java-topology/defects/tensorflow/tensorflow-diamond-recursion-CLEAN.md

Diamond Recursion Scan (tensorflow) — CLEAN (deeper scan)

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• tensorflow/python/ops/variables.py:_has_cycle — uses state dict with _STARTED/_FINISHED markers (three-color DFS) — CLEAN
• tensorflow/python/keras/engine/functional.py:_build_map_helper — uses finished_nodes set + nodes_in_progress set — CLEAN
• tensorflow/python/checkpoint/restore.py — uses BFS with deferred queue — CLEAN
• tensorflow/python/ops/control_flow_util_v2.py:resource_input_index — linear parent-chain walk, not DAG traversal — CLEAN

Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing tensorflow-0001