Hazard review

• scenarioreviewedmalformed_inputboundaryedge_case

  Worst case: a search for a secret-flavored query surfaces rows the user cannot act on - invisible or disabled rows matching the terms and inviting selection of a gated action; the !visible early return is the trust partition and the null/root guards bound the entry shape. malformed_input: the query is free-typed text - normalization (lowercase, trim, whitespace split) absorbs odd casing and runs of spaces, and matching is literal indexOf, so regex metacharacters and punctuation are inert by construction, no interpretation to exploit. boundary: the all-terms AND semantics flip on a single missed term; empty terms from whitespace runs are skipped rather than failing every row; a one-character term is the narrowest legitimate match. edge_case: description matches are whole-word only (termInSearchWords) while name matches are substring - a term inside a description word does not match, and an empty description reduces the row to name text only; disabled-but-visible rows are excluded by the caller folding guard results into visible.

• propertyrevieweddeterminism

  The same query against the same model yields the same match set: normalization is a fixed transform, term order is preserved, and matching is stateless string search with no ranking randomness here (scoring is the SJ7P sibling) - a row cannot flicker in and of the result set across identical keystrokes.

• structuralnot applicable

  toLowerCase and indexOf over config-sourced strings; no regex evaluation on user input (the only regex is the fixed whitespace splitter), so no backtracking surface, and no memory or encoding round-trip beyond case folding.

• domainnot applicable

  In-process text matching over the loaded model; the query arrives through the menu's own text field and no file, IPC transport, network, crypto, or privilege surface participates.