About server/client init: I'm not sure that making the difference is really useful, since HB can be sent by both (in particular, the server can exploit a vulnerable client)