Hazard review

• scenarioreviewedboundaryedge_case

  Worst case: a search ranking that can be steered - an installed app surface-crafted so its name outranks the menu route the user meant, sending the keystroke to the wrong target. The kind adjustments bound that: exact menu hit scores -2/-0 while the whole-word app ceiling is -5, so a menu exact match outranks any app tier, and apps stay inside their tier only relative to weaker menu tiers (prefix 10, substring 30, name 40, description 60), which is the intended assist without route capture. boundary: the empty/whitespace needle never reaches scoring (matchesQuery gates first), and the six tiers partition at exact-equality, whole-word membership (whitespace split), position-0 prefix, substring, name text, and description word boundary. edge_case: the whole-word-vs-exact code comment overstates one comparison (a whole-word app loses to any exact-labeled menu row by the arithmetic, and only beats weaker menu tiers); the requirement text and implementation agree with each other, so this is prose drift in a comment, not a contract break - worth a docs pass, not a hazard entry. description matching uses descriptionTextMatches so multi-word queries do not substring-match across the description wholesale. Catalog 1.11.0 re-review: input_domain not applicable, it reads no external text input. concurrency_scale not applicable, a pure function of its arguments, recomputed on each load or keystroke: no state across calls, no process, timer or lock.

• propertyrevieweddeterminismtotality

  determinism: the score is a pure function of (items, entry, query) with lowercase/trim normalization on both sides and no locale-dependent collation; depthFor carries its own cycle guard so a cyclic model cannot hang or inflate the depth term. totality: every entry admitted by the query filter receives exactly one score, and the final composite (score*1000 + depth*25 + order) is a strict total order with no unresolved ties.

• structuralnot applicable

  indexOf, toLowerCase, and one whitespace split over config-owned labels; the only regex operates on the label, not the query, and scores are bounded small integers - no overflow, no eval, no encoding transform.

• domainnot applicable

  Ranking chooses display order among rows the user already owns and could reach by scrolling; it grants no authority, and the traced scorer has no network, crypto, privilege, or cross-process wait surface.