Hazard review

• scenarioreviewedmalformed_inputerror_handlingconcurrency_scale

  Worst case graded on the existing error_handling obligation above (exec refusal surfaces as terminal error text, no menu - low). malformed_input: an unknown verb exits 2 with usage text, an unknown route degrades to the documented root default, and payloads are built with jq -nc --arg so shell metacharacters in a route cannot break the JSON envelope or the IPC call. error_handling: each verb is a single exec, so the IPC result code IS the dispatcher result - no swallow point exists between the verb case and the process exit; refresh/ping answers are passed through unmodified. Catalog 1.11.0 re-review: input_domain not applicable, routes travel as JSON built by a JSON encoder. concurrency_scale applied, verbs arrive as independent IPC calls that can follow each other quickly (SW-REQ-260922-50RE).

• propertyrevieweddeterminism

  determinism: the verb-to-IPC-call mapping is a fixed table (one case arm per verb, one payload shape per call) - same verb and route always dispatch the same call; no ordering, algebraic, or repeated-application surface exists on a fork-exec one-shot. idempotency belongs to the verbs themselves (toggle is deliberately not idempotent; summon/close/refresh are), which is the documented semantic, not a hazard.

• structuralnot applicable

  a bash case table around jq and exec: no memory, pointer, or format-string surface; the only encoding step (jq --arg) is the structurally safe construction named above.

• domainreviewed

  external_call_timeout_bounded evaluated and suppressed with rationale: every verb is exec dispatch onto the local omarchy-shell socket - a dead or wedged shell answers connect-refusal immediately (fast-fail loud, the low-graded worst case above), the dispatcher itself has no wait loop, and any bounded-wait debt inside the summoned surfaces is owned by their own requirements (done_file poll deferred under KI-MENU-SELECT-POLL-DEADLOCK). No auth surface (single-user local IPC), no cross-identity key movement between the verb table and the IPC call names - the strings are one repo artifact.