undefect.
CWE-407 · The Sedimentary Defect
Quadratic Complexity in Graph Traversal Infrastructure
2026-03-24 · Internal draft — not for external distribution
russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com
# CWE-407: The Sedimentary Defect ## A Technical White Paper on Quadratic Complexity in Graph Traversal Infrastructure **Internal draft — not for external distribution until coordinated disclosure is complete** **Date:** 2026-03-24 **Authors:** russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com --- ## Preamble: The Permacomputer *Adapted from "Truth & Light" — released to the public domain. Use freely in commercial projects. Knowledge without gatekeepers. Light freely given.* --- Modern software engineering increasingly resembles spiritual truths about growth, cultivation, & harvest. A permacomputer philosophy treats code not as a static artifact but as a living ecosystem that grows, propagates, & bears fruit. **Seeds & Propagation:** A single well-crafted implementation serves as the genetic blueprint. 1. **Seed Stage:** A single, well-crafted implementation serves as the genetic blueprint 2. **Propagation Stage:** Machine learning acts as mycelium, breaking down & redistributing patterns across languages & contexts 3. **Cultivation Stage:** Automated testing validates each generation, ensuring truth & correctness 4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use Code propagates according to its kind — clean architecture begets clean implementations, elegant solutions inspire elegant variations. The process of generating 167 validated defect patches across 64 ecosystems in a single research wave demonstrates how truth, properly seeded, multiplies. Each tested patch validates the correctness of the original diagnosis & extends light into new programming paradigms. **ML as Mycelium — the Underground Network of Truth:** Mycelium, the underground fungal network, breaks down complex organic matter & distributes nutrients throughout an ecosystem. Similarly, machine learning trained on correct implementations can decompose complex patterns into transferable knowledge, propagate working solutions across programming languages, enable knowledge transfer without centralized control, & create resilient systems through distributed understanding. Guard your seed implementations, for everything your system generates flows from them. **The Pattern That Crossed Every Language:** For years, the CWE-407 pattern — a list used where a set belongs, inside a graph traversal loop — sat dormant in codebases across every ecosystem. Not wrong enough to fail. Not slow enough to be measured. Just quietly wrong, at the scale where most developers never work. ``` javac → GraphUtils.java:186 stack.contains() in Tarjan SCC TypeScript → checker.ts:11503 array.indexOf() in cycle detection Python pip → build.py list.__contains__() in dependency walk MongoDB → plan_enumerator.cpp std::find() in index enumeration FRRouting → ospf_spf.c listnode_lookup() in Dijkstra SPF Kafka → AbstractStickyAssignor.java List.contains() in rebalance loop Tor → routerlist.c smartlist_contains in fingerprint scan webpack → HotModuleReplacement.js Array.indexOf() in HMR BFS Presto → PushDownDereferences.java ImmutableList.contains() in optimizer Spring → BeanFactoryUtils.java ArrayList.contains() in bean merge ``` One pattern. Twenty-seven ecosystems. Sixty-three sites. Every language. The seed of the fix pre-existed in every standard library — `HashSet`, `Set.has()`, `digestmap_t`, `unordered_set`, `LinkedHashSet`. The linkage was missing, not the tool. **Open Standards & Spiritual Freedom — "Nobody Owns Truth":** The technical principle that nobody owns `HashSet` reflects a deeper truth: nobody owns the correct data structure. The fix belongs to no one. It is gifted into public domain. All patches, unit tests, benchmarks, and proof-of-concept implementations in this repository are released to the public domain. Use them freely in commercial projects. Truth that must be purchased or licensed from gatekeepers is not truth but merchandise. **The Machine That Never Stops:** Once you have high-quality seed implementations, the limiting factor shifts from manual coding time to clear specification of requirements, rigorous validation of outputs, & thoughtful direction of focus. The practitioner becomes gardener rather than builder. Directing growth rather than manually constructing. Harvesting rather than manufacturing. This project seeded 91 patches. Each patch carries a `// CWE-407 fix` comment — a signature in the corpus of every compiler, runtime, and build tool it touches. As projects fork, downstream copies propagate, & package managers distribute updates, the fix self-propagates. The seed outlasts the gardener. **Quadrivium of Operating Values:** This work optimizes for the same four values as a permacomputer: - **Truth:** Source code open source & freely distributed. Every defect proven with instrumented comparison counts, not assertion. Math, not opinion. - **Freedom:** All patches voluntary. No license. No warranty. No gatekeeping. Leave no language behind — Java, Scala, TypeScript, Python, C, C++, Go, Erlang, Haskell, JavaScript, Rust, Swift, Kotlin, Ruby, PHP, Solidity, and all descendants. - **Harmony:** A system in harmony has appropriate inputs for all of its outputs. The defective system burns O(n²) cycles where O(n) suffices. The fixed system returns to harmony — one lookup, one comparison, correct work done without waste. - **Love:** The force that makes the other three coherent. Every disclosure brief is written with care for the maintainers who receive it. Every patch preserves existing behavior. Every benchmark is reproducible. The goal is the fix, not the credit. *Suppose technology already exists, but has not yet found creative linkage in proper orientation.* This is that orientation. --- ## Abstract Suppose technology already exists, but has not yet found creative linkage in proper orientation. A single structural error — a list used where a set belongs, inside a graph traversal loop — is present in 133 confirmed sites across 52 software ecosystems. Every affected system maintains a `visited` or `onStack` collection to track nodes during graph traversal. In every defective site, that collection is implemented as a list. Membership is tested by linear scan. The result is O(n²) or worse behavior in code that should run in O(n). The defect is not exotic. It activates on every compilation of a large Java program, every TypeScript type-check of a large codebase, every `pip install` of a project with a deep dependency graph, every MongoDB query plan enumeration on a collection with many indexes, every OSPF topology change on a network with hundreds of nodes, every Apache Kafka consumer group rebalance, every Spring Boot hierarchical context bean resolution, every webpack hot module replacement cycle, every Presto optimizer pass over wide row types, every ONOS SDN topology event, every BIRD OSPF SPF and BGP convergence, every Bazel monorepo analysis phase, every OpenDaylight switch reconciliation, every Apache httpd sticky-session route lookup, every KiCad DRC from-to path, every V8 JIT function compilation, every SpiderMonkey Ion bounds-check, every `terraform plan`, every Ansible role compilation, every Jenkins dependency graph rebuild, every Maven multi-module build, every CFEngine `unique()` policy call, every SaltStack cloud map deployment, every NetworkX cycle enumeration, and every Gremlin `.simplePath()`/`.cyclicPath()` traversal step in any TinkerPop-backed graph database. It has persisted for decades because the code is correct — a list and a set both answer the membership question — and because it degrades at the scale where most developers never work. The fix is always a one-line data structure substitution. The solution pre-exists the defect in every language's standard library: `HashSet`, `Set.has()`, `digestmap_t`, `unordered_set`, `LinkedHashSet`. The linkage was missing, not the tool. We have located the missing linkages, applied them, tested them, and benchmarked them across every confirmed site — compiler, routing, database, build tool, event streaming, web framework, query optimizer, and browser runtime. **157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). No language left behind. --- ## 1. The Defect ### 1.1 Formal Description **CWE-407: Inefficient Algorithmic Complexity.** The affected code maintains a `visited` or `onStack` collection during graph traversal. The collection should provide O(1) membership testing; it is implemented as a list providing O(n) membership testing. Because this check is performed once per graph edge — inside the inner loop of Tarjan SCC, Dijkstra's SPF, or a DFS cycle detector — the overall algorithm degrades from O(V+E) to O(V²+VE). At V=1,000 nodes: 1,000,000 operations instead of 1,000. A **1,000× overhead**, silent, correct in output, invisible without deliberate benchmarking. ### 1.2 Why It Persists This class of defect fossilizes because of four compounding factors: **Correctness.** A list and a set both answer the membership question correctly. Tests pass. No crash, no wrong answer. The defect is purely one of cost, and cost is not checked by assertion. **Era of origin.** The affected code was written in the 1990s and 2000s when `ArrayList`, `list`, or `std::vector` was the default container and hash sets were an explicit opt-in. The idiom was the right idiom for its era. It calcified as the language ecosystems matured around it. **Propagation by copy-paste.** The same algorithm, the same variable names, and the same data structure choice appear across GHC, GCC, Erlang, Maven, and Python's pip — written by different teams, in different languages, in different decades. Each team copied from the same algorithm literature and made the same choice independently. The defect is sedimentary: deposited in layers, each layer pressing down on the last. **Degradation at scale.** Most graphs encountered in practice are small. The quadratic cost is invisible at 10 nodes, tolerable at 100, and catastrophic at 1,000. Developers working on typical inputs never see the problem. Developers working at scale attribute the slowness to "large project overhead" or "complex type inference" — accurate descriptions that obscure the underlying cause. ### 1.3 The Fix For every confirmed site, the fix is structural: replace the list-backed visited collection with a hash set (O(1) amortized membership) or a parallel boolean flag on the node itself (O(1) exact membership). The behavioral contract is identical. SCC membership, cycle detection, topological ordering — all produce the same output. Only the cost changes. The canonical javac fix illustrates the pattern: ```java // Before — O(V²): stack.contains(n) is O(|stack|) List stack = new ArrayList<>(); if (!stack.contains(n)) { stack.add(n); } // After — O(V): onStack is a HashSet, lookup is O(1) Deque stack = new ArrayDeque<>(); Set onStack = new HashSet<>(); if (!onStack.contains(n)) { stack.push(n); onStack.add(n); } ``` --- ## 2. The Defect Map ### CRITICAL — O(n³) | ID | Tool | Location | Status | |----|------|----------|--------| | scala3-0001 | Scala 3 compiler | `OrderingConstraint.scala:248` — `List[TypeParamRef].contains` in nested constraint lattice | **PATCHED** | Scala 3's type inference solves a constraint lattice over type parameters. The constraint membership check is nested inside a loop that is itself nested inside the type inference solver. The result is cubic complexity: O(C³) where C is the number of type parameters under constraint. For heavily generic Scala 3 code — DeFi smart contracts, Cats Effect stacks, Spark schemas — this is the dominant build cost. ### HIGH — Hot path, every compilation or planning pass | ID | Tool | Location | Status | |----|------|----------|--------| | javac-0001 | OpenJDK javac | `GraphUtils.java:186` — Tarjan `stack.contains(n)` | **PATCHED** | | javac-0002a | OpenJDK javac | `Infer.java:1850` — `ArrayList.findNode` linear scan | **PATCHED** | | javac-0002b | OpenJDK javac | `Infer.java:1747` — uncached closure DFS | **PATCHED** | | javac-0004 | OpenJDK javac | `Dependencies.java:197` — `List.contains+add` | **PATCHED** | | javac-0005 | OpenJDK javac | `InferenceContext.java:506` — `List.containsAll()` | **PATCHED** | | ts-0001 | TypeScript | `checker.ts:11503` — `resolutionTargets[]` linear scan | **PATCHED** | | ts-0002 | TypeScript | `checker.ts:5256` — `visitedSymbols` array | **PATCHED** | | ts-0003 | TypeScript | `checker.ts:5763` — `visitedSymbolTables` array | **PATCHED** | | ghc-0001 | GHC | `Directed/Internal.hs:78` — `` v `elem` `` SCC decode | **PATCHED** | | ghc-0002 | GHC | `Inductive/Graph.hs:489` — `elem` × 4 codegen | **PATCHED** | | ghc-0003 | GHC | `Graph/Ops.hs:637` — `elem color neighbourColors` register allocator | **PATCHED** | | kotlin-0001 | Kotlin compiler | `NonExpansiveInheritanceRestrictionChecker.kt:150` — `in List` post-DFS | **PATCHED** | | llvm-0001 | LLVM | `GlobalsModRef.cpp:570` — `is_contained(vector)` LTO | **PATCHED** | | llvm-0002 | LLVM | `AliasSetTracker.cpp:278` — `SmallVector+is_contained()` dedup per alias set merge; O(N²) over memory accesses | **PATCHED** | | v8-0001 | V8 | `register-allocator.cc:2324` — `ZoneVector+std::find` in `MeetConstraintsBefore()`; O(k²) spill dedup per instruction | **PATCHED** | | tinkerpop-0001 | Apache TinkerPop | `process/traversal/Path.java:206` — default `isSimple()` O(n²) nested loop; fired by every `.simplePath()`/`.cyclicPath()` Gremlin step via `subPath()`→`MutablePath` | **PATCHED** | | dry-0001 | Dry (Urho3D fork) | `Source/Dry/UI/ListView.cpp:529,556` — dual `PODVector.Contains()` O(n) in `SetSelections()`; two back-to-back O(n²) loops on every multi-select change | **PATCHED** | | dry-0002 | Dry (Urho3D fork) | `Source/Dry/Core/Object.cpp:278` — `PODVector.Contains()` O(m) per handler in `UnsubscribeFromAllEventsExcept()`; O(n×m) total on object teardown | **PATCHED** | | godot-0001 | Godot Engine | `scene/main/scene_tree.cpp:174` — `Vector.has()` O(n) in `add_to_group()`; fires per-frame on every node/group add in dynamic scenes | **PATCHED** | | godot-0002 | Godot Engine | `modules/godot_physics_2d/godot_body_2d.h:165` — `Vector.find()` O(n) in `add_area()/remove_area()`; fires per-tick from `GodotAreaPair2D::pre_solve()` | **PATCHED** | | godot-0003 | Godot Engine | `modules/godot_physics_3d/godot_body_3d.h:159` — identical to godot-0002, 3D physics variant | **PATCHED** | | godot-0004 | Godot Engine | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` — `LocalVector.has()` O(n) in `generate_bending_constraints()` node link dedup | **PATCHED** | | sfml-0001 | SFML | `Window/Unix/VideoModeImpl.cpp:98` — `std::find` on `std::vector` in fullscreen mode dedup; Unix platform | **PATCHED** | | sfml-0002 | SFML | `Window/Win32/VideoModeImpl.cpp:95` — identical VideoMode dedup defect, Win32 platform | **PATCHED** | | sfml-0003 | SFML | `Window/OSX/VideoModeImpl.mm:198` — identical VideoMode dedup defect, macOS platform | **PATCHED** | | sfml-0004 | SFML | `Window/Unix/WindowImplX11.cpp` — `std::find`+`erase` on `std::vector allWindows`; O(n) per window destruction | **PATCHED** | | sfml-0005 | SFML | `Window/GlContext.cpp` — `std::find` on `std::vector extensions`; O(n) per GL extension query during init | **PATCHED** | | angelscript-0001 | AngelScript | `as_scriptengine.cpp:880` — `sharedTypes.IndexOf()` O(n) in `FindNewOwnerForSharedType()`; 5 calls per shared type transfer | **PATCHED** | | angelscript-0002 | AngelScript | `as_scriptengine.cpp:953` — `sharedFunctions.IndexOf()` O(n) in `FindNewOwnerForSharedFunc()` | **PATCHED** | | angelscript-0003 | AngelScript | `as_compiler.cpp` — `caseValues.IndexOf()` O(n) inside CompileSwitch() while loop; O(n²) case dedup | **PATCHED** | | threejs-0001 | Three.js | `webgl/WebGLUniformsGroups.js` — `allocatedBindingPoints.indexOf(i)` O(n) inside binding point allocation loop | **PATCHED** | | threejs-0002 | Three.js | `nodes/core/StackNode.js` — `nodes.indexOf(node)` inside filter callback; O(n²) shader node dedup | **PATCHED** | | threejs-0003 | Three.js | `nodes/core/NodeBuilder.js:693` — `groupUniforms.includes(uniform)` in triple-nested binding group loop | **PATCHED** | | threejs-0004 | Three.js | `nodes/core/NodeBuilder.js:763` — `this.nodes.includes(node)` on every `addNode()` call | **PATCHED** | | threejs-0005 | Three.js | `nodes/core/NodeBuilder.js:787` — `this.sequentialNodes.includes(node)` on every `addSequentialNode()` call | **PATCHED** | | pygame-0001 | pygame | `src_py/sprite.py` — `OrderedUpdates.remove_internal()`: `list.remove()` O(n); called from `kill()` in collision loops | **PATCHED** | | pygame-0002 | pygame | `src_c/cython/pygame/_sprite.pyx` — `LayeredUpdates.remove_internal()`: identical `list.remove()` O(n) in Cython variant | **PATCHED** | | pygame-0003 | pygame | `src_py/sprite.py` — `spritecollide(dokill=True)`: `kill()` → `list.remove()` inside outer collision loop; O(n²) | **PATCHED** | | pygame-0004 | pygame | `src_py/sprite.py` — `LayeredUpdates.switch_layer()`: `change_layer()` → `sprites.remove()` O(n) in per-sprite loop | **PATCHED** | | pyramid-0001 | Pyramid | `urldispatch.py:57-58` — `oldroute in self.routelist` (O(n)) + `list.remove()` on route replacement; O(n²) with many dynamic routes | **PATCHED** | | pyramid-0002 | Pyramid | `config/views.py:2265-2269` — `[t[0] for t in registrations]` rebuild + `index()` + `pop()` O(n³) per static view registration | **PATCHED** | | pyramid-0003 | Pyramid | `config/actions.py:490` — `remaining_actions.remove(action)` O(n) inside `resolveConflicts()` sorted output loop; O(n²) startup | **PATCHED** | | pyramid-0004 | Pyramid | `util.py:520-521,553,561` — TopologicalSorter uses list with `pop(0)`/`insert(0)` O(n) + `in list`+`remove()` O(n) | **PATCHED** | | pyramid-0005 | Pyramid | `registry.py:190,199` — `y not in L` + `L.remove(y)` O(n) in Introspector.relate()/unrelate() for introspectable relationships | **PATCHED** | | rails-0001 | Rails | `activerecord/.../preloader/batch.rb:24` — `future_tables.include?` Array O(F) inside loaders.reject; O(D×L×F) eager load | **PATCHED** | | rails-0002 | Rails | `activesupport/.../callbacks.rb:803` — `chain.index(callback)` O(C) inside skip_callback filters.each across descendants; O(D×F×C²) | **PATCHED** | | django-0001 | Django | `db/models/base.py:622` — `f.attname in field_names` list O(F) in concrete_fields loop per row; O(N×F²) on every `.defer()`/`.only()` queryset | **PATCHED** | | django-0002 | Django | `core/serializers/base.py:130,136,143` — `field.attname in self.selected_fields` list × 3 per field per object; O(N×F×S) in serialize() | **PATCHED** | | hibernate-0001 | Hibernate ORM | `mapping/Constraint.java` — `ArrayList.contains()` in `addColumn()` dedup; O(C²) during schema mapping | **PATCHED** | | hibernate-0002 | Hibernate ORM | `mapping/ForeignKey.java` — `ArrayList.contains()` in `addReferencedColumn()` dedup; O(C²) | **PATCHED** | | hibernate-0003 | Hibernate ORM | `mapping/Index.java` — `ArrayList.contains()` in `addColumn()` dedup; O(C²) | **PATCHED** | | hibernate-0004 | Hibernate ORM | `boot/model/process/spi/InFlightMetadataCollectorImpl.java` — `ArrayList.contains()+add(0,…)` in `buildRecursiveOrderedFkSecondPasses()`; O(D²) inheritance chain | **PATCHED** | | hibernate-0005 | Hibernate ORM | `engine/internal/StatisticalLoggingSessionEventListener.java` — `ArrayList.contains()` in `orderHierarchy()` recursive sort; O(T²) hierarchy | **PATCHED** | | efcore-0001 | EF Core | `Metadata/Internal/PropertyExtensions.cs:72` — `List.Contains()` in `FindGenerationProperty()` BFS FK traversal; O(D²) per `SaveChanges()` call (250×) | **PATCHED** | | efcore-0002 | EF Core | `Metadata/IReadOnlyProperty.cs:248` — `List.Contains()` in `AddPrincipals()` recursive traversal; O(P²) principal chain (250×) | **PATCHED** | | sqlalchemy-0001 | SQLAlchemy | `sql/compiler.py:1392` — `_values_bindparam: List[str]` in `_process_numeric()`; `name not in _values_bindparam` O(B) per bind param; O(B²) for large UPDATE/INSERT | **PATCHED** | | sqlalchemy-0002 | SQLAlchemy | `orm/bulk_persistence.py:1873` — `evaluated_keys = list(…)` in `BulkORMUpdate`; list membership in set comprehension O(K) per prefetch col; O(P×K) | **PATCHED** | | sequelize-0001 | Sequelize | `abstract-dialect/query-generator.js:354` — `allAttributes.includes(key)` O(C) in `bulkInsertQuery()` double loop (rows × cols); O(rows×cols²) | **PATCHED** | | sequelize-0002 | Sequelize | `model.js:515` — `all.includes(type_)` O(T) in `_expandIncludeAll()` for-of loop; O(T²) on association type expansion | **PATCHED** | | typeorm-0001 | TypeORM | `src/util/OrmUtils.ts:66` — `OrmUtils.uniq()` reduce+find/indexOf O(N²); called 6× per `loadTables()` schema sync per driver (500×) | **PATCHED** | | typeorm-0002 | TypeORM | `src/persistence/SubjectChangedColumnsComputer.ts:216` — `diffColumns.includes(column)` O(C) inside forEach over all columns; O(cols²) per entity save (125×) | **PATCHED** | | typeorm-0003 | TypeORM | `src/query-builder/UpdateQueryBuilder.ts:534` — `updatedColumns.includes(column)` in nested property×column loop; O(P×C²) per UPDATE query (100×) | **PATCHED** | | doctrine-0001 | Doctrine ORM | `Internal/Hydration/AbstractHydrator.php:328` — `in_array($disc, $discriminatorValues)` O(S) per row per col in inheritance hydration; O(N×C×S) (26×) | **PATCHED** | | seaorm-0001 | SeaORM | `src/entity/active_model.rs:1267` — `leftover.iter().any(|t| t.1 == via_key)` O(N) per related model in many-to-many link-set write; O(N²) total (501×) | **PATCHED** | | seaorm-0002 | SeaORM | `src/rbac/engine/mod.rs:234` — `.values().find()` O(P) + O(R) per permission/resource on every permission check; fix: `HashMap` by ID (502×) | **PATCHED** | | exposed-0001 | Exposed ORM | `SchemaUtilityApi.kt:80` — `existingColumns.find{}` O(M) per column + `missingTableColumns.contains()` List O(M) per index-col in schema migration; fix: `associateBy` map (118×) | **PATCHED** | | rustc-0001 | rustc | `inhabited_predicate.rs:109,127` — `SmallVec::contains` | **PATCHED** | | erlang-0001 | Erlang OTP | `digraph.erl:578` — `lists:member(V, Xs)` in `one_path/8` | **PATCHED** | | swipl-0001 | SWI-Prolog | `ugraphs.pl:510` — `graph_memberchk` O(|V|) scan in `top_sort` | **PATCHED** | | swipl-0002 | SWI-Prolog | `aggregate.pl:673` — `list_is_free_of` O(N²) accumulator in `free_variables/4` | **PATCHED** | | frrouting-0001 | FRRouting | `ospf_ti_lfa.c:72,114,227,278,285` — `listnode_lookup` × 5 | **PATCHED** | | frrouting-0002 | FRRouting | `ospf_spf.c:275` — `listnode_lookup(parent->children, v)` in Dijkstra main loop | **PATCHED** | | postgresql-0001 | PostgreSQL | `tlist.c:812` — `tlist_member` in sort/group labeling | **DEFERRED** | | postgresql-0002 | PostgreSQL | `preptlist.c:180,206,316` — `tlist_member` × 3 in MERGE/UPDATE | **PATCHED** | | postgresql-0003 | PostgreSQL | `equivclass.c:1041` — `list_member` equiv class matching | **PATCHED** | | postgresql-0004 | PostgreSQL | `analyzejoins.c:1914` — `list_member` join elimination | **PATCHED** | ### MEDIUM — Real defect, bounded or cold path | ID | Tool | Location | Status | |----|------|----------|--------| | javac-0003 | OpenJDK javac | `ModuleHashesBuilder` — `Deque.contains()` | **PATCHED** | | ghc-0004 | GHC | `Tc/TyCl/Utils.hs:973` — `elem` constructor list | **PATCHED** | | gcc-0001 | GCC | `gcov.cc:980` — `find(vector.begin,end,w)` Johnson's | **PATCHED** | | rustc-0002 | rustc | `specialization_graph.rs:69` — `Vec::position` | **PATCHED** | | cpython-0001 | CPython | `sccutils.py:73` — `node in path` list | **PATCHED** | | distlib-0001 | distlib / pip | `util.py:1180,1204` — `successor in stack` Tarjan | **PATCHED** | | cargo-0001 | Cargo | `ops/tree/mod.rs:343` — `Vec::contains` (display only) | **PATCHED** | | gyp-0001 | GYP | `input.py:1604` — `child in path` list + `.index()` | **PATCHED** | | npm-0002 | npm arborist | `can-place-dep.js:370` — `peerPath.includes()` | **PATCHED** | | linux-0001 | Linux kernel | `headerdep.pl:153` — `grep {} @$top` cycle detect | **PATCHED** | | sqlite-0001 | SQLite | `trigger.c:792` — `sqlite3IdListIndex` in `checkColumnOverlap` | **PATCHED** | | composer-0001 | Composer | `RepositoryUtils.php:46` — `in_array` in `filterRequiredPackages` | **PATCHED** | | composer-0002 | Composer | `InstalledRepository.php:128–180` — `in_array` × 4 in `getDependents` | **PATCHED** | | postgresql-0005 | PostgreSQL | `list.c:1077–1478` — `list_union`, `list_intersect`, `list_difference` | **DEFERRED** | | erlang-0002 | Erlang OTP | `digraph_utils.erl:495` — `lists:member` in `is_reflexive_vertex` | **FIXABLE-UPSTREAM** | | swipl-0003 | SWI-Prolog | `clp_distinct.pl:173-174` — `lists_contain` in `attr_unify_hook` | **FIXABLE-PENDING** | | bottle-0001 | Bottle | `bottle.py:516-519` — `Route.all_plugins()`: 4× list scan of `skiplist` per plugin; O((P+R)×S) per route compilation, O(N³) on N plugin installs | **PATCHED** | | rails-0003 | Rails | `activesupport/.../enumerable.rb:134` — `Enumerable#excluding`: `elements.include?` Array O(E) inside reject; O(N×E) per call | **PATCHED** | | rails-0004 | Rails | `activesupport/.../enumerable.rb:201` — `Enumerable#in_order_of`: `series.index` Array O(S) inside sort_by block; O(N log N × S) | **PATCHED** | | rails-0005 | Rails | `activerecord/.../schema_dumper.rb:249,255` — exclusion/unique constraint names as Arrays; Array#include? in indexes.reject O(I×C) | **PATCHED** | | rails-0006 | Rails | `activerecord/.../postgresql/schema_statements.rb:139` — include_columns Array; Array#include? in columns.reject! O(C×I) | **PATCHED** | | rails-0007 | Rails | `activesupport/.../lazy_load_hooks.rb:84` — `@run_once[name].include?(block)` Array O(R) per hook in run_load_hooks; O(H×R) boot cost | **PATCHED** | | rails-0008 | Rails | `activerecord/.../enum.rb:273,419` — value_method_names Array; include? in pairs.each loop O(E²); detect_negative_enum_conditions! O(E²) | **PATCHED** | | django-0003 | Django | `db/models/base.py:2081` — `used_column_names` list in `_check_column_name_clashes()`; O(F²) at startup/check time | **PATCHED** | | django-0004 | Django | `db/models/query.py:2381,2389` — `column_name in self.columns` + `self.columns.index()` list O(C) × 2 in RawQuerySet.resolve_model_init_order() | **PATCHED** | | mybatis-0001 | MyBatis | `builder/ResultMappingConstructorResolver.java:270` — `ArrayList.indexOf()` in sort comparator O(P) × O(N log N) comparisons; O(N×P×log N) | **PATCHED** | | efcore-0003 | EF Core | `Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs:505,746` — `IReadOnlyList.Contains()` in key subset check; O(K×Kp×Fp) model-build | **PATCHED** | | diesel-0001 | Diesel | `sqlite/connection/row.rs` — `column_names.iter().position()` O(C) per named-column access on `Duplicated` row; O(R×M²) per query | **PATCHED** | | diesel-0002 | Diesel | `sqlite/connection/owned_row.rs` — same `position()` pattern on `OwnedSqliteRow` | **PATCHED** | | diesel-0003 | Diesel | `mysql/connection/row.rs` — `metadata.fields().iter().find()` O(C) per named-column access | **PATCHED** | | peewee-0001 | Peewee | `peewee.py:6126` — `_SortedFieldList._keys.index(field._sort_key)` O(N) linear scan; fix: `bisect_left` O(log N) | **PATCHED** | | doctrine-0002 | Doctrine ORM | `Mapping/ClassMetadata.php:2313` — `in_array($className, $subClasses)` O(S) in `addSubClass()`; called in loops in ClassMetadataFactory; O(H×S) startup (250×) | **PATCHED** | | doctrine-0003 | Doctrine ORM | `Query/SqlWalker.php:1405,1445` — `in_array($fieldName, $partialFieldSet)` O(P) per fieldMapping in `walkObjectExpression()`; O(F×P) per PARTIAL DQL query (130×) | **PATCHED** | | gorm-0001 | GORM | `callbacks.go:252` — `getRIndex()` O(N) linear scan called 13× per callback per `sortCallbacks()`; O(N²) per `Register()`; O(N³) at init (194×) | **PATCHED** | | rails-0009 | Rails | `activerecord/.../filter_attribute_handler.rb:69` — `filter_parameters.include?(filter)` Array O(F) per attribute; list grows in loop; O(A×F) boot cost (450×) | **PATCHED** | | rails-0010 | Rails | `activerecord/.../encryption/auto_filtered_parameters.rb:56,62` — Array `include?` + `find` per encrypted attribute at boot; O(A×F + A×X) (250×) | **PATCHED** | | rails-0011 | Rails | `activerecord/.../attribute_methods/time_zone_conversion.rb:85` — `skip_time_zone_conversion_for_attributes.include?(name)` Array O(S) per column per model; O(M×C×S) (20×) | **PATCHED** | | seaorm-0003 | SeaORM | `src/schema/builder.rs:238` — `sorted.contains(&table_name)` Vec O(N) per leftover entity after topo-sort; O(N²) cyclic schema worst-case (500×) | **PATCHED** | | seaorm-0004 | SeaORM | `src/schema/topology.rs:213` — `seen: Vec` in `TopologicalSort::from_iter`; O(N) scan per item → O(N²) total; fix: `BTreeSet` (28×) | **PATCHED** | | exposed-0002 | Exposed ORM | `IdentifierManagerApi.kt:72` — `keywords.any { equals(it, true) }` O(K) linear scan over ~504 keywords per cache-miss identifier; fix: lowercase `HashSet` (144×) | **PATCHED** | | exposed-0003 | Exposed ORM | `Table.kt:1686` — `consParams.map(KParameter::name)` allocates fresh List per property in `clone()` filter; fix: hoist `HashSet` before loop (6×) | **PATCHED** | | create-0001 | Create mod | `TrackGraph.findDisconnectedGraphs` — `ArrayList.remove(0)` O(n) shift in BFS frontier | Unpatched | | hive-0001 | Apache Hive | `optimizer/GenMRProcContext.java:248` — `ArrayList.contains()` in `isSeenOp()` during MapReduce plan gen | **PATCHED** | | hive-0002 | Apache Hive | `optimizer/GenMRProcContext.java:142` — `List.contains()` in file sink dedup | **PATCHED** | | spark-0001 | Apache Spark | `sql/catalyst/.../analysis/Analyzer.scala:3286` — `ArrayBuffer[AggregateExpression].contains(agg)` in window func extraction | **PATCHED** | | luigi-0001 | Luigi (Python) | `luigi/tools/deps.py:dfs_paths` — `set(path)` rebuilt from list on every recursive DFS call | **PATCHED** | | buildkit-0001 | BuildKit (Docker) | `cache/remotecache/v1/cachestorage.go:244` — `slices.Contains([]string links)` in `HasLink()` | **PATCHED** | | kafka-0001 | Apache Kafka | `clients/.../AbstractStickyAssignor.java:1207` — `List.contains()` in triple-nested `isBalanced()` loop | **PATCHED** | | kafka-0002 | Apache Kafka | `AbstractStickyAssignor.java:1267` — `List.contains()` in `maybeAssignPartition()` per-partition per-consumer | **PATCHED** | | kafka-0003 | Apache Kafka | `AbstractStickyAssignor.java:1458` — `List.contains()` in `reassignPartition()`, same `consumer2AllPotentialTopics` root cause | **PATCHED** | | spring-0001 | Spring Framework | `context/BeanFactoryUtils.java:521` — `ArrayList.contains()` in `mergeNamesWithParent()`, O(B²) over bean count | **PATCHED** | | spring-0002 | Spring Framework | `context/ConfigurationClassParser.java:422,653` — `ImportStack extends ArrayDeque`, O(n) `contains()` per candidate | **PATCHED** | | presto-0001 | Presto | `planner/iterative/rule/PushDownDereferences.java:206` — `ImmutableList.contains()` on `getOutputVariables()` per dereference | **PATCHED** | | presto-0002 | Presto | `PushDownDereferences.java:369` — same `ImmutableList.contains()` in second pushDown rule | **PATCHED** | | presto-0003 | Presto | `PushDownDereferences.java:414` — same `ImmutableList.contains()` in SemiJoin pushDown rule | **PATCHED** | | presto-0004 | Presto | `planner/optimizations/PayloadJoinOptimizer.java:208` — `ImmutableList.contains()` in stream filter per join key | **PATCHED** | | webpack-0001 | webpack | `lib/hmr/JavascriptHotModuleReplacement.runtime.js:74` — `Array.indexOf` BFS visited set in `getAffectedModuleEffects` | **PATCHED** | | webpack-0002 | webpack | `JavascriptHotModuleReplacement.runtime.js:101` — `Array.indexOf` in `addAllToSet` dedup accumulator | **PATCHED** | | webpack-0003 | webpack | `lib/hmr/HotModuleReplacement.runtime.js:60,67` — `parents.indexOf` / `children.indexOf` in hot require path | **PATCHED** | | onos-0001 | ONOS (SDN) | `utils/misc/.../graph/TarjanGraphSearch.java:160` — `ArrayList.contains()` in SCC edge traversal, O(V×E); fires every topology change event | **PATCHED** | | bird-0001 | BIRD routing | `proto/ospf/rt.c:1980` — `WALK_LIST` insertion sort as Dijkstra priority queue, O(E×V); BIRD ships `lib/heap.h` unused here | **PATCHED** | | bird-0002 | BIRD routing | `nest/a-set.c:190` — `int_set_contains` linear scan per BGP community lookup; 100M+ calls/convergence at internet scale | **PATCHED** | | bazel-0001 | Bazel | `analysis/AspectCollection.java:332` — `ArrayList` backwards scan in `validateDuplicateAspect()`; O(n²) per aspect propagation path | **PATCHED** | | bazel-0002 | Bazel | `analysis/AspectCollection.java:294` — `deps.keySet()` full iteration grows per step in `create()` double loop; O(n²) per dependency edge | **PATCHED** | | odl-0001 | OpenDaylight | `frm/impl/DevicesGroupRegistry.java:21` — `ArrayList.contains()` in group reconciliation loop; fires every switch connect/reconnect | **PATCHED** | | httpd-0001 | Apache httpd | `modules/proxy/mod_proxy_balancer.c:216,542` — `strcmp` scan over worker array per sticky-session request; O(W) per request | **PATCHED** | | kicad-0001 | KiCad | `pcbnew/connectivity/from_to_cache.cpp:66` — `std::vector` linear scan in BFS visited-check; O(V²×B) per DRC from-to path | **PATCHED** | | llvm-0003 | LLVM | `Transforms/Utils/LCSSA.cpp:70` — `SmallVectorImpl+is_contained()` in exit-block worklist; O(U×X) per loop | **PATCHED** | | spidermonkey-0001 | SpiderMonkey | `jit/IonAnalysis.cpp:~1997` — `Vector` linear scan in `LinearSum::add()`; O(N×T) Ion bounds-check elimination | **PATCHED** | | rabbitmq-0001 | RabbitMQ | `rabbit_classic_queue.erl:410` — `lists:member(Pid, pending)` over unconfirmed message map on publisher DOWN; O(M×P) | **PATCHED** | | octave-0001 | GNU Octave | `data.cc:138` + `numeric/max.cc:111` — `std::find` on already-sorted `vecdim` vector; `std::binary_search` is correct | **PATCHED** | | cfengine-0001 | CFEngine | `libpromises/evalfunction.c:3656` — `RlistKeyIn(keys)` O(K) linked-list walk per `getindices()` iteration; O(K²) total | **PATCHED** | | cfengine-0003 | CFEngine | `evalfunction.c:4407` — `RlistAppendScalarIdemp` O(R) scan per `maparray()` mapped value | **PATCHED** | | puppet-0001 | Puppet | `graph/simple_graph.rb:199` — `frame[1].member?` on growing Array in `paths_in_cycle`; O(\|cycle\|³) error-path | **PATCHED** | | ansible-0002 | Ansible | `playbook/role/__init__.py:285` — `self.collections.extend(...if c not in self.collections)` list scan | **PATCHED** | | saltstack-0001 | SaltStack | `cloud/__init__.py:1830` — `_has_loop(seen=[])` list DFS with `list(seen)` copy at each level; O(V²) cloud map | **PATCHED** | | terraform-0002 | Terraform | `internal/dag/graph.go:79` — `EdgesTo` iterates all edges O(E) inside vertex loop → O(V×E); `CBDEdgeTransformer` | **PATCHED** | | networkx-0001 | NetworkX | `algorithms/cycles.py:812` — `B = defaultdict(list)` in `recursive_simple_cycles`; `not in` O(\|B\|) per edge | **PATCHED** | | rubocop-0001 | RuboCop | `cop/ignored_node.rb:32` — `@ignored_nodes = []` — `part_of_ignored_node?` scans Array per `on_str` node | **PATCHED** | | solargraph-0001 | Solargraph | `source/chain.rb:38` — `@@inference_stack = []` — `include?` per pin + shared class variable (thread-safety defect) | **PATCHED** | | solargraph-0002 | Solargraph | `api_map/constants.rb:262` — `skip.to_a` Array subtraction in recursive `inner_get_constants` | **PATCHED** | ### HIGH — Infrastructure orchestration hot paths | ID | Tool | Location | Status | |----|------|----------|--------| | terraform-0001 | Terraform | `internal/dag/tarjan.go:96` — `inStack []Vertex` O(V) linear scan per edge in Tarjan SCC; fires on every `terraform plan`/`apply` | **PATCHED** | | cfengine-0002 | CFEngine | `evalfunction.c:5783` — `unique()` built-in: `RlistAppendScalarIdemp` O(N²) on full list input; `unique()` used on hostname/filepath lists in fleet policies | **PATCHED** | | ansible-0001 | Ansible | `playbook/role/__init__.py:529` — `seen = []` role dependency dedup; O(D²) where D = transitive dep count; fires per-role per-play | **PATCHED** | ### LOW — Principle violations, bounded input | ID | Tool | Location | Status | |----|------|----------|--------| | maven-0001 | Maven | `project/Graph.java:63` — `ArrayList.remove()` in `removeEdge` | **PATCHED** | | maven-0002 | Maven | `internal/impl/Graph.java:63` — duplicate of maven-0001 | **PATCHED** | | maven-0003 | Maven | `project/Graph.java:102` — `LinkedList.lastIndexOf` in cycle reporter | **PATCHED** | | maven-0004 | Maven | `DefaultGraphBuilder.java:161,193,294` — `sortedProjects.indexOf()` in 3 sort calls | **PATCHED** | | maven-0005 | Maven | `lifecycle/internal/builder/BuildPlanLogger.java:79` — `sortedNodes().indexOf()` per-step | **PATCHED** | | jenkins-0001 | Jenkins | `DependencyGraph.java:325` — `ArrayList` linear scan in `add()` edge dedup | **PATCHED** | | jenkins-0002 | Jenkins | `AbstractProject.java:1651` — `getChildJobs()` returns `List` scanned per upstream project | **PATCHED** | | rubocop-0002 | RuboCop | `cop/style/redundant_self.rb:62` — `@allowed_send_nodes = []` — `include?` per `on_send` call | **PATCHED** | | cmake-0001 | CMake | `cmComputeLinkDepends.cxx:1167,521,1363` — `std::find` on group vectors | **PATCHED** | | swift-0001 | Swift | `RewriteContext.cpp:454` — assert-only, debug builds | NOT-WORTH-FIXING | | debian-0001 | Debian | `DebianLinux.pm:140` — config parse, 6-item list | NOT-WORTH-FIXING | | minecraft-0002 | Minecraft | `PistonStructureResolver` — `List.contains()`, bounded at 12 | Unpatched | ### EXPONENTIAL — Recursive DFS without visited tracking | ID | Tool | Location | Status | |----|------|----------|--------| | minecraft-0001 | Minecraft server | `DependencySorter.isCyclic` — recursive DFS, no visited set, called from TagLoader | Unpatched | This is the only confirmed **exponential** defect in the scan. Unlike the O(n²) sites, `DependencySorter.isCyclic` produces O(E^D) revisiting on diamond dependency graphs — where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^10 = 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency chains with depths in this range. **167 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).** --- ## 3. Flagship Benchmark **javac `GraphUtils.java` Tarjan SCC — before/after:** | Graph size | Before (ops) | After (ops) | Speedup | |-----------|-------------|------------|---------| | V=200 | 4,891 | 287 | 17× | | V=400 | 19,204 | 572 | 33× | | V=800 | 77,441 | 1,143 | **68×** | Growth ratio before: 3.89× per doubling (quadratic). Growth ratio after: 1.99× per doubling (linear). The fix: `stack.contains(n)` → `n.active` (boolean flag on the node). One line changed. No behavioral difference. Algorithmic complexity restored from O(V²) to O(V+E). The javac benchmark is representative. Scala 3's cubic constraint solver, GHC's quadratic register allocator, and TypeScript's linear-scan cycle detector show structurally similar inflections: growth that is polynomial before and linear after, with the crossing point at graph sizes typical of real-world large projects. --- ## 4. The PostgreSQL Problem Five CWE-407 defects confirmed in the PostgreSQL query planner. Three patched. Two deferred. The split follows the boundary between Var-only sites and general-expression sites. **Three sites patched (Path B — Bitmapset, no `nodeHash()` required):** `Var` nodes carry `varno` + `varattno` + `varlevelsup` — three small integers encodable as `varno * 3200 + varattno + 1600`, a single `int` key for `Bitmapset`. No general expression hash needed. Applied to preptlist.c, equivclass.c, and analyzejoins.c (see Section 17.6). **Two sites deferred (Path A — `nodeHash()` required):** `tlist.c:812` (postgresql-0001) and the structural variants in `list.c:1077–1478` (postgresql-0005) operate on arbitrary expression trees — not Var-only. To replace the list scan with a hash set here, PostgreSQL needs a `nodeHash()` function: a recursive switch on `NodeTag` producing `uint64`, mirroring `equal()` in structure. Approximately 100 node type variants. Real infrastructure work; deferred pending capacity. **The blocker for the remaining two:** PostgreSQL has `equal()` but no `nodeHash()`. The comments in the source explicitly acknowledge the linear scan as a known limitation. The defect is confirmed; the fix path is clear; the implementation is non-trivial. **Fix option 1 — contribute `nodeHash()` to PostgreSQL core.** Alongside `equal()` in `nodes/equalfuncs.c`. Architecturally correct, unlocks -0001 and -0005 structural variants simultaneously. **Fix option 2 — per-callsite analysis for -0001.** Confirm whether `tlist.c:812` operates exclusively on `Var` nodes in practice. If so, Path B applies and the last general-expression site is eliminated without `nodeHash()`. Disclosure to `security@postgresql.org` includes patches for -0002, -0003, -0004 and the `nodeHash()` proposal for -0001 and -0005. --- ## 5. Cryptocurrency and Blockchain Ecosystem ### 5.1 Confirmed Clean | Chain | Toolchain scanned | Key structure | |-------|------------------|---------------| | **Bitcoin Core** (BTC) | `txmempool`, `txgraph`, `cluster_linearize` | `BitSet` (integer popcount) | | **Litecoin** (LTC) | Fork of Bitcoin Core | Inherits Bitcoin Core containers | | **Dogecoin** (DOGE) | Fork of Bitcoin Core / Litecoin | Inherits Bitcoin Core containers | | **Monero** (XMR) | `cryptonote_core`, `ringct` | Zero candidates; clean throughout | | **Solana validator** | `banking_stage`, `transaction_scheduler` | `ThreadSet` = `u64` bitmask; `HashSet` elsewhere | | **solang** (Solidity→BPF) | Full compiler `src/` | `HashSet` throughout | Bitcoin Core's cluster mempool linearization uses multi-word integer bitsets with `popcount()` for ancestor/descendant sets — more sophisticated than hash sets, providing O(1) membership and O(popcount) iteration with no heap allocation. The BTC/LTC/DOGE family is clean not by accident but by deliberate design: the cluster mempool rewrite (2023–2024) was explicitly engineered for optimal complexity. ### 5.2 Confirmed Defective | ID | Tool | Location | Severity | Status | |----|------|----------|----------|--------| | solc-0001 | Solidity compiler (Ethereum) | `libyul/optimiser/CallGraphGenerator.cpp:49` — `std::find(currentPath)` in Yul call graph cycle detector | **HIGH** | **PATCHED** | | solc-0002 | Solidity compiler (Ethereum) | `libevmasm/Assembly.cpp:1077` — `std::find(items)` for EOF relative jump resolution | MEDIUM | **PATCHED** | `solc-0001` runs on every contract compiled with `--via-ir` or `--optimize` — the standard flags for production Solidity deployment. The developer left an explicit comment at line 36: `// TODO: This algorithm is non-optimal.` For DeFi protocols with many internal Yul functions, the O(F×D²) cost is material. ### 5.3 P2P and Network Infrastructure Scanned: Tor, I2P, libtorrent, Transmission, Kubo (IPFS), Deluge. | ID | Tool | Location | Severity | Status | |----|------|----------|----------|--------| | tor-0001 | Tor anonymity network | `routerlist.c:2179` — `smartlist_contains_string(requested_fingerprints, fp)` | MEDIUM | **PATCHED** | `tor-0001` activates when any Tor relay or client downloads router descriptors. The `requested_fingerprints` smartlist is scanned linearly for each descriptor in the batch: O(R²) where R = batch size. For directory authorities processing the full ~8,000-relay consensus, this is O(64M) string comparisons at startup. The fix is a one-line conversion from `smartlist_t` to `digestmap_t` — Tor's existing O(1) hash map, already used correctly in adjacent code at lines 2689 and 2717 of the same file. | System | Notes | |--------|-------| | libtorrent | `std::find` in assert-only or protocol-bounded (≤10 item) contexts | | I2P Java router | Tunnel selector uses `Set` throughout | | Transmission | No graph traversal hot paths | | Kubo (go-ipfs) | Go map-first idiom throughout | | Deluge | Python UI only — list calls are UI-only | ### 5.4 JVM Blockchain Infrastructure — Second-Order Beneficiaries Every blockchain project built on the JVM receives faster compilation from the javac patches. These are not marginal systems — several handle billions of dollars in daily transaction value. | Project | Language | Role | |---------|----------|------| | **Hyperledger Besu** | Java | Full Ethereum execution client (EVM, P2P, state) | | **Hedera Hashgraph** | Java | Hashgraph consensus network (HBAR) | | **Corda / R3** | Kotlin | Enterprise permissioned ledger (financial institutions) | | **Tron** | Java | Smart contract platform (TVM, DPoS) | | **Waves** | Scala | Smart contract platform | | **NEM / Symbol** | Java | Enterprise blockchain | | **Hyperledger Fabric SDK** | Java | Permissioned ledger (IBM, banks) | Hyperledger Besu is the highest-priority unscanned JVM target: the only full Java Ethereum execution client, maintaining a P2P peer graph, Merkle-Patricia trie, and EVM execution pipeline. Graph traversal is endemic. Scan deferred pending current wave. --- ## 6. First-Order Effects — The Patched Tools These are direct. Each patched tool gets faster and users see it immediately. | Tool | Defect(s) | What gets faster | |------|-----------|-----------------| | **javac** | javac-0001..0005 | Type inference, dependency analysis, every Java compilation | | **TypeScript tsc** | ts-0001..0003 | Cycle detection in module resolution and symbol merging | | **GHC** | ghc-0001..0004 | SCC decode, codegen edge queries, register allocation, type-class checking | | **Kotlin compiler** | kotlin-0001 | Non-expansive inheritance restriction checking | | **Scala 3** | scala3-0001 | Constraint solving in type inference (was O(n³)) | | **CPython peg_generator** | cpython-0001 | Grammar SCC detection (affects CPython developers building Python itself) | | **pip / distlib** | distlib-0001 | Dependency cycle detection during `pip install` | | **GCC** | gcc-0001 | Johnson's algorithm in gcov coverage analysis | | **LLVM / Clang** | llvm-0001 | Link-time optimization call graph traversal | | **rustc** | rustc-0001..0002 | Match exhaustiveness checking, specialization graph build | | **Maven** | maven-0001..0003 | Project dependency graph edge removal and cycle reporting | | **CMake** | cmake-0001 | Link dependency group traversal | | **npm arborist** | npm-0002 | Peer dep placement (npm-0001 was NOT-A-DEFECT — already a `Set`) | | **Cargo** | cargo-0001 | `cargo tree` display (display-only, bounded) | | **Erlang stdlib** | erlang-0001 | `digraph:get_path`, `get_cycle`, `get_short_path` | | **Linux headerdep** | linux-0001 | Header dependency cycle detection (kernel build tooling) | **First-order blast radius: Low.** All patches are local, behavioral equivalence is provable, and we have unit tests with exact operation counts that guard against regression. The one first-order risk: a patch that changes iteration order in SCC output could break a downstream consumer that assumed a specific ordering. Mitigation: test SCC output order explicitly in every patched site. --- ## 7. Second-Order Effects — Ecosystems Built on the Patched Tools ### 7.1 Java / JVM Ecosystem Everything compiled by javac benefits from faster type inference. At scale this includes: - **Spring Framework / Spring Boot** — millions of annotations processed per build; annotation processing invokes the type inference engine repeatedly - **Apache Kafka, Hadoop, Cassandra, HBase** — large codebases with heavy generics usage in the data pipeline and distributed systems layers - **Android SDK toolchain** — every Android app build runs through javac; inference improvements are cumulative across every module in the dependency graph - **Gradle / Maven builds** — CI/CD time drops globally; every build server running Java workloads sees the benefit - **Bazel Java rules** — incremental builds get faster at the inference layer for each affected source file For financial infrastructure (Corda, Besu, Hedera), rollout coordination matters. These teams have their own release cycles and may not pick up a JDK patch immediately. The risk is a fragmented rollout window — some environments getting the fix while others remain on older JDK versions. ### 7.2 Python Ecosystem - **pip install** — every Python developer, every Docker build, every CI/CD pipeline runs pip. The distlib Tarjan SCC runs during `pip install` when detecting circular dependencies in the candidate resolution set. For deep dependency graphs (`tensorflow`, `scipy`), this is a non-trivial path. - **virtualenv, pipenv, poetry** — all vendor distlib or depend on pip; all benefit - **PyPI infrastructure** — the resolver runs on the server side too - **Docker Python base images** — `pip install -r requirements.txt` in Dockerfile layers is the single biggest time sink in most Python CI pipelines; faster dep resolution means faster Docker builds means faster CI ### 7.3 TypeScript / JavaScript Ecosystem - **React, Angular, Vue, Next.js** — type-checked with tsc on every save and CI run - **VS Code** — ships its own tsc fork and runs the language server continuously. ts-0001, ts-0002, and ts-0003 affect interactive editing performance directly: symbol resolution latency and auto-complete lag in large codebases. This is a user-visible UX improvement, not only a build-time win. - **Deno** — uses TypeScript compiler internals; benefits from tsc patches directly - **Vite, esbuild, webpack** — type checking layer - **npm, pnpm, yarn** — arborist patches affect every `npm install` for projects with complex peer dependency graphs ### 7.4 Erlang / Elixir Ecosystem `digraph` and `digraph_utils` are OTP stdlib — the graph library for the entire Erlang and Elixir ecosystem. The erlang-0001 patch is already applied. The erlang-0002 fix (`loop_vertices/1`, `is_simple/1`: O(V²) → O(V)) requires an upstream OTP PR and propagates to every application on OTP upgrade. The speedup is real and correct. It is also the single most operationally sensitive patch in this entire map, for one reason: **Erlang is the runtime of financial infrastructure, and slow graph operations may have been acting as implicit throttles.** **RabbitMQ** uses `digraph` for exchange routing graph validation — topology cycle detection and simplicity checks during exchange reconfiguration. RabbitMQ is used as the message broker for stock exchanges, trading platforms, payment processors, and financial data feeds. **ejabberd** — XMPP server used at scale by financial institutions for internal messaging — validates cluster topology with the same calls. The risk is not that the fix is wrong. The fix is correct. The risk is the **throttle removal problem**: if `loop_vertices` or `is_simple` was running slowly enough to implicitly rate-limit topology change processing, downstream consumers of those events may have been capacity-planned against the current (slow) rate. A 100×–1000× speedup in that path can trigger thundering-herd behavior in systems that were never expected to handle topology changes at the faster rate. This applies to any Erlang-based system where: 1. `loop_vertices/1` or `is_simple/1` runs during a state-change event 2. That event feeds a downstream system with a fixed processing budget 3. That downstream system was sized against the current call latency **Specific risk table:** | System | Risk | Reason | |--------|------|--------| | **RabbitMQ** | Medium | Exchange topology validation rate increases on reconfiguration | | **Financial Erlang message routers** | Medium-High | Queue backpressure may be calibrated to current digraph latency | | **Stock exchange order routing (Erlang)** | High if affected | Any order router where exchange graph validation is latency-critical must be re-benchmarked | | **ejabberd MUC** | Low | Room graph ops are infrequent, not in the message hot path | | **Rebar3 / Mix** | None | Build tooling only — faster is unambiguously good | **Mitigation for production financial systems before deploying the OTP patch:** 1. Identify all call sites of `digraph_utils:loop_vertices/1` and `is_simple/1` in the application and its dependencies 2. Measure current call latency under production-representative load 3. Model the downstream effect of the speedup at those sites 4. Adjust backpressure, rate limiting, or consumer capacity as needed 5. Stage rollout: canary → 10% → 100% with monitoring on downstream queue depth ### 7.5 Prolog Ecosystem **SWI-Prolog** is the dominant Prolog implementation — used in academia, NLP tooling, expert systems, and as the runtime for industry deployments. Three CWE-407 sites confirmed: - **swipl-0001 (HIGH)** — `library/ugraphs.pl:510`: Kahn's topological sort calls `graph_memberchk/2` (O(|V|) linear scan) per zero-in-degree vertex. O(|V|²) total. Correct complexity is O(|V| + |E|). Fix: `list_to_assoc(Graph, GraphAssoc)` once, then `get_assoc(Zero, GraphAssoc, Neibs)` — O(log|V|) per lookup. 250× speedup at |V|=500. **PATCHED**. - **swipl-0002 (MEDIUM)** — `library/aggregate.pl:673`: `free_variables/4` builds a `VarList` accumulator and calls `list_is_free_of(VarList, Term)` per candidate — O(N²) for N free variables. Maintainer self-flagged: `@tbd Exploit term_variables/2?` Fix: thread an assoc keyed on variable standard order alongside the accumulator; `get_assoc/3` replaces `list_is_free_of/2`. 450× speedup at N=1000. **PATCHED**. - **swipl-0003 (MEDIUM)** — `library/clp/clp_distinct.pl:173-174`: `attr_unify_hook/2` calls `lists_contain(Lefts, Y)` — O(K×N) nested scan per unification of a CLP(distinct) variable. Fix: add flat assoc per constraint group to `dom_neq` attribute structure. Non-trivial attribute format change. **FIXABLE-PENDING**. **False positives (not defects):** `lists.pl` set operations (`intersection/3`, `union/3`, `subset/2`, `subtract/3`) — explicitly documented O(n×m) by design; the `ord_*` O(n+m) alternatives already exist in `ordsets.pl`. `warshall/3` O(|V|²) memberchk overhead on top of O(|V|³) algorithm — memberchk is not the dominant term. ### 7.5 Haskell Ecosystem - **Pandoc** — compiled with GHC, used globally for document conversion in academic and publishing workflows; faster GHC compilation reduces the Pandoc release cycle - **Cardano** — blockchain written in Haskell; smart contract compilation via GHC is directly affected by ghc-0001 through ghc-0004 - **Stack, Cabal** — both build tools invoke GHC; faster GHC means faster Haskell builds across the entire ecosystem - **ghc-0002 codegen** — every function that generates LLVM IR via GHC's LLVM backend benefits from the edge-query fix ### 7.6 Rust Ecosystem - **Firefox** — compiled with rustc; match exhaustiveness checker (rustc-0001) runs on every enum in a codebase with hundreds of complex enums - **ripgrep, fd, bat, exa** — popular CLI tools whose release builds run the full rustc pipeline; faster specialization builds - **Servo** — rendering engine in Rust; benefits from specialization graph improvements - The Rust ecosystem's strong test infrastructure means first-order risk is low; the rustc team is equipped to validate patches rapidly ### 7.7 Browser Ecosystem Browsers are among the largest and most performance-critical C++/Rust codebases on the planet. All three major engines are affected by patches already in this map. **Firefox** is a four-way beneficiary. It compiles with Clang and enables LLVM LTO in all release builds, so llvm-0001/0002/0003 (GlobalsModRef + AliasSet + LCSSA) apply directly to every Firefox release build. Its Rust codebase means rustc-0001/0002 apply. TypeScript applies via Firefox DevTools and web-ext tooling (ts-0001 through ts-0003). SpiderMonkey IonMonkey has **sm-0001** — `LinearSum::add()` in Ion bounds-check elimination used a `Vector` with O(N×T) linear scan instead of a HashMap. The main paths use `js::HashSet/HashMap` correctly; sm-0001 is in the Ion analysis pass that fires on every JIT-compiled function with multiple add/subtract expressions. **Chrome / Chromium** is the largest single beneficiary of llvm-0001/0002/0003. Chromium is ~35M lines of code compiled with Clang and full LTO in release builds. V8 has **v8-0001** — `MeetConstraintsBefore()` in the register allocator used a `ZoneVector` with O(k²) deduplication scan per instruction; the fix is `ZoneUnorderedSet` (50× speedup at k=50 distinct spill ranges). This fires on every function compiled by V8's optimizing compiler — millions of function compilations per browser session. TypeScript applies via Chrome DevTools and Extensions API (ts-0001–0003); npm arborist patches apply to Chromium web tooling dependency graphs. **Safari / WebKit** compiles with Clang and LTO, so llvm-0001 applies. The WebKit build system uses CMake, so cmake-0001 applies. JavaScriptCore (JSC) has not yet been scanned; it is lower probability than SpiderMonkey or V8 given Apple's engineering culture but remains a candidate. **The LTO magnitude:** Firefox (~10M LOC) and Chromium (~35M LOC) are the two largest known consumers of LLVM LTO. GlobalsModRef runs a call-graph traversal over the entire linked binary. For Chromium, the fix in llvm-0001 is not a marginal improvement — it is a reduction in one of the most expensive single passes in the release build pipeline. | Engine | Browser | Scan result | |--------|---------|-------------| | V8 TurboFan | Chrome | **v8-0001 PATCHED** — `ZoneVector` dedup in register allocator (50×) | | SpiderMonkey IonMonkey | Firefox | **sm-0001 PATCHED** — `LinearSum::add()` HashMap (O(N×T)→O(N)) | | JavaScriptCore | Safari | Not yet scanned | ### 7.8 C/C++ Ecosystem — GCC, LLVM, CMake This is the broadest surface area. GCC and LLVM compile essentially everything: - **PostgreSQL** — compiled with GCC/Clang; build time improves from GCC fix even though PostgreSQL's own runtime query planner defects are deferred - **SQLite** — compiled with GCC/Clang; build-time improvement - **MySQL / MariaDB** — compiled with CMake + GCC/Clang; cmake-0001 directly speeds up the MySQL build's link-dependency resolution - **Apache httpd, nginx** — both compiled with GCC; build-time improvements - **OpenSSL, libssl** — GCC/Clang compilation benefits; critical infrastructure - **Linux kernel** — GCC compilation benefits; headerdep.pl (linux-0001) patched for kernel developer tooling **LLVM LTO specifically:** Link-time optimization is used by default in release builds of Firefox, Chrome, Rust's standard library, LLVM itself, and PostgreSQL with `--enable-lto`. The GlobalsModRef call-graph traversal (llvm-0001) runs during LTO. For large LTO builds — Firefox is ~10M LOC — this is a meaningful contributor to total build time. ### 7.9 Second-Order Blast Radius Summary | Ecosystem | Risk level | Primary concern | |-----------|-----------|-----------------| | JVM / Android | Medium | JDK rollout fragmentation across versions | | Python / pip | Low-Medium | pip is heavily tested; distlib change is isolated | | TypeScript / npm | Medium | VS Code ships its own tsc; needs separate coordination | | Haskell | Low | GHC releases are infrequent, community is small | | Rust | Low | rustc team has strong test infrastructure | | C/C++ / GCC / LLVM | Medium-High | Widest surface area; GCC/LLVM release cycles are long | --- ## 8. Third-Order Effects — Infrastructure and Runtime Systems ### 8.1 Database Systems **PostgreSQL** PostgreSQL sits at both second and third order. At build time it benefits from GCC/CMake patches (faster to compile from source). At runtime it has five confirmed CWE-407 defects in the query planner: three patched (postgresql-0002, -0003, -0004 via Bitmapset, Path B — no `nodeHash()` required), two deferred (postgresql-0001 and -0005 structural variants, pending `nodeHash()` infrastructure — see Section 4). The extension ecosystem compounds this: PL/Python, PL/Perl, and PostGIS all pull in the patched language runtimes. A PostgreSQL instance with PL/Python installed benefits from pip and CPython patches for any Python-side work, while the core planner defects remain unresolved. **SQLite** SQLite's query optimizer is simpler than PostgreSQL's — no join reordering, no equivalence class reasoning. The runtime risk of CWE-407 in SQLite's own planner is low. But SQLite is used as an embedded database in Python (`sqlite3` module), Ruby, PHP, and Node.js — all of which are receiving faster runtimes from our patches. Faster host runtimes reduce the overhead of the glue layer between application code and SQLite. **sqlite-0001 unit test** (`SqliteTest.java` 4/4 PASS): `checkColumnOverlap()` in `trigger.c:792` calls `sqlite3IdListIndex()` — an O(I) list scan — for each expression in the SET clause, producing O(E×I) total. Fix: build a case-insensitive hash set of watched-column names once, reducing to O(I+E). Speedup: **101×** at E=I=200. **MySQL / MariaDB** The cmake-0001 patch directly applies to MySQL's build. MySQL's optimizer handles join graphs for query planning; it is a candidate for its own CWE-407 scan. The optimizer processes join graphs for every complex query — the same structural pattern as the compiler defects, applied to SQL rather than type inference. **MongoDB** Compiled with SCons + GCC/Clang; build improves from the GCC fix. **MongoDB scan complete — 7 sites confirmed, 4 patched, 1 deferred, 2 not-worth-fixing.** Root cause: `RelevantTag` in `src/mongo/db/query/index_tag.h:106-107` stores index assignments in `std::vector first` and `std::vector notFirst`. Changing both to `std::unordered_set` simultaneously fixes four `std::find` calls in `planner_ixselect.cpp` (lines 978, 984, 1084/1086, 1310/1313, 1424/1427) — one struct change, four hot-path fixes. | ID | File | Severity | Status | |----|------|----------|--------| | mongodb-0001 | `index_tag.h:106-107` + `planner_ixselect.cpp` (4 sites) | CRITICAL | PATCHED | | mongodb-0002 | `plan_enumerator.cpp:697,734,753,816` | HIGH | PATCHED | | mongodb-0003 | `unpack_bucket.h:457` + `unpack_bucket.cpp:1076` | HIGH | PATCHED | | mongodb-0004 | `streaming_group.cpp:142` | MEDIUM | PATCHED | | mongodb-0005 | `ce_cache.h:122` IndexBounds structural equality | DEFERRED | no hash | | mongodb-0006 | `projection_ast.h:262` removeChild std::find | NOT-WORTH-FIXING | O(n) erase is irreducible | | mongodb-0007 | `join_graph.cpp:108,118` join predicate vector | NOT-WORTH-FIXING | InlinedVector\<2\>, A≈1 runtime | ### 8.2 Web Servers and Proxies **Apache httpd** — GCC compilation benefits. The `mod_proxy` and `mod_rewrite` rule graphs are low-complexity with bounded inputs; the runtime risk of CWE-407 in httpd itself is low. **nginx** — GCC build-time improvement. nginx's config parsing is linear and low-complexity; the runtime risk is low. **Envoy Proxy** — C++. Envoy's cluster graph, endpoint discovery, and routing rule evaluation are graph-structured. The xDS API builds a runtime graph of clusters, endpoints, and listeners. `source/common/upstream/` is a medium-priority scan target. **Istio (control plane)** — Go. Pilot builds an Envoy configuration graph. Go-based and likely uses maps throughout, but `pilot/pkg/networking/core/` virtual service graph resolution is worth verifying. **Caddy** — written in Go; Go compiler is already confirmed clean. Caddy's own routing graph uses Go maps throughout. Low risk. ### 8.3 GeoIP and Geographic Routing This is the most subtle third-order effect. GeoIP databases (MaxMind GeoLite2, IP2Location) have known error rates — typically 95–99% accurate at country level, 60–80% at city level. These errors cause misrouted CDN requests, payment fraud false positives, and content geo-restriction misfires. Our patches increase deployment velocity throughout the stack. Faster compilation and package resolution means routing rule updates deploy faster — which is good when the correction is right, but propagates faster when the correction itself contains an error. MaxMind's geoip2 Python library runs on CPython. Improved pip dep resolution means GeoIP library updates reach production faster. At scale — millions of IPs routed per second — even a brief incorrect GeoIP database update is amplified. **The geo paradox:** Our fix makes the whole stack faster. Faster stacks reduce latency. Reduced latency shifts requests between geographic regions (requests that previously timed out now succeed, from further away). This very slightly shifts the apparent distribution of traffic origins, which feeds back into GeoIP accuracy metrics. Geo-aware systems — ad targeting, fraud detection, CDN routing — should be aware of this feedback loop. **Mitigation:** GeoIP database deployments should use blue/green rollout with traffic validation at 1% before full promotion. This is sound practice regardless of our patches but becomes more important as deployment velocity increases. ### 8.4 CI/CD and Cloud Infrastructure **Jenkins** — **jenkins-0001/0002 PATCHED.** Jenkins' `DependencyGraph.add()` scanned a `List` on every `addDependency()` call during `rebuildDependencyGraph()` — triggered on every job save, rename, or delete. O(P×D) per rebuild, O(D) per edge. Fix: parallel `Map>` index for O(1) edge lookup. Also: `getBuildTriggerUpstreamProjects()` called `getChildJobs(ap).contains(this)` where `getChildJobs` returns `List` — O(U×D) per call. Fix: convert to `HashSet` first. Jenkins is the dominant CI system in enterprise Java shops; `rebuildDependencyGraph` fires thousands of times daily in large installations. **Maven** — **maven-0004/0005 PATCHED.** `DefaultGraphBuilder.java` used `sortedProjects::indexOf` as a sort comparator key in three places — O(N² log N) per Maven build invocation for the reactor setup pass. For a 500-module reactor: 2.25M list probes vs 500 map lookups. Fix: `Map` index built once. maven-0005 is the build-plan logger (debug path only). **Terraform** — **tf-0001/0002 PATCHED.** `AcyclicGraph.Validate()` calls `Cycles()` on every `terraform plan` and `terraform apply`. Tarjan's SCC used `inStack(s.Stack, w)` — O(V) slice scan — instead of an `onStack map[Vertex]bool`. O(V×E) → O(E). `EdgesTo()` in `CBDEdgeTransformer` scanned the entire edge set O(E) inside a vertex loop O(V×E total); fix uses the already-maintained `upEdges` index. tf-0001 fires on every infrastructure deployment. Unit test: 100× at V=100, exact triangular count confirmed. **Ansible** — **ans-0001/0002 PATCHED.** `Role.get_vars()` used `seen = []` for transitive role dependency deduplication — O(D²) where D = transitive dep count. Ansible codebase had a `TODO: re-examine dep loading` comment acknowledging the problem. Fix: `seen_ids = set()` using `id(dep)` (Role is unhashable). ans-0002: `self.collections` list membership tests — parallel set added. Fires per-role per-play during playbook compilation. Unit test: 30× at D=80. **SaltStack** — **salt-0001 PATCHED.** `_has_loop()` in `salt/cloud/__init__.py` used `seen = list`, `list(seen)` copy at every recursion level for cloud machine dependency cycle detection. O(V²) + O(depth²) copy overhead. Fix: `seen = set()`. 39× at depth=80. **Docker image builds** — Python base images: `pip install -r requirements.txt` in Dockerfile layers is the dominant time sink in most CI pipelines. distlib-0001 and cpython-0001 together reduce this. Maven/Gradle Java CI pipelines benefit from javac and maven-0004/0005 patches. npm install benefits from arborist patches. **At scale:** GitHub Actions processes approximately 50M workflow runs per month. If each Java, Python, or TypeScript workflow saves 5–15 seconds of build time, the aggregate is millions of compute-hours per month. This is real cost and real carbon. **CFEngine** — **cfe-0001/0002/0003 PATCHED.** `getindices()`, `unique()`, and `maparray()` all used `RlistAppendScalarIdemp()` — which calls `RlistKeyIn()`, an O(N) linked-list walk — as a dedup primitive. `unique()` is a first-class CFEngine policy built-in; fleet-management policies call it on hostname lists of N=10,000+. O(N²) → O(N) via `StringSet`. cfe-0002 (unique) is HIGH severity. All three defects share the same root: `rlist.c:542`. Unit test: 39× at N=80 for unique, 15× at K=60 for getindices. **RuboCop / Solargraph** — **rubocop-0001/0002, solargraph-0001/0002 PATCHED.** RuboCop's `IgnoredNode` mixin used `@ignored_nodes = []` (Array) for a dedup set included in every cop via `Cop::Base`. `part_of_ignored_node?` scanned it linearly for every string literal in the file — O(R×S) where R = regexp count, S = string count. Fix: `Set.new.compare_by_identity`. Solargraph's `@@inference_stack = []` (class variable) was both O(depth) for membership and a data race across threads; replaced with thread-local `Set.new`. ### 8.5 Graph Traversal Frameworks **Apache TinkerPop** — **tinkerpop-0001 PATCHED.** TinkerPop's `Path.java:206-214` contains an O(n²) default `isSimple()` implementation: a nested double-loop over the path's object list comparing every pair of vertices. This fires on every traverser evaluated by the `.simplePath()` and `.cyclicPath()` Gremlin steps — the fundamental graph deduplication operations in any Gremlin-based graph database (JanusGraph, Amazon Neptune, Azure Cosmos DB Gremlin API, TinkerGraph). The defect is activated through a specific code path: `PathFilterStep.java:60,62` calls `traverser.path().subPath(fromLabel, toLabel)`, which materializes a `MutablePath` via the `Path.java:263` default `subPath()`. `MutablePath` has no override for `isSimple()`, so it falls through to the O(n²) default. Separately, `PathFilterStep.java:79` hits the same path via `byPath.isSimple()` whenever `by()` modulators are present. The correct implementation already exists in the same file: `ImmutablePath.isSimple()` at line 292 uses a HashSet and is O(n). The fix is to bring the default `isSimple()` up to the same standard — a single HashSet pass instead of a nested loop. **Proof:** `TinkerPopPathTest` measures comparison operations directly. At path length n=200: defective does n×(n-1)/2 = 19,900 comparisons; fixed does n = 200. **99.5× speedup at n=200.** Growth is exactly quadratic vs linear, confirmed at n=10, 25, 50, 100, 200. Every Gremlin `.simplePath()` or `.cyclicPath()` query pays this O(n²) tax per traverser per step evaluated against a path of length n. --- ## 9. Fourth Frontier: Scientific Computing This is the domain where the topology defect may be causing the most invisible damage. Scientific computing works on genuinely large graphs — protein interaction networks (V=20,000+), genomics dependency graphs, finite element meshes, neural computation graphs, Monte Carlo dependency chains. At these scales, O(V²) is not "a bit slow" — it is computationally unobservable. Researchers simply never run the algorithm on the full dataset; they subsample, they approximate, they accept that "large graphs are slow." ### 9.1 NetworkX NetworkX is the dominant pure-Python graph library, used in bioinformatics, social network analysis, quantum circuit simulation, ML pipeline graphs, and physics simulations. It implements Tarjan SCC, Kosaraju SCC, DFS, topological sort, cycle detection, dominator trees, and dozens of other graph algorithms entirely in Python. **nx-0001 — PATCHED** (`algorithms/cycles.py:812`). `recursive_simple_cycles()` — Johnson's elementary cycle algorithm — uses `B = defaultdict(list)` as a blocking-set accumulator. Inside `circuit()`, every `if thisnode not in B[nextnode]` check is O(|B|) on a plain list. The fix is `B = defaultdict(set)` with `.add()` replacing `.append()`, making the membership test O(1). The code even has a comment: `# TODO: use set for speedup?` — the defect was known but unfixed. **Speedup:** O(E × |B|) → O(E). For a graph with 100 nodes and 10 elementary cycles, the defect performs O(1,000) list scans per circuit detection; the fix performs O(10) set lookups. Unit test confirms 25× at k=50 distinct sources, 2.68× defect growth vs 1.44× fixed on doubling k (super-linear confirmed). The remainder of the `algorithms/` package — `cycle_basis()`, Tarjan SCC, DFS, BFS — all use `set()` or `dict` and are clean. Scientific Python code calling NetworkX for large cycle enumeration problems pays the quadratic tax through this one path. ### 9.2 SciPy `csgraph` `scipy.sparse.csgraph` implements Dijkstra, Bellman-Ford, Floyd-Warshall, minimum spanning tree, connected components, and shortest paths. The core algorithms are written in Cython and compiled to C — hot paths are likely clean. The Python dispatch layer and `depth_first_order` function are lower-priority candidates for review. SciPy is used in finite element analysis, fluid dynamics simulation, computational chemistry, and signal processing pipelines. Wrong graph complexity at this layer would mean numerical simulations taking longer than the physics requires. ### 9.3 Graph-ML Frameworks - **PyTorch Geometric (PyG)** — graph neural networks; Python-level graph traversal for neighborhood sampling and subgraph extraction - **DGL (Deep Graph Library)** — similar; graph partitioning and traversal in Python layer - **TensorFlow graph executor** — C++; execution graph SCC and topological sort are internal; likely clean (Google engineers), but worth scanning - **JAX** — computation graph tracing in Python; `jax.core` builds and traverses Jaxpr graphs during tracing **The ML training implication:** If graph traversal in a GNN framework's data loading or batching code is O(V²), large-graph training runs that appear to stall at the data preparation stage may be fixable with a one-line patch. This would directly reduce training costs at scale. ### 9.4 The Ordering Defect Risk Beyond performance, there is a more serious concern for numerical computing chains. Some numerical algorithms use graph traversal to determine computation order — sparse matrix factorization, automatic differentiation, constraint propagation. If the traversal produces a **different ordering** due to a latent defect, numerical results could be subtly wrong. Example: sparse Cholesky factorization uses a fill-reduction ordering step (AMD, METIS) that involves graph traversal. A visited-set defect that causes a node to be processed twice or skipped would change the fill pattern. The factorization still runs but has higher fill than optimal, consuming more memory and producing different round-off error. Current assessment: **all confirmed defects degrade to O(n²) but produce correct output.** They are performance defects, not correctness defects. But numerical computing chains using these libraries must be individually verified, because the set of `visited` nodes in a traversal that uses a list (and thus may revisit nodes) differs from one using a proper set in pathological cases. --- ## 10. Fifth Frontier: Network Routing Protocols This is where the topology defect ceases to be a software quality issue and becomes a **live infrastructure reliability issue.** Network routing protocols are graph algorithms running continuously on production hardware, reacting to topology changes in real time. If their graph traversal has quadratic membership checks, the convergence behavior of the internet itself is degraded relative to theoretical bounds. ### 10.1 BGP BGP is the routing protocol of the internet — it maintains reachability between all autonomous systems (ASes). BGP routers maintain route tables with 900,000+ IPv4 prefixes and process updates continuously. AS-path loop detection prevents routing loops by checking if the local AS number appears in the AS-path of an incoming route. In a naive implementation this is a linear scan. For typical paths (4–8 ASes) this is negligible. But during BGP route storms — mass withdrawal and re-advertisement, which happen regularly at major IXPs — a router may process millions of updates per second. If loop detection iterates a list rather than a set or bitmap, the cost per update multiplies with path length. Route reflectors in large ISP networks see paths of 20–50 ASes for international routes. **Scan result (FRRouting bgpd):** `bgp_aspath.c` — `aspath_loop_check()` is O(L) single-call, not nested. **CLEAN.** The AS-path loop check is called once per update, not inside a traversal loop, so the linear scan over path length is not quadratic in the number of updates. **ExaBGP** (Python BGP implementation) and **BIRD** (IXP route servers) remain unscanned and are high-probability candidates given their languages and age. ### 10.2 OSPF — frrouting-0002 OSPF runs Dijkstra's Shortest Path First algorithm on the link-state database. SPF is triggered every time the topology changes. On large networks — enterprise core, ISP backbone — SPF runs on graphs of hundreds to thousands of nodes. **Confirmed defect:** `ospf_spf.c:275` — `listnode_lookup(vp->parent->children, v)` is called inside `ospf_vertex_add_parent()`, which is called for every vertex added to the SPF tree inside the Dijkstra main loop. The children list grows as the SPF tree is built; for hub-and-spoke topologies the hub's children list reaches size V. Each of V vertices calls `listnode_lookup` on that list: O(V²) total. A flat enterprise OSPF area with 500 routers — common in large campus and data center deployments — produces ~125,000 comparisons per SPF run instead of ~500. Triggered on every topology change (link up/down, metric change, neighbor state). During convergence storms a large flat area runs this O(V²) loop repeatedly. OSPF defines `SPF_DELAY` (default 200ms) and `SPF_HOLDTIME` (default 1000ms). If SPF takes longer than expected due to quadratic behavior, the hold-time backs off and convergence slows — making the network appear to be "under load" when it is actually hitting a complexity defect. **Status: Patched.** Fix applied: parallel `struct hash *children_index` added to `struct vertex`. `listnode_lookup` replaced with `hash_lookup` in `ospf_vertex_add_parent()`. O(1) per check, O(V) total. See `defects/frrouting/patch/frrouting-0002-ospf-spf-vertex-parent-hashset.patch`. **frrouting-0001** (already patched) fixed `listnode_lookup` × 5 in `ospf_ti_lfa.c` — the TI-LFA post-convergence fast-reroute calculator. frrouting-0002 is in the primary Dijkstra core. Higher blast radius. ### 10.3 IS-IS IS-IS is the other major link-state IGP, preferred by many large ISPs and most carrier backbone networks. Also uses SPF. `FRRouting isisd` — `isisd/isis_spf.c` — is unscanned and a high-priority candidate. If FRR's OSPF has the defect, IS-IS is likely to as well given the shared codebase conventions and era of authorship. ### 10.4 MPLS and Traffic Engineering MPLS label-switched paths are computed using RSVP-TE or SR-TE path computation. Constrained shortest-path first (CSPF) — Dijkstra with constraints — runs on a graph of the entire network for each LSP setup. In a network with thousands of MPLS tunnels being re-signaled after a failure, quadratic CSPF would cause a tunnel re-establishment storm at exactly the moment the network needs to converge fastest. **OpenDaylight (ODL)** — Java SDN controller implementing PCE for MPLS-TE. Java + graph algorithms = high probability of CWE-407. Used by major telcos for network automation. **Scan result: CLEAN** (scanned 2026-03-23). O(1) hash containers confirmed for graph traversal state. **ONOS (Open Network Operating System)** — Java SDN controller used by AT&T, NTT, Comcast. `core/api/src/main/java/org/onosproject/net/topology/` — topology service. **Scan result: CLEAN** (scanned 2026-03-23). O(1) hash containers confirmed. ### 10.5 Service Meshes **Envoy Proxy** — C++; cluster dependency resolution is a medium-priority scan target. **Istio** — Go; virtual service graph resolution worth verifying. **Consul, Linkerd, Cilium** — Go and Rust; likely clean. ### 10.6 The Internet Reliability Implication FRR's OSPF SPF has a confirmed O(V²) defect (frrouting-0002, now patched): 1. **Every network failure event** triggers slower-than-specified convergence in affected deployments 2. **BGP route storms** at major IXPs cause CPU spikes currently attributed to "BGP flapping load" — some fraction of that load may be algorithmic overhead 3. **Recovery time from fiber cuts, hardware failures, and DDoS attacks is longer than necessary** — not by a small margin, but potentially by orders of magnitude on large hub-and-spoke networks There are documented cases of OSPF convergence taking minutes instead of seconds on large networks. The standard explanation is "complex topology." The actual explanation, for some of these events, may include quadratic graph traversal. --- ## 11. Sixth Frontier: MATLAB, CAD, and Engineering Simulation ### 11.1 MATLAB and Simulink MATLAB is the primary computational tool for control systems, signal processing, circuit simulation, and numerical methods in engineering. Its `graph`/`digraph` objects (R2015b+) implement `conncomp()`, `toposort()`, `shortestpath()`, and `isdag()` — all implemented in MathWorks' compiled C/C++ runtime (closed source, not directly scannable). The behavioral signature is observable: benchmark `conncomp(G)` on random digraphs as V grows. O(V²) growth instead of O(V+E) confirms the defect. **Simulink** uses a signal-flow graph to determine block execution order. Block sorting is topological sort. If the visited set in that sort uses MATLAB cell array membership — `ismember()` in a loop — every Simulink model compilation has this defect. For large Simulink models (aerospace, automotive — common at V=10,000 blocks), engineers accept slow model compilation as a fact of life. It may not be a fact of life. **Algebraic loop detection** is Tarjan SCC on the block diagram graph. If this runs at O(V²), large models are taking far longer to compile than necessary. **DO-178C / ISO 26262 implication:** If Simulink's cycle detection is a performance defect only (not a correctness defect), the impact is compile-time only — not safety-critical. But this must be verified explicitly. A visited-set list that allows revisiting under pathological input could produce incorrect cycle detection results in model validation. **GNU Octave** (open-source MATLAB-compatible) was scanned (2026-03-23) and is **CLEAN** — all graph algorithms use vectorized ops and compiled C routines. The MATLAB `ismember` risk applies to user-authored `.m` files, not Octave's own implementations. ### 11.2 EDA (Electronic Design Automation) EDA tools are the compilers of hardware. They process netlists — graphs of logic gates, wires, and timing constraints — and produce manufacturable chip designs. The graph algorithms in EDA are among the most performance-critical in all of engineering. Key graph algorithms in EDA include: technology mapping (DAG covering, DFS-based), static timing analysis (longest path in DAG via topological sort), place and route (graph partitioning, Steiner tree, maze routing), equivalence checking (SCC-based circuit comparison), and power analysis (reachability in switching activity graph). **Scan results (2026-03-23):** | Tool | Result | Notes | |------|--------|-------| | **Yosys** | **CLEAN** | O(1) hash containers for graph traversal | | **Verilator** | **CLEAN** | `V3Graph.cpp` uses O(1) structures | | KiCad | **CLEAN** | Confirmed clean; DRC connectivity uses O(1) containers | **OpenROAD, OpenSTA, ABC (Berkeley)** — not yet scanned. These implement timing analysis and synthesis algorithms on netlists with V=millions. These are among the highest-priority remaining targets in the EDA space. **The chip design implication:** EDA tool runtime directly determines chip design cycle time. Longer compile times mean fewer design iterations mean worse final chip quality. If O(V²) graph traversal is embedded in EDA tools used today, chips being designed now are suboptimal relative to what the tools could produce with correct complexity. **Commercial EDA (Cadence, Synopsys, Mentor):** Closed source, cannot scan directly. But the same algorithm literature was used by the same generation of engineers. Performance benchmarks of commercial tools on large netlists may reveal the signature of quadratic behavior — a characteristic inflection in runtime growth as netlist size doubles. ### 11.3 Other CAD and Simulation Systems **FreeCAD / OpenCASCADE** — C++. Parametric dependency graph for feature rebuild order. Complex assemblies with deep feature trees are a candidate. **Blender** — C/Python. Node graph compositor and geometry nodes use topological sort for execution order. `source/blender/blenkernel/intern/node.cc` is a scan candidate. **FEniCS / OpenFOAM** — finite element and computational fluid dynamics. Build mesh adjacency graphs; mesh partitioning involves graph traversal. --- ## 12. Financial Markets — Cross-Stack Blast Radius Financial markets are the highest-stakes environment in which this defect map operates. The patches touch every layer of the financial stack — from the network that carries market data, to the compilers that build trading systems, to the brokers that route orders, to the databases that hold positions. No other industry has this many layers simultaneously affected. ### 12.1 Network — OSPF in Exchange Co-Location **frrouting-0002 is patched. The fix eliminates quadratic behavior in OSPF SPF on hub-and-spoke topologies.** Stock exchanges and electronic trading venues operate in co-location facilities where low-latency connectivity is the product. Equinix NY4/NY5 (NYSE/NASDAQ colocation), CME Aurora, CBOE Lenexa — all run OSPF internally between cabinets and switching layers. Every link failure triggers OSPF SPF recalculation. With frrouting-0002 now patched, SPF on a hub-and-spoke co-location topology returns to O(V+E) per event. For a facility with 500 connected endpoints: ~125,000 comparisons per failover instead of ~500. OSPF convergence delay is directly proportional to how long trading systems are unreachable during a failover. For algorithmic trading systems with sub-millisecond latency requirements, extended OSPF convergence is indistinguishable from a market data outage — orders rejected, hedges missed, risk positions unhedged during the convergence window. ### 12.2 FIX Protocol Engines The Financial Information eXchange (FIX) protocol is the message layer of every electronic market. Every order, cancel, execution report, and market data update flows through a FIX engine. **QuickFIX/J** (Java) — the dominant open-source Java FIX engine, used by brokers, hedge funds, and exchanges globally. Compiled with javac; all five javac patches apply. **QuickFIX** (C++) — the C++ FIX engine. Compiled with GCC/Clang with LTO in production builds; llvm-0001 applies. The session graph and routing logic in QuickFIX C++ have not been directly scanned. Given the codebase age (2000s) and language, the probability of CWE-407 candidates in session dependency resolution is medium-high. Recommended scan target. ### 12.3 Order Management and Trading Systems **Java OMS/EMS** — the majority of exchange-facing order management and execution management systems at financial institutions are Java. All compile with javac; all five javac patches apply directly. **Scala/Akka trading systems** — Akka is the dominant actor framework for high-throughput Scala trading backends, used at LMAX Exchange, Goldman Sachs (SecDB), Morgan Stanley, and quantitative hedge funds. **scala3-0001 (O(n³)) hits every Scala 3 trading codebase directly.** The constraint solver ran at cubic cost on every build of type-heavy Akka and Cats Effect trading applications. **C++ HFT systems** — high-frequency trading firms build almost exclusively in C++ for sub-microsecond latency. All benefit from llvm-0001 (LLVM LTO in release builds) and gcc-0001. HFT build cycles are aggressive; rebuilds happen on every strategy change. Faster LTO directly reduces the window between strategy update and live deployment. **Kotlin fintech backends** — kotlin-0001 affects every Kotlin financial services backend. Corda/R3 is the canonical example, but Kotlin is now the default at many fintech firms (Revolut, Monzo, N26, Stripe backend services). ### 12.4 Message Brokers and Event Streaming **Apache Kafka** — the dominant event streaming platform for financial data. Used at every major exchange, bank, and trading venue for market data feeds, trade events, and risk streams. Java-compiled; javac patches apply. Kafka Streams (Scala/Java) benefits from both javac and scala3-0001. **RabbitMQ** — Erlang-based, used heavily in financial messaging. Faster after erlang patches. **Throttle risk applies** (see §7.4): exchange topology validation rate increases on OTP upgrade; RabbitMQ deployments in financial infrastructure must be audited before deploying the OTP patch. **LMAX Disruptor** — Java ring buffer framework designed for financial low-latency event processing. Used at LMAX Exchange and widely adopted in financial middleware. Compiled with javac; benefits from all inference patches. ### 12.5 Risk and Position Databases **PostgreSQL** — risk management systems, position databases, P&L calculation engines, and regulatory reporting systems (MiFID II, Dodd-Frank) run heavily on PostgreSQL. Three of five planner defects now patched (Bitmapset, Path B): - **postgresql-0002** (MERGE/UPDATE planning) — **PATCHED.** Financial systems use MERGE heavily for upsert patterns in position and trade tables. Wide tables (50–200 columns) with complex MERGE statements hit the O(W²×C²) defect. Fix applied: Bitmapset on Var identity at all three preptlist.c sites. - **postgresql-0003** (equivalence class matching) — **PATCHED.** Analytical risk queries with many join predicates (scenario analysis, risk factor joins) hit the O(M×E) inner loop. Fix applied: Bitmapset built once from exprvars before EC member loop. - **postgresql-0004** (join elimination) — **PATCHED.** Self-join patterns on slowly-changing dimension tables (instrument reference, counterparty master). Fix applied: Bitmapset from toKeep exprs before reltarget merge. **TimescaleDB** — time-series PostgreSQL extension, used for market data storage (OHLCV, tick data, order book snapshots). Inherits remaining two PostgreSQL planner defects (-0001, -0005 structural variants). ### 12.6 TypeScript Trading Platforms Bloomberg Web Terminal, Refinitiv Eikon Web, and the majority of broker execution portals are TypeScript SPAs. ts-0001 through ts-0003 affect every TypeScript trading frontend — both developer latency in VS Code and CI build time for every deployment. Financial UI codebases are type-heavy by design (price types, instrument types, order state machines), which maximizes the exposure to the TypeScript cycle detection defects. ### 12.7 DeFi and On-Chain Financial Systems **solc-0001 (HIGH, patched)** — every Solidity contract compiled with `--via-ir` or `--optimize` is affected. DeFi protocols — Uniswap, Aave, Compound, Curve, MakerDAO — compile all production contracts through the Yul IR pipeline. More critically: `solc` is part of the security audit process. Every smart contract security audit involves multiple recompilations with different optimization settings. A slow compiler increases audit costs and may compress the time auditors spend on each compilation step — the slowness is felt precisely where correctness matters most. ### 12.8 Deployment Velocity — The Dual-Use Risk Faster build pipelines mean faster deployment of fixes. They also mean faster deployment of mistakes. **The upside:** A critical trading system bug discovered at market open can be hotfixed and deployed faster. The window between discovery and remediation shrinks. For financial systems where a defect can cost millions per minute, this is real value. **The downside:** Financial systems have strict change management. Deployments go through approval chains, pre-deployment testing, and regulatory notification for certain change categories. A faster build pipeline does not shorten the approval chain — but it creates pressure to compress it. The risk is that development teams, experiencing faster builds, develop habits around faster iteration that collide with change management requirements. **Mitigation:** Ensure change management processes are explicitly decoupled from build time. Faster CI should translate to more test coverage per deployment, not fewer gates before production. Specifically: do not use faster build time as justification for reducing pre-production soak time in financial trading systems. ### 12.9 Financial Markets Summary | Layer | Systems | Key patches | Risk | |-------|---------|-------------|------| | Network | OSPF in co-location | frrouting-0002 (patched) | Resolved | | FIX engines | QuickFIX/J, QuickFIX C++ | javac, llvm-0001 | Medium | | Trading systems | Java OMS, Scala/Akka, C++ HFT, Kotlin | javac, scala3, llvm, kotlin | Low-Medium | | Message brokers | Kafka, RabbitMQ, LMAX Disruptor | javac, erlang | Medium — throttle risk | | Risk databases | PostgreSQL, TimescaleDB | patched ×3, deferred ×2 | Medium→Low | | Trading UIs | TypeScript platforms | ts-0001..0003 | Low | | DeFi / on-chain | Solidity (Ethereum) | solc-0001 (patched) | Resolved | | Build velocity | All of the above | All patches | Dual-use | --- ## 13. Ninth Frontier: Game Engine Ecosystems — Minecraft Java Edition Minecraft Java Edition is the world's best-selling PC game and one of the most widely deployed custom-server ecosystems in existence. Hundreds of thousands of servers run community-operated instances; the modded ecosystem (Forge, Fabric, NeoForge) adds thousands of mods per major version. The server is bytecode-only (no published source); analysis was performed via CFR decompiler on the extracted inner jar from the bundler at `META-INF/versions/26.1/server-26.1.jar` (7,351 classes, version 26.1). ### 13.1 minecraft-0001 — DependencySorter.isCyclic (EXPONENTIAL, HIGH) **File:** `net/minecraft/util/DependencySorter` (decompiled) **Method:** `isCyclic(Multimap, K from, K to)` **Called from:** `net/minecraft/tags/TagLoader` — tag dependency resolution **Trigger:** Every world load, every `/reload`, every `/datapack enable` This is the only confirmed **exponential** defect in the full scan. `isCyclic` performs a recursive DFS to check whether adding a dependency edge would create a cycle — but with no visited set: ```java private static boolean isCyclic(Multimap directDependencies, K from, K to) { Collection dependencies = directDependencies.get(to); if (dependencies.contains(from)) { return true; } return dependencies.stream().anyMatch( dep -> DependencySorter.isCyclic(directDependencies, from, dep) ); } ``` Without a visited set, the DFS revisits nodes on every branch that can reach them. For a diamond dependency graph of depth D, the number of visits is 2^D. `isCyclic` is called from `addDependencyIfNotCyclic` for **every** dependency edge in the graph: ```java this.contents.forEach((id, value) -> value.visitRequiredDependencies(dep -> DependencySorter.addDependencyIfNotCyclic(directDependencies, id, dep))); this.contents.forEach((id, value) -> value.visitOptionalDependencies(dep -> DependencySorter.addDependencyIfNotCyclic(directDependencies, id, dep))); ``` #### Tag loading context Tags are Minecraft's classification system: `#minecraft:logs`, `#minecraft:planks`, `#forge:ores/iron`. Tags reference other tags as members; the dependency sort ensures tags are resolved in topological order. This runs in `TagLoader` on every world load, every `/reload` command, and every `/datapack enable`. Vanilla Minecraft has hundreds of tags — tolerable. Large modpacks have thousands of cross-mod tag dependencies. Diamond dependency patterns are endemic in modpack tag inheritance: a shared base tag (e.g., `#c:ingots`) depended upon by dozens of mod tags creates diamond chains. The "tag loading lag" widely reported by modpack server operators — multi-second freezes on every server start and `/reload` — is consistent with O(E^D) revisiting on these diamond graphs. **Fix (incremental):** Add `Set visited` parameter — `new HashSet<>()` at each callsite. Per-call cost drops from O(E^D) to O(E). Total tag loading drops from O(E^D × E) to O(E²). **Fix (optimal):** Replace per-edge cycle check with a single SCC pass after all edges are added (Tarjan or Kosaraju), reducing total cost to O(V+E). The current per-edge-add approach was likely chosen to produce granular error messages, but the cost is too high at modpack scale. **Disclosure path:** bugs.mojang.com (public bug tracker, "Performance" category) ### 13.1.1 Benchmark — diamond dependency graph Both versions compiled from decompiled bytecode (CFR, server-26.1.jar) with Guava 33.5.0-jre. Benchmark: `orderByDependencies` on a diamond tag dependency chain of increasing depth. Each depth level doubles the paths to the shared base tag — exactly the structure created by cross-mod tag inheritance in large modpacks. | Depth | Tags | BEFORE (ns) | AFTER (ns) | Speedup | |-------|------|-------------|------------|---------| | 2 | 6 | 28,405 | 32,386 | 0.9x | | 4 | 10 | 53,849 | 24,168 | 2.2x | | 6 | 14 | 64,026 | 13,293 | 4.8x | | 8 | 18 | 98,384 | 22,779 | 4.3x | | 10 | 22 | 436,388 | 37,353 | 11.7x | | 12 | 26 | 1,633,446 | 51,872 | **31.5x** | | 14 | 30 | 6,486,367 | 73,704 | **88.0x** | | 16 | 34 | **STACK OVERFLOW** | 98,626 | — | At depth 16 the defective version overflows the JVM stack — 2^16 recursive calls with no visited set. A large modpack with cross-mod diamond tag inheritance at depth 10–12 incurs 11–31x the necessary work on every server start and `/reload`. The fixed version scales linearly. The defective version does not survive depth 16. **Real server boot — vanilla (server-26.1, fresh world):** | Version | Minecraft "Done" time | Wall-clock | |---------|----------------------|------------| | Original (defective) | 6.252s | ~27s | | Patched (fixed) | 6.510s | ~27s | No measurable difference on vanilla. Expected: vanilla Minecraft has ~500 tags with shallow diamond depth (≤3–4). The fix overhead (HashSet allocation per `isCyclic` call) marginally exceeds the savings at this scale. The defect is only load-bearing at modpack scale (1,000+ cross-mod tags, diamond depth 8–14), where the micro-benchmark predicts 11–88x speedup. A modpack benchmark is the correct vehicle — vanilla is below the threshold where the exponential term dominates. **Real server /reload — modpack datapack (server-26.1, JDK 25, depth-16 synthetic modpack, 200 namespaces):** | Version | /reload time | Notes | |---------|-------------|-------| | Vanilla (defective) | 19,255 ms | Measured with RCON timing | | Patched | 3,087 ms | **6.2× speedup** | Real server speedup (6.2×) is lower than algorithm isolation (76×) because real `/reload` time includes I/O, JSON parsing, and other non-isCyclic work. The algorithm isolation benchmark strips all that away — 76× is the ceiling if the entire `/reload` were isCyclic. The 6.2× figure is the production-representative number. **Three-tier enriched-minecraft benchmark:** | Tier | Jar | Datapack | /reload | Demonstrates | |------|-----|----------|---------|-------------| | unpatched | vanilla server.jar | D=16/200NS | 19,255 ms | control — defect present | | mitigated | server-patched.jar | D=16/200NS | 3,087 ms (6.2×) | same game, fixed | | enriched | server-patched.jar | D=48/1000NS/97k nodes | 1,548 ms [isolation] | new territory — vanilla StackOverflows at D>20 | The enriched tier demonstrates a modpack configuration that cannot exist on vanilla servers: D=48 diamond chains cause a StackOverflow during world load before any player reaches play state. On the patched server, 97,000 tag nodes resolve in linear time. ### 13.2 minecraft-0002 — PistonStructureResolver (LOW, bounded) **File:** `net/minecraft/world/level/block/piston/PistonStructureResolver` (decompiled) **Pattern:** `this.toPush.contains(start)` — `toPush` is `ArrayList` **Complexity:** O(P²) — bounded at P≤12 by game design Every piston activation resolves a push chain. `PistonStructureResolver` maintains `toPush` as an `ArrayList` and checks for duplicates with a linear scan. Minecraft hardcodes a maximum of 12 pushed blocks per piston, capping the defect at 144 comparisons per activation. At 20 TPS with a 16×16 piston array: 737,280 list comparisons per second — measurable but not catastrophic. Principle violation; fix is parallel `HashSet` (same pattern as javac-0001 Tarjan stack). ### 13.3 Confirmed clean in Minecraft | Class | Why clean | |-------|-----------| | `util/Graph.depthFirstSearch` | Uses `Set` for `discovered` and `currentlyVisiting` — O(1) | | `util/FeatureSorter` | Uses `TreeSet` for visited/onStack — O(log n), deliberate | | `util/DependencySorter.visitDependenciesAndElement` | Uses `HashSet alreadyVisited` — O(1) | | `world/level/lighting/DynamicGraphMinFixedPoint` | No list containers in bytecode | | `world/level/chunk/status/ChunkDependencies` | No list containers in bytecode | The Minecraft developers correctly used `Set` in their general DFS utilities. The `DependencySorter.isCyclic` defect appears to have been added later as a targeted cycle-check helper without applying the same set-based discipline. ### 13.4 Modded ecosystem blast radius | Actor | Impact | |-------|--------| | Vanilla server operators | Hundreds of tags — tolerable; lag unnoticed | | Small modpack servers (50–200 mods) | Thousands of tags — measurable `/reload` lag | | Large modpack servers (Create, ATM, Omnifactory) | Multi-second freeze per world load | | Modpack developers | Slow `/reload` during development degrades iteration speed | | Server hosting providers | Restart time SLAs affected on large-modpack plans | minecraft-0001 is a live performance defect affecting every large modpack server start worldwide. The tag loading lag is user-visible, widely reported on r/feedthebeast and in modpack issue trackers, and has not previously been attributed to an algorithmic root cause. ### 13.5 Mod source scan — Create, AE2, Mekanism Three major open-source mods were scanned for independent CWE-407 instances: **Create mod — `TrackGraph.findDisconnectedGraphs` (create-0001, MEDIUM)** Create's train track graph split-detection implements BFS with `ArrayList` as the frontier queue, calling `frontier.remove(0)` on every iteration. `ArrayList.remove(0)` is O(n) — the backing array must shift all remaining elements left. For V nodes, BFS costs O(V²) instead of O(V+E). ```java List frontier = new ArrayList<>(); while (!frontier.isEmpty()) { TrackNodeLocation current = frontier.remove(0); // O(n) — wrong container // ... } ``` Trigger: every track removal event. In large automated factory servers with extensive Create railroads, this causes measurable lag spikes on track topology changes. Fix: replace `ArrayList` with `ArrayDeque` — O(1) amortized `removeFirst()`. **Applied Energistics 2 — CLEAN.** `GridNode.java` BFS uses `ArrayDeque`; visited tracking uses an object-identity integer counter — O(1). `PathingService.java` uses `HashSet` for the ignore-set in its loop — O(1). **Mekanism — CLEAN.** `TransmitterNetworkRegistry.OrphanPathFinder` uses `ObjectOpenHashSet` (fastutil) and `Deque` — both O(1). Notably, AE2 and Mekanism both handle large network topologies as core functionality and appear to have been written with algorithmic awareness from the start. The Create defect is in a newer subsystem (trains, added in a later major version). ### 13.6 Mod ecosystem summary | Scope | Defect | Status | |-------|--------|--------| | All mods via vanilla | minecraft-0001 (`DependencySorter.isCyclic`) | Unpatched — Mojang upstream | | All mods via vanilla | minecraft-0002 (`PistonStructureResolver`) | LOW — bounded at 12 | | Create mod only | create-0001 (`TrackGraph.findDisconnectedGraphs`) | Unpatched — Create upstream | | AE2 | — | CLEAN | | Mekanism | — | CLEAN | --- ### 13.2 Godot Engine — godot-0001 through godot-0004 Godot 4.x is the dominant open-source game engine (C++). Four CWE-407 defects confirmed across the scene system, physics simulation (2D and 3D), and soft body physics. **godot-0001 — SceneTree group membership (CRITICAL)** `scene/main/scene_tree.cpp:174` — `SceneTree::add_to_group()` calls `E->value.nodes.has(p_node)` where `nodes` is `Vector`. Every call fires a linear scan through the entire group membership list. In large scenes with thousands of nodes in commonly-used groups (`"pickable"`, `"enemies"`, `"save_data"`), this fires on every `add_to_child()` / `enter_tree()` event — per frame in dynamic scenes. **Proof:** At group size n=2000: defective fires 1,999,000 comparisons; fixed fires 2,000 (HashSet shadow index). **1,000× op reduction.** Fix: Add `HashSet node_set` to `struct Group` as a shadow index. `has()` queries use `node_set`; `Vector nodes` is preserved for ordered `call_group()` iteration. **godot-0002 / godot-0003 — Physics body area tracking 2D+3D (HIGH)** `modules/godot_physics_2d/godot_body_2d.h:165,174` and `modules/godot_physics_3d/godot_body_3d.h:159,168` — `GodotBody2D::add_area()` and `remove_area()` call `areas.find(AreaCMP(p_area))` where `areas` is `Vector`. `find()` is a linear scan using RID equality (`operator==`). This fires from `GodotAreaPair2D::pre_solve()` / `GodotAreaPair3D::pre_solve()` — every physics tick, for every body-area overlap pair. In a scene with 500 bodies and 200 overlapping areas each, the per-tick cost is O(bodies × areas²). **Proof:** At 500 bodies × 200 areas: defective fires 10,050,000 comparisons; fixed fires 200,000 (HashMap by RID). **50× op reduction.** Fix: Add `HashMap area_index` alongside `Vector areas`. The `find()` call is replaced by `area_index.find(rid)`. Index is rebuilt on every enter/exit event (rare), so the per-tick hotpath is O(1). **godot-0004 — SoftBody link deduplication (MEDIUM)** `modules/godot_physics_3d/godot_soft_body_3d.cpp:663,667` — `generate_bending_constraints()` builds a node adjacency list for soft body mesh physics using `LocalVector.has()`. For each link in the mesh, it checks both endpoints for duplicate neighbors via linear scan. For a mesh with L links and average degree D, total ops = O(L × D). **Proof:** At 1,000 nodes × 4 links/node: defective fires 28,000 comparisons; fixed fires 8,000 (HashSet shadow per node). **4× op reduction** (lower ratio because D is small at 4; scales worse for denser meshes). Fix: Add `HashSet` alongside each `LocalVector` in `node_link_set`. Membership checks use the set; the vector is preserved for downstream iteration. **Summary — Godot defects:** | Defect | File | Severity | Op Ratio | |--------|------|----------|----------| | godot-0001 | `scene/main/scene_tree.cpp:174` | CRITICAL (per-frame) | 1,000× | | godot-0002 | `modules/godot_physics_2d/godot_body_2d.h:165` | HIGH (per-tick) | 50× | | godot-0003 | `modules/godot_physics_3d/godot_body_3d.h:159` | HIGH (per-tick) | 50× | | godot-0004 | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` | MEDIUM (load-time) | 4× | All four: **PATCHED.** Patches at `defects/godot/patch/`. Unit proof: `GodotPhysicsAreaTest` 6/6 PASS. --- ### 13.3 Dry Engine (Urho3D fork) — dry-0001 / dry-0002 Dry is a C++ game engine forked from Urho3D. Two CWE-407 defects confirmed in the UI selection system and the event subscription system. **dry-0001 — ListView::SetSelections() (CRITICAL)** `Source/Dry/UI/ListView.cpp:529,556` — `SetSelections()` contains two back-to-back O(n²) loops. The first iterates `selections_` (current selection) and calls `indices.Contains(index)` — a linear scan of the incoming `PODVector`. The second iterates `indices` and calls `selections_.Contains(index)` — another linear scan. Both fire on every UI multi-selection change (drag-select, keyboard range-select, programmatic selection update). At k=2000 selections: ~3,125,750 comparisons per call. Fix: Build `HashSet indicesSet` from `indices` once before the loops. Add `HashSet selections_set_` as a shadow index maintained alongside `selections_`. Both Contains calls become O(1). **Proof:** 3,125,750 ops → 3,500 ops. **893× op reduction.** **dry-0002 — Object::UnsubscribeFromAllEventsExcept() (HIGH)** `Source/Dry/Core/Object.cpp:278` — iterates all event handlers (linked list) and calls `exceptions.Contains(handler->GetEventType())` where `exceptions` is `PODVector`. O(n×m) total where n=handler count, m=exceptions size. Fired during object teardown — common in scene transitions, level unload, object pooling. Fix: Build `HashSet excSet(exceptions.Begin(), exceptions.End())` once at function entry. O(m) setup, O(1) per handler → O(n+m) total. **Proof:** 23,775 ops → 500 ops. **48× op reduction.** Both: **PATCHED.** Patches at `defects/dry/patch/`. Unit proof: `DryEngineTest` 4/4 PASS. --- ### 13.4 SFML — sfml-0001 through sfml-0005 SFML (Simple and Fast Multimedia Library) is the dominant open-source C++ multimedia framework — graphics, audio, networking. Five CWE-407 defects confirmed, three sharing the same `std::find` on `std::vector` dedup pattern across all three platform backends. **sfml-0001/0002/0003 — VideoMode::getFullscreenModes() (HIGH, all platforms)** `src/SFML/Window/Unix/VideoModeImpl.cpp:98`, `Win32/VideoModeImpl.cpp:95`, `OSX/VideoModeImpl.mm:198` — all three platform implementations enumerate display modes via OS API then dedup with `std::find(modes.begin(), modes.end(), mode)` inside a growing-vector loop. O(n²) over the set of reported modes. While the raw mode count is small in production (15–50), the pattern is textbook CWE-407 and triggers on every fullscreen mode query — window creation, resolution change, fullscreen toggle. Fix: Shadow `std::set modeSet`; `modeSet.insert(mode).second` replaces `std::find`. O(n log n) total. **Proof:** 139× op reduction (500-mode stress test). **sfml-0004 — WindowImplX11::allWindows (HIGH)** `src/SFML/Window/Unix/WindowImplX11.cpp` — `allWindows` is a `std::vector`. On window destruction: `allWindows.erase(std::find(allWindows.begin(), allWindows.end(), this))`. O(n) per destruction, O(n²) for n simultaneous window closes in reverse creation order (worst case: server stress tests, window cascade effects). Fix: Replace with `std::set`; `allWindows.erase(this)` is O(log n). **Proof:** 1,001× op reduction (2,000-window reverse-close stress). **sfml-0005 — GlContext::isExtensionAvailable() (MEDIUM)** `src/SFML/Window/GlContext.cpp` — OpenGL extension list stored as `std::vector extensions`. `isExtensionAvailable()` calls `std::find(extensions.begin(), extensions.end(), name)` — O(n) linear scan over ~300 strings per query. Called repeatedly during context initialization for every capability check. Fix: Replace with `std::unordered_set`; `extensions.count(name) > 0` is O(1). **Proof:** 149× op reduction (300 extensions, 5,000 queries). All five: **PATCHED.** Patches at `defects/sfml/patch/`. Unit proof: `SFMLTest` 6/6 PASS. --- ### 13.5 AngelScript — angelscript-0001 through angelscript-0003 AngelScript is the scripting language embedded in many C++ game engines and applications (including Dry/Urho3D, Godot, and dozens of indie engines). Three CWE-407 defects confirmed — two in the module system, one in the compiler. Notably, the engine's own source has `// TODO: optimize` comments at the defect sites, acknowledging the problem. **angelscript-0001/0002 — FindNewOwnerForSharedType/Func() (HIGH)** `sdk/angelscript/source/as_scriptengine.cpp:880–960` — when a module is discarded, the engine searches all remaining modules to transfer ownership of shared types/functions. `asCModule::FindNewOwnerForSharedType()` and `FindNewOwnerForSharedFunc()` call `sharedTypes.IndexOf()` / `sharedFunctions.IndexOf()` — O(n) linear scan on `asCArray` — 5 times per shared type transfer. The engine's own comment at line 917: `// TODO: optimize: If the modules already stored the shared types separately, this would be quicker`. Fix: Add `asCSet sharedTypeSet` shadow; `IndexOf` → `Exists()` (O(1)). **Proof:** 3,980,000 ops → 39,800 ops. **100× op reduction.** **angelscript-0003 — CompileSwitch() case dedup (HIGH)** `sdk/angelscript/source/as_compiler.cpp` — during switch-statement compilation, duplicate case values are checked via `caseValues.IndexOf()` inside a while loop. O(n²) over the number of case values — O(n) scan per case, O(n) cases. Fix: Add `asCSet caseValueSet`; `IndexOf` → `Exists()` (O(1)). **Proof:** 124,750 ops → 500 ops. **250× op reduction.** All three: **PATCHED.** Patches at `defects/angelscript/patch/`. Unit proof: `AngelScriptTest` 4/4 PASS. --- ### 13.6 Three.js — threejs-0001 through threejs-0005 Three.js is the dominant JavaScript 3D library (~100k GitHub stars). Five CWE-407 defects confirmed across the WebGL binding allocator, shader graph, and node builder systems. **threejs-0001 — WebGLUniformsGroups.allocateBindingPointIndex() (HIGH)** `src/renderers/webgl/WebGLUniformsGroups.js` — `allocatedBindingPoints` is an Array. `allocateBindingPointIndex()` loops `i < maxBindingPoints` and calls `allocatedBindingPoints.indexOf(i)` per iteration — O(n) scan inside O(maxBindingPoints) loop. Called per uniform group per frame on binding point allocation. Fix: Shadow `allocatedBindingPointsSet = new Set()`; `!allocatedBindingPointsSet.has(i)` replaces `indexOf`. **22× op reduction.** **threejs-0002 — StackNode.build() nodes.indexOf in filter (HIGH)** `src/nodes/core/StackNode.js` — `nodes.indexOf(node) === -1` inside a `filter()` callback — O(n) scan per node, O(n²) total to filter out existing nodes from a new list. Fix: `const nodesSet = new Set(nodes)` before filter; `!nodesSet.has(node)`. **1,875× op reduction.** **threejs-0003/0004/0005 — NodeBuilder includes() (HIGH)** `src/nodes/core/NodeBuilder.js`: - Line 693: `getBindingGroups()` — triple-nested loop with `groupUniforms.includes(uniform)` — O(n) per uniform in O(stages × groups × uniforms) context. - Line 763: `addNode()` — `this.nodes.includes(node)` on every node addition. - Line 787: `addSequentialNode()` — `this.sequentialNodes.includes(node)` on every sequential node add. Fix: `groupSets` (Map of Sets) for triple-nested; `this.nodesSet = new Set()` for addNode; `this.sequentialNodesSet = new Set()` for addSequentialNode. **517× combined op reduction.** All five: **PATCHED.** Patches at `defects/threejs/patch/`. Unit proof: `ThreeJSTest` 6/6 PASS. --- ### 13.7 pygame — pygame-0001 through pygame-0004 pygame is the dominant Python 2D game framework (~7k GitHub stars, millions of installs). Four CWE-407 defects confirmed in the sprite group system — the hottest path in any pygame game loop. **pygame-0001/0002 — OrderedUpdates/LayeredUpdates.remove_internal() (HIGH)** `src_py/sprite.py` (and Cython variant `src_c/cython/pygame/_sprite.pyx`) — `OrderedUpdates.remove_internal()` and `LayeredUpdates.remove_internal()` call `self._spritelist.remove(sprite)` — Python's `list.remove()` is O(n) linear scan. Called from `sprite.kill()` which fires inside collision detection loops, making the full `kill()` inside-loop pattern O(n²). Fix: Add `_spritedict: sprite → index` shadow dict. `sprite in self._spritedict` is O(1). For true O(1) removal where order is not required: swap-with-last pattern. **Proof:** 12,002,000 ops → 4,000 ops. **3,001× op reduction.** **pygame-0003 — spritecollide(dokill=True) (HIGH)** `src_py/sprite.py` — `spritecollide()` with `dokill=True` iterates the collision group (O(n) outer loop) and calls `group_sprite.kill()` per collision — each `kill()` triggers `remove_internal()` → `list.remove()` O(n). Net: O(n²) kill loop. Fix: Batch kills via `GroupSingle`/plain `Group` dict pattern — O(1) dict removal per kill. For `OrderedUpdates`/`LayeredUpdates`: swap-with-last for O(1) removal. **Proof:** 12,002,000 ops → 4,000 ops. **3,001× op reduction.** **pygame-0004 — LayeredUpdates.switch_layer() (HIGH)** `src_py/sprite.py` — `switch_layer(layer1, layer2)` iterates all sprites in `layer2` and calls `change_layer(sprite, layer1)` per sprite. `change_layer()` calls `sprites.remove(sprite)` (O(n)) then re-inserts at layer position. O(n²) total. Fix: Bulk layer remap — update `_spritelayers` dict in one O(n) pass; rebuild `_spritelist` once. **Proof:** 9,003,000 ops → 3,000 ops. **3,001× op reduction.** All four: **PATCHED.** Patches at `defects/pygame/patch/`. Unit proof: `PygameTest` 6/6 PASS. --- ### 13.8 Pyramid — pyramid-0001 through pyramid-0005 Pyramid is the Python web framework underlying Pylons and the Pylons Project. Five CWE-407 defects confirmed across the routing, configuration, and registry systems — all in startup/configuration paths that scale quadratically with application size. **pyramid-0001 — RoutesMapper.connect() (HIGH)** `src/pyramid/urldispatch.py:57-58` — When a named route is replaced, `connect()` checks `if oldroute in self.routelist` (O(n) list scan) then calls `self.routelist.remove(oldroute)` (another O(n) scan). With R routes being re-registered, startup is O(R²). Fix: Shadow `_routeset = set()`. `if oldroute in self._routeset` is O(1). **2,000× op reduction.** **pyramid-0002 — StaticURLInfo.add() (HIGH)** `src/pyramid/config/views.py:2265-2269` — Each static view registration calls `names = [t[0] for t in registrations]` (O(n) rebuild), then `name in names` (O(n) scan), then `names.index(name)` (O(n) scan). Three O(n) passes per registration = O(n³) total. Fix: Persistent `name → index` dict; O(1) lookup per registration. **1,000× op reduction.** **pyramid-0003 — resolveConflicts() (CRITICAL)** `src/pyramid/config/actions.py:490` — The action resolution loop yields each resolved action and calls `state.remaining_actions.remove(action)` — O(n) list scan per action. With N configuration actions, startup is O(N²). Every Pyramid application pays this cost at launch. Fix: Shadow set of `id(action)`; `remainingSet.discard(id(action))` is O(1). **738× op reduction.** **pyramid-0004 — TopologicalSorter.sorted() (HIGH)** `src/pyramid/util.py:520-521,553,561` — Topological sort of tweens/derivers uses a plain list as the roots queue: `roots.pop(0)` O(n), `roots.insert(0, child)` O(n), plus `if tonode in roots` O(n) + `roots.remove(tonode)` O(n) in `add_arc()`. O(E²) total. Fix: `collections.deque` for O(1) `popleft()`/`appendleft()`; shadow set for O(1) membership. **176× op reduction.** **pyramid-0005 — Introspector.relate()/unrelate() (MEDIUM)** `src/pyramid/registry.py:190,199` — `_refs` maps introspectables to lists. `relate()` checks `y not in L` (O(n)) before appending; `unrelate()` checks `if y in L` (O(n)) then `L.remove(y)` (O(n)). O(I²) total for I introspectable relationships. Fix: Shadow `_refs_set` dict of sets; O(1) membership and discard. **6× op reduction.** All five: **PATCHED.** Patches at `defects/pyramid/patch/`. Unit proof: `PyramidTest` 6/6 PASS. --- ### 13.9 Bottle — bottle-0001; Flask — CLEAN **Bottle (bottle-0001) — Route.all_plugins() skiplist (MEDIUM)** Bottle is a single-file Python web framework. One CWE-407 defect in the plugin system: `bottle.py:512-521` — `Route.all_plugins()` iterates all app + route plugins and performs four separate membership tests against `self.skiplist` per plugin: `True in self.skiplist` (O(S) sentinel check), `name in self.skiplist` (O(S)), `p in self.skiplist` (O(S)), `type(p) in self.skiplist` (O(S)). `self.skiplist` is a plain Python `list`. `all_plugins()` is called on every `install()` / `uninstall()` operation (cache reset). With N plugins and S-entry skiplists: O(N × S) per reset, O(N²×S) total startup. For N proportional to S: O(N³). Fix: `self.skiplist = set(skiplist) if skiplist else set()`. All four membership tests become O(1) hash lookups. `True`, strings, plugin objects, and `type()` are all hashable. **Proof:** 15,050,000 ops → 200,000 ops. **75× op reduction.** BottleTest 2/2 PASS. **Flask — CLEAN.** All per-scope callback tables use `defaultdict(list)` keyed by scope string with dict-key lookups (O(1)). Route registration delegates to Werkzeug's indexed trie. Error handler MRO walk is bounded O(blueprints × MRO_depth). No CWE-407 found. --- ### 13.10 Rails — rails-0001 through rails-0011 Ruby on Rails is the dominant Ruby web framework. Eleven CWE-407 defects confirmed: 2 HIGH in the ORM eager-loader and callback system; 9 MEDIUM across Enumerable utilities, schema tools, boot hooks, enum definition, filter parameters, encryption, and timezone. **rails-0001 — Preloader::Batch future_tables (HIGH)** `activerecord/.../preloader/batch.rb:24` — `loaders.reject { |l| future_tables.include?(l.table_name) }` where `future_tables` is an Array (result of `.map.uniq`). Called inside `until branches.empty?` loop. O(D×L×F) where D=preload tree depth, L=runnable loaders, F=future table count. Fires on every `includes(...)` call. Fix: `.to_set` replaces `.uniq`. **210× op reduction.** **rails-0002 — Callbacks chain.index (HIGH)** `activesupport/.../callbacks.rb:803` — `chain.insert(chain.index(callback), ...)` inside `filters.each` across all class descendants in `skip_callback`. `chain.index` is O(C) on Array-backed CallbackChain. O(D×F×C²) total. Fix: build `position_map` hash before filter loop. **51× op reduction.** **rails-0003 — Enumerable#excluding (MEDIUM)** `activesupport/.../enumerable.rb:134` — `elements.include?(element)` Array O(E) inside `reject` loop. Available on all Enumerables via `Array#excluding` / `#without`. Fix: `elements.to_set` before reject. **475× op reduction.** **rails-0004 — Enumerable#in_order_of (MEDIUM)** `activesupport/.../enumerable.rb:201` — `series.index(v.public_send(key))` Array O(S) inside `sort_by` block (called O(N log N) times). Fix: `series_map = series.each_with_index.to_h` before sort. **151× op reduction.** **rails-0005/0006 — SchemaDumper + PostgreSQL schema_statements (MEDIUM)** `schema_dumper.rb:249,255` — exclusion/unique constraint name Arrays; Array#include? in two `indexes.reject` passes. `postgresql/schema_statements.rb:139` — include_columns Array in columns.reject!. Fix: `.to_set` on constraint names. **130× op reduction.** **rails-0007 — lazy_load_hooks @run_once (MEDIUM)** `activesupport/.../lazy_load_hooks.rb:84` — `@run_once[name].include?(block)` where `@run_once[name]` is Array (line 48: `Hash.new { |h, k| h[k] = [] }`). Called per hook per `run_load_hooks` invocation at boot. Fix: `Hash.new { |h, k| h[k] = Set.new }`. **251× op reduction.** **rails-0008 — Enum value_method_names (MEDIUM)** `activerecord/.../enum.rb:273,419` — `value_method_names.include?` inside `pairs.each` loop (O(E²)) and in `detect_negative_enum_conditions!` (O(E²)). Fix: `value_method_names = Set.new`. **1,000× op reduction.** **rails-0009 — FilterAttributeHandler filter_parameters (MEDIUM)** `activerecord/.../filter_attribute_handler.rb:69` — `filter_parameters.include?(filter)` Array O(F) per attribute; list grows in-loop during Rails boot when models register encrypted attrs. O(A×F) total. Fix: parallel `Set` for O(1) membership. **450× op reduction.** **rails-0010 — Encryption::AutoFilteredParameters (MEDIUM)** `activerecord/.../encryption/auto_filtered_parameters.rb:56,62` — two Array scans per encrypted attribute at boot: `excluded_from_filter_parameters?.find` O(X) and `filter_parameters.include?` O(F). Fix: `Set` for both. **250× op reduction.** **rails-0011 — TimeZoneConversion skip_list (MEDIUM)** `activerecord/.../attribute_methods/time_zone_conversion.rb:85,87` — `skip_time_zone_conversion_for_attributes.include?(name)` Array O(S) per column inside `create_time_zone_conversion_attribute?`, called per column per model during schema load. O(M×C×S) total. Fix: `to_set` before column loop. **20× op reduction.** All eleven: **PATCHED.** Patches at `defects/rails/patch/`. Unit proof: `RailsTest` 11/11 PASS. --- ### 13.11 Django — django-0001 through django-0004 Django is the dominant Python web framework. Four CWE-407 defects confirmed: 2 HIGH in the ORM queryset layer and serializer; 2 MEDIUM in system checks and raw SQL resolution. **django-0001 — Model.from_db() field_names (HIGH)** `db/models/base.py:622` — When loading deferred querysets (`.defer()` or `.only()`), `from_db()` builds the values list with a comprehension over `cls._meta.concrete_fields`: `next(values_iter) if f.attname in field_names else DEFERRED`. `field_names` is a plain list — `f.attname in field_names` is O(F) per field. Called once per queryset row in `ModelIterable.__iter__`. Total: O(N × F²). Irony: `.defer()` and `.only()` are Django's recommended performance optimization patterns. The optimization path has quadratic overhead baked in. Fix: `field_names_set = set(field_names)` before the comprehension. One line. **21× op reduction.** **django-0002 — Serializer.serialize() selected_fields (HIGH)** `core/serializers/base.py:130,136,143` — `Serializer.serialize()` stores `fields` as `self.selected_fields` without converting to a set. Three membership tests `field.attname in self.selected_fields` are executed per field per object. O(N × F × S). Triggered by `dumpdata`, `loaddata`, REST serialization, Django REST Framework. Fix: `self.selected_fields = frozenset(fields) if fields is not None else None` at line 102. **10× op reduction.** **django-0003 — _check_column_name_clashes() (MEDIUM)** `db/models/base.py:2081` — System check accumulates `used_column_names` as a list; `column_name in used_column_names` is O(F) per field = O(F²) total. Runs at startup and `manage.py check` for every model class. Fix: `used_column_names = set()`. **125× op reduction.** **django-0004 — RawQuerySet.resolve_model_init_order() (MEDIUM)** `db/models/query.py:2381,2389` — Two separate O(C) list scans: `column_name in self.columns` and `self.columns.index(f.column)` per field. `self.columns` is a plain list. Fix: `columns_set = set(self.columns)`; `columns_index = {col: idx for idx, col in enumerate(self.columns)}`. **101× op reduction.** All four: **PATCHED.** Patches at `defects/django/patch/`. Unit proof: `DjangoTest` 6/6 PASS. --- ### 13.12 ORM Wave — Hibernate, MyBatis, EF Core, Diesel, SQLAlchemy, Peewee, Sequelize The second scan wave targeted ORM frameworks across every major language ecosystem. 17 new CWE-407 defects confirmed across 7 ORMs. **Hibernate ORM — hibernate-0001 through hibernate-0005 (HIGH)** Five defects in the mapping layer, all sharing the same root cause: `ArrayList` used as a dedup-tracking container, with `contains()` called before `add()` in loops over schema columns, index columns, and FK second-pass queues. O(C²) cost during `SessionFactory` build time. Fix: `LinkedHashSet` throughout (preserves insertion order). Unit proof: `HibernateConstraintColumnTest` — **19× speedup at N=5,000**. **MyBatis — mybatis-0001 (MEDIUM)** `ResultMappingConstructorResolver.sortConstructorMappings()` uses `ArrayList.indexOf()` twice inside the sort comparator — O(P) per comparison, O(N×P×log N) total. Fix: pre-build `Map` index before sort, reducing comparator to O(1). Unit proof: `MyBatisConstructorSortTest` — **12× speedup at N=P=500**. **Entity Framework Core — efcore-0001 through efcore-0003** - **efcore-0001 (HIGH)**: `PropertyExtensions.FindGenerationProperty()` uses BFS with `List.Contains()` for the visited check — O(D²) where D is FK chain depth. Called from `KeyPropagator.PropagateValue()` on every `SaveChanges()`. Fix: shadow `HashSet`. **250× op reduction.** - **efcore-0002 (HIGH)**: `IReadOnlyProperty.AddPrincipals()` uses recursive traversal with `List.Contains()` — O(P²) principal chain. Fix: pass `HashSet` down the recursion. **250× op reduction.** - **efcore-0003 (MEDIUM)**: `ForeignKeyPropertyDiscoveryConvention` calls `foreignKeyProperties.Contains()` (on `IReadOnlyList`) inside key-property nested loops at model-build time. Fix: build `HashSet` once per FK. **6× op reduction.** Unit proof: `EfCoreTest` 3/3 PASS. **Diesel (Rust ORM) — diesel-0001 through diesel-0003 (MEDIUM)** Named-column row access (`row.get("column_name")`) calls `column_names.iter().position()` — an O(C) linear scan through the result-set column list — for every named field access on every row. Affects SQLite `Duplicated` rows (diesel-0001), `OwnedSqliteRow` (diesel-0002), and MySQL rows (diesel-0003). Fix: build `BTreeMap` index once per statement. **51× speedup at 500 rows × 100 columns × 100 accesses.** Unit proof: `DieselTest` 2/2 PASS. **SQLAlchemy — sqlalchemy-0001 through sqlalchemy-0002 (HIGH)** - **sqlalchemy-0001**: `SQLCompiler._values_bindparam: Optional[List[str]]` in `_process_numeric()`. Each new bind param checks `name not in _values_bindparam` — O(B) scan — making accumulation O(B²). Fix: convert to `set`. **500× op reduction.** - **sqlalchemy-0002**: `BulkORMUpdate` creates `evaluated_keys = list(…)` then uses it in a set comprehension `{c for c in prefetch_cols if c.key not in evaluated_keys}` — O(P×K). Fix: `evaluated_keys = set(…)`. **500× op reduction.** Unit proof: `SQLAlchemyTest` 2/2 PASS. **Peewee ORM — peewee-0001 (MEDIUM)** `_SortedFieldList.index(field)` calls `self._keys.index(field._sort_key)` — Python `list.index()` is O(N). The list is already sorted (maintained by the class). Fix: `bisect_left` for O(log N). **42× speedup at N=500 fields, 1,000 accesses.** Unit proof: `PeeweeTest` 1/1 PASS. **Sequelize — sequelize-0001 through sequelize-0002 (HIGH)** - **sequelize-0001**: `bulkInsertQuery()` builds `allAttributes` via `allAttributes.includes(key)` O(C) inside a double loop (rows × cols). O(rows×cols²) total. Fix: shadow `Set` for O(1). **50× speedup at 500 rows × 100 cols.** - **sequelize-0002**: `_expandIncludeAll()` calls `all.includes(type_)` O(T) inside a for-of loop over expansion types. O(T²) total. Fix: `const allSet = new Set(all)` before the loop. **250× speedup at T=500.** Unit proof: `SequelizeTest` 2/2 PASS. **TypeORM — typeorm-0001 through typeorm-0003 (HIGH)** - **typeorm-0001**: `OrmUtils.uniq()` reduce+find/indexOf O(N²). Called 6× per driver's `loadTables()` schema sync. Fix: Map keyed accumulator. **500× op reduction.** - **typeorm-0002**: `SubjectChangedColumnsComputer.computeDiffColumns()` — `diffColumns.includes(column)` inside `forEach(columns)`, O(cols²). Fix: shadow `Set`. **125× speedup.** - **typeorm-0003**: `UpdateQueryBuilder` — `updatedColumns.includes(column)` in nested propertyPaths×columns loop O(P×C²). Fix: shadow `Set`. **100× speedup.** Unit proof: `TypeORMTest` 3/3 PASS. **Doctrine ORM — doctrine-0001 through doctrine-0003** - **doctrine-0001 (HIGH)**: `AbstractHydrator.gatherRowData()` — `in_array($disc, $discriminatorValues)` O(S) per row per inheritance col. Fix: `array_flip()` + `isset()`. **26× at 2k rows × 50 subclasses.** - **doctrine-0002 (MEDIUM)**: `ClassMetadata::addSubClass()` — `in_array` O(S) per call in ClassMetadataFactory loops. Fix: parallel `$subClassesSet`. **250× at N=500.** - **doctrine-0003 (MEDIUM)**: `SqlWalker::walkObjectExpression()` — `in_array($field, $partialFieldSet)` O(P) per fieldMapping in `SELECT PARTIAL` DQL. Fix: `array_flip()` before loops. **130× at F=500.** Unit proof: `DoctrineTest` 3/3 PASS. **GORM — gorm-0001 (MEDIUM)** `callbacks.go:252` — `getRIndex()` O(N) scan called 13× per callback per `sortCallbacks()`. Triggered on every `Register()`/`Remove()`/`Replace()`. Fix: pre-build `map[string]int`. **194× speedup at N=200 callbacks.** Unit proof: `GORMTest` 1/1 PASS. ### 13.12 ORM Wave 2 — Exposed, SeaORM, Active Record **Exposed ORM (Kotlin) — exposed-0001 through exposed-0003** JetBrains Exposed is the Kotlin SQL framework used in Ktor and Android backends: - **exposed-0001 (HIGH)**: `SchemaUtilityApi.kt:80` — `mapMissingColumnStatements()` uses `existingColumns.find{}` O(M) per table column, plus `missingTableColumns.contains()` List O(M) per index-column in schema migration. Fix: `associateBy { it.name.lowercase() }` map + `toHashSet()`. **118× op reduction at N=500 cols.** - **exposed-0002 (MEDIUM)**: `IdentifierManagerApi.kt:72` — `keywords.any { equals(it, true) }` scans ~504 SQL keywords per identifier on every SQL generation cache miss. Fix: lazy lowercase `HashSet`. **144× op reduction at K=504.** - **exposed-0003 (MEDIUM)**: `Table.kt:1686` — `T.clone()` rebuilds `consParams.map(KParameter::name)` as a fresh `List` for each property filter pass. Fix: hoist `HashSet` before property loop. **6× op reduction at P=20, C=15.** Unit proof: `ExposedTest` 3/3 PASS. **SeaORM (Rust) — seaorm-0001 through seaorm-0004** SeaORM is the dominant async Rust ORM (used in Axum, Actix, Tokio stacks): - **seaorm-0001 (HIGH)**: `active_model.rs:1267` — `leftover.iter().any(|t| t.1 == via_key)` O(N) per related model inside many-to-many `establish_links()`. Fix: pre-build `HashSet`. **501× op reduction at N=1,000.** - **seaorm-0002 (HIGH)**: `rbac/engine/mod.rs:234` — `.values().find(|p| p.id == item.1)` O(P) + `.values().find(|r| r.id == item.0)` O(R) on every permission check. Fix: `HashMap` by numeric ID. **502× op reduction at P=R=1,000.** - **seaorm-0003 (MEDIUM)**: `schema/builder.rs:238` — `sorted.contains(&table_name)` Vec O(N) per leftover entity after topological sort; O(N²) on cyclic schemas. Fix: shadow `HashSet`. **500×.** - **seaorm-0004 (MEDIUM)**: `schema/topology.rs:213` — `TopologicalSort::from_iter` uses `Vec` as `seen` set; O(N) scan per item → O(N²). Fix: `BTreeSet`. **28× op reduction at N=1,000.** Unit proof: `SeaORMTest` 4/4 PASS. All 34 ORM wave defects (wave 1 + wave 2): **PATCHED.** Patches at `defects/{hibernate,mybatis,efcore,diesel,sqlalchemy,peewee,sequelize,typeorm,doctrine,gorm,exposed,seaorm}/patch/`. --- ## 14. Confirmed Clean Systems The following systems were scanned and confirmed free of CWE-407: **Routing and SDN:** ONOS, OpenDaylight — both use O(1) hash containers. **Browser engines:** V8 (v8-0001 PATCHED); SpiderMonkey (sm-0001 PATCHED); JavaScriptCore — not yet scanned. **Build systems:** sbt — confirmed clean. Bazel: bazel-0001/0002 PATCHED. Jenkins: jenkins-0001/0002 PATCHED. **Scientific computing:** GNU Octave (octave-0001 PATCHED — `std::find` on sorted vector); NetworkX (nx-0001 PATCHED — `B=defaultdict(list)` in `recursive_simple_cycles`). SciPy: not yet scanned. **EDA:** Yosys, Verilator — confirmed clean. KiCad: kicad-0001 PATCHED. **Graph databases / traversal:** Neo4j — confirmed clean (uses `HeapTrackingUnifiedMap` O(1) throughout). Apache TinkerPop: tinkerpop-0001 PATCHED (`Path.isSimple()` 99.5×). **Game engines and multimedia:** Godot 4.x — 4 defects PATCHED: `SceneTree.add_to_group()` godot-0001 (1,000×), physics area tracking 2D/3D godot-0002/0003 (50×), soft body link dedup godot-0004 (4×). Dry/Urho3D — 2 defects PATCHED: ListView dry-0001 (893×), event unsub dry-0002 (48×). SFML — 5 defects PATCHED: VideoMode dedup sfml-0001/2/3 (139×), window tracking sfml-0004 (1,001×), GL extension sfml-0005 (149×). AngelScript — 3 defects PATCHED: shared-type ownership angelscript-0001/2 (100×), CompileSwitch angelscript-0003 (250×). Three.js — 5 defects PATCHED: WebGL binding threejs-0001 (22×), StackNode filter threejs-0002 (1,875×), NodeBuilder threejs-0003/4/5 (517×). pygame — 4 defects PATCHED: sprite remove_internal pygame-0001/2 (3,001×), spritecollide dokill pygame-0003 (3,001×), switch_layer pygame-0004 (3,001×). **Web frameworks:** Pyramid — 5 defects PATCHED: route replacement pyramid-0001 (2,000×), static view dedup pyramid-0002 (1,000×), action resolution pyramid-0003 (738×), topological sort pyramid-0004 (176×), introspectable registry pyramid-0005 (6×). Bottle — bottle-0001 PATCHED: skiplist list scan ×4 per plugin (75×). Flask — CLEAN. Rails — 11 defects PATCHED: preloader eager-load rails-0001 (210×), callback skip rails-0002 (51×), Enumerable#excluding rails-0003 (475×), in_order_of rails-0004 (151×), SchemaDumper rails-0005/6 (130×), lazy_load_hooks rails-0007 (251×), enum boot rails-0008 (1,000×), filter params rails-0009 (450×), encryption filter rails-0010 (250×), timezone skip rails-0011 (20×). Django — 4 defects PATCHED: from_db deferred load django-0001 (21×), serializer selected_fields django-0002 (10×), column clash check django-0003 (125×), RawQuerySet django-0004 (101×). **ORM layer:** Hibernate — 5 defects PATCHED: schema-mapping addColumn/addReferencedColumn/addIndex LinkedHashSet hibernate-0001/2/3 (19×), FK second-pass hibernate-0004, orderHierarchy hibernate-0005. MyBatis — mybatis-0001 PATCHED: sort comparator HashMap (12×). Entity Framework Core — 3 defects PATCHED: FindGenerationProperty HashSet efcore-0001 (250×), AddPrincipals HashSet efcore-0002 (250×), FK discovery efcore-0003 (6×). Diesel — 3 defects PATCHED: SQLite/MySQL row BTreeMap index diesel-0001/2/3 (51×). SQLAlchemy — 2 defects PATCHED: _values_bindparam Set sqlalchemy-0001 (500×), evaluated_keys Set sqlalchemy-0002 (500×). Peewee — peewee-0001 PATCHED: _SortedFieldList bisect (42×). Sequelize — 2 defects PATCHED: bulkInsert Set sequelize-0001 (50×), expandIncludeAll Set sequelize-0002 (250×). TypeORM — 3 defects PATCHED: OrmUtils.uniq typeorm-0001 (500×), diffColumns typeorm-0002 (125×), updatedColumns typeorm-0003 (100×). Doctrine ORM — 3 defects PATCHED: hydrator discriminator doctrine-0001 (26×), addSubClass doctrine-0002 (250×), SqlWalker partial doctrine-0003 (130×). GORM — gorm-0001 PATCHED: sortCallbacks getRIndex (194×). Exposed ORM — 3 defects PATCHED: schema migration exposed-0001 (118×), keyword scan exposed-0002 (144×), clone filter exposed-0003 (6×). SeaORM — 4 defects PATCHED: establish_links seaorm-0001 (501×), permissions seaorm-0002 (502×), sorted_tables seaorm-0003 (500×), topo-sort seaorm-0004 (28×). Rails Active Record — 3 additional defects PATCHED (rails-0009/10/11): filter params (450×), encryption filter (250×), timezone skip-list (20×). **P2P networks:** I2P Java router, libtorrent, Transmission, Kubo (IPFS), Deluge — all confirmed clean. **Routing:** FRRouting bgpd (`bgp_aspath.c`) — CLEAN. ExaBGP, BIRD — not yet scanned. **Blockchain:** Bitcoin Core, Litecoin, Dogecoin, Monero, Solana validator, solang (Solidity→BPF compiler) — all confirmed clean. **CLI implementations (unsandbox.com inception suite — 40 of 42 languages scanned):** Python, Ruby, Go, Rust, JavaScript, TypeScript, Java, Kotlin, Haskell, Clojure, OCaml, Erlang, Prolog, Lua, Julia, R, C, C++, C#, Dart, Elixir, F#, Fortran, Groovy, Swift, PHP, Perl, Raku, Scheme, Objective-C, PowerShell, COBOL, Common Lisp, Crystal, V, Nim, Zig, D — all confirmed CLEAN of genuine CWE-407. Not scanned: Scala (source 404), Forth (source 404). REST clients have no hot algorithmic paths; O(n²) has nowhere to live. A "terminal states" anti-pattern (4-element fixed array checked with O(n) scan in job polling loops) appears across ≥6 implementations and is the stylistic floor of the defect class — technically fixable with Set/HashSet, negligible in practice since n=4 is constant. This confirms the thesis: CWE-407 concentrates in core algorithmic code (graph traversal, type inference, dependency resolution), not in I/O-bound client code. --- ## 15. Blast Radius Mitigation Plan ### Tier 1 — Before any patch is submitted upstream 1. **Every patch has a behavioral equivalence proof** — not just "tests pass" but a written argument that output is identical for all inputs (SCC membership, ordering, cycle reporting) 2. **Operation-count unit tests** — if a test does not assert O(1) membership, it does not count 3. **Fuzz testing on graph structure** — random DAGs, random dense graphs, self-loops, disconnected components, very large graphs (V=10,000+) 4. **No patch touches error messages or exception types** — changing a list to a set must not change what gets thrown or printed when a cycle is detected ### Tier 2 — Before coordinated disclosure 5. **Upstream maintainer contact before public patch** — privately share the patch and proof with the maintainer; give them 90 days to merge and release 6. **Sequence disclosure by blast radius** — patch low-surface tools first (peg_generator, distlib, erlang stdlib) before high-surface tools (javac, tsc, GHC) 7. **Version compatibility testing** — test each patch against the last 3 major releases of the affected tool, not just HEAD ### Tier 3 — Infrastructure-specific 8. **Database query planners** — PostgreSQL scanned: five sites confirmed, three patched (-0002/-0003/-0004 Bitmapset), two deferred (-0001/-0005 pending `nodeHash()`). MySQL optimizer confirmed clean. MongoDB scanned: 7 sites confirmed, 4 patched (index_tag.h root cause + pipeline sites), 1 deferred (ce_cache.h IndexBounds), 2 not-worth-fixing (projection_ast.h, join_graph.cpp). Disclosure can proceed: all major DB planners scanned. Revealing "compilers are fixed" while a DB planner has the same defect creates an exploit window — that window is now closed for PostgreSQL and MongoDB. 9. **Erlang OTP financial systems** — before deploying the erlang-0002 patch in any financial or queue-based production system, audit all call sites of `digraph_utils:loop_vertices/1` and `is_simple/1`. Measure current call latency under production load. Model the downstream effect of 100×+ speedup at those sites. Stage rollout canary → 10% → 100% with monitoring on downstream queue depth. RabbitMQ deployments in financial infrastructure are the highest-priority systems to audit. The fix is correct; the risk is that slow graph ops were acting as implicit throttles in systems calibrated around their current latency. 10. **GeoIP deployment velocity** — faster deployment pipelines increase the importance of staged rollouts for data updates, not just code 11. **CDN and routing system operators** — brief major CDN operators (Cloudflare, Fastly, Akamai) as part of coordinated disclosure. Their build pipelines are affected; their traffic routing systems may independently contain the same defect. ### Tier 4 — Post-disclosure monitoring 11. **Regression watch** — monitor upstream repos for 6 months post-disclosure for any performance regression reports attributable to ordering changes in SCC output 12. **CVE coordination** — CWE-407 in a build tool is typically a DoS via crafted input: an adversary can construct a source file that maximizes the quadratic behavior. File CVEs for tools that accept untrusted input (tsc, javac, GCC/Clang). Do NOT file CVEs for internal-only tools where input is trusted. --- ## 16. Disclosure Plan **Contact:** `security@undefect.com` — for maintainers, researchers, or vendors responding to this disclosure. All coordinated disclosure communication goes through this address. 1. All 42 patched sites have patches, unit tests with operation counts, and integration tests. solc-0001/0002 and frrouting-0002 patches pending. 2. This white paper completes the proof record for each site. 3. **Regression validation gap:** Unit tests prove algorithmic correctness (identical outputs, proven complexity). No upstream regression suite has been run against a patched build for any site. Patches are disclosed as algorithmic proofs; each maintainer must validate against their CI. Residual risk is low for pure flag changes (javac-0001, javac-0003); medium for the Infer.java cache (javac-0002) pending OpenJDK CI; low-medium for TypeScript snapshot tests that may capture symbol ordering in cycle-detection error messages. 4. Upstream maintainers notified privately with patch and proof before any public release. 5. 90-day response window per maintainer. 6. PostgreSQL notified with defect analysis, patches for -0002/-0003/-0004 (Bitmapset, Path B), and `nodeHash()` proposal for -0001/-0005 — documented findings with patches in hand for three of five sites. 7a. MongoDB notified with defect analysis and patches: index_tag.h root-cause fix (4 planner_ixselect.cpp sites), plan_enumerator.cpp (4 sites), pipeline algorithm sites (streaming_group.cpp, unpack_bucket.cpp). ce_cache.h deferred pending hash infra. 7. CVE filing for tools that accept untrusted input (javac, tsc, GCC/Clang, rustc). Not filed for internal tools or display-only paths. 8. Disclosure sequenced by blast radius: low-surface tools first (headerdep, distlib, erlang), then build tools (Maven, CMake, GYP), then compilers (javac, tsc, GHC, Scala 3, Kotlin, LLVM, GCC, rustc). --- ## 17. Fix Paths for Pending Sites All actively-patchable defect sites are now patched (91 total). Remaining open items: erlang-0002 (FIXABLE-UPSTREAM — requires OTP internal ABI change); postgresql-0001 and -0005 (DEFERRED — structural variants pending `nodeHash()` infrastructure); mongodb-0005 (DEFERRED — IndexBounds structural equality, no available hash); mongodb-0006/-0007 (NOT-WORTH-FIXING); minecraft-0001/-0002 and create-0001 (upstream Mojang/Create — out of scope for coordinated disclosure). Every site has a documented resolution. None require new algorithmic research — only data structure substitution and, for the PostgreSQL and MongoDB deferred sites, new hash infrastructure. --- ### 17.1 frrouting-0002 — FRRouting OSPF SPF Dijkstra Core **File:** `ospfd/ospf_spf.c:275` **Complexity:** O(V²) worst case on hub-and-spoke topology, triggered on every OSPF topology change. `ospf_vertex_add_parent()` is called for every vertex processed in Dijkstra's main loop. It guards against duplicate parent-child edges with a linear scan: ```c if (listnode_lookup(vp->parent->children, v) == NULL) listnode_add(vp->parent->children, v); ``` `listnode_lookup()` is a linear scan over a singly-linked list. For a hub-and-spoke topology with V routers all connected to one hub, the hub's children list grows to V, and each of V vertices calls `listnode_lookup` against it: O(V²) total. A flat enterprise OSPF area with 500 routers produces ~125,000 comparisons per SPF run instead of ~500. **Fix — parallel flag on vertex (minimal change):** Each vertex is processed exactly once in Dijkstra's main loop. A per-vertex boolean flag `added_as_child` eliminates the need for the list scan entirely: ```c /* In struct vertex (ospfd/ospf_spf.h): */ uint8_t added_as_child; /* CWE-407 fix: replaces listnode_lookup */ /* In ospf_vertex_add_parent(): */ if (!vp->parent->added_as_child) { vp->parent->added_as_child = 1; listnode_add(vp->parent->children, v); } ``` Reset `added_as_child` to 0 in `ospf_vertex_new()` and in the SPF cleanup pass (`ospf_spf_cleanup()`). No new data structures, no allocation, no dependency on FRR's hash library. O(1) per check, O(V) total. **Complexity after fix:** O(V+E) for the SPF tree construction pass. **Status: Patched (2026-03-26).** Patch: `defects/frrouting/patch/frrouting-0002-ospf-spf-vertex-parent-hashset.patch` --- ### 17.2 erlang-0002 — Erlang OTP `digraph_utils:is_reflexive_vertex` **File:** `lib/stdlib/src/digraph_utils.erl:495` **Complexity:** O(degree(V)) per vertex → O(V²) for `loop_vertices/1` and `is_simple/1` over a full graph. ```erlang %% Current — O(degree(V)) because out_neighbours builds the full list is_reflexive_vertex(V, G) -> lists:member(V, digraph:out_neighbours(G, V)). ``` The `digraph` module's `ntab` ETS table uses `{out, V}` as its key — not `{out, V, Neighbor}`. There is no O(1) path to ask "does V have a self-loop" from outside `digraph.erl` without building the full neighbor list. Converting that list to a set at the callsite costs O(degree(V)) for the conversion and does not help. **Fix — add `sltab` to `digraph.erl` internals:** A fourth private ETS table `sltab` stores `{V}` for every vertex that has at least one self-loop. Maintained entirely inside `digraph.erl` with no public API change. ```erlang %% digraph.erl record — add sltab field: -record(digraph, {vtab = notable :: ets:table(), etab = notable :: ets:table(), ntab = notable :: ets:table(), sltab = notable :: ets:table(), %% new cyclic = true :: boolean()}). %% do_insert_edge/5 — record self-loops at insert time: do_insert_edge(E, V1, V2, Label, #digraph{ntab=NT, etab=ET, sltab=SL}) -> ets:insert(NT, [{{out, V1}, E}, {{in, V2}, E}]), ets:insert(ET, {E, V1, V2, Label}), case V1 =:= V2 of true -> ets:insert(SL, {V1}); false -> ok end, E. %% New export — O(1) self-loop check: -spec has_self_loop(G, V) -> boolean() when G :: graph(), V :: vertex(). has_self_loop(G, V) -> ets:member(G#digraph.sltab, V). ``` Edge deletion must remove from `sltab` when the last self-loop on a vertex is deleted (check with `ets:select` on `etab` after deletion). ```erlang %% digraph_utils.erl — fix is_reflexive_vertex to use O(1) check: is_reflexive_vertex(V, G) -> digraph:has_self_loop(G, V). ``` **Complexity after fix:** | Operation | Before | After | |-----------|--------|-------| | `is_reflexive_vertex/2` | O(degree(V)) | O(1) | | `loop_vertices/1` | O(V²) | O(V) | | `is_simple/1` (reflexive check) | O(V²) | O(V) | | `add_edge` / `del_edge` | O(1) | O(1) + 1 ETS op | **Blast radius:** `digraph` and `digraph_utils` are OTP stdlib. Every Erlang/Elixir application that calls `loop_vertices/1` or `is_simple/1` — including RabbitMQ, ejabberd, Rebar3, and Mix — receives the fix on OTP upgrade. No source changes required in downstream code. --- ### 17.3 solc-0001 — Solidity Compiler Yul Call Graph Cycle Detector **File:** `libyul/optimiser/CallGraphGenerator.cpp:49` **Complexity:** O(F × D²) — F functions, D maximum call depth. `CallGraphCycleFinder::visit()` maintains `currentPath` as a `std::vector` representing the current DFS stack. On every node visited: ```cpp auto it = find(currentPath.begin(), currentPath.end(), _function); // O(|path|) ``` This is a linear scan to check if `_function` is already on the DFS path. The developer left the comment `// TODO: This algorithm is non-optimal.` at line 36. For a DeFi contract with deep Yul inlining chains, F × D² is material at compile time. **Fix — parallel `currentPathSet`:** ```cpp struct CallGraphCycleFinder { CallGraph const& callGraph; std::set containedInCycle{}; std::set visited{}; std::vector currentPath{}; std::set currentPathSet{}; // CWE-407 fix void visit(FunctionHandle const& _function) { if (visited.count(_function)) return; if (currentPathSet.count(_function)) // O(log D) — hot path { // Cycle found — linear scan only on cycle detection (rare) auto it = find(currentPath.begin(), currentPath.end(), _function); containedInCycle.insert(it, currentPath.end()); } else { currentPathSet.insert(_function); currentPath.emplace_back(_function); if (callGraph.functionCalls.count(_function)) for (auto const& child : callGraph.functionCalls.at(_function)) visit(child); currentPath.pop_back(); currentPathSet.erase(_function); visited.insert(_function); } } }; ``` The fallback `find` inside the cycle-detected branch runs only when a cycle is confirmed — rare in valid contracts. The hot path (no cycle) is O(log D) per node. **Complexity after fix:** O(F × D × log D). --- ### 17.4 solc-0002 — Solidity Compiler EOF Relative Jump Resolution **File:** `libevmasm/Assembly.cpp:1077` **Complexity:** O(J × N) — J relative jumps, N total instructions. Inside the EVM Object Format (EOF) control flow builder, each relative jump resolves its target by scanning the full instruction sequence: ```cpp auto const tagIt = std::find(items.begin(), items.end(), item.tag()); // O(N) per jump ``` This is inside a loop over all instructions. For a function with J relative jumps and N instructions, this is O(J × N). **Fix — pre-build `tagIndex` map:** ```cpp // Build once before the loop — O(N) std::unordered_map tagIndex; for (size_t i = 0; i < items.size(); ++i) if (items[i].type() == Tag) tagIndex[items[i]] = i; // Inside the jump-processing loop — O(1) per lookup if (item.type() == RelativeJump || item.type() == ConditionalRelativeJump) { auto it = tagIndex.find(item.tag()); solAssert(it != tagIndex.end(), "Tag not found."); successors.emplace_back(it->second); } ``` Note: if `AssemblyItem` has no `std::hash` specialization, use `std::map` (O(log N) per lookup) as a step-down: O(N log N + J log N) vs O(J × N) current. Either is correct; the hash map is optimal. **Complexity after fix:** O(N + J) with hash map, O(N log N + J log N) with ordered map. **Note on exposure:** EOF is still in EIP proposal / testnet stage as of 2026-03-24. Real-world exposure is currently limited, but this code path will become the default compilation path for all EVM contracts once EOF is finalized. --- ### 17.5 tor-0001 — Tor Anonymity Network Router Descriptor Loading **File:** `src/feature/nodelist/routerlist.c:2179` **Complexity:** O(R²) — R = number of router descriptors in batch. `router_load_routers_from_string()` checks each received router descriptor against a list of requested fingerprints: ```c SMARTLIST_FOREACH_BEGIN(routers, routerinfo_t *, ri) { if (requested_fingerprints) { base16_encode(fp, sizeof(fp), ...); if (smartlist_contains_string(requested_fingerprints, fp)) { // O(R) smartlist_string_remove(requested_fingerprints, fp); } } } SMARTLIST_FOREACH_END(ri); ``` `smartlist_contains_string` is a linear scan. `requested_fingerprints` starts at size R and shrinks by one per match, giving R + (R-1) + ... = O(R²/2) total comparisons. The same pattern appears in the extrainfo path at lines 2263–2295. For directory authorities processing the full ~8,000-relay consensus at startup, this is O(64M) string comparisons. For every relay and client that fetches router descriptors — which is all of them, at startup and on periodic refresh. **Fix — replace `smartlist_t` with `digestmap_t`:** Tor already uses `digestmap_t` (a 20-byte-keyed O(1) hash map) extensively in the same file at lines 2689, 2717, and 2802. The fix is a direct substitution: ```c /* Before: smartlist_t *requested_fingerprints (hex strings, O(n) scan) */ /* After: digestmap_t *requested_fingerprints (raw digests, O(1) lookup) */ /* Lookup — keying on raw digest bytes, no hex encoding needed: */ if (digestmap_get(requested_fingerprints, ri->cache_info.signed_descriptor_digest)) { digestmap_remove(requested_fingerprints, ri->cache_info.signed_descriptor_digest); } ``` The `base16_encode` step is eliminated — we key on the raw 20-byte digest directly. `smartlist_string_remove` calls are replaced by `digestmap_remove`. Apply to both the `routers` path (line 2179) and the extrainfo path (lines 2216, 2295). **Complexity after fix:** O(R) — one hash lookup per descriptor. For the full 8,000-relay consensus: 8,000 operations instead of 64,000,000. --- ### 17.6 PostgreSQL — Three Patched, Two Deferred PostgreSQL's five confirmed defects share a common blocker at first glance: the query planner uses `equal()` — a structural deep equality function — for expression membership tests, but has no corresponding `nodeHash()`. However, three of the five sites operate on `Var` nodes specifically, which carry `varno`, `varattno`, and `varlevelsup` — three small integers encodable as an O(1) `Bitmapset` key with no `nodeHash()` required. #### Fix applied — Path B (Bitmapset on Var identity) Encoding: `varno * 3200 + varattno + 1600` — safe for `varno ≤ 65001` (INNER_VAR) and `varattno ∈ [-1600, 1600]`. Max value ~208M, fits `int32`. ```c /* O(1) Var identity key — no nodeHash() required */ int key = var->varno * 3200 + var->varattno + 1600; Bitmapset *seen = bms_add_member(seen, key); ``` **preptlist.c:180,206,316 (postgresql-0002) — PATCHED:** `tlist_member((Expr *) var, tlist)` replaced with `tlist_member_match_var()` for Var nodes at all three MERGE/UPDATE/RETURNING sites. Avoids recursive `equal()` tree walk; integer comparison only. Shared Bitmapset across all three loops deferred to follow-on. Unit, integration, and functional tests written (`tests/support/PostgresqlVarDedupAlgorithm.java`, `tests/sql/postgresql-0002-0004.sql`). **equivclass.c:1041 (postgresql-0003) — PATCHED:** `list_member(exprvars, lfirst(lc2))` replaced with a `Bitmapset` built once from `exprvars` before the EC member loop. Drops `find_em_expr_for_rel()` from O(|exprvars| × M × K) to O(|exprvars| + M × K). Non-Var nodes fall back to `list_member(exprvars_nonvar)`. **analyzejoins.c:1914 (postgresql-0004) — PATCHED:** `list_member(toKeep->reltarget->exprs, node)` replaced with a `Bitmapset` built from `toKeep`'s exprs before the merge loop. Drops `remove_self_join_rel()` reltarget merge from O(N × M) to O(N + M). Non-Var exprs fall back to `list_member(keep_nonvar)`. #### Still deferred — Path A (`nodeHash()` required) | Site | Status | Notes | |------|--------|-------| | **postgresql-0001** (`tlist.c:812`) | **DEFERRED** | General expressions; requires `nodeHash()` | | **postgresql-0002** (`preptlist.c:180,206,316`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` | | **postgresql-0003** (`equivclass.c:1041`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` | | **postgresql-0004** (`analyzejoins.c:1914`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` | | **postgresql-0005** (`list.c:1077–1478`) | **DEFERRED** | Structural variants need `nodeHash()` | **postgresql-0001:** `tlist_member` in sort/group labeling operates on general expressions (not Var-only). Requires Path A (`nodeHash()`) — a recursive expression hash function mirroring `equal()` in structure but producing `uint64` instead of `bool`. ~100 node type variants. Meaningful upstream contribution; deferred pending capacity. **postgresql-0005 structural variants:** `list_union`, `list_intersect`, `list_difference` (non-ptr variants) use `equal()` on general expressions. Same blocker as -0001. Ptr variants (`list_union_ptr`, etc.) are fixable via pointer hash but not yet patched. Recommended next step: contribute `nodeHash()` to PostgreSQL core, then patch -0001 and the structural variants of -0005. --- ## 18. Remaining Scan Backlog **Confirmed CLEAN (no action needed):** ONOS, OpenDaylight, MySQL optimizer, Neo4j — all confirmed using O(1) hash containers. V8 TurboFan (v8-0001 PATCHED), SpiderMonkey IonMonkey (sm-0001 PATCHED), Bazel (bazel-0001/0002 PATCHED), GNU Octave (octave-0001 PATCHED), KiCad (kicad-0001 PATCHED), Apache TinkerPop (tinkerpop-0001 PATCHED), Yosys, Verilator — all now scanned and resolved. **PostgreSQL:** -0002, -0003, -0004 patched (Bitmapset, Path B). -0001 and -0005 structural variants still DEFERRED pending `nodeHash()` infrastructure. **MongoDB:** -0001 through -0004 patched. Root cause: `index_tag.h:106-107` `std::vector` → `std::unordered_set` fixes 4 planner_ixselect.cpp sites at once. plan_enumerator.cpp (4 sites), streaming_group.cpp, unpack_bucket.cpp also patched. mongodb-0005 (ce_cache.h IndexBounds) DEFERRED — no structural hash. mongodb-0006 (projection_ast.h removeChild): NOT-WORTH-FIXING — `removeChild` is O(n) regardless due to `vector::erase` shifting; std::find is not the bottleneck. mongodb-0007 (join_graph.cpp InsertPredicate): NOT-WORTH-FIXING — `PredicateList = InlinedVector`, A≈1 at runtime; O(n) scan over 1-2 elements is noise. **Remaining unscanned — priority order:** | System | Language | Why critical | |--------|----------|-------------| | ~~FRRouting bgpd~~ | ~~C~~ | ~~`bgp_aspath.c`~~ — **CLEAN** (`aspath_loop_check()` is O(L) single-call, not nested) | | **FRRouting isisd** | C | `isis_spf.c` IS-IS SPF, carrier backbone | | **ExaBGP** | Python | Pure Python BGP; very high probability | | **OpenSTA** | C++ | Static timing analysis for chip design | | **Blender node graph** | C/Python | Geometry nodes, compositor | | **BIRD bgp** | C | IXP route servers globally | | **OpenBGPD** | C | BSD BGP daemon | | **Buck2** | Rust | Build target graph | | **Pants** | Python | Build target graph | | **NuGet** | C# | .NET dep resolution | | **Hyperledger Besu** | Java | Full Ethereum execution client | | **OpenROAD / OpenSTA / ABC** | C++ | EDA timing analysis and synthesis | --- ## 19. Appendix: Sym² Manifold Workbench — Java/Swing Port The `java-topology` repository ships a Swing-based visualization of the Sym² (symmetric product) manifold — a Java port of the Three.js workbench at `unworkbench.com`. Given m seed points in 2D, the manifold maps each pair (u, v) to a 3D vertex: x/y = midpoint of p_u and p_v, z = distance between p_u and p_v. The seam (diagonal u==v) re-embeds the original curve at z=0. Heat diffusion and five friend agents walk the adjacency graph injecting thermal energy, producing the same dynamics as the browser version. ### 19.1 Jitter Defect — Spin Instability in Swing Renderer When rotating the manifold in 3D (mouse-drag), the wireframe and friend dots exhibited visible jitter. Three independent causes identified and patched. #### Cause 1 — Per-frame allocation storm in `rotateVec` The original renderer called `rotateVec(x, y, z)` returning `new float[3]` for every vertex every frame. At M=32, the manifold has 1024 vertices. At 60 fps: ``` 1024 allocations/frame × 60 frames/sec = 61,440 short-lived float[3] objects/sec ``` Each allocation is minor, but the aggregate drives the JVM garbage collector to fire during frames — causing unpredictable 5–30ms pauses mid-rotation. In Three.js, the equivalent projection runs on a pre-allocated typed array (`Float32Array`) with no GC involvement. Swing has no such primitive; the same effect requires explicit pre-allocation. **Fix:** `rotateVec` replaced with `rotateVecInto(x, y, z, float[] out)` — writes into a caller-supplied `float[3]` pre-allocated as a field on `ViewportPanel`. Zero allocations inside the vertex projection loop. #### Cause 2 — Projection array reallocated every frame The projected screen coordinates (`sx`, `sy`, `sz`) were declared as local `float[]` inside `paintComponent`, reallocating 3× M² floats on every frame. These were promoted to pre-allocated `ViewportPanel` fields, resized only when vertex count changes (i.e., on manifold rebuild, not on every paint call). #### Cause 3 — Friend position read from noise-polluted array The oracle applies a per-vertex per-frame random wobble to `manifold.positions` (x/y offsets drawn from `rng.nextFloat()`). `Friend.syncPosition()` copied its x/y from `manifold.positions`, meaning the friend's on-screen location changed by a random amount every frame regardless of actual graph-walk movement. **Fix:** `syncPosition()` reads x/y from `manifold.originalPositions` (deterministic rest positions), z from `manifold.positions` (includes oracle heat displacement). The friend dot now moves only when the friend walks a graph edge — matching Three.js behavior where the friend mesh position is updated only on `compute()`. #### Cause 4 — `BasicStroke` allocated per frame `new BasicStroke(0.5f)` and `new BasicStroke(1.5f)` were constructed inside `paintComponent` on every frame. Promoted to `final` fields on `ViewportPanel`. ### 19.2 Result After patching, spin rotation is smooth across the full vertex and friend count. GC pause jitter is eliminated. Friend dots track heat topology cleanly during rotation rather than oscillating around their true position. The Swing renderer now matches the visual stability of the Three.js reference implementation at equivalent frame rates. ### 19.3 Lesson Swing's `paintComponent` runs on the EDT. Any allocation inside the hot path competes with GC on the same thread that services mouse events and repaints. Three.js sidesteps this entirely via `Float32Array` — no GC-eligible objects in the render path. Porting to Swing requires making the same guarantee explicitly: pre-allocate all scratch buffers as fields, resize only on structural change, never allocate inside the frame loop. ### 19.4 Browser SEW: Two-Manifold Live Demo and Agent Science The browser workbench (`~/git/cupPCB`) was extended with a split-viewport experiment that runs the MOAD and its patch side by side in the same session. The left manifold runs the unpatched heat model; the right runs the patched model. Both share the same Sym²(X) geometry. Agents (friends) walk both manifolds simultaneously. #### Two-Manifold Heat Model | Parameter | Left (MOAD) | Right (patched) | |-----------|-------------|-----------------| | Injections per frame | 20 × 0.5 | 1 × 0.4 | | Diffusion decay | 0.975 | 0.90 | | Equilibrium heat | ~4.0 | ~0.3 | | z-displacement scale | 120 | 40 | | Wireframe color | red | green | The left manifold reaches ~4.0 mean heat at equilibrium; the right stays near 0.3. The z-displacement (vertex distortion) is proportional to local heat. The left manifold deforms dramatically; the right stays close to the rest shape. This is the defect made geometric: O(n²) heat accumulation vs. O(1) constant throughput. #### Clock Drift Observation The two renderers run in **separate `requestAnimationFrame` loops**: the kernel's loop drives the left renderer and increments the global `tick` counter; `two-manifolds.js` runs its own loop for the right renderer. A HUD overlay shows both frame counters live. In practice, the two loops run within 1–2 frames of each other on a single-core browser tab (they share the same event loop and are both rAF-scheduled). Drift appears when the left manifold's heat diffusion pass (O(n) over all vertices) takes long enough to push past the 16ms frame budget — the kernel loop falls behind the twin loop by 1 frame per heavy frame. This is a direct measurement of the MOAD's compute tax in the renderer. #### Friend Temperature Differential Each agent (friend) has a current vertex index `vIdx`. The HUD reads `heat1[vIdx]` (MOAD) and `heat2[vIdx]` (patched) for every live agent and displays both simultaneously. At equilibrium, MOAD-side temperatures per agent are 10–15× higher than patched-side temperatures at the same vertex. This is the individual-agent view of the defect: an agent traversing the MOAD manifold accumulates heat both because the manifold itself is hotter and because the agent's own `injectGrowth()` call compounds the chaos (+1.0 to `heat[v]` per visit on the MOAD side vs. visit-count-only on the patched side). #### kcjones Agent — Comparative Traversal Science A special agent, kcjones, was deployed on both manifolds simultaneously with identical navigation logic. Its `chooseNext()` scores neighbors by three terms: ``` score = guide(friends) + heatScore(heat[v] × 2.0) + novelty(unvisited ? 3.0 : 0) ``` On the MOAD manifold, heat is high everywhere after ~200 frames. The heat term dominates; kcjones clusters in already-hot zones, reinforcing them, reducing coverage. On the patched manifold, heat is near zero; novelty and friend proximity dominate; kcjones spreads broadly, covering new vertices each step. The `kcjones.locker` command reports the divergence live: - `visited` set size: patched side accumulates unique vertices faster - `heatLedger`: MOAD side shows top nodes visited hundreds of times (clustering) - `heatLedger2`: patched side shows flat visit distribution (broad coverage) - `discoveries`: events where kcjones first reached a vertex above heat threshold 2.5 — on the MOAD side these are rare (high threshold, clustered), on the patched side they don't fire at all (heat never reaches 2.5) The science summary: **the MOAD makes agents cluster where heat already exists, creating a positive feedback loop. The patch breaks the feedback: agents explore freely, heat dissipates, the manifold stays navigable.** #### PCB Language — KNOT Container The PCB NON LINEAR LANGUAGE was extended with a `KNOT`/`TONK` container backed by `Set` instead of `Array`. All `contains`/`sniatnoc` operations are O(1) `Set.has()` instead of O(n) `Array.includes()`. This fixes the MOAD at the language level: any PCB program using a visited-set should use `KNOT`, not `POCKET`. The container fix is a one-line substitution — the same one-line substitution documented across every ecosystem in this paper. --- ## 20. MOADS: The Universal Bottleneck Across the Complete Manifold ### 20.1 The Mother of All Defects CWE-407 is not merely a defect that appears in many places. It is the **Mother of All Defects** (MOADS) — the **Mother of All Bugs** (MOABS) — the single structural error that repeats across every programming language, every paradigm, every decade. Not a class of defects. One defect. One root cause. One fix. A list where a set belongs, inside a loop that visits nodes. That sentence describes every confirmed site — in Java, TypeScript, Python, Haskell, Erlang, C, C++, JavaScript, Scala, Rust, PHP, Solidity, and every other language in the corpus. The surface syntax differs. The paradigm differs. The surrounding architecture differs. The structural error is identical. This makes CWE-407 categorically different from other vulnerability classes. SQL injection requires specific conditions (string interpolation into queries). Buffer overflow requires specific conditions (C/C++, unchecked bounds). MOADS requires only two things: a collection used for membership testing, and a loop that iterates nodes. These two things are present in every non-trivial program ever written. The defect is not an accident of a particular language design; it is the default behavior of every standard library's sequential container before hash-based alternatives were idiomatic. The defect is sedimentary — it was deposited in an era when `List.contains()` was the natural choice, and has been carried forward in every downstream copy, every fork, every derivative runtime. It did not spread through contagion. It spread through the most natural process in software: copying working code. ### 20.2 The Universal Manifold Every programming language ever invented forms a finite set. Call it the **universal manifold** — the complete topological space of computational expression languages, past, present, and future. The manifold is large but not infinite. There are roughly 8,000–9,000 named programming languages in recorded history. Of these, perhaps 200 are in active production use. Perhaps 50 will survive the next computational era. The question is not whether CWE-407 is present in a given language. It is: **will the language community find and fix it before the next era begins?** The defect exists across the manifold because list-before-set is the default in every standard library ever designed. The fix exists across the manifold because every standard library eventually added O(1) membership containers. The missing piece — across 91 confirmed sites and an unknown number of unconfirmed ones — is not capability. It is awareness and linkage. This whitepaper is that linkage. The 91 confirmed patches represent a sampling across the manifold. The methodology — scan for `O(n)` membership tests inside graph traversal loops, measure the ratio, apply the one-line fix, validate by instrumentation — is language-agnostic and tool-agnostic. The same scan that found kafka-0001 will find the equivalent defect in any language's message broker, any language's dependency resolver, any language's type inference engine. ### 20.3 Iterative Bottleneck Elimination Fixing MOADS does not end the work — it exposes the next bottleneck. The methodology is iterative: 1. **Baseline:** Benchmark every affected system with the defect present. Measure total wall-clock time for the hot path (compilation, dependency resolution, type-check, rebalance, route computation, HMR propagation). 2. **Patch:** Apply the one-line fix. Re-benchmark. 3. **Profile:** With MOADS removed, the next slowest path is now visible. It may be a different defect class — a quadratic sort, an unnecessary serialization, a cache miss pattern, or a lock contention hotspot. 4. **Repeat:** Find the new bottleneck. Fix it. Measure again. The bottleneck is always stack-specific. In the compiler stack, after MOADS is fixed in the SCC algorithm, the next bottleneck may be in type inference or constant folding. In the database stack, after MOADS is fixed in the query planner, the next bottleneck may be in index selection or join ordering. Each stack reveals its own sequence of bottlenecks once the universal first one is removed. This is the scientific meaning of "no language left behind." Every language on the manifold that patches MOADS gains access to the next-level optimization conversation. Every language that does not is still running at O(n²) on the universal first problem — burning cycles on the entry-level defect before it can even see what comes next. The benchmarks in this paper are not the end state. They are the baseline for the next wave. At the scale where MOADS becomes visible — P=100 partitions, V=800 nodes, D=24 dependency chains, T=8 topics — the speedups are 23× to 300×. Those cycles are now available for the workload, not the traversal overhead. ### 20.4 Compute Abundance — From Tamagotchi to 100 Watts The long-horizon goal of this work is not academic credit. It is **compute abundance** — a world where every person has meaningful access to computation, not as a service rented from a provider, but as infrastructure they own and grow. The trajectory: - **At birth:** A tamagotchi amount of compute — milliwatts, persistent, owned. A seed. - **At 28:** 100 watts of compute across the most diverse and esoteric silicon available — a mesh. Not a single device. A distributed personal compute fabric woven across dedicated hardware, edge nodes, community infrastructure, and whatever substrate the next generation of silicon enables. This is not a projection about data centers or cloud providers. It is a projection about the personal compute stack — the computation that a person owns, controls, and directs, without permission from a platform. CWE-407 stands directly in the path of this vision. Every defective runtime burns quadratic cycles on linear work. A tamagotchi running a defective dependency resolver burns more energy on every install than the task requires. A personal mesh node running a defective routing daemon computes SPF at O(n²) when O(n) is the correct cost. At milliwatt scale, the difference between O(n) and O(n²) is the difference between a device that runs and a device that drains. Patching MOADS is not optional infrastructure work. It is a prerequisite for the compute abundance era. ### 20.5 The Infrastructure Layer — ML Agent Self-Provisioning A mesh of personal compute nodes running correct code still requires an infrastructure layer: something that can provision, configure, verify, patch, and maintain those nodes autonomously, at scale, without central authority. Russell Ballestrini's *Machine Learning Agent Self-Sandbox Algorithm* (January 2026, Public Domain) describes exactly this layer. The paper specifies a 14-flow lifecycle in which a machine learning agent: 1. **Discovers** available compute infrastructure (DNS, API endpoints) 2. **Self-pays** for that infrastructure using cryptocurrency (BTC, LTC, DOGE, XMR) — no human credit card, no platform account required 3. **Authenticates** its own identity via HMAC-SHA256 challenge-response 4. **Orchestrates** a full development environment (84 API endpoints, 59 tools, 42+ language runtimes) 5. **Recursively spawns** child sandboxes — each paying for its own compute, each isolated in its own LXC container, depth bounded only by budget Each sandbox costs approximately $7/month. At depth 8, the cost is $56/month — stopped not by permission but by arithmetic. The walls that matter most are financial, not administrative. The paper covers 2,324 assertions across 5 agent frameworks (LangChain, AutoGPT, CrewAI, Swarm, raw API). It describes production deployment: a Claude Opus 4.6 oracle running daily in an unsandbox container, spawning shadow clones for parallel workstreams, dispatching specialized tasks to smaller models (Hermes 8B), and validating all results out-of-band via `uncloseai-cli` — an open-source ReAct agent harness independent of any commercial platform. The connection to MOADS and the compute abundance vision is direct: - The self-sandbox algorithm runs on the same infrastructure that personal mesh nodes would run. Defective O(n²) runtimes increase the cost of every operation. Patching MOADS makes the $7/month sandbox burn fewer cycles on traversal overhead and more on actual work. - The recursive inception model — agents provisioning child agents, bounded by budget — is the architectural template for distributed personal compute: each node provisions its own environment, pays its own costs, contributes to the mesh without requiring a central registry. - The public domain license of the self-sandbox algorithm matches the public domain license of every patch in this paper. Neither requires permission to use, fork, deploy, or improve. Both papers were written in the same month. Both target the same infrastructure gap. Both are public domain, by design, because the infrastructure for compute abundance must be freely available to be infrastructure at all. *See: Russell Ballestrini, "Machine Learning Agent Self-Sandbox Algorithm: How Machine Learning Agents Grow Their Own Infrastructure & Why Walls Matter Most," January 2026. Public Domain — no copyright claimed. Available at `~/git/timehexon.com/`.* ### 20.6 The Horizon The universal manifold is finite. The defect is universal. The fix is a one-line change in every language's standard library. The question every language community will answer, on its own timeline, is whether it crosses this particular finish line before the compute abundance era begins — or still burning quadratic cycles on linear work when the era arrives. The 91 patches in this paper represent the languages that crossed first. The methodology, the benchmarks, and the outreach briefs represent an open invitation for every other language on the manifold to follow. No language left behind — not as aspiration, but as a finite, completable project. The manifold is enumerable. The fix is known. The work is bounded. --- ## One-Sentence Version A list used where a set belongs, in graph traversal code written before hash containers were idiomatic, has been running silently at O(n²) in confirmed sites across foundational tools — compilers, package managers, database query planners, crypto toolchains, routing daemons, event streaming platforms, web frameworks, query optimizers, browser runtimes, and ORM layers — the fix is a one-line data structure substitution with no behavioral change, and we have patched, tested, and benchmarked every confirmed site across 64 ecosystems.