Certain

An exact application identifier boundary matches a container, preference domain, or documented application-owned path. Certain is the strongest evidence class; it is still not allowed to bypass a shared-resource or protected-path decision.

Strong

Multiple specific signals agree—for example an exact app-name boundary plus a reviewed Homebrew Cask zap path or compatible signing identity. The evidence inspector lists every contributing signal.

Possible

A weaker clue such as a loose display-name match points to the item, but the relationship is not specific enough for default selection. Possible findings begin excluded and require deliberate review.

Blocked or shared

Protection is a decision, not another confidence level. Another installed app, a shared vendor root, different signing team, symbolic link, system path, root owner, or protected product class blocks the item. Positive evidence never cancels this decision.

Homebrew Cask paths

The bundled catalog is generated from literal bounded Library paths in a pinned Homebrew Cask snapshot. The generator does not execute Ruby. Dynamic expressions, broad globs, absolute system paths, and traversal components are rejected. A catalog match remains visible evidence and must still pass the live safety checks.

The operation receipt

The final receipt records selected-app identity, scan coverage, each candidate and reason, each exclusion, the approved plan, move or copy outcome, SHA-256 verification where used, retention, and restore state. That makes a later answer possible: what was considered, what actually moved, and why?

Confidence describes the relationship to the selected app. Safety decides whether AppUnwind may act. Your reviewed plan is the final authorization.