supermodel: all 5 MOADs CLEAN (full coverage)

defects/supermodel/patch/CLEAN.md

@@ -0,0 +1,38 @@
+# Supermodel — MOAD 0001-0005 CLEAN
+
+Scanned: 2026-03-31
+Source: https://github.com/trzy/Supermodel (depth=1)
+
+## MOAD-0001 (CWE-407)
+
+No meaningful linear scans in hot paths.
+
+- GameLoader uses std::map/std::set with O(log N) or O(1) lookups for ROM file
+  identification by CRC32.
+- Graphics (New3D, Legacy3D) uses unordered_map for texture and shader caching.
+- CPU emulators (PPC, 68K, Z80) have no collection membership scans in per-cycle
+  paths.
+- Input system CheckKeySources/CheckMouseSources/CheckJoySources use find() in
+  the ReadMapping configuration path only (not per-frame gameplay polling).
+  Sources and badSources vectors are bounded by pressed-key count (<10 in
+  practice), not a hot defect.
+
+## MOAD-0002 (Intertangle)
+
+No god-object or shared mutable global state coupling found. CModel3 owns all
+hardware subsystems as members and passes references explicitly.
+
+## MOAD-0003 (Leaked Context)
+
+No thread_local or ThreadLocal usage. Supermodel is a C++ project with a
+largely single-threaded emulation core. No request-scoped identity carriers found.
+
+## MOAD-0004 (CWE-312)
+
+No credential logging found. Network board (NetBoard.cpp) does not log session
+tokens, authentication material, or ROM serial numbers verbatim.
+
+## MOAD-0005 (Thundering Herd)
+
+No cache get+null+put without synchronization. Supermodel's render state is
+managed on a single thread. No concurrent shader or pipeline caches found.