diamond hunt: godot-0009/0010 + meson-0002 + typeorm-0004/0005 + ts-0003; count 629→635

New diamond recursion defects (O(2^D) → O(N)):
- godot-0009: Font::_is_cyclic no visited set — CJK fallback diamond, 2648x at F=4,D=8
- godot-0010: Font::_update_rids_fb no visited set — duplicate RIDs + O(N^2) hot path
- meson-0002: get_internal_static_libraries_recurse link_whole guard missing — 132x at D=10
- typescript-0003: hasBaseType inner check() no visited set — 1024x at D=10; hot on instanceof

New O(N²) defects:
- typeorm-0004: SubjectTopologicalSorter Array.indexOf dedup — 200x at N=400
- typeorm-0005: DepGraph.createDFS result.indexOf + addDependency edge dedup — 300x at N=600

CLEAN confirmed (diamond recursion sweep): bazel, cargo, cmake, composer, dgl, diesel,
doctrine-orm, efcore, helm, mybatis, networkx-deeper, ninja, npm-arborist, peewee, pip,
rubygems, seaorm, sqlalchemy, swift

UNDF: 571→578 assigned; MOAD count: 629→635

defects/networkx/patch/networkx-deeper-diamond-CLEAN.md

@@ -0,0 +1,18 @@
+## Diamond Recursion Scan — Deeper Scan Notes
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Summary
+
+**nx-0001 (existing)** covers `recursive_simple_cycles` B defaultdict(list) O(N²).
+**nx-0002 (existing)** covers `all_node_cuts` seen-list O(K²).
+
+### Additional functions checked — CLEAN
+
+- `dag.py descendants/ancestors`: uses `bfs_edges` which employs a visited set internally — CLEAN.
+- `dag.py has_cycle`: uses `topological_generations` which is iterative with a visited set — CLEAN.
+- `algorithms/chains.py chain_decomposition`: uses explicit `visited = set()` — CLEAN.
+- All other DAG algorithms in `networkx/algorithms/dag.py` use proper visited sets.
+
+### Verdict: No additional diamond recursion defects found beyond nx-0001 and nx-0002