bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
for each event per function; fix: IndexSet (already a dependency) for O(1) dedup
tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
Transmission: bitfields for piece tracking, sorted binary search for string table
libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph
- Corrected fix in patch: use persistent `seen` set (no backtrack remove)
so diamond shared-nodes are visited once, not 2^D times
- Previous patch used DFS path-stack (cycle guard) which did not prevent
the 2^D blowup for convergent diamonds
- Add unit test: chained-diamond D=12 shows 334× visit reduction (16381→49)
- Performance test: ArrayList→HashSet for evaluatedNodes gives 51× speedup at N=500
dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)
cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)
Struts, RabbitMQ, Camel: CLEAN
ShowCommand._display_tree() uses a list for packages_in_tree, making every
`dep.name in current_tree` check O(N). For a project with 500 packages the
total membership-test cost is O(N²) ≈ 250,000 ops vs O(N) = 500 with a set.
Also fixes shared-state correctness bug: list is passed by reference causing
sibling branches to falsely report diamond dependencies as cycles.
Fix: set + per-branch set-union copy; 16-31x speedup measured.
CLEAN markers added for setuptools and celery (diamond recursion).
pip, django, poetry solver already CLEAN (prior or current scan).
InFlightMetadataCollectorImpl.buildRecursiveOrderedFkSecondPasses() lacks a
visited-table set — only guards against direct self-cycles (startTable check).
On diamond FK dependency graphs (A references B and C, both B and C reference D),
node D is visited 2^depth times. At depth=10: 25.9x overhead; at depth=13: 124x.
Fix: add Set<String> visitedTables parameter; skip re-entry with visited.add().
Unit test: HibernateFkDiamondRecursionTest.java — confirms exponential growth and
correctness (both algorithms produce identical FK sets). 4/4 assertions PASS.
Separate from hibernate-0004 (which addressed the O(N^2) ArrayList.contains()
in the same method); that patch uses LinkedHashSet to deduplicate output but does
not prevent exponential recursive traversal of intermediate diamond nodes.
spring and ant: diamond recursion scan CLEAN markers added.
findAndVerifyWindowGrace() recurses over parent GraphNodes without a visited
accumulator. Kafka Streams GraphNode is a genuine DAG (addChild wires
parent→child with multiple parents allowed), so a diamond topology causes
2^D recursive calls. Fix: thread an IdentityHashMap<GraphNode,Long> memo
through recursion; memoize on first visit, return cached result on revisit.
8/8 unit tests PASS; D=10 defect count=3071 vs patched O(N).
Diamond-recursion CLEAN markers added for: flink, neo4j, janusgraph,
tinkerpop, dgraph, zookeeper, storm, ant, gradle, graal, eclipse-jdt,
exposed, intellij, kotlin, scala3, hibernate-0007 (prior session work
now committed).
