fix: apply the review items for #683 at merge

findPersistedSessionOrFail now requires req (dropped the `?` and the dead `req &&` guard), like findSessionOrFail
The AST test in test/ownership-scoping.test.ts pins both declarations and asserts req's type is exactly FastifyRequest

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test/ownership-scoping.test.ts

@@ -166,18 +166,22 @@ describe('session-scoping helpers (multi-user)', () => {
     expect(() => findSessionUnscopedOrFail(ctxWith(map), 'missing')).toThrow();
   });
 
-  it('findSessionOrFail declares req as REQUIRED, so an unscoped call must use the explicit helper', async () => {
-    // tsc does not typecheck test/, so pin the signature from the source AST: an
+  it('findSessionOrFail and findPersistedSessionOrFail declare req as REQUIRED, so an unscoped call must use the explicit helper', async () => {
+    // tsc does not typecheck test/, so pin the signatures from the source AST: an
     // optional `req` would make forgetting it compile into an UNSCOPED lookup.
     const file = path.join(import.meta.dirname, '../src/web/route-helpers.ts');
     const src = ts.createSourceFile(file, await fs.readFile(file, 'utf8'), ts.ScriptTarget.Latest, true);
-    const decl = src.statements.find(
-      (s): s is ts.FunctionDeclaration => ts.isFunctionDeclaration(s) && s.name?.text === 'findSessionOrFail'
-    );
-    const req = decl?.parameters.find((p) => p.name.getText(src) === 'req');
-    expect(req).toBeDefined();
-    expect(req?.questionToken).toBeUndefined();
-    expect(req?.initializer).toBeUndefined();
+    for (const name of ['findSessionOrFail', 'findPersistedSessionOrFail']) {
+      const decl = src.statements.find(
+        (s): s is ts.FunctionDeclaration => ts.isFunctionDeclaration(s) && s.name?.text === name
+      );
+      const req = decl?.parameters.find((p) => p.name.getText(src) === 'req');
+      expect(req, name).toBeDefined();
+      expect(req?.questionToken, name).toBeUndefined();
+      expect(req?.initializer, name).toBeUndefined();
+      // Exactly `FastifyRequest`: a later `FastifyRequest | undefined` would be optional in all but syntax.
+      expect(req?.type?.getText(src), name).toBe('FastifyRequest');
+    }
   });
 
   it('per-user session cap counts only the owner sessions', () => {