al-sem 0.0.1

package/src/detectors/d17-min-version-drift.ts

@@ -0,0 +1,157 @@
+// src/detectors/d17-min-version-drift.ts
+import type { CombinedGraph } from "../engine/combined-graph.ts";
+import { compareStrings } from "../engine/uncertainty-util.ts";
+import { roleOf } from "../model/entities.ts";
+import type { DetectorStats, Finding } from "../model/finding.ts";
+import type { SemanticModel } from "../model/model.ts";
+import { fingerprintOf } from "../projection/finding-fingerprint.ts";
+import { toConfidence } from "./confidence.ts";
+import type { DetectorContext } from "./detector-context.ts";
+
+/**
+ * Compare two BC version strings ("X.Y.Z.W"). Returns -1, 0, 1. Missing components
+ * are treated as 0 so "24" < "24.1" < "24.1.0.0" correctly.
+ */
+function cmpVersion(a: string, b: string): number {
+	const pa = a.split(".").map((x) => Number.parseInt(x, 10) || 0);
+	const pb = b.split(".").map((x) => Number.parseInt(x, 10) || 0);
+	const len = Math.max(pa.length, pb.length);
+	for (let i = 0; i < len; i++) {
+		const da = pa[i] ?? 0;
+		const db = pb[i] ?? 0;
+		if (da !== db) return da < db ? -1 : 1;
+	}
+	return 0;
+}
+
+/**
+ * D17 — MinVersion vs resolved-Version drift (Outcome-B precision).
+ *
+ * For each dep declared in the primary app's app.json dependencies[], compare the
+ * declared minVersion against the actual resolved app version
+ * (SemanticModel.apps[].version). If resolved > declared AND the primary app
+ * actually calls into that dep, emit one info finding per drifting dep.
+ *
+ * Per-routine sinceVersion is deferred: SymbolReference.json doesn't carry it.
+ */
+export function detectD17(
+	model: SemanticModel,
+	graph: CombinedGraph,
+	ctx: DetectorContext,
+): { findings: Finding[]; stats: DetectorStats } {
+	const findings: Finding[] = [];
+	const declared = model.identity.primaryDependencies ?? [];
+	if (declared.length === 0) {
+		return {
+			findings,
+			stats: {
+				detector: "d17-min-version-drift",
+				candidatesConsidered: 0,
+				findingsEmitted: 0,
+				skipped: {},
+			},
+		};
+	}
+
+	const appByGuid = new Map(model.apps.map((a) => [a.appGuid, a]));
+	const objectsById = ctx.objectsById;
+	const routinesById = ctx.routineById;
+
+	const calledDepGuids = new Set<string>();
+	const sampleCallsiteByDep = new Map<
+		string,
+		{
+			callerRoutineId: string;
+			calleeRoutineName: string;
+			anchor: (typeof model.routines)[number]["sourceAnchor"];
+		}
+	>();
+	for (const [, edges] of graph.edgesByFrom) {
+		for (const e of edges) {
+			const caller = routinesById.get(e.from);
+			const callee = routinesById.get(e.to);
+			if (!caller || !callee) continue;
+			if (roleOf(caller) !== "primary") continue;
+			const callerObj = objectsById.get(caller.objectId);
+			const calleeObj = objectsById.get(callee.objectId);
+			if (!callerObj || !calleeObj) continue;
+			if (callerObj.appGuid === calleeObj.appGuid) continue;
+			calledDepGuids.add(calleeObj.appGuid);
+			if (!sampleCallsiteByDep.has(calleeObj.appGuid)) {
+				const cs = caller.features.callSites.find((c) => c.id === e.callsiteId);
+				sampleCallsiteByDep.set(calleeObj.appGuid, {
+					callerRoutineId: caller.id,
+					calleeRoutineName: callee.name,
+					anchor: cs?.sourceAnchor ?? caller.sourceAnchor,
+				});
+			}
+		}
+	}
+
+	let candidatesConsidered = 0;
+	let skippedOther = 0;
+	for (const dep of declared) {
+		candidatesConsidered++;
+		const resolved = appByGuid.get(dep.appGuid);
+		if (resolved === undefined) {
+			skippedOther++;
+			continue;
+		}
+		if (cmpVersion(resolved.version, dep.minVersion) <= 0) {
+			skippedOther++;
+			continue;
+		}
+		if (!calledDepGuids.has(dep.appGuid)) {
+			skippedOther++;
+			continue;
+		}
+		const sample = sampleCallsiteByDep.get(dep.appGuid);
+		if (sample === undefined) {
+			skippedOther++;
+			continue;
+		}
+		const callerRoutine = routinesById.get(sample.callerRoutineId);
+		if (!callerRoutine) {
+			skippedOther++;
+			continue;
+		}
+		const finding: Finding = {
+			id: `d17/${dep.appGuid}`,
+			rootCauseKey: `d17/${dep.appGuid}`,
+			detector: "d17-min-version-drift",
+			title: "Declared MinVersion is older than the resolved dependency version",
+			rootCause: `${callerRoutine.name} calls into ${dep.name} (${dep.appGuid}). app.json declares MinVersion ${dep.minVersion} for this dependency, but the resolved .app is at version ${resolved.version} — your code may use APIs that don't exist on older tenants.`,
+			severity: "info",
+			confidence: toConfidence([], "possible"),
+			primaryLocation: sample.anchor,
+			evidencePath: [
+				{
+					routineId: sample.callerRoutineId,
+					sourceAnchor: sample.anchor,
+					note: `calls ${sample.calleeRoutineName} in ${dep.name} ${resolved.version} (declared MinVersion ${dep.minVersion})`,
+				},
+			],
+			affectedObjects: [callerRoutine.objectId].sort(),
+			affectedTables: [],
+			fixOptions: [
+				{
+					description: `Bump app.json dependencies[].version for ${dep.name} to at least ${resolved.version}, or test that your code paths into this dep also work on ${dep.minVersion}.`,
+					safety: "medium",
+				},
+			],
+			provenance: [{ source: "tree-sitter" }],
+		};
+		finding.fingerprint = fingerprintOf(finding, model);
+		findings.push(finding);
+	}
+
+	return {
+		findings: findings.sort((a, b) => compareStrings(a.id, b.id)),
+		stats: {
+			detector: "d17-min-version-drift",
+			candidatesConsidered,
+			findingsEmitted: findings.length,
+			skipped: { other: skippedOther > 0 ? skippedOther : undefined },
+		},
+	};
+}

package/src/detectors/d18-constant-filter-in-loop.ts

@@ -0,0 +1,151 @@
+import type { CombinedGraph } from "../engine/combined-graph.ts";
+import { compareStrings } from "../engine/uncertainty-util.ts";
+import { roleOf } from "../model/entities.ts";
+import type { RecordOperation } from "../model/entities.ts";
+import { isLiteralExpression, unquotedFieldName } from "../model/expression.ts";
+import type { DetectorStats, EvidenceStep, Finding } from "../model/finding.ts";
+import type { SemanticModel } from "../model/model.ts";
+import { fingerprintOf } from "../projection/finding-fingerprint.ts";
+import { toConfidence } from "./confidence.ts";
+import type { DetectorContext } from "./detector-context.ts";
+
+const FILTER_OPS: ReadonlySet<string> = new Set(["SetRange", "SetFilter"]);
+
+/**
+ * A "literal" argument that does not depend on any loop variable — the same
+ * value is produced every iteration. Conservative matcher (see
+ * `model/expression.ts → isLiteralExpression`):
+ *  - quoted string (`'value'` or `"value"`)
+ *  - numeric literal (with optional unary `+` / `-`)
+ *  - boolean (`true` / `false`)
+ *  - enum literal `Type::Member`
+ *
+ * Identifiers and calls fall through to non-literal — we cannot prove the value
+ * is loop-invariant without dataflow we don't have. Better silent than wrong.
+ */
+
+/**
+ * D18 — flag `SetRange` / `SetFilter` inside a loop whose every argument after the
+ * field name is a literal. The same filter is applied every iteration with no
+ * dependency on the iterating variable; the call can be hoisted out of the loop.
+ *
+ * Skipped:
+ *  - temporary records (`tempState: { kind: "known", value: true }`) — the state
+ *    cost is in-memory and negligible;
+ *  - any non-literal value argument — we cannot statically prove loop-invariance.
+ *
+ * Dedup key: (routineId, loopId, recordVar, fieldName) — multiple identical sets
+ * inside the same loop produce one finding.
+ */
+export function detectD18(
+	model: SemanticModel,
+	_graph: CombinedGraph,
+	_ctx: DetectorContext,
+): { findings: Finding[]; stats: DetectorStats } {
+	const findings: Finding[] = [];
+	const seen = new Set<string>();
+	let candidatesConsidered = 0;
+	let skippedNonLiteral = 0;
+	let skippedTempRecord = 0;
+
+	for (const routine of model.routines) {
+		if (roleOf(routine) !== "primary") continue;
+		if (!routine.bodyAvailable) continue;
+		if (routine.parseIncomplete) continue;
+		candidatesConsidered++;
+
+		const loopById = new Map(routine.features.loops.map((l) => [l.id, l]));
+
+		for (const op of routine.features.recordOperations) {
+			if (!FILTER_OPS.has(op.op)) continue;
+			if (op.loopStack.length === 0) continue;
+			if (op.tempState.kind === "known" && op.tempState.value === true) {
+				skippedTempRecord++;
+				continue;
+			}
+			const infos = op.fieldArgumentInfos ?? [];
+			if (infos.length < 2) continue; // unrenderable — bail
+			const valueArgs = infos.slice(1);
+			if (!valueArgs.every(isLiteralExpression)) {
+				skippedNonLiteral++;
+				continue;
+			}
+
+			const representativeLoop = op.loopStack.at(-1);
+			if (representativeLoop === undefined) continue;
+			const loop = loopById.get(representativeLoop);
+			if (loop === undefined) continue;
+			const recordVar = op.recordVariableName.toLowerCase();
+			const fieldInfo = infos[0];
+			if (fieldInfo === undefined) continue;
+			const fieldName = fieldInfo.text.trim();
+			const dedupKey = `${routine.id}|${loop.id}|${recordVar}|${unquotedFieldName(fieldInfo)}`;
+			if (seen.has(dedupKey)) continue;
+			seen.add(dedupKey);
+
+			emit(routine, loop, op, fieldName, findings, model);
+		}
+	}
+
+	const sorted = findings.sort((a, b) => compareStrings(a.id, b.id));
+	return {
+		findings: sorted,
+		stats: {
+			detector: "d18-constant-filter-in-loop",
+			candidatesConsidered,
+			findingsEmitted: sorted.length,
+			skipped: {
+				...(skippedNonLiteral > 0 ? { nonLiteralArgs: skippedNonLiteral } : {}),
+				...(skippedTempRecord > 0 ? { tempRecord: skippedTempRecord } : {}),
+			},
+		},
+	};
+}
+
+function emit(
+	routine: { id: string; objectId: string; name: string; sourceAnchor: unknown },
+	loop: { id: string; type: string; sourceAnchor: unknown },
+	op: RecordOperation,
+	fieldName: string,
+	findings: Finding[],
+	model: SemanticModel,
+): void {
+	const path: EvidenceStep[] = [
+		{
+			routineId: routine.id,
+			loopId: loop.id,
+			sourceAnchor: loop.sourceAnchor as EvidenceStep["sourceAnchor"],
+			note: `${loop.type} loop`,
+		},
+		{
+			routineId: routine.id,
+			operationId: op.id,
+			sourceAnchor: op.sourceAnchor,
+			note: `${op.op}(${op.fieldArguments?.join(", ") ?? ""}) on ${op.recordVariableName}`,
+		},
+	];
+
+	const finding: Finding = {
+		id: `d18/${routine.id}/${loop.id}/${op.recordVariableName.toLowerCase()}/${fieldName.toLowerCase()}`,
+		rootCauseKey: `d18/${routine.id}/${loop.id}/${op.recordVariableName.toLowerCase()}/${fieldName.toLowerCase()}`,
+		detector: "d18-constant-filter-in-loop",
+		title: "Constant filter applied inside a loop",
+		rootCause: `${routine.name} calls ${op.op} on ${op.recordVariableName}.${fieldName} with literal arguments inside a ${loop.type} loop — the filter is identical every iteration and can be hoisted outside.`,
+		severity: "low",
+		confidence: toConfidence([], "likely"),
+		primaryLocation: op.sourceAnchor,
+		evidencePath: path,
+		affectedObjects: [routine.objectId],
+		affectedTables: op.tableId !== undefined ? [op.tableId] : [],
+		fixOptions: [
+			{
+				description:
+					"Move the SetRange/SetFilter call outside the loop. The filter state persists across iterations until reset or cleared.",
+				safety: "high",
+			},
+		],
+		provenance: [{ source: "tree-sitter" }],
+	};
+	finding.fingerprint = fingerprintOf(finding, model);
+	findings.push(finding);
+}

package/src/detectors/d19-unused-parameter.ts

@@ -0,0 +1,116 @@
+import type { CombinedGraph } from "../engine/combined-graph.ts";
+import { compareStrings } from "../engine/uncertainty-util.ts";
+import { roleOf } from "../model/entities.ts";
+import type { Routine } from "../model/entities.ts";
+import type { DetectorStats, EvidenceStep, Finding } from "../model/finding.ts";
+import type { SemanticModel } from "../model/model.ts";
+import { fingerprintOf } from "../projection/finding-fingerprint.ts";
+import { toConfidence } from "./confidence.ts";
+import type { DetectorContext } from "./detector-context.ts";
+
+/**
+ * D19 — declared procedure parameter never referenced in the routine body.
+ *
+ * Restricted to forms where the signal is precise:
+ *   - `procedure` only (NOT triggers, NOT event subscribers — the latter's signature
+ *     is dictated by the publisher and must keep every parameter declared, even unused).
+ *
+ * Detection: the L2 indexer walks the routine body and collects every identifier
+ * referenced as a *value* into `features.identifierReferences` (lowercased, sorted,
+ * deduped). Field names, enum member names, and bare type names in enum-type
+ * position are excluded by construction. A parameter whose lowercased name is
+ * absent from that set is unreferenced.
+ *
+ * Severity: `info` — hygiene, not correctness.
+ */
+export function detectD19(
+	model: SemanticModel,
+	_graph: CombinedGraph,
+	_ctx: DetectorContext,
+): { findings: Finding[]; stats: DetectorStats } {
+	const findings: Finding[] = [];
+	let candidatesConsidered = 0;
+	let skippedEventSubscriber = 0;
+	let skippedTrigger = 0;
+
+	for (const routine of model.routines) {
+		if (roleOf(routine) !== "primary") continue;
+		if (!routine.bodyAvailable) continue;
+		if (routine.parseIncomplete) continue;
+		if (routine.kind === "trigger") {
+			skippedTrigger++;
+			continue;
+		}
+		if (routine.kind === "event-subscriber") {
+			skippedEventSubscriber++;
+			continue;
+		}
+		if (routine.parameters.length === 0) continue;
+		candidatesConsidered++;
+
+		const refs = new Set(routine.features.identifierReferences);
+		for (const param of routine.parameters) {
+			const lc = param.name.toLowerCase();
+			if (lc === "") continue; // unnamed slot — never flag
+			if (refs.has(lc)) continue;
+			const path: EvidenceStep[] = [
+				{
+					routineId: routine.id,
+					sourceAnchor: routine.sourceAnchor,
+					note: `parameter '${param.name}: ${param.typeText}' declared but never referenced`,
+				},
+			];
+			findings.push(makeFinding(routine, param, path, model));
+		}
+	}
+
+	const sorted = findings.sort((a, b) => compareStrings(a.id, b.id));
+	return {
+		findings: sorted,
+		stats: {
+			detector: "d19-unused-parameter",
+			candidatesConsidered,
+			findingsEmitted: sorted.length,
+			skipped: {
+				...(skippedTrigger > 0 ? { trigger: skippedTrigger } : {}),
+				...(skippedEventSubscriber > 0 ? { eventSubscriber: skippedEventSubscriber } : {}),
+			},
+		},
+	};
+}
+
+function makeFinding(
+	routine: Routine,
+	param: Routine["parameters"][number],
+	path: EvidenceStep[],
+	model: SemanticModel,
+): Finding {
+	const finding: Finding = {
+		id: `d19/${routine.id}/p${param.index}`,
+		rootCauseKey: `d19/${routine.id}/p${param.index}`,
+		detector: "d19-unused-parameter",
+		title: "Procedure parameter is never used",
+		rootCause: `${routine.name} declares parameter '${param.name}' (${param.typeText}) at position ${param.index} but the body never references it.`,
+		severity: "info",
+		// Confidence upgraded from "possible" to "likely" — `identifierReferences`
+		// covers scalar parameter uses too (the pre-PR-5 fragment scan only saw
+		// record/call/field-access positions, which is why scalar params were
+		// excluded entirely). Now record AND scalar params are checked from the
+		// same precise structural signal.
+		confidence: toConfidence([], "likely"),
+		primaryLocation: routine.sourceAnchor,
+		evidencePath: path,
+		affectedObjects: [routine.objectId],
+		affectedTables: [],
+		fixOptions: [
+			{
+				description:
+					"Remove the parameter, or wire it into the procedure body. If callers must keep the existing signature, leave it and silence with an `_` prefix on the name.",
+				safety: "low",
+			},
+		],
+		provenance: [{ source: "tree-sitter" }],
+	};
+	finding.fingerprint = fingerprintOf(finding, model);
+	return finding;
+}

package/src/detectors/d2-event-fanout-in-loop.ts

@@ -0,0 +1,240 @@
+import type { CombinedGraph } from "../engine/combined-graph.ts";
+import { classifyOp, isDbTouchingClass } from "../engine/op-classification.ts";
+import type { Terminal, WalkPolicy } from "../engine/path-walker.ts";
+import { walkEvidence } from "../engine/path-walker.ts";
+import { resolvePublishedEvent } from "../engine/summary-engine.ts";
+import { compareStrings, dedupeUncertainties } from "../engine/uncertainty-util.ts";
+import { roleOf } from "../model/entities.ts";
+import type { RecordOperation } from "../model/entities.ts";
+import type { DetectorStats, EvidenceStep, Finding } from "../model/finding.ts";
+import type { RoutineId } from "../model/ids.ts";
+import type { SemanticModel } from "../model/model.ts";
+import type { Uncertainty } from "../model/summary.ts";
+import { fingerprintOf } from "../projection/finding-fingerprint.ts";
+import { touchesDbOf, writesTablesOf } from "./capability-query.ts";
+import { toConfidence } from "./confidence.ts";
+import type { DetectorContext } from "./detector-context.ts";
+import { mergeByTerminal } from "./path-merge.ts";
+import { describeTable } from "./table-display.ts";
+
+const BOUNDS = { maxDepth: 20, maxNodes: 500 };
+
+interface D2Terminal extends Terminal {
+	op: RecordOperation;
+}
+
+/** D2: find an event raised inside a loop whose subscribers touch the database. */
+export function detectD2(
+	model: SemanticModel,
+	graph: CombinedGraph,
+	ctx: DetectorContext,
+): { findings: Finding[]; stats: DetectorStats } {
+	const findings: Finding[] = [];
+	const { routineById, objectsById: objectById } = ctx;
+	const publisherRoutineIds = new Set(
+		model.routines.filter((r) => r.kind === "event-publisher").map((r) => r.id),
+	);
+	let candidatesConsidered = 0;
+	let skippedOpaqueCallee = 0;
+	let skippedDynamicDispatch = 0;
+	let skippedParseIncomplete = 0;
+	let unresolvedSubscriber = 0;
+
+	const policy: WalkPolicy<D2Terminal> = {
+		terminalsAt: (node) => {
+			const r = routineById.get(node);
+			if (r === undefined) return [];
+			return r.features.recordOperations
+				.filter((op) => isDbTouchingClass(classifyOp(op.op)))
+				.map((op) => ({ routineId: node, localLoopDepth: op.loopStack.length, op }));
+		},
+		expand: (node) =>
+			(graph.edgesByFrom.get(node) ?? []).filter((e) => {
+				if (e.kind === "event-dispatch") return false;
+				const to = routineById.get(e.to);
+				return to?.summary !== undefined && touchesDbOf(to.summary) !== "no";
+			}),
+		buildHopStep: (edge) => {
+			const fromRoutine = routineById.get(edge.from);
+			const cs = fromRoutine?.features.callSites.find((c) => c.id === edge.callsiteId);
+			const toName = routineById.get(edge.to)?.name ?? edge.to;
+			const triggerNote =
+				edge.kind === "implicit-trigger" ? ` (via implicit ${toName} trigger)` : "";
+			return {
+				routineId: edge.from,
+				callsiteId: edge.callsiteId,
+				sourceAnchor: cs?.sourceAnchor ??
+					fromRoutine?.sourceAnchor ?? {
+						sourceUnitId: "",
+						range: { startLine: 0, startColumn: 0, endLine: 0, endColumn: 0 },
+						enclosingRoutineId: edge.from,
+						syntaxKind: "call",
+					},
+				note: `calls ${toName}${triggerNote}`,
+			};
+		},
+		buildTerminalStep: (t) => ({
+			routineId: t.routineId,
+			operationId: t.op.id,
+			sourceAnchor: t.op.sourceAnchor,
+			note: `${t.op.op} on ${describeTable(t.op, routineById.get(t.routineId), ctx.tableById)}`,
+		}),
+	};
+
+	for (const routine of model.routines) {
+		if (roleOf(routine) !== "primary") continue;
+		if (!routine.bodyAvailable) continue;
+		if (routine.parseIncomplete) {
+			skippedParseIncomplete++;
+			continue;
+		}
+		candidatesConsidered++;
+		for (const cs of routine.features.callSites) {
+			if (cs.loopStack.length === 0) continue; // publish must be inside a loop
+			const edge = (graph.edgesByFrom.get(routine.id) ?? []).find((e) => e.callsiteId === cs.id);
+			if (edge === undefined) {
+				// No resolved edge in a loop — opaque callee
+				skippedOpaqueCallee++;
+				continue;
+			}
+			if (edge.kind === "interface" || edge.kind === "dynamic") {
+				skippedDynamicDispatch++;
+				continue;
+			}
+			if (!publisherRoutineIds.has(edge.to)) continue; // not an event publish
+			const eventId = resolvePublishedEvent(cs.operationId, model);
+			if (eventId === undefined) continue;
+
+			const subEdges = (graph.edgesByFrom.get(edge.to) ?? []).filter(
+				(e) => e.kind === "event-dispatch" && e.eventId === eventId,
+			);
+			const eventName = model.eventGraph.events.find((s) => s.id === eventId)?.eventName ?? eventId;
+
+			const loopId = cs.loopStack[cs.loopStack.length - 1];
+			const loopStep: EvidenceStep = {
+				routineId: routine.id,
+				loopId,
+				callsiteId: cs.id,
+				sourceAnchor: cs.sourceAnchor,
+				note: `loop raises event ${eventName}`,
+			};
+
+			const subscriberSteps: EvidenceStep[] = [];
+			const affectedObjects = new Set<string>([routine.objectId]);
+			const affectedTables = new Set<string>();
+			const uncertainties: Uncertainty[] = [];
+			let anyDbSubscriber = false;
+			let allResolved = true;
+
+			for (const subEdge of subEdges) {
+				if (subEdge.resolution !== "resolved") allResolved = false;
+				const subRoutine = routineById.get(subEdge.to);
+				if (subRoutine === undefined) {
+					unresolvedSubscriber++;
+					continue;
+				}
+				if (!subRoutine.bodyAvailable) {
+					allResolved = false;
+					continue;
+				}
+				if (subRoutine.summary === undefined || touchesDbOf(subRoutine.summary) === "no") continue;
+				// The subscriber's summary-level `touchesDb: "yes"` is the witness; the deep walk
+				// below is supplementary evidence that locates the exact op site.
+				const subSummary = subRoutine.summary;
+				anyDbSubscriber = true;
+				affectedObjects.add(subRoutine.objectId);
+				for (const u of subSummary.uncertainties) uncertainties.push(u);
+				for (const t of writesTablesOf(subSummary)) affectedTables.add(t);
+				const subObjectName = objectById.get(subRoutine.objectId)?.name ?? subRoutine.objectId;
+				subscriberSteps.push({
+					routineId: subRoutine.id,
+					sourceAnchor: subRoutine.sourceAnchor,
+					note: `subscriber ${subRoutine.name} in ${subObjectName} (app ${subEdge.subscriberAppId}) touches the database`,
+				});
+				const results = walkEvidence(subRoutine.id, policy, BOUNDS, graph, model, {
+					routineById,
+					uncertaintyEdgesByFrom: ctx.uncertaintyEdgesByFrom,
+					callSiteById: ctx.callSiteById,
+				});
+				const complete = results.find((r) => r.stop === "complete");
+				if (complete !== undefined) {
+					subscriberSteps.push(...complete.path);
+					for (const u of complete.uncertainties) uncertainties.push(u);
+					const term = complete.path.at(-1);
+					const termOp =
+						term?.operationId !== undefined
+							? routineById
+									.get(term.routineId)
+									?.features.recordOperations.find((o) => o.id === term.operationId)
+							: undefined;
+					if (termOp?.tableId !== undefined) affectedTables.add(termOp.tableId);
+				}
+			}
+
+			if (!anyDbSubscriber) continue;
+
+			const baseLevel = allResolved ? "likely" : "possible";
+			// Two keys, two purposes (mirrors D1):
+			//   `id`           per-(loop, eventId) — drops within-walker duplicates
+			//                  when the same loop publishes the same event from two
+			//                  callsites.
+			//   `rootCauseKey` per-eventId — used by mergeByTerminal to fold M
+			//                  different loops publishing the same event into ONE
+			//                  finding with the others in additionalPaths. The bug
+			//                  entity is the event with DB-touching subscribers; the
+			//                  loops are supporting traces. Fixing the subscribers
+			//                  cheap-ifies all callsites at once.
+			const d2finding: Finding = {
+				id: `d2/${loopId}/${eventId}`,
+				rootCauseKey: `d2/${eventId}`,
+				detector: "d2-event-fanout-in-loop",
+				title: "Event raised inside a loop fans out to database work",
+				rootCause: `${routine.name} raises ${eventName} inside a loop; subscribers touch the database every iteration.`,
+				severity: "high",
+				confidence: toConfidence(dedupeUncertainties(uncertainties), baseLevel),
+				primaryLocation: cs.sourceAnchor,
+				evidencePath: [loopStep, ...subscriberSteps],
+				affectedObjects: [...affectedObjects].sort(),
+				affectedTables: [...affectedTables].sort(),
+				fixOptions: [
+					{
+						description:
+							"Raise the event once outside the loop, or batch the work the subscribers do.",
+						safety: "medium",
+					},
+				],
+				provenance: [{ source: "tree-sitter" }],
+			};
+			// Fingerprint deferred until AFTER mergeByTerminal — affectedObjects /
+			// affectedTables are unioned across paths.
+			findings.push(d2finding);
+		}
+	}
+
+	// Two-stage collapse (mirrors D1):
+	//   1. Dedupe by id (loop+event pair) — drops within-walker duplicates.
+	//   2. mergeByTerminal — folds different loops on the same event into a
+	//      single Finding with additionalPaths.
+	const seen = new Set<string>();
+	const deduped: Finding[] = [];
+	for (const f of findings) {
+		if (seen.has(f.id)) continue;
+		seen.add(f.id);
+		deduped.push(f);
+	}
+	const merged = mergeByTerminal(deduped);
+	for (const f of merged) f.fingerprint = fingerprintOf(f, model);
+	const sorted = merged.sort((a, b) => compareStrings(a.id, b.id));
+	const stats: DetectorStats = {
+		detector: "d2-event-fanout-in-loop",
+		candidatesConsidered,
+		findingsEmitted: sorted.length,
+		skipped: {
+			...(skippedOpaqueCallee > 0 ? { opaqueCallee: skippedOpaqueCallee } : {}),
+			...(skippedDynamicDispatch > 0 ? { dynamicDispatch: skippedDynamicDispatch } : {}),
+			...(skippedParseIncomplete > 0 ? { parseIncomplete: skippedParseIncomplete } : {}),
+			...(unresolvedSubscriber > 0 ? { unresolvedSubscriber } : {}),
+		},
+	};
+	return { findings: sorted, stats };
+}