# doctrine-orm diamond recursion scan — CLEAN

Scanned: 2026-03-29
Scope: diamond recursion / CWE-407 in ORM dependency graph traversal

## Files checked

- `src/Internal/TopologicalSort.php` — DFS with 3-state coloring (NOT_VISITED / IN_PROGRESS / VISITED);
  uses `$this->states` array indexed by `spl_object_id()` for O(1) visited check. Clean.
- `src/Internal/StronglyConnectedComponents.php` — Tarjan SCC with visited arrays. Clean.
- `src/UnitOfWork.php` — delegates to `TopologicalSort` for insert/delete ordering. Clean.

## Verdict

CLEAN. All graph traversal uses proper visited-state tracking with O(1) lookups.
No diamond recursion pattern (unbounded recursion without a visited accumulator).
