openra: ALL 5 MOADs CLEAN

Scanned 1509 C# files in OpenRA (C# RTS game engine, Command & Conquer style).

MOAD-0001 (CWE-407): CLEAN. Exceptionally well-optimized. FrozenSet<string>
for config type checks, HashSet<Actor/CPos> for membership, binary search in
TraitDictionary, CellLayer bounds checks. Only List.Contains on small bounded
collections (<50 items).

MOAD-0002 (Intertangle): CLEAN. Trait-based ECS architecture. No god objects.
MOAD-0003 (Leaked Context): CLEAN. Single ThreadLocal for diagnostics only.
MOAD-0004 (CWE-312): CLEAN. Only public identifiers logged, no secrets.
MOAD-0005 (Thundering Herd): CLEAN. Single-threaded game logic, proper lock()
on multi-threaded subsystems.

defects/openra/CLEAN

@@ -0,0 +1,40 @@
+OpenRA — ALL 5 MOADs CLEAN
+
+Target: https://github.com/OpenRA/OpenRA (C# RTS game engine)
+Scanned: 2026-03-31
+Files: 1509 .cs files
+
+MOAD-0001 (CWE-407): CLEAN
+  OpenRA is exceptionally well-optimized for collection membership:
+  - FrozenSet<string> used throughout for config-driven type checks
+    (AirUnitsTypes, NavalUnitsTypes, ExcludeFromSquadsTypes, ProtectionTypes,
+    CaptorTypes, VeinholeActors, AllowedTerrainTypes, etc.)
+  - HashSet<Actor> for activeUnits, reserves, selection actors
+  - HashSet<CPos> for veinholeCells, accessibleCells, DisabledSpawnPoints
+  - Binary search in TraitDictionary for actor-trait lookups
+  - CellLayer bounds checks (not list membership) for Map.Contains()
+  - PERF comments throughout showing developer awareness of hot paths
+  - Only List.Contains found on small, bounded collections (rolloverActors,
+    controlGroups with <50 user-selected units, Repairers with <4 players)
+
+MOAD-0002 (Intertangle): CLEAN
+  Trait-based entity component system. State attached to actors via traits,
+  not shared through global mutable state. Static caches (ChromeProvider,
+  ChromeMetrics, TextNotificationsManager) are UI singletons with
+  initialization-time or single-writer patterns.
+
+MOAD-0003 (Leaked Context): CLEAN
+  Single ThreadLocal<PerfTimer> used for diagnostic performance profiling
+  (PerfTimer.cs), not request-scoped identity. Game logic runs on a single
+  thread.
+
+MOAD-0004 (CWE-312): CLEAN
+  Server logs fingerprints (public identifiers), profile names, UIDs, and
+  endpoints. No private keys, passwords, auth tokens, or signatures are
+  logged. AuthSignature and AuthToken are verified but never written to logs.
+
+MOAD-0005 (Thundering Herd): CLEAN
+  Game logic is single-threaded. Multi-threaded subsystems (graphics,
+  sound, network) use proper lock() synchronization (85 lock sites across
+  20 files). ConcurrentCache for thread-safe caching. GetOrAdd pattern
+  used on single-threaded game logic paths only.