSH package/runtime, quality, website, and SQLite/OceanBase acceptance.
Plugin unit suite	148 passed, including 30 automatic-path regressions and existing A coverage
Real PowerContext Server e2e	9 passed, including default Scope without cwd
Real DSH SDK runtime, published 0.1.2-rc.1	4 passed: Source → Memory → fresh-session context, persistence/model input, native diagnostics, actual tool results, stage faults, restart, Scope isolation
Integration manifest	26 passed
Build, quality, documentation	Passed Makefile-equivalent commands in PowerShell; GNU make is unavailable locally. Final website export verified 78 HTTP and 378 Python API pages.
Actual Web 0.1.2-rc.1	Snapshot display/history, independent stage faults, native console diagnostics, recovery/restart, Stop during held Scope, doctor/capabilities and bare /pc
Actual Web 0.1.0-rc.6	Capture/processing/new-session recall, rendered/persisted snapshot, Scope failure, doctor/capabilities and named-tool failure
Live-model + associated Web matrix	Pending: HTTP 401 authentication error. PR remains Draft.

Executed the commands in make js-test, make check, and make docs-test, plus:

pnpm --dir integrations/dsh/plugins/powercontext/tests/runtime install --frozen-lockfile
pnpm --dir integrations/dsh/plugins/powercontext test:e2e:runtime

Local environment: Windows, Node 24.14.1, Python 3.12.13. CI uses the repository's Node 22.19.0. SDK/runtime dependencies are locked. Passing runtime and Web scenarios use a deterministic loopback model and real Server processing/storage; they do not establish live-model behavior. The opt-in test:real command fails for a missing key and verifies actual Memory generation plus fresh-session recall with configured live inference.

AI usage statement

OpenAI Codex assisted with implementation, regression tests, fixtures, documentation, and browser-driven validation. Results above come from executed commands, real DSH/Server processes, persisted events, request observations and actual Web interactions. The unresolved live-model authentication gate is recorded explicitly; AI-generated code and model fixture replies are not treated as proof of live-model acceptance.

[knqiufan]

Validation for head e3ad78d7f1b0dec456b94dab52480a5852bb536d is complete for the available environment:

• 16 of 17 CI checks passed, including the DSH package and real runtime tests, Python 3.11–3.14, quality, website, both SQLite/OceanBase acceptance jobs, and Linux/macOS native service checks.
• The Windows native-service job failed at tests/native/test_personal_service_lifecycle.py:86: restarted.ok was false because the restarted service was not reachable. The failing check remains unresolved. A rerun attempt was refused with HTTP 403, Must have admin rights to Repository.
• Local final-build checks passed: 148 plugin unit tests, 9 real Server e2e tests, 4 real DSH runtime tests, quality/documentation gates, and actual Web checks on 0.1.2-rc.1 and 0.1.0-rc.6. The acceptance record contains the build hash, evidence, screenshot and reproduction details.
• Live-model acceptance remains blocked by authentication (HTTP 401). The passing runtime/Web checks used deterministic model responses. A (fix(dsh): handle Scope failures at tool and command boundaries #1452) is still open, and its original branch/head was left unchanged.

The PR remains Draft. B is not marked complete; remaining gates are live-model/Web acceptance, resolution of the Windows CI failure, and integration after A merges.

[knqiufan]

The Windows native-service failure has been traced to a reproducible Server defect, tracked in #1463 and fixed independently in #1464. The same fix is included in this PR as d2b3ee25.

The uploaded service log shows that the second Server process exited with cursor signing key must contain 32 bytes. The key writer used a Windows text-mode descriptor, so LF bytes in a random 32-byte key expanded to CRLF on disk. A fixed test input reproduces a 33-byte file and the failed restart. This was not an unexplained runner failure or a DSH diagnostic regression.

The fix uses binary writes and makes the persistence/restart tests deterministic. Windows CI now runs them against the installed wheel and continues to exercise the real Task Scheduler lifecycle. Native failure output also includes the Server log tail, so the underlying exception is visible without downloading an artifact first.

Correction to the earlier permissions note: GitHub rejected my attempt to rerun the old job with HTTP 403 and the message Must have admin rights to Repository. That was a restriction on initiating a rerun, not a prerequisite for making the test pass. GitHub documents repository write permission for reruns; reruns do not acquire the privileges of the person requesting them. The new substantive fix triggered normal PR validation without changing repository permissions or test requirements.

Validation is now complete for this CI fix:

• fix(server): preserve binary cursor keys on Windows #1464 at 2fb02a2e: 17/17 checks passed.
• fix(dsh): complete automatic-path diagnostics and recall presentation #1459 at d2b3ee25: 17/17 checks passed.
• The B-branch Windows job passed the four deterministic cursor checks and all four applicable real service lifecycle tests. The one native skip is macOS-only.
• Local source validation: 51 passed for cursor persistence and Server tests; the fresh installed wheel passed the four targeted persistence/restart tests.

The live-model HTTP 401 acceptance gate and dependency on A remain separate from this CI fix; the DSH PR remains Draft.