diff --git a/tools/pane-census.py b/tools/pane-census.py
index cc1270e..bd356f4 100644
--- a/tools/pane-census.py
+++ b/tools/pane-census.py
@@ -317,7 +317,21 @@ def chk(label, got, want):
 
 
 def main():
+    # ⛔ AN UNRECOGNISED FLAG ALONGSIDE `--self-test` MUST REFUSE, not be discarded. The
+    # gate measured this file as UNVERIFIABLE: `--self-test --zzz-not-a-flag` exited 0, so
+    # "the flag is matched and the rest DISCARDED — a control result here describes an
+    # invocation that was only half read." ⇒ A control whose invocation cannot be shown to
+    # have happened is not a control. Measured 2026-09-06.
+    # ⚠ Exit 2 is correct and unambiguous here: this file's contract already reads
+    # `2 established nothing`, and a half-read invocation establishes nothing.
     if "--self-test" in sys.argv or "--selftest" in sys.argv:
+        _extra = [a for a in sys.argv[1:] if a not in ("--self-test", "--selftest")]
+        if _extra:
+            print(f"\u26d4 VOID \u2014 unrecognised argument(s) alongside --self-test: {_extra}.\n"
+                  f"   The controls take no other flags, and running them while ignoring an\n"
+                  f"   argument would report a pass for an invocation that was only half read.\n"
+                  f"   NO REMEDY \u2014 run `--self-test` alone.", file=sys.stderr)
+            return 2
         return self_test()
     rows, err = panes_from_daintree()
     status_ids = getattr(panes_from_daintree, "_status_ids", None)
diff --git a/tools/pipe-exit-scan.py b/tools/pipe-exit-scan.py
index 91e449f..d53fdde 100755
--- a/tools/pipe-exit-scan.py
+++ b/tools/pipe-exit-scan.py
@@ -460,7 +460,21 @@ def main():
     # nobody would guess is worse than an absent one, because its existence has
     # been ASSERTED. A reviewer pointed the tool at the fixture, got the normal
     # scan, and nearly recorded that as a clean negative.
+    # ⛔ AN UNRECOGNISED FLAG ALONGSIDE `--self-test` MUST REFUSE, not be discarded. The
+    # gate measured this file as UNVERIFIABLE: `--self-test --zzz-not-a-flag` exited 0, so
+    # "the flag is matched and the rest DISCARDED — a control result here describes an
+    # invocation that was only half read." ⇒ A control whose invocation cannot be shown to
+    # have happened is not a control. Measured 2026-09-06.
+    # ⚠ Exit 2 is correct and unambiguous here: this file's contract already reads
+    # `2 established nothing`, and a half-read invocation establishes nothing.
     if "--self-test" in sys.argv or "--selftest" in sys.argv:
+        _extra = [a for a in sys.argv[1:] if a not in ("--self-test", "--selftest")]
+        if _extra:
+            print(f"\u26d4 VOID \u2014 unrecognised argument(s) alongside --self-test: {_extra}.\n"
+                  f"   The controls take no other flags, and running them while ignoring an\n"
+                  f"   argument would report a pass for an invocation that was only half read.\n"
+                  f"   NO REMEDY \u2014 run `--self-test` alone.", file=sys.stderr)
+            return 2
         return selftest()
     if "--transcripts" in sys.argv:
         project = None