Hazard review

• scenarioreviewedmalformed_inputboundaryedge_case

  Worst case: a directory whose stills all stall vips wedges every nproc lane and the preload drain never returns, so the image picker never opens. malformed_input: a vanished file or unparsable image fails its stat/converter guard and is skipped or queued without a row (thumbnail_for stat guard, generator failure arms); hashes are md5 of path+size+mtime, so hostile bytes never steer control flow. boundary: the legacy directory-lock reap fires only past 120s and only when the path is still a directory, and a fresh legacy lock makes the exec redirect fail so the generator bails rather than clobbering a live owner. edge_case: timeout(124) and SIGKILL(137) converter exits deliberately write no rejection marker so the next open retries, while any other non-zero exit records one - the asymmetry is the documented retry policy.

• propertyreviewedidempotency

  idempotency: regenerating a thumbnail for an unchanged file converges on the same content-hash path; a completed thumbnail short-circuits the generator, and a mid-write crash leaves only the pid-suffixed temp that the next lock holder sweeps (rm of thumbnail.*.jpg under the lock), so retries repair rather than accumulate. determinism: fan-out order across nproc lanes is unspecified by the req (rows are pruned against existence, not generation order), so lane scheduling is not an invariant this contract carries. atomicity of the cache publish (write-temp-rename under the rows lock) is owned by the sibling cache-discipline reqs 43HQ/MH9B and already reviewed there.

• structuralnot applicable

  bash plus external converters: no manual memory, pointer arithmetic, or format strings; the only encoding surface (base64 row transit to the shell picker) belongs to the open-flow siblings 43HQ/MH9B, not to the generation contract this req carries. The nil/empty edge (stat guard returns empty and the caller skips) is recorded under scenario.

• domainreviewed

  external_call_timeout_bounded evaluated and DEFERRED (see obligation_deferrals): the still lane vipsthumbnail call has no deadline and a stalled conversion wedges its lane - in preload mode the synchronous drain then blocks the picker open, in lazy mode each open leaks an orphaned vipsthumbnail child. Filed as KI-MENU-IMAGES-VIPS-NO-TIMEOUT; this is the batch D headline hazard. The remaining external surfaces are bounded: ffmpegthumbnailer under timeout -k 5 10, both flock waits bounded at 30s, and the done_file poll in the open flow is a poll-loop mechanism already deferred on SW-REQ-260922-MH9B under KI-MENU-SELECT-POLL-DEADLOCK (generation does not own that wait). cache_coherent: thumbnails key on path+size+mtime, so an edited image regenerates on next open and a repaired video starts clean - stale-cache serving needs an identical signature. The append-only index.tsv grows one ~100-byte row per new-or-changed file with no cap; accumulation_bounded is gated out of this project profile and the growth is desktop-churn bounded, recorded here as an explicitly evaluated residual rather than a new obligation.