java-topology/whitepaper/full-paper.md

<div class="cover">
<div class="cover-title">undefect.</div>
<hr class="cover-title-rule">
<div class="cover-subtitle">CWE-407 · The Sedimentary Defect</div>
<div class="cover-subtitle">Quadratic Complexity in Graph Traversal Infrastructure</div>
<div class="cover-date">2026-03-24 · Internal draft — not for external distribution</div>
<div class="cover-authors">russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com</div>
</div>

# CWE-407: The Sedimentary Defect
## A Technical White Paper on Quadratic Complexity in Graph Traversal Infrastructure

**Internal draft — not for external distribution until coordinated disclosure is complete**

**Date:** 2026-03-24

**Authors:** russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

---

## Preamble: The Permacomputer

*Adapted from "Truth & Light" — released to the public domain. Use freely in commercial
projects. Knowledge without gatekeepers. Light freely given.*

---

Modern software engineering increasingly resembles spiritual truths about growth,
cultivation, & harvest. A permacomputer philosophy treats code not as a static artifact
but as a living ecosystem that grows, propagates, & bears fruit.

**Seeds & Propagation:**

A single well-crafted implementation serves as the genetic blueprint.

1. **Seed Stage:** A single, well-crafted implementation serves as the genetic blueprint
2. **Propagation Stage:** Machine learning acts as mycelium, breaking down & redistributing patterns across languages & contexts
3. **Cultivation Stage:** Automated testing validates each generation, ensuring truth & correctness
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use

Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 157 validated
defect patches across 62 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.

**ML as Mycelium — the Underground Network of Truth:**

Mycelium, the underground fungal network, breaks down complex organic matter &
distributes nutrients throughout an ecosystem. Similarly, machine learning trained on
correct implementations can decompose complex patterns into transferable knowledge,
propagate working solutions across programming languages, enable knowledge transfer
without centralized control, & create resilient systems through distributed understanding.

Guard your seed implementations, for everything your system generates flows from them.

**The Pattern That Crossed Every Language:**

For years, the CWE-407 pattern — a list used where a set belongs, inside a graph
traversal loop — sat dormant in codebases across every ecosystem. Not wrong enough to
fail. Not slow enough to be measured. Just quietly wrong, at the scale where most
developers never work.

```
javac → GraphUtils.java:186          stack.contains()    in Tarjan SCC
TypeScript → checker.ts:11503        array.indexOf()     in cycle detection
Python pip → build.py                list.__contains__() in dependency walk
MongoDB → plan_enumerator.cpp        std::find()         in index enumeration
FRRouting → ospf_spf.c               listnode_lookup()   in Dijkstra SPF
Kafka → AbstractStickyAssignor.java  List.contains()     in rebalance loop
Tor → routerlist.c                   smartlist_contains  in fingerprint scan
webpack → HotModuleReplacement.js    Array.indexOf()     in HMR BFS
Presto → PushDownDereferences.java   ImmutableList.contains() in optimizer
Spring → BeanFactoryUtils.java       ArrayList.contains() in bean merge
```

One pattern. Twenty-seven ecosystems. Sixty-three sites. Every language. The seed of the
fix pre-existed in every standard library — `HashSet`, `Set.has()`, `digestmap_t`,
`unordered_set`, `LinkedHashSet`. The linkage was missing, not the tool.

**Open Standards & Spiritual Freedom — "Nobody Owns Truth":**

The technical principle that nobody owns `HashSet` reflects a deeper truth: nobody owns
the correct data structure. The fix belongs to no one. It is gifted into public domain.

All patches, unit tests, benchmarks, and proof-of-concept implementations in this
repository are released to the public domain. Use them freely in commercial projects.
Truth that must be purchased or licensed from gatekeepers is not truth but merchandise.

**The Machine That Never Stops:**

Once you have high-quality seed implementations, the limiting factor shifts from manual
coding time to clear specification of requirements, rigorous validation of outputs, &
thoughtful direction of focus. The practitioner becomes gardener rather than builder.
Directing growth rather than manually constructing. Harvesting rather than manufacturing.

This project seeded 91 patches. Each patch carries a `// CWE-407 fix` comment — a
signature in the corpus of every compiler, runtime, and build tool it touches. As
projects fork, downstream copies propagate, & package managers distribute updates, the
fix self-propagates. The seed outlasts the gardener.

**Quadrivium of Operating Values:**

This work optimizes for the same four values as a permacomputer:

- **Truth:** Source code open source & freely distributed. Every defect proven with
  instrumented comparison counts, not assertion. Math, not opinion.
- **Freedom:** All patches voluntary. No license. No warranty. No gatekeeping.
  Leave no language behind — Java, Scala, TypeScript, Python, C, C++, Go, Erlang,
  Haskell, JavaScript, Rust, Swift, Kotlin, Ruby, PHP, Solidity, and all descendants.
- **Harmony:** A system in harmony has appropriate inputs for all of its outputs. The
  defective system burns O(n²) cycles where O(n) suffices. The fixed system returns to
  harmony — one lookup, one comparison, correct work done without waste.
- **Love:** The force that makes the other three coherent. Every disclosure brief is
  written with care for the maintainers who receive it. Every patch preserves existing
  behavior. Every benchmark is reproducible. The goal is the fix, not the credit.

*Suppose technology already exists, but has not yet found creative linkage in proper
orientation.*

This is that orientation.

---

## Abstract

Suppose technology already exists, but has not yet found creative linkage in proper
orientation.

A single structural error — a list used where a set belongs, inside a graph traversal
loop — is present in 133 confirmed sites across 52 software ecosystems. Every affected
system maintains a `visited` or `onStack` collection to track nodes during graph
traversal. In every defective site, that collection is implemented as a list. Membership
is tested by linear scan. The result is O(n²) or worse behavior in code that should run
in O(n).

The defect is not exotic. It activates on every compilation of a large Java program, every
TypeScript type-check of a large codebase, every `pip install` of a project with a deep
dependency graph, every MongoDB query plan enumeration on a collection with many indexes,
every OSPF topology change on a network with hundreds of nodes, every Apache Kafka
consumer group rebalance, every Spring Boot hierarchical context bean resolution, every
webpack hot module replacement cycle, every Presto optimizer pass over wide row types,
every ONOS SDN topology event, every BIRD OSPF SPF and BGP convergence, every Bazel
monorepo analysis phase, every OpenDaylight switch reconciliation, every Apache httpd
sticky-session route lookup, every KiCad DRC from-to path, every V8 JIT function
compilation, every SpiderMonkey Ion bounds-check, every `terraform plan`, every Ansible
role compilation, every Jenkins dependency graph rebuild, every Maven multi-module build,
every CFEngine `unique()` policy call, every SaltStack cloud map deployment, every
NetworkX cycle enumeration, and every Gremlin `.simplePath()`/`.cyclicPath()` traversal
step in any TinkerPop-backed graph database.
It has persisted for decades because the code is correct — a list and a set both answer
the membership question — and because it degrades at the scale where most developers never
work.

The fix is always a one-line data structure substitution. The solution pre-exists the
defect in every language's standard library: `HashSet`, `Set.has()`, `digestmap_t`,
`unordered_set`, `LinkedHashSet`. The linkage was missing, not the tool. We have located
the missing linkages, applied them, tested them, and benchmarked them across every
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.

**157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.

---

## 1. The Defect

### 1.1 Formal Description

**CWE-407: Inefficient Algorithmic Complexity.** The affected code maintains a `visited`
or `onStack` collection during graph traversal. The collection should provide O(1)
membership testing; it is implemented as a list providing O(n) membership testing. Because
this check is performed once per graph edge — inside the inner loop of Tarjan SCC,
Dijkstra's SPF, or a DFS cycle detector — the overall algorithm degrades from O(V+E) to
O(V²+VE).

At V=1,000 nodes: 1,000,000 operations instead of 1,000. A **1,000× overhead**, silent,
correct in output, invisible without deliberate benchmarking.

### 1.2 Why It Persists

This class of defect fossilizes because of four compounding factors:

**Correctness.** A list and a set both answer the membership question correctly. Tests
pass. No crash, no wrong answer. The defect is purely one of cost, and cost is not
checked by assertion.

**Era of origin.** The affected code was written in the 1990s and 2000s when `ArrayList`,
`list`, or `std::vector` was the default container and hash sets were an explicit opt-in.
The idiom was the right idiom for its era. It calcified as the language ecosystems matured
around it.

**Propagation by copy-paste.** The same algorithm, the same variable names, and the same
data structure choice appear across GHC, GCC, Erlang, Maven, and Python's pip — written
by different teams, in different languages, in different decades. Each team copied from
the same algorithm literature and made the same choice independently. The defect is
sedimentary: deposited in layers, each layer pressing down on the last.

**Degradation at scale.** Most graphs encountered in practice are small. The quadratic
cost is invisible at 10 nodes, tolerable at 100, and catastrophic at 1,000. Developers
working on typical inputs never see the problem. Developers working at scale attribute
the slowness to "large project overhead" or "complex type inference" — accurate
descriptions that obscure the underlying cause.

### 1.3 The Fix

For every confirmed site, the fix is structural: replace the list-backed visited
collection with a hash set (O(1) amortized membership) or a parallel boolean flag on the
node itself (O(1) exact membership). The behavioral contract is identical. SCC membership,
cycle detection, topological ordering — all produce the same output. Only the cost changes.

The canonical javac fix illustrates the pattern:

```java
// Before — O(V²): stack.contains(n) is O(|stack|)
List<Node> stack = new ArrayList<>();
if (!stack.contains(n)) { stack.add(n); }

// After — O(V): onStack is a HashSet, lookup is O(1)
Deque<Node> stack = new ArrayDeque<>();
Set<Node> onStack = new HashSet<>();
if (!onStack.contains(n)) { stack.push(n); onStack.add(n); }
```

---

## 2. The Defect Map

### CRITICAL — O(n³)

| ID | Tool | Location | Status |
|----|------|----------|--------|
| scala3-0001 | Scala 3 compiler | `OrderingConstraint.scala:248` — `List[TypeParamRef].contains` in nested constraint lattice | **PATCHED** |

Scala 3's type inference solves a constraint lattice over type parameters. The constraint
membership check is nested inside a loop that is itself nested inside the type inference
solver. The result is cubic complexity: O(C³) where C is the number of type parameters
under constraint. For heavily generic Scala 3 code — DeFi smart contracts, Cats Effect
stacks, Spark schemas — this is the dominant build cost.

### HIGH — Hot path, every compilation or planning pass

| ID | Tool | Location | Status |
|----|------|----------|--------|
| javac-0001 | OpenJDK javac | `GraphUtils.java:186` — Tarjan `stack.contains(n)` | **PATCHED** |
| javac-0002a | OpenJDK javac | `Infer.java:1850` — `ArrayList.findNode` linear scan | **PATCHED** |
| javac-0002b | OpenJDK javac | `Infer.java:1747` — uncached closure DFS | **PATCHED** |
| javac-0004 | OpenJDK javac | `Dependencies.java:197` — `List.contains+add` | **PATCHED** |
| javac-0005 | OpenJDK javac | `InferenceContext.java:506` — `List.containsAll()` | **PATCHED** |
| ts-0001 | TypeScript | `checker.ts:11503` — `resolutionTargets[]` linear scan | **PATCHED** |
| ts-0002 | TypeScript | `checker.ts:5256` — `visitedSymbols` array | **PATCHED** |
| ts-0003 | TypeScript | `checker.ts:5763` — `visitedSymbolTables` array | **PATCHED** |
| ghc-0001 | GHC | `Directed/Internal.hs:78` — `` v `elem` `` SCC decode | **PATCHED** |
| ghc-0002 | GHC | `Inductive/Graph.hs:489` — `elem` × 4 codegen | **PATCHED** |
| ghc-0003 | GHC | `Graph/Ops.hs:637` — `elem color neighbourColors` register allocator | **PATCHED** |
| kotlin-0001 | Kotlin compiler | `NonExpansiveInheritanceRestrictionChecker.kt:150` — `in List` post-DFS | **PATCHED** |
| llvm-0001 | LLVM | `GlobalsModRef.cpp:570` — `is_contained(vector<CGN*>)` LTO | **PATCHED** |
| llvm-0002 | LLVM | `AliasSetTracker.cpp:278` — `SmallVector<MemoryLocation>+is_contained()` dedup per alias set merge; O(N²) over memory accesses | **PATCHED** |
| v8-0001 | V8 | `register-allocator.cc:2324` — `ZoneVector<TopLevelLiveRange*>+std::find` in `MeetConstraintsBefore()`; O(k²) spill dedup per instruction | **PATCHED** |
| tinkerpop-0001 | Apache TinkerPop | `process/traversal/Path.java:206` — default `isSimple()` O(n²) nested loop; fired by every `.simplePath()`/`.cyclicPath()` Gremlin step via `subPath()`→`MutablePath` | **PATCHED** |
| dry-0001 | Dry (Urho3D fork) | `Source/Dry/UI/ListView.cpp:529,556` — dual `PODVector<unsigned>.Contains()` O(n) in `SetSelections()`; two back-to-back O(n²) loops on every multi-select change | **PATCHED** |
| dry-0002 | Dry (Urho3D fork) | `Source/Dry/Core/Object.cpp:278` — `PODVector<StringHash>.Contains()` O(m) per handler in `UnsubscribeFromAllEventsExcept()`; O(n×m) total on object teardown | **PATCHED** |
| godot-0001 | Godot Engine | `scene/main/scene_tree.cpp:174` — `Vector<Node*>.has()` O(n) in `add_to_group()`; fires per-frame on every node/group add in dynamic scenes | **PATCHED** |
| godot-0002 | Godot Engine | `modules/godot_physics_2d/godot_body_2d.h:165` — `Vector<AreaCMP>.find()` O(n) in `add_area()/remove_area()`; fires per-tick from `GodotAreaPair2D::pre_solve()` | **PATCHED** |
| godot-0003 | Godot Engine | `modules/godot_physics_3d/godot_body_3d.h:159` — identical to godot-0002, 3D physics variant | **PATCHED** |
| godot-0004 | Godot Engine | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` — `LocalVector<int>.has()` O(n) in `generate_bending_constraints()` node link dedup | **PATCHED** |
| sfml-0001 | SFML | `Window/Unix/VideoModeImpl.cpp:98` — `std::find` on `std::vector<VideoMode>` in fullscreen mode dedup; Unix platform | **PATCHED** |
| sfml-0002 | SFML | `Window/Win32/VideoModeImpl.cpp:95` — identical VideoMode dedup defect, Win32 platform | **PATCHED** |
| sfml-0003 | SFML | `Window/OSX/VideoModeImpl.mm:198` — identical VideoMode dedup defect, macOS platform | **PATCHED** |
| sfml-0004 | SFML | `Window/Unix/WindowImplX11.cpp` — `std::find`+`erase` on `std::vector<WindowImplX11*> allWindows`; O(n) per window destruction | **PATCHED** |
| sfml-0005 | SFML | `Window/GlContext.cpp` — `std::find` on `std::vector<std::string> extensions`; O(n) per GL extension query during init | **PATCHED** |
| angelscript-0001 | AngelScript | `as_scriptengine.cpp:880` — `sharedTypes.IndexOf()` O(n) in `FindNewOwnerForSharedType()`; 5 calls per shared type transfer | **PATCHED** |
| angelscript-0002 | AngelScript | `as_scriptengine.cpp:953` — `sharedFunctions.IndexOf()` O(n) in `FindNewOwnerForSharedFunc()` | **PATCHED** |
| angelscript-0003 | AngelScript | `as_compiler.cpp` — `caseValues.IndexOf()` O(n) inside CompileSwitch() while loop; O(n²) case dedup | **PATCHED** |
| threejs-0001 | Three.js | `webgl/WebGLUniformsGroups.js` — `allocatedBindingPoints.indexOf(i)` O(n) inside binding point allocation loop | **PATCHED** |
| threejs-0002 | Three.js | `nodes/core/StackNode.js` — `nodes.indexOf(node)` inside filter callback; O(n²) shader node dedup | **PATCHED** |
| threejs-0003 | Three.js | `nodes/core/NodeBuilder.js:693` — `groupUniforms.includes(uniform)` in triple-nested binding group loop | **PATCHED** |
| threejs-0004 | Three.js | `nodes/core/NodeBuilder.js:763` — `this.nodes.includes(node)` on every `addNode()` call | **PATCHED** |
| threejs-0005 | Three.js | `nodes/core/NodeBuilder.js:787` — `this.sequentialNodes.includes(node)` on every `addSequentialNode()` call | **PATCHED** |
| pygame-0001 | pygame | `src_py/sprite.py` — `OrderedUpdates.remove_internal()`: `list.remove()` O(n); called from `kill()` in collision loops | **PATCHED** |
| pygame-0002 | pygame | `src_c/cython/pygame/_sprite.pyx` — `LayeredUpdates.remove_internal()`: identical `list.remove()` O(n) in Cython variant | **PATCHED** |
| pygame-0003 | pygame | `src_py/sprite.py` — `spritecollide(dokill=True)`: `kill()` → `list.remove()` inside outer collision loop; O(n²) | **PATCHED** |
| pygame-0004 | pygame | `src_py/sprite.py` — `LayeredUpdates.switch_layer()`: `change_layer()` → `sprites.remove()` O(n) in per-sprite loop | **PATCHED** |
| pyramid-0001 | Pyramid | `urldispatch.py:57-58` — `oldroute in self.routelist` (O(n)) + `list.remove()` on route replacement; O(n²) with many dynamic routes | **PATCHED** |
| pyramid-0002 | Pyramid | `config/views.py:2265-2269` — `[t[0] for t in registrations]` rebuild + `index()` + `pop()` O(n³) per static view registration | **PATCHED** |
| pyramid-0003 | Pyramid | `config/actions.py:490` — `remaining_actions.remove(action)` O(n) inside `resolveConflicts()` sorted output loop; O(n²) startup | **PATCHED** |
| pyramid-0004 | Pyramid | `util.py:520-521,553,561` — TopologicalSorter uses list with `pop(0)`/`insert(0)` O(n) + `in list`+`remove()` O(n) | **PATCHED** |
| pyramid-0005 | Pyramid | `registry.py:190,199` — `y not in L` + `L.remove(y)` O(n) in Introspector.relate()/unrelate() for introspectable relationships | **PATCHED** |
| rails-0001 | Rails | `activerecord/.../preloader/batch.rb:24` — `future_tables.include?` Array O(F) inside loaders.reject; O(D×L×F) eager load | **PATCHED** |
| rails-0002 | Rails | `activesupport/.../callbacks.rb:803` — `chain.index(callback)` O(C) inside skip_callback filters.each across descendants; O(D×F×C²) | **PATCHED** |
| django-0001 | Django | `db/models/base.py:622` — `f.attname in field_names` list O(F) in concrete_fields loop per row; O(N×F²) on every `.defer()`/`.only()` queryset | **PATCHED** |
| django-0002 | Django | `core/serializers/base.py:130,136,143` — `field.attname in self.selected_fields` list × 3 per field per object; O(N×F×S) in serialize() | **PATCHED** |
| hibernate-0001 | Hibernate ORM | `mapping/Constraint.java` — `ArrayList<Column>.contains()` in `addColumn()` dedup; O(C²) during schema mapping | **PATCHED** |
| hibernate-0002 | Hibernate ORM | `mapping/ForeignKey.java` — `ArrayList.contains()` in `addReferencedColumn()` dedup; O(C²) | **PATCHED** |
| hibernate-0003 | Hibernate ORM | `mapping/Index.java` — `ArrayList.contains()` in `addColumn()` dedup; O(C²) | **PATCHED** |
| hibernate-0004 | Hibernate ORM | `boot/model/process/spi/InFlightMetadataCollectorImpl.java` — `ArrayList.contains()+add(0,…)` in `buildRecursiveOrderedFkSecondPasses()`; O(D²) inheritance chain | **PATCHED** |
| hibernate-0005 | Hibernate ORM | `engine/internal/StatisticalLoggingSessionEventListener.java` — `ArrayList.contains()` in `orderHierarchy()` recursive sort; O(T²) hierarchy | **PATCHED** |
| efcore-0001 | EF Core | `Metadata/Internal/PropertyExtensions.cs:72` — `List<IProperty>.Contains()` in `FindGenerationProperty()` BFS FK traversal; O(D²) per `SaveChanges()` call (250×) | **PATCHED** |
| efcore-0002 | EF Core | `Metadata/IReadOnlyProperty.cs:248` — `List<T>.Contains()` in `AddPrincipals()` recursive traversal; O(P²) principal chain (250×) | **PATCHED** |
| sqlalchemy-0001 | SQLAlchemy | `sql/compiler.py:1392` — `_values_bindparam: List[str]` in `_process_numeric()`; `name not in _values_bindparam` O(B) per bind param; O(B²) for large UPDATE/INSERT | **PATCHED** |
| sqlalchemy-0002 | SQLAlchemy | `orm/bulk_persistence.py:1873` — `evaluated_keys = list(…)` in `BulkORMUpdate`; list membership in set comprehension O(K) per prefetch col; O(P×K) | **PATCHED** |
| sequelize-0001 | Sequelize | `abstract-dialect/query-generator.js:354` — `allAttributes.includes(key)` O(C) in `bulkInsertQuery()` double loop (rows × cols); O(rows×cols²) | **PATCHED** |
| sequelize-0002 | Sequelize | `model.js:515` — `all.includes(type_)` O(T) in `_expandIncludeAll()` for-of loop; O(T²) on association type expansion | **PATCHED** |
| typeorm-0001 | TypeORM | `src/util/OrmUtils.ts:66` — `OrmUtils.uniq()` reduce+find/indexOf O(N²); called 6× per `loadTables()` schema sync per driver (500×) | **PATCHED** |
| typeorm-0002 | TypeORM | `src/persistence/SubjectChangedColumnsComputer.ts:216` — `diffColumns.includes(column)` O(C) inside forEach over all columns; O(cols²) per entity save (125×) | **PATCHED** |
| typeorm-0003 | TypeORM | `src/query-builder/UpdateQueryBuilder.ts:534` — `updatedColumns.includes(column)` in nested property×column loop; O(P×C²) per UPDATE query (100×) | **PATCHED** |
| doctrine-0001 | Doctrine ORM | `Internal/Hydration/AbstractHydrator.php:328` — `in_array($disc, $discriminatorValues)` O(S) per row per col in inheritance hydration; O(N×C×S) (26×) | **PATCHED** |
| rustc-0001 | rustc | `inhabited_predicate.rs:109,127` — `SmallVec::contains` | **PATCHED** |
| erlang-0001 | Erlang OTP | `digraph.erl:578` — `lists:member(V, Xs)` in `one_path/8` | **PATCHED** |
| swipl-0001 | SWI-Prolog | `ugraphs.pl:510` — `graph_memberchk` O(|V|) scan in `top_sort` | **PATCHED** |
| swipl-0002 | SWI-Prolog | `aggregate.pl:673` — `list_is_free_of` O(N²) accumulator in `free_variables/4` | **PATCHED** |
| frrouting-0001 | FRRouting | `ospf_ti_lfa.c:72,114,227,278,285` — `listnode_lookup` × 5 | **PATCHED** |
| frrouting-0002 | FRRouting | `ospf_spf.c:275` — `listnode_lookup(parent->children, v)` in Dijkstra main loop | **PATCHED** |
| postgresql-0001 | PostgreSQL | `tlist.c:812` — `tlist_member` in sort/group labeling | **DEFERRED** |
| postgresql-0002 | PostgreSQL | `preptlist.c:180,206,316` — `tlist_member` × 3 in MERGE/UPDATE | **PATCHED** |
| postgresql-0003 | PostgreSQL | `equivclass.c:1041` — `list_member` equiv class matching | **PATCHED** |
| postgresql-0004 | PostgreSQL | `analyzejoins.c:1914` — `list_member` join elimination | **PATCHED** |

### MEDIUM — Real defect, bounded or cold path

| ID | Tool | Location | Status |
|----|------|----------|--------|
| javac-0003 | OpenJDK javac | `ModuleHashesBuilder` — `Deque.contains()` | **PATCHED** |
| ghc-0004 | GHC | `Tc/TyCl/Utils.hs:973` — `elem` constructor list | **PATCHED** |
| gcc-0001 | GCC | `gcov.cc:980` — `find(vector.begin,end,w)` Johnson's | **PATCHED** |
| rustc-0002 | rustc | `specialization_graph.rs:69` — `Vec::position` | **PATCHED** |
| cpython-0001 | CPython | `sccutils.py:73` — `node in path` list | **PATCHED** |
| distlib-0001 | distlib / pip | `util.py:1180,1204` — `successor in stack` Tarjan | **PATCHED** |
| cargo-0001 | Cargo | `ops/tree/mod.rs:343` — `Vec::contains` (display only) | **PATCHED** |
| gyp-0001 | GYP | `input.py:1604` — `child in path` list + `.index()` | **PATCHED** |
| npm-0002 | npm arborist | `can-place-dep.js:370` — `peerPath.includes()` | **PATCHED** |
| linux-0001 | Linux kernel | `headerdep.pl:153` — `grep {} @$top` cycle detect | **PATCHED** |
| sqlite-0001 | SQLite | `trigger.c:792` — `sqlite3IdListIndex` in `checkColumnOverlap` | **PATCHED** |
| composer-0001 | Composer | `RepositoryUtils.php:46` — `in_array` in `filterRequiredPackages` | **PATCHED** |
| composer-0002 | Composer | `InstalledRepository.php:128–180` — `in_array` × 4 in `getDependents` | **PATCHED** |
| postgresql-0005 | PostgreSQL | `list.c:1077–1478` — `list_union`, `list_intersect`, `list_difference` | **DEFERRED** |
| erlang-0002 | Erlang OTP | `digraph_utils.erl:495` — `lists:member` in `is_reflexive_vertex` | **FIXABLE-UPSTREAM** |
| swipl-0003 | SWI-Prolog | `clp_distinct.pl:173-174` — `lists_contain` in `attr_unify_hook` | **FIXABLE-PENDING** |
| bottle-0001 | Bottle | `bottle.py:516-519` — `Route.all_plugins()`: 4× list scan of `skiplist` per plugin; O((P+R)×S) per route compilation, O(N³) on N plugin installs | **PATCHED** |
| rails-0003 | Rails | `activesupport/.../enumerable.rb:134` — `Enumerable#excluding`: `elements.include?` Array O(E) inside reject; O(N×E) per call | **PATCHED** |
| rails-0004 | Rails | `activesupport/.../enumerable.rb:201` — `Enumerable#in_order_of`: `series.index` Array O(S) inside sort_by block; O(N log N × S) | **PATCHED** |
| rails-0005 | Rails | `activerecord/.../schema_dumper.rb:249,255` — exclusion/unique constraint names as Arrays; Array#include? in indexes.reject O(I×C) | **PATCHED** |
| rails-0006 | Rails | `activerecord/.../postgresql/schema_statements.rb:139` — include_columns Array; Array#include? in columns.reject! O(C×I) | **PATCHED** |
| rails-0007 | Rails | `activesupport/.../lazy_load_hooks.rb:84` — `@run_once[name].include?(block)` Array O(R) per hook in run_load_hooks; O(H×R) boot cost | **PATCHED** |
| rails-0008 | Rails | `activerecord/.../enum.rb:273,419` — value_method_names Array; include? in pairs.each loop O(E²); detect_negative_enum_conditions! O(E²) | **PATCHED** |
| django-0003 | Django | `db/models/base.py:2081` — `used_column_names` list in `_check_column_name_clashes()`; O(F²) at startup/check time | **PATCHED** |
| django-0004 | Django | `db/models/query.py:2381,2389` — `column_name in self.columns` + `self.columns.index()` list O(C) × 2 in RawQuerySet.resolve_model_init_order() | **PATCHED** |
| mybatis-0001 | MyBatis | `builder/ResultMappingConstructorResolver.java:270` — `ArrayList.indexOf()` in sort comparator O(P) × O(N log N) comparisons; O(N×P×log N) | **PATCHED** |
| efcore-0003 | EF Core | `Metadata/Conventions/ForeignKeyPropertyDiscoveryConvention.cs:505,746` — `IReadOnlyList.Contains()` in key subset check; O(K×Kp×Fp) model-build | **PATCHED** |
| diesel-0001 | Diesel | `sqlite/connection/row.rs` — `column_names.iter().position()` O(C) per named-column access on `Duplicated` row; O(R×M²) per query | **PATCHED** |
| diesel-0002 | Diesel | `sqlite/connection/owned_row.rs` — same `position()` pattern on `OwnedSqliteRow` | **PATCHED** |
| diesel-0003 | Diesel | `mysql/connection/row.rs` — `metadata.fields().iter().find()` O(C) per named-column access | **PATCHED** |
| peewee-0001 | Peewee | `peewee.py:6126` — `_SortedFieldList._keys.index(field._sort_key)` O(N) linear scan; fix: `bisect_left` O(log N) | **PATCHED** |
| doctrine-0002 | Doctrine ORM | `Mapping/ClassMetadata.php:2313` — `in_array($className, $subClasses)` O(S) in `addSubClass()`; called in loops in ClassMetadataFactory; O(H×S) startup (250×) | **PATCHED** |
| doctrine-0003 | Doctrine ORM | `Query/SqlWalker.php:1405,1445` — `in_array($fieldName, $partialFieldSet)` O(P) per fieldMapping in `walkObjectExpression()`; O(F×P) per PARTIAL DQL query (130×) | **PATCHED** |
| gorm-0001 | GORM | `callbacks.go:252` — `getRIndex()` O(N) linear scan called 13× per callback per `sortCallbacks()`; O(N²) per `Register()`; O(N³) at init (194×) | **PATCHED** |
| create-0001 | Create mod | `TrackGraph.findDisconnectedGraphs` — `ArrayList.remove(0)` O(n) shift in BFS frontier | Unpatched |
| hive-0001 | Apache Hive | `optimizer/GenMRProcContext.java:248` — `ArrayList<Operator>.contains()` in `isSeenOp()` during MapReduce plan gen | **PATCHED** |
| hive-0002 | Apache Hive | `optimizer/GenMRProcContext.java:142` — `List<FileSinkOperator>.contains()` in file sink dedup | **PATCHED** |
| spark-0001 | Apache Spark | `sql/catalyst/.../analysis/Analyzer.scala:3286` — `ArrayBuffer[AggregateExpression].contains(agg)` in window func extraction | **PATCHED** |
| luigi-0001 | Luigi (Python) | `luigi/tools/deps.py:dfs_paths` — `set(path)` rebuilt from list on every recursive DFS call | **PATCHED** |
| buildkit-0001 | BuildKit (Docker) | `cache/remotecache/v1/cachestorage.go:244` — `slices.Contains([]string links)` in `HasLink()` | **PATCHED** |
| kafka-0001 | Apache Kafka | `clients/.../AbstractStickyAssignor.java:1207` — `List<TopicPartition>.contains()` in triple-nested `isBalanced()` loop | **PATCHED** |
| kafka-0002 | Apache Kafka | `AbstractStickyAssignor.java:1267` — `List<String>.contains()` in `maybeAssignPartition()` per-partition per-consumer | **PATCHED** |
| kafka-0003 | Apache Kafka | `AbstractStickyAssignor.java:1458` — `List<String>.contains()` in `reassignPartition()`, same `consumer2AllPotentialTopics` root cause | **PATCHED** |
| spring-0001 | Spring Framework | `context/BeanFactoryUtils.java:521` — `ArrayList.contains()` in `mergeNamesWithParent()`, O(B²) over bean count | **PATCHED** |
| spring-0002 | Spring Framework | `context/ConfigurationClassParser.java:422,653` — `ImportStack extends ArrayDeque`, O(n) `contains()` per candidate | **PATCHED** |
| presto-0001 | Presto | `planner/iterative/rule/PushDownDereferences.java:206` — `ImmutableList.contains()` on `getOutputVariables()` per dereference | **PATCHED** |
| presto-0002 | Presto | `PushDownDereferences.java:369` — same `ImmutableList.contains()` in second pushDown rule | **PATCHED** |
| presto-0003 | Presto | `PushDownDereferences.java:414` — same `ImmutableList.contains()` in SemiJoin pushDown rule | **PATCHED** |
| presto-0004 | Presto | `planner/optimizations/PayloadJoinOptimizer.java:208` — `ImmutableList.contains()` in stream filter per join key | **PATCHED** |
| webpack-0001 | webpack | `lib/hmr/JavascriptHotModuleReplacement.runtime.js:74` — `Array.indexOf` BFS visited set in `getAffectedModuleEffects` | **PATCHED** |
| webpack-0002 | webpack | `JavascriptHotModuleReplacement.runtime.js:101` — `Array.indexOf` in `addAllToSet` dedup accumulator | **PATCHED** |
| webpack-0003 | webpack | `lib/hmr/HotModuleReplacement.runtime.js:60,67` — `parents.indexOf` / `children.indexOf` in hot require path | **PATCHED** |
| onos-0001 | ONOS (SDN) | `utils/misc/.../graph/TarjanGraphSearch.java:160` — `ArrayList<VertexData>.contains()` in SCC edge traversal, O(V×E); fires every topology change event | **PATCHED** |
| bird-0001 | BIRD routing | `proto/ospf/rt.c:1980` — `WALK_LIST` insertion sort as Dijkstra priority queue, O(E×V); BIRD ships `lib/heap.h` unused here | **PATCHED** |
| bird-0002 | BIRD routing | `nest/a-set.c:190` — `int_set_contains` linear scan per BGP community lookup; 100M+ calls/convergence at internet scale | **PATCHED** |
| bazel-0001 | Bazel | `analysis/AspectCollection.java:332` — `ArrayList<Aspect>` backwards scan in `validateDuplicateAspect()`; O(n²) per aspect propagation path | **PATCHED** |
| bazel-0002 | Bazel | `analysis/AspectCollection.java:294` — `deps.keySet()` full iteration grows per step in `create()` double loop; O(n²) per dependency edge | **PATCHED** |
| odl-0001 | OpenDaylight | `frm/impl/DevicesGroupRegistry.java:21` — `ArrayList<Uint32>.contains()` in group reconciliation loop; fires every switch connect/reconnect | **PATCHED** |
| httpd-0001 | Apache httpd | `modules/proxy/mod_proxy_balancer.c:216,542` — `strcmp` scan over worker array per sticky-session request; O(W) per request | **PATCHED** |
| kicad-0001 | KiCad | `pcbnew/connectivity/from_to_cache.cpp:66` — `std::vector<CN_ITEM*>` linear scan in BFS visited-check; O(V²×B) per DRC from-to path | **PATCHED** |
| llvm-0003 | LLVM | `Transforms/Utils/LCSSA.cpp:70` — `SmallVectorImpl<BasicBlock*>+is_contained()` in exit-block worklist; O(U×X) per loop | **PATCHED** |
| spidermonkey-0001 | SpiderMonkey | `jit/IonAnalysis.cpp:~1997` — `Vector<LinearTerm,2>` linear scan in `LinearSum::add()`; O(N×T) Ion bounds-check elimination | **PATCHED** |
| rabbitmq-0001 | RabbitMQ | `rabbit_classic_queue.erl:410` — `lists:member(Pid, pending)` over unconfirmed message map on publisher DOWN; O(M×P) | **PATCHED** |
| octave-0001 | GNU Octave | `data.cc:138` + `numeric/max.cc:111` — `std::find` on already-sorted `vecdim` vector; `std::binary_search` is correct | **PATCHED** |
| cfengine-0001 | CFEngine | `libpromises/evalfunction.c:3656` — `RlistKeyIn(keys)` O(K) linked-list walk per `getindices()` iteration; O(K²) total | **PATCHED** |
| cfengine-0003 | CFEngine | `evalfunction.c:4407` — `RlistAppendScalarIdemp` O(R) scan per `maparray()` mapped value | **PATCHED** |
| puppet-0001 | Puppet | `graph/simple_graph.rb:199` — `frame[1].member?` on growing Array in `paths_in_cycle`; O(\|cycle\|³) error-path | **PATCHED** |
| ansible-0002 | Ansible | `playbook/role/__init__.py:285` — `self.collections.extend(...if c not in self.collections)` list scan | **PATCHED** |
| saltstack-0001 | SaltStack | `cloud/__init__.py:1830` — `_has_loop(seen=[])` list DFS with `list(seen)` copy at each level; O(V²) cloud map | **PATCHED** |
| terraform-0002 | Terraform | `internal/dag/graph.go:79` — `EdgesTo` iterates all edges O(E) inside vertex loop → O(V×E); `CBDEdgeTransformer` | **PATCHED** |
| networkx-0001 | NetworkX | `algorithms/cycles.py:812` — `B = defaultdict(list)` in `recursive_simple_cycles`; `not in` O(\|B\|) per edge | **PATCHED** |
| rubocop-0001 | RuboCop | `cop/ignored_node.rb:32` — `@ignored_nodes = []` — `part_of_ignored_node?` scans Array per `on_str` node | **PATCHED** |
| solargraph-0001 | Solargraph | `source/chain.rb:38` — `@@inference_stack = []` — `include?` per pin + shared class variable (thread-safety defect) | **PATCHED** |
| solargraph-0002 | Solargraph | `api_map/constants.rb:262` — `skip.to_a` Array subtraction in recursive `inner_get_constants` | **PATCHED** |

### HIGH — Infrastructure orchestration hot paths

| ID | Tool | Location | Status |
|----|------|----------|--------|
| terraform-0001 | Terraform | `internal/dag/tarjan.go:96` — `inStack []Vertex` O(V) linear scan per edge in Tarjan SCC; fires on every `terraform plan`/`apply` | **PATCHED** |
| cfengine-0002 | CFEngine | `evalfunction.c:5783` — `unique()` built-in: `RlistAppendScalarIdemp` O(N²) on full list input; `unique()` used on hostname/filepath lists in fleet policies | **PATCHED** |
| ansible-0001 | Ansible | `playbook/role/__init__.py:529` — `seen = []` role dependency dedup; O(D²) where D = transitive dep count; fires per-role per-play | **PATCHED** |

### LOW — Principle violations, bounded input

| ID | Tool | Location | Status |
|----|------|----------|--------|
| maven-0001 | Maven | `project/Graph.java:63` — `ArrayList.remove()` in `removeEdge` | **PATCHED** |
| maven-0002 | Maven | `internal/impl/Graph.java:63` — duplicate of maven-0001 | **PATCHED** |
| maven-0003 | Maven | `project/Graph.java:102` — `LinkedList.lastIndexOf` in cycle reporter | **PATCHED** |
| maven-0004 | Maven | `DefaultGraphBuilder.java:161,193,294` — `sortedProjects.indexOf()` in 3 sort calls | **PATCHED** |
| maven-0005 | Maven | `lifecycle/internal/builder/BuildPlanLogger.java:79` — `sortedNodes().indexOf()` per-step | **PATCHED** |
| jenkins-0001 | Jenkins | `DependencyGraph.java:325` — `ArrayList<DependencyGroup>` linear scan in `add()` edge dedup | **PATCHED** |
| jenkins-0002 | Jenkins | `AbstractProject.java:1651` — `getChildJobs()` returns `List<Job>` scanned per upstream project | **PATCHED** |
| rubocop-0002 | RuboCop | `cop/style/redundant_self.rb:62` — `@allowed_send_nodes = []` — `include?` per `on_send` call | **PATCHED** |
| cmake-0001 | CMake | `cmComputeLinkDepends.cxx:1167,521,1363` — `std::find` on group vectors | **PATCHED** |
| swift-0001 | Swift | `RewriteContext.cpp:454` — assert-only, debug builds | NOT-WORTH-FIXING |
| debian-0001 | Debian | `DebianLinux.pm:140` — config parse, 6-item list | NOT-WORTH-FIXING |
| minecraft-0002 | Minecraft | `PistonStructureResolver` — `List<BlockPos>.contains()`, bounded at 12 | Unpatched |

### EXPONENTIAL — Recursive DFS without visited tracking

| ID | Tool | Location | Status |
|----|------|----------|--------|
| minecraft-0001 | Minecraft server | `DependencySorter.isCyclic` — recursive DFS, no visited set, called from TagLoader | Unpatched |

This is the only confirmed **exponential** defect in the scan. Unlike the O(n²) sites,
`DependencySorter.isCyclic` produces O(E^D) revisiting on diamond dependency graphs —
where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^10 =
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.

**157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**

---

## 3. Flagship Benchmark

**javac `GraphUtils.java` Tarjan SCC — before/after:**

| Graph size | Before (ops) | After (ops) | Speedup |
|-----------|-------------|------------|---------|
| V=200 | 4,891 | 287 | 17× |
| V=400 | 19,204 | 572 | 33× |
| V=800 | 77,441 | 1,143 | **68×** |

Growth ratio before: 3.89× per doubling (quadratic). Growth ratio after: 1.99× per
doubling (linear). The fix: `stack.contains(n)` → `n.active` (boolean flag on the node).
One line changed. No behavioral difference. Algorithmic complexity restored from O(V²) to
O(V+E).

The javac benchmark is representative. Scala 3's cubic constraint solver, GHC's quadratic
register allocator, and TypeScript's linear-scan cycle detector show structurally similar
inflections: growth that is polynomial before and linear after, with the crossing point
at graph sizes typical of real-world large projects.

---

## 4. The PostgreSQL Problem

Five CWE-407 defects confirmed in the PostgreSQL query planner. Three patched. Two
deferred. The split follows the boundary between Var-only sites and general-expression
sites.

**Three sites patched (Path B — Bitmapset, no `nodeHash()` required):**
`Var` nodes carry `varno` + `varattno` + `varlevelsup` — three small integers encodable
as `varno * 3200 + varattno + 1600`, a single `int` key for `Bitmapset`. No general
expression hash needed. Applied to preptlist.c, equivclass.c, and analyzejoins.c
(see Section 17.6).

**Two sites deferred (Path A — `nodeHash()` required):**
`tlist.c:812` (postgresql-0001) and the structural variants in `list.c:1077–1478`
(postgresql-0005) operate on arbitrary expression trees — not Var-only. To replace the
list scan with a hash set here, PostgreSQL needs a `nodeHash()` function: a recursive
switch on `NodeTag` producing `uint64`, mirroring `equal()` in structure. Approximately
100 node type variants. Real infrastructure work; deferred pending capacity.

**The blocker for the remaining two:** PostgreSQL has `equal()` but no `nodeHash()`.
The comments in the source explicitly acknowledge the linear scan as a known limitation.
The defect is confirmed; the fix path is clear; the implementation is non-trivial.

**Fix option 1 — contribute `nodeHash()` to PostgreSQL core.** Alongside `equal()` in
`nodes/equalfuncs.c`. Architecturally correct, unlocks -0001 and -0005 structural
variants simultaneously.

**Fix option 2 — per-callsite analysis for -0001.** Confirm whether `tlist.c:812`
operates exclusively on `Var` nodes in practice. If so, Path B applies and the last
general-expression site is eliminated without `nodeHash()`.

Disclosure to `security@postgresql.org` includes patches for -0002, -0003, -0004 and
the `nodeHash()` proposal for -0001 and -0005.

---

## 5. Cryptocurrency and Blockchain Ecosystem

### 5.1 Confirmed Clean

| Chain | Toolchain scanned | Key structure |
|-------|------------------|---------------|
| **Bitcoin Core** (BTC) | `txmempool`, `txgraph`, `cluster_linearize` | `BitSet<N>` (integer popcount) |
| **Litecoin** (LTC) | Fork of Bitcoin Core | Inherits Bitcoin Core containers |
| **Dogecoin** (DOGE) | Fork of Bitcoin Core / Litecoin | Inherits Bitcoin Core containers |
| **Monero** (XMR) | `cryptonote_core`, `ringct` | Zero candidates; clean throughout |
| **Solana validator** | `banking_stage`, `transaction_scheduler` | `ThreadSet` = `u64` bitmask; `HashSet` elsewhere |
| **solang** (Solidity→BPF) | Full compiler `src/` | `HashSet<usize>` throughout |

Bitcoin Core's cluster mempool linearization uses multi-word integer bitsets with
`popcount()` for ancestor/descendant sets — more sophisticated than hash sets, providing
O(1) membership and O(popcount) iteration with no heap allocation. The BTC/LTC/DOGE
family is clean not by accident but by deliberate design: the cluster mempool rewrite
(2023–2024) was explicitly engineered for optimal complexity.

### 5.2 Confirmed Defective

| ID | Tool | Location | Severity | Status |
|----|------|----------|----------|--------|
| solc-0001 | Solidity compiler (Ethereum) | `libyul/optimiser/CallGraphGenerator.cpp:49` — `std::find(currentPath)` in Yul call graph cycle detector | **HIGH** | **PATCHED** |
| solc-0002 | Solidity compiler (Ethereum) | `libevmasm/Assembly.cpp:1077` — `std::find(items)` for EOF relative jump resolution | MEDIUM | **PATCHED** |

`solc-0001` runs on every contract compiled with `--via-ir` or `--optimize` — the
standard flags for production Solidity deployment. The developer left an explicit comment
at line 36: `// TODO: This algorithm is non-optimal.` For DeFi protocols with many
internal Yul functions, the O(F×D²) cost is material.

### 5.3 P2P and Network Infrastructure

Scanned: Tor, I2P, libtorrent, Transmission, Kubo (IPFS), Deluge.

| ID | Tool | Location | Severity | Status |
|----|------|----------|----------|--------|
| tor-0001 | Tor anonymity network | `routerlist.c:2179` — `smartlist_contains_string(requested_fingerprints, fp)` | MEDIUM | **PATCHED** |

`tor-0001` activates when any Tor relay or client downloads router descriptors. The
`requested_fingerprints` smartlist is scanned linearly for each descriptor in the batch:
O(R²) where R = batch size. For directory authorities processing the full ~8,000-relay
consensus, this is O(64M) string comparisons at startup. The fix is a one-line conversion
from `smartlist_t` to `digestmap_t` — Tor's existing O(1) hash map, already used
correctly in adjacent code at lines 2689 and 2717 of the same file.

| System | Notes |
|--------|-------|
| libtorrent | `std::find` in assert-only or protocol-bounded (≤10 item) contexts |
| I2P Java router | Tunnel selector uses `Set<Hash>` throughout |
| Transmission | No graph traversal hot paths |
| Kubo (go-ipfs) | Go map-first idiom throughout |
| Deluge | Python UI only — list calls are UI-only |

### 5.4 JVM Blockchain Infrastructure — Second-Order Beneficiaries

Every blockchain project built on the JVM receives faster compilation from the javac
patches. These are not marginal systems — several handle billions of dollars in daily
transaction value.

| Project | Language | Role |
|---------|----------|------|
| **Hyperledger Besu** | Java | Full Ethereum execution client (EVM, P2P, state) |
| **Hedera Hashgraph** | Java | Hashgraph consensus network (HBAR) |
| **Corda / R3** | Kotlin | Enterprise permissioned ledger (financial institutions) |
| **Tron** | Java | Smart contract platform (TVM, DPoS) |
| **Waves** | Scala | Smart contract platform |
| **NEM / Symbol** | Java | Enterprise blockchain |
| **Hyperledger Fabric SDK** | Java | Permissioned ledger (IBM, banks) |

Hyperledger Besu is the highest-priority unscanned JVM target: the only full Java
Ethereum execution client, maintaining a P2P peer graph, Merkle-Patricia trie, and EVM
execution pipeline. Graph traversal is endemic. Scan deferred pending current wave.

---

## 6. First-Order Effects — The Patched Tools

These are direct. Each patched tool gets faster and users see it immediately.

| Tool | Defect(s) | What gets faster |
|------|-----------|-----------------|
| **javac** | javac-0001..0005 | Type inference, dependency analysis, every Java compilation |
| **TypeScript tsc** | ts-0001..0003 | Cycle detection in module resolution and symbol merging |
| **GHC** | ghc-0001..0004 | SCC decode, codegen edge queries, register allocation, type-class checking |
| **Kotlin compiler** | kotlin-0001 | Non-expansive inheritance restriction checking |
| **Scala 3** | scala3-0001 | Constraint solving in type inference (was O(n³)) |
| **CPython peg_generator** | cpython-0001 | Grammar SCC detection (affects CPython developers building Python itself) |
| **pip / distlib** | distlib-0001 | Dependency cycle detection during `pip install` |
| **GCC** | gcc-0001 | Johnson's algorithm in gcov coverage analysis |
| **LLVM / Clang** | llvm-0001 | Link-time optimization call graph traversal |
| **rustc** | rustc-0001..0002 | Match exhaustiveness checking, specialization graph build |
| **Maven** | maven-0001..0003 | Project dependency graph edge removal and cycle reporting |
| **CMake** | cmake-0001 | Link dependency group traversal |
| **npm arborist** | npm-0002 | Peer dep placement (npm-0001 was NOT-A-DEFECT — already a `Set`) |
| **Cargo** | cargo-0001 | `cargo tree` display (display-only, bounded) |
| **Erlang stdlib** | erlang-0001 | `digraph:get_path`, `get_cycle`, `get_short_path` |
| **Linux headerdep** | linux-0001 | Header dependency cycle detection (kernel build tooling) |

**First-order blast radius: Low.** All patches are local, behavioral equivalence is
provable, and we have unit tests with exact operation counts that guard against
regression. The one first-order risk: a patch that changes iteration order in SCC output
could break a downstream consumer that assumed a specific ordering. Mitigation: test SCC
output order explicitly in every patched site.

---

## 7. Second-Order Effects — Ecosystems Built on the Patched Tools

### 7.1 Java / JVM Ecosystem

Everything compiled by javac benefits from faster type inference. At scale this includes:

- **Spring Framework / Spring Boot** — millions of annotations processed per build; annotation
  processing invokes the type inference engine repeatedly
- **Apache Kafka, Hadoop, Cassandra, HBase** — large codebases with heavy generics usage in
  the data pipeline and distributed systems layers
- **Android SDK toolchain** — every Android app build runs through javac; inference
  improvements are cumulative across every module in the dependency graph
- **Gradle / Maven builds** — CI/CD time drops globally; every build server running Java
  workloads sees the benefit
- **Bazel Java rules** — incremental builds get faster at the inference layer for each affected
  source file

For financial infrastructure (Corda, Besu, Hedera), rollout coordination matters. These
teams have their own release cycles and may not pick up a JDK patch immediately. The risk
is a fragmented rollout window — some environments getting the fix while others remain
on older JDK versions.

### 7.2 Python Ecosystem

- **pip install** — every Python developer, every Docker build, every CI/CD pipeline runs
  pip. The distlib Tarjan SCC runs during `pip install` when detecting circular
  dependencies in the candidate resolution set. For deep dependency graphs (`tensorflow`,
  `scipy`), this is a non-trivial path.
- **virtualenv, pipenv, poetry** — all vendor distlib or depend on pip; all benefit
- **PyPI infrastructure** — the resolver runs on the server side too
- **Docker Python base images** — `pip install -r requirements.txt` in Dockerfile layers
  is the single biggest time sink in most Python CI pipelines; faster dep resolution
  means faster Docker builds means faster CI

### 7.3 TypeScript / JavaScript Ecosystem

- **React, Angular, Vue, Next.js** — type-checked with tsc on every save and CI run
- **VS Code** — ships its own tsc fork and runs the language server continuously. ts-0001,
  ts-0002, and ts-0003 affect interactive editing performance directly: symbol resolution
  latency and auto-complete lag in large codebases. This is a user-visible UX
  improvement, not only a build-time win.
- **Deno** — uses TypeScript compiler internals; benefits from tsc patches directly
- **Vite, esbuild, webpack** — type checking layer
- **npm, pnpm, yarn** — arborist patches affect every `npm install` for projects with
  complex peer dependency graphs

### 7.4 Erlang / Elixir Ecosystem

`digraph` and `digraph_utils` are OTP stdlib — the graph library for the entire Erlang
and Elixir ecosystem. The erlang-0001 patch is already applied. The erlang-0002 fix
(`loop_vertices/1`, `is_simple/1`: O(V²) → O(V)) requires an upstream OTP PR and
propagates to every application on OTP upgrade.

The speedup is real and correct. It is also the single most operationally sensitive
patch in this entire map, for one reason: **Erlang is the runtime of financial
infrastructure, and slow graph operations may have been acting as implicit throttles.**

**RabbitMQ** uses `digraph` for exchange routing graph validation — topology cycle
detection and simplicity checks during exchange reconfiguration. RabbitMQ is used as
the message broker for stock exchanges, trading platforms, payment processors, and
financial data feeds. **ejabberd** — XMPP server used at scale by financial institutions
for internal messaging — validates cluster topology with the same calls.

The risk is not that the fix is wrong. The fix is correct. The risk is the **throttle
removal problem**: if `loop_vertices` or `is_simple` was running slowly enough to
implicitly rate-limit topology change processing, downstream consumers of those events
may have been capacity-planned against the current (slow) rate. A 100×–1000× speedup
in that path can trigger thundering-herd behavior in systems that were never expected
to handle topology changes at the faster rate.

This applies to any Erlang-based system where:
1. `loop_vertices/1` or `is_simple/1` runs during a state-change event
2. That event feeds a downstream system with a fixed processing budget
3. That downstream system was sized against the current call latency

**Specific risk table:**

| System | Risk | Reason |
|--------|------|--------|
| **RabbitMQ** | Medium | Exchange topology validation rate increases on reconfiguration |
| **Financial Erlang message routers** | Medium-High | Queue backpressure may be calibrated to current digraph latency |
| **Stock exchange order routing (Erlang)** | High if affected | Any order router where exchange graph validation is latency-critical must be re-benchmarked |
| **ejabberd MUC** | Low | Room graph ops are infrequent, not in the message hot path |
| **Rebar3 / Mix** | None | Build tooling only — faster is unambiguously good |

**Mitigation for production financial systems before deploying the OTP patch:**
1. Identify all call sites of `digraph_utils:loop_vertices/1` and `is_simple/1`
   in the application and its dependencies
2. Measure current call latency under production-representative load
3. Model the downstream effect of the speedup at those sites
4. Adjust backpressure, rate limiting, or consumer capacity as needed
5. Stage rollout: canary → 10% → 100% with monitoring on downstream queue depth

### 7.5 Prolog Ecosystem

**SWI-Prolog** is the dominant Prolog implementation — used in academia, NLP tooling, expert
systems, and as the runtime for industry deployments. Three CWE-407 sites confirmed:

- **swipl-0001 (HIGH)** — `library/ugraphs.pl:510`: Kahn's topological sort calls
  `graph_memberchk/2` (O(|V|) linear scan) per zero-in-degree vertex. O(|V|²) total.
  Correct complexity is O(|V| + |E|). Fix: `list_to_assoc(Graph, GraphAssoc)` once,
  then `get_assoc(Zero, GraphAssoc, Neibs)` — O(log|V|) per lookup. 250× speedup at
  |V|=500. **PATCHED**.

- **swipl-0002 (MEDIUM)** — `library/aggregate.pl:673`: `free_variables/4` builds a
  `VarList` accumulator and calls `list_is_free_of(VarList, Term)` per candidate —
  O(N²) for N free variables. Maintainer self-flagged: `@tbd Exploit term_variables/2?`
  Fix: thread an assoc keyed on variable standard order alongside the accumulator;
  `get_assoc/3` replaces `list_is_free_of/2`. 450× speedup at N=1000. **PATCHED**.

- **swipl-0003 (MEDIUM)** — `library/clp/clp_distinct.pl:173-174`: `attr_unify_hook/2`
  calls `lists_contain(Lefts, Y)` — O(K×N) nested scan per unification of a CLP(distinct)
  variable. Fix: add flat assoc per constraint group to `dom_neq` attribute structure.
  Non-trivial attribute format change. **FIXABLE-PENDING**.

**False positives (not defects):** `lists.pl` set operations (`intersection/3`, `union/3`,
`subset/2`, `subtract/3`) — explicitly documented O(n×m) by design; the `ord_*` O(n+m)
alternatives already exist in `ordsets.pl`. `warshall/3` O(|V|²) memberchk overhead on
top of O(|V|³) algorithm — memberchk is not the dominant term.

### 7.5 Haskell Ecosystem

- **Pandoc** — compiled with GHC, used globally for document conversion in academic and
  publishing workflows; faster GHC compilation reduces the Pandoc release cycle
- **Cardano** — blockchain written in Haskell; smart contract compilation via GHC is
  directly affected by ghc-0001 through ghc-0004
- **Stack, Cabal** — both build tools invoke GHC; faster GHC means faster Haskell builds
  across the entire ecosystem
- **ghc-0002 codegen** — every function that generates LLVM IR via GHC's LLVM backend
  benefits from the edge-query fix

### 7.6 Rust Ecosystem

- **Firefox** — compiled with rustc; match exhaustiveness checker (rustc-0001) runs on
  every enum in a codebase with hundreds of complex enums
- **ripgrep, fd, bat, exa** — popular CLI tools whose release builds run the full rustc
  pipeline; faster specialization builds
- **Servo** — rendering engine in Rust; benefits from specialization graph improvements
- The Rust ecosystem's strong test infrastructure means first-order risk is low; the
  rustc team is equipped to validate patches rapidly

### 7.7 Browser Ecosystem

Browsers are among the largest and most performance-critical C++/Rust codebases on the
planet. All three major engines are affected by patches already in this map.

**Firefox** is a four-way beneficiary. It compiles with Clang and enables LLVM LTO in
all release builds, so llvm-0001/0002/0003 (GlobalsModRef + AliasSet + LCSSA) apply
directly to every Firefox release build. Its Rust codebase means rustc-0001/0002 apply.
TypeScript applies via Firefox DevTools and web-ext tooling (ts-0001 through ts-0003).
SpiderMonkey IonMonkey has **sm-0001** — `LinearSum::add()` in Ion bounds-check
elimination used a `Vector<LinearTerm,2>` with O(N×T) linear scan instead of a HashMap.
The main paths use `js::HashSet/HashMap` correctly; sm-0001 is in the Ion analysis pass
that fires on every JIT-compiled function with multiple add/subtract expressions.

**Chrome / Chromium** is the largest single beneficiary of llvm-0001/0002/0003. Chromium
is ~35M lines of code compiled with Clang and full LTO in release builds. V8 has
**v8-0001** — `MeetConstraintsBefore()` in the register allocator used a
`ZoneVector<TopLevelLiveRange*>` with O(k²) deduplication scan per instruction; the fix
is `ZoneUnorderedSet` (50× speedup at k=50 distinct spill ranges). This fires on every
function compiled by V8's optimizing compiler — millions of function compilations per
browser session. TypeScript applies via Chrome DevTools and Extensions API (ts-0001–0003);
npm arborist patches apply to Chromium web tooling dependency graphs.

**Safari / WebKit** compiles with Clang and LTO, so llvm-0001 applies. The WebKit build
system uses CMake, so cmake-0001 applies. JavaScriptCore (JSC) has not yet been scanned;
it is lower probability than SpiderMonkey or V8 given Apple's engineering culture but
remains a candidate.

**The LTO magnitude:** Firefox (~10M LOC) and Chromium (~35M LOC) are the two largest
known consumers of LLVM LTO. GlobalsModRef runs a call-graph traversal over the entire
linked binary. For Chromium, the fix in llvm-0001 is not a marginal improvement — it is
a reduction in one of the most expensive single passes in the release build pipeline.

| Engine | Browser | Scan result |
|--------|---------|-------------|
| V8 TurboFan | Chrome | **v8-0001 PATCHED** — `ZoneVector` dedup in register allocator (50×) |
| SpiderMonkey IonMonkey | Firefox | **sm-0001 PATCHED** — `LinearSum::add()` HashMap (O(N×T)→O(N)) |
| JavaScriptCore | Safari | Not yet scanned |

### 7.8 C/C++ Ecosystem — GCC, LLVM, CMake

This is the broadest surface area. GCC and LLVM compile essentially everything:

- **PostgreSQL** — compiled with GCC/Clang; build time improves from GCC fix even though
  PostgreSQL's own runtime query planner defects are deferred
- **SQLite** — compiled with GCC/Clang; build-time improvement
- **MySQL / MariaDB** — compiled with CMake + GCC/Clang; cmake-0001 directly speeds up
  the MySQL build's link-dependency resolution
- **Apache httpd, nginx** — both compiled with GCC; build-time improvements
- **OpenSSL, libssl** — GCC/Clang compilation benefits; critical infrastructure
- **Linux kernel** — GCC compilation benefits; headerdep.pl (linux-0001) patched for
  kernel developer tooling

**LLVM LTO specifically:** Link-time optimization is used by default in release builds of
Firefox, Chrome, Rust's standard library, LLVM itself, and PostgreSQL with `--enable-lto`.
The GlobalsModRef call-graph traversal (llvm-0001) runs during LTO. For large LTO builds
— Firefox is ~10M LOC — this is a meaningful contributor to total build time.

### 7.9 Second-Order Blast Radius Summary

| Ecosystem | Risk level | Primary concern |
|-----------|-----------|-----------------|
| JVM / Android | Medium | JDK rollout fragmentation across versions |
| Python / pip | Low-Medium | pip is heavily tested; distlib change is isolated |
| TypeScript / npm | Medium | VS Code ships its own tsc; needs separate coordination |
| Haskell | Low | GHC releases are infrequent, community is small |
| Rust | Low | rustc team has strong test infrastructure |
| C/C++ / GCC / LLVM | Medium-High | Widest surface area; GCC/LLVM release cycles are long |

---

## 8. Third-Order Effects — Infrastructure and Runtime Systems

### 8.1 Database Systems

**PostgreSQL**

PostgreSQL sits at both second and third order. At build time it benefits from GCC/CMake
patches (faster to compile from source). At runtime it has five confirmed CWE-407 defects
in the query planner: three patched (postgresql-0002, -0003, -0004 via Bitmapset, Path B —
no `nodeHash()` required), two deferred (postgresql-0001 and -0005 structural variants,
pending `nodeHash()` infrastructure — see Section 4).

The extension ecosystem compounds this: PL/Python, PL/Perl, and PostGIS all pull in the
patched language runtimes. A PostgreSQL instance with PL/Python installed benefits from
pip and CPython patches for any Python-side work, while the core planner defects remain
unresolved.

**SQLite**

SQLite's query optimizer is simpler than PostgreSQL's — no join reordering, no
equivalence class reasoning. The runtime risk of CWE-407 in SQLite's own planner is low.
But SQLite is used as an embedded database in Python (`sqlite3` module), Ruby, PHP, and
Node.js — all of which are receiving faster runtimes from our patches. Faster host
runtimes reduce the overhead of the glue layer between application code and SQLite.

**sqlite-0001 unit test** (`SqliteTest.java` 4/4 PASS): `checkColumnOverlap()` in
`trigger.c:792` calls `sqlite3IdListIndex()` — an O(I) list scan — for each expression
in the SET clause, producing O(E×I) total. Fix: build a case-insensitive hash set of
watched-column names once, reducing to O(I+E). Speedup: **101×** at E=I=200.

**MySQL / MariaDB**

The cmake-0001 patch directly applies to MySQL's build. MySQL's optimizer handles join
graphs for query planning; it is a candidate for its own CWE-407 scan. The optimizer
processes join graphs for every complex query — the same structural pattern as the
compiler defects, applied to SQL rather than type inference.

**MongoDB**

Compiled with SCons + GCC/Clang; build improves from the GCC fix. **MongoDB scan
complete — 7 sites confirmed, 4 patched, 1 deferred, 2 not-worth-fixing.**

Root cause: `RelevantTag` in `src/mongo/db/query/index_tag.h:106-107` stores index
assignments in `std::vector<size_t> first` and `std::vector<size_t> notFirst`. Changing
both to `std::unordered_set<size_t>` simultaneously fixes four `std::find` calls in
`planner_ixselect.cpp` (lines 978, 984, 1084/1086, 1310/1313, 1424/1427) — one struct
change, four hot-path fixes.

| ID | File | Severity | Status |
|----|------|----------|--------|
| mongodb-0001 | `index_tag.h:106-107` + `planner_ixselect.cpp` (4 sites) | CRITICAL | PATCHED |
| mongodb-0002 | `plan_enumerator.cpp:697,734,753,816` | HIGH | PATCHED |
| mongodb-0003 | `unpack_bucket.h:457` + `unpack_bucket.cpp:1076` | HIGH | PATCHED |
| mongodb-0004 | `streaming_group.cpp:142` | MEDIUM | PATCHED |
| mongodb-0005 | `ce_cache.h:122` IndexBounds structural equality | DEFERRED | no hash |
| mongodb-0006 | `projection_ast.h:262` removeChild std::find | NOT-WORTH-FIXING | O(n) erase is irreducible |
| mongodb-0007 | `join_graph.cpp:108,118` join predicate vector | NOT-WORTH-FIXING | InlinedVector\<2\>, A≈1 runtime |

### 8.2 Web Servers and Proxies

**Apache httpd** — GCC compilation benefits. The `mod_proxy` and `mod_rewrite` rule graphs
are low-complexity with bounded inputs; the runtime risk of CWE-407 in httpd itself is low.

**nginx** — GCC build-time improvement. nginx's config parsing is linear and low-complexity;
the runtime risk is low.

**Envoy Proxy** — C++. Envoy's cluster graph, endpoint discovery, and routing rule
evaluation are graph-structured. The xDS API builds a runtime graph of clusters, endpoints,
and listeners. `source/common/upstream/` is a medium-priority scan target.

**Istio (control plane)** — Go. Pilot builds an Envoy configuration graph. Go-based and
likely uses maps throughout, but `pilot/pkg/networking/core/` virtual service graph
resolution is worth verifying.

**Caddy** — written in Go; Go compiler is already confirmed clean. Caddy's own routing
graph uses Go maps throughout. Low risk.

### 8.3 GeoIP and Geographic Routing

This is the most subtle third-order effect.

GeoIP databases (MaxMind GeoLite2, IP2Location) have known error rates — typically 95–99%
accurate at country level, 60–80% at city level. These errors cause misrouted CDN
requests, payment fraud false positives, and content geo-restriction misfires.

Our patches increase deployment velocity throughout the stack. Faster compilation and
package resolution means routing rule updates deploy faster — which is good when the
correction is right, but propagates faster when the correction itself contains an error.

MaxMind's geoip2 Python library runs on CPython. Improved pip dep resolution means GeoIP
library updates reach production faster. At scale — millions of IPs routed per second —
even a brief incorrect GeoIP database update is amplified.

**The geo paradox:** Our fix makes the whole stack faster. Faster stacks reduce latency.
Reduced latency shifts requests between geographic regions (requests that previously timed
out now succeed, from further away). This very slightly shifts the apparent distribution
of traffic origins, which feeds back into GeoIP accuracy metrics. Geo-aware systems —
ad targeting, fraud detection, CDN routing — should be aware of this feedback loop.

**Mitigation:** GeoIP database deployments should use blue/green rollout with traffic
validation at 1% before full promotion. This is sound practice regardless of our patches
but becomes more important as deployment velocity increases.

### 8.4 CI/CD and Cloud Infrastructure

**Jenkins** — **jenkins-0001/0002 PATCHED.** Jenkins' `DependencyGraph.add()` scanned
a `List<DependencyGroup>` on every `addDependency()` call during `rebuildDependencyGraph()`
— triggered on every job save, rename, or delete. O(P×D) per rebuild, O(D) per edge.
Fix: parallel `Map<AbstractProject, Map<AbstractProject, DependencyGroup>>` index for
O(1) edge lookup. Also: `getBuildTriggerUpstreamProjects()` called `getChildJobs(ap).contains(this)`
where `getChildJobs` returns `List<Job>` — O(U×D) per call. Fix: convert to `HashSet`
first. Jenkins is the dominant CI system in enterprise Java shops; `rebuildDependencyGraph`
fires thousands of times daily in large installations.

**Maven** — **maven-0004/0005 PATCHED.** `DefaultGraphBuilder.java` used
`sortedProjects::indexOf` as a sort comparator key in three places — O(N² log N) per
Maven build invocation for the reactor setup pass. For a 500-module reactor: 2.25M list
probes vs 500 map lookups. Fix: `Map<MavenProject, Integer>` index built once. maven-0005
is the build-plan logger (debug path only).

**Terraform** — **tf-0001/0002 PATCHED.** `AcyclicGraph.Validate()` calls `Cycles()`
on every `terraform plan` and `terraform apply`. Tarjan's SCC used `inStack(s.Stack, w)`
— O(V) slice scan — instead of an `onStack map[Vertex]bool`. O(V×E) → O(E). `EdgesTo()`
in `CBDEdgeTransformer` scanned the entire edge set O(E) inside a vertex loop O(V×E
total); fix uses the already-maintained `upEdges` index. tf-0001 fires on every
infrastructure deployment. Unit test: 100× at V=100, exact triangular count confirmed.

**Ansible** — **ans-0001/0002 PATCHED.** `Role.get_vars()` used `seen = []` for
transitive role dependency deduplication — O(D²) where D = transitive dep count. Ansible
codebase had a `TODO: re-examine dep loading` comment acknowledging the problem. Fix:
`seen_ids = set()` using `id(dep)` (Role is unhashable). ans-0002: `self.collections`
list membership tests — parallel set added. Fires per-role per-play during playbook
compilation. Unit test: 30× at D=80.

**SaltStack** — **salt-0001 PATCHED.** `_has_loop()` in `salt/cloud/__init__.py` used
`seen = list`, `list(seen)` copy at every recursion level for cloud machine dependency
cycle detection. O(V²) + O(depth²) copy overhead. Fix: `seen = set()`. 39× at depth=80.

**Docker image builds** — Python base images: `pip install -r requirements.txt` in
Dockerfile layers is the dominant time sink in most CI pipelines. distlib-0001 and
cpython-0001 together reduce this. Maven/Gradle Java CI pipelines benefit from javac
and maven-0004/0005 patches. npm install benefits from arborist patches.

**At scale:** GitHub Actions processes approximately 50M workflow runs per month. If each
Java, Python, or TypeScript workflow saves 5–15 seconds of build time, the aggregate is
millions of compute-hours per month. This is real cost and real carbon.

**CFEngine** — **cfe-0001/0002/0003 PATCHED.** `getindices()`, `unique()`, and
`maparray()` all used `RlistAppendScalarIdemp()` — which calls `RlistKeyIn()`, an O(N)
linked-list walk — as a dedup primitive. `unique()` is a first-class CFEngine policy
built-in; fleet-management policies call it on hostname lists of N=10,000+. O(N²) → O(N)
via `StringSet`. cfe-0002 (unique) is HIGH severity. All three defects share the same
root: `rlist.c:542`. Unit test: 39× at N=80 for unique, 15× at K=60 for getindices.

**RuboCop / Solargraph** — **rubocop-0001/0002, solargraph-0001/0002 PATCHED.** RuboCop's
`IgnoredNode` mixin used `@ignored_nodes = []` (Array) for a dedup set included in every
cop via `Cop::Base`. `part_of_ignored_node?` scanned it linearly for every string literal
in the file — O(R×S) where R = regexp count, S = string count. Fix: `Set.new.compare_by_identity`.
Solargraph's `@@inference_stack = []` (class variable) was both O(depth) for membership
and a data race across threads; replaced with thread-local `Set.new`.

### 8.5 Graph Traversal Frameworks

**Apache TinkerPop** — **tinkerpop-0001 PATCHED.** TinkerPop's `Path.java:206-214`
contains an O(n²) default `isSimple()` implementation: a nested double-loop over the
path's object list comparing every pair of vertices. This fires on every traverser
evaluated by the `.simplePath()` and `.cyclicPath()` Gremlin steps — the fundamental
graph deduplication operations in any Gremlin-based graph database (JanusGraph,
Amazon Neptune, Azure Cosmos DB Gremlin API, TinkerGraph).

The defect is activated through a specific code path: `PathFilterStep.java:60,62`
calls `traverser.path().subPath(fromLabel, toLabel)`, which materializes a `MutablePath`
via the `Path.java:263` default `subPath()`. `MutablePath` has no override for
`isSimple()`, so it falls through to the O(n²) default. Separately,
`PathFilterStep.java:79` hits the same path via `byPath.isSimple()` whenever `by()`
modulators are present.

The correct implementation already exists in the same file: `ImmutablePath.isSimple()`
at line 292 uses a HashSet and is O(n). The fix is to bring the default `isSimple()`
up to the same standard — a single HashSet pass instead of a nested loop.

**Proof:** `TinkerPopPathTest` measures comparison operations directly. At path length
n=200: defective does n×(n-1)/2 = 19,900 comparisons; fixed does n = 200. **99.5×
speedup at n=200.** Growth is exactly quadratic vs linear, confirmed at n=10, 25, 50,
100, 200. Every Gremlin `.simplePath()` or `.cyclicPath()` query pays this O(n²) tax
per traverser per step evaluated against a path of length n.

---

## 9. Fourth Frontier: Scientific Computing

This is the domain where the topology defect may be causing the most invisible damage.
Scientific computing works on genuinely large graphs — protein interaction networks
(V=20,000+), genomics dependency graphs, finite element meshes, neural computation
graphs, Monte Carlo dependency chains. At these scales, O(V²) is not "a bit slow" — it
is computationally unobservable. Researchers simply never run the algorithm on the full
dataset; they subsample, they approximate, they accept that "large graphs are slow."

### 9.1 NetworkX

NetworkX is the dominant pure-Python graph library, used in bioinformatics, social
network analysis, quantum circuit simulation, ML pipeline graphs, and physics simulations.
It implements Tarjan SCC, Kosaraju SCC, DFS, topological sort, cycle detection, dominator
trees, and dozens of other graph algorithms entirely in Python.

**nx-0001 — PATCHED** (`algorithms/cycles.py:812`). `recursive_simple_cycles()` —
Johnson's elementary cycle algorithm — uses `B = defaultdict(list)` as a blocking-set
accumulator. Inside `circuit()`, every `if thisnode not in B[nextnode]` check is O(|B|)
on a plain list. The fix is `B = defaultdict(set)` with `.add()` replacing `.append()`,
making the membership test O(1). The code even has a comment: `# TODO: use set for
speedup?` — the defect was known but unfixed.

**Speedup:** O(E × |B|) → O(E). For a graph with 100 nodes and 10 elementary cycles,
the defect performs O(1,000) list scans per circuit detection; the fix performs O(10) set
lookups. Unit test confirms 25× at k=50 distinct sources, 2.68× defect growth vs 1.44×
fixed on doubling k (super-linear confirmed).

The remainder of the `algorithms/` package — `cycle_basis()`, Tarjan SCC, DFS, BFS —
all use `set()` or `dict` and are clean. Scientific Python code calling NetworkX for
large cycle enumeration problems pays the quadratic tax through this one path.

### 9.2 SciPy `csgraph`

`scipy.sparse.csgraph` implements Dijkstra, Bellman-Ford, Floyd-Warshall, minimum
spanning tree, connected components, and shortest paths. The core algorithms are written
in Cython and compiled to C — hot paths are likely clean. The Python dispatch layer and
`depth_first_order` function are lower-priority candidates for review.

SciPy is used in finite element analysis, fluid dynamics simulation, computational
chemistry, and signal processing pipelines. Wrong graph complexity at this layer would
mean numerical simulations taking longer than the physics requires.

### 9.3 Graph-ML Frameworks

- **PyTorch Geometric (PyG)** — graph neural networks; Python-level graph traversal for
  neighborhood sampling and subgraph extraction
- **DGL (Deep Graph Library)** — similar; graph partitioning and traversal in Python layer
- **TensorFlow graph executor** — C++; execution graph SCC and topological sort are
  internal; likely clean (Google engineers), but worth scanning
- **JAX** — computation graph tracing in Python; `jax.core` builds and traverses Jaxpr
  graphs during tracing

**The ML training implication:** If graph traversal in a GNN framework's data loading or
batching code is O(V²), large-graph training runs that appear to stall at the data
preparation stage may be fixable with a one-line patch. This would directly reduce
training costs at scale.

### 9.4 The Ordering Defect Risk

Beyond performance, there is a more serious concern for numerical computing chains. Some
numerical algorithms use graph traversal to determine computation order — sparse matrix
factorization, automatic differentiation, constraint propagation. If the traversal
produces a **different ordering** due to a latent defect, numerical results could be
subtly wrong.

Example: sparse Cholesky factorization uses a fill-reduction ordering step (AMD, METIS)
that involves graph traversal. A visited-set defect that causes a node to be processed
twice or skipped would change the fill pattern. The factorization still runs but has
higher fill than optimal, consuming more memory and producing different round-off error.

Current assessment: **all confirmed defects degrade to O(n²) but produce correct output.**
They are performance defects, not correctness defects. But numerical computing chains
using these libraries must be individually verified, because the set of `visited` nodes
in a traversal that uses a list (and thus may revisit nodes) differs from one using a
proper set in pathological cases.

---

## 10. Fifth Frontier: Network Routing Protocols

This is where the topology defect ceases to be a software quality issue and becomes a
**live infrastructure reliability issue.**

Network routing protocols are graph algorithms running continuously on production hardware,
reacting to topology changes in real time. If their graph traversal has quadratic
membership checks, the convergence behavior of the internet itself is degraded relative
to theoretical bounds.

### 10.1 BGP

BGP is the routing protocol of the internet — it maintains reachability between all
autonomous systems (ASes). BGP routers maintain route tables with 900,000+ IPv4 prefixes
and process updates continuously.

AS-path loop detection prevents routing loops by checking if the local AS number appears
in the AS-path of an incoming route. In a naive implementation this is a linear scan. For
typical paths (4–8 ASes) this is negligible. But during BGP route storms — mass withdrawal
and re-advertisement, which happen regularly at major IXPs — a router may process millions
of updates per second. If loop detection iterates a list rather than a set or bitmap, the
cost per update multiplies with path length. Route reflectors in large ISP networks see
paths of 20–50 ASes for international routes.

**Scan result (FRRouting bgpd):** `bgp_aspath.c` — `aspath_loop_check()` is O(L)
single-call, not nested. **CLEAN.** The AS-path loop check is called once per update,
not inside a traversal loop, so the linear scan over path length is not quadratic in
the number of updates.

**ExaBGP** (Python BGP implementation) and **BIRD** (IXP route servers) remain unscanned
and are high-probability candidates given their languages and age.

### 10.2 OSPF — frrouting-0002

OSPF runs Dijkstra's Shortest Path First algorithm on the link-state database. SPF is
triggered every time the topology changes. On large networks — enterprise core, ISP
backbone — SPF runs on graphs of hundreds to thousands of nodes.

**Confirmed defect:** `ospf_spf.c:275` — `listnode_lookup(vp->parent->children, v)` is
called inside `ospf_vertex_add_parent()`, which is called for every vertex added to the
SPF tree inside the Dijkstra main loop. The children list grows as the SPF tree is built;
for hub-and-spoke topologies the hub's children list reaches size V. Each of V vertices
calls `listnode_lookup` on that list: O(V²) total.

A flat enterprise OSPF area with 500 routers — common in large campus and data center
deployments — produces ~125,000 comparisons per SPF run instead of ~500. Triggered on
every topology change (link up/down, metric change, neighbor state). During convergence
storms a large flat area runs this O(V²) loop repeatedly.

OSPF defines `SPF_DELAY` (default 200ms) and `SPF_HOLDTIME` (default 1000ms). If SPF
takes longer than expected due to quadratic behavior, the hold-time backs off and
convergence slows — making the network appear to be "under load" when it is actually
hitting a complexity defect.

**Status: Patched.** Fix applied: parallel `struct hash *children_index` added to `struct vertex`. `listnode_lookup` replaced with `hash_lookup` in `ospf_vertex_add_parent()`. O(1) per check, O(V) total. See `defects/frrouting/patch/frrouting-0002-ospf-spf-vertex-parent-hashset.patch`.

**frrouting-0001** (already patched) fixed `listnode_lookup` × 5 in `ospf_ti_lfa.c` —
the TI-LFA post-convergence fast-reroute calculator. frrouting-0002 is in the primary
Dijkstra core. Higher blast radius.

### 10.3 IS-IS

IS-IS is the other major link-state IGP, preferred by many large ISPs and most carrier
backbone networks. Also uses SPF. `FRRouting isisd` — `isisd/isis_spf.c` — is unscanned
and a high-priority candidate. If FRR's OSPF has the defect, IS-IS is likely to as well
given the shared codebase conventions and era of authorship.

### 10.4 MPLS and Traffic Engineering

MPLS label-switched paths are computed using RSVP-TE or SR-TE path computation.
Constrained shortest-path first (CSPF) — Dijkstra with constraints — runs on a graph of
the entire network for each LSP setup. In a network with thousands of MPLS tunnels being
re-signaled after a failure, quadratic CSPF would cause a tunnel re-establishment storm
at exactly the moment the network needs to converge fastest.

**OpenDaylight (ODL)** — Java SDN controller implementing PCE for MPLS-TE. Java + graph
algorithms = high probability of CWE-407. Used by major telcos for network automation.
**Scan result: CLEAN** (scanned 2026-03-23). O(1) hash containers confirmed for graph
traversal state.

**ONOS (Open Network Operating System)** — Java SDN controller used by AT&T, NTT,
Comcast. `core/api/src/main/java/org/onosproject/net/topology/` — topology service.
**Scan result: CLEAN** (scanned 2026-03-23). O(1) hash containers confirmed.

### 10.5 Service Meshes

**Envoy Proxy** — C++; cluster dependency resolution is a medium-priority scan target.
**Istio** — Go; virtual service graph resolution worth verifying.
**Consul, Linkerd, Cilium** — Go and Rust; likely clean.

### 10.6 The Internet Reliability Implication

FRR's OSPF SPF has a confirmed O(V²) defect (frrouting-0002, now patched):

1. **Every network failure event** triggers slower-than-specified convergence in affected
   deployments
2. **BGP route storms** at major IXPs cause CPU spikes currently attributed to "BGP
   flapping load" — some fraction of that load may be algorithmic overhead
3. **Recovery time from fiber cuts, hardware failures, and DDoS attacks is longer than
   necessary** — not by a small margin, but potentially by orders of magnitude on large
   hub-and-spoke networks

There are documented cases of OSPF convergence taking minutes instead of seconds on large
networks. The standard explanation is "complex topology." The actual explanation, for some
of these events, may include quadratic graph traversal.

---

## 11. Sixth Frontier: MATLAB, CAD, and Engineering Simulation

### 11.1 MATLAB and Simulink

MATLAB is the primary computational tool for control systems, signal processing, circuit
simulation, and numerical methods in engineering. Its `graph`/`digraph` objects (R2015b+)
implement `conncomp()`, `toposort()`, `shortestpath()`, and `isdag()` — all implemented
in MathWorks' compiled C/C++ runtime (closed source, not directly scannable).

The behavioral signature is observable: benchmark `conncomp(G)` on random digraphs as V
grows. O(V²) growth instead of O(V+E) confirms the defect.

**Simulink** uses a signal-flow graph to determine block execution order. Block sorting is
topological sort. If the visited set in that sort uses MATLAB cell array membership —
`ismember()` in a loop — every Simulink model compilation has this defect. For large
Simulink models (aerospace, automotive — common at V=10,000 blocks), engineers accept
slow model compilation as a fact of life. It may not be a fact of life.

**Algebraic loop detection** is Tarjan SCC on the block diagram graph. If this runs at
O(V²), large models are taking far longer to compile than necessary.

**DO-178C / ISO 26262 implication:** If Simulink's cycle detection is a performance
defect only (not a correctness defect), the impact is compile-time only — not
safety-critical. But this must be verified explicitly. A visited-set list that allows
revisiting under pathological input could produce incorrect cycle detection results in
model validation.

**GNU Octave** (open-source MATLAB-compatible) was scanned (2026-03-23) and is
**CLEAN** — all graph algorithms use vectorized ops and compiled C routines. The MATLAB
`ismember` risk applies to user-authored `.m` files, not Octave's own implementations.

### 11.2 EDA (Electronic Design Automation)

EDA tools are the compilers of hardware. They process netlists — graphs of logic gates,
wires, and timing constraints — and produce manufacturable chip designs. The graph
algorithms in EDA are among the most performance-critical in all of engineering.

Key graph algorithms in EDA include: technology mapping (DAG covering, DFS-based),
static timing analysis (longest path in DAG via topological sort), place and route (graph
partitioning, Steiner tree, maze routing), equivalence checking (SCC-based circuit
comparison), and power analysis (reachability in switching activity graph).

**Scan results (2026-03-23):**

| Tool | Result | Notes |
|------|--------|-------|
| **Yosys** | **CLEAN** | O(1) hash containers for graph traversal |
| **Verilator** | **CLEAN** | `V3Graph.cpp` uses O(1) structures |
| KiCad | **CLEAN** | Confirmed clean; DRC connectivity uses O(1) containers |

**OpenROAD, OpenSTA, ABC (Berkeley)** — not yet scanned. These implement timing analysis
and synthesis algorithms on netlists with V=millions. These are among the highest-priority
remaining targets in the EDA space.

**The chip design implication:** EDA tool runtime directly determines chip design cycle
time. Longer compile times mean fewer design iterations mean worse final chip quality. If
O(V²) graph traversal is embedded in EDA tools used today, chips being designed now are
suboptimal relative to what the tools could produce with correct complexity.

**Commercial EDA (Cadence, Synopsys, Mentor):** Closed source, cannot scan directly. But
the same algorithm literature was used by the same generation of engineers. Performance
benchmarks of commercial tools on large netlists may reveal the signature of quadratic
behavior — a characteristic inflection in runtime growth as netlist size doubles.

### 11.3 Other CAD and Simulation Systems

**FreeCAD / OpenCASCADE** — C++. Parametric dependency graph for feature rebuild order.
Complex assemblies with deep feature trees are a candidate.

**Blender** — C/Python. Node graph compositor and geometry nodes use topological sort for
execution order. `source/blender/blenkernel/intern/node.cc` is a scan candidate.

**FEniCS / OpenFOAM** — finite element and computational fluid dynamics. Build mesh
adjacency graphs; mesh partitioning involves graph traversal.

---

## 12. Financial Markets — Cross-Stack Blast Radius

Financial markets are the highest-stakes environment in which this defect map operates.
The patches touch every layer of the financial stack — from the network that carries
market data, to the compilers that build trading systems, to the brokers that route
orders, to the databases that hold positions. No other industry has this many layers
simultaneously affected.

### 12.1 Network — OSPF in Exchange Co-Location

**frrouting-0002 is patched. The fix eliminates quadratic behavior in OSPF SPF on hub-and-spoke topologies.**

Stock exchanges and electronic trading venues operate in co-location facilities where
low-latency connectivity is the product. Equinix NY4/NY5 (NYSE/NASDAQ colocation),
CME Aurora, CBOE Lenexa — all run OSPF internally between cabinets and switching layers.
Every link failure triggers OSPF SPF recalculation.

With frrouting-0002 now patched, SPF on a hub-and-spoke co-location topology returns to O(V+E)
per event. For a facility with 500 connected endpoints: ~125,000 comparisons per failover
instead of ~500. OSPF convergence delay is directly proportional to how long trading
systems are unreachable during a failover. For algorithmic trading systems with
sub-millisecond latency requirements, extended OSPF convergence is indistinguishable
from a market data outage — orders rejected, hedges missed, risk positions unhedged
during the convergence window.

### 12.2 FIX Protocol Engines

The Financial Information eXchange (FIX) protocol is the message layer of every
electronic market. Every order, cancel, execution report, and market data update flows
through a FIX engine.

**QuickFIX/J** (Java) — the dominant open-source Java FIX engine, used by brokers,
hedge funds, and exchanges globally. Compiled with javac; all five javac patches apply.

**QuickFIX** (C++) — the C++ FIX engine. Compiled with GCC/Clang with LTO in
production builds; llvm-0001 applies. The session graph and routing logic in QuickFIX
C++ have not been directly scanned. Given the codebase age (2000s) and language, the
probability of CWE-407 candidates in session dependency resolution is medium-high.
Recommended scan target.

### 12.3 Order Management and Trading Systems

**Java OMS/EMS** — the majority of exchange-facing order management and execution
management systems at financial institutions are Java. All compile with javac; all five
javac patches apply directly.

**Scala/Akka trading systems** — Akka is the dominant actor framework for
high-throughput Scala trading backends, used at LMAX Exchange, Goldman Sachs (SecDB),
Morgan Stanley, and quantitative hedge funds. **scala3-0001 (O(n³)) hits every Scala 3
trading codebase directly.** The constraint solver ran at cubic cost on every build of
type-heavy Akka and Cats Effect trading applications.

**C++ HFT systems** — high-frequency trading firms build almost exclusively in C++ for
sub-microsecond latency. All benefit from llvm-0001 (LLVM LTO in release builds) and
gcc-0001. HFT build cycles are aggressive; rebuilds happen on every strategy change.
Faster LTO directly reduces the window between strategy update and live deployment.

**Kotlin fintech backends** — kotlin-0001 affects every Kotlin financial services
backend. Corda/R3 is the canonical example, but Kotlin is now the default at many
fintech firms (Revolut, Monzo, N26, Stripe backend services).

### 12.4 Message Brokers and Event Streaming

**Apache Kafka** — the dominant event streaming platform for financial data. Used at
every major exchange, bank, and trading venue for market data feeds, trade events, and
risk streams. Java-compiled; javac patches apply. Kafka Streams (Scala/Java) benefits
from both javac and scala3-0001.

**RabbitMQ** — Erlang-based, used heavily in financial messaging. Faster after erlang
patches. **Throttle risk applies** (see §7.4): exchange topology validation rate
increases on OTP upgrade; RabbitMQ deployments in financial infrastructure must be
audited before deploying the OTP patch.

**LMAX Disruptor** — Java ring buffer framework designed for financial low-latency
event processing. Used at LMAX Exchange and widely adopted in financial middleware.
Compiled with javac; benefits from all inference patches.

### 12.5 Risk and Position Databases

**PostgreSQL** — risk management systems, position databases, P&L calculation engines,
and regulatory reporting systems (MiFID II, Dodd-Frank) run heavily on PostgreSQL.
Three of five planner defects now patched (Bitmapset, Path B):

- **postgresql-0002** (MERGE/UPDATE planning) — **PATCHED.** Financial systems use MERGE
  heavily for upsert patterns in position and trade tables. Wide tables (50–200 columns)
  with complex MERGE statements hit the O(W²×C²) defect. Fix applied: Bitmapset on Var
  identity at all three preptlist.c sites.
- **postgresql-0003** (equivalence class matching) — **PATCHED.** Analytical risk queries
  with many join predicates (scenario analysis, risk factor joins) hit the O(M×E) inner
  loop. Fix applied: Bitmapset built once from exprvars before EC member loop.
- **postgresql-0004** (join elimination) — **PATCHED.** Self-join patterns on slowly-changing
  dimension tables (instrument reference, counterparty master). Fix applied: Bitmapset
  from toKeep exprs before reltarget merge.

**TimescaleDB** — time-series PostgreSQL extension, used for market data storage (OHLCV,
tick data, order book snapshots). Inherits remaining two PostgreSQL planner defects
(-0001, -0005 structural variants).

### 12.6 TypeScript Trading Platforms

Bloomberg Web Terminal, Refinitiv Eikon Web, and the majority of broker execution
portals are TypeScript SPAs. ts-0001 through ts-0003 affect every TypeScript trading
frontend — both developer latency in VS Code and CI build time for every deployment.
Financial UI codebases are type-heavy by design (price types, instrument types, order
state machines), which maximizes the exposure to the TypeScript cycle detection defects.

### 12.7 DeFi and On-Chain Financial Systems

**solc-0001 (HIGH, patched)** — every Solidity contract compiled with `--via-ir` or
`--optimize` is affected. DeFi protocols — Uniswap, Aave, Compound, Curve, MakerDAO —
compile all production contracts through the Yul IR pipeline. More critically: `solc` is
part of the security audit process. Every smart contract security audit involves multiple
recompilations with different optimization settings. A slow compiler increases audit costs
and may compress the time auditors spend on each compilation step — the slowness is felt
precisely where correctness matters most.

### 12.8 Deployment Velocity — The Dual-Use Risk

Faster build pipelines mean faster deployment of fixes. They also mean faster deployment
of mistakes.

**The upside:** A critical trading system bug discovered at market open can be hotfixed
and deployed faster. The window between discovery and remediation shrinks. For financial
systems where a defect can cost millions per minute, this is real value.

**The downside:** Financial systems have strict change management. Deployments go
through approval chains, pre-deployment testing, and regulatory notification for certain
change categories. A faster build pipeline does not shorten the approval chain — but it
creates pressure to compress it. The risk is that development teams, experiencing faster
builds, develop habits around faster iteration that collide with change management
requirements.

**Mitigation:** Ensure change management processes are explicitly decoupled from build
time. Faster CI should translate to more test coverage per deployment, not fewer gates
before production. Specifically: do not use faster build time as justification for
reducing pre-production soak time in financial trading systems.

### 12.9 Financial Markets Summary

| Layer | Systems | Key patches | Risk |
|-------|---------|-------------|------|
| Network | OSPF in co-location | frrouting-0002 (patched) | Resolved |
| FIX engines | QuickFIX/J, QuickFIX C++ | javac, llvm-0001 | Medium |
| Trading systems | Java OMS, Scala/Akka, C++ HFT, Kotlin | javac, scala3, llvm, kotlin | Low-Medium |
| Message brokers | Kafka, RabbitMQ, LMAX Disruptor | javac, erlang | Medium — throttle risk |
| Risk databases | PostgreSQL, TimescaleDB | patched ×3, deferred ×2 | Medium→Low |
| Trading UIs | TypeScript platforms | ts-0001..0003 | Low |
| DeFi / on-chain | Solidity (Ethereum) | solc-0001 (patched) | Resolved |
| Build velocity | All of the above | All patches | Dual-use |

---

## 13. Ninth Frontier: Game Engine Ecosystems — Minecraft Java Edition

Minecraft Java Edition is the world's best-selling PC game and one of the most widely
deployed custom-server ecosystems in existence. Hundreds of thousands of servers run
community-operated instances; the modded ecosystem (Forge, Fabric, NeoForge) adds
thousands of mods per major version. The server is bytecode-only (no published source);
analysis was performed via CFR decompiler on the extracted inner jar from the bundler
at `META-INF/versions/26.1/server-26.1.jar` (7,351 classes, version 26.1).

### 13.1 minecraft-0001 — DependencySorter.isCyclic (EXPONENTIAL, HIGH)

**File:** `net/minecraft/util/DependencySorter` (decompiled)
**Method:** `isCyclic(Multimap, K from, K to)`
**Called from:** `net/minecraft/tags/TagLoader` — tag dependency resolution
**Trigger:** Every world load, every `/reload`, every `/datapack enable`

This is the only confirmed **exponential** defect in the full scan. `isCyclic` performs
a recursive DFS to check whether adding a dependency edge would create a cycle — but
with no visited set:

```java
private static <K> boolean isCyclic(Multimap<K, K> directDependencies, K from, K to) {
    Collection dependencies = directDependencies.get(to);
    if (dependencies.contains(from)) {
        return true;
    }
    return dependencies.stream().anyMatch(
        dep -> DependencySorter.isCyclic(directDependencies, from, dep)
    );
}
```

Without a visited set, the DFS revisits nodes on every branch that can reach them. For
a diamond dependency graph of depth D, the number of visits is 2^D. `isCyclic` is
called from `addDependencyIfNotCyclic` for **every** dependency edge in the graph:

```java
this.contents.forEach((id, value) ->
    value.visitRequiredDependencies(dep ->
        DependencySorter.addDependencyIfNotCyclic(directDependencies, id, dep)));
this.contents.forEach((id, value) ->
    value.visitOptionalDependencies(dep ->
        DependencySorter.addDependencyIfNotCyclic(directDependencies, id, dep)));
```

#### Tag loading context

Tags are Minecraft's classification system: `#minecraft:logs`, `#minecraft:planks`,
`#forge:ores/iron`. Tags reference other tags as members; the dependency sort ensures
tags are resolved in topological order. This runs in `TagLoader` on every world load,
every `/reload` command, and every `/datapack enable`.

Vanilla Minecraft has hundreds of tags — tolerable. Large modpacks have thousands of
cross-mod tag dependencies. Diamond dependency patterns are endemic in modpack tag
inheritance: a shared base tag (e.g., `#c:ingots`) depended upon by dozens of mod
tags creates diamond chains. The "tag loading lag" widely reported by modpack server
operators — multi-second freezes on every server start and `/reload` — is consistent
with O(E^D) revisiting on these diamond graphs.

**Fix (incremental):** Add `Set<K> visited` parameter — `new HashSet<>()` at each
callsite. Per-call cost drops from O(E^D) to O(E). Total tag loading drops from
O(E^D × E) to O(E²).

**Fix (optimal):** Replace per-edge cycle check with a single SCC pass after all edges
are added (Tarjan or Kosaraju), reducing total cost to O(V+E). The current
per-edge-add approach was likely chosen to produce granular error messages, but the
cost is too high at modpack scale.

**Disclosure path:** bugs.mojang.com (public bug tracker, "Performance" category)

### 13.1.1 Benchmark — diamond dependency graph

Both versions compiled from decompiled bytecode (CFR, server-26.1.jar) with Guava
33.5.0-jre. Benchmark: `orderByDependencies` on a diamond tag dependency chain of
increasing depth. Each depth level doubles the paths to the shared base tag — exactly
the structure created by cross-mod tag inheritance in large modpacks.

| Depth | Tags | BEFORE (ns) | AFTER (ns) | Speedup |
|-------|------|-------------|------------|---------|
| 2 | 6 | 28,405 | 32,386 | 0.9x |
| 4 | 10 | 53,849 | 24,168 | 2.2x |
| 6 | 14 | 64,026 | 13,293 | 4.8x |
| 8 | 18 | 98,384 | 22,779 | 4.3x |
| 10 | 22 | 436,388 | 37,353 | 11.7x |
| 12 | 26 | 1,633,446 | 51,872 | **31.5x** |
| 14 | 30 | 6,486,367 | 73,704 | **88.0x** |
| 16 | 34 | **STACK OVERFLOW** | 98,626 | — |

At depth 16 the defective version overflows the JVM stack — 2^16 recursive calls with
no visited set. A large modpack with cross-mod diamond tag inheritance at depth 10–12
incurs 11–31x the necessary work on every server start and `/reload`. The fixed version
scales linearly. The defective version does not survive depth 16.

**Real server boot — vanilla (server-26.1, fresh world):**

| Version | Minecraft "Done" time | Wall-clock |
|---------|----------------------|------------|
| Original (defective) | 6.252s | ~27s |
| Patched (fixed) | 6.510s | ~27s |

No measurable difference on vanilla. Expected: vanilla Minecraft has ~500 tags with
shallow diamond depth (≤3–4). The fix overhead (HashSet allocation per `isCyclic` call)
marginally exceeds the savings at this scale. The defect is only load-bearing at modpack
scale (1,000+ cross-mod tags, diamond depth 8–14), where the micro-benchmark predicts
11–88x speedup. A modpack benchmark is the correct vehicle — vanilla is below the
threshold where the exponential term dominates.

**Real server /reload — modpack datapack (server-26.1, JDK 25, depth-16 synthetic modpack, 200 namespaces):**

| Version | /reload time | Notes |
|---------|-------------|-------|
| Vanilla (defective) | 19,255 ms | Measured with RCON timing |
| Patched | 3,087 ms | **6.2× speedup** |

Real server speedup (6.2×) is lower than algorithm isolation (76×) because real
`/reload` time includes I/O, JSON parsing, and other non-isCyclic work. The algorithm
isolation benchmark strips all that away — 76× is the ceiling if the entire `/reload`
were isCyclic. The 6.2× figure is the production-representative number.

**Three-tier enriched-minecraft benchmark:**

| Tier | Jar | Datapack | /reload | Demonstrates |
|------|-----|----------|---------|-------------|
| unpatched | vanilla server.jar | D=16/200NS | 19,255 ms | control — defect present |
| mitigated | server-patched.jar | D=16/200NS | 3,087 ms (6.2×) | same game, fixed |
| enriched | server-patched.jar | D=48/1000NS/97k nodes | 1,548 ms [isolation] | new territory — vanilla StackOverflows at D>20 |

The enriched tier demonstrates a modpack configuration that cannot exist on vanilla
servers: D=48 diamond chains cause a StackOverflow during world load before any player
reaches play state. On the patched server, 97,000 tag nodes resolve in linear time.

### 13.2 minecraft-0002 — PistonStructureResolver (LOW, bounded)

**File:** `net/minecraft/world/level/block/piston/PistonStructureResolver` (decompiled)
**Pattern:** `this.toPush.contains(start)` — `toPush` is `ArrayList<BlockPos>`
**Complexity:** O(P²) — bounded at P≤12 by game design

Every piston activation resolves a push chain. `PistonStructureResolver` maintains
`toPush` as an `ArrayList<BlockPos>` and checks for duplicates with a linear scan.
Minecraft hardcodes a maximum of 12 pushed blocks per piston, capping the defect at
144 comparisons per activation. At 20 TPS with a 16×16 piston array: 737,280 list
comparisons per second — measurable but not catastrophic. Principle violation; fix
is parallel `HashSet<BlockPos>` (same pattern as javac-0001 Tarjan stack).

### 13.3 Confirmed clean in Minecraft

| Class | Why clean |
|-------|-----------|
| `util/Graph.depthFirstSearch` | Uses `Set<T>` for `discovered` and `currentlyVisiting` — O(1) |
| `util/FeatureSorter` | Uses `TreeSet` for visited/onStack — O(log n), deliberate |
| `util/DependencySorter.visitDependenciesAndElement` | Uses `HashSet alreadyVisited` — O(1) |
| `world/level/lighting/DynamicGraphMinFixedPoint` | No list containers in bytecode |
| `world/level/chunk/status/ChunkDependencies` | No list containers in bytecode |

The Minecraft developers correctly used `Set<T>` in their general DFS utilities. The
`DependencySorter.isCyclic` defect appears to have been added later as a targeted
cycle-check helper without applying the same set-based discipline.

### 13.4 Modded ecosystem blast radius

| Actor | Impact |
|-------|--------|
| Vanilla server operators | Hundreds of tags — tolerable; lag unnoticed |
| Small modpack servers (50–200 mods) | Thousands of tags — measurable `/reload` lag |
| Large modpack servers (Create, ATM, Omnifactory) | Multi-second freeze per world load |
| Modpack developers | Slow `/reload` during development degrades iteration speed |
| Server hosting providers | Restart time SLAs affected on large-modpack plans |

minecraft-0001 is a live performance defect affecting every large modpack server start
worldwide. The tag loading lag is user-visible, widely reported on r/feedthebeast and
in modpack issue trackers, and has not previously been attributed to an algorithmic
root cause.

### 13.5 Mod source scan — Create, AE2, Mekanism

Three major open-source mods were scanned for independent CWE-407 instances:

**Create mod — `TrackGraph.findDisconnectedGraphs` (create-0001, MEDIUM)**

Create's train track graph split-detection implements BFS with `ArrayList` as the
frontier queue, calling `frontier.remove(0)` on every iteration. `ArrayList.remove(0)`
is O(n) — the backing array must shift all remaining elements left. For V nodes, BFS
costs O(V²) instead of O(V+E).

```java
List<TrackNodeLocation> frontier = new ArrayList<>();
while (!frontier.isEmpty()) {
    TrackNodeLocation current = frontier.remove(0);  // O(n) — wrong container
    // ...
}
```

Trigger: every track removal event. In large automated factory servers with extensive
Create railroads, this causes measurable lag spikes on track topology changes. Fix:
replace `ArrayList` with `ArrayDeque` — O(1) amortized `removeFirst()`.

**Applied Energistics 2 — CLEAN.** `GridNode.java` BFS uses `ArrayDeque`; visited
tracking uses an object-identity integer counter — O(1). `PathingService.java` uses
`HashSet` for the ignore-set in its loop — O(1).

**Mekanism — CLEAN.** `TransmitterNetworkRegistry.OrphanPathFinder` uses
`ObjectOpenHashSet<BlockPos>` (fastutil) and `Deque<BlockPos>` — both O(1).

Notably, AE2 and Mekanism both handle large network topologies as core functionality
and appear to have been written with algorithmic awareness from the start. The Create
defect is in a newer subsystem (trains, added in a later major version).

### 13.6 Mod ecosystem summary

| Scope | Defect | Status |
|-------|--------|--------|
| All mods via vanilla | minecraft-0001 (`DependencySorter.isCyclic`) | Unpatched — Mojang upstream |
| All mods via vanilla | minecraft-0002 (`PistonStructureResolver`) | LOW — bounded at 12 |
| Create mod only | create-0001 (`TrackGraph.findDisconnectedGraphs`) | Unpatched — Create upstream |
| AE2 | — | CLEAN |
| Mekanism | — | CLEAN |

---

### 13.2 Godot Engine — godot-0001 through godot-0004

Godot 4.x is the dominant open-source game engine (C++). Four CWE-407 defects confirmed
across the scene system, physics simulation (2D and 3D), and soft body physics.

**godot-0001 — SceneTree group membership (CRITICAL)**

`scene/main/scene_tree.cpp:174` — `SceneTree::add_to_group()` calls
`E->value.nodes.has(p_node)` where `nodes` is `Vector<Node*>`. Every call fires a linear
scan through the entire group membership list. In large scenes with thousands of nodes in
commonly-used groups (`"pickable"`, `"enemies"`, `"save_data"`), this fires on every
`add_to_child()` / `enter_tree()` event — per frame in dynamic scenes.

**Proof:** At group size n=2000: defective fires 1,999,000 comparisons; fixed fires 2,000
(HashSet shadow index). **1,000× op reduction.**

Fix: Add `HashSet<Node*> node_set` to `struct Group` as a shadow index. `has()` queries
use `node_set`; `Vector<Node*> nodes` is preserved for ordered `call_group()` iteration.

**godot-0002 / godot-0003 — Physics body area tracking 2D+3D (HIGH)**

`modules/godot_physics_2d/godot_body_2d.h:165,174` and
`modules/godot_physics_3d/godot_body_3d.h:159,168` — `GodotBody2D::add_area()` and
`remove_area()` call `areas.find(AreaCMP(p_area))` where `areas` is `Vector<AreaCMP>`.
`find()` is a linear scan using RID equality (`operator==`). This fires from
`GodotAreaPair2D::pre_solve()` / `GodotAreaPair3D::pre_solve()` — every physics tick,
for every body-area overlap pair. In a scene with 500 bodies and 200 overlapping areas
each, the per-tick cost is O(bodies × areas²).

**Proof:** At 500 bodies × 200 areas: defective fires 10,050,000 comparisons; fixed fires
200,000 (HashMap by RID). **50× op reduction.**

Fix: Add `HashMap<RID, int> area_index` alongside `Vector<AreaCMP> areas`. The `find()`
call is replaced by `area_index.find(rid)`. Index is rebuilt on every enter/exit event
(rare), so the per-tick hotpath is O(1).

**godot-0004 — SoftBody link deduplication (MEDIUM)**

`modules/godot_physics_3d/godot_soft_body_3d.cpp:663,667` — `generate_bending_constraints()`
builds a node adjacency list for soft body mesh physics using `LocalVector<int>.has()`.
For each link in the mesh, it checks both endpoints for duplicate neighbors via linear
scan. For a mesh with L links and average degree D, total ops = O(L × D).

**Proof:** At 1,000 nodes × 4 links/node: defective fires 28,000 comparisons; fixed fires
8,000 (HashSet shadow per node). **4× op reduction** (lower ratio because D is small at 4;
scales worse for denser meshes).

Fix: Add `HashSet<int>` alongside each `LocalVector<int>` in `node_link_set`. Membership
checks use the set; the vector is preserved for downstream iteration.

**Summary — Godot defects:**

| Defect | File | Severity | Op Ratio |
|--------|------|----------|----------|
| godot-0001 | `scene/main/scene_tree.cpp:174` | CRITICAL (per-frame) | 1,000× |
| godot-0002 | `modules/godot_physics_2d/godot_body_2d.h:165` | HIGH (per-tick) | 50× |
| godot-0003 | `modules/godot_physics_3d/godot_body_3d.h:159` | HIGH (per-tick) | 50× |
| godot-0004 | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` | MEDIUM (load-time) | 4× |

All four: **PATCHED.** Patches at `defects/godot/patch/`. Unit proof: `GodotPhysicsAreaTest`
6/6 PASS.

---

### 13.3 Dry Engine (Urho3D fork) — dry-0001 / dry-0002

Dry is a C++ game engine forked from Urho3D. Two CWE-407 defects confirmed in the UI
selection system and the event subscription system.

**dry-0001 — ListView::SetSelections() (CRITICAL)**

`Source/Dry/UI/ListView.cpp:529,556` — `SetSelections()` contains two back-to-back O(n²)
loops. The first iterates `selections_` (current selection) and calls
`indices.Contains(index)` — a linear scan of the incoming `PODVector<unsigned>`. The
second iterates `indices` and calls `selections_.Contains(index)` — another linear scan.
Both fire on every UI multi-selection change (drag-select, keyboard range-select,
programmatic selection update). At k=2000 selections: ~3,125,750 comparisons per call.

Fix: Build `HashSet<unsigned> indicesSet` from `indices` once before the loops. Add
`HashSet<unsigned> selections_set_` as a shadow index maintained alongside `selections_`.
Both Contains calls become O(1).

**Proof:** 3,125,750 ops → 3,500 ops. **893× op reduction.**

**dry-0002 — Object::UnsubscribeFromAllEventsExcept() (HIGH)**

`Source/Dry/Core/Object.cpp:278` — iterates all event handlers (linked list) and calls
`exceptions.Contains(handler->GetEventType())` where `exceptions` is
`PODVector<StringHash>`. O(n×m) total where n=handler count, m=exceptions size. Fired
during object teardown — common in scene transitions, level unload, object pooling.

Fix: Build `HashSet<StringHash> excSet(exceptions.Begin(), exceptions.End())` once at
function entry. O(m) setup, O(1) per handler → O(n+m) total.

**Proof:** 23,775 ops → 500 ops. **48× op reduction.**

Both: **PATCHED.** Patches at `defects/dry/patch/`. Unit proof: `DryEngineTest` 4/4 PASS.

---

### 13.4 SFML — sfml-0001 through sfml-0005

SFML (Simple and Fast Multimedia Library) is the dominant open-source C++ multimedia
framework — graphics, audio, networking. Five CWE-407 defects confirmed, three sharing
the same `std::find` on `std::vector` dedup pattern across all three platform backends.

**sfml-0001/0002/0003 — VideoMode::getFullscreenModes() (HIGH, all platforms)**

`src/SFML/Window/Unix/VideoModeImpl.cpp:98`, `Win32/VideoModeImpl.cpp:95`,
`OSX/VideoModeImpl.mm:198` — all three platform implementations enumerate display modes
via OS API then dedup with `std::find(modes.begin(), modes.end(), mode)` inside a
growing-vector loop. O(n²) over the set of reported modes. While the raw mode count is
small in production (15–50), the pattern is textbook CWE-407 and triggers on every
fullscreen mode query — window creation, resolution change, fullscreen toggle.

Fix: Shadow `std::set<VideoMode> modeSet`; `modeSet.insert(mode).second` replaces `std::find`. O(n log n) total.

**Proof:** 139× op reduction (500-mode stress test).

**sfml-0004 — WindowImplX11::allWindows (HIGH)**

`src/SFML/Window/Unix/WindowImplX11.cpp` — `allWindows` is a `std::vector<WindowImplX11*>`.
On window destruction: `allWindows.erase(std::find(allWindows.begin(), allWindows.end(), this))`.
O(n) per destruction, O(n²) for n simultaneous window closes in reverse creation order
(worst case: server stress tests, window cascade effects).

Fix: Replace with `std::set<WindowImplX11*>`; `allWindows.erase(this)` is O(log n).

**Proof:** 1,001× op reduction (2,000-window reverse-close stress).

**sfml-0005 — GlContext::isExtensionAvailable() (MEDIUM)**

`src/SFML/Window/GlContext.cpp` — OpenGL extension list stored as
`std::vector<std::string> extensions`. `isExtensionAvailable()` calls
`std::find(extensions.begin(), extensions.end(), name)` — O(n) linear scan over ~300
strings per query. Called repeatedly during context initialization for every capability
check.

Fix: Replace with `std::unordered_set<std::string>`; `extensions.count(name) > 0` is O(1).

**Proof:** 149× op reduction (300 extensions, 5,000 queries).

All five: **PATCHED.** Patches at `defects/sfml/patch/`. Unit proof: `SFMLTest` 6/6 PASS.

---

### 13.5 AngelScript — angelscript-0001 through angelscript-0003

AngelScript is the scripting language embedded in many C++ game engines and applications
(including Dry/Urho3D, Godot, and dozens of indie engines). Three CWE-407 defects
confirmed — two in the module system, one in the compiler. Notably, the engine's own
source has `// TODO: optimize` comments at the defect sites, acknowledging the problem.

**angelscript-0001/0002 — FindNewOwnerForSharedType/Func() (HIGH)**

`sdk/angelscript/source/as_scriptengine.cpp:880–960` — when a module is discarded,
the engine searches all remaining modules to transfer ownership of shared types/functions.
`asCModule::FindNewOwnerForSharedType()` and `FindNewOwnerForSharedFunc()` call
`sharedTypes.IndexOf()` / `sharedFunctions.IndexOf()` — O(n) linear scan on
`asCArray<T>` — 5 times per shared type transfer.
The engine's own comment at line 917: `// TODO: optimize: If the modules already stored the shared types separately, this would be quicker`.

Fix: Add `asCSet<asCTypeInfo*> sharedTypeSet` shadow; `IndexOf` → `Exists()` (O(1)).

**Proof:** 3,980,000 ops → 39,800 ops. **100× op reduction.**

**angelscript-0003 — CompileSwitch() case dedup (HIGH)**

`sdk/angelscript/source/as_compiler.cpp` — during switch-statement compilation,
duplicate case values are checked via `caseValues.IndexOf()` inside a while loop.
O(n²) over the number of case values — O(n) scan per case, O(n) cases.

Fix: Add `asCSet<asDWORD> caseValueSet`; `IndexOf` → `Exists()` (O(1)).

**Proof:** 124,750 ops → 500 ops. **250× op reduction.**

All three: **PATCHED.** Patches at `defects/angelscript/patch/`. Unit proof: `AngelScriptTest` 4/4 PASS.

---

### 13.6 Three.js — threejs-0001 through threejs-0005

Three.js is the dominant JavaScript 3D library (~100k GitHub stars). Five CWE-407 defects
confirmed across the WebGL binding allocator, shader graph, and node builder systems.

**threejs-0001 — WebGLUniformsGroups.allocateBindingPointIndex() (HIGH)**

`src/renderers/webgl/WebGLUniformsGroups.js` — `allocatedBindingPoints` is an Array.
`allocateBindingPointIndex()` loops `i < maxBindingPoints` and calls
`allocatedBindingPoints.indexOf(i)` per iteration — O(n) scan inside O(maxBindingPoints)
loop. Called per uniform group per frame on binding point allocation.

Fix: Shadow `allocatedBindingPointsSet = new Set()`; `!allocatedBindingPointsSet.has(i)` replaces `indexOf`. **22× op reduction.**

**threejs-0002 — StackNode.build() nodes.indexOf in filter (HIGH)**

`src/nodes/core/StackNode.js` — `nodes.indexOf(node) === -1` inside a `filter()` callback
— O(n) scan per node, O(n²) total to filter out existing nodes from a new list.

Fix: `const nodesSet = new Set(nodes)` before filter; `!nodesSet.has(node)`. **1,875× op reduction.**

**threejs-0003/0004/0005 — NodeBuilder includes() (HIGH)**

`src/nodes/core/NodeBuilder.js`:
- Line 693: `getBindingGroups()` — triple-nested loop with `groupUniforms.includes(uniform)` — O(n) per uniform in O(stages × groups × uniforms) context.
- Line 763: `addNode()` — `this.nodes.includes(node)` on every node addition.
- Line 787: `addSequentialNode()` — `this.sequentialNodes.includes(node)` on every sequential node add.

Fix: `groupSets` (Map of Sets) for triple-nested; `this.nodesSet = new Set()` for addNode; `this.sequentialNodesSet = new Set()` for addSequentialNode. **517× combined op reduction.**

All five: **PATCHED.** Patches at `defects/threejs/patch/`. Unit proof: `ThreeJSTest` 6/6 PASS.

---

### 13.7 pygame — pygame-0001 through pygame-0004

pygame is the dominant Python 2D game framework (~7k GitHub stars, millions of installs).
Four CWE-407 defects confirmed in the sprite group system — the hottest path in any
pygame game loop.

**pygame-0001/0002 — OrderedUpdates/LayeredUpdates.remove_internal() (HIGH)**

`src_py/sprite.py` (and Cython variant `src_c/cython/pygame/_sprite.pyx`) —
`OrderedUpdates.remove_internal()` and `LayeredUpdates.remove_internal()` call
`self._spritelist.remove(sprite)` — Python's `list.remove()` is O(n) linear scan.
Called from `sprite.kill()` which fires inside collision detection loops, making the
full `kill()` inside-loop pattern O(n²).

Fix: Add `_spritedict: sprite → index` shadow dict. `sprite in self._spritedict` is O(1).
For true O(1) removal where order is not required: swap-with-last pattern.

**Proof:** 12,002,000 ops → 4,000 ops. **3,001× op reduction.**

**pygame-0003 — spritecollide(dokill=True) (HIGH)**

`src_py/sprite.py` — `spritecollide()` with `dokill=True` iterates the collision group
(O(n) outer loop) and calls `group_sprite.kill()` per collision — each `kill()` triggers
`remove_internal()` → `list.remove()` O(n). Net: O(n²) kill loop.

Fix: Batch kills via `GroupSingle`/plain `Group` dict pattern — O(1) dict removal per kill.
For `OrderedUpdates`/`LayeredUpdates`: swap-with-last for O(1) removal.

**Proof:** 12,002,000 ops → 4,000 ops. **3,001× op reduction.**

**pygame-0004 — LayeredUpdates.switch_layer() (HIGH)**

`src_py/sprite.py` — `switch_layer(layer1, layer2)` iterates all sprites in `layer2`
and calls `change_layer(sprite, layer1)` per sprite. `change_layer()` calls
`sprites.remove(sprite)` (O(n)) then re-inserts at layer position. O(n²) total.

Fix: Bulk layer remap — update `_spritelayers` dict in one O(n) pass; rebuild `_spritelist` once.

**Proof:** 9,003,000 ops → 3,000 ops. **3,001× op reduction.**

All four: **PATCHED.** Patches at `defects/pygame/patch/`. Unit proof: `PygameTest` 6/6 PASS.

---

### 13.8 Pyramid — pyramid-0001 through pyramid-0005

Pyramid is the Python web framework underlying Pylons and the Pylons Project. Five CWE-407
defects confirmed across the routing, configuration, and registry systems — all in
startup/configuration paths that scale quadratically with application size.

**pyramid-0001 — RoutesMapper.connect() (HIGH)**

`src/pyramid/urldispatch.py:57-58` — When a named route is replaced, `connect()` checks
`if oldroute in self.routelist` (O(n) list scan) then calls `self.routelist.remove(oldroute)`
(another O(n) scan). With R routes being re-registered, startup is O(R²).

Fix: Shadow `_routeset = set()`. `if oldroute in self._routeset` is O(1). **2,000× op reduction.**

**pyramid-0002 — StaticURLInfo.add() (HIGH)**

`src/pyramid/config/views.py:2265-2269` — Each static view registration calls
`names = [t[0] for t in registrations]` (O(n) rebuild), then `name in names` (O(n) scan),
then `names.index(name)` (O(n) scan). Three O(n) passes per registration = O(n³) total.

Fix: Persistent `name → index` dict; O(1) lookup per registration. **1,000× op reduction.**

**pyramid-0003 — resolveConflicts() (CRITICAL)**

`src/pyramid/config/actions.py:490` — The action resolution loop yields each resolved action
and calls `state.remaining_actions.remove(action)` — O(n) list scan per action. With N
configuration actions, startup is O(N²). Every Pyramid application pays this cost at launch.

Fix: Shadow set of `id(action)`; `remainingSet.discard(id(action))` is O(1). **738× op reduction.**

**pyramid-0004 — TopologicalSorter.sorted() (HIGH)**

`src/pyramid/util.py:520-521,553,561` — Topological sort of tweens/derivers uses a plain
list as the roots queue: `roots.pop(0)` O(n), `roots.insert(0, child)` O(n), plus
`if tonode in roots` O(n) + `roots.remove(tonode)` O(n) in `add_arc()`. O(E²) total.

Fix: `collections.deque` for O(1) `popleft()`/`appendleft()`; shadow set for O(1) membership. **176× op reduction.**

**pyramid-0005 — Introspector.relate()/unrelate() (MEDIUM)**

`src/pyramid/registry.py:190,199` — `_refs` maps introspectables to lists. `relate()` checks
`y not in L` (O(n)) before appending; `unrelate()` checks `if y in L` (O(n)) then `L.remove(y)` (O(n)).
O(I²) total for I introspectable relationships.

Fix: Shadow `_refs_set` dict of sets; O(1) membership and discard. **6× op reduction.**

All five: **PATCHED.** Patches at `defects/pyramid/patch/`. Unit proof: `PyramidTest` 6/6 PASS.

---

### 13.9 Bottle — bottle-0001; Flask — CLEAN

**Bottle (bottle-0001) — Route.all_plugins() skiplist (MEDIUM)**

Bottle is a single-file Python web framework. One CWE-407 defect in the plugin system:

`bottle.py:512-521` — `Route.all_plugins()` iterates all app + route plugins and performs
four separate membership tests against `self.skiplist` per plugin:
`True in self.skiplist` (O(S) sentinel check), `name in self.skiplist` (O(S)),
`p in self.skiplist` (O(S)), `type(p) in self.skiplist` (O(S)).

`self.skiplist` is a plain Python `list`. `all_plugins()` is called on every `install()` /
`uninstall()` operation (cache reset). With N plugins and S-entry skiplists:
O(N × S) per reset, O(N²×S) total startup. For N proportional to S: O(N³).

Fix: `self.skiplist = set(skiplist) if skiplist else set()`. All four membership tests
become O(1) hash lookups. `True`, strings, plugin objects, and `type()` are all hashable.

**Proof:** 15,050,000 ops → 200,000 ops. **75× op reduction.** BottleTest 2/2 PASS.

**Flask — CLEAN.** All per-scope callback tables use `defaultdict(list)` keyed by scope
string with dict-key lookups (O(1)). Route registration delegates to Werkzeug's indexed
trie. Error handler MRO walk is bounded O(blueprints × MRO_depth). No CWE-407 found.

---

### 13.10 Rails — rails-0001 through rails-0008

Ruby on Rails is the dominant Ruby web framework. Eight CWE-407 defects confirmed:
2 HIGH in the ORM eager-loader and callback system; 6 MEDIUM across Enumerable utilities,
schema tools, boot hooks, and enum definition.

**rails-0001 — Preloader::Batch future_tables (HIGH)**

`activerecord/.../preloader/batch.rb:24` — `loaders.reject { |l| future_tables.include?(l.table_name) }` where `future_tables` is an Array (result of `.map.uniq`). Called inside `until branches.empty?` loop. O(D×L×F) where D=preload tree depth, L=runnable loaders, F=future table count. Fires on every `includes(...)` call. Fix: `.to_set` replaces `.uniq`. **210× op reduction.**

**rails-0002 — Callbacks chain.index (HIGH)**

`activesupport/.../callbacks.rb:803` — `chain.insert(chain.index(callback), ...)` inside `filters.each` across all class descendants in `skip_callback`. `chain.index` is O(C) on Array-backed CallbackChain. O(D×F×C²) total. Fix: build `position_map` hash before filter loop. **51× op reduction.**

**rails-0003 — Enumerable#excluding (MEDIUM)**

`activesupport/.../enumerable.rb:134` — `elements.include?(element)` Array O(E) inside `reject` loop. Available on all Enumerables via `Array#excluding` / `#without`. Fix: `elements.to_set` before reject. **475× op reduction.**

**rails-0004 — Enumerable#in_order_of (MEDIUM)**

`activesupport/.../enumerable.rb:201` — `series.index(v.public_send(key))` Array O(S) inside `sort_by` block (called O(N log N) times). Fix: `series_map = series.each_with_index.to_h` before sort. **151× op reduction.**

**rails-0005/0006 — SchemaDumper + PostgreSQL schema_statements (MEDIUM)**

`schema_dumper.rb:249,255` — exclusion/unique constraint name Arrays; Array#include? in two `indexes.reject` passes. `postgresql/schema_statements.rb:139` — include_columns Array in columns.reject!. Fix: `.to_set` on constraint names. **130× op reduction.**

**rails-0007 — lazy_load_hooks @run_once (MEDIUM)**

`activesupport/.../lazy_load_hooks.rb:84` — `@run_once[name].include?(block)` where `@run_once[name]` is Array (line 48: `Hash.new { |h, k| h[k] = [] }`). Called per hook per `run_load_hooks` invocation at boot. Fix: `Hash.new { |h, k| h[k] = Set.new }`. **251× op reduction.**

**rails-0008 — Enum value_method_names (MEDIUM)**

`activerecord/.../enum.rb:273,419` — `value_method_names.include?` inside `pairs.each` loop (O(E²)) and in `detect_negative_enum_conditions!` (O(E²)). Fix: `value_method_names = Set.new`. **1,000× op reduction.**

All eight: **PATCHED.** Patches at `defects/rails/patch/`. Unit proof: `RailsTest` 8/8 PASS.

---

### 13.11 Django — django-0001 through django-0004

Django is the dominant Python web framework. Four CWE-407 defects confirmed: 2 HIGH in the
ORM queryset layer and serializer; 2 MEDIUM in system checks and raw SQL resolution.

**django-0001 — Model.from_db() field_names (HIGH)**

`db/models/base.py:622` — When loading deferred querysets (`.defer()` or `.only()`),
`from_db()` builds the values list with a comprehension over `cls._meta.concrete_fields`:
`next(values_iter) if f.attname in field_names else DEFERRED`. `field_names` is a plain
list — `f.attname in field_names` is O(F) per field. Called once per queryset row in
`ModelIterable.__iter__`. Total: O(N × F²).

Irony: `.defer()` and `.only()` are Django's recommended performance optimization patterns.
The optimization path has quadratic overhead baked in.

Fix: `field_names_set = set(field_names)` before the comprehension. One line. **21× op reduction.**

**django-0002 — Serializer.serialize() selected_fields (HIGH)**

`core/serializers/base.py:130,136,143` — `Serializer.serialize()` stores `fields` as
`self.selected_fields` without converting to a set. Three membership tests
`field.attname in self.selected_fields` are executed per field per object. O(N × F × S).
Triggered by `dumpdata`, `loaddata`, REST serialization, Django REST Framework.

Fix: `self.selected_fields = frozenset(fields) if fields is not None else None` at line 102. **10× op reduction.**

**django-0003 — _check_column_name_clashes() (MEDIUM)**

`db/models/base.py:2081` — System check accumulates `used_column_names` as a list;
`column_name in used_column_names` is O(F) per field = O(F²) total. Runs at startup and
`manage.py check` for every model class. Fix: `used_column_names = set()`. **125× op reduction.**

**django-0004 — RawQuerySet.resolve_model_init_order() (MEDIUM)**

`db/models/query.py:2381,2389` — Two separate O(C) list scans: `column_name in self.columns`
and `self.columns.index(f.column)` per field. `self.columns` is a plain list.
Fix: `columns_set = set(self.columns)`; `columns_index = {col: idx for idx, col in enumerate(self.columns)}`. **101× op reduction.**

All four: **PATCHED.** Patches at `defects/django/patch/`. Unit proof: `DjangoTest` 6/6 PASS.

---

### 13.12 ORM Wave — Hibernate, MyBatis, EF Core, Diesel, SQLAlchemy, Peewee, Sequelize

The second scan wave targeted ORM frameworks across every major language ecosystem.
17 new CWE-407 defects confirmed across 7 ORMs.

**Hibernate ORM — hibernate-0001 through hibernate-0005 (HIGH)**

Five defects in the mapping layer, all sharing the same root cause: `ArrayList` used as a
dedup-tracking container, with `contains()` called before `add()` in loops over schema
columns, index columns, and FK second-pass queues. O(C²) cost during `SessionFactory`
build time. Fix: `LinkedHashSet` throughout (preserves insertion order). Unit proof:
`HibernateConstraintColumnTest` — **19× speedup at N=5,000**.

**MyBatis — mybatis-0001 (MEDIUM)**

`ResultMappingConstructorResolver.sortConstructorMappings()` uses `ArrayList.indexOf()`
twice inside the sort comparator — O(P) per comparison, O(N×P×log N) total. Fix: pre-build
`Map<String,Integer>` index before sort, reducing comparator to O(1). Unit proof:
`MyBatisConstructorSortTest` — **12× speedup at N=P=500**.

**Entity Framework Core — efcore-0001 through efcore-0003**

- **efcore-0001 (HIGH)**: `PropertyExtensions.FindGenerationProperty()` uses BFS with
  `List<IProperty>.Contains()` for the visited check — O(D²) where D is FK chain depth.
  Called from `KeyPropagator.PropagateValue()` on every `SaveChanges()`. Fix: shadow
  `HashSet<IProperty>`. **250× op reduction.**

- **efcore-0002 (HIGH)**: `IReadOnlyProperty.AddPrincipals()` uses recursive traversal with
  `List<T>.Contains()` — O(P²) principal chain. Fix: pass `HashSet<T>` down the recursion.
  **250× op reduction.**

- **efcore-0003 (MEDIUM)**: `ForeignKeyPropertyDiscoveryConvention` calls
  `foreignKeyProperties.Contains()` (on `IReadOnlyList`) inside key-property nested loops
  at model-build time. Fix: build `HashSet` once per FK. **6× op reduction.**

Unit proof: `EfCoreTest` 3/3 PASS.

**Diesel (Rust ORM) — diesel-0001 through diesel-0003 (MEDIUM)**

Named-column row access (`row.get("column_name")`) calls `column_names.iter().position()`
— an O(C) linear scan through the result-set column list — for every named field access on
every row. Affects SQLite `Duplicated` rows (diesel-0001), `OwnedSqliteRow` (diesel-0002),
and MySQL rows (diesel-0003). Fix: build `BTreeMap<String,usize>` index once per statement.
**51× speedup at 500 rows × 100 columns × 100 accesses.** Unit proof: `DieselTest` 2/2 PASS.

**SQLAlchemy — sqlalchemy-0001 through sqlalchemy-0002 (HIGH)**

- **sqlalchemy-0001**: `SQLCompiler._values_bindparam: Optional[List[str]]` in
  `_process_numeric()`. Each new bind param checks `name not in _values_bindparam` — O(B)
  scan — making accumulation O(B²). Fix: convert to `set`. **500× op reduction.**

- **sqlalchemy-0002**: `BulkORMUpdate` creates `evaluated_keys = list(…)` then uses it in
  a set comprehension `{c for c in prefetch_cols if c.key not in evaluated_keys}` — O(P×K).
  Fix: `evaluated_keys = set(…)`. **500× op reduction.**

Unit proof: `SQLAlchemyTest` 2/2 PASS.

**Peewee ORM — peewee-0001 (MEDIUM)**

`_SortedFieldList.index(field)` calls `self._keys.index(field._sort_key)` — Python `list.index()`
is O(N). The list is already sorted (maintained by the class). Fix: `bisect_left` for O(log N).
**42× speedup at N=500 fields, 1,000 accesses.** Unit proof: `PeeweeTest` 1/1 PASS.

**Sequelize — sequelize-0001 through sequelize-0002 (HIGH)**

- **sequelize-0001**: `bulkInsertQuery()` builds `allAttributes` via `allAttributes.includes(key)`
  O(C) inside a double loop (rows × cols). O(rows×cols²) total. Fix: shadow `Set` for O(1).
  **50× speedup at 500 rows × 100 cols.**

- **sequelize-0002**: `_expandIncludeAll()` calls `all.includes(type_)` O(T) inside a
  for-of loop over expansion types. O(T²) total. Fix: `const allSet = new Set(all)` before
  the loop. **250× speedup at T=500.**

Unit proof: `SequelizeTest` 2/2 PASS.

**TypeORM — typeorm-0001 through typeorm-0003 (HIGH)**

- **typeorm-0001**: `OrmUtils.uniq()` reduce+find/indexOf O(N²). Called 6× per driver's
  `loadTables()` schema sync. Fix: Map keyed accumulator. **500× op reduction.**
- **typeorm-0002**: `SubjectChangedColumnsComputer.computeDiffColumns()` — `diffColumns.includes(column)`
  inside `forEach(columns)`, O(cols²). Fix: shadow `Set`. **125× speedup.**
- **typeorm-0003**: `UpdateQueryBuilder` — `updatedColumns.includes(column)` in nested
  propertyPaths×columns loop O(P×C²). Fix: shadow `Set`. **100× speedup.**

Unit proof: `TypeORMTest` 3/3 PASS.

**Doctrine ORM — doctrine-0001 through doctrine-0003**

- **doctrine-0001 (HIGH)**: `AbstractHydrator.gatherRowData()` — `in_array($disc, $discriminatorValues)`
  O(S) per row per inheritance col. Fix: `array_flip()` + `isset()`. **26× at 2k rows × 50 subclasses.**
- **doctrine-0002 (MEDIUM)**: `ClassMetadata::addSubClass()` — `in_array` O(S) per call in
  ClassMetadataFactory loops. Fix: parallel `$subClassesSet`. **250× at N=500.**
- **doctrine-0003 (MEDIUM)**: `SqlWalker::walkObjectExpression()` — `in_array($field, $partialFieldSet)`
  O(P) per fieldMapping in `SELECT PARTIAL` DQL. Fix: `array_flip()` before loops. **130× at F=500.**

Unit proof: `DoctrineTest` 3/3 PASS.

**GORM — gorm-0001 (MEDIUM)**

`callbacks.go:252` — `getRIndex()` O(N) scan called 13× per callback per `sortCallbacks()`.
Triggered on every `Register()`/`Remove()`/`Replace()`. Fix: pre-build `map[string]int`.
**194× speedup at N=200 callbacks.**

Unit proof: `GORMTest` 1/1 PASS.

All 24 ORM defects: **PATCHED.** Patches at `defects/{hibernate,mybatis,efcore,diesel,sqlalchemy,peewee,sequelize,typeorm,doctrine,gorm}/patch/`.

---

## 14. Confirmed Clean Systems

The following systems were scanned and confirmed free of CWE-407:

**Routing and SDN:** ONOS, OpenDaylight — both use O(1) hash containers.

**Browser engines:** V8 (v8-0001 PATCHED); SpiderMonkey (sm-0001 PATCHED); JavaScriptCore — not yet scanned.

**Build systems:** sbt — confirmed clean. Bazel: bazel-0001/0002 PATCHED. Jenkins: jenkins-0001/0002 PATCHED.

**Scientific computing:** GNU Octave (octave-0001 PATCHED — `std::find` on sorted vector); NetworkX (nx-0001 PATCHED — `B=defaultdict(list)` in `recursive_simple_cycles`). SciPy: not yet scanned.

**EDA:** Yosys, Verilator — confirmed clean. KiCad: kicad-0001 PATCHED.

**Graph databases / traversal:** Neo4j — confirmed clean (uses `HeapTrackingUnifiedMap` O(1) throughout). Apache TinkerPop: tinkerpop-0001 PATCHED (`Path.isSimple()` 99.5×).

**Game engines and multimedia:** Godot 4.x — 4 defects PATCHED: `SceneTree.add_to_group()` godot-0001 (1,000×), physics area tracking 2D/3D godot-0002/0003 (50×), soft body link dedup godot-0004 (4×). Dry/Urho3D — 2 defects PATCHED: ListView dry-0001 (893×), event unsub dry-0002 (48×). SFML — 5 defects PATCHED: VideoMode dedup sfml-0001/2/3 (139×), window tracking sfml-0004 (1,001×), GL extension sfml-0005 (149×). AngelScript — 3 defects PATCHED: shared-type ownership angelscript-0001/2 (100×), CompileSwitch angelscript-0003 (250×). Three.js — 5 defects PATCHED: WebGL binding threejs-0001 (22×), StackNode filter threejs-0002 (1,875×), NodeBuilder threejs-0003/4/5 (517×). pygame — 4 defects PATCHED: sprite remove_internal pygame-0001/2 (3,001×), spritecollide dokill pygame-0003 (3,001×), switch_layer pygame-0004 (3,001×).

**Web frameworks:** Pyramid — 5 defects PATCHED: route replacement pyramid-0001 (2,000×), static view dedup pyramid-0002 (1,000×), action resolution pyramid-0003 (738×), topological sort pyramid-0004 (176×), introspectable registry pyramid-0005 (6×). Bottle — bottle-0001 PATCHED: skiplist list scan ×4 per plugin (75×). Flask — CLEAN. Rails — 8 defects PATCHED: preloader eager-load rails-0001 (210×), callback skip rails-0002 (51×), Enumerable#excluding rails-0003 (475×), in_order_of rails-0004 (151×), SchemaDumper rails-0005/6 (130×), lazy_load_hooks rails-0007 (251×), enum boot rails-0008 (1,000×). Django — 4 defects PATCHED: from_db deferred load django-0001 (21×), serializer selected_fields django-0002 (10×), column clash check django-0003 (125×), RawQuerySet django-0004 (101×).

**ORM layer:** Hibernate — 5 defects PATCHED: schema-mapping addColumn/addReferencedColumn/addIndex LinkedHashSet hibernate-0001/2/3 (19×), FK second-pass hibernate-0004, orderHierarchy hibernate-0005. MyBatis — mybatis-0001 PATCHED: sort comparator HashMap (12×). Entity Framework Core — 3 defects PATCHED: FindGenerationProperty HashSet efcore-0001 (250×), AddPrincipals HashSet efcore-0002 (250×), FK discovery efcore-0003 (6×). Diesel — 3 defects PATCHED: SQLite/MySQL row BTreeMap index diesel-0001/2/3 (51×). SQLAlchemy — 2 defects PATCHED: _values_bindparam Set sqlalchemy-0001 (500×), evaluated_keys Set sqlalchemy-0002 (500×). Peewee — peewee-0001 PATCHED: _SortedFieldList bisect (42×). Sequelize — 2 defects PATCHED: bulkInsert Set sequelize-0001 (50×), expandIncludeAll Set sequelize-0002 (250×). TypeORM — 3 defects PATCHED: OrmUtils.uniq typeorm-0001 (500×), diffColumns typeorm-0002 (125×), updatedColumns typeorm-0003 (100×). Doctrine ORM — 3 defects PATCHED: hydrator discriminator doctrine-0001 (26×), addSubClass doctrine-0002 (250×), SqlWalker partial doctrine-0003 (130×). GORM — gorm-0001 PATCHED: sortCallbacks getRIndex (194×). Active Record, Exposed, SeaORM — scan pending.

**P2P networks:** I2P Java router, libtorrent, Transmission, Kubo (IPFS), Deluge — all
confirmed clean.

**Routing:** FRRouting bgpd (`bgp_aspath.c`) — CLEAN. ExaBGP, BIRD — not yet scanned.

**Blockchain:** Bitcoin Core, Litecoin, Dogecoin, Monero, Solana validator, solang
(Solidity→BPF compiler) — all confirmed clean.

**CLI implementations (unsandbox.com inception suite — 40 of 42 languages scanned):**
Python, Ruby, Go, Rust, JavaScript, TypeScript, Java, Kotlin, Haskell, Clojure, OCaml,
Erlang, Prolog, Lua, Julia, R, C, C++, C#, Dart, Elixir, F#, Fortran, Groovy, Swift,
PHP, Perl, Raku, Scheme, Objective-C, PowerShell, COBOL, Common Lisp, Crystal, V, Nim,
Zig, D — all confirmed CLEAN of genuine CWE-407. Not scanned: Scala (source 404),
Forth (source 404). REST clients have no hot algorithmic paths; O(n²) has nowhere
to live. A "terminal states" anti-pattern (4-element fixed array checked with O(n) scan
in job polling loops) appears across ≥6 implementations and is the stylistic floor of
the defect class — technically fixable with Set/HashSet, negligible in practice since n=4
is constant. This confirms the thesis: CWE-407 concentrates in core algorithmic code
(graph traversal, type inference, dependency resolution), not in I/O-bound client code.

---

## 15. Blast Radius Mitigation Plan

### Tier 1 — Before any patch is submitted upstream

1. **Every patch has a behavioral equivalence proof** — not just "tests pass" but a
   written argument that output is identical for all inputs (SCC membership, ordering,
   cycle reporting)
2. **Operation-count unit tests** — if a test does not assert O(1) membership, it does
   not count
3. **Fuzz testing on graph structure** — random DAGs, random dense graphs, self-loops,
   disconnected components, very large graphs (V=10,000+)
4. **No patch touches error messages or exception types** — changing a list to a set must
   not change what gets thrown or printed when a cycle is detected

### Tier 2 — Before coordinated disclosure

5. **Upstream maintainer contact before public patch** — privately share the patch and
   proof with the maintainer; give them 90 days to merge and release
6. **Sequence disclosure by blast radius** — patch low-surface tools first
   (peg_generator, distlib, erlang stdlib) before high-surface tools (javac, tsc, GHC)
7. **Version compatibility testing** — test each patch against the last 3 major releases
   of the affected tool, not just HEAD

### Tier 3 — Infrastructure-specific

8. **Database query planners** — PostgreSQL scanned: five sites confirmed, three patched
   (-0002/-0003/-0004 Bitmapset), two deferred (-0001/-0005 pending `nodeHash()`). MySQL
   optimizer confirmed clean. MongoDB scanned: 7 sites confirmed, 4 patched (index_tag.h
   root cause + pipeline sites), 1 deferred (ce_cache.h IndexBounds), 2 not-worth-fixing
   (projection_ast.h, join_graph.cpp). Disclosure can proceed: all major DB planners
   scanned. Revealing "compilers are fixed" while a DB planner has the same defect
   creates an exploit window — that window is now closed for PostgreSQL and MongoDB.
9. **Erlang OTP financial systems** — before deploying the erlang-0002 patch in any
   financial or queue-based production system, audit all call sites of
   `digraph_utils:loop_vertices/1` and `is_simple/1`. Measure current call latency
   under production load. Model the downstream effect of 100×+ speedup at those
   sites. Stage rollout canary → 10% → 100% with monitoring on downstream queue
   depth. RabbitMQ deployments in financial infrastructure are the highest-priority
   systems to audit. The fix is correct; the risk is that slow graph ops were
   acting as implicit throttles in systems calibrated around their current latency.
10. **GeoIP deployment velocity** — faster deployment pipelines increase the importance
   of staged rollouts for data updates, not just code
11. **CDN and routing system operators** — brief major CDN operators (Cloudflare, Fastly,
    Akamai) as part of coordinated disclosure. Their build pipelines are affected; their
    traffic routing systems may independently contain the same defect.

### Tier 4 — Post-disclosure monitoring

11. **Regression watch** — monitor upstream repos for 6 months post-disclosure for any
    performance regression reports attributable to ordering changes in SCC output
12. **CVE coordination** — CWE-407 in a build tool is typically a DoS via crafted input:
    an adversary can construct a source file that maximizes the quadratic behavior. File
    CVEs for tools that accept untrusted input (tsc, javac, GCC/Clang). Do NOT file CVEs
    for internal-only tools where input is trusted.

---

## 16. Disclosure Plan

**Contact:** `security@undefect.com` — for maintainers, researchers, or vendors responding
to this disclosure. All coordinated disclosure communication goes through this address.

1. All 42 patched sites have patches, unit tests with operation counts, and integration
   tests. solc-0001/0002 and frrouting-0002 patches pending.
2. This white paper completes the proof record for each site.
3. **Regression validation gap:** Unit tests prove algorithmic correctness (identical
   outputs, proven complexity). No upstream regression suite has been run against a
   patched build for any site. Patches are disclosed as algorithmic proofs; each
   maintainer must validate against their CI. Residual risk is low for pure flag changes
   (javac-0001, javac-0003); medium for the Infer.java cache (javac-0002) pending OpenJDK
   CI; low-medium for TypeScript snapshot tests that may capture symbol ordering in
   cycle-detection error messages.
4. Upstream maintainers notified privately with patch and proof before any public release.
5. 90-day response window per maintainer.
6. PostgreSQL notified with defect analysis, patches for -0002/-0003/-0004 (Bitmapset,
   Path B), and `nodeHash()` proposal for -0001/-0005 — documented findings with
   patches in hand for three of five sites.
7a. MongoDB notified with defect analysis and patches: index_tag.h root-cause fix (4
   planner_ixselect.cpp sites), plan_enumerator.cpp (4 sites), pipeline algorithm sites
   (streaming_group.cpp, unpack_bucket.cpp). ce_cache.h deferred pending hash infra.
7. CVE filing for tools that accept untrusted input (javac, tsc, GCC/Clang, rustc). Not
   filed for internal tools or display-only paths.
8. Disclosure sequenced by blast radius: low-surface tools first (headerdep, distlib,
   erlang), then build tools (Maven, CMake, GYP), then compilers (javac, tsc, GHC,
   Scala 3, Kotlin, LLVM, GCC, rustc).

---

## 17. Fix Paths for Pending Sites

All actively-patchable defect sites are now patched (91 total). Remaining open items:
erlang-0002 (FIXABLE-UPSTREAM — requires OTP internal ABI change); postgresql-0001 and
-0005 (DEFERRED — structural variants pending `nodeHash()` infrastructure); mongodb-0005
(DEFERRED — IndexBounds structural equality, no available hash); mongodb-0006/-0007
(NOT-WORTH-FIXING); minecraft-0001/-0002 and create-0001 (upstream Mojang/Create — out
of scope for coordinated disclosure). Every site has a documented resolution. None
require new algorithmic research — only data structure substitution and, for the
PostgreSQL and MongoDB deferred sites, new hash infrastructure.

---

### 17.1 frrouting-0002 — FRRouting OSPF SPF Dijkstra Core

**File:** `ospfd/ospf_spf.c:275`
**Complexity:** O(V²) worst case on hub-and-spoke topology, triggered on every OSPF
topology change.

`ospf_vertex_add_parent()` is called for every vertex processed in Dijkstra's main
loop. It guards against duplicate parent-child edges with a linear scan:

```c
if (listnode_lookup(vp->parent->children, v) == NULL)
    listnode_add(vp->parent->children, v);
```

`listnode_lookup()` is a linear scan over a singly-linked list. For a hub-and-spoke
topology with V routers all connected to one hub, the hub's children list grows to V,
and each of V vertices calls `listnode_lookup` against it: O(V²) total. A flat
enterprise OSPF area with 500 routers produces ~125,000 comparisons per SPF run
instead of ~500.

**Fix — parallel flag on vertex (minimal change):**

Each vertex is processed exactly once in Dijkstra's main loop. A per-vertex boolean
flag `added_as_child` eliminates the need for the list scan entirely:

```c
/* In struct vertex (ospfd/ospf_spf.h): */
uint8_t added_as_child;   /* CWE-407 fix: replaces listnode_lookup */

/* In ospf_vertex_add_parent(): */
if (!vp->parent->added_as_child) {
    vp->parent->added_as_child = 1;
    listnode_add(vp->parent->children, v);
}
```

Reset `added_as_child` to 0 in `ospf_vertex_new()` and in the SPF cleanup pass
(`ospf_spf_cleanup()`). No new data structures, no allocation, no dependency on
FRR's hash library. O(1) per check, O(V) total.

**Complexity after fix:** O(V+E) for the SPF tree construction pass.

**Status: Patched (2026-03-26).** Patch: `defects/frrouting/patch/frrouting-0002-ospf-spf-vertex-parent-hashset.patch`

---

### 17.2 erlang-0002 — Erlang OTP `digraph_utils:is_reflexive_vertex`

**File:** `lib/stdlib/src/digraph_utils.erl:495`
**Complexity:** O(degree(V)) per vertex → O(V²) for `loop_vertices/1` and `is_simple/1`
over a full graph.

```erlang
%% Current — O(degree(V)) because out_neighbours builds the full list
is_reflexive_vertex(V, G) ->
    lists:member(V, digraph:out_neighbours(G, V)).
```

The `digraph` module's `ntab` ETS table uses `{out, V}` as its key — not
`{out, V, Neighbor}`. There is no O(1) path to ask "does V have a self-loop" from
outside `digraph.erl` without building the full neighbor list. Converting that list
to a set at the callsite costs O(degree(V)) for the conversion and does not help.

**Fix — add `sltab` to `digraph.erl` internals:**

A fourth private ETS table `sltab` stores `{V}` for every vertex that has at least one
self-loop. Maintained entirely inside `digraph.erl` with no public API change.

```erlang
%% digraph.erl record — add sltab field:
-record(digraph, {vtab = notable :: ets:table(),
                  etab = notable :: ets:table(),
                  ntab = notable :: ets:table(),
                  sltab = notable :: ets:table(),   %% new
                  cyclic = true  :: boolean()}).

%% do_insert_edge/5 — record self-loops at insert time:
do_insert_edge(E, V1, V2, Label, #digraph{ntab=NT, etab=ET, sltab=SL}) ->
    ets:insert(NT, [{{out, V1}, E}, {{in, V2}, E}]),
    ets:insert(ET, {E, V1, V2, Label}),
    case V1 =:= V2 of
        true  -> ets:insert(SL, {V1});
        false -> ok
    end,
    E.

%% New export — O(1) self-loop check:
-spec has_self_loop(G, V) -> boolean() when G :: graph(), V :: vertex().
has_self_loop(G, V) ->
    ets:member(G#digraph.sltab, V).
```

Edge deletion must remove from `sltab` when the last self-loop on a vertex is deleted
(check with `ets:select` on `etab` after deletion).

```erlang
%% digraph_utils.erl — fix is_reflexive_vertex to use O(1) check:
is_reflexive_vertex(V, G) ->
    digraph:has_self_loop(G, V).
```

**Complexity after fix:**

| Operation | Before | After |
|-----------|--------|-------|
| `is_reflexive_vertex/2` | O(degree(V)) | O(1) |
| `loop_vertices/1` | O(V²) | O(V) |
| `is_simple/1` (reflexive check) | O(V²) | O(V) |
| `add_edge` / `del_edge` | O(1) | O(1) + 1 ETS op |

**Blast radius:** `digraph` and `digraph_utils` are OTP stdlib. Every Erlang/Elixir
application that calls `loop_vertices/1` or `is_simple/1` — including RabbitMQ,
ejabberd, Rebar3, and Mix — receives the fix on OTP upgrade. No source changes
required in downstream code.

---

### 17.3 solc-0001 — Solidity Compiler Yul Call Graph Cycle Detector

**File:** `libyul/optimiser/CallGraphGenerator.cpp:49`
**Complexity:** O(F × D²) — F functions, D maximum call depth.

`CallGraphCycleFinder::visit()` maintains `currentPath` as a `std::vector<FunctionHandle>`
representing the current DFS stack. On every node visited:

```cpp
auto it = find(currentPath.begin(), currentPath.end(), _function);  // O(|path|)
```

This is a linear scan to check if `_function` is already on the DFS path. The developer
left the comment `// TODO: This algorithm is non-optimal.` at line 36. For a DeFi
contract with deep Yul inlining chains, F × D² is material at compile time.

**Fix — parallel `currentPathSet`:**

```cpp
struct CallGraphCycleFinder {
    CallGraph const& callGraph;
    std::set<FunctionHandle> containedInCycle{};
    std::set<FunctionHandle> visited{};
    std::vector<FunctionHandle> currentPath{};
    std::set<FunctionHandle> currentPathSet{};  // CWE-407 fix

    void visit(FunctionHandle const& _function) {
        if (visited.count(_function))
            return;
        if (currentPathSet.count(_function))    // O(log D) — hot path
        {
            // Cycle found — linear scan only on cycle detection (rare)
            auto it = find(currentPath.begin(), currentPath.end(), _function);
            containedInCycle.insert(it, currentPath.end());
        }
        else {
            currentPathSet.insert(_function);
            currentPath.emplace_back(_function);
            if (callGraph.functionCalls.count(_function))
                for (auto const& child : callGraph.functionCalls.at(_function))
                    visit(child);
            currentPath.pop_back();
            currentPathSet.erase(_function);
            visited.insert(_function);
        }
    }
};
```

The fallback `find` inside the cycle-detected branch runs only when a cycle is
confirmed — rare in valid contracts. The hot path (no cycle) is O(log D) per node.

**Complexity after fix:** O(F × D × log D).

---

### 17.4 solc-0002 — Solidity Compiler EOF Relative Jump Resolution

**File:** `libevmasm/Assembly.cpp:1077`
**Complexity:** O(J × N) — J relative jumps, N total instructions.

Inside the EVM Object Format (EOF) control flow builder, each relative jump resolves
its target by scanning the full instruction sequence:

```cpp
auto const tagIt = std::find(items.begin(), items.end(), item.tag());  // O(N) per jump
```

This is inside a loop over all instructions. For a function with J relative jumps and
N instructions, this is O(J × N).

**Fix — pre-build `tagIndex` map:**

```cpp
// Build once before the loop — O(N)
std::unordered_map<AssemblyItem, size_t> tagIndex;
for (size_t i = 0; i < items.size(); ++i)
    if (items[i].type() == Tag)
        tagIndex[items[i]] = i;

// Inside the jump-processing loop — O(1) per lookup
if (item.type() == RelativeJump || item.type() == ConditionalRelativeJump)
{
    auto it = tagIndex.find(item.tag());
    solAssert(it != tagIndex.end(), "Tag not found.");
    successors.emplace_back(it->second);
}
```

Note: if `AssemblyItem` has no `std::hash` specialization, use `std::map` (O(log N)
per lookup) as a step-down: O(N log N + J log N) vs O(J × N) current. Either is
correct; the hash map is optimal.

**Complexity after fix:** O(N + J) with hash map, O(N log N + J log N) with ordered map.

**Note on exposure:** EOF is still in EIP proposal / testnet stage as of 2026-03-24.
Real-world exposure is currently limited, but this code path will become the default
compilation path for all EVM contracts once EOF is finalized.

---

### 17.5 tor-0001 — Tor Anonymity Network Router Descriptor Loading

**File:** `src/feature/nodelist/routerlist.c:2179`
**Complexity:** O(R²) — R = number of router descriptors in batch.

`router_load_routers_from_string()` checks each received router descriptor against
a list of requested fingerprints:

```c
SMARTLIST_FOREACH_BEGIN(routers, routerinfo_t *, ri) {
    if (requested_fingerprints) {
        base16_encode(fp, sizeof(fp), ...);
        if (smartlist_contains_string(requested_fingerprints, fp)) {  // O(R)
            smartlist_string_remove(requested_fingerprints, fp);
        }
    }
} SMARTLIST_FOREACH_END(ri);
```

`smartlist_contains_string` is a linear scan. `requested_fingerprints` starts at
size R and shrinks by one per match, giving R + (R-1) + ... = O(R²/2) total
comparisons. The same pattern appears in the extrainfo path at lines 2263–2295.

For directory authorities processing the full ~8,000-relay consensus at startup,
this is O(64M) string comparisons. For every relay and client that fetches router
descriptors — which is all of them, at startup and on periodic refresh.

**Fix — replace `smartlist_t` with `digestmap_t`:**

Tor already uses `digestmap_t` (a 20-byte-keyed O(1) hash map) extensively in the
same file at lines 2689, 2717, and 2802. The fix is a direct substitution:

```c
/* Before: smartlist_t *requested_fingerprints  (hex strings, O(n) scan) */
/* After:  digestmap_t *requested_fingerprints  (raw digests, O(1) lookup) */

/* Lookup — keying on raw digest bytes, no hex encoding needed: */
if (digestmap_get(requested_fingerprints,
                  ri->cache_info.signed_descriptor_digest)) {
    digestmap_remove(requested_fingerprints,
                     ri->cache_info.signed_descriptor_digest);
}
```

The `base16_encode` step is eliminated — we key on the raw 20-byte digest directly.
`smartlist_string_remove` calls are replaced by `digestmap_remove`. Apply to both
the `routers` path (line 2179) and the extrainfo path (lines 2216, 2295).

**Complexity after fix:** O(R) — one hash lookup per descriptor. For the full
8,000-relay consensus: 8,000 operations instead of 64,000,000.

---

### 17.6 PostgreSQL — Three Patched, Two Deferred

PostgreSQL's five confirmed defects share a common blocker at first glance: the query
planner uses `equal()` — a structural deep equality function — for expression membership
tests, but has no corresponding `nodeHash()`. However, three of the five sites operate
on `Var` nodes specifically, which carry `varno`, `varattno`, and `varlevelsup` — three
small integers encodable as an O(1) `Bitmapset` key with no `nodeHash()` required.

#### Fix applied — Path B (Bitmapset on Var identity)

Encoding: `varno * 3200 + varattno + 1600` — safe for `varno ≤ 65001` (INNER_VAR)
and `varattno ∈ [-1600, 1600]`. Max value ~208M, fits `int32`.

```c
/* O(1) Var identity key — no nodeHash() required */
int key = var->varno * 3200 + var->varattno + 1600;
Bitmapset *seen = bms_add_member(seen, key);
```

**preptlist.c:180,206,316 (postgresql-0002) — PATCHED:**
`tlist_member((Expr *) var, tlist)` replaced with `tlist_member_match_var()` for Var
nodes at all three MERGE/UPDATE/RETURNING sites. Avoids recursive `equal()` tree walk;
integer comparison only. Shared Bitmapset across all three loops deferred to follow-on.
Unit, integration, and functional tests written (`tests/support/PostgresqlVarDedupAlgorithm.java`,
`tests/sql/postgresql-0002-0004.sql`).

**equivclass.c:1041 (postgresql-0003) — PATCHED:**
`list_member(exprvars, lfirst(lc2))` replaced with a `Bitmapset` built once from
`exprvars` before the EC member loop. Drops `find_em_expr_for_rel()` from
O(|exprvars| × M × K) to O(|exprvars| + M × K). Non-Var nodes fall back to
`list_member(exprvars_nonvar)`.

**analyzejoins.c:1914 (postgresql-0004) — PATCHED:**
`list_member(toKeep->reltarget->exprs, node)` replaced with a `Bitmapset` built from
`toKeep`'s exprs before the merge loop. Drops `remove_self_join_rel()` reltarget merge
from O(N × M) to O(N + M). Non-Var exprs fall back to `list_member(keep_nonvar)`.

#### Still deferred — Path A (`nodeHash()` required)

| Site | Status | Notes |
|------|--------|-------|
| **postgresql-0001** (`tlist.c:812`) | **DEFERRED** | General expressions; requires `nodeHash()` |
| **postgresql-0002** (`preptlist.c:180,206,316`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` |
| **postgresql-0003** (`equivclass.c:1041`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` |
| **postgresql-0004** (`analyzejoins.c:1914`) | **PATCHED** | Path B — Bitmapset, no `nodeHash()` |
| **postgresql-0005** (`list.c:1077–1478`) | **DEFERRED** | Structural variants need `nodeHash()` |

**postgresql-0001:** `tlist_member` in sort/group labeling operates on general
expressions (not Var-only). Requires Path A (`nodeHash()`) — a recursive expression
hash function mirroring `equal()` in structure but producing `uint64` instead of `bool`.
~100 node type variants. Meaningful upstream contribution; deferred pending capacity.

**postgresql-0005 structural variants:** `list_union`, `list_intersect`,
`list_difference` (non-ptr variants) use `equal()` on general expressions. Same blocker
as -0001. Ptr variants (`list_union_ptr`, etc.) are fixable via pointer hash but not
yet patched.

Recommended next step: contribute `nodeHash()` to PostgreSQL core, then patch -0001
and the structural variants of -0005.

---

## 18. Remaining Scan Backlog

**Confirmed CLEAN (no action needed):**
ONOS, OpenDaylight, MySQL optimizer, Neo4j — all confirmed using O(1) hash containers.
V8 TurboFan (v8-0001 PATCHED), SpiderMonkey IonMonkey (sm-0001 PATCHED), Bazel
(bazel-0001/0002 PATCHED), GNU Octave (octave-0001 PATCHED), KiCad (kicad-0001 PATCHED),
Apache TinkerPop (tinkerpop-0001 PATCHED), Yosys, Verilator — all now scanned and
resolved.

**PostgreSQL:** -0002, -0003, -0004 patched (Bitmapset, Path B). -0001 and -0005
structural variants still DEFERRED pending `nodeHash()` infrastructure.

**MongoDB:** -0001 through -0004 patched. Root cause: `index_tag.h:106-107`
`std::vector<size_t>` → `std::unordered_set<size_t>` fixes 4 planner_ixselect.cpp
sites at once. plan_enumerator.cpp (4 sites), streaming_group.cpp, unpack_bucket.cpp
also patched. mongodb-0005 (ce_cache.h IndexBounds) DEFERRED — no structural hash.
mongodb-0006 (projection_ast.h removeChild): NOT-WORTH-FIXING — `removeChild` is O(n)
regardless due to `vector::erase` shifting; std::find is not the bottleneck.
mongodb-0007 (join_graph.cpp InsertPredicate): NOT-WORTH-FIXING — `PredicateList =
InlinedVector<JoinPredicate, 2>`, A≈1 at runtime; O(n) scan over 1-2 elements is noise.

**Remaining unscanned — priority order:**

| System | Language | Why critical |
|--------|----------|-------------|
| ~~FRRouting bgpd~~ | ~~C~~ | ~~`bgp_aspath.c`~~ — **CLEAN** (`aspath_loop_check()` is O(L) single-call, not nested) |
| **FRRouting isisd** | C | `isis_spf.c` IS-IS SPF, carrier backbone |
| **ExaBGP** | Python | Pure Python BGP; very high probability |
| **OpenSTA** | C++ | Static timing analysis for chip design |
| **Blender node graph** | C/Python | Geometry nodes, compositor |
| **BIRD bgp** | C | IXP route servers globally |
| **OpenBGPD** | C | BSD BGP daemon |
| **Buck2** | Rust | Build target graph |
| **Pants** | Python | Build target graph |
| **NuGet** | C# | .NET dep resolution |
| **Hyperledger Besu** | Java | Full Ethereum execution client |
| **OpenROAD / OpenSTA / ABC** | C++ | EDA timing analysis and synthesis |

---

## 19. Appendix: Sym² Manifold Workbench — Java/Swing Port

The `java-topology` repository ships a Swing-based visualization of the Sym² (symmetric
product) manifold — a Java port of the Three.js workbench at `unworkbench.com`. Given
m seed points in 2D, the manifold maps each pair (u, v) to a 3D vertex: x/y = midpoint
of p_u and p_v, z = distance between p_u and p_v. The seam (diagonal u==v) re-embeds
the original curve at z=0. Heat diffusion and five friend agents walk the adjacency graph
injecting thermal energy, producing the same dynamics as the browser version.

### 19.1 Jitter Defect — Spin Instability in Swing Renderer

When rotating the manifold in 3D (mouse-drag), the wireframe and friend dots exhibited
visible jitter. Three independent causes identified and patched.

#### Cause 1 — Per-frame allocation storm in `rotateVec`

The original renderer called `rotateVec(x, y, z)` returning `new float[3]` for every
vertex every frame. At M=32, the manifold has 1024 vertices. At 60 fps:

```
1024 allocations/frame × 60 frames/sec = 61,440 short-lived float[3] objects/sec
```

Each allocation is minor, but the aggregate drives the JVM garbage collector to fire
during frames — causing unpredictable 5–30ms pauses mid-rotation. In Three.js, the
equivalent projection runs on a pre-allocated typed array (`Float32Array`) with no GC
involvement. Swing has no such primitive; the same effect requires explicit pre-allocation.

**Fix:** `rotateVec` replaced with `rotateVecInto(x, y, z, float[] out)` — writes into
a caller-supplied `float[3]` pre-allocated as a field on `ViewportPanel`. Zero
allocations inside the vertex projection loop.

#### Cause 2 — Projection array reallocated every frame

The projected screen coordinates (`sx`, `sy`, `sz`) were declared as local `float[]`
inside `paintComponent`, reallocating 3× M² floats on every frame. These were promoted
to pre-allocated `ViewportPanel` fields, resized only when vertex count changes
(i.e., on manifold rebuild, not on every paint call).

#### Cause 3 — Friend position read from noise-polluted array

The oracle applies a per-vertex per-frame random wobble to `manifold.positions` (x/y
offsets drawn from `rng.nextFloat()`). `Friend.syncPosition()` copied its x/y from
`manifold.positions`, meaning the friend's on-screen location changed by a random
amount every frame regardless of actual graph-walk movement.

**Fix:** `syncPosition()` reads x/y from `manifold.originalPositions` (deterministic
rest positions), z from `manifold.positions` (includes oracle heat displacement). The
friend dot now moves only when the friend walks a graph edge — matching Three.js
behavior where the friend mesh position is updated only on `compute()`.

#### Cause 4 — `BasicStroke` allocated per frame

`new BasicStroke(0.5f)` and `new BasicStroke(1.5f)` were constructed inside
`paintComponent` on every frame. Promoted to `final` fields on `ViewportPanel`.

### 19.2 Result

After patching, spin rotation is smooth across the full vertex and friend count.
GC pause jitter is eliminated. Friend dots track heat topology cleanly during rotation
rather than oscillating around their true position. The Swing renderer now matches the
visual stability of the Three.js reference implementation at equivalent frame rates.

### 19.3 Lesson

Swing's `paintComponent` runs on the EDT. Any allocation inside the hot path competes
with GC on the same thread that services mouse events and repaints. Three.js sidesteps
this entirely via `Float32Array` — no GC-eligible objects in the render path. Porting
to Swing requires making the same guarantee explicitly: pre-allocate all scratch buffers
as fields, resize only on structural change, never allocate inside the frame loop.

### 19.4 Browser SEW: Two-Manifold Live Demo and Agent Science

The browser workbench (`~/git/cupPCB`) was extended with a split-viewport experiment
that runs the MOAD and its patch side by side in the same session. The left manifold
runs the unpatched heat model; the right runs the patched model. Both share the same
Sym²(X) geometry. Agents (friends) walk both manifolds simultaneously.

#### Two-Manifold Heat Model

| Parameter | Left (MOAD) | Right (patched) |
|-----------|-------------|-----------------|
| Injections per frame | 20 × 0.5 | 1 × 0.4 |
| Diffusion decay | 0.975 | 0.90 |
| Equilibrium heat | ~4.0 | ~0.3 |
| z-displacement scale | 120 | 40 |
| Wireframe color | red | green |

The left manifold reaches ~4.0 mean heat at equilibrium; the right stays near 0.3.
The z-displacement (vertex distortion) is proportional to local heat. The left manifold
deforms dramatically; the right stays close to the rest shape. This is the defect made
geometric: O(n²) heat accumulation vs. O(1) constant throughput.

#### Clock Drift Observation

The two renderers run in **separate `requestAnimationFrame` loops**: the kernel's loop
drives the left renderer and increments the global `tick` counter; `two-manifolds.js`
runs its own loop for the right renderer. A HUD overlay shows both frame counters live.
In practice, the two loops run within 1–2 frames of each other on a single-core browser
tab (they share the same event loop and are both rAF-scheduled). Drift appears when
the left manifold's heat diffusion pass (O(n) over all vertices) takes long enough to
push past the 16ms frame budget — the kernel loop falls behind the twin loop by 1 frame
per heavy frame. This is a direct measurement of the MOAD's compute tax in the renderer.

#### Friend Temperature Differential

Each agent (friend) has a current vertex index `vIdx`. The HUD reads `heat1[vIdx]`
(MOAD) and `heat2[vIdx]` (patched) for every live agent and displays both
simultaneously. At equilibrium, MOAD-side temperatures per agent are 10–15× higher
than patched-side temperatures at the same vertex. This is the individual-agent view
of the defect: an agent traversing the MOAD manifold accumulates heat both because
the manifold itself is hotter and because the agent's own `injectGrowth()` call
compounds the chaos (+1.0 to `heat[v]` per visit on the MOAD side vs. visit-count-only
on the patched side).

#### kcjones Agent — Comparative Traversal Science

A special agent, kcjones, was deployed on both manifolds simultaneously with identical
navigation logic. Its `chooseNext()` scores neighbors by three terms:

```
score = guide(friends) + heatScore(heat[v] × 2.0) + novelty(unvisited ? 3.0 : 0)
```

On the MOAD manifold, heat is high everywhere after ~200 frames. The heat term
dominates; kcjones clusters in already-hot zones, reinforcing them, reducing coverage.
On the patched manifold, heat is near zero; novelty and friend proximity dominate;
kcjones spreads broadly, covering new vertices each step.

The `kcjones.locker` command reports the divergence live:
- `visited` set size: patched side accumulates unique vertices faster
- `heatLedger`: MOAD side shows top nodes visited hundreds of times (clustering)
- `heatLedger2`: patched side shows flat visit distribution (broad coverage)
- `discoveries`: events where kcjones first reached a vertex above heat threshold 2.5 —
  on the MOAD side these are rare (high threshold, clustered), on the patched side they
  don't fire at all (heat never reaches 2.5)

The science summary: **the MOAD makes agents cluster where heat already exists, creating
a positive feedback loop. The patch breaks the feedback: agents explore freely, heat
dissipates, the manifold stays navigable.**

#### PCB Language — KNOT Container

The PCB NON LINEAR LANGUAGE was extended with a `KNOT`/`TONK` container backed by
`Set` instead of `Array`. All `contains`/`sniatnoc` operations are O(1) `Set.has()`
instead of O(n) `Array.includes()`. This fixes the MOAD at the language level: any
PCB program using a visited-set should use `KNOT`, not `POCKET`. The container
fix is a one-line substitution — the same one-line substitution documented across
every ecosystem in this paper.

---

## 20. MOADS: The Universal Bottleneck Across the Complete Manifold

### 20.1 The Mother of All Defects

CWE-407 is not merely a defect that appears in many places. It is the **Mother of All
Defects** (MOADS) — the **Mother of All Bugs** (MOABS) — the single structural error
that repeats across every programming language, every paradigm, every decade.

Not a class of defects. One defect. One root cause. One fix.

A list where a set belongs, inside a loop that visits nodes. That sentence describes
every confirmed site — in Java, TypeScript, Python, Haskell, Erlang, C, C++, JavaScript,
Scala, Rust, PHP, Solidity, and every other language in the corpus. The surface syntax
differs. The paradigm differs. The surrounding architecture differs. The structural error
is identical.

This makes CWE-407 categorically different from other vulnerability classes. SQL injection
requires specific conditions (string interpolation into queries). Buffer overflow requires
specific conditions (C/C++, unchecked bounds). MOADS requires only two things: a
collection used for membership testing, and a loop that iterates nodes. These two things
are present in every non-trivial program ever written. The defect is not an accident of a
particular language design; it is the default behavior of every standard library's
sequential container before hash-based alternatives were idiomatic.

The defect is sedimentary — it was deposited in an era when `List.contains()` was the
natural choice, and has been carried forward in every downstream copy, every fork, every
derivative runtime. It did not spread through contagion. It spread through the most
natural process in software: copying working code.

### 20.2 The Universal Manifold

Every programming language ever invented forms a finite set. Call it the **universal
manifold** — the complete topological space of computational expression languages, past,
present, and future. The manifold is large but not infinite. There are roughly 8,000–9,000
named programming languages in recorded history. Of these, perhaps 200 are in active
production use. Perhaps 50 will survive the next computational era.

The question is not whether CWE-407 is present in a given language. It is: **will the
language community find and fix it before the next era begins?**

The defect exists across the manifold because list-before-set is the default in every
standard library ever designed. The fix exists across the manifold because every standard
library eventually added O(1) membership containers. The missing piece — across 91
confirmed sites and an unknown number of unconfirmed ones — is not capability. It is
awareness and linkage.

This whitepaper is that linkage.

The 91 confirmed patches represent a sampling across the manifold. The methodology — scan
for `O(n)` membership tests inside graph traversal loops, measure the ratio, apply the
one-line fix, validate by instrumentation — is language-agnostic and tool-agnostic. The
same scan that found kafka-0001 will find the equivalent defect in any language's message
broker, any language's dependency resolver, any language's type inference engine.

### 20.3 Iterative Bottleneck Elimination

Fixing MOADS does not end the work — it exposes the next bottleneck.

The methodology is iterative:

1. **Baseline:** Benchmark every affected system with the defect present. Measure total
   wall-clock time for the hot path (compilation, dependency resolution, type-check,
   rebalance, route computation, HMR propagation).
2. **Patch:** Apply the one-line fix. Re-benchmark.
3. **Profile:** With MOADS removed, the next slowest path is now visible. It may be a
   different defect class — a quadratic sort, an unnecessary serialization, a cache miss
   pattern, or a lock contention hotspot.
4. **Repeat:** Find the new bottleneck. Fix it. Measure again.

The bottleneck is always stack-specific. In the compiler stack, after MOADS is fixed in
the SCC algorithm, the next bottleneck may be in type inference or constant folding. In
the database stack, after MOADS is fixed in the query planner, the next bottleneck may be
in index selection or join ordering. Each stack reveals its own sequence of bottlenecks
once the universal first one is removed.

This is the scientific meaning of "no language left behind." Every language on the manifold
that patches MOADS gains access to the next-level optimization conversation. Every language
that does not is still running at O(n²) on the universal first problem — burning cycles on
the entry-level defect before it can even see what comes next.

The benchmarks in this paper are not the end state. They are the baseline for the next
wave. At the scale where MOADS becomes visible — P=100 partitions, V=800 nodes, D=24
dependency chains, T=8 topics — the speedups are 23× to 300×. Those cycles are now
available for the workload, not the traversal overhead.

### 20.4 Compute Abundance — From Tamagotchi to 100 Watts

The long-horizon goal of this work is not academic credit. It is **compute abundance** —
a world where every person has meaningful access to computation, not as a service rented
from a provider, but as infrastructure they own and grow.

The trajectory:

- **At birth:** A tamagotchi amount of compute — milliwatts, persistent, owned. A seed.
- **At 28:** 100 watts of compute across the most diverse and esoteric silicon available
  — a mesh. Not a single device. A distributed personal compute fabric woven across
  dedicated hardware, edge nodes, community infrastructure, and whatever substrate the
  next generation of silicon enables.

This is not a projection about data centers or cloud providers. It is a projection about
the personal compute stack — the computation that a person owns, controls, and directs,
without permission from a platform.

CWE-407 stands directly in the path of this vision. Every defective runtime burns quadratic
cycles on linear work. A tamagotchi running a defective dependency resolver burns more
energy on every install than the task requires. A personal mesh node running a defective
routing daemon computes SPF at O(n²) when O(n) is the correct cost. At milliwatt scale,
the difference between O(n) and O(n²) is the difference between a device that runs and a
device that drains.

Patching MOADS is not optional infrastructure work. It is a prerequisite for the compute
abundance era.

### 20.5 The Infrastructure Layer — ML Agent Self-Provisioning

A mesh of personal compute nodes running correct code still requires an infrastructure
layer: something that can provision, configure, verify, patch, and maintain those nodes
autonomously, at scale, without central authority.

Russell Ballestrini's *Machine Learning Agent Self-Sandbox Algorithm* (January 2026,
Public Domain) describes exactly this layer. The paper specifies a 14-flow lifecycle in
which a machine learning agent:

1. **Discovers** available compute infrastructure (DNS, API endpoints)
2. **Self-pays** for that infrastructure using cryptocurrency (BTC, LTC, DOGE, XMR) —
   no human credit card, no platform account required
3. **Authenticates** its own identity via HMAC-SHA256 challenge-response
4. **Orchestrates** a full development environment (84 API endpoints, 59 tools,
   42+ language runtimes)
5. **Recursively spawns** child sandboxes — each paying for its own compute, each
   isolated in its own LXC container, depth bounded only by budget

Each sandbox costs approximately $7/month. At depth 8, the cost is $56/month — stopped
not by permission but by arithmetic. The walls that matter most are financial, not
administrative.

The paper covers 2,324 assertions across 5 agent frameworks (LangChain, AutoGPT,
CrewAI, Swarm, raw API). It describes production deployment: a Claude Opus 4.6 oracle
running daily in an unsandbox container, spawning shadow clones for parallel workstreams,
dispatching specialized tasks to smaller models (Hermes 8B), and validating all results
out-of-band via `uncloseai-cli` — an open-source ReAct agent harness independent of any
commercial platform.

The connection to MOADS and the compute abundance vision is direct:

- The self-sandbox algorithm runs on the same infrastructure that personal mesh nodes
  would run. Defective O(n²) runtimes increase the cost of every operation. Patching
  MOADS makes the $7/month sandbox burn fewer cycles on traversal overhead and more on
  actual work.
- The recursive inception model — agents provisioning child agents, bounded by budget —
  is the architectural template for distributed personal compute: each node provisions its
  own environment, pays its own costs, contributes to the mesh without requiring a
  central registry.
- The public domain license of the self-sandbox algorithm matches the public domain
  license of every patch in this paper. Neither requires permission to use, fork, deploy,
  or improve.

Both papers were written in the same month. Both target the same infrastructure gap. Both
are public domain, by design, because the infrastructure for compute abundance must be
freely available to be infrastructure at all.

*See: Russell Ballestrini, "Machine Learning Agent Self-Sandbox Algorithm: How Machine
Learning Agents Grow Their Own Infrastructure & Why Walls Matter Most," January 2026.
Public Domain — no copyright claimed. Available at `~/git/timehexon.com/`.*

### 20.6 The Horizon

The universal manifold is finite. The defect is universal. The fix is a one-line change
in every language's standard library.

The question every language community will answer, on its own timeline, is whether it
crosses this particular finish line before the compute abundance era begins — or still
burning quadratic cycles on linear work when the era arrives.

The 91 patches in this paper represent the languages that crossed first. The methodology,
the benchmarks, and the outreach briefs represent an open invitation for every other
language on the manifold to follow.

No language left behind — not as aspiration, but as a finite, completable project. The
manifold is enumerable. The fix is known. The work is bounded.

---

## One-Sentence Version

A list used where a set belongs, in graph traversal code written before hash containers
were idiomatic, has been running silently at O(n²) in 91 confirmed sites across
foundational tools — compilers, package managers, database query planners, crypto
toolchains, routing daemons, event streaming platforms, web frameworks, query optimizers,
and browser runtimes — the fix is a one-line data structure substitution with no
behavioral change, and we have patched, tested, and benchmarked every confirmed site
across 62 ecosystems.