no-stone-unturned wave: 8 new defects, 15 CLEAN confirmations; count 621→629

New defects (all PASS):
- exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20
- minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24
- minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N)
- minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N)
- minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N)
- mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000
- ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x
- pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x

CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup,
  prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools,
  linux-kernel (pointer to linux/)

defects/dask/CLEAN.md

@@ -1,27 +1,39 @@
 # Dask — CWE-407 Scan: CLEAN
 
-**Date:** 2026-03-27
-**Target:** dask/dask
+**Date:** 2026-03-29 (re-scanned; original 2026-03-27)
+**Target:** dask/dask (Version 2026.3.0)
 **Files scanned:**
 - `dask/order.py` — task ordering algorithm
 - `dask/optimization.py` — graph fusion, visited nodes
 - `dask/base.py` — tokenization, key deduplication
 - `dask/_task_spec.py` — task specification graph traversal
 - `dask/local.py` — local scheduler
+- `dask/blockwise.py` — blockwise layer fusion
+- `dask/graph_manipulation.py` — graph cloning / rebinding
 
 ## Verdict: CLEAN
 
 All `not in` membership tests in hot graph traversal paths are against
 `set`, `dict`, or `frozenset` containers providing O(1) average membership:
 
-- `order.py:118` — `k not in dependencies` — dict
-- `order.py:246` — `item not in external_keys` — set
+- `order.py:237` — `item in result` — dict
+- `order.py:325` — `key in runnable_hull or key in result` — set, dict
 - `order.py:374` — `path[-2] not in result` — dict
+- `order.py:581` — `item in result` — dict
 - `optimization.py:62` — `d not in seen` — set
 - `optimization.py:156` — `child not in unfusible` — set
 - `optimization.py:215` — `key not in fused` — set
 - `optimization.py:349` — `key not in output` — set/dict
 - `optimization.py:577` — `v not in rdeps` — dict
+- `local.py:182` — `key in seen` — set
+- `local.py:309` — `dep not in results` — dict
+- `blockwise.py:1123` — `layer in seen` — set
+- `blockwise.py:1389` — `x in seen` — dict
+- `graph_manipulation.py:299` — `layer in omit_layers` — set comprehension
 - `base.py:490` — `tok not in repack_dsk` — dict
 
+The only `if x in [...]` patterns found are against constant-size literal
+lists (e.g. `mode in ["edge", "linear_ramp"]`, `kind in [p.POSITIONAL_OR_KEYWORD, ...]`)
+— these are not hot-path O(N) issues.
+
 No CWE-407 defects found.