## Diamond Recursion Scan — Deeper Scan Notes

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Summary

**typescript-0001 (existing)** covers `findResolutionCycleStartIndex` O(depth) list scan, `getExportsOfModuleWorker` visitedSymbols array O(N²), `getAccessibleSymbolChainFromSymbolTable` visitedSymbolTables array O(N²).

**typescript-0002 FOUND** in `hasBaseType` inner `check()` function — diamond interface hierarchy causes O(2^D) traversal. See `ts-0002-hasbasetype-diamond-recursion.md`.

### Other functions checked — CLEAN

- `getBaseTypes` (line 13296): caches result in `type.resolvedBaseTypes` after first computation — CLEAN for repeated calls to `getBaseTypes(sameType)`.
- `getResolvedBaseConstraint` / `getImmediateBaseConstraint` (line 15330): uses `pushTypeResolution`/`popTypeResolution` stack guard — CLEAN.
- `resolveBaseTypesOfClass` / `resolveBaseTypesOfInterface`: called once per type (guarded by `type.baseTypesResolved`) — CLEAN for resolution itself.
- `isCircularMappedProperty` (line 32381): checks single property, not a traversal — CLEAN.
- `hasNonCircularTypeParameterDefault` (line 15509): uses `pushTypeResolution` guard — CLEAN.
- `isReachableFlowNode` (line 28865): uses `FlowNode` state flags — CLEAN.

### GHC note (adjacent)

GHC's `transSuperClasses` in `TcType.hs` uses `rec_clss` (NameSet) to prevent cycles
but NOT to prevent re-visiting shared ancestors in diamond type-class hierarchies. The
`rec_clss` is passed down per-branch (not accumulated across siblings), meaning shared
superclasses in a diamond ARE visited twice. In practice Haskell class hierarchies are
shallow enough that this is not a practical concern. No new GHC defect filed.
