Hazard review

• scenarioreviewedboundaryconcurrentedge_caseconcurrency_scale

  Worst case: the caller's read races the write - the done marker landing before the selection bytes are durable converts a real pick into a spurious cancel (the CLI exits 1 on an empty selection), or a late answer for an already-finished request writes into the next invocation's files; the single bash -c ordering (selection flushed, then done truncated) is the commit protocol and the up-front field clearing plus the activeSelection/activeDone locals pin the write to this request's mktemp-unique paths. boundary: the null-selection dismissal arm versus the answered arm is the exact partition this requirement sits on the answered side of (done-only is C8HX). concurrent: the single-threaded QML loop plus the requestActive re-check make a second finish a silent no-op rather than a duplicate write. edge_case: a selection with newlines or shell metacharacters passes verbatim through Util.shellQuote into printf - the caller receives exactly what was picked, multi-line included, and the quoting helper's own requirements own its correctness; the polling CLI side and its unbounded wait are the Q6ZS/9ABD siblings' tracked debt. Catalog 1.11.0 re-review: input_domain not applicable, it reads no external text input. concurrency_scale applied, part of the menu request lifecycle: the answer write can race a superseding summon.

• propertyreviewedatomicity

  Answer delivery is all-or-nothing against the polling caller: the done file exists only after the selection file is fully written inside the same bash -c, so observing done implies a complete selection or a deliberate dismissal - no interleaving leaves the caller reading a truncated answer.

• structuralnot applicable

  One shell-quoted printf through a spawned bash -c; no parsing, arithmetic, memory, or encoding transform - selection bytes are quoted and passed verbatim.

• domainnot applicable

  Same-user mktemp'd files written by the menu's own result process; summon-payload path provenance is Q6ZS's, the CLI wait and its no-deadline poll are the tracked Q6ZS/9ABD debt, and no network, crypto, or privilege boundary is crossed in the write arm.