threejs-0007: Node.traverse() diamond recursion O(2^D); CLEAN for webpack/valhalla/traefik/wasmer/wasmtime; count 621->622

UNDF-2026-000000468: three.js src/nodes/core/Node.js:351 traverse() recurses
without a visited set; on shared-node (diamond) TSL shader graphs yields 2^D
callback invocations. D=10 gives 4093× overhead. Fix: add optional visited Set
parameter, default new Set() at root call.

Unit test: 10/10 PASS (ThreeJSNodeTraverseTest.java)

CLEAN markers written for: webpack (visitedModules WeakSet throughout),
valhalla (Dijkstra+BFS, no recursive DAG traversal), traefik (traverse() has
proper visited map), wasmer (petgraph+BTreeMap), wasmtime (SCC algorithms).

defects/wasmtime/patch/wasmtime-diamond-recursion-CLEAN.md

@@ -0,0 +1,14 @@
+## Diamond Recursion Scan (wasmtime) — CLEAN
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `crates/wasmtime/src/compile/stratify.rs` — call graph stratification for parallel inlining — uses SCC (Strongly Connected Components) + condensation DAG. CLEAN.
+- `crates/environ/src/graphs/scc.rs` — SCC implementation, not recursive without visited set. CLEAN.
+- `crates/cranelift/src/debug/gc.rs` — `build_dependencies()` — graph-based, uses petgraph. CLEAN.
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found in wasmtime
+
+Wasmtime uses proper graph algorithm libraries (petgraph, SCC) for all module/call-graph dependency analysis. No recursive DAG traversal without visited set found.