Is it possible that we have a reference to a session, but not a heartbeat object?

Afaik it shouldn't be if you use the normal "session create" API which gives you both Session and Heartbeater object back when a session has been successfully created. It could happen though if you instantiate Heartbeater manually at some later point.