kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
widgets read/write the same map from the main thread — data race on project
load. Patch: add QMutex, wrap all m_lumacache access sites.
audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.
9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).
