test(cli): every bin that calls refuseUnknownFlags has a row in the unknown-flag table

What changed: cli.test.mjs's "every CLI refuses a flag it does not know" table gains measure.mjs, export-warc.mjs, artifact.mjs and panel.mjs, each with no arguments (measure and export-warc refuse before they look for a project; artifact with no subcommand names the flag and exits 2, the subcommand path's exit 3 being covered by artifact-cli.test.mjs; panel refuses before it listens), and a guard before the loop: every .mjs under bin/ whose source calls refuseUnknownFlags( must have a row, or the test fails naming the files. CHANGELOG Unreleased, one bullet. Rows and guard sit in the existing registration, so the inventory stays 1789. No file under bin/ or lib/ changed (#271).

Why: four CLIs called refuseUnknownFlags and were never added to the table, so the one test that proves the refusal exists did not run them, and a fifth could be forgotten the same way; the guard turns the omission into a named red. The CLIs with their own refusal (collect-remote, disclosure, mcp-server, path-authority) are not matched by the guard and keep their own tests.

What you verified: verified red first - with only the guard in place, `node research-kit/bin/selftest.mjs cli` from the repository root: 117 passed, 1 failed, "these CLIs refuse unknown flags but have no row in this table: artifact.mjs, export-warc.mjs, measure.mjs, panel.mjs" (Node 24.21.0 linux); verified with the four rows: 118 passed, 0 failed, 25.8 s; verified the full offline suite on Node 24.21.0 linux: 1789 passed, 0 failed, 0 unsupported, 202.4 s, exit 0; verified git diff --check clean, both files LF-only; untested when written: this commit's all-seven CI.

What you got wrong: nothing to report.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gg4isLfN2Ng16zr5DwTnH9

Author: StepenkoAnatoli

CHANGELOG.md

@@ -5,6 +5,10 @@ Each release of Research-Kit, newest first. The version is `KIT_VERSION` in
 
 ## Unreleased
 
+- The suite's "every CLI refuses a flag it does not know" table now covers `measure`,
+  `export-warc`, `artifact` and `panel`, and fails by name when a file under `bin/` calls
+  `refuseUnknownFlags` without a row (#271). Tests only; no CLI changed.
+
 - `doctor` reports Node 22.13.0 through 22.22.0 as a failing Node line (#282, ADR-0159):
   those builds' `TextDecoder` reads `windows-1252` as Latin-1 (nodejs/node#60888), so a
   page's euro signs, curly quotes and dashes were captured as control characters with no

research-kit/test/cli.test.mjs

@@ -965,7 +965,20 @@ test('every CLI refuses a flag it does not know, before it does anything', () =>
     ['evidence-context.mjs', ['--all']],
     ['audit.mjs', []], ['brief.mjs', []], ['doctor.mjs', []], ['gate.mjs', []], ['handoff.mjs', []],
     ['preflight.mjs', []], ['prior.mjs', []], ['research.mjs', ['--dry-run']], ['bundle.mjs', []],
+    // Added 2026-10-11 (#271). measure and export-warc refuse before they look for a project.
+    // artifact with no subcommand names the unknown flag and exits 2; with a subcommand the
+    // refusal is exit 3 (BLOCKED) and artifact-cli.test.mjs covers it. panel refuses before
+    // it listens on anything.
+    ['measure.mjs', []], ['export-warc.mjs', []], ['artifact.mjs', []], ['panel.mjs', []],
   ];
+  // Found 2026-10-11 (#271): four CLIs called refuseUnknownFlags and had no row here, so a new
+  // CLI could be forgotten again. Every file under bin/ that refuses unknown flags by that name
+  // must have a row; a CLI with its own refusal (collect-remote, disclosure, mcp-server,
+  // path-authority) is covered by its own tests.
+  const refusing = fs.readdirSync(path.join(KIT_ROOT, 'bin'))
+    .filter((name) => name.endsWith('.mjs') && /refuseUnknownFlags\(/.test(fs.readFileSync(path.join(KIT_ROOT, 'bin', name), 'utf8')));
+  const missing = refusing.filter((name) => !cases.some(([bin]) => bin === name));
+  assert.deepEqual(missing, [], `these CLIs refuse unknown flags but have no row in this table: ${missing.join(', ')}`);
   for (const [bin, args] of cases) {
     const root = planned('flags');
     const r = run(bin, [...args, '--no-such-flag'], { root, env: { HOME: home, USERPROFILE: home, RESEARCH_KIT_CONFIG: path.join(home, 'c.json') } });