MenuModel.js stripJsonc used the string-blind regex /,(\s*[}\]])/g to strip JSONC trailing commas. Because \s* matches zero characters and the regex never tracked string literals, a comma inside a string value followed by } or ] (with any amount of whitespace, including none) was deleted even though it was data. JSON.parse accepts the stripped text, so nothing ever surfaced an error: the corruption was silent. Two observed failure modes. Mode (a) display corruption: a label "x, ]y" rendered as "x ]y". Mode (b) command mutation, the realistic payload: an action "mv f{.bak,}" became "mv f{.bak}" (brace expansion destroyed; mv then targets a literal filename) and "awk '{print $1, }'" became "awk '{print $1 }'" (output format silently changed for downstream pipelines). omarchy-menu executes action strings with the invoking user's full privileges, so a mutated command runs mutated with no warning. The defect did not escalate privilege - the user authors the config - but it violated the explicit-configuration contract invisibly. Reproduced old-vs-new on 2026-09-27 (research-delta doc); fixed on this branch by the string-aware single-pass scanner.

risk area

Config Behavior

No requirement modeled the comma-drop decision, so its two conditions (comma_in_string, next_char_closes_json) were unexercised variables and no test partition held a comma+closer inside a string literal. The 3T3F parse-robustness requirement could never catch this class because the corrupted text still parsed successfully.