- Dedup drops duplicates keyed by sha256(ProviderName|KeyMasked|Source) - Preserves input order and first-seen metadata (stable dedup) - Same provider+masked with different Source URLs are kept separate - Uses engine.Finding directly to avoid alias collision with Plan 09-01