## Diamond Recursion Scan — Deeper Scan Notes

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Summary

**meson-0002 FOUND** in `get_internal_static_libraries_recurse` (link_whole_targets branch missing visited guard) — see `meson-0002-link-whole-diamond-recursion.md`.

**meson-0001 (existing)** covers `extra_files` dedup O(N²) in `process_link_depends`.

### Other functions checked — CLEAN

- `get_dependencies_recurse` (line 1500): has explicit `visited` set parameter — CLEAN.
- `get_dependencies` (line 1485): creates `visited` set and passes it — CLEAN.
- `get_internal_static_libraries` (line 1620): calls `get_internal_static_libraries_recurse` — DEFECTIVE (meson-0002).
- `build.py` dependency resolution: uses `OrderedSet` throughout for dedup — CLEAN beyond meson-0002.
