## Diamond Recursion Scan (luigi) — CLEAN (deeper scan)

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `luigi/tools/deps.py:dfs_paths` — "find all paths" function; re-visiting shared nodes on different paths is intentional (not a diamond blowup defect). Covered by luigi-0001 (O(D²) set-rebuild fix). — CLEAN re diamond recursion
- `luigi/execution_summary.py:_depth_first_search` — uses `visited` set — CLEAN
- `luigi/scheduler.py:_upstream_status` — iterative with `upstream_status_table` memoization — CLEAN

### Verdict: CLEAN — no NEW diamond recursion CWE-407; luigi-0001 covers existing issue
