crystal-0001: collect_ancestors O(2^D) diamond traversal; clojure/elixir/nim/lua CLEAN; count 621→622

defects/elixir/patch/CLEAN.md

@@ -0,0 +1,42 @@
+# Elixir — CWE-407 Diamond Recursion Scan: CLEAN
+
+## Scan Date
+2026-03-29
+
+## Targets Checked
+
+### 1. Behaviour/callback verification (`Module.Behaviour`)
+- **File:** `lib/elixir/lib/module/behaviour.ex`, `check_behaviours_and_impls`
+- **Mechanism:** Calls `behaviour.behaviour_info(:callbacks)` — returns a precomputed
+  list from the compiled BEAM module. No recursive traversal of the behaviour graph.
+- **Result:** CLEAN.
+
+### 2. Protocol consolidation (`lib/elixir/lib/protocol.ex`)
+- **Mechanism:** Protocol dispatch uses `__impl__/1` which is compiled into the
+  protocol module as a direct function call — O(1) dispatch.
+- `Protocol.consolidate/2` iterates `impls` list linearly — no recursive traversal.
+- **Result:** CLEAN.
+
+### 3. Import deduplication (Erlang layer, `elixir_import.erl`)
+- **File:** `lib/elixir/src/elixir_import.erl`, `ensure_no_duplicates` (line 225)
+- `lists:member({Name, Arity}, Acc)` in a fold — O(N²) over import list.
+- **N is bounded:** import lists are typically ≤100 entries per module, no diamond
+  graph structure. This is a minor quadratic scan, not an exponential diamond defect.
+- **Result:** Not CWE-407 (bounded, not graph-recursive).
+
+### 4. Macro expansion / `@impl` checking
+- **File:** `lib/elixir/lib/module/parallel_checker.ex`
+- `defining?/2` uses `Enum.any?` over a waiting list — bounded by concurrent module
+  compilation queue, not a type hierarchy depth.
+- **Result:** CLEAN for diamond recursion.
+
+### 5. Erlang runtime module loading
+- Elixir relies on Erlang/OTP module loading which tracks loaded modules in a
+  global `code_server` ETS table — O(1) lookup.
+- **Result:** CLEAN.
+
+## Conclusion
+
+No CWE-407 diamond recursion defects found in Elixir. Behaviour callbacks use
+precomputed BEAM metadata; protocol dispatch is compiled to direct calls; module
+loading uses ETS-backed sets.