# efcore diamond recursion scan — CLEAN

Scanned: 2026-03-29
Scope: diamond recursion / CWE-407 in migration dependency graph traversal

## Files checked

- `src/Shared/Multigraph.cs` — Kahn's algorithm (BFS topological sort) using
  `Dictionary<TVertex, Dictionary<TVertex, object?>>` for `_successorMap` and
  `_predecessorMap`. `predecessorCounts` is a `Dictionary<TVertex, int>`. All
  O(1) hash operations, no Array linear scans. Clean.
- `src/EFCore/Migrations/` — delegates to `Multigraph`. Clean.
- `src/EFCore.Relational/Metadata/Internal/Sequence.cs` — `IsCyclic` is a
  sequence property (CYCLE/NO CYCLE SQL option), not graph cycle detection. Clean.

## Verdict

CLEAN. All topology code uses Kahn's BFS with Dictionary-based O(1) lookups.
No diamond recursion pattern. EFCore already has 3 previous defects (0001-0003)
in different subsystems.