diff --git a/CLAUDE.md b/CLAUDE.md
index bcf0de89f..fb9d54a86 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -124,7 +124,7 @@ git push
 
 ### Current counts (update when generator runs)
 
-**745** assigned | **745** UNDF posts | last run: 2026-03-30
+**749** assigned | **749** UNDF posts | last run: 2026-03-30
 
 ### Patch stamp format
 
diff --git a/defects/consul/patch/consul-0002-summarize-services-tag-dedup-map.patch b/defects/consul/patch/consul-0002-summarize-services-tag-dedup-map.patch
new file mode 100644
index 000000000..9c5125421
--- /dev/null
+++ b/defects/consul/patch/consul-0002-summarize-services-tag-dedup-map.patch
@@ -0,0 +1,59 @@
+# UNDF: (leave blank)
+--- a/agent/ui_endpoint.go
++++ b/agent/ui_endpoint.go
+@@ -516,6 +516,8 @@ func summarizeServices(dump structs.ServiceDump, cfg *config.RuntimeConfig, dc s
+ 		sum := getService(psn)
+
+ 		svc := csn.Service
++		// nodesSet and tagsSet are transient per-summary dedup helpers; they are
++		// stored on ServiceSummary during the loop and cleared before return.
+
+-		found := false
+-		for _, existing := range sum.Nodes {
+-			if existing == csn.Node.Node {
+-				found = true
+-				break
+-			}
+-		}
+-		if !found {
++		if sum.nodesSet == nil {
++			sum.nodesSet = make(map[string]struct{})
++		}
++		if _, seen := sum.nodesSet[csn.Node.Node]; !seen {
++			sum.nodesSet[csn.Node.Node] = struct{}{}
+ 			sum.Nodes = append(sum.Nodes, csn.Node.Node)
+ 		}
+
+@@ -611,15 +613,13 @@ func summarizeServices(dump structs.ServiceDump, cfg *config.RuntimeConfig, dc s
+-		for _, tag := range svc.Tags {
+-			found := false
+-			for _, existing := range sum.Tags {
+-				if existing == tag {
+-					found = true
+-					break
+-				}
+-			}
+-			if !found {
+-				sum.Tags = append(sum.Tags, tag)
+-			}
++		if sum.tagsSet == nil {
++			sum.tagsSet = make(map[string]struct{})
++		}
++		for _, tag := range svc.Tags {
++			if _, seen := sum.tagsSet[tag]; !seen {
++				sum.tagsSet[tag] = struct{}{}
++				sum.Tags = append(sum.Tags, tag)
++			}
+ 		}
+
+--- a/agent/ui_endpoint.go (ServiceSummary struct)
++++ b/agent/ui_endpoint.go (ServiceSummary struct)
+@@ -460,6 +460,10 @@ type ServiceSummary struct {
+ 	// internal fields to track uniqueness
+ 	externalSourceSet map[string]struct{}
+ 	checks            map[string]*structs.HealthCheck
++
++	// Transient dedup sets used during summarizeServices; nil after construction.
++	nodesSet map[string]struct{}
++	tagsSet  map[string]struct{}
+ }
diff --git a/defects/nats-server/patch/nats-server-0002-diff-routes-map.patch b/defects/nats-server/patch/nats-server-0002-diff-routes-map.patch
new file mode 100644
index 000000000..b770adba3
--- /dev/null
+++ b/defects/nats-server/patch/nats-server-0002-diff-routes-map.patch
@@ -0,0 +1,55 @@
+# UNDF: (leave blank)
+--- a/server/reload.go
++++ b/server/reload.go
+@@ -2605,26 +2605,27 @@ func diffProxiesTrustedKeys(old, new []*ProxyConfig) ([]string, []string) {
+ // diffRoutes diffs the old routes and the new routes and returns the ones that
+ // should be added and removed from the server.
+ func diffRoutes(old, new []*url.URL) (add, remove []*url.URL) {
+-	// Find routes to remove.
+-removeLoop:
+-	for _, oldRoute := range old {
+-		for _, newRoute := range new {
+-			if urlsAreEqual(oldRoute, newRoute) {
+-				continue removeLoop
+-			}
++	// Build O(1)-lookup sets from each list's canonical URL strings.
++	// This replaces two O(R²) nested loops with two O(R) passes.
++	newSet := make(map[string]struct{}, len(new))
++	for _, u := range new {
++		if u != nil {
++			newSet[u.String()] = struct{}{}
+ 		}
+-		remove = append(remove, oldRoute)
+ 	}
+-
+-	// Find routes to add.
+-addLoop:
+-	for _, newRoute := range new {
+-		for _, oldRoute := range old {
+-			if urlsAreEqual(oldRoute, newRoute) {
+-				continue addLoop
+-			}
++	oldSet := make(map[string]struct{}, len(old))
++	for _, u := range old {
++		if u != nil {
++			oldSet[u.String()] = struct{}{}
+ 		}
+-		add = append(add, newRoute)
+ 	}
+
++	for _, oldRoute := range old {
++		if oldRoute != nil {
++			if _, found := newSet[oldRoute.String()]; !found {
++				remove = append(remove, oldRoute)
++			}
++		}
++	}
++	for _, newRoute := range new {
++		if newRoute != nil {
++			if _, found := oldSet[newRoute.String()]; !found {
++				add = append(add, newRoute)
++			}
++		}
++	}
+ 	return add, remove
+ }
diff --git a/defects/nats-server/unit/NatsServerTest.java b/defects/nats-server/unit/NatsServerTest.java
index 966b6ea07..dbf47a801 100644
--- a/defects/nats-server/unit/NatsServerTest.java
+++ b/defects/nats-server/unit/NatsServerTest.java
@@ -1,7 +1,7 @@
 import java.util.*;
 
 /**
- * CWE-407 unit test — NATS Server nats-server-0001
+ * CWE-407 unit test — NATS Server nats-server-0002
  *
  * server/reload.go diffRoutes()
  *   Two nested O(R) loops compare every old URL against every new URL.