Hazard review

• scenarioreviewedmalformed_inputboundaryedge_case

  Worst case: an entry whose declared shape is ambiguous or hostile - action AND target both present, an id with leading/trailing/double dots, or a non-object raw - normalizes into a tree node that silently loses a declared behavior (link target dropped because kind precedence picks action) or derives a parent that matches no other node (empty-string parent from an id like .x), so the row never renders or renders at the wrong depth. malformed_input: raw||{}, the action-over-target precedence, and the dotted-id derivation are exactly the declared-shape handling this class names, and the shipped config is user-extensible so shapes beyond the happy path are reachable. boundary: id==root forcing empty parent versus derived root parent is the identity edge of the tree; the three-way kind precedence is the type boundary. edge_case: explicit parent overriding the derived one, and dotted ids of every arity, are the witnessed corners.

• propertyreviewedtotality

  Every (id, raw) pair yields a fully defined item object: raw defaults to {}, kind is always one of action/link/menu, parent is always a string (dotted derivation, root literal, or declared), label defaults to the id. No config shape can make normalizeItem return a partial node that downstream tree building trips over.

• structuralreviewednil_safety

  The function's whole job is absorbing zero-value input: a null/undefined/non-object raw becomes {}, missing strings default at every field (icon, iconFont, label, title), and the undefined-parent check is the nil case the contract itself specifies - that is the nil_safety obligation, witnessed by config fixtures with missing fields.

• domainnot applicable

  In-process config-object normalization; no file, IPC payload, network, crypto, or privilege surface - the JSONC reading and file watching are owned by the source-loading sibling requirements.