Stop flag interpretation at unknown flags

docs/roadmap/remediation.md

@@ -1,6 +1,6 @@
 # Invocation reporting audit remediation
 
-Status: remediation in progress; 6 of 7 findings complete.
+Status: remediation complete; all 7 findings addressed.
 
 ## Review scope
 
@@ -31,7 +31,8 @@ native reports, and maintained consumers. Representative successful invocations
 covered command and scoped flag aliases with explicit zero and repeated values,
 quiet help/version, aggregate configuration YAML, quiet comparison, concrete
 request validation, and offline aggregate smoke testing. Findings 4 and 5 record
-the additional gaps; findings 1–3 remain open and are not duplicated below.
+the additional gaps; findings 1–3 were still open at that review and were not
+duplicated below.
 
 The algorithmic audit at `ee76b0f` examined the reporting-specific parser passes,
 delivery bookkeeping, deferred storage, native diagnostic partitioning, and
@@ -444,7 +445,13 @@ storage analysis is sufficient; no benchmark or allocation threshold is proposed
 
 ## 7. Stop normalizing an argument tail that parsing cannot reach
 
-Priority: P3. Status: for consideration.
+Priority: P3. Status: complete.
+
+- [x] Completed: interpretation returns the first fatal unknown-flag prefix,
+  retaining earlier canonical/alias occurrences and short-cluster members.
+  Temporary slices grow with that prefix; unreachable values and spellings are
+  no longer normalized or copied. Existing error precedence, values, and
+  terminator coverage passes. Validation: root module suite passes.
 
 ### Finding and complexity
 
@@ -500,3 +507,17 @@ the extra work statically. Existing prefix-order, missing-value precedence,
 short-cluster, and terminator/value tests provide relevant behavior coverage if
 this is selected. Preserve the backend error and consumed occurrence prefix on
 early failure; no timing threshold or real-world performance data is needed.
+
+## Final remediation validation
+
+All seven items have completion markers and focused regression evidence. The
+following checks pass for the assembled changes:
+
+- `GOTOOLCHAIN=local go test ./...` at the repository root and in each of
+  `integrations/ckconfig` and `integrations/ckprompt`, including maintained examples.
+- `GOWORK=off GOTOOLCHAIN=local go test ./...` at the repository root.
+- `GOTOOLCHAIN=local go test -race -run '^TestReporter|^TestHidden' .` at root.
+- Go formatting, staged/unstaged whitespace review, and local document-link review.
+
+The ignored local workspace is preserved. No dependency upgrade, release,
+publication, or change to upstream domain behavior was part of this work.