[rlfleming93]

Bug

Since #1 the session builder auto-fills the rider's strap. A strap only advertises once worn, so after an app restart it is not in the hub yet, and `POST /api/sessions` answered `400 Unknown HRM ` (seen live on the first ride after #2).

Fix

• `resolveRiderConfigs`: accept an HRM that is in the device registry even when the hub has not discovered it yet. Ids never seen stay a 400.
• `SessionEngine.attachHrm(hrm)`: subscribes a strap to every active rider configured with it (off-before-on, idempotent). Called at rider start and from `hub.on('hrm')`, so HR flows as soon as the strap wakes.

Evidence

• `pnpm check` clean; server tests 249/249.
• Sim server probe: registry-known asleep HRM → 200, rider `riding`; unknown id → 400 `Unknown HRM bogus`.
• Engine probe: 2 rows without HR before the strap, then `hrBpm 120` after `attachHrm`; calling it twice leaves 1 listener.

[rlfleming93]

Review gate: PASS

• Head: 79fe4db4f00d1ab9e179d1b5ccee799b734ad326
• Reviewer: sonnet / claude-sonnet-5-5 (claude)
• Rounds used: 1/2

ID	Severity	Status	Location	Finding	Proof
—	—	—	—	None	—

MINOR findings (0)

None.

[rlfleming93]

Shipped as 933b24a on main. What changes: Start no longer fails with Unknown HRM when the rider's strap is known but not yet awake; HR starts flowing as soon as the strap is discovered. Ids never seen are still a 400. The live Mac app runs the old server code until its next restart (held until the current ride ends).