Hazard review

• scenarioreviewedmalformed_inputboundaryedge_caseinput_domain

  Clean-baseline review against upstream e332dc97 (2026-10-01). Upstream stripJsonc is two string-blind regex passes: a line-anchored pass drops each whole-line // comment with its line break, then a pass drops each comma whose next non-whitespace character is } or ]. Worst case: the comma pass also matches inside string literals, so a label or action carrying comma+closer ("x, ]y", mv f{.bak,}) is silently rewritten while the parse still succeeds (KI-MENU-JSONC-COMMA-IN-STRING, #13250); an inline // tail is not stripped, so JSON.parse rejects the file and the whole file contributes no rows (KI-MENU-JSONC-INLINE-COMMENT, #13493; docs/menu.md documents the limitation); block comments are not stripped (KI-MENU-JSONC-STRIP-GAPS). Within the documented grammar the order of the two passes is the control: a trailing comma followed by whole-line comments and then } or ] is dropped, so a commented-out entry after the last real one keeps every row (preservation tests in menu-test.sh and test/node/menumodel-replay.test.mjs, incl. the shipped extension template with its examples uncommented, and a 2000-case seeded differential property test). boundary: EOF without a trailing newline after a comment line is matched by (\n|$); a file that strips to whitespace yields []. edge_case: // inside a string survives because only line-leading comments are matched; CRLF comment lines are removed whole. Catalog 1.11.0 re-review: input_domain applied, input_domain is on its obligation checklist: LF, CRLF, comment indentation with any JS whitespace, any character inside strings and huge files are accepted; non-ASCII whitespace between tokens and CR-only files with a comment empty the menu (KI-MENU-JSONC-UNICODE-WHITESPACE, KI-MENU-JSONC-CR-LINE-ENDINGS). concurrency_scale not applicable, a pure function of its arguments, recomputed on each load or keystroke: no state across calls, no process, timer or lock.

• propertyrevieweddeterminism

  The strip is a single left-to-right state-machine pass with two states (in-string, outside), so one input yields one output every time - the same authored file parses to the same entries on every load, including across the file watcher's reloads.

• structuralnot applicable

  Character-classified string concatenation in a bounded single pass; no memory management, pointer math, or numeric surface, and no encoding transform - bytes pass through verbatim outside the two strip rules.

• domainnot applicable

  The parser consumes the two fixed local menu JSONC paths (same-user, no egress sink in the traced files), and the parse-failure recovery policy (empty list, defaults preserved) is owned by the failure-arm siblings (3T3F/66FW), so no domain class binds to the strip contract reviewed here.