Hazard review

• scenarioreviewedmalformed_inputboundaryinput_domainconcurrency_scale

  Worst case graded above (whole-user-extension silent drop on one malformed key - low: documented recovery, menu stays usable on defaults, and the fix is one lint pass; graded low because the failure is total but benign). malformed_input: the parser declares its policy - whole-line comments and trailing commas are stripped before JSON.parse, unparsable text catches to [], scalar and null roots are treated as no rows (an array root is walked with for..in and renders phantom rows keyed 0,1,... - KI-MENU-JSONC-ARRAY-ROOT, #13492), and non-object entries are skipped during normalization, so malformed shape can never enter the tree. boundary: an empty file yields [] with the injected root, and a user override for an unknown key still merges (per-key override semantics do not require the key to exist upstream). Catalog 1.11.0 re-review: input_domain applied, it merges the default and user menu files, whose byte-level domain is stated and witnessed on SW-REQ-260922-E4J2 and SW-REQ-260922-3T3F. concurrency_scale applied, the two FileView loads finish in either order and each rebuilds the tree, so the merged tree must not depend on their order.

• propertyreviewedinvariant_preservation

  invariant_preservation: the merge rebuilds fresh items/itemOrder objects on every pass and never writes into the QML var properties it is handed (the documented engine dropped-write defect behind the historical duplicate-row bug), so merge is idempotent and rerun-safe, kind/parent inference is a pure function of the entry shape, and the root is injected exactly once. determinism: default-then-user source order fixes override precedence; equal-priority conflicts resolve last-writer-wins deterministically.

• structuralnot applicable

  JS objects under a GCd engine: no manual memory, pointer arithmetic, or format-string surface; the JSONC stripper is two string-blind regex passes (string-literal gaps tracked as KI-MENU-JSONC-COMMA-IN-STRING), and malformed text is dispositioned under scenario.malformed_input (catch to []). No nil deref: every entry passes the object-shape guard before normalization.

• domainnot applicable

  the user menu config is the trust root for its own session (same disposition as the keybinding Lua review): merging it cannot cross a privilege boundary, and app/provider rows land through their own children with their own hazard decisions. No external call, timeout, or concurrency surface in the merge itself (single synchronous function per merge). cross_structure_key_identity is met by construction - the map is keyed by the same id string that normalizeItem stamps into entry.id, so key and identity cannot drift.