thrift-0002: t_cpp_generator::is_struct_storage_not_throwing() vector<t_field*>
member deduplication uses std::find O(M²) — fix with unordered_set
victoria-metrics-0002: MetricName RemoveTagsOn/RemoveTagsIgnoring hasTag()
O(T×I) linear scan inside per-metric loop — fix with map-based tag set
pulsar-0007: ModularLoadManagerImpl.reapDeadBrokerPreallocations() takes
List<String> aliveBrokers, calls contains() O(B) per broker — fix with HashSet
kafka-0010: fix unit test worst-case ordering (shared-topic last for slow path)
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
