no-stone-unturned wave: 8 new defects, 15 CLEAN confirmations; count 621→629

New defects (all PASS):
- exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20
- minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24
- minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N)
- minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N)
- minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N)
- mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000
- ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x
- pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x

CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup,
  prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools,
  linux-kernel (pointer to linux/)

defects/express/patch/express-CLEAN.md

@@ -0,0 +1,30 @@
+# Express CWE-407 Scan — CLEAN
+
+**Scan date:** 2026-03-29
+
+## Files scanned
+
+- `lib/application.js` — routing setup, middleware registration
+- `lib/request.js` — request parsing helpers
+- `lib/response.js` — response formatting helpers
+- `lib/utils.js` — ETag, MIME, trust-proxy utilities
+- `lib/view.js` — template view resolution
+- `lib/express.js` — module entry point
+
+## Findings
+
+- `lib/request.js` — `String.indexOf(',')`, `String.indexOf(':')` calls are single
+  O(N) string scans on header values, never inside loops over requests/routes.
+- `lib/utils.js` — `type.indexOf('/')` and `str.indexOf(';')` are single-pass
+  content-type parser helpers; not called in nested loops.
+- `lib/response.js` — `type.indexOf('/')` once per content-type set; no loop.
+- `lib/application.js` — `methods.forEach(...)` iterates the 30 HTTP method names
+  once at module load time to register route handlers; not called per-request.
+- `res.format()` — iterates the caller's key-map once; no inner membership scan.
+- Vary header handling delegates to the `vary` npm package (not in-tree).
+
+## Conclusion
+
+No CWE-407 defects found in Express. All `indexOf`/`includes` calls occur in
+single-pass string parsing or bounded startup loops, never as inner membership
+checks nested inside per-request or per-route loops.