whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/zsh/patch/zsh-CLEAN.md

@@ -0,0 +1,36 @@
+# zsh — CLEAN
+
+## Scan Date
+
+2026-03-27
+
+## Files Scanned
+
+- `Src/params.c` (parameter lookup)
+- `Src/jobs.c` (job table)
+- `Src/exec.c` (command resolution, findcmd)
+
+## Findings
+
+No CWE-407 defects found.
+
+### Parameter lookup (`paramtab`)
+
+`paramtab` is a hash table (`HashTable`); lookups use `paramtab->getnode()`
+which is O(1). No linear scans in parameter access paths.
+
+### Job table (`jobtab`)
+
+`jobtab` is an array indexed by job number; lookup is O(1) by index. The
+`findproc()` function scans jobs linearly, but it is called from signal
+handlers on PID receipt — not in a per-event inner loop.
+
+### Command resolution (`findcmd`, `cmdnamtab`)
+
+`cmdnamtab->getnode()` is a hash table lookup O(1). `findcmd()` does walk
+`path[]` linearly but this is bounded by PATH entries (typically < 20), not
+by the number of commands. Not CWE-407.
+
+### Verdict
+
+CLEAN — no algorithmic complexity defects in scanned code paths.