Hazard review

• scenarioreviewedboundaryedge_casemalformed_input

  Worst case: caller-supplied bytes corrupting the summon payload into a shape the shell misreads as a different mode or destination - closed structurally: every string field passes an explicit UTF-8 decode and JSON encode in perl, so any argv bytes arrive as payload values, never structure. boundary: the options-source partition is the contract spine - argv options, or stdin lines when no arguments and stdin is non-terminal, or the B839 usage exit when neither source exists; width/maxHeight appear only when given and are int-coerced. edge_case: an empty pipe yields an empty options array (defined empty menu rather than an error, with B839 owning the no-source case); invalid UTF-8 argv dies loudly at the decode instead of mojibake-ing into the payload.

• propertyreviewedtotalitydeterminism

  totality: every (argv, stdin-kind, width/maxheight-presence) combination resolves to exactly one payload shape or the usage exit, with no combination emitting a partial or mis-typed field set. determinism: fields serialize in fixed order from fixed sources, so the same invocation always produces the same payload.

• structuralnot applicable

  Encode/decode boundaries are explicit (UTF-8 decode before JSON encode, integer coercion for dimensions); no eval, shell interpolation of payload fields, or pointer work - the payload is built in perl structures and printed once.

• domainnot applicable

  Local mktemp paths and the session shell IPC summon; the far side of the protocol is the shell plugin siblings own surface, and this side carries no network, crypto, or privilege boundary.