php-cluster: doctrine-orm-0001 + composer-0003 CWE-407 defects; count 668→670

doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH
  - src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list
  - addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class
  - Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000

composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM
  - needles array grows during foreach($packages) loop, in_array scan 3 sites
  - $packagesFoundSet already exists for cycle-detection but needles is separate
  - Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000

cayley: CLEAN (confirmed -- map-based seen/pathMap throughout)
tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)

defects/wasmtime/patch/CLEAN.md

@@ -0,0 +1,12 @@
+# CLEAN — wasmtime
+
+Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
+
+## Findings
+
+- `crates/environ/src/graphs/scc.rs` — SCC algorithm uses `EntitySet` (a sparse set abstraction) for `on_stack`. CLEAN.
+- `crates/environ/src/fact/trampoline.rs` — `ancestors: Vec<RuntimeComponentInstanceIndex>` with `.contains()` for reentrance guard: WebAssembly Component Model instance nesting depth is bounded in practice (typically 2–5 levels). Called once per adapter compilation (not per Wasm call). Not actionable.
+- `crates/wasmtime/src/compile.rs` — `trampoline_types_seen: HashSet`. CLEAN.
+- `crates/environ/src/compile/module_types.rs` — `already_seen: HashMap` for rec group deduplication. CLEAN.
+
+**Result: No actionable CWE-407 defects.**