fix(session): guard truncation flags before read in settle strategy (CI)

test_issue6867 extracts _restoreSettledSession into a bare harness where
the module-level _messagesTruncated/_oldestIdx lets are absent; a bare
read threw ReferenceError and the whole recovery path died before it
could restore. Use typeof guards like the surrounding paging restores.
The semantics are unchanged in the real page (both are always declared).

static/messages.js

@@ -7092,7 +7092,7 @@ function attachLiveStream(activeSid, streamId, uploaded=[], options={}){
         // identical turns make BOTH comparisons succeed, preferring the prefix
         // splices at the wrong offset and silently drops/duplicates rows
         // (#7628). Never prefer prefix when truncation is active.
-        const _truncatedRecovery=!!_messagesTruncated||!!(_oldestIdx>0);
+        const _truncatedRecovery=(typeof _messagesTruncated!=='undefined'&&!!_messagesTruncated)||(typeof _oldestIdx!=='undefined'&&!!(_oldestIdx>0));
         const _preserveCurrentTranscript=preserveVisibleOnShorterTerminalSnapshot&&(_truncatedRecovery?_stagedMatchesCurrentSuffix:_stagedMatchesCurrentPrefix);
         const _resolvedMessages=_preserveCurrentTranscript
           ? [..._stagedMessages,..._currentVisibleMessages.slice(_truncatedRecovery?_stagedSuffixStart+_stagedMessages.length:_stagedMessages.length)]

tests/test_session_default_window.py

@@ -158,7 +158,7 @@ def test_settle_truncation_signal_decides_match_strategy():
     BOTH comparisons succeed; the prefix branch then splices at the wrong offset
     and silently drops/duplicates rows) (#7628)."""
     restore = _restore_settled_session_body()
-    assert "_truncatedRecovery=!!_messagesTruncated||!!(_oldestIdx>0)" in restore
+    assert "_truncatedRecovery=(typeof _messagesTruncated!=='undefined'&&!!_messagesTruncated)||(typeof _oldestIdx!=='undefined'&&!!(_oldestIdx>0))" in restore
     # The splice offset must follow the SAME truncation decision as the match
     # strategy — no fallthrough to prefix when both match.
     assert "_truncatedRecovery?_stagedSuffixStart+_stagedMessages.length:_stagedMessages.length" in restore