fix(cli): reject an unknown --info/--debug item the way upstream does

[oferchen]

--debug=" flist" exited 0 silently where upstream exits 1, and every rejection oc did emit used invented wording.

Upstream

One tokenizer serves both options: parse_output_words(words, levels, str, priority) at options.c:443-490, called from OPT_INFO (options.c:1877-1880) and OPT_DEBUG (options.c:1882-1885).

lines	shape	decision
448-454	comma split, if (!len) continue;	zero-length segments are accepted no-ops — --debug=, ,,,, name,. No whitespace trim anywhere.
455-458	if (!isDigit(str)) while (len && isDigit(str+len-1)) len--;	trailing digits stripped only when the token does not start with a digit
459-464	lev = …; if (lev > MAX_OUT_LEVEL || lev < 0) lev = MAX_OUT_LEVEL;	level clamped to 4 (options.c:261), never rejected
465-468	len==4 && strncasecmp(str,"help",4)==0	output_item_help(); exit_cleanup(0); — exits 0 from inside the loop
469-472	none / all	zero or set every word
473-483	strncasecmp(str, words[j].name, len) with len == namelen	exact-length, case-insensitive
484-488	if (len && !words[j].name && !am_server)	rprintf(FERROR, "Unknown %s item: \"%.*s\"\n", words[j].help, len, str); exit_cleanup(RERR_SYNTAX);

At :484 words[j] is the NULL sentinel whose help is the literal "--info" (options.c:301) / "--debug" (options.c:333); len is the digit-stripped length; RERR_SYNTAX is 1 (errcode.h:25). The !am_server half means the server side stays silent on an unknown word.

Measured against the real 3.5.0 binary

Every probed shape that already matched is omitted — flist, flist2, all0, ALL2, none2, HELP, DeLtAsUm, ,,,, ,bogus, 2flist, 99999999999999999999, nobogus, -bogus, stats3, and the --info= twins all agreed on rc and message before this change.

argv	upstream	before	after
--debug= flist	rc=1 Unknown --debug item: " flist"	rc=0, silent	matches
--debug=flist	rc=1 Unknown --debug item: "flist "	rc=0, silent	matches
--info="name2, del1"	rc=1 Unknown --info item: " del"	rc=0, silent	matches
--debug=bogus2	rc=1 Unknown --debug item: "bogus"	rc=1, invented wording	matches
--debug=help,bogus	rc=0, prints the table	rc=1	matches
--debug=bogus	rc=1 Unknown --debug item: "bogus"	rc=1, invented wording	matches

Four distinct defects: the trim, the un-stripped token in the message, help not short-circuiting, and the invented text.

oc's line keeps the repo-wide branding envelope (oc-rsync error: … (code 1) at debug.rs(179)), which is the established convention for every option error — --chmod=zzz renders identically. The diagnostic text, stream and exit code are ported; restructuring Message repo-wide is out of scope.

Word-split trap avoided: each cell passed as one argv word via an array, and the non-empty upstream rc=1 rows prove the flags reached the binary.

Seven parser sites enumerated, three changed

site	verdict
flags/output_words.rs — shared tokenizer	changed — trim dropped, TokenFlow short-circuit, digit-stripped case-preserving base
flags/debug.rs	changed
flags/info.rs	changed (spec_for also made case-insensitive per options.c:475)
server/run.rs:198-215	unchanged — correctly permissive, mirrors the !am_server half
server/flags.rs:1160-1165	unchanged — server --debug= captured, never parsed; matches upstream silence
logging/src/config.rs:201-303	unchanged — downstream applier, every caller does let _ =; only sees already-accepted tokens
frontend/info_output.rs:250-300	unchanged, flagged: a second parallel parse_info_flags with its own .trim() and its own name table. Publicly re-exported, but its only consumer is tests/output_parity.rs — off the binary's path. Latent recurrence of this exact defect class if ever wired up.

Mutation proof

Filter test(/flags::tests|info_debug/), test files untouched, one predicate reverted per arm:

arm	result
baseline	155 run: 155 passed
M1 restore the trim	155 run: 153 passed, 2 failed
M2 report the raw token	155 run: 154 passed, 1 failed
M3 Help returns Continue	155 run: 154 passed, 1 failed
M4 restore the invented wording	155 run: 146 passed, 9 failed

passed + failed == run in every arm. Companions stayed green under M1-M3 (an_unpadded_word_is_still_accepted, a_known_word_with_a_level_suffix_is_still_accepted, an_unknown_item_before_help_still_errors, the_server_side_decoder_still_ignores_an_unknown_item), so "reject everything" cannot satisfy the pins. The CLI companion deliberately avoids --version as terminator — --version short-circuits before --debug is parsed and would make the control vacuous.

Gates

Workspace 32627 run: 32622 passed, 5 failed. All 5 reproduce at pristine HEAD with the changed files reverted (5 run: 0 passed, 5 failed) — APFS sparse-block accounting plus one xtask fixture, unrelated. check_rustfmt_all.py clean (3389 files); clippy -p cli --all-targets silent on touched files; no --help snapshot moved and --debug=help output is byte-identical.

Reported, not fixed

--version / --help precedence is a separate divergence: upstream is strictly argv-ordered (popt handles each option where it sits), oc's maybe_print_help_or_version runs before option validation and wins regardless of position — so --debug=bogus --version exits 0 on oc, 1 upstream. Fixing it means reordering global preflight against every validated option, with broad snapshot blast radius.

Task 775's premise (an oc-invented no…/-… negation prefix) was measured not to reproduce: --debug=nobogus, -bogus, noflist, --info=nodel, -skip all exit 1 matching upstream, already pinned by pre-existing tests, and no prefix stripping exists at any of the 7 sites.