diff --git a/TODO.md b/TODO.md
index bf32f33..d5659e8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -7,9 +7,6 @@ ranking; unlabeled items are "someday, if the mood strikes."
 
 ## Projections: future enhancements
 
-- **Configurable benchmark symbols — priority MEDIUM.** Currently
-  hardcoded SPY + AGG. Route through `projections.srf` as a
-  `type::config,benchmark::SYMBOL` record (or similar). Low effort.
 - **Configurable return cap per position — priority MEDIUM.**
   Default: none; cap outliers like NVDA. Should route through
   `projections.srf` cleanly.
@@ -592,73 +589,20 @@ commands plus interactive. The framework dispatch itself is
 working correctly; these are gaps in command-level behavior or in
 the global `--refresh-data` flag's coverage.
 
-### `--refresh-data=never` doesn't actually skip network calls — priority MEDIUM
+### `zfin interactive --default-keys`/`--default-theme` swallow trailing flags — priority LOW
 
-Today `never` and `auto` behave identically: both respect cache
-TTLs, neither truly skips network. The help text promises "no
-provider calls (offline mode)" but that's aspirational — the
-underlying `svc.loadAllPrices` loader has no `skip_network` knob.
-See `src/commands/common.zig:280-291` for the documented
-approximation.
+`zfin interactive --default-keys --bogus-flag` is silently
+accepted: `--default-keys` prints its output and `return`s from
+`tui.run` before the rest of the args are parsed. The flag
+parser itself now rejects unknown flags (`error.InvalidArgs`
++ exit 1), but only when control reaches the parsing loop —
+which it doesn't if `--default-keys` or `--default-theme`
+short-circuits first.
 
-Fix: add a `skip_network: bool` option to the loader's options
-struct, threaded through to `getCandles` etc. so a stale entry is
-served from cache instead of triggering a refetch when the user
-explicitly opts in to offline mode. Then map `.never` → `.{ .skip_network = true }`
-in `loadPortfolioPrices`.
-
-Alternative: revise the help text to drop the offline-mode claim
-and document `never` as "TTL-respecting" (which is what it
-actually does). Less work, less honest.
-
-### `--refresh-data` ignored by single-symbol commands — priority MEDIUM
-
-The 7 multi-symbol commands (portfolio, analysis, snapshot, audit,
-compare, contributions, projections) honor
-`ctx.globals.refresh_policy` because they go through
-`cli.loadPortfolioPrices`. The 12 single-symbol commands (perf,
-quote, divs, splits, options, earnings, etf, history-symbol-mode,
-lookup, plus version/cache which don't fetch) bypass it — they
-call `svc.getCandles` etc. directly, which has its own TTL logic
-and doesn't read the global flag.
-
-So `zfin --refresh-data=force perf AAPL` doesn't force a
-re-fetch. The help text implies the flag is universal.
-
-Fix options:
-- Thread `refresh_policy` into the per-symbol freshness check
-  in `service.zig`. Most invasive but most correct.
-- Scope the flag's docs to "portfolio commands" and rename it.
-  Less work, smaller blast radius.
-- Add a different flag (`--symbol-refresh`?) for single-symbol
-  cases. Worst of both — two flags users have to remember.
-
-### `interactive -s` without a symbol value silently launches the TUI — priority LOW
-
-`zfin interactive -s` (no value following) doesn't error. The
-flag-parsing in `src/tui.zig:2071-2079` checks `if (i + 1 < args.len)`
-and silently drops `-s` if no value follows. It also doesn't
-validate that the value isn't another flag — `zfin interactive -s --chart 80x24`
-would treat `--chart` as the symbol.
-
-Same issue applies to `--chart` (lines 2080-2086). Both should
-error out with a clear "flag requires a value" message and exit 1.
-
-Fix: rewrite the loop to use the framework's parseArgs convention
-— error on missing values, error on flag-shaped values where a
-positional value is expected. Or migrate the TUI flag parser to
-the framework entirely (see "interactive command isn't framework-
-registered" in main.zig's docs for the constraints).
-
-### `zfin interactive --help` printed help; `--default-keys`/`--default-theme` skip the TUI — priority LOW
-
-Acknowledged as fixed-with-caveat. The current implementation
-intercepts `--help` at the dispatch site (main.zig). The TUI's
-`--default-keys` / `--default-theme` print and `return` from
-`tui.run` correctly. But: the TUI flag parser's "silently ignore
-malformed flag" behavior (above) means
-`zfin interactive --default-keys --bogus-flag` is accepted; the
-bogus flag is silently dropped. Same fix as above.
+Fix: validate the entire arg list before honoring the
+print-and-exit flags, or restructure so the parser runs first
+and the print-and-exit flags fire from inside the loop after
+all args have been validated.
 
 ### `etf <SYMBOL>` warns `failed to serialize ETF profile: WriteFailed` — priority LOW