Hazard review

• scenarioreviewedboundaryerror_handlingmalformed_inputempty_inputedge_caseinput_domain

  Worst case: a derived budget that overshoots the real logind window strands a closed laptop suspended mid-lock. boundary: the 12000 ms cap, the at-least-1000 ms logind reserve, and the positive-int-within-cap argument validation are the requirement threshold set (capped-window and invalid-arg scenarios). error_handling: an unreadable InhibitDelayMaxUSec, including a busctl timeout, falls back to 5000 ms. malformed_input: a non-numeric busctl tail or caller argument fails the ^[0-9]+$ regex and routes to the derived budget. empty_input: an absent argument is the default derivation path. edge_case: a zero window cannot drive the reserve negative because of the max(window/5,1000) floor. Catalog 1.11.0 re-review: input_domain applied, it reads the logind InhibitDelayMaxUSec property as text; empty, non-numeric and failed reads are the malformed_input and empty_input partitions already applied here (5000 ms fallback). concurrency_scale not applicable, one property read per suspend; repeated suspends are stated on SYS-REQ-260912-HC86.

• propertyreviewedtotality

  Every entry condition terminates inside the budget, either exit 0 on secure or the unsecured report and exit 1; the remaining>0 entry guard stops a frozen or jumped clock from looping forever, so the wait is total and terminating.

• structuralreviewedencoding_safety

  EPOCHREALTIME renders with the locale decimal separator; the [!0-9] digit strip prevents a comma locale from being re-read as the bash comma operator, which would silently void the deadline. overflow_safety not applicable: bash 64-bit arithmetic, epoch micros near 1.7e15 sit far below 2^63, and 10# stripping cannot grow the magnitude. nil_safety not applicable: unset and empty argument are the specified empty_input default path.

• domainreviewedexternal_call_timeout_bounded

  Every cross-process call declares a deadline: busctl is wrapped in timeout 1s with kill-after, both omarchy-shell calls are clamped to the remaining budget, and the clamshell reconciliation is bounded at 0.4s; nothing defaults to unbounded.