When Set is called with a key path that contains an array-index component [N] whose parent in the addressed JSON is an OBJECT rather than an array, the implementation emits **malformed JSON output** and returns it with a **nil error**. The caller has no signal that the returned bytes cannot be re-parsed by any JSON consumer. Reproducer (filed as KI-3, locked by tripwire set_spec_test.go:TestSetArrayIndexUnderObjectMalformedJSON_KI3): Set({"a":{"b":1}}, 9, "a", "[5]") -> {"a":{"b":1,9}} (INVALID) Set({"a":{"b":1}}, 9, "a", "[0]", "x") -> {"a":{"b":1,{"x":9}}} (INVALID) Set({"a":1}, 9, "[0]") -> {"a":1,9} (INVALID) Each output is rejected by encoding/json.Unmarshal with "invalid character '9' looking for beginning of object key string" or similar. Root cause: createInsertComponent (parser.go:756) with isIndex=true, comma=true, object=false emits only ,<value> (no quoted object key), so the value is spliced into the object body where JSON requires a "key":value pair. Set (parser.go:1018-1038) does not reject the cross-type path before invoking createInsertComponent. The symmetric case (object-key component under an array parent) is handled by auto-vivification, so the bug is specifically [N]-under-object. Hazard class: this is the same family as PR #286 (silent data corruption on underspecified Set partitions). The partition "path component kind mismatches its parent container kind" was not covered by SYS-REQ-009's fretish. The catalog obligation malformed_input is now attached to SYS-REQ-009 so the audit enforces this failure mode henceforth.

risk area

Data Integrity