pygame/libgdx: CWE-407 findings

pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)

defects/pygame/patch/CLEAN.md

@@ -0,0 +1,20 @@
+# pygame — CWE-407 Scan Result: CLEAN
+
+**Scanned:** 2026-03-30
+**Scope:** Python layer (`src_py/`), Cython layer (`src_c/cython/`), event C layer (`src_c/event.c`)
+
+## Findings
+
+No CWE-407 defects found in the runtime Python/Cython/C layers.
+
+### Why pygame is clean
+
+- `AbstractGroup` uses `dict` (`spritedict`) for all sprite membership — O(1) `in` checks.
+- `Sprite.__g` is a `set` — O(1) group membership.
+- Event blocking (`set_blocked`/`get_blocked`) uses SDL's native `SDL_EventState` array — O(1).
+- `LayeredUpdates` uses `_spritelayers` dict for layer lookups — O(1).
+- `sysfont` module uses `dict` for font registry — O(1).
+- `OrderedUpdates._spritelist.remove()` is O(N) but is a single-shot operation, not nested.
+
+The build infrastructure (`buildconfig/`) contains some list membership patterns but these
+run once at build time, not in game loops, and are not relevant to runtime complexity.