Hazard review

• scenarioreviewedboundaryedge_casemalformed_input

  Worst case: a malformed predicate (unbalanced quote, stray newline) breaks the generated script wholesale, so every guard fails to answer and the view falls open (JRW1 renders unguarded rows) - honest degradation, and the failure is visible in the guard script exit rather than a wrong 0/1 verdict. boundary: exactly one if-line per declared when/checked/disabled is the whole contract, with the zero case (items with no guard emit no lines) as the tested half. edge_case: a predicate that blocks stalls the refresh for as long as it runs - accepted design per the documented tradeoff that the menu opens on the last evaluation results; GUARD_READER substitution is slot-based so reader output never re-enters shell parsing.

• propertyreviewedtotality

  The generator is a total function of the item map: every declared guard yields exactly one <id>:<w|c|d> if-line and every undeclared item yields none, so the emitted script is a faithful index of declared guards with no duplication or omission across the id space.

• structuralnot applicable

  The string concatenation is the contract, not a hazard: the artifact is generated bash by design, ids come from config keys of the same authority as the expressions, and the JS side never evals the result.

• domainnot applicable

  Guard predicates are user-authored shell from user-owned menu config executing with the user own authority on every open - the same authority row actions already exercise on click, so open-time evaluation adds no new trust boundary; third-party plugin menus gain only earlier timing of authority they already hold, and no network or privilege surface exists in the generator itself.