undf: assign UNDF-2026-000000055 to solang-0001, stamp patch

defects/beam/patch/CLEAN.md

@@ -0,0 +1,25 @@
+# CLEAN — Apache Beam
+Scanned 2026-03-29 for CWE-407.
+
+## Scope
+
+- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser
+- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold
+- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator
+- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList
+- `runners/jet/src/main/java` — DAGBuilder
+
+## Findings
+
+| Location | Pattern | Type | Result |
+|----------|---------|------|--------|
+| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN |
+| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet<String>` | CLEAN |
+| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN |
+| `DataflowRunner.experiments` | `experiments.contains(...)` | `List<String>` — called at job-submission time (once), not in hot loop | LOW — startup only |
+| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN |
+| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN |
+
+The `DataflowRunner.experiments` pattern makes several `List<String>.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407.
+
+**Result: No actionable CWE-407 defects.**