Hazard review

• scenarioreviewederror_handlingmalformed_inputconcurrency_scale

  Worst case graded above on the existing error_handling obligation (silent no-op or wrong-target action, high - the documented historical class). error_handling: every script in the family carries set -euo pipefail and explicit exit-coded refusals (usage errors exit 1/2, IPC acceptance checked, failed handbacks printed to stderr), so refusal is loud and exit-coded by construction. malformed_input: unknown verb/route/argument shapes are refused with usage text rather than guessed at. The two known unbounded-wait sites in the family are owned downstream, not here: the done_file poll by SW-REQ-260922-MH9B under KI-MENU-SELECT-POLL-DEADLOCK, and the still-image converter lane by SW-REQ-260929-THMB under KI-MENU-IMAGES-VIPS-NO-TIMEOUT (both deferred there; this parent adds no duplicate debt row). Catalog 1.11.0 re-review: input_domain not applicable, each script reads only its own arguments and tool output; the stdin reader is stated on SW-REQ-260922-Q6ZS. concurrency_scale applied, the images and keybindings scripts keep caches shared across concurrent invocations (SW-REQ-260922-43HQ, SW-REQ-260922-MH9B, SW-REQ-260929-THMB, SW-REQ-260929-REJT).

• propertyreviewedidempotency

  idempotency: the family scripts are one-shot per invocation and safe to re-invoke (toggle/refresh verbs converge, generation is content-keyed), so a retried activation cannot compound a half-applied side effect; determinism/commutativity do not pertain to a fork-and-exit contract. atomicity of the underlying side effects is owned by each target component (lock, shell IPC, file ops) under its own requirements.

• structuralnot applicable

  bash scripts with explicit exit codes: no memory/pointer/format-string surface; encoding-sensitive handoffs (base64 rows) are owned by the images open-flow children, not by the loud-refusal contract.

• domainreviewed

  external_call_timeout_bounded evaluated: the family scripts external calls are bounded at their owning requirements - ffmpegthumbnailer under timeout -k 5 10 and the done_file poll deferred on the children (KI-MENU-SELECT-POLL-DEADLOCK; KI-MENU-IMAGES-VIPS-NO-TIMEOUT); omarchy-shell IPC calls fail fast on a dead peer (connect refusal), so the dispatcher-side verbs need no deadline here. external_call_failure_observable is satisfied by the contract itself: refusal must be loud and exit-coded, silent black-holing is the exact forbidden shape. No trust boundary: all scripts run as the invoking user on their own machine; nothing here authenticates or authorizes.