resolved_user_id already accesses ws.session unguarded just above (SessionMiddleware covers the WS scope), so the '"session" in ws.scope' fallback was dead code — read ws.session directly for consistency (review follow-up).