docs(test): mark CF-06 and heartbeat failures

TASKLIST.md

@@ -1140,11 +1140,15 @@
   - AF-10：malformed auth_request payload
   - 覆盖 re_pair 后 secret 清理与 pairingStatus=revoked
 - 已同步更新 `tests/failure-path/MATRIX.md` 的 PF / AF / RP / HF 状态标记与当前备注
+- 已新增 `Yonexus.Server/tests/connection-heartbeat-failures.test.ts`
+  - CF-06：未认证 rule message 会关闭连接
+  - HF-03：认证前心跳会返回 `AUTH_FAILED`
+  - HF-04：无会话心跳会返回 `AUTH_FAILED`
 
 **待完成**
 - AF-04：当前实现未单独暴露 `invalid_secret` 分支，需先决定是否保留该错误码语义
 - RP 其余触发场景
-- CF / HF / SR 其余边界场景测试
+- CF / HF / SR 其余边界场景测试（除 CF-06、HF-03、HF-04）
 
 ---
 

tests/failure-path/MATRIX.md

@@ -66,7 +66,7 @@ This document defines the systematic test coverage for pairing and authenticatio
 | CF-03 | Duplicate connection | Same ID connects twice | Old connection closed, new accepted | ⬜ |
 | CF-04 | Protocol version mismatch | Unsupported version | Connection rejected with error | ⬜ |
 | CF-05 | Malformed hello | Invalid JSON | Error response, connection maintained | ⬜ |
-| CF-06 | Unauthenticated rule message | Client sends before auth | Connection closed | ⬜ |
+| CF-06 | Unauthenticated rule message | Client sends before auth | Connection closed | ✅ |
 | CF-07 | Reserved rule registration | Plugin tries `registerRule("builtin")` | Registration rejected | ⬜ |
 
 ---
@@ -77,8 +77,8 @@ This document defines the systematic test coverage for pairing and authenticatio
 |----|----------|---------|-------------------|--------|
 | HF-01 | 7-minute timeout | No heartbeat received | Status → `unstable`, notify | ✅ |
 | HF-02 | 11-minute timeout | Still no heartbeat | Status → `offline`, disconnect | ✅ |
-| HF-03 | Early heartbeat | Heartbeat before auth | Rejected/ignored | ⬜ |
-| HF-04 | Heartbeat from unauthenticated | Wrong state | Error, possible disconnect | ⬜ |
+| HF-03 | Early heartbeat | Heartbeat before auth | Rejected/ignored | ✅ |
+| HF-04 | Heartbeat from unauthenticated | Wrong state | Error, possible disconnect | ✅ |
 
 ---