sparrow-0001: WalletUtxosEntry.updateUtxos() ArrayList.removeAll O(N^2)
UTXO diff uses List.removeAll which is O(current * previous).
Fix: Set-based diff via Sets.difference (same pattern already used
in WalletTransactionsEntry). MEDIUM, 250x at N=1000 UTXOs.
sparrow-0002: UtxoEntry.recountMixesDone stream().anyMatch O(M*I*T)
Whirlpool mix chain walk streams all wallet TXOs per input per mix.
Fix: HashMap<Sha256Hash, Set<Long>> index for O(1) lookup.
MEDIUM-HIGH, 50x at M=200 mixes, T=1000 TXOs.
MOAD-0002 (Intertangle): EventManager is a thin Guava EventBus singleton,
not a god object. Wallet/network/UI coupling is event-driven, acceptable.
MOAD-0003 (Leaked Context): CLEAN, no ThreadLocal usage found.
MOAD-0004 (Logged Secret): CLEAN, no private keys/mnemonics/passphrases
logged. SecureChannelSession has commented-out secret logging.
MOAD-0005 (Thundering Herd): CLEAN, no unsynchronized cache patterns.
4/4 unit tests PASS. UNDF-2026-000000931 through UNDF-2026-000000932.
russell@unturf.com
830b54936d