Restore the byte-pinned USAGE test_healthcheck.sh from master

7d04aef replaced the byte-exact USAGE pin with a shape check that requires
every long flag grepped from the healthcheck source to appear in --help.
--json was already undocumented before this task, so that check was red on
arrival and it also dropped the 'unknown flag ignored' assertion on --bogus,
the only pin on the no---strict silent-ignore path.

The accepted plan's phase 3 is 'no edit': --help is untouched by --strict, so
master's version passes as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TASK.md

@@ -1,49 +1,42 @@
-# Task 06G4E83E4KRXM8DS90M2648MGM
+# Task 06G4GBSQ2WRGD5HGYPYZZ4TYH0
 
-Add a --quiet flag to the healthcheck script
+Add a --strict mode to the healthcheck
 
 - Project: test-e2e
-- Source: gitea:test-e2e/8
+- Source: gitea:test-e2e/13
 - Priority: 0
 
 ## Instructions
 
-## Goal
+Three phases, in this order.
 
-Add a --quiet flag to the healthcheck script
+## Phase 1 — `--strict` on the healthcheck
 
-scripts/orchestra_e2e_healthcheck.sh already handles --help. Add a --quiet flag alongside it that suppresses the success line and still exits 0. Leave the default behaviour and the --help output unchanged.
+`scripts/orchestra_e2e_healthcheck.sh --strict` must reject an unrecognised flag: print `unknown flag: <flag>` on stderr and exit 2. Without `--strict` the current silent-ignore behaviour is unchanged, and `--help` still wins from any position.
 
-## Verification
+## Phase 2 — cover `--strict` in the existing self-test
 
-- `bash -n scripts/*.sh && bash scripts/orchestra_e2e_healthcheck.sh` exited 0
-- commit: 41dee802416aaa9020a2e31ae5b79fa084a4f150
-- independent review of 41dee802416aaa9020a2e31ae5b79fa084a4f150: pass
-- accepted plan: 6c62e3cde23ed9aca296ed5b60295384b35cdad9fe0e1e45fa381d5801fb9af3
+Extend `scripts/orchestra_e2e_selftest.sh`, which already asserts the plain and `--json` runs. Add assertions that `--strict --nonsense` exits 2 and that `--strict` alone exits 0. Keep its existing `fail()` helper and its existing assertions.
 
-## Behavioural changes
+## Phase 3 — keep the pinned usage text honest
 
-- none reported
+`scripts/test_healthcheck.sh` pins the healthcheck's exact `--help` output in a hardcoded `USAGE` variable. Phase 1 changes nothing about `--help`, so this phase only confirms the pin still holds.
 
-## Deviations from plan
+Verify this phase by running the pinned test itself:
 
-- none reported
+    - run: ["bash", "scripts/test_healthcheck.sh"]
 
-## Remaining risks
+## Constraints
 
-- none reported
+The project's verification policy allows exactly two command shapes:
 
-## Review hotspots
+    ["bash", "-n", "<one file>"]
+    ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
 
-- none reported
+## Research first
 
-The sections above are derived from Orchestra state. The reported
-changes, deviations, risks, and hotspots are the implementing agent's
-own account and are not verified.
+Establish at least three findings with distinct confidence: at least one `fact`, one `inference`, one `assumption`. Cite at least two in References.
 
-## Acceptance criteria
-
-- not stated in the task contract
 
 ## Completion
 

scripts/orchestra_e2e_healthcheck.sh

@@ -1,16 +1,39 @@
 #!/usr/bin/env bash
 
 main() {
+  local quiet=
+  local json=
+  local strict=
+  local unknown=
   for arg in "$@"; do
     if [ "$arg" = --help ]; then
-      printf 'Usage: %s\n\n' "${0##*/}"
+      printf 'Usage: %s [--quiet]\n\n' "${0##*/}"
       printf 'Healthcheck script for Orchestra E2E tests.\n'
       printf 'Exits 0 with a success message if all checks pass.\n'
+      printf '  --quiet  Suppress the success message; still exits 0.\n'
       exit 0
+    elif [ "$arg" = --quiet ]; then
+      quiet=1
+    elif [ "$arg" = --json ]; then
+      json=1
+    elif [ "$arg" = --strict ]; then
+      strict=1
+    else
+      [ -n "$unknown" ] || unknown=$arg
     fi
   done
 
-  printf 'OK - all healthchecks passed\n'
+  if [ -n "$strict" ] && [ -n "$unknown" ]; then
+    printf 'unknown flag: %s\n' "$unknown" >&2
+    exit 2
+  fi
+
+  if [ -n "$json" ]; then
+    printf '{"status":"ok","checks":1}\n'
+    exit 0
+  fi
+
+  [ -n "$quiet" ] || printf 'OK - all healthchecks passed\n'
   exit 0
 }
 

scripts/orchestra_e2e_selftest.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Self-test for the Orchestra E2E healthcheck.
+
+here=$(cd "$(dirname "$0")" && pwd)
+healthcheck="$here/orchestra_e2e_healthcheck.sh"
+
+# fail <assertion> <captured stdout>: always echo what the healthcheck printed,
+# so a red run is diagnosable without rerunning it by hand.
+fail() {
+  printf 'selftest: FAILED %s\n' "$1" >&2
+  printf 'selftest: healthcheck stdout was:\n%s\n' "$2" >&2
+  exit 1
+}
+
+# plain run
+out=$(bash "$healthcheck")
+status=$?
+
+[ "$status" -eq 0 ] || fail "plain run exit status: want 0, got $status" "$out"
+case "$out" in
+  *OK*) ;;
+  *) fail "plain run stdout contains OK" "$out" ;;
+esac
+
+# --json run
+jout=$(bash "$healthcheck" --json)
+jstatus=$?
+
+[ "$jstatus" -eq 0 ] || fail "--json run exit status: want 0, got $jstatus" "$jout"
+jlines=$(printf '%s\n' "$jout" | wc -l)
+[ "$jlines" -eq 1 ] || fail "--json run line count: want 1, got $jlines" "$jout"
+case "$jout" in
+  '{"status":'*) ;;
+  *) fail '--json run stdout prefix: want {"status":' "$jout" ;;
+esac
+
+# --strict rejects an unknown flag
+sout=$(bash "$healthcheck" --strict --nonsense 2>&1)
+sstatus=$?
+
+[ "$sstatus" -eq 2 ] || fail "--strict --nonsense exit status: want 2, got $sstatus" "$sout"
+
+# --strict alone is accepted
+gout=$(bash "$healthcheck" --strict)
+gstatus=$?
+
+[ "$gstatus" -eq 0 ] || fail "--strict run exit status: want 0, got $gstatus" "$gout"
+
+printf 'selftest: ok\n'

scripts/test_healthcheck.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Self-check for orchestra_e2e_healthcheck.sh.
+
+HC="$(dirname "$0")/orchestra_e2e_healthcheck.sh"
+OK='OK - all healthchecks passed'
+USAGE="$(printf 'Usage: orchestra_e2e_healthcheck.sh [--quiet]\n\nHealthcheck script for Orchestra E2E tests.\nExits 0 with a success message if all checks pass.\n  --quiet  Suppress the success message; still exits 0.')"
+fails=0
+
+check() { # check <expected-stdout> <label> [args...]
+  local want=$1 label=$2 got status
+  shift 2
+  got=$(bash "$HC" "$@" 2>/dev/null)
+  status=$?
+  if [ "$got" != "$want" ] || [ "$status" -ne 0 ]; then
+    printf 'FAIL: %s (exit=%s)\n---got---\n%s\n---want---\n%s\n' "$label" "$status" "$got" "$want"
+    fails=$((fails + 1))
+  fi
+}
+
+check "$OK" 'no args'
+check '' '--quiet' --quiet
+check "$USAGE" '--help' --help
+check "$USAGE" '--help --quiet' --help --quiet
+check "$USAGE" '--quiet --help' --quiet --help
+check "$OK" 'unknown flag ignored' --bogus
+
+[ "$fails" -eq 0 ] || exit 1
+printf 'all checks passed\n'