Hazard review

• scenarioreviewederror_handlingboundary

  Worst case: the clipboard - which routinely holds passwords and tokens - lands in a /tmp file that outlives the script by design, or a failed clipboard read ships an empty file to the LAN picker. mktemp creates the file 0600, so the retention window is same-user-readable only and system cleanup owns reaping - a documented, graded-low tradeoff. boundary: wl-paste failure produces an empty temp file that still flows into the send (the script does not gate the send on a non-empty clipboard) - the empty-share edge; a chooser status above 1 is distinguished from a user cancel through command substitution so a chooser that never opened cannot pass as an empty selection. error_handling is suppressed as a pointer to the standing obligation_suppressions entry: the chooser-status-capturing command substitution is exactly why set -e/pipefail is wrong here, and the remaining pipeline steps fail soft with no partial state; the critical-notification path for chooser failure is witnessed under JREH. Catalog 1.11.0 re-review: input_domain not applicable, the clipboard text is passed through to a file, not parsed. concurrency_scale not applicable, one run per user action that owns its own temp files and shares no state with a concurrent run.

• propertyreviewedtotality

  Every argv shape resolves to a defined ending - usage error, clipboard share, chooser-cancelled no-op, chooser-failure notification with exit 1, or a detached send of the picked files; no mode string or file-list shape leaves the script mid-state with the temp file half-written or the send half-configured.

• structuralnot applicable

  Quoted redirections and an argv array passed through to systemd-run; no parsing of file contents, no arithmetic, no encoding transform - the clipboard bytes are written verbatim, which is the contract (binary_data_preserved would only bind if a transform existed).

• domainreviewed

  The LAN send is the feature itself, delegated wholesale to localsend's own protocol and GUI session: the launcher's contract ends at a successful systemd-run handoff, so send-outcome errors belong to the detached session that owns the transfer, and transport security (localsend's encrypted device-to-device protocol) is that tool's posture, not this script's. The deliberate detachment means the launcher cannot propagate a failed unit - accepted and documented here as the cost of send_detached rather than carried as an errors_propagated obligation.