Summary

Repair stale external-result question blockers when session messages are loaded through the paginated message endpoint. This is a follow-up to #947: the full-history path was repaired, but the desktop app uses GET /session/:sessionID/message?limit=... and that route still bypassed the repair.

Why

A session can be reopened after the app is shut down while a question tool is waiting for renderer input. If the in-memory ExternalResult is gone, the persisted question part is no longer answerable. The paginated endpoint previously returned that stale part as running, so the UI kept showing a question card and every response failed with "session restarted".

Related Issue

No standalone issue. Follow-up regression from #947.

Human Review Status

Pending

Review Focus

Please check that stale-question terminalization stays in the session API layer instead of moving side effects into the low-level MessageV2.page() storage reader.

Risk Notes

Skipped checklist items:

• Visible UI/manual screenshot: no visible UI or copy changed; the affected user-visible state is covered through the server route contract.
• macOS/Windows platform impact: no platform, packaging, updater, signing, shell, or permission surface changed.
• Docs/release/dependencies/generated/local files: none touched.

How To Verify

Diff check: git diff --check passed
RED: bun test test/server/session-messages.test.ts -t "terminalizes stale running external-result questions in paginated responses" failed before the fix with Expected "error", Received "running"
RED follow-up: bun test test/server/session-messages.test.ts -t "older cursor page" failed when the route was temporarily restored to direct MessageV2.page, with Expected "error", Received "running"
Server route tests: bun test test/server/session-messages.test.ts passed, 9 tests
Session stale-question tests: bun test test/session/session.test.ts -t "messages" passed, 3 tests
Tool response route tests: bun test test/server/tool-respond-route.test.ts passed, 7 tests
Typecheck: bun run typecheck passed

Screenshots or Recordings

Not applicable. No visible UI change.

Checklist

How to use this checklist:

• Tick a box by replacing [ ] with [x]. Do not edit, add, or remove items.
• The bot-applied label items can only be honestly ticked AFTER the PR is opened and the labeler / priority-triage bots have run — return to the PR description and tick them then.
• Most items are required. The few that are conditional are explicitly marked (conditional); for those, leave unticked if they truly do not apply and explain why in Risk Notes. All other items must be ticked before requesting human review.

• Type label — this PR carries exactly one of bug, enhancement, task, documentation. Type labels are author-added; the labeler bot does NOT assign them. Add the label in the GitHub UI, then tick this.
• Routing labels — this PR carries at least one of app, ui, platform, harness, ci. The labeler bot assigns these on PR open based on changed paths. Confirm the bot's choice (or override if wrong), then tick this.
• Priority label — this PR carries exactly one of P0, P1, P2, P3. The priority-triage bot suggests one on PR open. Confirm or override, then tick this.
• Human Review Status above is set to Pending, Approved by @<reviewer>, or Not required: <reason> (default is Pending; "not required" is restricted to bot-authored low-risk PRs).
• I linked the related issue, or stated in Summary why there is no issue.
• I described the review focus and any meaningful risks.
• I replaced the example block in How To Verify with the real verification steps and the key result for each.
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope.
• (conditional) I manually checked visible UI or copy changes when needed, with screenshots or recordings. Leave unticked only if no visible UI or copy changed.
• (conditional) I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes. Leave unticked only if no platform/packaging surface was touched.
• (conditional) I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant. Leave unticked only if none of those surfaces was touched.
• I reviewed the final diff for unrelated changes and suspicious dependency changes.
• I am targeting dev, and my PR title and commit messages use Conventional Commits in English.