## Diamond Recursion Scan (wasmtime) — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `crates/wasmtime/src/compile/stratify.rs` — call graph stratification for parallel inlining — uses SCC (Strongly Connected Components) + condensation DAG. CLEAN.
- `crates/environ/src/graphs/scc.rs` — SCC implementation, not recursive without visited set. CLEAN.
- `crates/cranelift/src/debug/gc.rs` — `build_dependencies()` — graph-based, uses petgraph. CLEAN.

### Verdict: CLEAN — no diamond recursion CWE-407 found in wasmtime

Wasmtime uses proper graph algorithm libraries (petgraph, SCC) for all module/call-graph dependency analysis. No recursive DAG traversal without visited set found.
