Hazard review

• scenarioreviewedboundaryedge_caseerror_handling

  Worst case: a route resolves to an action item, the menu closes, and the action silently never runs (execDetached is fire-and-forget) - the user loses the interaction with no reopen path in this slice; consequence is a lost launch, not a wrong one. boundary: the zero cases are pinned - empty id cancels, empty action no-ops, and applySelected closes the menu before dispatch so a failed action cannot leave the menu half-open. edge_case: the summonAction fast path passes the single-quoted payload literally to the in-process summon while the bash path would have shell-expanded it - same user authority, different expansion timing; the divergence is owned by SW-REQ-260928-8VJQ which pins the fast path, and N3RM only requires that a resolved action runs directly without opening a menu. Catalog 1.11.0 re-review: input_domain not applicable, it reads no external text input. concurrency_scale not applicable, a pure function of its arguments, recomputed on each load or keystroke: no state across calls, no process, timer or lock.

• propertyreviewedtotality

  Every resolved (kind, action) ending is defined: action item with non-empty action runs directly with no menu open, empty action no-ops, empty id cancels - no route ends with the menu reopening or the action firing twice.

• structuralnot applicable

  The fast-path regex is bounded ([A-Za-z0-9._-]+ for the id, single-quote-delimited payload), the action string dispatches as one argv to execDetached, and no payload is string-built or evald in QML.

• domainnot applicable

  Actions are user-authored commands from user-owned config executing with the user own privileges; the fast path only changes spawn plumbing (in-process summon vs bash), not authority, and the traced files carry no network, crypto, or privilege surface.