MOAD-0002 (Intertangle): UpdateContext god-object confirmed - couples GC, AVM1, AVM2, audio, video, rendering, networking, UI, storage, logging, timer, input all in one struct (core/src/context.rs). This is structural/architectural - no single-patch fix. MOAD-0003 (Leaked Context): CURRENT_CONTEXT thread_local in web/src/lib.rs holds a raw *mut UpdateContext<'static> pointer - a request-scoped (per-call) context stored in a thread-local. Also desktop/src/main.rs holds CALLSTACK/RENDER_INFO/SWF_INFO per-SWF state in thread_local. Both patterns carry request/session scope in thread scope. MOAD-0004 (Logged Secret): No verbatim credential logging found. Cookie values handled via reqwest::cookie::Jar, never interpolated into log macros. Proxy URL logged on error but contains no credentials. CLEAN. MOAD-0005 (Thundering Herd): Arc<Mutex<Player>> used for player access from async loader contexts. Single-owner pattern - no concurrent get+insert race on shared cache. Audio mixer uses Arc<Mutex<SlotMap>> for sound instances, protected by Mutex throughout. No unsynchronized cache double-check pattern found. CLEAN.
