Hazard review

• scenarioreviewederror_handlingmalformed_inputinput_domainconcurrency_scale

  Worst case graded above (peer death after summon hangs the synchronous caller - medium, tracked at the children under the KI). error_handling: cancellation reaches the caller as a clean no-selection (exit 1) rather than an error, so cancel is a protocol answer, not a failure; the answer file empty-vs-absent distinction is the no-selection contract. malformed_input: the picked value is delivered glyph-stripped with subtext preserved as the stable key, so decorative drift in labels cannot corrupt the payload; unknown/empty payloads are refused by the payload-shape child rather than passed through. boundary: single-select and multi-select modes answer through one delivery path so the caller needs no mode-specific wait logic. Catalog 1.11.0 re-review: input_domain applied, input_domain is on its obligation checklist and covered by SW-REQ-260922-Q6ZS (stdin lines as options). concurrency_scale applied, select and input prompts can be summoned while another request is active; the stranded-caller defect is KI-MENU-REQUEST-LIFECYCLE (omacom/omarchy#9057).

• propertyrevieweddeterminism

  determinism: the same pick answers the same payload - glyph stripping and key extraction are pure string functions of the chosen row; delivery order (exit code, answer file content) is fixed by the protocol, not by timing. idempotency: rewriting the answer file with the same pick converges; a second pick overwrites the first, which is the documented last-writer contract.

• structuralnot applicable

  payload is a stripped string written to a file: no memory/pointer/format surface; encoding is preserved byte-wise by the shell write path, and the shape guard on the caller side is dispositioned under scenario.malformed_input.

• domainreviewed

  external_call_timeout_bounded evaluated: the wait-on-answer-file poll inside the dmenu flow is exactly the KI-MENU-SELECT-POLL-DEADLOCK mechanism, and it is deferred at the children that carry the poll (9ABD and Q6ZS under the KI, with reproducer); the parent adds no duplicate deferral - decomposition keeps the debt row where the fix will land, and obligation_decomposition stays honest because both children carry the class. cancel-as-answer means the protocol never relies on a timeout for its normal path. No trust boundary: the answer travels from the user own picker surface to their own script through a mode-600 file in the session tmpdir.