crystal-0001: collect_ancestors O(2^D) diamond traversal; clojure/elixir/nim/lua CLEAN; count 621→622

defects/lua/patch/CLEAN.md

@@ -0,0 +1,29 @@
+# Lua — CWE-407 Diamond Recursion Scan: CLEAN
+
+## Scan Date
+2026-03-29
+
+## Targets Checked
+
+### 1. Metamethod dispatch (`__index` / `__newindex` chains, `lvm.c`)
+- **File:** `lvm.c`, line 50: `#define MAXTAGLOOP 2000`
+- **Mechanism:** Tag-method chains are bounded by `MAXTAGLOOP` counter (2000 steps).
+  Any `__index` chain exceeding this triggers `luaG_runerror("'__index' chain too long")`.
+- No recursive graph traversal — iterative loop with hard cap.
+- **Result:** CLEAN (bounded by counter).
+
+### 2. Type system
+- Lua is dynamically typed. There is no compile-time type hierarchy, no module
+  inclusion graph, and no type inference pass.
+- No concept of module diamonds exists at the language level.
+- **Result:** CLEAN (not applicable).
+
+### 3. Parser (`lparser.c`)
+- Block/scope tracking uses a linked list of `BlockCnt` structs — O(depth) stack.
+  No graph traversal.
+- **Result:** CLEAN.
+
+## Conclusion
+
+No CWE-407 diamond recursion defects found in Lua. The language has no compile-time
+type graph; runtime metamethod chains are bounded by `MAXTAGLOOP`.