synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN

synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.

defects/matrix-js-sdk/patch/CLEAN.md

@@ -0,0 +1,24 @@
+# matrix-js-sdk — CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-30
+Source: https://github.com/matrix-org/matrix-js-sdk (depth=1)
+
+## Scan Coverage
+- `src/models/room.ts` — room timeline, member list, thread notifications
+- `src/models/room-state.ts` — member filtering
+- `src/sync.ts` — sync processing, toDevice event handling
+- `src/filter-component.ts` — event filter evaluation
+- `src/client.ts` — client-level operations
+- `src/models/event-timeline-set.ts` — timeline event dedup
+- `src/crypto/` — device tracking, key verification
+
+## Findings
+All `.includes()` / `.indexOf()` calls found are on:
+- Small constant arrays (enum value checks, 2-5 elements)
+- `functionalMembers` (service member IDs, typically 0-2)
+- `excludedIds` (small exclusion lists)
+- `cancelledKeyVerificationTxns` (bounded by single sync response)
+
+No O(N^2) patterns found in hot paths. The codebase correctly uses
+Map/Set for large collections and only uses Array.includes() on small,
+bounded arrays.