java-topology/defects/ray/ray-diamond-recursion-CLEAN.md

Diamond Recursion Scan (ray) — CLEAN (deeper scan)

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• python/ray/dag/dag_node.py:apply_recursive — uses UUID cache (_CachingFn) for memoization — CLEAN
• python/ray/dag/dag_node.py:traverse_and_apply — uses visited = set() — CLEAN
• python/ray/dag/vis_utils.py:_dfs — delegates to apply_recursive (cached) — CLEAN
• python/ray/workflow/ — empty (only init.py) — CLEAN

Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing ray-0001