## Business Logic Defect Detection

> Unlike static defects, business logic defects require understanding the business semantics of the code to identify.
> This file is the detection routing table -- it locates the detection subtask subfiles to load based on code characteristics.

### Detection Routing Table

| Trigger Signals (Code Characteristics) | Detection Subtask Triggered | File |
|---------------------|-----------|------|
| Multiple write operations (insert/update/delete) without transaction wrapping | Transaction Consistency | [transaction-consistency.md](transaction-consistency.md) |
| Create/delete/status change without synchronized handling of associated data | Data Integrity | [data-integrity.md](data-integrity.md) |
| Write operations in route handlers (POST/PUT/DELETE) | Authorization Bypass + Idempotency | [authorization-bypass.md](authorization-bypass.md) [idempotency.md](idempotency.md) |
| Status field direct assignment (`obj.status = ...`) | State Machine Violation | [state-machine.md](state-machine.md) |
| Read-modify-write sequence (query then modify) | Concurrency Conflict | [concurrency-conflict.md](concurrency-conflict.md) |
| "Create if not exists" pattern (`if (!exists) then create`) | Concurrency Conflict + Idempotency | [concurrency-conflict.md](concurrency-conflict.md) [idempotency.md](idempotency.md) |
| Cache operations + database write operations coexist | Data Consistency | [data-consistency.md](data-consistency.md) |
| switch/case handling enums/status, or same concept with conditional branches in multiple places | Conditional Logic Omission | [conditional-logic.md](conditional-logic.md) |
| Pagination/batch operations (limit, batch, bulk, forEach) | Boundary Business Rules | [boundary-rules.md](boundary-rules.md) |
| Multi-step workflows (step1→step2→step3, state-machine-driven) | Workflow Defects | [workflow-defects.md](workflow-defects.md) |

### Usage

1. Read the changed code and identify the trigger signals above
2. Based on matched trigger signals, **only load** the corresponding subfiles (no need to load everything)
3. No matched trigger signals → do not execute logical defect detection
4. When the same trigger signal corresponds to multiple detection subtasks, execute by priority: Critical → High → Medium

### General Exclusion Rules

The following situations are not reported as defects:
- **Test files**: `*.test.*`, `*.spec.*`, `__tests__/` directories
- **Generated code**: `generated/`, `*.generated.*`, `node_modules/`, vendor
- **Third-party dependencies**: uncontrollable external library code
- **Clear TODO/FIXME comments**: issues already known to the developer
- **Issues detectable by static analysis/compiler**: type errors, syntax errors, undefined variables, etc. should be handled by the static defect detection routing table (`static-defects/routing.md`)
