test(build): harden convention diagnostics

Exercise malformed static policy, client module/event/state, confirmation, SSE, delay, throttle, and mixed-event values so build-time diagnostics fail closed across the public declarative surface.

req: diagnostics/004

req: convention/006

req: client_local/011

PLAN.md

@@ -21,7 +21,7 @@
 - [ ] **State:** In progress — the package-native capped xtask entry point is reachable, rejects unknown packages, propagates mutest failure, and mutation-tests `hemx-axum`, `hemx-core`, `hemx-js`, and the full `hemx-test` package cleanly; full package closure remains.
 - **User value:** maintainers can run one bounded repository command and trust that meaningful Rust logic across every mutation-applicable library is either killed or explicitly justified.
 - **Build:** add a capped `hemx-xtask` mutation command that invokes `/opt/repositories/mutest`/`mutest` through package-native test targets rather than the broken workspace-wide example path; enumerate only current mutation-applicable library/proc-macro packages; finish adversarial tests or simplify code until every survivor is classified; keep equivalent, invariant-only, and infrastructure-inapplicable classifications inspectable and minimal; document the exact local release command in the existing readiness surface.
-- **Blocked by:** none; broad survivors currently remain in `hemx-build`, `hemx-derive`, and `hemx-lsp` outside already-clean focused contracts. The complete 470-mutant `hemx-axum` package gate now passes with 262 caught and 208 unviable after public page/form/multipart/registry/response/runtime proofs and narrow classification of infallible header parsing and streamed multipart unwrap-equivalent mutants.
+- **Blocked by:** none; broad survivors currently remain in `hemx-build`, `hemx-derive`, and `hemx-lsp` outside already-clean focused contracts. The current `hemx-build` slice now adversarially proves policy, client-module/event/state, confirmation, SSE, delay, throttle, and mixed-event diagnostics; remaining generated-resource and diagnostic-contract survivors remain. The complete 470-mutant `hemx-axum` package gate now passes with 262 caught and 208 unviable after public page/form/multipart/registry/response/runtime proofs and narrow classification of infallible header parsing and streamed multipart unwrap-equivalent mutants.
 - **Proof:** the new xtask mutation command exits zero within its documented bound, covers each applicable package, emits no unexplained missed mutant, and a deliberate adjacent mutation makes it fail. `cargo run -p hemx-xtask -- test` remains green. req: test/020 req: test/021
 
 ## 3. Elect and enforce the release license policy

hemx-build/src/lib.rs

@@ -3156,6 +3156,84 @@ fn main() {{
                 "data-hemx-policy",
                 "latest",
             ),
+            (
+                "empty-client",
+                r#"<button data-hemx-client="">Save</button>"#,
+                "data-hemx-client",
+                "non-empty",
+            ),
+            (
+                "client-module-scheme",
+                r#"<main data-hemx-root="app" data-hemx-client-module="https://example.com/app.js"></main>"#,
+                "data-hemx-client-module",
+                "same-origin",
+            ),
+            (
+                "client-event",
+                r#"<button data-hemx-client="save" data-hemx-client-event="blur">Save</button>"#,
+                "data-hemx-client-event",
+                "runtime-supported",
+            ),
+            (
+                "client-version-zero",
+                r#"<button data-hemx-client="save" data-hemx-client-state-version="0">Save</button>"#,
+                "data-hemx-client-state-version",
+                "positive",
+            ),
+            (
+                "client-version-invalid",
+                r#"<button data-hemx-client="save" data-hemx-client-state-version="one">Save</button>"#,
+                "data-hemx-client-state-version",
+                "positive",
+            ),
+            (
+                "client-policy-invalid",
+                r#"<button data-hemx-client="save" data-hemx-client-policy="queue">Save</button>"#,
+                "data-hemx-client-policy",
+                "latest",
+            ),
+            (
+                "events-mixed",
+                r#"<button data-hemx-handle="save" data-hemx-on="click blur">Save</button>"#,
+                "data-hemx-on",
+                "runtime-supported",
+            ),
+            (
+                "confirm-empty",
+                r#"<button data-hemx-handle="save" data-hemx-confirm=" ">Save</button>"#,
+                "data-hemx-confirm",
+                "non-empty",
+            ),
+            (
+                "sse-empty",
+                r#"<main data-hemx-root="app" data-hemx-sse=" "></main>"#,
+                "data-hemx-sse",
+                "non-empty",
+            ),
+            (
+                "delay-empty",
+                r#"<button data-hemx-handle="save" data-hemx-delay="">Save</button>"#,
+                "data-hemx-delay",
+                "milliseconds",
+            ),
+            (
+                "throttle-invalid",
+                r#"<button data-hemx-handle="save" data-hemx-throttle="ms">Save</button>"#,
+                "data-hemx-throttle",
+                "milliseconds",
+            ),
+            (
+                "duration-suffix-only",
+                r#"<button data-hemx-handle="save" data-hemx-delay="s">Save</button>"#,
+                "data-hemx-delay",
+                "milliseconds",
+            ),
+            (
+                "policy-duplicate-anchor",
+                r#"<button data-hemx-handle="save" data-hemx-policy="newest">Save</button>"#,
+                "data-hemx-policy",
+                "latest",
+            ),
             (
                 "debounce",
                 r#"<button data-hemx-handle="save" data-hemx-debounce="soon">Save</button>"#,