game-engines: allegro5/bullet3/box2d/dry CWE-407 scan

bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)

defects/dragonfly/patch/CLEAN.md

@@ -0,0 +1,16 @@
+# CLEAN — Dragonfly (Redis-compatible, C++)
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
+
+## Scope
+- `src/server/` — key eviction, cluster family, stream family, replication
+- `src/core/search/` — HNSW vector search, range tree
+- `src/server/search/` — document index, aggregator, search family
+
+## Findings
+- **HNSW vector search** (`src/core/search/hnsw_alg.h`) — uses `VisitedListPool` with a flat array indexed by element ID (`visited_array[id] == tag`). O(1) per visited check. CLEAN.
+- **Aggregator dedup** (`src/server/search/aggregator.cc`) — uses `absl::flat_hash_set<Value>` for DISTINCT counting. CLEAN.
+- **`search_family.cc` kIgnoredOptions** — `std::find` on `kIgnoredOptions` / `kIgnoredOptionsWithArg` which are compile-time constant arrays of ~5 strings. O(1) in practice. CLEAN.
+- **`doc_index.cc` free_ids_** — DCHECK-only assertion, not a production hot path. CLEAN.
+- **Cluster / replication** — no vector-based membership checks found in hot paths; uses hash maps throughout.
+
+**Result: No actionable CWE-407 defects. Dragonfly consistently uses `absl::flat_hash_set`, `flat_hash_map`, and array-indexed visited tracking.**