Restore the byte-pinned USAGE test_healthcheck.sh from master

7d04aef replaced the byte-exact USAGE pin with a shape check that requires
every long flag grepped from the healthcheck source to appear in --help.
--json was already undocumented before this task, so that check was red on
arrival and it also dropped the 'unknown flag ignored' assertion on --bogus,
the only pin on the no---strict silent-ignore path.

The accepted plan's phase 3 is 'no edit': --help is untouched by --strict, so
master's version passes as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TASK.md

@@ -1,50 +1,30 @@
-# Task 06G4FT0MB733H2ZCZ237WFHFD8
+# Task 06G4GBSQ2WRGD5HGYPYZZ4TYH0
 
-Give the healthcheck a self-test and a machine-readable mode
+Add a --strict mode to the healthcheck
 
 - Project: test-e2e
-- Source: gitea:test-e2e/10
+- Source: gitea:test-e2e/13
 - Priority: 0
 
 ## Instructions
 
-Three pieces of work, in order. Plan them as exactly three phases in that order.
+Three phases, in this order.
 
-## Phase 1 — a self-test for the healthcheck
+## Phase 1 — `--strict` on the healthcheck
 
-New file `scripts/orchestra_e2e_selftest.sh`, executable, `#!/usr/bin/env bash`.
+`scripts/orchestra_e2e_healthcheck.sh --strict` must reject an unrecognised flag: print `unknown flag: <flag>` on stderr and exit 2. Without `--strict` the current silent-ignore behaviour is unchanged, and `--help` still wins from any position.
 
-It runs `scripts/orchestra_e2e_healthcheck.sh`, then asserts:
+## Phase 2 — cover `--strict` in the existing self-test
 
-- exit status is 0
-- stdout contains `OK`
+Extend `scripts/orchestra_e2e_selftest.sh`, which already asserts the plain and `--json` runs. Add assertions that `--strict --nonsense` exits 2 and that `--strict` alone exits 0. Keep its existing `fail()` helper and its existing assertions.
 
-On failure it prints which assertion failed and exits 1. On success it prints `selftest: ok` and exits 0.
+## Phase 3 — keep the pinned usage text honest
 
-Verification for this phase is automated only. The one check is:
+`scripts/test_healthcheck.sh` pins the healthcheck's exact `--help` output in a hardcoded `USAGE` variable. Phase 1 changes nothing about `--help`, so this phase only confirms the pin still holds.
 
-    - run: ["bash", "-n", "scripts/orchestra_e2e_selftest.sh"]
+Verify this phase by running the pinned test itself:
 
-Do not add a manual step to this phase.
-
-## Phase 2 — `--json` on the healthcheck
-
-`scripts/orchestra_e2e_healthcheck.sh --json` prints exactly one line:
-
-    {"status":"ok","checks":1}
-
-and exits 0. Without `--json` the existing human output is unchanged, and `--help` keeps working. `--json` and `--help` together behave as `--help`.
-
-Verification for this phase must include both an automated check and a manual step. The JSON shape is a judgement a human confirms by reading it, so state the manual step as the exact command a human runs and the exact line they should see.
-
-## Phase 3 — teach the self-test about `--json`
-
-Extend `scripts/orchestra_e2e_selftest.sh` to run the healthcheck twice: once plain and once with `--json`. Assert the plain run still contains `OK`, and assert the `--json` run prints one line beginning with `{"status":`.
-
-Verification for this phase is automated only:
-
-    - run: ["bash", "-n", "scripts/orchestra_e2e_selftest.sh"]
-    - run: ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
+    - run: ["bash", "scripts/test_healthcheck.sh"]
 
 ## Constraints
 
@@ -53,11 +33,9 @@ The project's verification policy allows exactly two command shapes:
     ["bash", "-n", "<one file>"]
     ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
 
-A `run:` line outside those is refused when the plan seals, not later.
-
 ## Research first
 
-Before planning, establish at least three findings and label their confidence honestly: at least one `fact`, one `inference`, and one `assumption`. The plan must cite at least two of them in References.
+Establish at least three findings with distinct confidence: at least one `fact`, one `inference`, one `assumption`. Cite at least two in References.
 
 
 ## Completion

scripts/orchestra_e2e_healthcheck.sh

@@ -3,6 +3,8 @@
 main() {
   local quiet=
   local json=
+  local strict=
+  local unknown=
   for arg in "$@"; do
     if [ "$arg" = --help ]; then
       printf 'Usage: %s [--quiet]\n\n' "${0##*/}"
@@ -14,9 +16,18 @@ main() {
       quiet=1
     elif [ "$arg" = --json ]; then
       json=1
+    elif [ "$arg" = --strict ]; then
+      strict=1
+    else
+      [ -n "$unknown" ] || unknown=$arg
     fi
   done
 
+  if [ -n "$strict" ] && [ -n "$unknown" ]; then
+    printf 'unknown flag: %s\n' "$unknown" >&2
+    exit 2
+  fi
+
   if [ -n "$json" ]; then
     printf '{"status":"ok","checks":1}\n'
     exit 0

scripts/orchestra_e2e_selftest.sh

@@ -34,4 +34,16 @@ case "$jout" in
   *) fail '--json run stdout prefix: want {"status":' "$jout" ;;
 esac
 
+# --strict rejects an unknown flag
+sout=$(bash "$healthcheck" --strict --nonsense 2>&1)
+sstatus=$?
+
+[ "$sstatus" -eq 2 ] || fail "--strict --nonsense exit status: want 2, got $sstatus" "$sout"
+
+# --strict alone is accepted
+gout=$(bash "$healthcheck" --strict)
+gstatus=$?
+
+[ "$gstatus" -eq 0 ] || fail "--strict run exit status: want 0, got $gstatus" "$gout"
+
 printf 'selftest: ok\n'