Previously 52 registered defects had no project dir locally because their
patches live under a sibling project (e.g. ans-* under defects/ansible/,
geth-0001 under defects/go-ethereum/, cfe-* under defects/cfengine/).
Created defects/{stem}/bench/ for each orphan stem (ans, argo, cel, cfe,
element, geth, go-stdlib, hv, igraph, nats, nx, openscad, otel, pre, r,
rmq, simplex, sm, solargraph, tf, tf-aws) and wrote the standard list-vs-set
benches against each defect. Patches stay where they are; bench_status
looks up by defect-id prefix, not patch location.
Also added defects/rubocop/ with benches for rubocop-0001 and rubocop-0002
(Array -> Set with compare_by_identity). Both were misclassified as
MOAD-0011 ReDoS in generate_undf.py; the tickets show they're CWE-407
Sedimentary (O(N*S) -> O(N+S) via identity Set).
Coverage: 1243 -> 1281 (96.0% -> 98.9%). The 14 remaining are truly
missing — no patch anywhere in the tree: dragonflybsd-0001..0005,
jami-daemon, jitsi-videobridge, netbsd-0001..0004, regamedll-cs-0001,
supertuxkart-0002, hadoop-rpc-0001.
Restructure openscad-0001 (was in wrong dir, Java test) into proper
openscad-0001/ with TICKET.md and Python test. New openscad-0002 patches
PolySetBuilder::endPolygon + appendPolySet std::find on colors_ vector ->
unordered_map; Color4f already has std::hash. New openscad-0003 patches
OctoPrint::requestApiKey and getJsonData to stop logging API responses
verbatim (app_token + api responses exposed under --debug).
MOADs 0002/0003/0005 CLEAN.
Defect: export_amf.cc add_vertex() uses std::find on std::vector for every
vertex during AMF export. For meshes with V vertices, total cost is O(V²).
Fix: parallel unordered_map<vertex_str, size_t> for O(1) lookup.
Unit test: 5-16x ratio at V=500-5000, PASS.
