@@ -730,12 +730,33 @@ def _reach(self, ref: str, direction: str, depth: int | None) -> set:
         Level-by-level rather than a plain stack, because ``depth`` is a hop budget and a
         depth-first walk cannot count hops without revisiting. Shared by the slices and by the two
         flow predicates, so "reachable" means one thing on this backend.
+
+        **A node enters the next frontier once, which is the whole point of adding to ``seen``
+        inside the loop rather than after it.** The obvious spelling builds the level as a
+        comprehension and updates ``seen`` afterwards::
+
+            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
+            seen.update(nxt)
+
+        That is correct but not usable: ``seen`` does not yet contain the level being built, so a
+        node with *k* predecessors in the current frontier is appended *k* times and the next level
+        expands every copy. The frontier then tracks the number of **paths** rather than the number
+        of nodes. Measured on memos (208,293 source nodes, 743,154 edges), over 250 ports: identical
+        answers at every depth — duplicates cannot change a set — but 151,417,783 frontier
+        expansions at depth 8 against 670,450, which is 83.65s against 0.11s, and unbounded it does
+        not terminate at all. Since ``depth=None`` is the default on
+        :meth:`paths_between`, :meth:`flows_to_call`, :meth:`flows_to_argument` and :meth:`taint`,
+        the unusable case was the default one.
         """
         edges = self._sdg[0][direction]
         seen, frontier, hops = {ref}, [ref], 0
         while frontier and (depth is None or hops < depth):
-            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
-            seen.update(nxt)
+            nxt = []
+            for src in frontier:
+                for d in edges.get(src, ()):
+                    if d not in seen:
+                        seen.add(d)
+                        nxt.append(d)
             frontier = nxt
             hops += 1
         return seen
 
@@ -16,6 +16,7 @@
 """
 
 import json
+from collections import Counter
 from pathlib import Path
 from unittest.mock import MagicMock
 
@@ -382,6 +383,62 @@ def test_max_paths_caps_witnesses_and_says_so(httpsql):
     assert len(capped.paths) <= 1
 
 
+def test_reach_expands_each_node_exactly_once(backend):
+    """``_reach`` must add to ``seen`` *inside* the level, not after it.
+
+    The obvious spelling builds the level as a comprehension and updates ``seen`` afterwards, so
+    ``seen`` does not yet contain the level being built: a node with k predecessors in the current
+    frontier is appended k times, and the next level expands every copy. The frontier then tracks
+    the number of **paths** rather than the number of nodes.
+
+    Only cost reveals it, because a set cannot hold duplicates and the answer stays correct —
+    measured on the memos corpus (208,293 source nodes, 743,154 edges), 151,417,783 frontier
+    expansions at depth 8 against 670,450, 83.65s against 0.11s, and unbounded it never terminated.
+    ``depth=None`` is the default on ``paths_between`` / ``flows_to_*`` / ``taint``, so the unusable
+    case was the default one.
+
+    Pinned by counting expansions rather than by timing, which would be flaky, and rather than by
+    frontier size, which this fixture is too small to blow up: the adjacency is wrapped so every
+    lookup is recorded, and a correct walk looks each node up at most once.
+    """
+    forward = backend._sdg[0]["forward"]
+    seeds = [r for r in backend._port_refs if forward.get(r)]
+    assert seeds, "fixture has no port with an outgoing edge"
+
+    class Counting(dict):
+        def __init__(self, inner):
+            super().__init__(inner)
+            self.fetches = Counter()
+
+        def get(self, key, default=None):
+            self.fetches[key] += 1
+            return super().get(key, default)
+
+    for ref in seeds:
+        counting = Counting(forward)
+        backend._sdg[0]["forward"] = counting
+        try:
+            backend._reach(ref, "forward", None)
+        finally:
+            backend._sdg[0]["forward"] = forward
+        repeats = {k: n for k, n in counting.fetches.items() if n > 1}
+        assert not repeats, f"{ref}: {len(repeats)} node(s) expanded more than once, e.g. {next(iter(repeats.items()))}"
+
+
+def test_reach_is_monotone_and_terminates_unbounded(backend):
+    """An unbounded reach must terminate and contain every bounded one.
+
+    The frontier bug made the unbounded case non-terminating on a real application while every
+    bounded case still answered, so a suite that only ever passed a `depth` would not have seen it.
+    """
+    for ref in [r for r in backend._port_refs if backend._sdg[0]["forward"].get(r)][:12]:
+        unbounded = backend._reach(ref, "forward", None)
+        for depth in (1, 2, 3):
+            assert backend._reach(ref, "forward", depth) <= unbounded, f"{ref}: depth={depth} escapes the unbounded reach"
+        # And the walk is a fixed point: one more hop than the graph's diameter adds nothing.
+        assert backend._reach(ref, "forward", len(unbounded) + 1) == unbounded
+
+
 def test_the_two_slices_are_complementary(httpsql):
     """Forward is what a value affects, backward what affects it. The sink's port must be in the
     source's forward slice, and symmetrically."""