diamond-scan: llvm/gcc/swift/webkit O(2^D) type hierarchy traversal

swift-0001: QualifiedLookupRequest::evaluate (NameLookup.cpp:2860) pushes
protocol superclassDecl onto BFS stack unconditionally — visited.insert()
return not checked. Nearby ClassDecl arm (line 2833) is correctly guarded.
Diamond protocol hierarchies sharing a class superclass trigger O(2^D)
re-traversal on every qualified member lookup. Fix: check .second.

llvm, gcc, webkit: CLEAN in available sparse-clone code.

defects/webkit/patch/CLEAN.md

@@ -0,0 +1,25 @@
+# CLEAN — WebKit (JavaScriptCore)
+Scanned 2026-03-30 for CWE-407 diamond recursion (O(2^D)).
+
+## Scope
+
+Sparse clone: `Source/JavaScriptCore/` — bytecode/, dfg/, b3/ subdirectories
+(390 .cpp files). The `runtime/` directory (prototype chain traversal,
+JSObject hierarchy) is not present in this clone.
+
+## Findings
+
+- `dfg/DFGValidate.cpp` — uses `seen.add(node).isNewEntry` (WebKit HashSet
+  API; isNewEntry == true means newly inserted). Correctly guarded. CLEAN.
+- `dfg/DFGCombinedLiveness.cpp` — `seen.add(node).isNewEntry` guard. CLEAN.
+- `dfg/DFGLiveCatchVariablePreservationPhase.cpp` — `seen.add(predecessor)` with
+  `bool isNewEntry` capture and conditional push. CLEAN.
+- `dfg/DFGIntegerRangeOptimizationPhase.cpp` — `m_seenBlocks.add(target)` with
+  `if` guard. CLEAN.
+- No WebKit `.add()` without `.isNewEntry` check found in DFG, b3, or
+  bytecode paths.
+- `runtime/` (JSObject prototype chain, JSClass hierarchy) not available
+  in this sparse clone — cannot confirm absence of defects there.
+
+**Result: No actionable O(2^D) diamond defects in available code.
+Note: runtime/ not cloned; prototype chain traversal unverified.**