## Diamond Recursion Scan — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `src/graph.cc` — `RecomputeDirty`, `RecomputeNodeDirty`, `VerifyDAG`
- `src/deps_log.cc`

### Findings

**RecomputeNodeDirty:** Uses `node->status_known()` as a per-node visited flag. Before recursing into dependencies, Ninja checks `if (node->status_known()) return true;`. This is the canonical O(N) visited-flag pattern — CLEAN.

**VerifyDAG:** Uses a DFS `stack` vector for cycle detection (ancestor set). Non-recursive for the visited case — uses an `in_edge_->mark` flag to detect already-processed edges.

### Verdict: CLEAN — no diamond recursion CWE-407 found
