Hazard review

• scenarioreviewedboundaryedge_caseerror_handling

  Worst case: a chooser that writes a pick then exits above 1 makes the share drop a file the user explicitly chose - defined fail-safe (nothing is sent without a clean success), though the critical message (chooser did not open) can be mildly misleading about the real failure. boundary: the status 1 vs above-1 partition is the entire trigger; status 1 and the portal client EXIT_NOTHING_PICKED both land in the silent exit-0 arm because the chooser taxonomy calls both a decision rather than a fault. edge_case: a newline inside a picked filename splits readarray entries along the line protocol and the bad entry fails at the send step, never sending a wrong file; a notification-send failure under set -e aborts nonzero anyway. Catalog 1.11.0 re-review: input_domain not applicable, it reads only the chooser exit status and the picked path. concurrency_scale not applicable, one run per user action that owns its own temp files and shares no state with a concurrent run.

• propertyreviewedtotality

  Every chooser ending the portal client can emit (picked, cancelled, nothing-picked, crashed) resolves to exactly one share-script ending - detached send, silent exit 0, silent exit 0, critical notification with exit 1 - and the tests witness the failure and cancel quadrants.

• structuralnot applicable

  Bash orchestration only: command substitution capturing the chooser, one readarray line split, string emptiness test; no parsing of chooser payloads beyond the line protocol, no arithmetic, no encoding transforms.

• domainreviewed

  The traced file does reach the network, but through the systemd-run detached localsend send that is SW-REQ-260922-8ERH own send contract, not the chooser-failure arm this requirement governs; the arm itself performs only the portal call. Disposition stays reviewed rather than not_applicable because of that egress sink.