Hazard review

• scenarioreviewedboundaryedge_case

  Worst case: the cursor parks on a row Enter cannot run, so a visible cursor implies an actionable row that is not - or settleCursor leaves selectedIndex pointing at a row that just vanished and a later consumer reads it without checking cursorActive, acting on the wrong row. settleCursor pins selectedIndex=0 whenever target is -1, so the parked-cursor state must survive only while cursorActive=false; composition with any consumer that ignores cursorActive is the graded residual, guarded by the activation paths checking row disabled state (Z48F/SYS-P708 siblings). boundary: count==0 returns -1 before any index math - the empty-model edge. edge_case: the all-rows-disabled menu and the transition where one row becomes selectable again (cursor must grow back) are the witnessed corners. Catalog 1.11.0 re-review: input_domain not applicable, it reads no external text input. concurrency_scale not applicable, view state recomputed from the current rows on each UI event: no process, timer or lock, and events are handled one at a time.

• propertyreviewedtotality

  Every model state (empty, all disabled, mixed, cursor out of range) yields a fully defined cursor state through nextSelectable + settleCursor; the -1 sentinel is resolved at the single assignment site, never leaked into the model. Idempotency holds as a consequence - settleCursor twice reaches the same state - and is witnessed by the compositor reopen flow, but totality is the load-bearing claim.

• structuralnot applicable

  Declarative QML over integer indices and a boolean; no manual memory, pointer math, format-string sinks, numeric overflow surface (indices bounded by model count), or encoding transform.

• domainnot applicable

  Pure in-shell UI cursor state; no IPC payload, file, network, crypto, or privilege surface is touched by nextSelectable/settleCursor - the summon and guard-batch surfaces are owned by sibling requirements.