scala-0002: RefChecks.intersectionIsEmpty O(D²) 100x; julia/octave deeper scan CLEAN

defects/octave/patch/octave-deeper-CLEAN.md

@@ -0,0 +1,37 @@
+# Octave — CWE-407 Deeper Scan: CLEAN (beyond octave-0001/octave-0002)
+
+## Scan Date
+2026-03-29
+
+## Areas Scanned
+
+### 1. libinterp/corefcn/load-path.cc — m_dir_list
+- Line 1661: `std::find(m_dir_list.begin(), m_dir_list.end(), dir_name)` in `package_info::move()`
+- `m_dir_list` is `std::list<std::string>` — O(D) linear scan.
+- **Severity assessment:** LOW — `move()` is called only during manual path reordering
+  (e.g. `movepath`/`addpath`), not during function lookup. Not in a nested loop.
+- **Result:** CLEAN (below CWE-407 threshold for hot-path requirement).
+
+### 2. libinterp/corefcn/load-path.cc — path string scan
+- Lines 163–171: `path_list.find(path)` — this is `std::string::find()` on a colon-separated
+  path string, not a container membership scan.
+- **Result:** CLEAN (string substring search, not container dedup).
+
+### 3. libinterp/parse-tree/pt-classdef.cc — classdef MRO
+- No visited/seen arrays in classdef hierarchy traversal.
+- **Result:** CLEAN.
+
+### 4. libinterp/corefcn/fcn-info.cc — function lookup
+- Uses `std::map`-based lookups throughout — O(log N) or O(1) via unordered_map.
+- **Result:** CLEAN.
+
+### 5. liboctave/ — numerical libraries
+- No visited/seen arrays found.
+- **Result:** CLEAN.
+
+## Conclusion
+
+No additional CWE-407 defects found beyond octave-0001 (vecdim std::find)
+and octave-0002 (load_path::add directory presence scan). The only remaining
+`std::find` on a list is in `package_info::move()` which is a rarely-called
+path-reordering utility and does not qualify as a hot-path nested scan.