Hazard review

• scenarioreviewederror_handlingboundaryedge_caseinput_domain

  Worst case: the menu mislabels a binding - a resolved symbol from the wrong keymap section shadows a correct fallback, or an unknown code renders raw as code:N - misleading a user hunting for a keybinding, cosmetic and graded low because dispatch uses the binding's own expression, never the displayed symbol. error_handling is the subject: xkbcli failure or an empty keymap degrades to the built-in fallback table, and </dev/null on the xkbcli pipe keeps a keymap read from consuming binding records on stdin - the composition trap this design closes. boundary: fallback-table codes are the fixed enumerated set (10..21, 59..61) plus mouse 272-274; a code outside both the keymap and the table is the uncovered edge that falls back to raw display. edge_case: GRAVE rewriting to ~ is a display convention over the layout-dependent keysym, so the symbol tracks whichever key the active layout puts left of 1 - witnessed by the source-derived keymap parse. Catalog 1.11.0 re-review: input_domain applied, it reads xkbcli keymap output and a built-in table; the producer emits machine-generated text, and an unresolvable code falls back to the table (already applied as error_handling). concurrency_scale not applicable, one keymap resolution per menu build.

• propertyrevieweddeterminism

  Given one compiled keymap, every binding resolves to the same symbol on every menu build: the awk pass folds code_by_name and sym_by_name once, the fallback table is a fixed literal, and later keymap entries overwrite earlier ones deterministically rather than by iteration order - the menu shows a stable label for a stable configuration.

• structuralnot applicable

  awk associative arrays over regex-matched string fields; no memory, pointer, or encoding surface, and the toupper normalization is a display convention on an internal symbol vocabulary, not a round-trip.

• domainreviewed

  Two cross-process reads (hyprctl binds, xkbcli compile-keymap) feed this resolution, both without deadline wrappers; the class that names this hazard is accepted as tracked debt rather than suppressed, because a stalled Hyprland IPC is documented as real during lid transitions and xkbcli inherits the same exposure - the deferral entry records the consequence and the tracking ref.