shotcut+rawtherapee: 5-MOAD scan, 1 new defect rawtherapee-0001

shotcut-0001 already existed (m_hashes std::find, UNDF-2026-000000805).
Fixed duplicate UNDF comment in patch header. Added SCAN-NOTES.md.
MOADs 0002-0005: MAIN god object noted; 0003/0004/0005 CLEAN.

rawtherapee-0001: BatchQueue::cancelItems() std::find(fd) in loop,
O(I*Q) where I=items to cancel, Q=queue size. 166-333x overhead at
Q=1000-2000. Fix: unordered_set + single remove_if pass. 2/2 PASS.
MOADs 0002-0005: App::get().options() god object noted; 0003/0004/0005 CLEAN.

defects/shotcut/SCAN-NOTES.md

@@ -0,0 +1,32 @@
+# Shotcut MOAD Scan Notes
+
+Date: 2026-03-31
+Target: https://github.com/mltframework/shotcut (depth=1)
+Language: C++/Qt/QML
+
+## MOAD-0001 (CWE-407): shotcut-0001 PATCHED
+
+`src/docks/playlistdock.cpp` PlaylistProxyModel:
+
+- `m_hashes` is `std::vector<std::string>` (sorted)
+- `filterAcceptsRow()` calls `std::find(m_hashes.begin(), m_hashes.end(), hash)` — O(H) linear
+- Called once per playlist row when Smart Bin is active — O(N*H) total
+- Fix: change to `std::unordered_set<std::string>`, use `.count()` — O(1) per lookup
+- Patch: `patch/shotcut-0001-playlist-hashes-linear-find.patch`
+- Unit test: `unit/ShotcutTest.java` — 375x ratio at N=1000, PASS
+
+## MOAD-0002 (Intertangle): NOTE only
+
+`MainWindow::singleton()` accessed via `MAIN` macro from 47 source files. Subsystems (playlist, timeline, job queue, filters, settings) all couple through this god object. Architectural issue, not patchable at MOAD scope.
+
+## MOAD-0003 (Leaked Context): CLEAN
+
+No `thread_local`, `QThreadStorage`, or equivalent thread-scoped identity carriers found.
+
+## MOAD-0004 (CWE-312 Logged Secret): CLEAN
+
+No cloud credential logging found. Shotcut has no YouTube/S3/OAuth upload path that logs tokens or keys through `LOG_DEBUG`/`LOG_INFO`.
+
+## MOAD-0005 (Thundering Herd): CLEAN
+
+No unsynchronized cache get+null+compute+put patterns found. Database uses `QMutex`. No concurrent cache race conditions identified.

defects/shotcut/patch/shotcut-0001-playlist-hashes-linear-find.patch

@@ -1,5 +1,4 @@
 # UNDF: UNDF-2026-000000805
-# UNDF: (leave blank)
 # Defect: shotcut-0001
 # Component: src/docks/playlistdock.cpp — PlaylistProxyModel m_hashes
 # Pattern: CWE-407 — std::find on vector<string> m_hashes inside filterAcceptsRow (called per row)