## Diamond Recursion Scan (wasmer) — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `lib/wasix/src/runtime/resolver/resolve.rs` — `discover_dependencies()` — iterative BFS using `BTreeMap<PackageId, NodeIndex>` as visited map + `VecDeque` queue. CLEAN.
- Uses `petgraph::DiGraph` for the dependency graph and `petgraph::algo::toposort` for cycle detection. CLEAN.

### Verdict: CLEAN — no diamond recursion CWE-407 found in wasmer

Wasmer's package dependency resolver uses petgraph with proper BTreeMap-based node dedup. All dependency graph traversal is iterative, not recursive.
