Hazard review

• scenarioreviewedmalformed_inputerror_handlingboundaryconcurrent

  Worst case: a malformed or hostile IPC payload - unparsable JSON, unknown mode, absent menu id - crashes or wedges the IpcHandler and takes down the whole Quickshell desktop shell, or a second summon arrives while the menu is open and clobbers the live request's doneFile/selection state. malformed_input: JSON.parse sits in a try/catch degrading to {} so an unparsable payload answers as a root-menu open instead of killing the handler - the declared parse policy. error_handling: every dispatch arm answers (dmenu flow, route fallback to root, close, refresh, ping); no payload shape leaves the call unanswered. boundary: the exact mode strings select/input split dmenu from route, and initialMenu/menu/root is a three-step fallback chain whose arms are the tested partition. concurrent: open-while-open and open-while-dmenu-active interleave through the opened/requestActive/requestSerial discipline, but a second select summon while the first is unanswered replaces selectionFile/doneFile without answering the first caller, so that omarchy-menu-select polls forever - KI-MENU-REQUEST-LIFECYCLE (omacom/omarchy#9057), behavioural reproducer test/reports/report-cmulr95nw0kqr1gw46i7f50xj.sh; upstream e332dc97 has no cancel-prior guard (that is PR #9056). Note: payload.fontFamily is an accepted same-user cosmetic override, graded low - the IPC endpoint is same-user local and carries no privilege.

• propertyreviewedidempotency

  refresh() and ping() are pure read-side verbs returning ok with identical observable effect when repeated; open() with the same payload twice re-reaches the same route through the fallback chain. Repeated lifecycle calls converge instead of accumulating state - the witness suite re-summons menus across scenarios and asserts the same rendered state.

• structuralnot applicable

  The only parse is JSON.parse wrapped in try/catch with a defined fallback; no memory, pointer, format-string, or encoding surface - payload strings are consumed as opaque JSON or dropped wholesale.

• domainnot applicable

  The IPC endpoint is Quickshell's same-user local IpcHandler with no authentication surface to declare (auth posture: none, same-user by construction, no network listener), and refresh() reads only the two fixed menu JSONC paths - no egress sink, no tamper/replay surface beyond what the same-user threat model already grants, so no domain class applies_when fires.