java-topology/defects/luigi/luigi-diamond-recursion-CLEAN.md

Diamond Recursion Scan (luigi) — CLEAN (deeper scan)

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• luigi/tools/deps.py:dfs_paths — "find all paths" function; re-visiting shared nodes on different paths is intentional (not a diamond blowup defect). Covered by luigi-0001 (O(D²) set-rebuild fix). — CLEAN re diamond recursion
• luigi/execution_summary.py:_depth_first_search — uses visited set — CLEAN
• luigi/scheduler.py:_upstream_status — iterative with upstream_status_table memoization — CLEAN

Verdict: CLEAN — no NEW diamond recursion CWE-407; luigi-0001 covers existing issue