Hazard review

• scenarioreviewedboundaryedge_case

  Worst case: a shared reader with side effects (a counter, a cache write) executes once per referencing guard line instead of once per batch - the substitution covers only the plain $(reader) form, and documented non-plain forms (VAR=x reader, command -v reader, nested substitutions) are deliberately left to run the real command at eval time, so read-once holds exactly for the contract shape and degrades to repeated execution outside it; consequence is duplicate side effects and a slower batch, accepted and documented in MenuModel.js. boundary: a reader referenced by zero guards emits no capture line at all (the slot-membership test) - the read-once-only-when-shared half. edge_case: a reader exiting nonzero captures empty under the ||: isolation, so its dependents evaluate against an empty value (typically a false answer) instead of killing the batch, and one hung reader stalls the eager prelude - the freshness-only stall family dispositioned at MQ37.

• propertyrevieweddeterminismidempotency

  determinism: slot numbering is fixed by GUARD_READERS order and the same items always produce the same prelude with the same captured values. idempotency: re-deriving the script over unchanged items repeats no reader execution beyond the one eager capture per used reader - the read-once property the requirement names.

• structuralnot applicable

  Literal string substitution of $(reader) for an index-derived slot name over config-owned text; no eval on the JS side, no collision across slot indices, and an adversarial literal slot in a user expression is same-authority self-config, not an injection path.

• domainnot applicable

  Readers are user-authored shell running with the user own authority - the same boundary MQ37 dispositioned for the generated script; the substitution adds no privilege, network, or crypto surface.