Hazard review

• scenarioreviewedmalformed_inputboundaryedge_caseconcurrency_scale

  Worst case: one still that stalls vips holds the eager drain, so the picker never opens. In a lazy open a stalled still holds the shared pool, so stills queued later get no thumbnail while the stall lasts (KI-MENU-IMAGES-VIPS-NO-TIMEOUT). malformed_input: a vanished file or unparsable image fails its stat/converter guard and is skipped or queued without a row (thumbnail_for stat guard, generator failure arms); hashes are md5 of path+size+mtime, so hostile bytes never steer control flow. boundary: the legacy directory-lock reap fires only past 120s and only when the path is still a directory, and a fresh legacy lock makes the exec redirect fail so the generator bails rather than clobbering a live owner. edge_case: timeout(124) and SIGKILL(137) converter exits deliberately write no rejection marker so the next open retries, while any other non-zero exit records one - the asymmetry is the documented retry policy. Catalog 1.11.0 re-review: input_domain not applicable, media files are handed to converters by extension; their contents are not parsed here. concurrency_scale applied: one pool per rows cache bounds lazy conversion to two converters at lowered priority, and repeated refreshes join its queue instead of starting more converters. A refresh that loses the pool lock leaves its jobs to the owner, which drains until the queue is empty. Eager, video and lazy generation can still overlap, and they serialize per file on the content-hash lock.

• propertyreviewedidempotency

  idempotency: regenerating a thumbnail for an unchanged file converges on the same content-hash path; a completed thumbnail short-circuits the generator, and a mid-write crash leaves only the pid-suffixed temp that the next lock holder sweeps (rm of thumbnail.*.jpg under the lock), so retries repair rather than accumulate. determinism: fan-out order across nproc lanes is unspecified by the req (rows are pruned against existence, not generation order), so lane scheduling is not an invariant this contract carries. atomicity of the cache publish (write-temp-rename under the rows lock) is owned by the sibling cache-discipline reqs 43HQ/MH9B and already reviewed there.

• structuralnot applicable

  bash plus external converters: no manual memory, pointer arithmetic, or format strings; the only encoding surface (base64 row transit to the shell picker) belongs to the open-flow siblings 43HQ/MH9B, not to the generation contract this req carries. The nil/empty edge (stat guard returns empty and the caller skips) is recorded under scenario.

• domainreviewed

  external_call_timeout_bounded evaluated and DEFERRED (see obligation_deferrals): the still lane vipsthumbnail call has no deadline and a stalled conversion wedges its lane - in an eager open the synchronous drain then blocks the picker open, and in a lazy open it holds the shared pool so stills queued later wait behind it. Filed as KI-MENU-IMAGES-VIPS-NO-TIMEOUT; this is the batch D headline hazard. The remaining external surfaces are bounded: ffmpegthumbnailer under timeout -k 5 10, the per-file and rows-cache flock waits at 30s, and the unbounded queue-lock waits guard only an append, an emptiness check and an unlink. The done_file poll in the open flow is a poll-loop mechanism already deferred on SW-REQ-260922-MH9B under KI-MENU-SELECT-POLL-DEADLOCK (generation does not own that wait). cache_coherent: thumbnails key on path+size+mtime, so an edited image regenerates on next open and a repaired video starts clean - stale-cache serving needs an identical signature. The append-only index.tsv grows one ~100-byte row per new-or-changed file with no cap; accumulation_bounded is gated out of this project profile and the growth is desktop-churn bounded, recorded here as an explicitly evaluated residual rather than a new obligation.