The config that failed openConcept

A single trailing comma made your entire global Claude config invisible — 53 allow rules, 52 deny rules, every hook, and your default model. Nothing failed loudly. This is what 'failing open' looks like.

A config file has two ways to be wrong. It can say the wrong thing — you typed the wrong path, allowed the wrong command — and the system does something you didn't want. Or it can be unreadable, and the system does nothing at all, quietly, using its built-in defaults instead. The first kind announces itself. The second kind is invisible, because a program that can't read your preferences doesn't know it had any.

That's 'failing open': when the safety mechanism breaks, the gate swings open rather than shut. Your settings.json is mostly protective — 52 deny rules stopping reads of .env files, SSH keys, .pem certificates, your Documents and Pictures folders. While the file was unparseable, none of those existed. Neither did your 53 allow rules, which is the other half of the damage: headless jobs that depend on pre-approved tools hit permission walls with no human to click Approve. The Aug 11 lesson diagnosed exactly that failure for the JobHunt sweep.

The nastiest detail is the provenance. This break came from a fix. You went in to correct six malformed deny rules — a real problem, correctly identified — and left a comma where JSON forbids one. Every edit to a config is a chance to zero it out, and the edits most likely to break it are the ones you make while improving it.

Worked example

The check that would have caught it, and the one line that did the damage:

# What the file said (line 113-114) — JSON does not allow that last comma
#   "Read(/Users/tom/Library/Mobile Documents/**)",
#   ]

# The whole diagnostic, in one command:
python3 -c "import json; json.load(open('/Users/tom/.claude/settings.json'))"

# And what the tool already knew:
claude doctor | grep -A2 'Invalid settings'

# After the fix — count what came back online:
python3 -c "
import json; d=json.load(open('/Users/tom/.claude/settings.json'))
p=d['permissions']
print('allow:', len(p['allow']), 'deny:', len(p['deny']))
print('hooks:', list(d['hooks']), 'model:', d['model'])"

• JSON permits no trailing comma before a closing bracket. Many languages do; JSON never has. This is the single most common way a hand-edited config dies.
• `json.load` is the entire test. It either parses or raises with a line and column number — here, line 113 column 53. No tooling required beyond Python.
• `claude doctor` was already reporting this. The information existed; nothing routed it anywhere you read. That gap, not the comma, is the real bug.
• Counting what returns after the fix is how you measure the blast radius. 53 + 52 + 3 hook types + the default model were all dark.

Gotchas

• A backup is not a rollback if the file was never in git. settings.json isn't tracked in your home repo, so there was no known-good version to restore — the fix had to be made by hand.
• settings.local.json parsed fine the whole time, which is why some behavior looked normal. Partial config is more confusing than no config.
• Don't add the comma back by 'tidying' the list later. If you sort or reorder those rules, re-run the parse check before you close the file.