Hazard review

• scenarioreviewedmalformed_inputboundaryinput_domain

  malformed_input (post-de63134b): dispatcher values that are nil, unmarked tables, or unregistered functions fall through the resolution chain with kind="" exactly as pre-delta - the new elseif only fires when o.bind_commands holds an entry for the exact dispatcher key. boundary: a registered function bind resolves to its single mapped command; Lua table keys are function-identity unique, so cross-bind command confusion is structurally impossible. Stale-cache boundary closed by the v13->v14 key bump (verified in keybindings_cache_key). Catalog 1.11.0 re-review: input_domain applied, it parses hyprctl binds output and the source-derived cache; the producers emit machine-generated text, and malformed rows are the malformed_input partition already applied here. concurrency_scale not applicable, one display mapping per bind row; the cache rebuild is owned by the keybindings script build.

• propertyrevieweddeterminism

  The bind_commands lookup is a pure map read keyed by function identity: same config run yields the same records. helpers.lua registers the mapping at bind-creation time, before the sandbox prints rows, so ordering is fixed.

• domainnot applicable

  No new trust boundary: the Lua config already executes with full user privileges inside Hyprland; the keybindings script only re-reads it to render the menu, and the menu ran the resulting rows with user privileges before this delta. bind_commands values are written only by o.launch_terminal (fixed string omarchy-launch-terminal); a user-written mapping is config behavior, not an attack surface.

• structuralnot applicable

  Bash + GC'd Lua; table.concat over strings only. Lua nil-key read returns nil (no error), keeping the fall-through safe; no manual memory, pointers, or format strings.