@@ -422,6 +422,53 @@ def flow_path(nodes: Sequence[SliceNode], edges: Sequence[Tuple[str, "str | None
     return FlowPath(hops=[PathHop(frm=nodes[i], to=nodes[i + 1], via=via[rel], var=var, prov=list(prov or [])) for i, (rel, var, prov) in enumerate(edges)])
 
 
+def reach(edges: Mapping[str, Mapping[str, Sequence[tuple]]], src: str, depth: "int | None") -> set:
+    """The node ids reachable from ``src`` over ``edges`` in at most ``depth`` hops.
+
+    ``edges`` is one direction of the ``{src: {dst: [label]}}`` adjacency each local backend
+    builds -- only the keys are read, so the labels are ignored here. ``depth`` of ``None`` is the
+    whole cone.
+
+    Level-by-level rather than a plain stack, because ``depth`` is a hop budget and a depth-first
+    walk cannot count hops without revisiting. Every local backend's slices and flow predicates go
+    through this, so "reachable" means one thing per language *and* across them.
+
+    **A node enters the next frontier once**, which is why ``seen`` is added to inside the level
+    rather than after it. The obvious spelling builds the level as a comprehension and updates
+    ``seen`` afterwards::
+
+        nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
+        seen.update(nxt)
+
+    That is correct and unusable. ``seen`` does not yet contain the level being built, so a node
+    with *k* predecessors in the current frontier is appended *k* times and the next level expands
+    every copy: the frontier tracks the number of **paths**, not the number of nodes. A set cannot
+    hold duplicates, so the answer never changes -- which is exactly why it survived in four
+    separate copies of this function until an evaluation against a real application measured the
+    cost. On the ``memos`` corpus (208,293 source nodes, 743,154 edges), over 250 ports: identical
+    reachable sets at every depth, and 151,417,783 frontier expansions at depth 8 against 670,450
+    -- 83.65s against 0.11s -- while unbounded it did not terminate at all. ``depth=None`` is the
+    default on ``paths_between`` / ``flows_to_call`` / ``flows_to_argument`` / ``taint``, so the
+    unusable case was the default one (python-sdk#436).
+
+    Lifted out of the four language backends for :func:`shortest_walks`' reason, and with its
+    history as the argument: it is a graph algorithm over an adjacency of strings and knows no
+    language, and four copies were four places to drift -- which is how one bug came to live in
+    all of them.
+    """
+    seen, frontier, hops = {src}, [src], 0
+    while frontier and (depth is None or hops < depth):
+        nxt = []
+        for node in frontier:
+            for d in edges.get(node, ()):
+                if d not in seen:
+                    seen.add(d)
+                    nxt.append(d)
+        frontier = nxt
+        hops += 1
+    return seen
+
+
 def shortest_walks(
     edges: Mapping[str, Mapping[str, Sequence[tuple]]],
     src: str,
 
@@ -49,7 +49,7 @@
     check_page_size,
     edge_page,
 )
-from cldk.analysis.commons.graphs import call_reaches, cone_sinks, flow_path, shortest_walks, slice_resolved, under_callable
+from cldk.analysis.commons.graphs import call_reaches, cone_sinks, flow_path, reach, shortest_walks, slice_resolved, under_callable
 from cldk.analysis.commons.levels import analyzer_level
 from cldk.analysis.commons.resolve import (
     CallableCandidate,
@@ -727,39 +727,13 @@ def get_ddg(self, callable: str, *, in_class: str | None = None, page_size: int
     def _reach(self, ref: str, direction: str, depth: int | None) -> set:
         """The node ids reachable from ``ref`` in at most ``depth`` hops.
 
-        Level-by-level rather than a plain stack, because ``depth`` is a hop budget and a
-        depth-first walk cannot count hops without revisiting. Shared by the slices and by the two
-        flow predicates, so "reachable" means one thing on this backend.
-
-        **A node enters the next frontier once, which is the whole point of adding to ``seen``
-        inside the loop rather than after it.** The obvious spelling builds the level as a
-        comprehension and updates ``seen`` afterwards::
-
-            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
-            seen.update(nxt)
-
-        That is correct but not usable: ``seen`` does not yet contain the level being built, so a
-        node with *k* predecessors in the current frontier is appended *k* times and the next level
-        expands every copy. The frontier then tracks the number of **paths** rather than the number
-        of nodes. Measured on memos (208,293 source nodes, 743,154 edges), over 250 ports: identical
-        answers at every depth — duplicates cannot change a set — but 151,417,783 frontier
-        expansions at depth 8 against 670,450, which is 83.65s against 0.11s, and unbounded it does
-        not terminate at all. Since ``depth=None`` is the default on
-        :meth:`paths_between`, :meth:`flows_to_call`, :meth:`flows_to_argument` and :meth:`taint`,
-        the unusable case was the default one.
+        One line over :func:`~cldk.analysis.commons.graphs.reach`, which is where the walk and the
+        reason for its shape live: it is a graph algorithm over an adjacency of strings and knows no
+        language. This method stays because the *direction* is a backend concern — which half of the
+        cached adjacency to read — and because the slices and both flow predicates call it, so
+        "reachable" means one thing here.
         """
-        edges = self._sdg[0][direction]
-        seen, frontier, hops = {ref}, [ref], 0
-        while frontier and (depth is None or hops < depth):
-            nxt = []
-            for src in frontier:
-                for d in edges.get(src, ()):
-                    if d not in seen:
-                        seen.add(d)
-                        nxt.append(d)
-            frontier = nxt
-            hops += 1
-        return seen
+        return reach(self._sdg[0][direction], ref, depth)
 
     def _slice_from(self, root: SliceNode, direction: str, depth: int | None, max_nodes: int) -> Slice:
         """:meth:`_reach`'s closure from ``root``, described and capped as the graph's is.
 
@@ -41,7 +41,7 @@
 from cldk.analysis.commons.identity import resolve_identity, validate_identity, cache_matches
 from cldk.analysis import AnalysisLevel
 from cldk.analysis.commons.bounds import DEFAULT_PAGE_SIZE, check_page_size, edge_page
-from cldk.analysis.commons.graphs import flow_path, shortest_walks, slice_resolved, under_callable
+from cldk.analysis.commons.graphs import flow_path, reach, shortest_walks, slice_resolved, under_callable
 from cldk.analysis.commons.levels import ANALYZER_LEVELS, LEVEL_NAMES, analyzer_level
 from cldk.analysis.commons.results import Diagnostic, EdgePage, FlowPath, FlowPaths, Slice, SliceNode
 from cldk.analysis.java.backend import (
@@ -547,17 +547,15 @@ def link(src: str, dst: str, label: tuple) -> None:
         return self._sdg_cache
 
     def _reach(self, ref: str, direction: str, depth: int | None) -> set:
-        """The set of node ids reachable from ``ref`` in at most ``depth`` hops. Level by level
-        rather than a plain stack, because ``depth`` is a hop budget and a depth-first walk cannot
-        count hops without revisiting."""
-        edges = self._sdg()[0][direction]
-        seen, frontier, hops = {ref}, [ref], 0
-        while frontier and (depth is None or hops < depth):
-            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
-            seen.update(nxt)
-            frontier = nxt
-            hops += 1
-        return seen
+        """The set of node ids reachable from ``ref`` in at most ``depth`` hops.
+
+        The walk is :func:`~cldk.analysis.commons.graphs.reach`, lifted there with its
+        measurements (python-sdk#436). The level-by-level shape and the reason a node must enter
+        the frontier exactly once live with it; the spelling that was here appended a node once per
+        predecessor, which left an unbounded walk non-terminating on a real application while every
+        answer it did return was correct. ``direction`` stays a backend concern.
+        """
+        return reach(self._sdg()[0][direction], ref, depth)
 
     def _value_slice(self, root: SliceNode, *, backward: bool, depth: int | None, max_nodes: int) -> Slice:
         """See :meth:`JavaAnalysisBackend._value_slice`. The whole closure is computed and then cut,
 
@@ -64,7 +64,7 @@
 from cldk.analysis.commons.keys import module_scope
 from cldk.analysis.commons.identity import resolve_identity, validate_identity
 from cldk.analysis import AnalysisLevel
-from cldk.analysis.commons.graphs import call_reaches, under_callable
+from cldk.analysis.commons.graphs import call_reaches, reach, under_callable
 from cldk.analysis.commons.levels import ANALYZER_LEVELS, LEVEL_NAMES, analyzer_level
 from cldk.analysis.commons.resolve import CallableCandidate, body_node_kind, resolve_callable_signature, resolve_value_name, resolve_within, value_candidate
 from cldk.analysis.commons.results import BodyRef, CallableRef, Diagnostic, EdgePage, EntrypointCoverage, FlowPath, FlowPaths, LocateResult, ModuleRef, Slice, SliceNode, TypeRef
@@ -1333,18 +1333,17 @@ def link(src: str, dst: str, label: tuple) -> None:
     def _reach(self, ref: str, direction: str, depth: int | None) -> set:
         """The set of node ids reachable from ``ref`` in at most ``depth`` hops.
 
-        Level-by-level rather than a plain stack, because ``depth`` is a hop budget and a
-        depth-first walk cannot count hops without revisiting. Shared by the slices and by the two
-        mixed flow queries so "reachable" means one thing on this backend.
+        Shared by the slices and by the two mixed flow queries so "reachable" means one thing on
+        this backend.
+
+        The walk is :func:`~cldk.analysis.commons.graphs.reach`, lifted there with its
+        measurements (python-sdk#436). The level-by-level shape and the reason a node must enter
+        the frontier exactly once live with it; the spelling that was here appended a node once per
+        predecessor, which left an unbounded walk non-terminating on a real application while every
+        answer it did return was correct. ``direction`` stays a backend concern -- which half of the
+        cached adjacency to read.
         """
-        edges = self._sdg()[0][direction]
-        seen, frontier, hops = {ref}, [ref], 0
-        while frontier and (depth is None or hops < depth):
-            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
-            seen.update(nxt)
-            frontier = nxt
-            hops += 1
-        return seen
+        return reach(self._sdg()[0][direction], ref, depth)
 
     def _slice_from(self, root: SliceNode, direction: str, depth: int | None, max_nodes: int) -> Slice:
         """:meth:`_reach`'s closure from ``root``, described and capped like the graph's.
 
@@ -53,7 +53,7 @@
     check_page_size,
     edge_page,
 )
-from cldk.analysis.commons.graphs import call_reaches, cone_sinks, flow_path, shortest_walks, slice_resolved, under_callable
+from cldk.analysis.commons.graphs import call_reaches, cone_sinks, flow_path, reach, shortest_walks, slice_resolved, under_callable
 from cldk.analysis.commons.keys import body_key_column, resolve_module_key
 from cldk.analysis.commons.levels import ANALYZER_LEVELS, LEVEL_NAMES, analyzer_level
 from cldk.analysis.commons.resolve import CallableCandidate, resolve_callable_signature, resolve_value_name, resolve_within
@@ -1186,18 +1186,16 @@ def link(src: str, dst: str, label: tuple) -> None:
     def _reach(self, ref: str, direction: str, depth: int | None) -> set:
         """The set of node ids reachable from ``ref`` in at most ``depth`` hops.
 
-        Level-by-level rather than a plain stack, because ``depth`` is a hop budget and a
-        depth-first walk cannot count hops without revisiting. Shared by the slices and by the two
-        flow predicates so "reachable" means one thing on this backend.
+        Shared by the slices and by the two flow predicates so "reachable" means one thing on this
+        backend.
+
+        The walk is :func:`~cldk.analysis.commons.graphs.reach`, lifted there with its
+        measurements (python-sdk#436). The level-by-level shape and the reason a node must enter
+        the frontier exactly once live with it; the spelling that was here appended a node once per
+        predecessor, which left an unbounded walk non-terminating on a real application while every
+        answer it did return was correct. ``direction`` stays a backend concern.
         """
-        edges = self._sdg[0][direction]
-        seen, frontier, hops = {ref}, [ref], 0
-        while frontier and (depth is None or hops < depth):
-            nxt = [d for src in frontier for d in edges.get(src, ()) if d not in seen]
-            seen.update(nxt)
-            frontier = nxt
-            hops += 1
-        return seen
+        return reach(self._sdg[0][direction], ref, depth)
 
     def _slice_node(self, ref: str) -> SliceNode:
         """One reached body node in the caller's vocabulary.
 
@@ -486,3 +486,94 @@ def test_the_local_acceptance_domain_is_delimited_too(module, cls):
     src = inspect.getsource(getattr(importlib.import_module(module), cls)._edge_vars_in)
     assert "under_callable(" in src, "the acceptance domain stopped delimiting; a sibling callable's vars leak in"
     assert ".startswith(" not in src, "a bare prefix accepts a variable the delimited cut cannot sever"
+
+
+# -----[ reach: the walk every local backend shares (python-sdk#436) ]-----
+#
+# Lifted out of four byte-identical copies, which is how one bug came to live in all of them:
+# each built the level as a comprehension and updated ``seen`` afterwards, so a node with k
+# predecessors in the current frontier was appended k times and the next level expanded every
+# copy. The reachable SET never changed -- a set cannot hold duplicates -- so only cost showed it.
+
+
+def _diamond_chain(levels):
+    """``n0 -> {a,b} -> n1 -> {a,b} -> n2 ...``: two predecessors per node, every level.
+
+    The shape the bug is quadratic-or-worse on, and small enough to assert exactly: ``1 + 3*levels``
+    nodes, but ``2**levels`` distinct paths from the head, so a frontier that counts paths rather
+    than nodes grows exponentially while the answer stays the same size.
+    """
+    edges = {}
+    for lvl in range(levels):
+        a, b, nxt = f"a{lvl}", f"b{lvl}", f"n{lvl + 1}"
+        edges[f"n{lvl}"] = {a: [()], b: [()]}
+        edges[a] = {nxt: [()]}
+        edges[b] = {nxt: [()]}
+    return edges, 1 + 3 * levels
+
+
+def test_reach_expands_each_node_at_most_once():
+    """The invariant, pinned by counting lookups rather than by timing.
+
+    18 levels is 55 nodes and 262,144 paths; the old walk made 1,048,573 frontier expansions for
+    them where this makes 55. Counting is the non-flaky way to say that.
+    """
+    from cldk.analysis.commons.graphs import reach
+
+    edges, expected = _diamond_chain(18)
+
+    class Counting(dict):
+        def __init__(self, inner):
+            super().__init__(inner)
+            self.fetches = {}
+
+        def get(self, key, default=None):
+            self.fetches[key] = self.fetches.get(key, 0) + 1
+            return super().get(key, default)
+
+    counting = Counting(edges)
+    got = reach(counting, "n0", None)
+    assert len(got) == expected
+    repeats = {k: n for k, n in counting.fetches.items() if n > 1}
+    assert not repeats, f"reach re-expanded {len(repeats)} node(s), e.g. {next(iter(repeats.items()))}"
+
+
+def test_reach_is_bounded_monotone_and_reaches_a_fixed_point():
+    """``depth`` is a hop budget: each bound contains the shallower ones, and past the graph's
+    diameter the answer stops growing. Unbounded must equal the fixed point, not exceed it."""
+    from cldk.analysis.commons.graphs import reach
+
+    edges, expected = _diamond_chain(6)
+    sizes = [len(reach(edges, "n0", d)) for d in range(1, 14)]
+    assert sizes == sorted(sizes), f"reach is not monotone in depth: {sizes}"
+    assert sizes[-1] == expected == len(reach(edges, "n0", None))
+    for d in range(1, 14):
+        assert reach(edges, "n0", d) <= reach(edges, "n0", None)
+
+
+def test_reach_handles_a_cycle_and_an_unknown_seed():
+    """A cycle must terminate (``seen`` is the guard, not the depth bound), and a seed with no
+    outgoing edges is its own reach rather than an error -- ``reaches(x, x)``'s zero-hop rule is
+    ``call_reaches``' business, not this walk's."""
+    from cldk.analysis.commons.graphs import reach
+
+    cyclic = {"a": {"b": [()]}, "b": {"c": [()]}, "c": {"a": [()]}}
+    assert reach(cyclic, "a", None) == {"a", "b", "c"}
+    assert reach({}, "lonely", None) == {"lonely"}
+    assert reach(cyclic, "a", 1) == {"a", "b"}
+
+
+def test_every_local_backend_delegates_to_the_shared_walk():
+    """No backend may keep its own copy: four copies were four places to drift, and they did."""
+    import inspect
+
+    from cldk.analysis.go.codeanalyzer import GoCodeanalyzer
+    from cldk.analysis.java.codeanalyzer import JCodeanalyzer
+    from cldk.analysis.python.codeanalyzer import PyCodeanalyzer
+    from cldk.analysis.typescript.codeanalyzer import TSCodeanalyzer
+
+    for cls in (PyCodeanalyzer, JCodeanalyzer, TSCodeanalyzer, GoCodeanalyzer):
+        src = inspect.getsource(cls._reach)
+        code = [ln.strip() for ln in src.splitlines() if ln.strip()]
+        assert any(ln.startswith("return reach(") for ln in code), f"{cls.__name__}._reach does not delegate"
+        assert not any("while frontier" in ln for ln in code), f"{cls.__name__}._reach still carries its own walk"