whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/fish/patch/fish-CLEAN.md

@@ -0,0 +1,33 @@
+# fish — CLEAN
+
+## Scan Date
+
+2026-03-27
+
+## Files Scanned
+
+- `src/complete.rs` (completion dedup, wrap targets)
+- `src/exec.rs` (process execution)
+
+## Findings
+
+No CWE-407 defects found. Fish shell has been rewritten in Rust and uses
+appropriate data structures throughout.
+
+### Completion dedup (`unique_completions_retaining_order`)
+
+Uses `HashSet::insert()` for O(1) per-element dedup — correct.
+
+### Completion tombstones (`COMPLETION_TOMBSTONES`)
+
+`BTreeSet<WString>` — O(log N) lookup — not O(N). Correct.
+
+### Wrap targets (`complete_add_wrapper`)
+
+`Vec::contains()` on per-command wrapper list. The list is bounded by the
+number of wraps registered for a single command (typically 1-5). Not a
+cross-product loop. Correct.
+
+### Verdict
+
+CLEAN — no algorithmic complexity defects in scanned code paths.