Hazard review

• scenarioreviewedboundaryerror_handlingedge_case

  Worst case: a caller scripts omarchy-menu <typo> in a chain and misreads exit 2 as success - the taxonomy is the mitigation: usage errors (missing args) exit 1, unknown verbs exit 2, so programmatic callers get two distinct failure classes, and the diagnostic names the offending verb plus the --help pointer on stderr where it cannot be mistaken for output. boundary: the case dispatch is total - every known verb, --help (exit 0), and the catch-all unknown arm - with no argv shape falling off the dispatcher. edge_case: the raw verb is echoed unquoted into the message, so terminal escape bytes in a hand-typed verb render raw in the user own terminal; the source is the user own command line (self-owned authority, same as any command echoing its arguments), and the bytes pass to stderr only, never to a parser. Catalog 1.11.0 re-review: input_domain not applicable, it compares the verb argument to a fixed list. concurrency_scale not applicable, one run per user action that owns its own temp files and shares no state with a concurrent run.

• propertyreviewedtotality

  Every argv resolves to exactly one dispatcher ending - a known verb dispatch, help text with exit 0, or the unknown diagnostic with exit 2 - with no input reaching an undefined fall-through or double exit.

• structuralnot applicable

  A case allowlist, one stderr echo, and exit codes; the verb is never evald, dispatched through, or interpolated into a command - unknown input can only become message text.

• domainnot applicable

  stderr text to the user own terminal from the user own argv; no trust boundary is crossed, and no network, crypto, privilege, or wait surface exists in the dispatcher arm.