Every recorded revision of this object's source — newest first, each with the commit message and its file-level diff.

When `Set` is called with a key path that contains an array-index component `[N]` whose parent in the addressed JSON is an OBJECT rather than an array, the implementation emits **malformed JSON output** and returns it with a **nil error**. The caller has no signal that the returned bytes cannot be re-parsed by any JSON consumer. Reproducer (filed as KI-3, locked by tripwire `set_spec_test.go:TestSetArrayIndexUnderObjectMalformedJSON_KI3`): Set(`{"a":{"b":1}}`, `9`, "a", "[5]") -> `{"a":{"b":1,9}}` (INVALID) Set(`{"a":{"b":1}}`, `9`, "a", "[0]", "x") -> `{"a":{"b":1,{"x":9}}}` (INVALID) Set(`{"a":1}`, `9`, "[0]") -> `{"a":1,9}` (INVALID) Each output is rejected by `encoding/json.Unmarshal` with "invalid character '9' looking for beginning of object key string" or similar. Root cause: `createInsertComponent` (parser.go:756) with `isIndex=true, comma=true, object=false` emits only `,<value>` (no quoted object key), so the value is spliced into the object body where JSON requires a `"key":value` pair. `Set` (parser.go:1018-1038) does not reject the cross-type path before invoking `createInsertComponent`. The symmetric case (object-key component under an array parent) is handled by auto-vivification, so the bug is specifically `[N]`-under-object. Hazard class: this is the same family as PR #286 (silent data corruption on underspecified `Set` partitions). The partition "path component kind mismatches its parent container kind" was not covered by SYS-REQ-009's fretish. The catalog obligation `malformed_input` is now attached to SYS-REQ-009 so the audit enforces this failure mode henceforth.

risk area

Data Integrity